Whacky Hacky: Adding extra DC/DC and DC/AC converters to PDU? (Gen1 Leaf)

[cornbinder89]

Not sure if this will help or not, but there seams to be a fair bit of info here:
https://mynissanleaf.com/threads/setec-vehicle-to-load-6-kw-discharge-inverter.33154/
and
https://mynissanleaf.com/threads/my-setec-chademo-vehicle-to-home-mods.32620/

 

[Jsprinkle]

The out of usa firmware for the leaf would be very valuable to some of us.
Easily worth a couple of thousand dollars installed.

 

[nlspace]

Some associated wiring for Normal Charge and Quick Charge for the Gen 1 with OBC behind the seat and DC Junction box near the front firewall in "engine" compartment:

 

[Jsprinkle]

Not sure if this will help or not, but there seams to be a fair bit of info here:
https://mynissanleaf.com/threads/setec-vehicle-to-load-6-kw-discharge-inverter.33154/
and
https://mynissanleaf.com/threads/my-setec-chademo-vehicle-to-home-mods.32620/

Thank you.
I believe we perused these posts before buying our Setec 6kw unit. The new 6kw unit seems to have conflicts with the 2023 LEAF as it will only output 240acv for a few seconds before disconnecting. Seems the car is controlling that.

We have the Setec unit and would dearly love to have it operational. Thus far we are led to believe that this is a deliberate programming feature built into the USA LEAF units currently sold.

How to change that firmware to a set that accepts V2L is a question that we need to answer. Setec was no help on this but maybe we asked the wrong questions.

Any experience in these matters to be shared here will be greatly appreciated. Thank you.

 

[jerquee]

Hi everyone, I haven't read everything yet but wanted to chime in with what I
know.

1. Leafs are EXTREMELY picky about ChaDeMo and will trip errors and flip out
if you do anything out of the ordinary. I discovered this while implementing
ChaDeMo for a big company and testing it on Leafs was an exercise in patience
- I recommend don't bother trying that route.

2. I have not checked, but i'm pretty sure the system will not be upset if
you're drawing current from the DC bus while in "Park" even though it doesn't
know where the energy is going. There may be a limit to the number of amps it
will allow in that mode, but it's probably a lot more than 5KW.

3. You can get "inverter" boards on ebay and aliexpress that take 350-450VDC
and turn it into 120VAC or 240VAC and they work fine. But don't believe the
wattage ratings on them (do get a 5KW one and use it at 2.5KW max) and do add
a big hefty AC filter after the output to reduce RF noise and interference.

4. Just use the car's regular key system to "start" it up. You can tap into a
12v wire somewhere that's only "on" when the key is on, to trigger your stuff
to power up, or you can watch CANbus messages if you prefer. There is Leaf
CANbus documentation out there on Github I think.

and be careful!

 

[jerquee]

Hi everyone, I haven't read everything yet but wanted to chime in with what I
know.

1. Leafs are EXTREMELY picky about ChaDeMo and will trip a bunch of latching errors and flip out if you do anything out of the ordinary. I discovered this while implementing ChaDeMo for a big company and testing it on Leafs was an exercise in patience - I recommend don't bother trying that route.

2. I have not checked, but i'm pretty sure the system will not be upset if you're drawing current from the DC bus while in "Park" even though it doesn't
know where the energy is going. There may be a limit to the number of amps it will allow in that mode, but it's probably a lot more than 5KW.

3. You can get "inverter" boards on ebay and aliexpress that take 350-450VDC and turn it into 120VAC or 240VAC and they work fine. But don't believe the
wattage ratings on them (do get a 5KW one and use it at 2.5KW max) and do add a big hefty AC filter after the output to reduce RF noise and interference.

4. Just use the car's regular key system to "start" it up. You can tap into a 12v wire somewhere that's only "on" when the key is on, to trigger your stuff
to power up, or you can watch CANbus messages if you prefer. There is Leaf CANbus documentation out there on Github I think. If you do this, you might want to setup a relay or other method to prevent the car from going into "drive" or "reverse" , such as by using a relay to interrupt the brake light signal (car won't leave Park unless it knows you're stepping on the brake pedal)

and be careful!

 

[cornbinder89]

Just my two cents from someone who isn't knowledgeable enough to know how to do it, and what to look for:
It seams that time spent looking to WHY the Chademo route is not working would bring more benefits than a one off connection to the buss, esp in terms of safety.
If the unit functions but quickly cuts out, that would seam to confirm it can work, and something is tripping the safety system. If it was blocked in its entirety by Nissan, I don't think you would see even a momentary connection.
It does seam it has worked on the Leaf in the past on vehicles in the US, so I don't think it is a "blanket" it will not work, but rather something that the safety system does not like, Initial in rush current?
The above post suggests the Leaf Chademo is "picky" but it still has to conform to the Chademo protocol, so if you know the protocol and can look at what is happening in real time, and may be vary one aspect at a time to see how it effects the system "kicking out" the end result will be far better than a brute force attack on the Leafs system.

 

[Jsprinkle]

Just my two cents from someone who isn't knowledgeable enough to know how to do it, and what to look for:
It seams that time spent looking to WHY the Chademo route is not working would bring more benefits than a one off connection to the buss, esp in terms of safety.
If the unit functions but quickly cuts out, that would seam to confirm it can work, and something is tripping the safety system. If it was blocked in its entirety by Nissan, I don't think you would see even a momentary connection.
It does seam it has worked on the Leaf in the past on vehicles in the US, so I don't think it is a "blanket" it will not work, but rather something that the safety system does not like, Initial in rush current?
The above post suggests the Leaf Chademo is "picky" but it still has to conform to the Chademo protocol, so if you know the protocol and can look at what is happening in real time, and may be vary one aspect at a time to see how it effects the system "kicking out" the end result will be far better than a brute force attack on the Leafs system.

Maybe so. The setec system seems to work elsewhere.
We will gladly pay well for a workaround that includes the leaf safety protocols.

If we could get the software used overseas installed that would work I believe.
Thanks, everyone!

 

[Jsprinkle]

Maybe so. The setec system seems to work elsewhere.
We will gladly pay well for a workaround that includes the leaf safety protocols.

If we could get the software used overseas installed that would work I believe.
Thanks, everyone!

Also, just a safe way to close the big battery contacts to access through the Chademo port would be great and valuable.

 

[cornbinder89]

Maybe so. The setec system seems to work elsewhere.
We will gladly pay well for a workaround that includes the leaf safety protocols.

If we could get the software used overseas installed that would work I believe.
Thanks, everyone!

Since the poster V2x posted his experience using on a USA 2014 Leaf, I doubt it is a software problem in this country causing the problem. Something isn't play well together but if a 2014 Leaf in the USA can I would be surprised that a later one cannot. While not in the ranger of impossibility, I would say it very improbably that the Leaf has changed to prevent it.

 

[danielsantos]

Wow. Really know what you are worth don’t you?
Well. I am also an arrogant SOB so maybe we’ll get along fine.
Our firm deals in solar power backup and our lab purchased a 2023 LEAF to use the big battery to run whole house backup and related good projects.

The solar industry has many good charge controllers which will take 400vdc and charge 48 vdc battery systems which are at this point pretty standard for many whole house inverters.

Our problem is the handshake needed to convince the LEAF that we are a friend and just want access to the big battery via the Chademo port.

It seems that lawyers in the USA see a real problem with allowing us access. Overseas there is not a problem in many countries but the USA programming seems to disallow such operations even using a 4000$ device purchased from a supplier who sells into Europe and Australia with success.

There were two USA companies promising devices last year and then this year but no results I am aware of yet.

I will gladly partner with a knowledgeable someone to safely hack this lab car if that worthy partner shows up.

Good luck!

Sorry for disappearing for a bit. I just closed on selling my house, thus completing my divorce (FREEDOM!) and simultaneously having life jump me. Things are gradually settling down here.

Here in the states, we have the worst laws when it comes to protecting the rights of the consumer. There was a lot of push-back when Apple starting iBricking devices and they backed off on that one but have obviously won the war (unless the DOJ succeeds). Somewhere around the early aughts, we lost the right of ownership. You can buy a product, but you don't have the right to modify it. This is definitely not going to work!

So I would like to say "challenge accepted!" and start hacking. I'll need to rig up a CHAdeMO jumper/spy/thingie to see what's really going on. But I'm curious -- does it give you access to the battery initially, but they shut you down once it sees that there isn't charging going on?

 

[danielsantos]

Our problem is the handshake needed to convince the LEAF that we are a friend and just want access to the big battery via the Chademo port.

BTW, I can think of another solution that so pretty because it involves modifying the vehicle, but should work. Hijack the connection between the LBC and the rest of the car (á la Dala [pun intended]) so you can omit/manipulate any information we necessary to keep it from freaking out, and replace the high voltage cable from the battery module to the PDM with your own Y cable, add relays and then an extra connector for your usage.

Why is it that after I write the whole thing out that it sounds so much less appealing?

 

[danielsantos]

Finally, this investigation is actually leading me to believe that

I believe we perused these posts before buying our Setec 6kw unit. The new 6kw unit seems to have conflicts with the 2023 LEAF as it will only output 240acv for a few seconds before disconnecting. Seems the car is controlling that.

hehe, I failed to notice the second page of responses on this post.

This tells me precisely what I was suspecting -- that there's very likely nothing wrong with the CAN communications from CHAdeMO to PMU, it's just that the software is specifically designed to shut you down if you aren't really charging.

Again, I think the work-around is probably to lie -- stick a small computer in-between the LBC and system CAN bus and tell it the stories it will want to hear. "Yes, we're charging, but a little bit more slowly than we expected. No big deal, just hang on there...". Then when you disengage the CHAdeMO V2x, just start reporting the truth and see if the VCM has a fit or not.

It's always *possible* to hack the firmware image, but that would take a lot of effort and have risks without complete simulation hardware to test and debug on -- not something I'm open to at this time.

If we could get the software used overseas installed that would work I believe.

Just to note that depending upon how far Nissan went with this sabotage effort, there could be unintended consequences of firmware locale mismatch between components on the same CAN bus. To return to my previous rant, this is the type of bullshit that should be illegal, but for our shitty political system and atmosphere here.

4. Just use the car's regular key system to "start" it up. You can tap into a 12v wire somewhere that's only "on" when the key is on, to trigger your stuff
to power up, or you can watch CANbus messages if you prefer. There is Leaf CANbus documentation out there on Github I think. If you do this, you might want to setup a relay or other method to prevent the car from going into "drive" or "reverse" , such as by using a relay to interrupt the brake light signal (car won't leave Park unless it knows you're stepping on the brake pedal)

When you hold down the break and press "start", you don't go into drive mode, but you do have access to high voltage, e.g., via the electric compressor. I think this mode is called "On/ACC"? So it shouldn't allow you to go into drive or reverse while in this mode.

 

[BillAinCT]

It's always *possible* to hack the firmware image, but that would take a lot of effort and have risks without complete simulation hardware to test and debug on -- not something I'm open to at this time.

I don't think it's possible. It's securely programmed in its microprocessor and can't be read. And if you could read it, you're looking at compiled C code (speculating this) assembly language and it's essentially impossible to get it to a readable source form and make meaningful changes. If you mean cut off the top and read the die, sure, it's possible. But this isn't in the scope of what you can do yourself.

 

[danielsantos]

I don't think it's possible. It's securely programmed in its microprocessor and can't be read. And if you could read it, you're looking at compiled C code (speculating this) assembly language and it's essentially impossible to get it to a readable source form and make meaningful changes. If you mean cut off the top and read the die, sure, it's possible. But this isn't in the scope of what you can do yourself.

There are many companies who will cap decap ICs for you, so this isn't unreasonable (e.g., 1, 2, 3). It can be costly and, iiuc, it may take a few attempts to get 100% of the firmware area visibly readable (from a microscope). As far as compiled C code and/or assembly, it is BY NO MEANS "impossible" to reverse engineer, but it's a whole lot of work. I've done this many times, though I don't enjoy it like some people do.

All in all, it's both possible and almost reasonable if there's enough resources, but I would rather not be the one to do it!

 

[FrancoVecchi]

Hi everyone, I haven't read everything yet but wanted to chime in with what I
know.

(...)

4. Just use the car's regular key system to "start" it up. You can tap into a 12v wire somewhere that's only "on" when the key is on, to trigger your stuff
to power up, or you can watch CANbus messages if you prefer. There is Leaf CANbus documentation out there on Github I think. If you do this, you might want to setup a relay or other method to prevent the car from going into "drive" or "reverse" , such as by using a relay to interrupt the brake light signal (car won't leave Park unless it knows you're stepping on the brake pedal)

and be careful!

In the chademo port there are two pin that if connected (shorted) , tell to the car that the connector is on, and the car cannot move. The car refuse to go in D, B or R if these pins are connected each other.

 

[Jsprinkle]

There are many companies who will cap decap ICs for you, so this isn't unreasonable (e.g., 1, 2, 3). It can be costly and, iiuc, it may take a few attempts to get 100% of the firmware area visibly readable (from a microscope). As far as compiled C code and/or assembly, it is BY NO MEANS "impossible" to reverse engineer, but it's a whole lot of work. I've done this many times, though I don't enjoy it like some people do.

All in all, it's both possible and almost reasonable if there's enough resources, but I would rather not be the one to do it!

Thank you very much for your insight and comments. We are very interested in pursuing access to that big battery which we will then put to a solar charge controller to change it down to 48 V to run the normal 48 V inverters for houses etc..
It seems that someone with the canbus directives and experience in canbus Programming would be able to convince the car computer that it’s only charging and allow continued connection to the high-voltage battery through the Chademo port

 

[Jsprinkle]

There are many companies who will cap decap ICs for you, so this isn't unreasonable (e.g., 1, 2, 3). It can be costly and, iiuc, it may take a few attempts to get 100% of the firmware area visibly readable (from a microscope). As far as compiled C code and/or assembly, it is BY NO MEANS "impossible" to reverse engineer, but it's a whole lot of work. I've done this many times, though I don't enjoy it like some people do.

All in all, it's both possible and almost reasonable if there's enough resources, but I would rather not be the one to do it!

Don’t be scared you can do it please

 

[Jsprinkle]

There are many companies who will cap decap ICs for you, so this isn't unreasonable (e.g., 1, 2, 3). It can be costly and, iiuc, it may take a few attempts to get 100% of the firmware area visibly readable (from a microscope). As far as compiled C code and/or assembly, it is BY NO MEANS "impossible" to reverse engineer, but it's a whole lot of work. I've done this many times, though I don't enjoy it like some people do.

All in all, it's both possible and almost reasonable if there's enough resources, but I would rather not be the one to do it!

Maybe do the simplest possible on modifying the canbus communication just to keep the battery contacts engaged

 

[danielsantos]

Maybe do the simplest possible on modifying the canbus communication just to keep the battery contacts engaged

This is my personal thought, but I'll have to play with it to verify that the issue is sabatoge when it sees the battery going down instead of up. As you're probably aware, when you plug in the J1772 L1 or L2 charger, the charging hardware in the PDM takes responsibility for doing the charging -- the shop manual goes into pretty descent detail on this process. But for CHAdeMO (and I presume CSS on other cars) the quick charger is responsible for all of that.

So I would be curious to experiment to see what conditions leads the PDM/VCM to shut down the "charging" process.

But yes, I suspect that the easiest option could be to just install a CAN bus bridge and lie to the car.