Another thing we can try is to unplug the round control connector from the battery pack, see if the car powers up into ACC mode (since the HV battery is not accessible as the contactor coil wires also go through that connector) and once the EV bus gets quiet, plug the connector in again to see if the LBC will report for duty and the car accept it (extinguish the warning lights)
Or take a capture of a typical good startup, then wire the EV CAN bus to a different LBC and do the same startup, it is easier to see the differences that way. I have the hardware to build two CANary (intended for the dual pack truck) so once I have that running, I can use one to reprogram and start capturing CAN bus traffic... Cor van de Water Chief Scientist Proxim Wireless office +1 408 383 7626 Skype: cor_van_de_water XoIP +31 87 784 1130 private: cvandewater.info http://www.proxim.com This email message (including any attachments) contains confidential and proprietary information of Proxim Wireless Corporation. If you received this message in error, please delete it and notify the sender. Any unauthorized use, disclosure, distribution, or copying of any part of this message is prohibited. -----Original Message----- From: EV [mailto:ev-boun...@lists.evdl.org] On Behalf Of Collin Kidder via EV Sent: Thursday, January 26, 2017 12:38 PM To: Tom Parker; Electric Vehicle Discussion List Subject: Re: [EVDL] Anyone interested in 2015 Leaf drivetrain or interior/exterior/suspension parts? I have a capture from (I think it was the 2013 Leaf but I have a 2012 as well) and the capture is both buses at the same time. The "normal" can bus is a lot noisier than the EV bus. It also starts up first and has a lot of traffic before the EV bus even starts. I need to do some more filtering to see which IDs are really on which buses but it looks like maybe 0x5C0 could have something to do with it. It seems to be part of the LBC comm and the message appears on the EV bus and then immediately seems to be re-broadcast on the other CAN bus. But, I don't see any form of response to it other than the VCM seems to forward it immediately. Also, the numbers found within seem to be different for each car I'm aware of. It also has a cyclic three messages. The first byte goes 0x40, 0x80, 0xC0 for everyone. But, the data doesn't seem to change much depending on that first byte. I get: 0x5C0 Len: 8 Data: 0x40 50 4C 00 BD 00 1E 00 0x5C0 Len: 8 Data: 0x80 4C 4C 00 BD D8 0C 00 0x5C0 Len: 8 Data: 0xC0 4A 4A 00 BD D8 0C 00 There is some minor fluctuation of the numbers but not a lot. Kind of seems like some form of data that might really not be a serial number but it is one of the few frames directly forwarded between buses. So, maybe there's something to it, maybe not. It'd be interesting to know what your bytes are. On Thu, Jan 26, 2017 at 1:53 PM, Tom Parker via EV <ev@lists.evdl.org> wrote: > On 27/01/17 07:29, Cor van de Water via EV wrote: >> >> Also, the LBC validation happens without disconnecting the aux battery. >> I know for sure as I never disconnect the 12V battery and when I swapped >> my pack for a complete replacement pack from Washington State, the >> yellow light on the dash came on and my Leaf was in Limp mode while I >> only disconnected the (non-energized, due to the contactors in the pack) >> HV lines and the control bus. >> Just wheeling the original pack back under my Leaf and swapping the >> connectors removed the Limp mode, so I know for a fact that the Leaf >> validates the battery upon pressing the power button while the aux >> battery is connected continuously, so it seems that you were looking at >> the wrong thing. >> Probably a trace of the EV bus as soon as the power button is depressed >> (when a *lot* of communication is happening) will tell the story. >> You may start the trace as soon as the brake is pressed. > > > Thank you for this information Cor! > > I have many captures of my car's startup on the EV Bus and unless my > hardware misses the important frames, I don't see anything special at > startup. 0x603 is sent once, is the first frame sent and always with payload > 00. A number of frames are sent with lots of bits set which later contain > valid data - for example the first couple of frames from the LBC: > > 1 2017-01-26 21:47:24.907267 CAN 16 STD: > 0x00000603 00 > 8 2017-01-26 21:47:24.993307 VCM Info 16 STD: > 0x000001f2 08 64 00 00 00 01 01 06 > 65 2017-01-26 21:47:25.139218 LBC Battery V/A 16 STD: > 0x000001db 7f e0 ff c6 00 00 00 de > 66 2017-01-26 21:47:25.140191 LBC 0x1dc 16 STD: > 0x000001dc ff ff ff ff 1f ff fc 6b > > And I can see the VCM go through it's startup sequence (in 0x1f2 byte 5). > However all the frames other than 0x603 are sent more than once per second. > > I'll capture startup from some more cars, identify which bytes are different > and use a man in the middle to selectively tamper with those bytes and see > what causes the car to reject the battery. Hopefully there aren't too many > differences! Carl at https://bluecars.nz/ has a leaf system on the bench, so > establishing the man in the middle won't be too hard. > > _______________________________________________ > UNSUBSCRIBE: http://www.evdl.org/help/index.html#usub > http://lists.evdl.org/listinfo.cgi/ev-evdl.org > Read EVAngel's EV News at http://evdl.org/evln/ > Please discuss EV drag racing at NEDRA (http://groups.yahoo.com/group/NEDRA) > _______________________________________________ UNSUBSCRIBE: http://www.evdl.org/help/index.html#usub http://lists.evdl.org/listinfo.cgi/ev-evdl.org Read EVAngel's EV News at http://evdl.org/evln/ Please discuss EV drag racing at NEDRA (http://groups.yahoo.com/group/NEDRA) _______________________________________________ UNSUBSCRIBE: http://www.evdl.org/help/index.html#usub http://lists.evdl.org/listinfo.cgi/ev-evdl.org Read EVAngel's EV News at http://evdl.org/evln/ Please discuss EV drag racing at NEDRA (http://groups.yahoo.com/group/NEDRA)
