Active EV-CAN sampling: cell voltages, pack temperatures...

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
hubaksis said:
Hi everyone,
I think this is the best topic to ask.
I found out that some values can be requested from a module only after setting it into diagnostic mode by sending a command 02 10 C0.

However, I can't find any details about this mode.
Can you tell me, does it have any expiration time? If so - is there a command to keep it active or just send another one 02 10 C0?
Do I need to exit diagnostic mode after I finished all requests?

Thanks.
I think it exits in about 1-2 seconds. 02 3E 01 will keep it alive if sent once a second. No harm in not exiting. It will timeout anyway.
 
Hello all,
Can some one post the request codes for VIN, DCQC count and L1/L2 count of 2012 leaf? I have already tried the 797 but not getting any respond on 079A.
Thank You.
 
GregH said:
garygid said:
One long set of data from the BMS should be the estimated
cell (pair) resistances, derived from noting how much the
cell-pair's voltage sags when current is being withdrawn.

There might be another set of data indicating charging
resistances, derived from how much the voltage rises
when charging.

Yes!
There are some odd sets of 10 x 16bit data in group 5.. no clue yet.
Also I'm guessing we might find some sort of counters in there for charge events so that the Nissan battery report can tell how often you've been plugging in at high states of charge or how often you've used QCs..

garygid said:
Perhaps use F (x 10, so in tenths) = (C x 18) + 320
to display the battery temperatures?

It is increasingly looking like Nissan is NOT using a look up table for the non-linear NTC values but rather a set of linear approximations.. (edit-maybe)
So yes in the range of 18-24 degrees it looks like 10 steps per degree C.. but in looks like in the 12-17 degree range it's closer to 10.5 steps. I'm still filling in my temperature data table.. so far I have the following for temp transitions..

13 degrees starts at 589
14 degrees starts at 579
15 degrees starts at 569
16 degrees starts at 558
17 degrees starts at 548
18 degrees starts at 537
19 degrees starts at 527
20 degrees starts at 517
21 degrees starts at 507
22 degrees starts at 497
23 degrees starts at 487
24 degrees starts at 477
25 degrees starts at 467
26 degrees starts at 457
27 degrees starts at 447
28 degrees starts at 438
29 degrees starts at 428
30 degrees starts at 419
31 degrees starts at 410

<edit> If anyone has data below 13 or over 30, please share! :)
(btw as soon as the highest temp clicked over from 468 to 467, the 6th temp bar on the dash lit up. After resting it has gone down to 468 (24.9deg) and the 6th bar went away..)

probably Nissan connected an NTC thermistor in series with a fixed resistor, and sent the result to an ADC which is what you're seeing.
this is the proper way to do it but they might not have known:
https://en.tdk.eu/download/531110/a3be527165c9dd17abca4970f507014f/pdf-applicationnotes.pdf
 
Hi all.
I have BMS 2013 in desktop bank with a connected battery. I can not start the shunt derivation. The leafspy current indicates 2147483.75A, the current sensor being disconnected. Can this influence that shunts shunts do not appear?
Turbo3, what are the minimum hardware conditions for the BMS to initiate derivation?
Thank you
 
Is there sample code or a guide for collecting together the data to make a SoC value by communicating on CAR-CAN?

I've seen Gary and Jim discussing request/response on 797/79a for example but it isn't entirely fleshed out, except I suppose inside LeafSpy.

I found code in the forum here for reading a complete SoC on id 50D, but my car doesn't ever output anything on 50D.

I do love LeafSpy and I bought the pro version, but I'd prefer a full-time usb wired elm327 to something like a raspberry pi with a screen maybe. I've got an older Leaf that doesn't display a percent charge and I want to fix that.
 
Please tell me whether it is possible to use the module LBC Leaf 2014 for autonomous operation in BMS mode? I want to use this module to control the voltage of 96 cells and emergency shutdown of the second battery if the voltage parameters exceed the critical values. Is it possible? I would also like to be able to balance the battery, but I'm afraid it's impossible
 
TickTock said:
Thanks again Greg! Just finished coding it up. Here's the money-shot.

Just wonder if you code is online for others to share, looking at resuse of leaf parts so any help would be great.
 
I have a 2012 BMS board (no car). If I were to hook up 48 cells to it, does the balancing happen automatically, or must I send a CAN message to turn on a specific shunt?

I would like to just have the BMS be a black box that I can poll battery voltages periodically from my motor controller and charger, and then have it take care of balancing.
 
Hi. Does anybody know how to collect battery id from EV-CAN (H/L pins, 12/13 pins from under-dash OBD2) with some Arduino + wiring?
 
GregH said:
So with a little help from TickTock and a friend at Nissan, we've been able to replicate some of the specific CAN messages used by the technician's scan-tool to read data from the Leaf battery management system.
First of course I should say that SENDING CAN messages to your Leaf (as compared to passively listening) could cause problems although most of the harmful writable data is usually protected with additional check-sums.
Anyway.. Proceed at your own risk..

What we're doing here is sending specific request messages asking for groups of data from the HV battery subsystem.
As best we can tell all of the requests from the scan-tool regarding the HV battery are sent on the 0x79b CAN ID with responses on 0x7bb. All packets are 8 bytes although sometimes not all 8 are utilized.
We've found 6 different groups of data...
Group 1 has 6 lines of data (precision SOC, Ah Capacity and perhaps battery State of Health %)
Group 2 has 29 lines of data and contains all 96 of the cell voltages.
Group 3 has 5 lines and contains the Vmin and Vmax as well as a few other things we haven't figured out yet.
Group 4 has 3 lines of data and contains the 4 pack temperatures.
Group 5 has 11 lines and again, not sure what it is yet..
Group 6 (discovered by Lincomatic) has 4 lines of data and contains the status of the resistive cell balancing shunts.

In order to read a group of data, first send the initial request command on ID 0x79b:
0x02 0x21 group 0xff 0xff 0xff 0xff 0xff (those last 5 bytes can be 0xff or 0x00, doesn't seem to matter, and yeah I tried group 0 and 6.. didn't see anything)

For example to request pack temperatures you'd start with
0x79b: 0x02 0x21 0x04 0 0 0 0 0

Which returns something like:
0x7bb: 0x10 0x10 0x61 0x04 0x01 0xfb 0x15 0x01

The first byte is an index (incremented on subsequent lines), the 2nd byte is a sort of group size, the 3rd byte is 0x61 (responding to the 0x21) and the 4th byte is the group number. The actual data starts on the 5th byte.
In this example the first temperature is a 3 byte value (16bit raw A/D and 8bit temp) 0x01fb 0x15 meaning 21 degrees C with the raw 10 bit A/D NTC thermistor value 0x1fb or 507 decimal. The start of the 2nd temperature is the last byte of the message.

To ask for additional lines of data, they must be requested within about a second of the initial request. In my software I ask for the 2nd line immediately after receiving the first and then ask for subsequent lines every 16ms or so.
The request additional lines command is
0x79b: 0x30 0x01 0x00 0xff 0xff 0xff 0xff 0xff

All subsequent lines will have an index in the first byte with 2 as the MS nibble and the lower nibble (4 bits) as the index.. The remaining 7 bytes are all data.
Such as:
0x7bb: 0x21 0xf8 0x15 0x02 0x06 0x13 0x02 0x0d
(ie the other 2/3rds of temp2, all of temp3 and the first 2/3rds of temp4)

In order to receive the last line, another 0x30 0x01 0x00 request is sent and for this example the response looks like:
0x7bb: 0x22 0x13 0x13 0x00 0xff 0xff 0xff 0xff
(giving the last byte of temp4.. not sure what if anything the extra 0x13 and 0x00 mean... maybe some check-sum)

In larger groups (cell voltages in group 2) the index byte continues 0x23, 0x24, 0x25 etc wrapping from 0x2f back to 0x20.

The cell voltages in Group 2 start with the 5th byte in the first line (just like the temps) with the first two cell voltages then subsequent lines contain another 3 and a half cell voltages on each.

example:
0x7bb: 10 C6 61 02 0F D8 0F D4
0x7bb: 21 0F D0 0F D9 0F D0 0F
0x7bb: 22 CC 0F D3 0F D0 0F D0
etc..

I have a 2012 BMS by itself with batteries. I am using my own board, accepting standard SIDs, and sending standard SIDs. When I turn on the 12v power to the BMS, I am seeing IDs 475 and 475 sending their data very fast. I'm also seeing ID 1371 sending its data much slower, maybe 10 times per second, then there is ID 1468 and 1472. Those are done at about 2 times per second. One of those contains data for the highest thermistor temperature.

The BMS is not responding to the 0x79b commands. Any suggestions from anybody? Should my messages be using the extended identifier format of the CAN packet?
 
GregH said:
So with a little help from TickTock and a friend at Nissan, we've been able to replicate some of the specific CAN messages used by the technician's scan-tool to read data from the Leaf battery management system.
....

I am masters student doing my thesis on Battery testing. I am looking to log cell pair voltages, which are further used in a matlab script to find SOH. I'm planning to send CAN request as you suggested to log cell voltages but I'm unable to decode CAN message. Could you please help me understand the decoding of CAN messages to numerical values.
Thanks!
 
I have LeafSpy Pro reading my Gen1 battery voltages and expected to see all kinds of 0x79B and 0x7BB message traffic on my canbus monitor (I am monitoring traffic using a Seeed canbus shield and Arduino One). I see some messages initiated from the LBC and the Inverter but not from LeafSpy. I plan to use the Arduino to monitor HV battery cell voltages and temps. Does anyone know why I might be able to see the voltage values update on LeafSpy and not see any 0x79B messages on the canbus? BTW my EV does not have the Leaf VCM or BCM or other ECU devices. Regards,
 
I'm having issues querying any group of 0x79B. I'm sending the sequence
Code:
0x79B 02 21 01 00 00 00 00 00
for Group 1, and getting a proper response
Code:
7BB 10 29 61 01 FF FF F6 56
but when I ask for additional lines with
Code:
30 01 00 FF FF FF FF FF or even 30 01 00 00 00 00 00 00
, I always get back "NO DATA". Anyone else had this problem and figured out what they did wrong?

My queries for 0x79B Group 61 (SOH) and Motor 0x784 work fine. Just this multline 0x79B queries I can't get data for.

Code:
initialization:
"ATD", => OK
"ATZ", => OK
"ATSTFF", => OK
"ATSP6", => OK
"ATI", => OK
"ATE0", => OK
"ATL1", => OK
"ATH1", => OK
"ATS1", => OK
"ATAL", => OK
"ATCAF0" => OK

then:
AT SH 79B => OK
AT FC SH 79B => OK
AT FC SD 30 00 20 => OK
AT FC SM 1 => OK
AT CRA 7BB => OK
02 21 01 00 00 00 00 00 => 7BB 10 29 61 01 FF FF F6 56
then immediately send:
30 01 00 FF FF FF FF FF => "NO DATA"

I'm stumped. Anyone know why I'm getting "NO DATA" instead of actual Group 1 responses? Did I miss multi-line setup step?
 
So have seen @GregH mapping of the raw value
-1 degrees C finishes at 730 (Kudos to Sean W. for catching this one!)
-0 degrees C starts at 729
+0 degrees C starts at 720 (LeafDD with original SW is accurate down to here!)
1 degrees C starts at 710
2 degrees C starts at 700
3 degrees C starts at 690
4 degrees C starts at 680
5 degrees C starts at 671 (?!?!) strange, double confirmed. P.S. Thanks Steve S for these single digit confirmations.
6 degrees C starts at 660
7 degrees C starts at 650
8 degrees C starts at 640
9 degrees C starts at 630
10 degrees starts at 620
11 degrees starts at 609
12 degrees starts at 599
13 degrees starts at 589
14 degrees starts at 579
15 degrees starts at 569
16 degrees starts at 558
17 degrees starts at 548
18 degrees starts at 537
19 degrees starts at 527
20 degrees starts at 517
21 degrees starts at 507
22 degrees starts at 497
23 degrees starts at 487
24 degrees starts at 477
25 degrees starts at 467
26 degrees starts at 457
27 degrees starts at 447
28 degrees starts at 438
29 degrees starts at 428
30 degrees starts at 419
31 degrees starts at 410
32 degrees starts at 401
33 degrees starts at 392
34 degrees starts at 383
35 degrees starts at 374
36 degrees starts at 365
37 degrees starts at 357
38 degrees starts at 348
39 degrees starts at 340
40 "" 332 ?
41 "" 324 ?
42 degrees starts at 316
43 degrees starts at 309
44 "" 302 ?
45 "" 295 ?

The raw vales do seem to match the Deg C value from each line
So does the raw give any more accuracy, or should we just use the whole number value in Deg'C

Code:
 #1 7bb, data, 10, 10, 61, 4, 1, da, 18, 1, ;
 #2  7bb, data, 21, d5, 18, ff, ff, ff, 1, da, ;
 #3  7bb, data, 22, 18, 18, 0, ff, ff, ff, ff, ;
So on the line #1 we have data[6] = 0x18 (24deg C)
(All other reading are 0x18, 24deg C also then)

Then if you get the 5C0 data messages and decode them, how do 7BB compare?
Code:
Max       #1   5c0,data,40,84,84,0,9e,4,1f,10,;
Average #2  5c0,data,80,82,82,0,a8,d4,1f,3,;
Min       #3   5c0,data,c0,82,82,0,9e,d4,1f,3,;

Update: I just check and was seeing 5C0 message look about same but with no decimal accuracy still.
 
Last edited:
I'm having issues querying any group of 0x79B. I'm sending the sequence
Code:
0x79B 02 21 01 00 00 00 00 00
for Group 1, and getting a proper response
Code:
7BB 10 29 61 01 FF FF F6 56
but when I ask for additional lines with
Code:
30 01 00 FF FF FF FF FF or even 30 01 00 00 00 00 00 00
, I always get back "NO DATA". Anyone else had this problem and figured out what they did wrong?

My queries for 0x79B Group 61 (SOH) and Motor 0x784 work fine. Just this multline 0x79B queries I can't get data for.

Code:
initialization:
"ATD", => OK
"ATZ", => OK
"ATSTFF", => OK
"ATSP6", => OK
"ATI", => OK
"ATE0", => OK
"ATL1", => OK
"ATH1", => OK
"ATS1", => OK
"ATAL", => OK
"ATCAF0" => OK

then:
AT SH 79B => OK
AT FC SH 79B => OK
AT FC SD 30 00 20 => OK
AT FC SM 1 => OK
AT CRA 7BB => OK
02 21 01 00 00 00 00 00 => 7BB 10 29 61 01 FF FF F6 56
then immediately send:
30 01 00 FF FF FF FF FF => "NO DATA"

I'm stumped. Anyone know why I'm getting "NO DATA" instead of actual Group 1 responses? Did I miss multi-line setup step?
I hit the same wall myself. I am documenting my progress here:
https://mynissanleaf.com/threads/my-nissan-leaf-2021-obd2-elm327-bluetooth-adventure.35042/
 
I look forward to seeing the temperature responses from you and others.. So far I've seen:
21 degrees 499-505 raw
20 degrees 509-517 raw
19 degrees 518-527 raw
18 degrees 528-536 raw
17 degrees 538-547 raw
.. but for example I don't know if 537 would come down as 17 or 18 degrees.. so I'm looking to fill in this table with more data..
I put you values in to a table, and projecting the number down to 0deg C
Looks like value would be about 719

So could the formula just be as simple as
Temp = (719 - RawValue) / 10
 
I'm stumped. Anyone know why I'm getting "NO DATA" instead of actual Group 1 responses? Did I miss multi-line setup step?
I noticed when tracking down a similar issue that if I sent second request too quickly I would not get any response. So I had to add a manual delay of about 50 milliseconds between the two outbound frames.
 
Back
Top