I made a transparent CAN bus bridge with logging, requesting input

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.

mux

Well-known member
Joined
Jan 13, 2018
Messages
350
This is pretty much the ultimate CAN bus hacking tool and will be the key to completely reverse engineering everything on the Leaf and other cars. Here's a video:

https://youtu.be/1q2HLLAw5nM

I made two devices, a quad CAN bus logger/bridge and a dual CAN bus logger/bridge. Both can accept and send data from either port and either pass it on undisturbed or modify messages on the fly IN REAL TIME. There's a serial port at 921600 baud that spits out all CAN messages including the message direction (in case of the bridge) or the port (in case of the quad CAN device).

If you watched the video, you can see that there are some bodge wires on the boards and a couple of issues with the firmware that I still have to resolve. So I will have to do a board revision. I know that a couple of people have asked in DMs and otherwise whether I'm going to provide this hardware for sale and... yes I am. I don't have a final price yet, but it'll be in the $40-50 range + shipping, sold on my Tindie store (http://tindie.com/stores/mux).

Before I do that though, I want to put out the question: what features would you like on this board? Both hardware and software. The hardware is all automotive grade, can withstand standard load dump voltages, conforms to CAN2.0B, the board is conformally coated and as soon as I have made an inventory of useful features I will publish a full datasheet. The boards will be firmware-upgradeable without any special tools (over an as of yet to be implemented USB mass storage bootloader).
 
Have enjoyed following your efforts and progress adding additional batteries to the LEAF - Nice Work!

As a suggestion, maybe also offer these boards without the conformal coat or potting. For folks wanting to do their own experimental work, mods or repairs are much easier to do without coatings.

Also, in addition to the present capabilities please consider adding the features necessary to have the board function as the TCU.

Remote climate control / status / charge control even if only over WiFi/802.11, 802.15 of some sort (ZigBee or LoRa?) would be very nice to have and would open up some additional avenues for development.

Perhaps the same features/functions as used to wakeup the TCU could also be used to control power to your board as well?

It may be too much to do at this stage, but could you also add Bluetooth support / ELM emulation so it could also work directly with LeafSpy?

You probably already know about the OVMS and these sites, but if not, perhaps you'll find them useful:

http://www.arachnon.de/wb/pages/en/nissan-leaf/ovms.php

http://lists.openvehicles.com/mailman/listinfo

https://carrott.org/emini/Nissan_Leaf_OVMS

https://carrott.org/blog/archives/158-OVMS-Nissan-Leaf-Remote-Climate-Control.html
 
Sorry to disappoint the first commenter (partly), but I'll motivate what I'm saying:

- Yes, the boards are already conformally coated. The plan is actually to fully pot them, but I still need to probably 3D print suitable potting enclosures.
- I'm not planning for these boards in particular to become replacement TCUs, however I do in fact plan to build a replacement TCU further on in the modding process. Either that, or reverse engineering the existing TCU to do what I want - I don't know how hard that is yet. This is not a short-term project.
- I cannot offer anything but a USB and/or TTL serial port right now, it would cause some issues with getting this board out in a timely fashion. Wireless modules are relatively expensive pre-certified and would drive up the price considerably (essentially doubling, making it awfully unattractive as a general CAN hacking tool) and I have no experience with LoRa modules yet, although they are very promising.
- Yes, I will attempt to reverse engineer the TCU routines for wakeup.
- I won't be adding ELM emulation to this board for physical layer reasons listed above
- I'm aware of OVMS and am proooobably buying a set just to mess with it, but thanks a lot for the link, it had kinda sagged in my mind already. Yeah, I really should buy it.

Note that my board will be able to function with phones, tablets and computers already using USB-CDC and a web app. Yes, it is separate from existing tools, but unfortunately due to the nature of the protocol it really has to be. ELM/OBD doesn't nearly have enough bandwidth and frankly neither does an ESP8266. We're talking about logging gigabytes of raw (but compressible) data during a couple-hour trip.

Also, if anyone is willing to work with me to program and test this board, that would be highly appreciated. Or maybe the firmware really should be open source, I'm not sure.
 
Nice project! I have upgraded my Leaf 24kwh 2014 with a 30 kwh battery. I was thinking about making a device like yours and change the battery id on the fly but fortunately I didn't have to.

Your device could be very useful in the future if battery cells become cheap enough for it to be worth making a new battery pack.
 
Hi Mux,

Glad you found the OVMS info helpful!

Not disappointed - just was offering some input and suggestions...

Didn't realize the boards were already complete and coated, the video seemed to indicate that you still needed to do another spin of the PCB for parts that were now unavailable.

In the next version of the board, maybe look to include some sort of simple expansion header connector? That way you can allow options like the wireless but it won't increase the cost of the basic unit.

Sorry if I hadn't expressed the wireless idea clearly enough. I wasn't thinking of trying to stream all the CAN data over a wireless link, just having it there as a low data rate way to add remote control or configuration capabilities.

With the hardware already present, is there any possibility to log the data directly to a USB memory device?

Maybe you can include some on-board message filtering capability that will only log items of interest?

Keeping the cost low is a great goal, as is getting something done and out in a timely fashion.

Best wishes for your continuing success!
 
Ah, an expansion header isn't a bad idea. To be honest, that could just be the serial port + power - it is a bidirectional port after all.

The boards are conformally coated if only for the fact they're dangling dangerously around in my car, bumping into everything. It's the least I could do. That being said, for thermal and environmental stability reasons, I'm pretty sure this coating is not enough. I've got a better conformal coating formulation on order and am looking into potting as well. So this is something I envisaged and partly implemented, but is still a work in progress.

Unfortunately logging to a usb key is actually a fairly memory- and CPU-intensive process for these microcontrollers. I'm using an AVR XMEGA which is very fast and useful for an 8/16-bit MCU, but still essentially technology well surpassed by CPUs in the 80s. So I'd say logging would have to be done through a daughterboard with a dedicated FAT-capable microcontroller.

And great idea to implement logging filters. There's a lot of uninteresting stuff happening on the bus that I can just as well filter out - that'll help my reverse engineering attempts as well.

It's not even a matter of keeping costs low, it's one of those projects where feature creep will cause non-delivery in the end. That's what happened to another project of mine, a powerbank. Just became too big.
 
I need this smaller board, but I did not see it in your shop. Is it for sale? Does it work only with the bigger 4 can bus module or can it be used separately? I am thinking about adding another full used Leaf pack with bms because I need to drive 150km in winter and it should be possible with 80% of battery capacity because of quick chargers.
 
It's not for sale yet. I am still waiting on the revised boards, which should arrive any day now. Additionally, my potting compound has also not arrived yet, so I am not able to make an automotive grade assembly yet. I'll update this thread and post more specs/manuals/etc. when it is field-tested and ready for sale.

I have two units currently being tested by a client in a prototype powerwall-type thing, still awaiting feedback and bug reports for that too.

All-in, I think ETA is end of July.
 
Thanks for answering! Your videos are very high quality and informative!
Is it possible with your board to make work 2 Leaf BMS modules at the same time, so that the instrument cluster display would show remaining kilometres what both of the batteries allow?
 
For that you'd need the 4-CAN board (or, well, at least 3 CAN buses). One needs to talk transparently with the VCM and the other would need to be read and its capacity added to the other. It's a bit involved but could certainly be done. I'll see if I can put this kind of functionality in the release firmware.
 
@mux Could you mod your transparent CAN bus bridge to intercept the CAN bus signals for battery charging, with the intent to spoof the stock BMS into thinking that the car is fully charged, when in fact it's at 80% SOC?

There seem to be so many post 2013 owners who want the 80% charging feature, so if you could create a reasonably priced device that would do that one thing, I'm sure you would have no shortage of customers.
 
Ooooooh... I understand this now. They REMOVED the 80% feature? That's stupid. I had somebody else contact me about this and I didn't understand what he meant.

Yeah, that's pretty easy to do. I'll put it on my features list.
 
Yeah, they really only had it on the 2013 model year. I'm guessing there are lots of owners who would pay up to $150 US, just to get this feature alone...
 
carrott said:
I made something very similar using two USB can bus interfaces and a python script to bridge them together. It decodes a lot of the data from the Nissan Leaf battery and allows you to modify frames on the fly. This sort of tools is very useful for reverse engineering! See https://carrott.org/blog/archives/159-Nissan-Leaf-CAN-Bus-Man-In-The-Middle.html for details and source code.

My 2011 Leaf onboard charger (OBC) died last month. I am looking for an open source replacement for the OBC but one of the sticking points is getting it to work with the Leaf. Did you get enough info with your testing (https://carrott.org/blog/archives/159-Nissan-Leaf-CAN-Bus-Man-In-The-Middle.html) to determine if an aftermarket or open source charger could be used?

Thanks,
RK
 
Technically, if you really need an OBC quickly and don't have the time or willingness to properly implement offline charging (i.e. charging when the car is otherwise in a non-ready state), you can use a raw mains to 392V CCCV charger connected to the OBC battery connections and put the car into ready mode to close the main contactors and energize that circuit. Note that the 2011-2012 generation has a pretty wimpy cable gauge, so don't try to charge faster than 6kW.
 
mux said:
Technically, if you really need an OBC quickly and don't have the time or willingness to properly implement offline charging (i.e. charging when the car is otherwise in a non-ready state), you can use a raw mains to 392V CCCV charger connected to the OBC battery connections and put the car into ready mode to close the main contactors and energize that circuit. Note that the 2011-2012 generation has a pretty wimpy cable gauge, so don't try to charge faster than 6kW.

That is an interesting way to get it done and it is a reasonable backup plan. I have the ability to swap the OBC safely if I bought a spare, but they are still very expensive from Nissan, especially for a 2011 car. Would a replacement OBC work out of the box? I've read that changing the BCM requires registration, do you know if changing the OBC with a junkyard spare requires something similar?

Have you logged the OBC can bus enough to enable a non-OEM charger to be used?
 
I've done extensive logging on the car, but not on the OBC yet (in order to know for sure, I use the CAN bus bridge I designed and expained earlier in this thread right outside the bus connection of the component I'm interested in). However, I *highly* doubt there is any VIN locking or anything like that going on. I have two clues:
- On the EV-CAN bus, I don't see any messages with challenge/response routines or anything like that while charging
- People have replaced 3kW chargers with 6kW, dealers have even done that, and it seems to just work immediately

So I expect the OBC to be reasonably easily swappable. The main annoyance is having to refill the coolant loop.

In order to use a non-OEM OBC, you will have to spoof the original OBC. The OBC has to issue a wakeup message on CAN and do some chatting to the VCM to let it enable the relays. I don't know exactly what it says, but it will no doubt be synthesizable with my hardware. If you are seriously interested and willing to share your findings, I can send you a CAN bridge to play with.
 
Understanding charging (and discharging) protocols for various energy sources (including both chargers and charge controllers) could be the most important "discoveries" that allow (the eventual) massive amounts of EV battery energy storage to stabilize the use of renewables (notably solar). Mux - keep up the great work - CHAdeMO, CCS, Tesla all needed.

Just my opinion.
 
Back
Top