Poking at 797

[GregH]

It looks like the vehicle controller has it's active CAN request ID at 797 with responses on 79A. It seems this can be accessed on either CAR-CAN or EV-CAN.

I've tried the LBC style request format with very limited results.
Jim has clearly had success with a different approach... by sending:
03 22 12 XX 00 00 00 00

The actual data seems to be in the last 4 bytes of the response..
Some of the responses I've had on my 2013 rental include:
XX=01
05 62 12 01 01 EA 00 00
and
05 62 12 01 01 F0 00 00

XX=02
07 62 12 02 00 00 77 FB
and
07 62 12 02 00 00 7A 5D

XX=03
05 62 12 03 00 0C 00 00 DCQC count

XX=04
07 62 12 04 00 00 04 7A

XX=05
05 62 12 05 00 5D 00 00 L1/L2 count

XX=06
07 62 12 06 00 01 51 BD

XX=07-0C seem to return a fault code.. always 03 7F 22 12 00 00 00 00

XX=0D
05 62 12 0D 00 99 00 00

XX=0E
05 62 12 0E 00 9E 00 00

XX=0F fails

XX=10
07 62 12 10 00 02 E9 D6
(seems to be some clock or counter... last digit slowly increments)

XX=11
07 62 12 11 00 01 D1 20

XX=12
05 62 12 12 02 B2 00 00

XX=13 and 14 and 16 fail

XX=15
05 62 12 15 00 00 00 00

XX=4E
05 62 12 4E 06 C8 00 00

You get the idea.. there's a lot of stuff in there.

 

[derkraut]

I have absolutely no idea what you have posted here :roll: :roll: :roll: :roll: :roll:

 

[GregH]

I have absolutely no idea what you have posted here :roll: :roll: :roll: :roll: :roll:

Haha, hopefully I'm not the only one trying to figure this out...

 

[JeremyW]

Just to cause more confusion, my '12 doesn't seem to be responding to 797 requests! :shock: My car trolled Greg pretty good at lunch today as he was trying to record can data...

I did get QC/L2 counts last time Allen hooked up his ELM and android with the latest beta... :?

 

[garygid]

It looks like the vehicle controller has it's active CAN request ID at 797 with responses on 79A. It seems this can be accessed on either CAR-CAN or EV-CAN.

I've tried the LBC style request format with very limited results. Jim has clearly had success with a different approach... by sending: 03 22 12 XX 00 00 00 00

The actual data seems to be in the last 4 bytes of the response.. Some of the responses I've had on my 2013 rental include: XX=01 05 62 12 01 01 EA 00 00 and 05 62 12 01 01 F0 00 00

XX=02 07 62 12 02 00 00 77 FB and 07 62 12 02 00 00 7A 5D

Translation:
1.The LEAF has a half dozen major micro-processors that control
most of the car's behavior and operation.
2. They generally communicate with each other by sending
short "messages" on at least one on the four internal CAN buses.
3. The "vehicle control module" (VCM) is one of these micro-processors,
and the BCM (battery control module) is another, both major players
in the operation of the car.
4. Since three of the CAN buses are available at the On-Board Diagnostics
(OBD) connector, we can monitor the car's "communications" by listening
to the Messages that appear on the CAN buses.
5. Not all of the car's internal data appears in these messages. Some,
like the voltages of the 96 cell-pairs, is kept in some appropriate controller
and is only available when somebody sends a message that asks for the data.
6. Then, Responses to properly formed "Request" messages can reveal
rather interesting, even helpful, information, like the tire pressures.
7. So, to get this information, one needs to address and format the
Request message(s) correctly, be able to "recieve" the Response message(s).
and be able to interpret the data in terms response(s).
8. The message "address" is called the Messsge Identifier, or MsgID,
or sometimes just ID.

[the VCM] has it's active CAN request ID at 797

9. A Request message with a MsgID of 797 hex is apparently
accepted by the VCM, (hex are the numbers 0,1,2...9,A, B, C, D, E, F,
so F = 15, and 10 hex =16, and FF hex =255)

with responses on 79A.

10. The VCM's Response messages have the MsgID 79A hex.

It seems this can be accessed on either CAR-CAN or EV-CAN.

11. One can use either CAN bus to send the Request, and Receive the Resonse(s).
We call the LEAF's CAN buses CAR, EV, AV, and QC.

I've tried the LBC style request format with very limited results. Jim has clearly
had success with a different approach... by sending: 03 22 12 XX 00 00 00 00

12. A message with MsgID 797 (wth the 8 hex data bytes above) was tried,
with the XX value set to different values, in an attempt to "ask" for different
data, watching for 79A responses.

The actual data seems to be in the last 4 bytes of the response..
Some of the responses I've had on my 2013 rental include:
XX=01

13. [in the Request message 797 03 22 12 01 00 00 00 00]
Got the following two responses in 79A messages:

05 62 12 01 01 EA 00 00
and
05 62 12 01 01 F0 00 00
(From previous experience we expect the first byte to be the
number of "used" bytes following the first byte. So, here,
the last 2 bytes, both 00, are not used in this response.)

14. Then, having gotten a response (one or more), one needs to guess
at the meaning of each of the 8 bytes of data in each response.

XX=02
07 62 12 02 00 00 77 FB and
07 62 12 02 00 00 7A 5D
(Here we see that the 4th byte is a copy of the XX value in the
request, so that we can better associate this response with
a request. Also, the 07 first byte says that all the following
seven data bytes are "used".)

15. We see that a similar, but different request returned different data,
so one has yet another detective puzzle, and another,...

 

[garygid]

More Transltion:

XX=03
05 62 12 03 00 0C 00 00
DCQC count
(the two bytes of response "data" are 000C hex, or 12
in decimal count, and apparently the number of QC sessions.
Since a FFFF value (-1 decimal) has been observed for cars
without the QC port, and I think for cars with the port, but
the port never used (and thus never tested?), this count
might start at zero after the first use. This might be a
"bug" in the firmware where -1 should have meant no port,
but zero should have meant that the port is there, but
unused. Still, one wonders about testing, or maybe the
"test" is less expensive if left for the customer to do?)

XX=04
07 62 12 04 00 00 04 7A
(of the 4 data bytes, the 04 7A, is 1146 decimal, so perhaps...?)

XX=05
05 62 12 05 00 5D 00 00
L1/L2 count
(the two data bytes are 005D, or 93 decimal, so this would seem
to indicate a "young" vehicle if this is the count of L1 and L2
charging sessions. Counts up to about 32,000, or possibly
64,000 might be accommodated. I guess that 1000 charges per
year for 32 years should be sufficient. )

XX=06
07 62 12 06 00 01 51 BD
(4 bytes of data, 00 01 51 BD, unknown meaning)

XX=07-0C [all] seem to return a fault code.. always
03 7F 22 12 00 00 00 00
(only the first 3 bytes are used)

 

[GregH]

XX=05
05 62 12 05 00 5D 00 00
L1/L2 count
(the two data bytes are 005D, or 93 decimal, so this would seem
to indicate a "young" vehicle if this is the count of L1 and L2
charging sessions.)

Yes, a 2013 with less than 2000 miles..

 

[garygid]

GregH,
You are doing great work, my friend.
Cheers, Gary