Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Dala's Leaf buildthread (2015 Nissan Leaf)
I've been spending heaps of time getting to know the Nissan Leaf CAN system. Here is a compressed version, to quickly get you started with debugging the LEAF CAN system.

The LEAF uses standard 11-bit frames. Bus speed is 500kbps. There are 4x CAN buses available, CARcan, EVcan, QCcan and AVcan. We are only interested in the EVcan for correcting battery upgrades. Message speed in ms is 10/20/40/60/100/103/500/512 depending on which bus and message you look at. Stuff like amperages and voltages need to be communicated extremely quickly (10ms), but lower priority stuff like sending stuff to the instrument cluster is 50x slower (500ms)

The EVcan bus is extremely tolerant to errors. You can pause communication, and the car triggers limp mode, and on resuming communication the errors are cleared. Reverse engineering by simply modifying and seeing what happens is totally doable!

Lets take a closer look at frame 0x5BC on the EVcan, it contains much good stuff and is sent every 500ms from the LBC->VCM
0x5BC Frame, captured with CANrunner from my 24/30kWh bruteforce battery LBC
HEX: 0x17 c0 f0 64 c9 03 02 d0
DEC: 23 192 240 100 201 3 2 208
‭BIN: 00010111‬ 10000001 11110000 1100100 11001001 0011 ‭0010 11010000

The Battery Gauge display on the instrument cluster is powered by the GIDs signal (the first 10 bits of 0x5BC). The km estimate that the Guess-O-Meter spits out is also linked to the available GIDs. From example frame (BIN 1011110 = 94 DEC) for 94 GIDs available!

0x5BC bits 36-39 (the high nibble of the 5th byte) affects the battery charge gauge, lower numbers mean more bars. This section probably contains how much one GID is worth OR some degradation offset.

The battery capacity gauge (the bars outside the fuel gauge) is controlled by a muxed field, when 0x5BC bits 32-35 (ie the low nibble of the 5th byte) is 0x3, 0x5BC bits 16-19 (ie the low nibble of the 3rd byte) contains the capacity bars. Changing this value directly manipulates the number of bars displayed, the value on the can bus is literally the number of bars. From example frame (BIN 1100 = 12 DEC) 12 capacity bars available!
Glubux and Korishan like this post
The EVcan is available on the OBD2 port, on the nonstandard pins "CAN-L (12), CAN-H (13)"
Pinout of the car OBD2 connector:
[Image: connectorblue.GIF]

To capture the CAN data, I use a laptop with an USB Kvaser Memorator Professional
Interested to hear progress on your Leaf. I've got a 2011 Leaf (24kWH) with a replaced pack (module level swap, same BMS/case) and I plan to eventually add 9.8kWH of PHEV (+ a little extra 18650 to handle the worst case loads) Li-Ion to it using Muxsan's electronics. How did you end up buying just his CAN injector? Are you working with him officially in his other projects?
(08-29-2019, 08:58 PM)rev0 Wrote: Interested to hear progress on your Leaf. I've got a 2011 Leaf (24kWH) with a replaced pack (module level swap, same BMS/case) and I plan to eventually add 9.8kWH of PHEV (+ a little extra 18650 to handle the worst case loads) Li-Ion to it using Muxsan's electronics. How did you end up buying just his CAN injector? Are you working with him officially in his other projects?

Sounds like a nice project Smile

I am cooperating with Muxsan on a few things yeah. The CAN-bridge has some issues when installed in a e-NV200, so it might even need a hardware revision update. This is hindering the development, and is the main reason why the CAN-bridge is not yet available for sale.
I've got good progress on the instrumentation correction!

24kWh has ~280 gids full, 30kWh has ~360 gids full. After modifying the 0x5BC CAN message, and adding 70gids, the 24/30kWh bruteforce battery is atleast doing two things correctly now!

As you can see, it now reports remaining km even when all the charge bars have disappeared. Before it just went '---'! Also it doesn't trigger Low Battery Warning(LBW) anymore at 16%, it instead triggers close to actual LBW!

Now only two things left to fix, the dash SOC is still showing wrong % values. Also the chargebars disappear way too soon. But progress is progress! Big Grin
lnxpro, HughF, ilie And 2 others like this post
I've been busy stomping bugs, here's a status update

Muxsan solved the CAN corruption issue that could occur every 6-12h. This was problematic, since it could cancel the charging session. Imagine setting your car to charge overnight and waking up to an almost empty battery! The fix supplied from Muxsan seems to work very well, so I am happy Smile

Another bug I noticed, was the Low Battery Warning popup. It triggers at the correct place (>30%SOC), but since the SOC is estimated with a voltage lookup table, it was not very stable. During heavy acceleration, it could trigger the LBW, and upon releasing the pedal, the LBW faded away.

To solve this, I now put in the lowest of effort, an average function!

The code snippet at the top saves the battery voltage (once every 500ms), and makes an average once 10 samples have been read. This should remove the heavy swings in the SOC-estimation. Let's see if I need something more elegant, but I like to keep things simple.

Speaking of simple, I just got a shipment of EVs Enhanced HV Battery Translator. These can do clean upgrades, for swapping in 30kWh packs into 2013-2015 Nissan Leafs. Essentially making my bruteforce method obsolete for this vintage of Leafs (and that is a really good thing!).

I've been putting off touching the 40kWh pack, since Muxsan has gotten 40kWh packs to natively boot in a 24kWh Leaf. If it were possible to do a clean 40kWh swap with only the CAN-bridge, I would much prefer that compared to another 12h+ session of bruteforcing an upgrade.
Korishan and RikH like this post
I've almost cracked the final messages that I need to perfect the brute-force swap. I thought it would be good to share this information how to reverse engineer CAN messages. There are many ways to do this, but here is my workflow.

I started on the fine work already done by the community. There is a bunch of Nissan CAN message decoding already done, found in an excel here:

However, most of that information is related to early 2011-2012 ZE0 Leafs. So not all the information was applicable. Also keeping data in an excel document has its limits. So I downloaded Kvaser Database Editor 3, and started to create a proper CAN database that can be interpreted by engineering tools. Here is what that file looks like.

Once the data is in a good format, you can more easily start to edit, format, test, playback logs etc. To analyze a CAN log-file, the workflow would be
1.Drive the car, capture CAN data with CANrunner running on a laptop (EV-CAN)
2.Get back in front of a computer, play back CAN data with CANrunner (on a virtual CAN channel)
3.Open XTM, import the database.dbc file you made
4.Start sniffing the virtual CAN channel, trend values, monitor etc.

Here is what XTM looks like

As you can see, decoding CAN is not some black art, only lots of manual work staring at numbers and writing down changes overtime Big Grin
HughF and rev0 like this post
After analyzing the data with XTM, we found out that the 2015 Leaf behaves very differently compared to the 2011 model. The 0x5BC message is sent with 100ms instead of 500ms, and internally it has two multiplexes that decides the content inside it.

So to get the chargebars to move, you need to modify 0x5BC frame[2] bits4-7. The multiplex signal is inside frame[4] bits 0-3, which alternates between DEC 8/9. Here is a code snippet I used to test this out

The end result can be seen here
[Image: Yl6GTAC.gif]
So, here's something mechanical for a change. I noticed that this car had never had any proper periodic maintenance done on it. The service records in the book were empty! Let's remedy this.

The only thing that is in the periodic maintenance intervals are brake fluid flushes and cabin filter replacements. That's it! Reading the service recommendations is a real eye opener on how cheap it is to operate an EV.

I decided to upgrade the OEM DOT3 fluid to a DOT5.1 brake-fluid.

Bleeding the brakes on the Leaf is exactly the same as on any caliper equipped car. I flushed 1000ml brake fluid thru the system to guarantee that no DOT3 fluid would be left.

Now I get to make the first stamp in the service book Smile Since the weather is getting colder, I finished the job by putting on the winter tires.
The brake calipers stick on all of ours, lack of use etc.

Forum Jump:

Users browsing this thread: 6 Guest(s)