LEAF CANbus decoding. (Open discussion)

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
Thanks for sharing that. I have to say, as a firmware professional that I'm very impressed with the tools available today for this sort of thing. I started with BASIC in the 1960's when I was just a kid and my uncle let me play on the local college's PDP-8. My times have changed! :D
 
goldbrick said:
Thanks for sharing that. I have to say, as a firmware professional that I'm very impressed with the tools available today for this sort of thing. I started with BASIC in the 1960's when I was just a kid and my uncle let me play on the local college's PDP-8. My times have changed! :D

You should see the paid tools then! They are even better, but my budget don't allow for these yet..

Along with some friends, we completed a quick sideproject. We did a nag-screen delete, with a permanent box mounted behind the OBD2 port. This box sends CAN messages onto the AV-CAN on every startup, so you don't have to see the nag-screen. Here it is in action:
https://www.youtube.com/watch?v=Rptz6ULKjXU

If anyone wants to replicate this at home, send these commands with 100ms inbetween
To get it to Status:

0x681 0x04 30 40 0d b1 ff ff ff

0x681 0x04 40 40 0d b1 ff ff ff

0x681 0x04 50 40 0d 31 ff ff ff

To get it to FM:

0x681 0x04 20 40 0d a3 ff ff ff

0x681 0x04 30 40 0d a3 ff ff ff

0x681 0x04 40 40 0d 23 ff ff ff

Maybe it would be worthwile to create a plug'n'play solution for the OBD2 port? Something you just set and forget there?
 
Dala said:
goldbrick said:
Thanks for sharing that. I have to say, as a firmware professional that I'm very impressed with the tools available today for this sort of thing. I started with BASIC in the 1960's when I was just a kid and my uncle let me play on the local college's PDP-8. My times have changed! :D

You should see the paid tools then! They are even better, but my budget don't allow for these yet..

Along with some friends, we completed a quick sideproject. We did a nag-screen delete, with a permanent box mounted behind the OBD2 port. This box sends CAN messages onto the AV-CAN on every startup, so you don't have to see the nag-screen. Here it is in action:
https://www.youtube.com/watch?v=Rptz6ULKjXU

If anyone wants to replicate this at home, send these commands with 100ms inbetween
To get it to Status:

0x681 0x04 30 40 0d b1 ff ff ff

0x681 0x04 40 40 0d b1 ff ff ff

0x681 0x04 50 40 0d 31 ff ff ff

To get it to FM:

0x681 0x04 20 40 0d a3 ff ff ff

0x681 0x04 30 40 0d a3 ff ff ff

0x681 0x04 40 40 0d 23 ff ff ff

Maybe it would be worthwile to create a plug'n'play solution for the OBD2 port? Something you just set and forget there?

can you share more info about this hardware"box" and also tell us where exactly you connect it after the odb2

thx
 
Thanks :)

The hardware is not important, you can use anything for this project. We just used what we happened to have lying around the workshop.
We used a ESP32-WROOM Devkit, coupled with a MCP2551-IP CAN transceiver. Oh, and a 12V->5V DC/DC converter. But you could use any microcontroller for this, as long as you make it possible to send CAN messages with it. Maybe an arduino, raspberry, devbords, etc.

Implementation: Powered with OBD2 Pin8 (switched 12V), then connected to AV-CAN (OBD2 pin 11 = H, pin 3 = L). Start sending the messages roughly 9 seconds after the car is started. You can get it to go straight to FM, Nav or Status this way.

If I were to design a proper one, I would make a really small thing that would fit inside an OBD2 plug. That way it would be easy to remove aswell.
 
I'm currently working on using the LBC and batteries without any other components of the Leaf.

I have noticed that the CANbus datagram 0x5C0 contains a DTC errorcode. This is however is a code within the range of 000-255 and doesnt 'match' the DTC or P-codes as mentioned in the EVB manual or used in the Leaf Spy app.

Can someone enlight me on how these codes relate to each other ?
Is it some sort of hash or are the codes from 0x5C0 just ordered messages from a prefined list of P-codes ?
For example the errorcode 0x03 in 0x5C0 appears as DTC U1000 in the Leaf Spy app.
 
I've just bought a 30kWh Nismo Leaf JDM. A couple of features would be good to tweak via CAN query of the eeprom content extract/modify/reload. Eg turn off the dash internal reverse buzzer (as opposed to external VPS) and reduce the power steering assist level. Appreciate there are other ways to hack these.

Are there tools similar to those for BMW (BMWTools32/NCSExpert) for Nissan to do this other than Consult plus?

The Nismo has different coding for the VCM so it would be interesting to compare to stock one too.
 
DTCs are not communicated via 'normal' CAN messages, they are generated on OBDII PIDs (https://en.wikipedia.org/wiki/OBD-II_PIDs). You cannot read a DTC via the general EV-CAN datastream, just like you can't read any other service parameters on plain CAN data.
 
mux said:
you can't read any other service parameters on plain CAN data.

Is registering a new TPMS sensor included in the things not possible using the CAN bus? So this requires CONSULT or equivalent?

By new, I mean never installed in the car. I know LSP will allow rotations, etc and I'm not talking about 'cloning' existing TPMS sensors, even though I think that is the route I should have taken...
 
goldbrick said:
Is registering a new TPMS sensor included in the things not possible using the CAN bus? So this requires CONSULT or equivalent?

By new, I mean never installed in the car. I know LSP will allow rotations, etc and I'm not talking about 'cloning' existing TPMS sensors, even though I think that is the route I should have taken...

Do a MNL search referencing use of LeafSpy to re-learn newly installed TPMS sensors. Typically most TPMS ECUs require that
the ECU be placed in its learn mode or the sensor I.D. be loaded with its location loaded into the ECU's flash memory.
Accessing the TPMS ECU, as for any Leaf ECU, is via one of the two Leaf CAN buses, e.g. pins 6 & 14 of the OBDII connector.
Some on MNL have replaced their TPMS sensors without the use of the Nissan Consult tool. Some later vehicles don't require
any accessing of the TPMS ECU, i.e. the ECU just re-learns the newly installed sensor.
 
mux said:
DTCs are not communicated via 'normal' CAN messages, they are generated on OBDII PIDs (https://en.wikipedia.org/wiki/OBD-II_PIDs). You cannot read a DTC via the general EV-CAN datastream, just like you can't read any other service parameters on plain CAN data.

The OBD2 PID's seem to be transmited in the 0x79b/0x7bb messges in group 2, the same as the cell voltages group but with a different identifier.
 
Hi all,
I'm a computer science student who's struggling to understand how to retrieve battery info from my Nissan Leaf 2018 ZE1.
My goal is to embed GSM computer board with OBD2 interface to some Leaf we have at the university, collecting battery info as capacity/SOH/SOC/Voltage. Unfortunately, asking all drivers to always connect to LeafSpy is not possible :)

Actually, from wikipedia and other articles, I thought every new car model would have been ISO 15765-4 compliant, replying on OBD2 pins DTCs code and errors etc, but my Nissan doesn't. I tried to send 7DF queries without any replies.
The Linux board we're using has an active can0 500kbps interface on pins 6 and 14 but candump doesn't show any 'passive' messages.
From the threads I read here, I guess pins 6/14 communicates with the CARcan since I can get 7BB or 79A messages asking for 797 or 797.

Below some results (car ON, Parked)

> Often I read that odometer was easy to get asking:
Query: 743#022119FFFFFFFFFF Reply: 763#056119005D6AFFFF
but I get error in my case:
can0 743 [8] 02 21 19 FF FF FF FF FF
can0 763 [8] 03 7F 21 11 FF FF FF FF
I noted that neither LeafSpy is getting it at the moment, so they probably removed it :|

> I got the VIN correctly!
VIN
can0 797 [8] 02 21 81 FF FF FF FF FF
can0 79A [8] 10 15 61 81 53 4A 4E 46
can0 797 [8] 30 01 00 FF FF FF FF FF
can0 79A [8] 21 41 41 5A 45 31 55 30
can0 797 [8] 30 01 00 FF FF FF FF FF
can0 79A [8] 22 30 35 33 39 32 37 00
echo "53 4A 4E 46 41 41 5A 45 31 55 30 30 35 33 39 32 37" | xxd -r -p
SJNFAAZE1U0053927

> Tire pressure is always 0 asking to 0x745: 0x02 0x21 0x10 0xff 0xff 0xff 0xff 0xff

> Cabin and ambient temperature is different from the famous spreadsheet https://docs.google.com/spreadsheets/d/1EHa4R85BttuY4JZ-EnssH4YZddpsDVu6rUFm0P7ouwg:
can0 797 [8] 03 22 11 5D FF FF FF FF
can0 79A [8] 04 62 11 5D 82 00 00 00

I guess 82 (before was 81) is HEX81 = DEC130 - 41 = 89F = 31,66°C (right?)
Cabin temperature is zero though.

> QC counter and L1/L2 counter seem to work:

can0 797 [8] 03 22 12 03 FF FF FF FF
can0 79A [8] 05 62 12 03 00 01 00 00

can0 797 [8] 03 22 12 05 FF FF FF FF
can0 79A [8] 05 62 12 05 00 73 00 00

> I tried to get some battery info querying 79b:

can0 79B [8] 02 21 01 FF FF FF FF FF
can0 7BB [8] 10 35 61 01 FF FF FC 18
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 21 02 AF FF FF FB 62 FF
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 22 FF F0 DD 0B 1C 30 D4
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 23 95 1D 33 06 03 95 00
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 24 01 70 00 26 9A 00 0C
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 25 44 B5 00 11 0B B8 80
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 26 00 01 FF FF FB 62 FF
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 27 FF FC AA 01 AD FF FF
can0 79B [8] 30 01 00 FF FF FF FF FF

So, according to the excel:

PackHealth (% * 100) is 0x7000 = DEC28672 = 286.72%
SOC high precision SOC (% * 10000) is 0x9a000c = DEC10092556 = 1009.2556 %
Pack Capacity (Ah * 10000) is 0xb50011 = DEC11862033 = 1186.2033 Ah

The numbers are nosense to me 🤔

> Cell pair voltages:
79B group 3:
can0 79B [8] 02 21 03 FF FF FF FF FF
can0 7BB [8] 10 1C 61 03 FF FF 02 AE
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 21 01 AB 00 0C A1 FF 0F
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 22 84 0F 75 00 00 F3 00
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 23 00 00 00 00 00 00 00
can0 79B [8] 30 01 00 FF FF FF FF FF
can0 7BB [8] 24 0B FF FF FF FF FF FF
cell pair min/max voltage (mV)
Vmax: 0x0f84 = 3972 mV = 3,972 V
Vmin: 0x0f75 = 3957 mV = 3,957 V

Even if numbers seem ok, I guess they're too low than real values...

I read here (https://github.com/baradhili/leaf_can_bus_messages/issues/2) that EVcan should be accesible from pid 12,13 even if @Dala told me they probably removed EVcan from my model.

Does somebody know how to get aforementioned values on my Leaf model?
Is it normal I don't see any passive message on CARcan (some are described on 'carCAN' tab in the spreadsheet)?
I found a DBC file here for Leaf 2018 (https://github.com/commaai/opendbc/blob/master/nissan_leaf_2018.dbc) but I guess it works with passive mode only.
Some expert could clear my doubts?
 
What I recall is that the ZE1 models require a lot more querying to get data. They don't just passively broadcast as the ZE0 did.
 
coleafrado said:
What I recall is that the ZE1 models require a lot more querying to get data. They don't just passively broadcast as the ZE0 did.

Hi @coleafrado,
yes is like I showed in my post. I tried to sniff pin 12/13 but I couldn't see any messages. Only on CARcan (6/14) apparently even if I guess even formulas are changed for ZE1 case.
Any chance somebody share them? :mrgreen:
 
Hello people.

I'm trying to sniffer my Nissan Leaf 2020 data with an OBD2. I send the ATs commands. However I am having problems receiving the data.

Has anyone in the group already managed to get data on the Nissan Leaf 2020?

I'm using Raspberry Pi 4 + 2515 + OBD + Arduino and nothing worked.

Any idea? Thank you


Link: https://www.amazon.com.br/Festnight-KONNWEI-OBD-II-Diagnóstico-Ferramentas/dp/B08D9T3JCG/ref=sr_1_26?dchild=1&keywords=scanner+konnwei&qid=1605017354&sr=8-26
 
Dala said:
goldbrick said:
Thanks for sharing that. I have to say, as a firmware professional that I'm very impressed with the tools available today for this sort of thing. I started with BASIC in the 1960's when I was just a kid and my uncle let me play on the local college's PDP-8. My times have changed! :D

You should see the paid tools then! They are even better, but my budget don't allow for these yet..

Along with some friends, we completed a quick sideproject. We did a nag-screen delete, with a permanent box mounted behind the OBD2 port. This box sends CAN messages onto the AV-CAN on every startup, so you don't have to see the nag-screen. Here it is in action:
https://www.youtube.com/watch?v=Rptz6ULKjXU

If anyone wants to replicate this at home, send these commands with 100ms inbetween
To get it to Status:

0x681 0x04 30 40 0d b1 ff ff ff

0x681 0x04 40 40 0d b1 ff ff ff

0x681 0x04 50 40 0d 31 ff ff ff

To get it to FM:

0x681 0x04 20 40 0d a3 ff ff ff

0x681 0x04 30 40 0d a3 ff ff ff

0x681 0x04 40 40 0d 23 ff ff ff

Maybe it would be worthwile to create a plug'n'play solution for the OBD2 port? Something you just set and forget there?
I did obd2 device on MCP2515 and arduino nano for this. It realy works) If anyone need, I can share my sketch and connection diagram.
Dala , do you know commands for getting TV-AUX screen?
 
[/quote]
I did obd2 device on MCP2515 and arduino nano for this. It realy works) If anyone need, I can share my sketch and connection diagram.
[/quote]

Always is a good contribution give back to the community if somethig has been derived from the community => yes please :)
 
Dala said:
nickname3 said:
<span>I did <a href="http://www.amazon.com/gp/product/B005NLQAHS/?tag=myelecarfor-20&" interlinkr"="" target="_blank">OBD2</a> device on MCP2515 and arduino nano for this. It realy works) If anyone need, I can share my sketch and connection diagram.</span>
Dala , do you know commands for getting TV-AUX screen?

Nice, congratulations! No sorry I don't!
I sniff commands for pressing TV-AUX button. There is:
0x681 0x04 10 40 0D AB FF FF FF
0x681 0x04 20 40 0D AB FF FF FF
0x681 0x04 30 40 0D AB FF FF FF
 
Back
Top