LEAF CANbus decoding. (Open discussion)

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
In the google doc we have a few "is this speed/volts/torque?" for a few of the high priority (10ms) messages. I thought of two little tricks to find some of the inverter messages: while in reverse at say a few MPH, throw the car into drive. With the parking brake on, put the car into drive and put a little throttle on to make the motor push against the brakes. From those two tests (in a secluded area with nobody around!) I found the following on the EV CAN bus:

Message 1D4 bytes 2-3 2's complement is in fact commanded torque. Units are unknown but I've confirmed the value is positive while the car was still going backwards but "accelerating" forward (after I put it into drive from reverse while moving).

Message 1DA bytes 4-5 2's complement is motor RPM. Units are again unknown but this one should be easy to figure out since we know wheel speed from other values as well as the reduction gear ratio. Probably 0.5 rpm/bit.

Message 1DA byte 8 with the mux identifier as byte 7 shows the individual phase currents for the motor, including neutral. Byte 7 00-02 are the 3 phases and 03 is the sum or neutral. Even at 10ms per message there is significant undersampling.

Anyway I have about 90% confidence on these values. I encourage anyone with a bit of space around to try the above tricks and see what's what. If you have a 2011 or 2012 with the electronic parking brake note that if you hammer on it too much, it'll automatically disengage!
 
JeremyW said:
In the google doc we have a few "is this speed/volts/torque?" for a few of the high priority (10ms) messages. I thought of two little tricks to find some of the inverter messages: while in reverse at say a few MPH, throw the car into drive. With the parking brake on, put the car into drive and put a little throttle on to make the motor push against the brakes. From those two tests (in a secluded area with nobody around!) I found the following on the EV CAN bus:

Message 1D4 bytes 2-3 2's complement is in fact commanded torque. Units are unknown but I've confirmed the value is positive while the car was still going backwards but "accelerating" forward (after I put it into drive from reverse while moving).

Message 1DA bytes 4-5 2's complement is motor RPM. Units are again unknown but this one should be easy to figure out since we know wheel speed from other values as well as the reduction gear ratio. Probably 0.5 rpm/bit.

Message 1DA byte 8 with the mux identifier as byte 7 shows the individual phase currents for the motor, including neutral. Byte 7 00-02 are the 3 phases and 03 is the sum or neutral. Even at 10ms per message there is significant undersampling.

Anyway I have about 90% confidence on these values. I encourage anyone with a bit of space around to try the above tricks and see what's what. If you have a 2011 or 2012 with the electronic parking brake note that if you hammer on it too much, it'll automatically disengage!

Interesting idea but I am not convinced it really provides insight. Both commanded torque and motor amps will be positive if imparting positive torque - regardless of the motor rotation direction. This occurs when accelerating forward (top right scenario) or decelerating reverse (bottom right) which is the mode you entered when you threw it into D from R. Similarly, during forward regen (top left), 1D4:23 goes negative when regen braking although you are still rotating the same direction. So I don't think we can make any conclusion on whether it is commanded torque or actual current or torque.

regen-fig4.jpg


Also, how did you conclude that 1D4:45 is motor rpm vs. motor Volts (Volts is directly proportional to motor speed)?
 
TickTock said:
Also, how did you conclude that 1D4:45 is motor rpm vs. motor Volts (Volts is directly proportional to motor speed)?
Because the value was 0 even when applying a torque with the parking brake on. There should be some voltage present, because when you look at pack current or even the phase currents there is a current flowing through the motor with the rotor locked.*

The value I believe is commanded torque has no noise, where as everything else I've seen from the inverter/battery that is a real world value has some noise on it. Further, it always leads the motor rpm message and motor amps. It has a no inertia vs the rpm message which seems "realistic" in it's inertial qualities. Motor amps has more noise and is "softer" than the commanded torque.

*Note if you try this don't do it for very long! This is a good way to cook the rotor.
 
TickTock said:
decelerating reverse (bottom right) which is the mode you entered when you threw it into D from R.
Note that the leaf does not regen when going in reverse if you are using the regular brakes. In this case the leaf will use the friction brakes to stop, and the "commanded torque" value should be near zero.
 
JeremyW said:
TickTock said:
Also, how did you conclude that 1D4:45 is motor rpm vs. motor Volts (Volts is directly proportional to motor speed)?
Because the value was 0 even when applying a torque with the parking brake on. There should be some voltage present, because when you look at pack current or even the phase currents there is a current flowing through the motor with the rotor locked.*

The value I believe is commanded torque has no noise, where as everything else I've seen from the inverter/battery that is a real world value has some noise on it. Further, it always leads the motor rpm message and motor amps. It has a no inertia vs the rpm message which seems "realistic" in it's inertial qualities. Motor amps has more noise and is "softer" than the commanded torque.

*Note if you try this don't do it for very long! This is a good way to cook the rotor.
OK. I buy that - there should be some voltage from series losses.
 
JeremyW said:
TickTock said:
decelerating reverse (bottom right) which is the mode you entered when you threw it into D from R.
Note that the leaf does not regen when going in reverse if you are using the regular brakes. In this case the leaf will use the friction brakes to stop, and the "commanded torque" value should be near zero.
Did you see regen when you threw it into D while moving in reverse? I would assume so - otherwise, where is the energy going?
 
Thanks. Nice sleuthing, Jeremy. I updated the 1DA entry. I suspect you are also right on 1D4:23 since it is a less noisy signal than the motor amps but will leave the ? until we devise a more positive proof like your torque while stationary voltage vs speed test. Maybe lift the wheels off the ground so there is minimal inertia to fight and floor it, then do the same on the road, and compare the results. I would assume the same requested torque (at least briefly) but should have considerably less current for the first case.
 
Thanks! :) I suppose I could disconnect the inverter communication connector (the grey plug on the passenger side of the inverter) and then boot the car up and see which CAN messages disappear.
 
JeremyW said:
Thanks! :) I suppose I could disconnect the inverter communication connector (the grey plug on the passenger side of the inverter) and then boot the car up and see which CAN messages disappear.
LOL! and how much the dealer wants to charge you to reset the DTCs. :)
 
Updated the CAN msg doc with timing info (ms between messages) on the CAR CAN bus as observed with my 2012. Also updated a few timings on the EV can side too.

CAR CAN has some weird timings. The second highest priority message has a 100ms cycle time, while all the high priority messages around it are 10ms. There's a few different intervals used such as 20ms, 40ms, and 60 ms.

I also have notes on which CAR can messages are active when the car is off (for a short while) or in acc mode, but I'll leave that for tomorrow...
 
On my 2012 I've noted the following CAR CAN messages are active during accessory (one press of the power button w/o brake press) or a short while after the car is off:
1CA
1CB
215
216
280
2DE
351
355
358
35D
5C5
5E3
60D
625
 
Per the service manual, the active fuel bars and charge time are sent via the VCM to the TCU for carwings. The VCM is the one that calculates the number of bars. On CAR CAN this is message 5B3, on EV CAN this is message 5B9 with a cycle time of 512ms. TickTock noted that 5A9 appeared after an update in 2012. It might be the TCU looks for any messages in the 5x9 range and forwards them on to the mothership. ;)

I'm inclined to believe 5A9 is also sent from the VCM as it has the same cycle time (5A9 also appears on CAR CAN bus with different data).

I've updated the CAN message doc with the correct originator for 5B9 (previously I thought it was the BMS/LBC).

Also, I believe 5B3 on CAR CAN has pack temperature (probably averaged between the sensors) on the first byte.
 
So I found an old PDF with Pipcecil's DTC freeze frame info from when he had the OBC failure back almost a year ago [thread here][PDF here]
A few things I've noted from this:
OBC amperage is shown only as a single digit (8A), not a lot of precision there.
Available HV Battery power is 110kW, which matches EV CAN message 1DC byte 0.
"Chargeable Pwr MAX" for L2 charging is somewhere around 32kW
Regen Power is a separate value than chargeable power, and is a hilarious error of 256kW during charging (so probably a byte and an extra nibble bit on a message).
Coolant temp was 60F and charger temp was 70F so the temp sensor for the charger is probably not on the heatsink (probably on the control board) since the charger had just started up.
The quick charger voltage sensor is pretty accurate (maybe) with 3 digits after the decimal (5 sig figs!).
"VCM State" is listed as 130, which is what message 1F2 byte 5 is on my leaf when L2 charging.

I previously suspected that 1F2 was from the VCM, and after going through some logs and consulting the "EVC" section of the service manual, I've confirmed that byte 5 on 1F2 is the VCM state and thus the message is coming from the VCM.

A few small puzzle pieces have found their place. :)
 
2011/2012 Climate Control...

I unplugged my CC module and booted the car and watched the EV CAN bus. Messages 54A-54F disappear, and notably the last "mystery" messages (50A-50C) don't disappear. I took a log which didn't save because my laptop crashed when I powered off the car. Oh well... Someone else can give their center panel a tug. :roll:

Notably, when you boot without the CC the car you get: no temp in the eyebrow (understandable since it comes from the CC), no GOM (three dashes that are solid, not blinking), cooling fan goes to maximum (CC sends cooling fan request to VCM for condenser heat removal), and the EV system light (car with a ! in it) is illuminated. You also set a bunch of DTC's (which I cleared with LeafSpy Pro) and when rebooting the car with the CC module attached, you'll get a blinking front defrost button before the system resets to 75 degrees, auto mode, fresh air, and feet.

I also found the following goodies on the 54B message:

Byte 2
Code:
hex	binary	state
88	10001000	Face
98	10011000	Feet and Face
90	10010000	Feet
A0	10100000	Feet and Defrost
A8	10101000	Defrost

Byte 3
Code:
hex	binary	state
09	00001001	recirculation
12	00010010	vent
92	10010010	defrost

I also noted that message 50A byte 3 has a slow increase with AC on, and a slow decrease after AC is turned off. It *might* be related to CAR CAN message 50A which has what we believe as low side pressure of the AC compressor. If that's the case, 50A-50C are from the VCM to the Climate Control. Can someone with logs of both busses compare the pair of 50A messages? :)
 
Message 50A is identical on EV and CAR CAN. I'm 99% sure it's from the VCM. Since 50A-50C don't disappear with the climate module disconnected and they are sent one right after another, I believe they are coming from the VCM.

I also found that for 2011-2012 cars (with the Nichicon charger) message 5BF byte 3 has the HV bus voltage as seen by the charger. There is 260 offset, no scale factor (1V resolution). Note that unless you are charging or QC'ing the charger is disconnected from the bus and you should see nearly 0 volts.
 
Anyone tried messing around with one of these cheap dual channel CAN adapters? Like a lot of these cheap clones seems to be sold under many different names, decided to go with this one as at least its shipped from US.
http://www.ebay.com/itm/281242431345?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT" onclick="window.open(this.href);return false;

This is my first foray into CAN, but for $50 decided to give it a shot. Kind of intrigued by the relay capability. Seems like that would let you insert the adapter between a controller and the rest of the bus and monitor what's getting passed in each direction without disturbing traffic. Maybe, if it can keep up with the flow I guess. Might be even more interesting if you can intercept and modify specific messages while relaying everything else unchanged.

Rob
 
FYI, got my adapter working. Using cat5e cable, and currently just sticking ends into the OBD port connectors. Got the channel on the EV-CAN showing clean data, but still have errors on the CAR-CAN. Assuming just contact issues. Need to get a cable built up. Would also like to eventually experiment with isolating various controllers using the relay mode and looking at which specific messages originate from each controller. That may have to wait until the system is out of the Leaf though.
Rob

17734588263_5bca019b3c_z.jpg
 
Back
Top