Active EV-CAN sampling: cell voltages, pack temperatures...

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
garygid said:
GregH,
So, it looks like the raw temp data will indicate
a precision of very near a tenth of a degree C,
even if we do not know much yet about the accuracy.

Akso, it seems that tell Pack temperature Bar display
operates on the highest temperature, and there is
essentially no hysteresis.

So, using the raw values, we might try to display the
extended-precision temperatures, like "C20. 3".

In the CANary, scrolling plots of the 4 high-precision
temperatures on one graph would be very interesting.
Click to expand...

Yes. Just the other night I did see the highest temp reach 25.0 and even 25.1 and the 6th temp bar never came on... but in the past I'd seen it click on at 25.0 and off again at 24.9 so I believe the hysteresis (or lack thereof) is correct. I've been displaying temp to 0.1 degrees C now for about a week and it's certainly more entertaining than just using the car's 1.0 precision. There is a +/-0.1 error if you repeatedly sample but you can certainly discern temp changes of 0.2 degrees C or more. With the increased screen real estate on CANary you could certainly do a lot with this. Due to my limited screen space I'm just displaying Tmax (which is almost always T1 or T2, the front stack) as well as the delta from Tmax to Tmin just to get a sense of the spread..

Note I've been editing the post a few back to update the observed transition points for temperature conversion. I look forward to seeing data from folks in warmer or cooler climates so I can tweak my software for optimal precision... On my group 4 page I show the raw data, the car's temp (Celsius 1.0 precision), and my calculated temp (Celsius 0.1 precision) such as:
473 24 24.4
476 34 24.1
493 22 22.4
491 22 22.6
(my current battery temps)
And my main page shows 24.4-2.0
 
It just occurred to me that one of these groups of "Battery" data
might contain 96 bits to indicate which of the cell-pairs have
their "equalizing" shunt active, bleeding off excess charge
from the highest-voltage cells.

The data might look like 12 bytes of all zero data most the time.

These shuts are most likely to be active when some cells
are noticeably to the high side of the CP histogram.
 
Has anybody experimented with other Request commands,
perhaps 79C instead of 79B, using the same format for Group 1?

Just one ping please, to see if anything in the 7xx range comes back?
 
garygid said:
It just occurred to me that one of these groups of "Battery" data
might contain 96 bits to indicate which of the cell-pairs have
their "equalizing" shunt active, bleeding off excess charge
from the highest-voltage cells.

The data might look like 12 bytes of all zero data most the time.

These shuts are most likely to be active when some cells
are noticeably to the high side of the CP histogram.
Click to expand...

I've looked for this.. so far can't find any sign of it but I'm sure it's in there in some form.

Used the DCQC in Azusa Friday and later in the day got to 34 degrees, a new record :/
(will update the first post with new exact readings for 31-34 degrees C)

Also noted that at a full charge later in the day (L2) got to 278 Gids at 95.3% SOC :(
Seeing as how all of my prior 281 readings where at 95.4%, I'm guessing my days of seeing 281 are over.. Fun while it lasted.
 
garygid said:
Has anybody experimented with other Request commands,
perhaps 79C instead of 79B, using the same format for Group 1?

Just one ping please, to see if anything in the 7xx range comes back?
Click to expand...

Looks like there are also controllers at:
0x744
0x746
0x784
0x792
0x79d
.. I haven't tried pinging any yet, but based on my time with the Consult tool I did see activity there..
 
I received my $11.35 eBay ELM 1.5 BT dongle today http://www.ebay.com/itm/310651672153?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1439.l2649

This is my first time playing with an ELM327, so I might have done something wrong, but it appears that I got data for groups 0 and 6-9.
Here is a log of my entire session:

Code: 
>atz
ÿ

ELM327 v1.5

>at sp 6
OK

>at h1 
OK

>at d1
OK

>at sh 79b
OK

>at fc sh 79b
OK

>at fc sd 30 00 20
OK

>at fc sm 1
OK

>21 00
7BB 8 06 61 00 FF 80 00 01 

>21 01
7BB 8 10 29 61 01 00 00 00 95 
7BB 8 21 02 88 00 00 02 9C FF 
7BB 8 22 FF FF FF 0F 90 2A F8 
7BB 8 23 91 2F 2D 1C 03 9F 00 
7BB 8 24 5C 21 81 00 06 18 0F 
7BB 8 25 00 08 DD 59 80 00 01 

>21 02
7BB 8 10 C6 61 02 0F 22 0F 20 
7BB 8 21 0F 20 0F 21 0F 24 0F 
7BB 8 22 21 0F 20 0F 22 0F 1D 
7BB 8 23 0F 1D 0F 18 0F 15 0F 
7BB 8 24 1D 0F 1E 0F 14 0F 1E 
7BB 8 25 0F 1B 0F 1B 0F 20 0F 
7BB 8 26 1D 0F 1E 0F 1F 0F 1A 
7BB 8 27 0F 1A 0F 1D 0F 1E 0F 
7BB 8 28 19 0F 15 0F 1E 0F 1F 
7BB 8 29 0F 1D 0F 15 0F 25 0F 
7BB 8 2A 25 0F 1B 0F 20 0F 24 
7BB 8 2B 0F 20 0F 16 0F 1C 0F 
7BB 8 2C 21 0F 22 0F 1B 0F 1D 
7BB 8 2D 0F 1D 0F 21 0F 1D 0F 
7BB 8 2E 18 0F 1B 0F 1D 0F 18 
7BB 8 2F 0F 19 0F 26 0F 22 0F 
7BB 8 20 24 0F 23 0F 20 0F 20 
7BB 8 21 0F 20 0F 21 0F 27 0F 
7BB 8 22 23 0F 23 0F 23 0F 20 
7BB 8 23 0F 24 0F 20 0F 21 0F 
7BB 8 24 22 0F 22 0F 21 0F 22 
7BB 8 25 0F 24 0F 1D 0F 21 0F 
7BB 8 26 22 0F 24 0F 24 0F 29 
7BB 8 27 0F 22 0F 1D 0F 1D 0F 
7BB 8 28 1D 0F 1E 0F 24 0F 22 
7BB 8 29 0F 21 0F 21 0F 27 0F 
7BB 8 2A 26 0F 29 0F 27 0F 27 
7BB 8 2B 0F 26 0F 26 0F 26 91 
7BB 8 2C 68 91 59 FF FF FF FF 

>21 03
7BB 8 10 1C 61 03 0E FC 02 87 
7BB 8 21 00 DC 00 06 1A 85 0F 
7BB 8 22 2B 0F 14 00 00 C5 00 
7BB 8 23 00 00 00 00 00 00 00 
7BB 8 24 01 FF FF FF FF FF FF 

>21 04
7BB 8 10 10 61 04 01 EE 16 01 
7BB 8 21 F4 15 01 F8 15 01 FB 
7BB 8 22 15 14 00 FF FF FF FF 

>21 05
7BB 8 10 47 61 05 02 7D 01 FF 
7BB 8 21 01 9A 0E FD 0E FC 01 
7BB 8 22 EE 01 F3 01 F9 01 FB 
7BB 8 23 02 86 00 00 00 D0 03 
7BB 8 24 9E 00 32 00 32 00 32 
7BB 8 25 00 32 00 32 00 32 00 
7BB 8 26 32 00 32 00 32 00 32 
7BB 8 27 03 D0 03 D1 03 D0 03 
7BB 8 28 D0 03 D1 03 D0 03 D2 
7BB 8 29 03 CF 03 D0 03 CF AA 
7BB 8 2A AA 00 FF FF FF FF FF 

>21 06
7BB 8 10 1A 61 06 00 00 00 00 
7BB 8 21 00 00 00 00 00 00 00 
7BB 8 22 00 00 00 00 00 00 00 
7BB 8 23 00 00 00 00 00 00 FF 

>21 07
7BB 8 10 0A 61 07 13 F6 26 A1 
7BB 8 21 75 78 01 FF FF FF FF 

>21 08
7BB 8 05 61 08 00 00 00 

>21 09
7BB 8 07 61 09 54 00 00 FF FF 

>21 0a
7BB 8 03 7F 21 12 

>21 0b
7BB 8 03 7F 21 12 

>21 0c
7BB 8 03 7F 21 12 

>21 0d
7BB 8 03 7F 21 12 

>21 0e
7BB 8 03 7F 21 12 

>21 0f
7BB 8 03 7F 21 12 

>21 10
7BB 8 03 7F 21 12

Group 0: 1 line of data
Group 6: 4 lines
Group 7: 2 lines
Group 8: 1 line with only 6 bytes of data
Group 9: 1 line
Groups 0a-10 appear to be garbage, probably some sort of error message indicating an out of range group.
 
For Groups 0 and 8+, the first byte is not the initial
index 0x10, but a count of the following visible bytes.

So, the 1st byte = 0x10 indicates that there are additional
responses, and a value of 1 to 7 would seem to be just
the count of the following "used" data bytes in that single response.

So, all the responses appear to be real responses, with
Group 0, 8, and 9 having some real response data, yet to be
understood.

The other responses appear to be "real", probably an Error code
indicating that the responder does not expect to handle that request.

However, if the response message really has a length 8, then why does
the ELM327 output them as short "messages"?

Perhaps the length byte shown (as 8) is not correct?
 
The second byte in the first response (after the 0x10) appears
to be the number of "used" data bytes that follow...

Counting 6 bytes for the first message, 7 bytes for each following
response (except for the last), and N<8 bytes for the last response.
 
garygid said:
Group 6, with 24 bytes of zero data, at two bits per cell-pair,
might possibly be a cell-pair status. One bit might indicate
that the equalizing shunt is turned on.
Click to expand...

Cool! Good catch! I could have sworn I tried these other group IDs.. hmm.
 
http://www.ebay.com/itm/310651672153?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1439.l2649

Good, an in-USA source, thanks. Do you know where they ship from?

Looking at your session log, I do not understand how the ELM327 knows
how many responses to ask for:
Please correct my comments below, for my better understanding.
Thanks.

Do you have a good link to the "ELM327" version 1.5 (clone) programming manual?

Code: 
>atz (asks for device info?) 
ÿ

ELM327 v1.5

>at sp 6 (set the OBD interface type to CAN, 11-bit MsgID, and 500kbps?) 
OK

>at h1 (show headers as mode 1,or On?) 
OK

>at d1 (show data length???) 
OK

>at sh 79b (set the send-command MsgID, or header?) 
OK

>at fc sh 79b (set the get-next-response MsgID?) 
OK

>at fc sd 30 00 20 (set the get-next-response data?) 
OK

>at fc sm 1 (must specify when to send,or not send, the get-next-response???) 
OK

>21 00 (sends 79b 21 00, a short message?????) 
7BB 8 06 61 00 FF 80 00 01 (the single response, did you set a filter to show only the 7bb MsgIDs???) 

>21 01
7BB 8 10 29 61 01 00 00 00 95 (how does the ELM327 know to request more responses???) 
7BB 8 21 02 88 00 00 02 9C FF 
7BB 8 22 FF FF FF 0F 90 2A F8 
7BB 8 23 91 2F 2D 1C 03 9F 00 
7BB 8 24 5C 21 81 00 06 18 0F 
7BB 8 25 00 08 DD 59 80 00 01 

>...  snip...
 
Gary,
You do realize this is my command sequence that I developed for the ELM327 project. I have the ELM327 tell the Leaf to send all the data with a 32 msec delay between lines. So you don’t need to know how many lines to expect for any command. If the Leaf supports the command/group it know how to respond.

Jim
 
Jim, thanks a lot for your efforts! I don't have an Android device w/ BT yet, so I can't run your app, which is why I was playing with it through a serial terminal on my PC.

Gary, yes, the command sequence is still gibberish to me.. I copied it from Jim's ELM327 thread. The only things I figured out myself are:
1) "at sp 6" - sets 11-bit 500kbps CAN
2) the 2nd byte in "21 xx" selects the group number.
You can get a copy of the ELM327 manual here: http://elmelectronics.com/DSheets/ELM327DS.pdf. I haven't been able to find one that specifically addresses the V1.5 clone.
To talk to my fake ELM327, just pair it with your PC using PIN: 1234. Enable the SPP virtual serial port, and write down the comm port number.
Then, you can just open up the virtual comm port in any terminal emulator, such as Putty using 38400,n,8,1

The eBay seller that I bought mine from ships from Corona. It took only a couple of days to arrive. I selected this particular one because it looks like the one that Jim uses, and it's easy to open in case I want to modify it (though it's probably better to just buy an extension cord, and make a little jumper box to switch among the CAN busses). I've only used it for a few minutes so far, but it seems to work fine, and it also was able to retrieve OBD-II data from my BMW w/o any problems.
 
GregH said:
garygid said:
Group 6, with 24 bytes of zero data, at two bits per cell-pair,
might possibly be a cell-pair status. One bit might indicate
that the equalizing shunt is turned on.
Click to expand...

Cool! Good catch! I could have sworn I tried these other group IDs.. hmm.
Click to expand...

I wonder if it's because I ran it on the CAR-CAN instead of EV-CAN, though I would expect the BMS to respond to these kind of messages on the EV-CAN
 
lincomatic said:
GregH said:
garygid said:
Group 6, with 24 bytes of zero data, at two bits per cell-pair,
might possibly be a cell-pair status. One bit might indicate
that the equalizing shunt is turned on.
Click to expand...

Cool! Good catch! I could have sworn I tried these other group IDs.. hmm.
Click to expand...

I wonder if it's because I ran it on the CAR-CAN instead of EV-CAN, though I would expect the BMS to respond to these kind of messages on the EV-CAN
Click to expand...
Yeah, I'm getting group 6 now (over EV-CAN). During charge every now and then I see a 00 turn to 0F, 0E, 05 or 01.. But mostly 0F.. It will pop on for a few seconds then back to all zero...not really what I was expecting. This is during charge at about 50% SOC.. Will check again in the morning when I continue charging closer to full...
 
GregH said:
Looks like there are also controllers at:
0x744
0x746
0x784
0x792
0x79d
.. I haven't tried pinging any yet, but based on my time with the Consult tool I did see activity there..
Click to expand...

OK, I don't know if I'm doing it right, but I pinged all of these ID's and all but 0x746 returned data:

Code: 
>atsh744
OK

>atfcsh744
OK

>atfcsd300020
OK

>atfcsm1
OK

>21 00
764 8 06 61 00 80 01 80 00

>21 01
764 8 10 0D 61 01 FD AE 00 00
764 8 21 FB FF F8 FF F1 BF FF

>21 02
764 8 03 7F 21 12

>21 03
764 8 03 7F 21 12

>21 04
764 8 03 7F 21 12

>21 05
764 8 03 7F 21 12

>21 06
764 8 03 7F 21 12

>atsh746
OK

>atfcsh746
OK

>atfcsd300020
OK

>atfcsm1
OK

>21 00
NO DATA

>21 01
NO DATA

>atsh784
OK

>atfcsh784
OK

>atfcsd300020
OK

>atfcsm1
OK

>21 00
78C 8 06 61 00 B0 00 00 00

>21 01
78C 8 03 61 01 98

>21 02
78C 8 03 7F 21 12

>21 03
78C 8 04 61 03 03 B9

>21 04
78C 8 04 61 04 00 00

>21 05
78C 8 03 7F 21 12

>21 06
78C 8 03 7F 21 12

>21 07
78C 8 03 7F 21 12

>atsh792
OK

>atfcsh792
OK

>atfcsd300020
OK

>atfcsm1
OK

>21 00
793 8 06 61 00 E0 00 00 00

>21 01
793 8 10 1A 61 01 CB C9 CD C2
793 8 21 C0 CB C2 C0 CB C8 C7
793 8 22 CA C1 BC C9 C4 C3 C6
793 8 23 C9 C8 CB C2 BF C8 C6

>21 02
793 8 10 1A 61 02 96 96 97 96
793 8 21 95 99 96 95 98 96 96
793 8 22 97 96 95 99 96 95 99
793 8 23 96 95 97 96 95 98 99

>21 03
793 8 10 12 61 03 04 11 12 31
793 8 21 12 31 05 11 13 31 04
793 8 22 11 05 10 12 31 31 04

>21 04
793 8 03 7F 21 12

>21 05
793 8 03 7F 21 12

>21 06
793 8 03 7F 21 12

>atsh79d
OK

>atfcsh79d
OK

>atfcsd300020
OK

>atfcsm1
OK

>12 00
7BD 8 03 7F 12 11

>21 00
7BD 8 06 61 00 C0 01 F0 00

>21 01
7BD 8 10 50 61 01 25 39 01 95
7BD 8 21 8D 8D 4B 4C 4C 4C 4C
7BD 8 22 4C 00 00 5B 06 5A 06
7BD 8 23 01 06 06 08 00 03 00
7BD 8 24 08 00 01 00 00 00 03
7BD 8 25 00 00 00 00 00 00 00
7BD 8 26 00 03 00 00 00 00 00
7BD 8 27 00 00 00 00 00 00 00
7BD 8 28 00 00 00 00 00 00 00
7BD 8 29 00 00 00 00 00 00 00
7BD 8 2A 00 00 00 00 00 00 00
7BD 8 2B 00 00 00 00 00 00 00

>21 02
7BD 8 10 50 61 02 00 12 45 00
7BD 8 21 01 00 47 D2 00 00 00
7BD 8 22 00 00 00 00 20 86 59
7BD 8 23 59 00 38 00 00 00 00
7BD 8 24 00 00 00 00 00 00 00
7BD 8 25 00 00 00 00 00 00 00
7BD 8 26 00 00 00 00 00 00 00
7BD 8 27 00 00 00 00 00 00 00
7BD 8 28 00 00 00 00 00 00 00
7BD 8 29 00 00 00 00 00 00 00
7BD 8 2A 00 00 00 00 00 00 00
7BD 8 2B 00 00 00 00 00 00 00

>21 03
7BD 8 03 7F 21 12

>21 04
7BD 8 03 7F 21 12

I hope I'm doing it right .. maybe Turbo3 can comment. I ran exactly the same commands that I used for 79B, except for substituting in the new ID. Curiously, I typed in 12 00 instead of 21 00 on the last id, and the 2 commands returned different data:

Code: 
>12 00
7BD 8 03 7F 12 11

>21 00
7BD 8 06 61 00 C0 01 F0 00

Can someone explain the numeric command's format? I'm having trouble understanding the description in the ELM327 manual.

FYI, one thing bad about these cheap BT ELM dongles is that they don't stay paired after you unplug them. My Win8 machine has issues when I try to delete/re-pair the device, so I end up wasting 15 minutes or more each time I need to reconnect it.
 
Apparently these are Error Responses:

>12 00
7BD 8 03 7F 12 11

have 3 bytes of following data (the 03),
the 7F error indicator
the Request-Function that caused the error (the 12, but 21 elsewhere),
and an Error-Type code (11 here, that probably means that the
Request-Function is not supported)

>21 05
793 8 03 7F 21 12

The other Error-Type we have seen is 0x12, which apparently
means that the Request-Function (here 21) is supported, but
the requested Group (here 05) is not supported.
 
Note that all of these tests, using the ELM327 type device,
are being done on the CAR-CAN bus.

Perhaps the Consult 3 Plus only connects to the CAR-CAN bus
for most of its diagnostics, but still might need to connect
elsewhere to do firmware upgrades.

Apparently the Consult 3 Plus can do most of the updates.

However, it seems that updating the TCU (telecommunications unit)
requires an SD card in the left slot of the center console, probably
because the TCU is only connected (by USB?) to the center console,
and not to any CAN bus?

Then, the center console itself, although connected to at least the AV bus,
seems to get at least its major programming from the "Nav" SD chip.

Warning: Everybody should write down their Nav system's CONFIRMATION
CODE NUMBER, in case they need/want to replace the Nav SD card.
Having the Set "Number" (Model), and Serial Number might be useful,
but these can still be read even without the SD card.
Perhaps even put it on a sticker on the back of the Nav screen, or
behind the Nav screen?
 
With the hope of finding out how to get the tire pressures, I did some googling.
First of all. I found that Nissan mostly uses the Schrader brand of TPMS.
I also found the CAN codes to get pressures on a Prius. They are at http://priuschat.com/threads/obdii-codes.73944/. I'm hoping they might be standardized so the same ones would work on the LEAF. Anyone care to check?
That's all I found after an hour of searching. It does seem that several scan tools can give the pressures on many brands of cars. Also, the OEM CAN codes are proprietary and they charge of order $50k for them.
 
Just an update.. I am still trying to track the temperature conversion points to get accurate temperatures down to 0.1C (0.2F) I've been updating the first post in this thread periodically. Here is the latest known data from 12C to 43C. Note the slope of the impedance on the thermistor is not linear.. The car doesn't seem to be using a look up table but rather a series of linear approximations.. ie 10 clicks per degree C from 18 to 28 but 8 clicks per degree C from 36C to at least 43 (as high as we have confirmed data for).. The "clicks" are the raw data reported from the car. The car reports the raw data as well as the temp in degrees C (no decimal precision). Both Jim (on the ELM app) and I (on LeafDD) attempt to derive a more precise temperature in C or F based on the raw data. LeafDD is accurate from 13C to 43C but in order to extend that accuracy to lower and higher temps we need more data. On the LeafDD page 2, holding the button will show the raw thermistor and degree C value directly from the car.. otherwise you're seeing my derived values.

13 degrees starts at 589
14 degrees starts at 579
15 degrees starts at 569
16 degrees starts at 558
17 degrees starts at 548
18 degrees starts at 537
19 degrees starts at 527
20 degrees starts at 517
21 degrees starts at 507
22 degrees starts at 497
23 degrees starts at 487
24 degrees starts at 477
25 degrees starts at 467
26 degrees starts at 457
27 degrees starts at 447
28 degrees starts at 438
29 degrees starts at 428
30 degrees starts at 419
31 degrees starts at 410
32 degrees starts at 401
33 degrees starts at 392
34 degrees starts at 383
35 degrees starts at 374
36 degrees starts at 365
37 "" 357 ?
38 "" 349 ?
39 "" 341 ?
40 "" 333 ?
41 "" 325 ?
42 "" 317 ?
43 degrees starts at 309
44 "" 301 ?
45 "" 293 ?
 

Similar threads

A
(2018+) TCU Decoding and Emulating
Replies
2
Views
954
aless1616
A
majbthrd
TCU Teardown
Replies
9
Views
6K
Stanton
Stanton
L
Survey: Battery Temp Bars VS Battery Pack Degradation
2
Replies
21
Views
5K
lkkms2
L
T
Using clone ELM327 Bluetooth OBDII adapter with Leaf
118 119 120
Replies
2K
Views
401K
GaleHawkins
G
garygid
SOC-Meter CAN-Message and CAN-Do Log file formats
Replies
19
Views
12K
garygid
garygid

Latest posts

Back
Top