LEAF CANbus decoding. (Open discussion)

[49thdiver]

More good info, thanks Dala. I am away from home at the moment but am doing two things while away:
1- rewriting my code to include the MPRUN/CSUM/CRC as described in your video. This will certainly change some of the outcomes I am getting and explains a lot about my lack of success on the OBC/charger project, I will be revisting that shortly I hope to. The more I think about it the more significant this information is.
2- Writing a new piece of code to run on a stand alone UNO and an MCP2515 that emulates a Nissan Leaf or at least the BMS relevant VCM & OBC communication. This will help reduce the code development time by not having to connect to the car until the code is really ready and advance the OBC charger project.
More to follow, Thanks again.

[49thdiver]

Dala, As I am coding my leaf emulator I notice that byte 4 of 5BC has different lengths associated with signals 2, 5 and 9 creating bit overlaps. I may just only use 2 permutation of this command for my first version as the information in bytes 5,6 & 7 are not critical for reading GIDS. Signal 5 bit 0 would appear to be the multiplex for charge and capacity bars and bits 3 2,1 being part of signal 4. Signal 9 is perhaps not relevant, other than bit 0 as noted above. Any comments ?
With thanks
Peter.

[Dala]

Dala, As I am coding my leaf emulator I notice that byte 4 of 5BC has different lengths associated with signals 2, 5 and 9 creating bit overlaps. I may just only use 2 permutation of this command for my first version as the information in bytes 5,6 & 7 are not critical for reading GIDS. Signal 5 bit 0 would appear to be the multiplex for charge and capacity bars and bits 3 2,1 being part of signal 4. Signal 9 is perhaps not relevant, other than bit 0 as noted above. Any comments ?
With thanks
Peter.

Shouldn't affect GIDs reading. Just alternate something like this
5x
0x000005bc 8 0x4c 00 98 64 be 03 ff ff
5x
0x000005bc 8 0x4c 00 f0 64 bf 03 ff ff
....

[Dala]

damienmaguire posted some raw CAN logs from a ZE1 "gen3" inverter. This helps decode the CAN-messages on EV-CAN for ZE1 even further
https://github.com/damienmaguire/Nissan ... m_cold.csv

https://github.com/dalathegreat/leaf_ca ... c293c67769

[nickonck]

Hi,

Thank you very much for this thread, Im learning a lot about my new leaf.

I've bought a 2020 model (ZE1), and Im triying to make an application to connect a OBD plug with my phone and read some battery data. I know that the OBD is locked, and I need to query. I've tried to query with 79B messages that I found in https://docs.google.com/spreadsheets/d/ ... edit#gid=7 . With these querys I receive data, but I cant decode most of them, like the SOC, that I think it should be trivial. Somebody knows how can I get these parameter?

[Dala]

Hi,

Thank you very much for this thread, Im learning a lot about my new leaf.

I've bought a 2020 model (ZE1), and Im triying to make an application to connect a OBD plug with my phone and read some battery data. I know that the OBD is locked, and I need to query. I've tried to query with 79B messages that I found in https://docs.google.com/spreadsheets/d/ ... edit#gid=7 . With these querys I receive data, but I cant decode most of them, like the SOC, that I think it should be trivial. Somebody knows how can I get these parameter?

Hi, yes here is how:

Query to LBC:
0x79B 02 21 01 00 00 00 00 00
0x79B 30 00 00 00 00 00 00 00
Answer from LBC:
0x7BB 10 35 61 01 FF FF FC 18
0x7BB 21 02 AF FF FF FB 62 FF
0x7BB 22 FF F0 DD 0B 1C 30 D4
0x7BB 23 95 1D 33 06 03 95 00
0x7BB 24 01 70 00 26 9A 00 0C
0x7BB 25 44 B5 00 11 0B B8 80
0x7BB 26 00 01 FF FF FB 62 FF
0x7BB 27 FF FC AA 01 AD FF FF

Name: SOC (%)
Type: Integer
Description: State of Charge (SOC) of the HV Battery
Formula:
0x7BB 24 01 70 00 26 9A 00 0C
0x7BB 25 44 B5 00 11 0B B8 80
SOC = (data 24[7] << 16 | ((data 25[1] << 8) | data 25[2]))/10000

[gorgo]

* LEAF 2018 CAN MESSAGES *

Hi all, after months of CAN analyzing, I guess it's time to release all my findings on the Leaf 2018 (+?) CAN messages.
I summarized them all in the PDF here: https://drive.google.com/file/d/1jH9cgm ... sp=sharing
There you can find every variable found, with the description taken from SpyLeaf's documentation.
I also reported the function to convert the raw Temperature to °C and the function to get the values of the shunts.

In addition some open challenges:

// Left Arrow & Right Arrow
- The PDF lacks of a Arrows bytes combination I found two days ago such as:
Wiper == '0xb' & Light1 == '0x4' => Left_Arrow
Wiper == '0xb' & Light1 == '0x8' => Right_Arrow

// HVAC
- I couldn't find any messages related to the HVAC air flow modes and air recycle even if I guess they shall be trivial messages. I expect modes are corresponding to a byte that changes from X to X+5 while the air recycle shall be a bit 0/1 for recycle ON/OFF.

- HeaterTemp is still buggy. We detected that byte changes in according to the temp button pressure, but its values change from time to time. Using a static function to convert value to Temperature doesn't work every time.

// Recharging BMS messages
- We wanted to get recharge BMS values (HV_Current and OBC_Power) values, but apparently monitoring CAN messages once the power plug is attached is not trivial.
The can0 is answering for 4/5 minutes then it turns off and I can't get any messages.
From recent tests, I found that this is not always true:
continuing sending Power_Software and PlugState queries seem to wake the CAN up again.
From time to time the bus, instead of not replying, it replies with PlugState = 2 and I can ask for G1 BMS messages, getting all HV_Current values I need even if the car is OFF and the doors are closed.
I hope someone can suggest a clever way to keep the CAN open without bombing it with queries

[mux]

One of the big reasons that's happening, is because the debug mode messages are not meant to be repeated. The official documentation even says the car should not be operated or charged during a CONSULT session, which is the only moment debug messages are requested. This is also one of the reasons there are extremely rare instances of the car getting into a fault state when driving with leaf spy.

For live or everyday logging/messaging I highly recommend just using the regular CAN bus messages and not trying to send debugging and engineering messages.

[gorgo]

Hi Mux, could you address me to the official documentation you're talking about?
We've just tested that polling the CAN bus while the car is off, it actually discharges the 12V battery.

Is there some info about accessing the regular CAN bus?
Tnks

[mux]

That would be the CONSULT documentation, which ultimately is the only way - without leaf spy or other tools - that the car would encounter these messages. I'm not sure I can share that documentation without some repercussions for my consult license.

And yes, you'll run into 12V drain issues if you do this, that's a well-known issue with leaf spy as well.

What would you like to know about the CAN bus? There's an entire CAN reverse engineering topic here: https://www.mynissanleaf.com/viewtopic.php?f=44&t=4131