My findings on the CAN bus

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.

turbo2ltr

Well-known member
Joined
Jul 31, 2010
Messages
1,376
Location
Phoenix, AZ
I am going to preface this with a disclaimer. I have been in the business of automotive datalogging for the past 10 years. My primary reason for spending every waking moment for the past few weeks working on this is so I can make products that will pay the bills. I'm going to share some information I have found simply to benefit the community. I will not be sharing the detailed findings of my reverse engineering efforts. I feel I'm in a unique position market-wise (having a car very early in the game) and with the economy the way it is, I really *need* to take full advantage. With that said, please don't get upset if I don't answer your questions.


I deal with CAN almost daily, but it was always on products that were engineered by us or at the very least, we knew exactly what we were looking at via full documentation.

I used a CAN to USB adapter for all work. It's a straight CAN adapter, not one that tries to connect to OBDII.

I knew in order to get anything done, I'd need a way to process data efficiently. At the speeds the data comes over the bus, you end up with incredible amounts of data very quickly. This lead me realize I need to develop my own program. This program allows me to monitor data, "watch" variables, "play" previously saved log files in real time (or faster/slower) to simulate driving, and send out my own modified messages very easily. It was quick and dirty so it's not pretty but it worked great.

canmon.png


My primary goal going in was to find a true SOC number. It seemed LEAF owners wanted this the most so I was intent on giving them that.

I found messages for:
  • range
  • the climate control +/- miles
  • SOC and capacity Bargraphs
  • All kinds of steering data such as steering angle, steering force and steering rate of change
  • Numbers that look like torque readings
  • per-wheel brake pressures
  • all kinds of status type of data.. Switches, parking brake, PRNDL, want to know if the left turn signal bulb is on? no problem.

Due to the nature of EVs, it is harder to differentiate between speed and motor RPM than ICE cars since they are coupled by single gear reduction box, so while I did find messages that appeared to be speed related, i did not pursue decoding the scaling of these parameters.

After initial excitement of finding the range/soc display controls, I quickly found out that the messages I found were just a way to control the dash. I was initially hoping the SOC would be sent to the dash and the dash would interpret the SOC into bargraphs. But no "computing" is done in the dash, the messages were strictly for controlling the dash.

So I continued my search and after a lot of searching and head scratching, I do believe I have found SOC.

Because there is no SOC numeric display to verify the findings, I had to do tests. The only feedback the car has is range and the SOC bargraphs. It was evident the bargraphs were not going to be useful for this (I'm not going to get into why). But if I send out my own message with a fake SOC value, the range on the dash changes. I needed to be sure that the number I thought was SOC wasn't really some range number. So I ran some tests.

I charged 100% last night which gave me 95 mile range. I plotted range vs what I suspected was SOC by sending out fake messages and observing the dash. I took note of where the battery low, battery very low and turtle mode were activated as well.

I then went for a 10 mile drive at 75-80 mph. My range went from 95 to 52 but I only lost two SOC bars, meaning the range adjusted for my forcasted driving style. I returned and plotted them again. By comparing the plots, one could see if the alleged SOC number was really SOC or was a range number that would have been corrected for driving style. You can see two distinct lines in the lot below. The lower one is the plot after I returned (I didn't plot nearly as many points).

rangevssoc.png


I again checked what values the low battery, very low battery and turtle mode occurred and the values did not change, despite the range at which those events occurred changing.

Prior to the highway run:
Low batt: 16mi
Very low bat: 8

After Highway run
Low Batt: 13
Very low bat: 6

There is no range displayed when turtle mode is activated, but it was triggered at the same SOC number both before and after the trip.

According to my math, Low battery warning happens at 18%. Very low battery happens at 9%. Turtle mode happens at 2%. Some of you guys have done tests, how does this compare with what you came up with?

So with that said, I am confident this is the number we seek. Now on to step two...bringing it to the consumers..
 
Wonderful work, Turbo! Thanks for keeping us in the loop as you see fit.

Product wise - are you thinking a 'scangauge' like appendage, or a software upgrade that brings a new or re-purposed display?

Are you able to catch the buss from the diagnostic port, or have you had to dig into the wiring?
 
I have some ideas on working it into the existing dash display, but I need to do further testing. Not sure it will work. If it doesn't then yes, it will be a bit of hardware, probably something similar, but smaller than scangauge.
 
Cool.

Looks like my edit overlapped your post.

Are you able to work from the diagnostic port or did you have to tear into the wiring?
 
Very interesting work, and I would encourage you to continue it. I recently bought one of the bluetooth devices like this: http://www.amazon.com/Bluetooth-ELM-Scanner-OBDII-Diagnostic/dp/B004B7YXOM and I've used my android phone with Torque https://market.android.com/details?id=org.prowl.torque to get information from my other car. All quite entertaining!
 
Excellent job, Mr. Liter! (Or can I call you Turbo?) ;)

I think it's totally understandable that you want to monetize this in the early going. Hopefully people will understand.

I would be very interested in an Android "app" that could display some of this info. An iPhone app would appeal to others, no doubt. Would one of the aforementioned Bluetooth doohickies work for what you are doing? (Do they pass the data that you need?)

I like the idea of piping the SOC data to the existing display too, of course. Would you be "overloading" one of the existing variables to do this? Something like having the climate-control power "dial" show SOC instead?

Maybe one of the clocks?
 
I have a ScanGuageII that does CAN bus info. If you want me to help test your codes, let me know and I'll be happy to plug 'er in and see what we get.
 
I've never used a SG but i took a quick look (so I could be mistaken) through their manual. It seems the custom messages you can program are OBDII messages (686A...) Yes you can do OBDII over CAN, but everything I've done so far is at the CAN message level. I've been dealing with raw can messages already being broadcast on the bus. OBDII is a higher level protocol that requires a request in order to get a response.
 
turbo2ltr said:
I have some ideas on working it into the existing dash display, but I need to do further testing. Not sure it will work. If it doesn't then yes, it will be a bit of hardware, probably something similar, but smaller than scangauge.
I think there are quite a few of us who will be more than willing to pay you for something that gives us a meaningful SOC. This is a truly exciting report!

Ray
 
turbo2ltr said:
I've never used a SG but i took a quick look (so I could be mistaken) through their manual. It seems the custom messages you can program are OBDII messages (686A...) Yes you can do OBDII over CAN, but everything I've done so far is at the CAN message level. I've been dealing with raw can messages already being broadcast on the bus. OBDII is a higher level protocol that requires a request in order to get a response.

That's my understanding too - you (or the SG) puts a request on the bus and listens for, and decodes and scales the reply. The user programmable portions are called the X Gauges.
 
turbo2ltr said:
According to my math, Low battery warning happens at 18%. Very low battery happens at 9%. Turtle mode happens at 2%. Some of you guys have done tests, how does this compare with what you came up with?
According to Nissan - low battery accors when 4 kwh of capacity remains. If we assume 24kwh, that is 16.7%. Quite close.

I didn't know there is a "very low" battery level as well. I thought after low battery, you went into turtle ...
 
Will CAN bus info finally and definitively tell what the total capacity of the pack is ??

/inquiring minds want to know
 
evnowI didn't know there is a "very low" battery level as well. I thought after low battery said:
Yup ... I hit "very low" at least twice last Sunday on my "limping" return to home base ... I did see "---" on the range, but have still not hit "Turtle" ... I guess I need to become even more "adventurous" :lol:
 
LakeLeaf said:
turbo2ltr said:
I've never used a SG but i took a quick look (so I could be mistaken) through their manual. It seems the custom messages you can program are OBDII messages (686A...) Yes you can do OBDII over CAN, but everything I've done so far is at the CAN message level. I've been dealing with raw can messages already being broadcast on the bus. OBDII is a higher level protocol that requires a request in order to get a response.

That's my understanding too - you (or the SG) puts a request on the bus and listens for, and decodes and scales the reply. The user programmable portions are called the X Gauges.

So if Tronz figures out where the raw CAN messages are being broadcast, can't we just program an Xguage 'request' for the information and then decode the result?? (Obviously, I'm not that technically minded, but my SG does do X Guages)
 
I didn't know there is a "very low" battery level as well. I thought after low battery, you went into turtle ...

Keep in mind that "tricking" the car like I was might change it's behavior, but there was a definitive repeatable pattern. There was a low battery warning which popped up on the dash and turned on the "gas pump with a plug" light.. Then there was the very low warning, which also prompted the NAV system to ask if you want to find nearby chargers and changed the warning on the dash LCD to indicate 'very' as well as changed the range to ---. Then there was turtle mode which illuminated the turtle light.

Will CAN bus info finally and definitively tell what the total capacity of the pack is ??

Anything is possibly but CAN messages usually do not contain "static" type data.
 
Carcus said:
Will CAN bus info finally and definitively tell what the total capacity of the pack is ??

/inquiring minds want to know
My guess is no, because all of the car's systems keep us in the 'consumer safe zone'. There might be capacity info in the battery controller we can requst/retrieve with a diagnostic too, but I can't see a reason why it would be broadcast on the buss.
 
Carcus said:
Will CAN bus info finally and definitively tell what the total capacity of the pack is ??

/inquiring minds want to know

If you kept track of pack or module voltage you may be able to figure it out if you make certain assumptions on cell chemistry.. should not be too hard to obtain, but please dont get electrocuted. We will know soon.
 
I know people keep holding out hope for the ScanGaugeII, and I have one myself, but it's really not a fit.
It just does ODB-II messages -- first over the ISO9141-2 low-speed bus, and then using OBD over CAN.
I don't think it can do generic CAN message snooping, but I could be wrong. I think only does OBD queries over CAN.
You can't tell it to watch for a specific message, interpret the data this way, and display it. At least, that wasn't in my manual. :)

One option for display would be to grab the "true" SOC and re-purpose some part of the LEAF dash to display it.. like the Range display. Just override the display messages coming from the ECU with SOC. I don't know if you would have to intercept (reroute, drop message, insert new one), but since you were able to already display your own values, I suspect you can do it through the port already.


If you can display text on the "time to charge" display, even better.

This is actually similar to what the Tesla did with the Lotus dash. It's all CAN messages, on a separate bus than the motor/brake controls. They just re-used the LCD display are for more Roadster-specific things, last I saw.
 
Another useful feature would be a Carwings "agree-er", if you can spoof button presses over CAN.
A ped-warning disable too. Something to hit the button for you on power-on.
 
Back
Top