EV-CAN message Decoding

This thread is for discussing the meaning of the messages that occur on the LEAF's "EV" CAN buss.

About 1 million messages per hour were recorded during a 6-hour charging (20% to 100%) session.

A message-ID that appears to contain the "SOC" occurs on this buss about every 6 seconds while charging.

I have posted one 6-million EV-CAN-message example ".evc" file (a 6-hour charging session).

I have also posted a ".csv" file with a "recipe" for each of the various "decoded" values that have come to my attention.

These files can be read by my evolving "CAN-Do" program (also posted, for WinXP, Vista, and Win7). With these files you can use the program to look for yet "undiscovered" meanings in the 8 bytes of data that are part of each (most) messages.

See http://www.wwwsite.com/puzzles/cando/
to download copies of these files if you want to "play" in this game, without any hardware or expense. No, no User Manual yet. See the "CAN-Do: a CAN-message Analysis Tool" thread for more details.

CAN-Do can capture, log, help with analysis, do data graphing, and even display a time-lapse or real-time "dashboard".

In EV-CAN message 1DA, data bytes D5 and D6 (of D1 to D8) form
a 16-bit 2's comp number, apparently representing the motor RPM.

It is included in my Recipe v1.01 and the Dashboard of CAN-Do v142
(I just posted both).

EV-CAN Message 55A appears to have 3 temperatures that gradually climb while charging: D2, D3, and D6

The units could be Degrees F (ºF), but it would seem strange that Nissan would not use Degrees-C.

These raw values go from about 69 to 89 ... so too high for ºC. Even 2 times ºC (35 to 45) would be too high.

The range of "20" ... (thinking...)?
IF the range is really 10 ºC, that is 18 ºF, so that is possible, with the raw data being half-degree steps.

However, 1/4 degree ºC steps (9 ºF temp rise) is "better" for the 6-hour temperature rise.

So, MAYBE, "about" 68 to 88 raw becomes 17 to 22 ºC ... quite believable.

So, let's consider that these numbers MIGHT be ºC times 4 (1/4 degree steps).

The raw RPM value goes negative for Reverse.

Also, it looks like the "raw" value (in the EV-CAN message) is really 2x RPM.

garygid said:

So, let's consider that these numbers MIGHT be ºC times 4 (1/4 degree steps).

Click to expand...

Certainly possible; the sensors I've used do exactly that when you put them at a higher resolution.

garygid said:

EV-CAN Message 55A appears to have 3 temperatures that gradually climb while charging: D2, D3, and D6

The units could be Degrees F (ºF), but it would seem strange that Nissan would not use Degrees-C.

These raw values go from about 69 to 89 ... so too high for ºC. Even 2 times ºC (35 to 45) would be too high.

Click to expand...

There is no way that they are using F. And not resistance.

From Service Manual, April 2011, page EVB-140:

OK, so ºC in 1/4 degree steps seems likely.

During the 6-hour charging, D2 and D3 are quite similar, falling off just a little after the the charging is "done". One of these has a small "dip" just after charging starts, the other does not. The one with the dip might be closer to the external pipes that take coolant back to the Charger?

So, these two might be Battery Temps, but why are there not 4 being reported.

D6 is similar, but it does not "fall off" like the other two.

I need to look at these "temps" in the 35-mile driving log (that I made and posted yesterday).

Gary, we know which pins to test for temperature from the service manual. Could we "ping" each pin and look for the result on the CAN?

It seems that that could be as simple as grounding each pin, looking for the 55 C plus temp., or looking for the change in CAN value.

1. So far, WE do not know what command to put (insert) into the EV-CAN bus message stream (about 1,000,000 messages per hour) to ASK for anything.

Turbo2ltr reported inserting slightly-altered copies of observed messages (like the occasional (600 per hour) message that carries the SOC data) to briefly "trick" the VCM and Dash-Display into showing "incorrect" Bars.

2. Accessing the Battery Pack connector (if that is where these pins are) might be a problem, especially with the LEAF running.

Better than shorting would be using something like a 10-ohm resistor (presumably to ground), and watching for a "dip" in one of the temp values (soon to be) displayed on CAN-Do's Dashboard.

I didn't suggest some fancy command! Shorting to ground is just zero resistance. A resistor is fine too.

To access those pins isn't hard with a car lift. Might have to pull a pin from the receptacle or cut the wire to insert the resistor to ground.

If you want to come down next week, we can put my car on the lift to search for this. The actual connection is on the front of the battery pack, right below your Dr. Pepper. Just a small assortment of hardware to remove to aerodynamic belly pan, and I think four screws to remove the battery connector.

Probably have to disconnect the 300-ish volt DC pack voltage first ;-)

Will the car turn ON enough for the EV-CAN bus to create messages?

Possibly without the HV, but ... the many-pin connector would need to be screwed onto the battery pack, right?

If the sensor resistor is litterally connected between the stated pin and ground, where is the hardware that reads the sensor?

Maybe it would be easier to "spoof" the reading at the sensor-reading end of the wire harness.

The reason for the resistor is, that shorting to ground could trigger some kind of BMS fault, causing your car to insist on being taken to the dealer. But so far I have a track record of 0 for n when it comes to guessing what the BMS actually does, so what do I know. Firmware that I've written will ignore shorts and opens and try to use the remaining sensors as best it can. That's the other liability, that it might just ignore your attempts.

Given that the manual shows resistances, they probably use thermistors and convert analog-to-digital and do their own conversion to temperature. And I'd have to retract my statement about resolution versus reported numbers, as that applied to the direct-to-digital chips. But they certainly can still convert to whatever numbers they like.

I think that when it comes to "trying stuff", the mantra would be, "Go for it, Tony; We'll watch from a safe distance! "

Looking at 55A2, D3, and D6 in the 45-minute 35-mile driving log (on-line), D2 looks like it might be "battery temp", but D6 is essentially constant, and D3 has high-frequency components, but its average essentially matches D6.

Neither D3 nor D6 are increasing during the trip.

So, I am guessing D6 MIGHT be Charger Temp, D3 PERHAPS Inverter Temp, and D2 the "combined" Battery Temp.
But, still just guesses.

garygid said:

Will the car turn ON enough for the EV-CAN buss to create messages?

Possibly without the HV, but ... the many-pin connector would need to be screwed onto the battery pack, right?

Click to expand...

I obviously haven't tried this, so here's what I envision. The data collecting device would be plugged into the OBD2.

The car is put on a lift, and per the Nissan Service Manual, the front wiring connector is disconnected from the battery controller. The manual most probably has the scary DC stuff turned off. Don't know 'till I read it.

Then, we'd use our super sleuth techniques to patch in a resistor to ground, bypassing the actual analog thermister(s). Then reconnect the plug (fully powered) and start looking! I'm not suggesting this to somebody who has never worked on cars, or can't read a schematic, or has no experience in troubleshooting electronics, so "DON'T TRY THIS AT HOME".

It doesn't have to be successful, just a logical SAFE process.

gbarry42 said:

The reason for the resistor is, that shorting to ground could trigger some kind of BMS fault, causing your car to insist on being taken to the dealer. But so far I have a track record of 0 for n when it comes to guessing what the BMS actually does, so what do I know.

Click to expand...

Good points. I think we can find a few resistors to use. I'd hate go have to take the car in for unnecessary warranty work.

Maybe the battery should get dropped, being only six bolts away at that point.

If just the temp sensors are inside the battery, and the screw-on, multi-pin grey connector connects the temp-sensitive resistors to a measuring circuit elsewhere, then leaving the LEAF in ACC2 mode (so the EV-CAN bus is active) might leave the HV not-activated.

Then, unscrewing the "sensor" connector (while logging) and connecting a 5 or 10 ohm resistor to the correct pins (sensor "n" and ground) of the cable (not the battery), MIGHT give us some detectable changes in logged values.

Or, the car might just detect a severe fault and quit working, until:
1. the cable is plugged back in
2. the car is re-started
3. the car is re-booted
4. a dealer resets a severe, no-drive error code!

So far, I have NOT found 4 values that appear to be battery-temps. I have ONE that might be the "average" (or otherwise combined) value. However, I would think that the lowest and highest of the four would be more useful. But, it is quite possible that only the "average" appears as a value being "constantly" (frequently) presented on the CAN bus, and other "error" or "warning" conditions would just appear as "error-codes", only when needed.

Also, there may be error/warning bits in the can data, that would only come on when needed, much like the dashboard warning lights.

Starting Logging BEFORE the car is turned ON might allow us to see some of those bits being turned on.

Occasionally I see an initial value that appears to be strangely out-of-bounds for a reading (like 255 degrees), that might be a special error, warning, or test-warning-light value.

Maybe I missed something.. but the BMS (or "LBC" as nissan calls it) handles the temperature sensors. The BMS is inside the pack so the temperature wires never come out. You'd have to open the pack to try to spoof temperature readings.

gbarry42 said:

garygid said:

So, let's consider that these numbers MIGHT be ºC times 4 (1/4 degree steps).

Click to expand...

Certainly possible; the sensors I've used do exactly that when you put them at a higher resolution.

Click to expand...

Another possibility could be degrees C times 2 with an offset, for example temp=x/2-10... I've seen this used in other automotive systems..

turbo2ltr said:

Maybe I missed something.. but the BMS (or "LBC" as nissan calls it) handles the temperature sensors. The BMS is inside the pack so the temperature wires never come out. You'd have to open the pack to try to spoof temperature readings.

Click to expand...

Sounds likely.. Did anyone check the service manuals?