Stand alone OBC/PDModule EV system Can 2015 - SOLVED

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.

49thdiver

Well-known member
Joined
Feb 7, 2020
Messages
105
Location
CANADA's westcoast
I have posted the complete solution on page 17 post #164. Thanks to everyone, good luck with your projects. :D https://mynissanleaf.com/viewtopic.php?p=620578#p620578

I am not the first one to try this nor I am sure will I be the last to try it. Hoping we can pull all the info into one place and generate some new interest to make this easier for anyone else that wants to give it a try. Thanks ito everyone that has been here a while and thanks in advance for any help with this project. My specific project is to put a Nissan Leaf pack and charger into a 2002 RAV4 EV.

What I know so far.
The PDM sits on the "EV SYSTEM CAN Circuit" There are a number of connections on the B24 connector that need to be hard wired in order to function along with an external j1772 charger to start with ChaDemo can come later.
The connections are
  • Pin 10, Plug in signal, LightGreen
  • Pin 11, EV System CAN-L, DarkGreen
  • Pin 12, HV detecting circuit Interlock In, Orange
  • Pin 15, HV detecting signal Interlock Out, Pink
  • Pin16 Power On (IGN) , Violet
  • Pin 18, Battery Power Supply, Red
  • Pin 27, EV System CAN-H, Blue
  • Pin 29, EVSE Connection Signal, White
  • Pin30, EVSE communication PWM, Brown

This is the connector :
Leaf_B24.jpg


This is my set up :
leafPDMsetup2.jpg


and my connection diagram :
PDMhookupschematic.jpg


When the PDM powers up all I get is a high on pin 29 and two CAN messages, 0x390 & 0x393 each one transmitted several times

I have a wrecked 2015 and access to complete working 2015 which am going to record can bus charging messages and try and play them back on both the working car and on the stand alone PDM to see what happens. Does anyone know is there a risk of bricking the working car by trying sending messages to the charger. I am also going to pull the VCM, the combination display and the charge lights from the wreck to see if I can cobble that together to assist in the diagnosis of the stand alone PDM. Any and advice appreciated. I am new to can bus so have to learn a lot. I am an electronics tech design and service in the it world with a little OBDII hacking experience.

Peter

Others on this forum have advised the following :

Celeron55 :
Project update: I was unable to reverse the charger CAN protocol to an extent that would have made it do any... well, charging. I did get the DC-DC converter to operate, but that was it.

Basically I found out bit 0x04 in the 0x1f2 frame disables the converter (set low to enable, just spam 0x1f2 00 64 00 a0 00 00 00 00 or so every 10ms). You might also need 50b, 1d4 and maybe 55b (probably not). Anyway, that's worthless without the charging working.

I'm now in the process of developing the necessary hardware mods to get it to charge without any co-operation of Nissan's original software. This is actually going fairly well (I already have full control in a lab setup), but making this reproducible or to be something that I can use daily is more difficult.

EDIT: I've basically reverse-engineered enough of the connections to the Renesas R5F35MEEJFE chip that controls the PDM in order to write a new program from scratch for it to do regular charging and dc-dc conversion. Not sure if I'll do that, I'd need a E8a emulator ($150) and basically IAR Embedded Workbench for M16C ($2000? $4000?) to program it. Also, nobody sells these chips for a hobbyist if the one on board is somehow locked. I can find different ones with the same pinout though, eg. R5F35L2EJFE.


IskeSoderlund:
Hi!
Been lurking here for a while, I'm trying to hack a leaf OBD charger. I've come quite a way closer to charging. I've written a program which makes the charger think it's in the leaf. And it seems to work the charger is no longer sending "fault" signals by CAN. And I'm trying to make it charge by sending the same messages that the VCM sends to the leaf when charging, according to CAN captures by carrot. I still haven't been able to make it charge. Is it possible that the charger like the inverter saves DTC and refuses to start charging? If so what's my best option to remove stored DTCs?

If anyone wants my codes for the program or help with making the charger "think" its in a leaf just contact me!
 
After connecting a real J1772 charger to the PDM today I ran some data grabs on the can bus again when plugging and unplugging the j1772 connector. These are messages sent from the PDM with no connection to anything else other than my digiview data acquisition device and a obdII bluetooth dongle.

Update August 2020: Turns out the digiview was misinterpreting the data and sent me off an a bad track of investigation.
I have changed my data acquisition tools to Arduino based MCP2515 devices, as you will see below the data now makes sense.

I have been able do the same data acquisition on a working 2015 leaf and have recorded a charge sequence.
 
Do you have a schematic of the PDM? What are the boards and different sections in your setup picture, and what are the functions? Is the OBC built into the PDM or is it a stand alone box? i only have a 2012 OBC and it looks different inside from anything you have shown.
 
nlspace said:
Do you have a schematic of the PDM? What are the boards and different sections in your setup picture, and what are the functions? Is the OBC built into the PDM or is it a stand alone box? i only have a 2012 OBC and it looks different inside from anything you have shown.

No I have not attempted to reverse engineer it, that would take a serious amount of effort.
ac to dc converter on the left, chadeamo circuit on the top right, dc to dc converter for charging the 12 volt system on the bottom right.
The descriptors toyota uses are different through out what documentation there is. I consider that box in my picture to be the PDM but it also reffered to as OBC/PDM. There was a major engineering change at 2013. Yours will be completely different. I think your charger is in behind the back seat.
 
If there is an AC to DC section, then i would think it is for the OBC? but like i said my 2012 OBC is sitting on the workbench and i'm not up to speed on the later models. You could at least trace out the major functions to create a block diagram without spending much time--it could help the next guy or even yourself with this project.
 
nlspace said:
If there is an AC to DC section, then i would think it is for the OBC? but like i said my 2012 OBC is sitting on the workbench and i'm not up to speed on the later models. You could at least trace out the major functions to create a block diagram without spending much time--it could help the next guy or even yourself with this project.

Sorry I was not clear that is the On Board Charger (OBC) on the top left, the IGBT's or power electronics associated with the charger are on the underside of the module.

Not my priority to reverse engineer the charger at this time, there may be others that have done some of this already.

My focus is to try and get the charger to charge at the moment that effort is going to be focused on the can bus and what systems I can port over from the wrecked leaf. We managed to strip out all the modules today and are now going to set out to reconnect it all on the bench. I t may come to it that I will need to reverse engineer but the issue there will be getting the OBC independent processor to cooperate. So much is done in software these days that knowing what the hardware does may not get me any closer to charging.

I was also able to grab data from the EVCAN SYSTEM circuit today from the working leaf while starting and stopping charging this should help understand what the dependency is between the other systems such as the VCM and the BMS. I will be posting the data here once I get it in a readable form.

Thanks for your interest and good luck with your OBC.
 
This is very interesting idea. Where is so tittle rav4 ev alive. I'm trying to find one to play around.
Good luck with your project, I will gonna keep my eyes on you.
 
For those of you that are interested in data mining here is the latest EVCAN SYSTEM Circuit data grab.
https://www.divemaster.ca/RAV4EV/LEAF/CANEV SYSTEM Feb 22-2020.xlsx
There are a number of data sets on separate sheets pluging and unpluging the charger from a 100% working 2015 leaf.
The most reliable sets are probably the ones that record the plug in or start charging sequence as the pattern seems more obvious to me anyway.
My next step is to hook up a minimal number of modules from the leaf to compare the data results to figure out what messages are missing or needed to get the charger to turn on.

I note in one of the links I found above one of the authors indicates that the charger is a current based charger not voltage and that you could connect any battery (within limits I guess) and it would charge. That idea interests me as I would like to reconfigure the pack for a lower voltage.

Any body with info on that I would love to see it.
Stay tuned.
 
There is both voltage and current sense measurements in the OBC and these are fed to the microcontroller. i'm fairly certain that limits are programmed into that device such that an OBC won't function outside of the narrow range of the program, i.e. it's not a generic chargger that could be used for any battery without re-programming.

In addition the large inductors and transformers in the OBC were likely designed for the current and expected voltages, so those would have to be changed for different voltage operation also.

The benefit of reverse engineering circuitry is the ability to troubleshoot, repair and modify the hardware. It also seems to help when disassembling the firmware.

The only successful re-programming of an EV chargger was done by forum user Coulomb and documented in threads on the diyelectriccar forum:

hardware here,

https://www.diyelectriccar.com/forums/showpost.php?p=452281&postcount=3

and firmware,

https://www.diyelectriccar.com/forums/showthread.php?t=134225
 
Thanks for the ELCON charger links I had not seen that before, I will keep it in mind going forward.

Here is a block diagram from the Nissan Manual :

PDM%20charger%20pinciple.jpg


I think this is the micro controller used in the OBC/PDM as noted by Celleron55 in an earlier post from 2017/18.

https://www.divemaster.ca/RAV4EV/LEAF/r01ds0019ej_m16c5m.pdf

I am going to keep plugging along trying to get what I have up and running before I dive into R.E. it.

Having a system that is working even partly would enable me to get a scope and logic analyzer in there and that would help with a R.E. process.
My friend with the working Leaf is not going to let me get any deeper into his car than I already have so getting the parts out of the wrecked one is my best path at the moment to determine how deep I want to go.

I am hoping this thread will bring other players to the table that seem to be spread all over the place on different forums. I have reached out to those that I have direct 2013+ obc/pdm experience that I found so far and and am waiting for responses.

Thanks again for the interest you got to hunt down the data sheet for the micro-controller, that is a start.
 
49thdiver said:
Thanks for the ELCON charger links I had not seen that before...
I'm the author of the reverse engineered Elcon/TC charger firmware.

I think this is the micro controller used in the OBC.PDM as noted by Celleron55 in an earlier post from 2017/18.
All those Japanese microcontrollers are such a pain; they've been taken over and renamed so many times it's hard to know what you're dealing with. Nevertheless, I think the instruction set may be what IDA Pro calls an NEC 78K0.

I'd be happy to have a go at reverse engineering this, IF someone can find an encrypted binary firmware image to work with. The mention of the suspected processor gives me a faint hope of this, though it's much more likely that the suspicion arises from a part number on the chip rather than someone examining a binary image of the firmware. So that's a big IF.
 
I'm not sure what the goal is of understanding what any of the chips do - all you need to enable this thing to properly charge is to emulate the signals from the VCM. This is 90% CAN bus and a few direct signals.

The CAN messages you're getting are strange. Very strange indeed. I've never seen a RTR (remote transfer request) happen on EV-CAN before, so I think this is either some kind of failsafe for when communication is completely dead, or possibly an issue where you didn't properly set up your CAN parameters. The ID 30C is also something I have never seen on any Leaf. Not even when scanning for DTCs or requesting data from processors. It might be something I have overlooked for sure, I haven't played with the PDM yet, but at this point I'd investigate that bit first.

I do not have engineering data for the PDM itself, but I expect you're going to need at least:
- 0x1F2 messages, which contain among other things the commanded charge power, charging state and VCM state
- 0x1DB messages (battery voltage/current and error flags)
- 0x1DC messages (battery allowable charge/discharge power and pairing code).
- 0x50C messages (VCM wake/sleep request signal)

Logical extensions of this set would be:
- 0x55B (SOC, LBC answer, etc.) - I've tinkered with blocking this message before, and have gotten PDM DTCs

Sending all of these with a replay attack (I can provide a CAN trace of a charging session if you like) should yield a functional charger. However, there are a few more connections you need to make:
- The VCM pin 72 and 73 seem to be necessary to initiate a charge (interlock pins)
- You need to synthesize the F/S CHG relay

Some more corrections to earlier comments: the PDM DC/DC converter AND the OBC are both fairly general purpose chargers. Yeah, you heard me right. The OBC is basically a firmware power-limited lab power supply that will happily supply 200-450V to anything you connect to it - it is current-controlled. The PDM DC/DC is likewise a 1.25kW 400V to 6-16V dc/dc converter that will just try to keep its output voltage at the level you tell it to be, delivering up to its maximum current rating. They're both not QUITE versatile enough to actually be used in any EV, but they're certainly versatile enough to use with different chemistries and series count batteries. If these can be reverse engineered and operated reliably, that makes the Leaf drivetrain incredibly valuable to car conversions. One of the most expensive and cumbersome parts of getting a conversion to work is figuring out the dc/dc and charger, and the Leaf 'engine' has everything you need in a nice, neat package, ready to go.
 
I submitted different data streams to the channel:
1. a clean stream taken from a working car.
2. A stream with emulation of a current and voltage sensor.
3. Stream with data from the motor, etc. The charging device starts, there are no errors, but the battery does not charge ((
Perhaps the charger is connected to the engine and uses it as a transformer.
 
mux said:
- all you need to enable this thing to properly charge is to emulate the signals from the VCM. This is 90% CAN bus and a few direct signals.

I can provide a CAN trace of a charging session if you like

Thanks Mux for your message, this has confirmed what I have been thinking, some of your tips I have implemented already and the others I will include in the build presently underway.
Update August 2020 : This was resolved by not using the digiview it was misinterpreting the can data.
I am also glad to hear your comments on the strange messages, there is certainly no record of these in the info out there. These messages do not reoccur on the working leaf. I am using a dataview logic analyzer with CAN protocol decode on their Digivew D9 software. It may be as you said a result of no other module connections to provide answers. I would appreciate it if you could send me or create a link to your traces of a charge session. This would help a lot.

I would like to get one of your man in the middle devices, as I am sure you can appreciate this would also help enormously. I have messaged you elsewhere. Send me a message with details I and I can send your an etransfer by return. I checked your tindie store a couple of times.

I spent all of today hooking up the modules to re-establish the communication links and system requirements.
I hope to finish the by the end of the week and I hope to get some good data as a result. The man in the middle will be one of the next steps to get a working system.

Thanks again for your message, after a day in the shop connecting wires, it really made my day.

Cheers.
 
That is a beautiful drawing I wish there was one like that for the 2015. The same detail for the 2015 is spread over 8 drawings with another 4 that you need to know some detail from. I will post my working diagrams when I get home next.
The simple answer to your question is I don't know, the 2012 is very different from the 2015 which is what my focus is. The answer is of course dependent on what your objective is, i.e. if you only want to run the charger or if you want other functionality. At the core or what ever your objective is, you have to consider two things minimum function to power up in some fashion and can bus error handling associated with what ever systems your remove and what information or commands the remaining systems need to function. I am not at the stage where I can definitively say what the minimum configuration is for the 2015. I can share the following from a standalone charger/battery pack perspective.
You can pull abs, braking(other than brake pedal switch),airbags A/C, and the inverter and another bits associated with vehicle movement. There are some fail safe functions that need to be considered. At a minimum you need the BCM, IPDM, and the BMS, if one can spoof some of the physical functions of the BCM and IPDM it might be possible to get rid of them but they are on the can bus and the added complexity of can error handling may not warrant it.
Consider none of this was designed to work independently and may not, there is no simple plug and play solution, tackling this requires systems knowledge, canbus & software experience as well as an electronics background. I think it's fair to say this ground where fools fear to tread.

My project has been underway for a month since we got the wrecked leaf, it was being planned 6 months ago and will be weeks to months maybe more before I get to a place where I know its working and or is reproducible.
Keep an eye on this thread I am committed to posting what I learn so I can learn from others and we may all benefit.

All the best and good sailing.
 
MUXAN was right :
mux said:
The CAN messages you're getting are strange. Very strange indeed. I've never seen a RTR (remote transfer request) happen on EV-CAN before, so I think this is either some kind of fail safe for when communication is completely dead, or possibly an issue where you didn't properly set up your CAN parameters.
The logic analyzer was decoding the can messages incorrectly, I will go back and figure that out later maybe.
I finally got a man in the middle going with the CanDue ver 2.2 Shield from EVTV on an Arduino due and using Collin Kidders code. The messaging now makes much more sense, see the linked spreadsheet.
https://www.divemaster.ca/RAV4EV/LEAF/Working MIM March 23.xlsx
I received Mux's CAN Bridge but am waiting for the programmer to implement it. I will use this in the car when I figure out the messaging I hope. On Friday I am going to re-record the command stream using the Arduino MIM device on a working Leaf and use that data to compare to what the stand alone charger and the VCM are producing to determine what missing and to try once again to get the charger to do something.
 
Did any one get the OnBoard charger working for a Gen1, working and info very different ?

This is image I made up for a 2011 Gen1
0000631_blogimages.jpeg


But still not sure what to do for CAN messages to get it to work
https://www.mynissanleaf.com/viewtopic.php?f=37&t=31035&p=582016#p582016

And what do we do with these two ?
On board charger Plug 26 (Pin 18) - Ev activation request signal, connects to Plug E63 (pin96) on VCM
On board charger Plug 26 (Pin 21) - Plug in signal, connects to Plug M34 (pin 9) on Combination meter
 
Back
Top