LEAF CANbus decoding. (Open discussion)

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
Has someone posted a reasonably comprehensive list of the CAN 'polling' query codes? I'm talking about the parameters for request codes like 797 and 745. I read through the google docs spreadsheet of CAN codes and have gotten through half of the 44 (ouch!) pages of this topic in the forum and have found only a dribbling of these codes (about 7 so far). I'm not sure of the exact terminology for these: polling codes, request/response codes, PIDs (Parameter IDs). So not knowing the official terminology I'm not sure exactly what to search for.
 
JeremyW said:
CarWings does not have a stop charging message. As far as I can tell, the command from the telematics (EV bus message 56E) is pretty simple and made up of a few bit flags.
Code:
hex	binary	state
86	10000110	idle
46	01000110	status
4E	01001110	cc on
56	01010110	cc off
66	01100110	remote charge
From the highest bit: idle, VCM wake-up logic line status, remote charge, cc off, cc on, unknown, unknown, 0. The unknowns could be 12v supply voltage voltage ok and "within cell coverage"

Since that time I've never seen anything other than these states. You could unplug the TCU and try sending some other things like 0x67: 01100111 and see if that turns it off. However, I doubt Nissan would have left this functionality on the table. The only thing that I think they might have left on the table is the code to change the remote turn on temperature. In the 2013+ models this is a command from the AV unit to the climate control computer. I haven't isolated the message on a 2013 but I suspect it *might* work on a 2011 or 2012.

You might look at EV bus message 1F2. I suspect commanded charge power is in here.

Anyone going to take this info and turn it into a simple product? I see jermyw seems to have got rid of his leaf.
A carwings replacement is very interesting for all leafs that are exportet from usa to europa. I know there is a lot of usa leafs going to Norway, and I suspect there are a lot of leafs exported.

I did a poll on a Norwegian forum, and there where 21 people that voted they wanted a carwingsreplacement for their leafs. I think there is more that would be interested in this than 21 here in Norway. Not all are on the forum.
 
I am working on my LeafSpy Pro setup. I have it all working using an old Google Nexus and the Konnwei KW902 (http://www.amazon.com/gp/product/B00R4R1VUU?psc=1&redirect=true&ref_=oh_aui_detailpage_o00_s00). This OBD2 reader has an on/off switch, but i don't know how long it will last, so I am thinking of a switched extension cable.

I was looking at the Tonsiki cable (http://www.amazon.com/gp/product/B00UR5XBMW?psc=1&redirect=true&ref_=ox_sc_act_title_1&smid=A2FJISFXR1Q6M0) but I read the details and saw that it only passes through pins 2, 4, 5, 6, 7, 10, 14, 15, and 16.

I read a nice report here (http://digitalcommons.calpoly.edu/cgi/viewcontent.cgi?article=1087&context=cpesp) that says the EV CAN bus is passed through pins 12 and 13.

Does LeafSpy use the EV CAN bus? (I can't see how it wouldn't!) Does that then mean that I need to find (or make) a switched extension cable that carries pins 12 and 13?
 
pncguy said:
I am working on my LeafSpy Pro setup. I have it all working using an old Google Nexus and the Konnwei KW902 (http://www.amazon.com/gp/product/B00R4R1VUU?psc=1&redirect=true&ref_=oh_aui_detailpage_o00_s00). This OBD2 reader has an on/off switch, but i don't know how long it will last, so I am thinking of a switched extension cable.

I was looking at the Tonsiki cable (http://www.amazon.com/gp/product/B00UR5XBMW?psc=1&redirect=true&ref_=ox_sc_act_title_1&smid=A2FJISFXR1Q6M0) but I read the details and saw that it only passes through pins 2, 4, 5, 6, 7, 10, 14, 15, and 16.

I read a nice report here (http://digitalcommons.calpoly.edu/cgi/viewcontent.cgi?article=1087&context=cpesp) that says the EV CAN bus is passed through pins 12 and 13.

Does LeafSpy use the EV CAN bus? (I can't see how it wouldn't!) Does that then mean that I need to find (or make) a switched extension cable that carries pins 12 and 13?
ELM type OBDII adapters only connect to the standard CAR-CAN pins. They have no ability to connect to the EV-CAN unless you rewire them. LeafSpy assumes your OBDII adapter is connected to the CAR-CAN.

CAR-CAN is on pins 6 and 14
EV-CAN is on pins 12 and 13
AV-CAN is on pins 11 and 3
 
Hey, after my charging adventures I noticed the equation for battery voltage at OBC 0x5BF byte 3 doesn't seem to add up in my case. This is on a 2012 SL with QC, just charging on the portable L1.

When I was having difficulty 370V was measured at the battery/charger with no current flowing and the reading was #70. Later after charging for a while I measured 378V and the CAN byte was #79.

That might mean just a 1:1 ratio and ~258V offset for x5BF byte 3?

Also, byte 2, Line Voltage was fluctuating between #95 and #97 for L1 charging.

Rob
 
nmgeek said:
Has someone posted a reasonably comprehensive list of the CAN 'polling' query codes? I'm talking about the parameters for request codes like 797 and 745. I read through the google docs spreadsheet of CAN codes and have gotten through half of the 44 (ouch!) pages of this topic in the forum and have found only a dribbling of these codes (about 7 so far). I'm not sure of the exact terminology for these: polling codes, request/response codes, PIDs (Parameter IDs). So not knowing the official terminology I'm not sure exactly what to search for.


I'm still searching for these codes. I've come up empty handed. I can't seem to get all the codes from the master spreadsheet either. 1XX Codes pertaining to BMS/VCM don't show up when I query for them directly, or with any kind of Mask/Filter.
 
I found traction battery volts at 7BB D0:D1line 03 at a scale of * 100.
IE: 239830385A038F00 = 389.6 volts
I imagine the traction battery amps are somewhere here too, but I don't know at what scale.
 
Hi guys. Would anyone happen to know an ID for a message on the CAR or EV bus (OBD) that would show that a QC or regular connector has been connected to the car? Optionally, an ID referencing the charge port door being opened?

Cheers!
 
Hi Everone,

Have not yet figured out how to post a new thread here so am replying to one to get something posted.

I have purchased an expensive bluetooth OBDII dongle that works with LeafSpy Pro and a cheap one that keeps connecting and disconnecting.

Then connected to the LEAF using Bluetooth Serial controller software with both Bluetooth dongles and sent AT commands to see what the differences are.

Here is a snippet of what I get back using the expensive Bluetooth dongle:

< at I
>
at I
ELM327 v1.5

>


< at ma
>
at ma
00 00 00 00 00 00 C2 48
00 00 00 00 00 00 C2 49
FF F0 FF 00 FF FF
<DATA ERROR
42 64 <DATA ERROR
00 FF
00 00 00 00 10 03 4C
00 00 00 00 00 0C
00 00 05 BE

00 00 00 00 00 00 02 D0

A0 80 70 02 00 00 00 38 <DATA ERROR
108
0: 80 12 04 00 00 00
00 00 00 00 00 00 2D 00
00 00 00 AA 0
BUFFER FULL

>

and here is a snippet of what I get back with the cheap Bluetooth dongle:


< ati
>
ati ELM327 v1.5

>


< at ma>
at ma
AA FC 00 07 40 <DATA ERROR
FF C0 00
00 00 00 00 00 00 02 D0
00 00 00 00 00 00 2B 00
00 00 00 AA 0B 00 00 00
00 00 00 00 00 00 0B
00 00 00 03 D9
C8 C8 7D 00 <DATA ERROR
00 00 00 00 00 00 03 89
00 00 00 00 00 00 03 8A
00 00 00 00 00 10 00 00
08 00 00 <DATA ERROR
FF F0
BUFFER FULL

>

09-09-2017 10:01:09 AM



< at ma
>
at ma
42 64 <DATA ERROR
00 FF
00 00 00 00 00 00 02 D0
00 00 00 00 00 00 40 00
AA FC 00 07 26 <DATA ERROR
00 00 00 00 00 00 1E A4
00 00 00 00 00 00 1E A5
00 00 00 00 00 00 21 00
00 00 00 AA 01 00 00 00
FF F0 FF 00 FF FF <DATA ERROR
00 00 00 00 00 00 01
42 64 <DATA ERROR
BUFFER FULL

>

Does any of this make sense to anyone? I am working on a data logger for a company that wants to trial Nissan delivery vans and wants to log specific information from the LEAF CANbus but not the same data that LeafSpy provides.

Regards,

Bert
 
bvdb said:
Here is a snippet of what I get back using the expensive Bluetooth dongle:

at ma

You'll want to pass a filter with "ATCF5B3", "ATCRA5BX" to get battery SOH for example. Buffer Overflow is a limitation of the ELM.
See some of my code here for documented codes (bottom of page): https://github.com/blandman/HappyLeaf/blob/master/app/services/flow-manager.js

If your appliance is specific, you can find more data on EVCan, but cannot access that through ELM.
 
Hi. I'm planning on controlling a Leaf inverter on my own, with none of the rest of a Leaf at my disposal.

I've done some reading and it appears the inverter is able to store DTCs and go in a permanent low power mode according to the stored DTCs.

It seems I cannot clear inverter DTCs using LeafSpy because if it was able to clear them, it would do it through the VCM. I don't have a VCM.

Does anyone have a capture of the EV CAN bus when inverter DTCs are being cleared, or does anyone have the resources to do one for me?

E.g. unplug the motor sensor wire to get some DTCs and then capture the reading and clearing of them.
 
celeron55 said:
Hi. I'm planning on controlling a Leaf inverter on my own, with none of the rest of a Leaf at my disposal.

I've done some reading and it appears the inverter is able to store DTCs and go in a permanent low power mode according to the stored DTCs.

It seems I cannot clear inverter DTCs using LeafSpy because if it was able to clear them, it would do it through the VCM. I don't have a VCM.

Does anyone have a capture of the EV CAN bus when inverter DTCs are being cleared, or does anyone have the resources to do one for me?

E.g. unplug the motor sensor wire to get some DTCs and then capture the reading and clearing of them.
To clear DTCs from a standalone motor/inverter unit you would need a new version of LeafSpy Pro that skips trying to read information from all the other ECUs.

This was done to support clearing BMS DTCs from a standalone battery pack.

I can look into adding that on a future update I am working on for another person. You would then go into Settings and change the Model year to Motor/Inverter.
 
Turbo3 said:
I can look into adding that on a future update I am working on for another person. You would then go into Settings and change the Model year to Motor/Inverter.

I imagine then I'd just connect the EV CAN bus to the regular CAN pins of an ELM327, fiddle with some settings and be on my way?

Any estimate on when this feature would be available?
 
celeron55 said:
Turbo3 said:
I can look into adding that on a future update I am working on for another person. You would then go into Settings and change the Model year to Motor/Inverter.

I imagine then I'd just connect the EV CAN bus to the regular CAN pins of an ELM327, fiddle with some settings and be on my way?

Any estimate on when this feature would be available?
Working on it right now. Probably a couple of days.
-------------------------------------
Update done. Version 0.40.107, which I will release shortly, now supports a Motor/Inverter only mode. Just go into Settings and select the top most item for Model Year ("MTR/INV").

Use this link to get the latest test version. https://play.google.com/apps/testing/com.Turbo3.Leaf_Spy_Pro
 
Ha, nice! Now I just need an Android device of some kind... LOL

I modded a sure-fire way to clear DTCs from my inverter:

hIfPCZr.jpg


Yes, it now has a replaceable EEPROM that I already read onto my laptop. This was the content: https://pastebin.com/Vb3WGWks (tighter format: https://pastebin.com/dUAREEvr)

Interestingly, I can find my resolver calibration values in there. (The plate on the motor reads 78 0073 0058)
 
celeron55 said:
Ha, nice! Now I just need an Android device of some kind... LOL

I modded a sure-fire way to clear DTCs from my inverter:

Yes, it now has a replaceable EEPROM that I already read onto my laptop. This was the content: https://pastebin.com/Vb3WGWks (tighter format: https://pastebin.com/dUAREEvr)

Interestingly, I can find my resolver calibration values in there. (The plate on the motor reads 78 0073 0058)
Can you take a screenshot of all the DTCs before you clear them?
 
celeron55 said:
Ha, nice! Now I just need an Android device of some kind... LOL

I modded a sure-fire way to clear DTCs from my inverter:

hIfPCZr.jpg


Yes, it now has a replaceable EEPROM that I already read onto my laptop. This was the content: https://pastebin.com/Vb3WGWks (tighter format: https://pastebin.com/dUAREEvr)

Interestingly, I can find my resolver calibration values in there. (The plate on the motor reads 78 0073 0058)

Whose large processor is located near the serial EEPROM you removed, i.e. the one most likely doing system diagnostics?
Surely that processor has flash, but having an external EEPROM possibly simplifies external access for diagnostic tools.
 
lorenfb said:
Whose large processor is located near the serial EEPROM you removed, i.e. the one most likely doing system diagnostics?
Surely that processor has flash, but having an external EEPROM possibly simplifies external access for diagnostic tools.

The board has two Renesas MCUs: R5F71476FPV (the big 32-bit one) and R5F2120 (a 16-bit one on the backside). Neither has internal EEPROM, and usually you don't store anything in flash when you have an external EEPROM at your disposal.

More photos if someone is interested (including all chip markings on the logic board, annotated where not visible otherwise): https://imgur.com/a/cQNVs

Does anyone know of a gen2 EV CAN capture for a "switch on, switch to D, drive, stop, switch off" sequence?

I'm currently basing my work on a gen1 capture, which is not ideal at all.
 
celeron55 said:
lorenfb said:
Whose large processor is located near the serial EEPROM you removed, i.e. the one most likely doing system diagnostics?
Surely that processor has flash, but having an external EEPROM possibly simplifies external access for diagnostic tools.

The board has two Renesas MCUs: R5F71476FPV (the big 32-bit one) and R5F2120 (a 16-bit one on the backside). Neither has internal EEPROM, and usually you don't store anything in flash when you have an external EEPROM at your disposal.

More photos if someone is interested (including all chip markings on the logic board, annotated where not visible otherwise): https://imgur.com/a/cQNVs

Does anyone know of a gen2 EV CAN capture for a "switch on, switch to D, drive, stop, switch off" sequence?

I'm currently basing my work on a gen1 capture, which is not ideal at all.

Thanks for the info. Most Bosch automotive ECMs for the last 15-20 years rarely use a small serial EEPROM and utilize the processor's
on-board flash. That serial memory was mostly used to store a rolling remote key code for the main ECM processor's immobilizer function.
 
As far as I know, Bosch doesn't make anything in the leaf. The main ECU is made by Hitachi. TCU is by Continental. My guess is the inverter is designed by Nissan in house.

celeron55, some great work there. Can you post the EEPROM contents? What are you using the motor for?

Maybe a new thread is necessary for your project. :)
 
Back
Top