Forgive my complete Leaf newbness, but has anyone tried just rebroadcasting CAN messages with modified values to see what happens? It was discovered on the old Gen2 Prius that when a message was modified and rebroadcast very quickly to the CAN bus each time it was heard, the receiving controller would ignore the first (unmodified) message and act in response to the second (modified) message. This had the really nice benefit of not having to break the CAN bus and insert a device in between controllers, IE all other traffic was untouched by the spoofing controller.
This was used in some of the early Prius PHEV conversions for spoofing the SOC, to keep the Prius HV Controller in a state where it would maximize EV drive usage while the PHEV pack still had available charge.
http://www.eaa-phev.org/wiki/Prius_PHEV ... poofing.29" onclick="window.open(this.href);return false;
I have no idea if the leaf controllers would respond to a rebroadcasted message in a similar way, but if so this might be a much simpler way to spoof the requested torque value?
Rob