Reverse engineering the LEAF resolver offset writing

[Dala]

Hi,
I have managed to store the CAN-logs that the official Consult3+ tool uses to read and write resolver offsets to LEAF inverters. You know, this procedure:


I've attached the .log file from my experiments, can be played back with CANrunner. Use the "WRITE-ID-86-00-14-00-55.log" and replace the numbers according to your motor.

I made a video on my 80->110kW project here:


Here's a peak on the decoding I did for the READ command;


Hope this is helpful to someone! I am working with the creator of Leafspy Pro so that we can add the functionality there too!

[earthman]

this file that you posted is a record from the CAN bus? I'm sorry I just don't understand English

I'm trying to do the same thing, only with the help of CAN Hacker. I don't have a data stream, but I have a motor and an inverter from zeo

[drprox]

I'm not having much luck with this so far.
It appears in your log that byte 02 is the address of the number it wants, and then it is also in byte 02 of the reply.

I get the first number (86), but then not the others, see below. Unfortunately, I don't know what the number should be because I don't have the motor it came from. Any ideas?

Code: Select all

Chn Identifier Flg   DLC  D0...1...2...3...4...5...6..D7       Time     Dir
 0    000007D2         8  02  3E  00  FF  FF  FF  FF  FF     663.798860 T
 0    00000784         8  02  10  C0  00  00  00  00  00     663.900670 T
 0    0000078C         8  02  50  C0  FF  FF  FF  FF  FF     663.911850 R
 0    00000784         8  02  21  01  00  00  00  00  00     663.999480 T
 0    0000078C         8  03  61  01  86  FF  FF  FF  FF     664.011860 R
 0    00000784         8  02  21  03  00  00  00  00  00     664.099580 T
 0    0000078C         8  03  7F  21  12  FF  FF  FF  FF     664.111870 R
 0    00000784         8  02  21  04  00  00  00  00  00     664.198570 T
 0    0000078C         8  03  7F  21  12  FF  FF  FF  FF     664.211790 R

[Dala]

Also note that the car needs to be in ACC mode, not ON when doing the resolve writing! Known working "WRITE-ID-86-00-14-00-55.log" file uploaded to main post!

[bexander]

Was able to change resolver settings on my Leaf inverter with this information using a Atmega328p (Arduino pro mini) and a MCP2515/TJA1050 module.
Thanks for sharing, Dala!

[schildere]

@bexander That's awesome. Is it possible to share your Arduino code?

[collin80]

For the curious - the Leaf speaks UDS when it is doing things like this. UDS, in the case of CAN, is transmitted using ISO-TP which is a protocol layer on top of raw CAN. ISO-TP uses the first byte for a variety of uses but one of them is to specify how many bytes follow. So, when you see 0x02 as the first byte that means that two bytes thereafter are important, the rest are filler. ISO-TP allow for multi-frame messages as well but it's not looking like they use any such long messages here. The next byte is the UDS command type. 0x10 is "diagnostic mode control" and lets the far side specify which sort of diagnostic mode it wants the ECU in. 0xC0 would be the requested diagnostic mode for instance. This is a non-standard mode. Usually it's mode 1, 2, or 3. Replies from the ECU come in with a command type + 0x40 to show success. So, you can see the ECU reply 0x50 which means "diagnostic mode success!" followed by the mode that was requested.

0x21 is read by local ID" so the read is first for 1 then 3 then 4. Read of ID1 returns only one byte while reads to 3 and 4 return two bytes each. You'll note that the replies here are 0x61 which is 0x40 higher, just like it should be.

In the write log they use 0x3B which normally decodes as GMLAN write DID. Apparently Nissan uses it to write values too.

At any rate, the whole thing is UDS and so large portions of it are more or less standard, just with Nissan quirks thrown in. I find it interesting that you can write to the resolver offset without any security mode stuff. Apparently you just pass a non-standard diagnostic mode and you're golden!

[EV_Builder]

Do we need to login? Which level? And which password?
UDS I'm talking about. Normally it's part of the sequence.

[bexander]

@bexander That's awesome. Is it possible to share your Arduino code?

Sorry, didn't see your request until now.
Here is the code I used.

ResolverSetting.zip

(1.63 KiB) Downloaded 554 times

[schildere]

Thx!!!

@bexander That's awesome. Is it possible to share your Arduino code?

Sorry, didn't see your request until now.
Here is the code I used.

ResolverSetting.zip

[sglassmann]

Was able to change resolver settings on my Leaf inverter with this information using a Atmega328p (Arduino pro mini) and a MCP2515/TJA1050 module.
Thanks for sharing, Dala!

Hi bexander,
Im trying to reset my resolver # using the Arduino pro mini and mcp2515/tja1050. to transmit your code do you only need one Arduino set-up? Can you share a schematic and explain how you connected with the inverter with CAN HI and LO and what file you used with the inverter numbers. Thanks for your help. Thanks a lot. Steve

[bexander]

Hi bexander,
Im trying to reset my resolver # using the Arduino pro mini and mcp2515/tja1050. to transmit your code do you only need one Arduino set-up? Can you share a schematic and explain how you connected with the inverter with CAN HI and LO and what file you used with the inverter numbers. Thanks for your help. Thanks a lot. Steve

Yes, one Arduino setup is what is needed and termination resistors in both ends of the CAN-bus.
I connected as per this: http://productions.8dromeda.net/c55-lea ... tocol.html

My motor data:
7C 00 88
00 5C

In the function writeResolverDataCAN() in my code these lines corespond to the resolver motor parameters.
counter == 2, msg[3] = 0x7C
counter == 3, msg[3] = 0x00
counter == 3, msg[4] = 0x88
counter == 4, msg[3] = 0x00
counter == 4, msg[4] = 0x5C

Code: Select all

void writeResolverDataCAN()
{
	if(write)
	{
		return;
	}
	
	Serial.println("w");
	static uint8_t counter = 0;
	static uint32_t startTime = millis(); // Set start time
	uint16_t txId;
	uint8_t msg[8];
	
	if(counter == 0)
	{
		txId = 0x784;
		msg[0] = 0x02;
		msg[1] = 0x3E;
		msg[2] = 0x01;
		msg[3] = 0x00;
		msg[4] = 0x00;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
  
  if(counter == 1)
	{
		txId = 0x745;
		msg[0] = 0x02;
		msg[1] = 0x10;
		msg[2] = 0xAA;
		msg[3] = 0x00;
		msg[4] = 0x00;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
	
	if(counter == 2)
	{
		txId = 0x784;
		msg[0] = 0x03;
		msg[1] = 0x3B;
		msg[2] = 0x01;
		msg[3] = 0x7C;
		msg[4] = 0x00;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
	
	if(counter == 3)
	{
		txId = 0x784;
		msg[0] = 0x04;
		msg[1] = 0x3B;
		msg[2] = 0x03;
		msg[3] = 0x00;
		msg[4] = 0x88;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
	
	if(counter == 4)
	{
		txId = 0x784;
		msg[0] = 0x04;
		msg[1] = 0x3B;
		msg[2] = 0x04;
		msg[3] = 0x00;
		msg[4] = 0x5C;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
  
  if(counter == 5)
	{
		txId = 0x784;
		msg[0] = 0x02;
		msg[1] = 0x21;
		msg[2] = 0x01;
		msg[3] = 0x00;
		msg[4] = 0x00;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
  
  if(counter == 6)
	{
		txId = 0x784;
		msg[0] = 0x02;
		msg[1] = 0x21;
		msg[2] = 0x03;
		msg[3] = 0x00;
		msg[4] = 0x00;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
	
	if(counter == 7)
	{
		txId = 0x784;
		msg[0] = 0x02;
		msg[1] = 0x21;
		msg[2] = 0x04;
		msg[3] = 0x00;
		msg[4] = 0x00;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
	
	if(counter == 8)
	{
		txId = 0x784;
		msg[0] = 0x02;
		msg[1] = 0x10;
		msg[2] = 0x81;
		msg[3] = 0x00;
		msg[4] = 0x00;
		msg[5] = 0x00;
		msg[6] = 0x00;
		msg[7] = 0x00;
	}
	
	if(counter == 9)
	{
		txId = 0x7D2;
		msg[0] = 0x02;
		msg[1] = 0x3E;
		msg[2] = 0x00;
		msg[3] = 0xFF;
		msg[4] = 0xFF;
		msg[5] = 0xFF;
		msg[6] = 0xFF;
		msg[7] = 0xFF;
	}
  
  CAN.sendMsgBuf(txId, 0, 8, msg);
  
  Serial.print(millis() - startTime);
	Serial.print(" ");
  Serial.print(txId, HEX);
  Serial.print(" ");
  for(int i=0; i<8; i++)
  {
    Serial.print(msg[i], HEX);
    Serial.print(" ");
  }
  Serial.println();
  
  if(counter > 9)
  {
		write = true;
		counter = 0;
	}
	else
	{
		counter++;
	}
}

[sglassmann]

Hey Thanks for the helpful reply about the resolver code.

Im having a hard time finding the mcp_can.h file in the library. any assistance or a copy of that file would be great. thanks a bunch

[sglassmann]

Hi bexander,
Im trying to reset my resolver # using the Arduino pro mini and mcp2515/tja1050. to transmit your code do you only need one Arduino set-up? Can you share a schematic and explain how you connected with the inverter with CAN HI and LO and what file you used with the inverter numbers. Thanks for your help. Thanks a lot. Steve

[bexander]

HI bexander. THanks for your help so far. I am having a hard time finding the mcp_can file for can communication in the library.
any ideas where to find file or can you send me a copy? thanks a lot and have a great day, steve

This is the one I use:

MCP_CAN_lib-master.zip

(35.92 KiB) Downloaded 435 times

[johu]

Hi and welcome sglassmann! Please do not blindly quote big chunks, but pick the exact sentences you want to reply to. The thread becomes hard to read otherwise.

[sglassmann]

Hi and welcome sglassmann! Please do not blindly quote big chunks, but pick the exact sentences you want to reply to. The thread becomes hard to read otherwise.

Im sorry, I had a hard time replying to just the member I was communicating with. If you need to delete the big chunk response to clean up the thread, please do. sorry

[sglassmann]

HI bexander. THanks for your help so far. I am having a hard time finding the mcp_can file for can communication in the library.
any ideas where to find file or can you send me a copy? thanks a lot and have a great day, steve

This is the one I use:
MCP_CAN_lib-master.zip

Awesome Thanks

[skylitdriven]

Yes, one Arduino setup is what is needed and termination resistors in both ends of the CAN-bus.
I connected as per this: http://productions.8dromeda.net/c55-lea ... tocol.html

Hey bexander, I'm looking into doing the inverter swap and it seems like I will need to write the resolver code for it to work, but I am completely clueless when it comes to CAN coding and have never touched an Arduino before. I was hoping you'd be able to lend a hand with the process of how it'd work.

I understand that I will have to modify the code values based on my motor data. Would the Arduino setup be connected to the inverter (with termination resistors) outside of the vehicle before it is installed, power up the inverter, then power up the Arduino and it will run the code automatically?

Thanks in advance.

[bexander]

Yes, probably a good idea to do the programming with the inverter on the bench. Can be done in the vehicle as well but safer to do it on the bench.
Power up the inverter with 12V. The arduino is usually powered via the USB or serial programmer used. If you want to catch all messages comming from the Inverter you need to power up the arduino first and then the Inverter.

There should be a termination resistor (120ohm) in each end of the CAN-bus. Usually the CAN-module or shield contains the possibility to set this via jumper or similar. In the inverter end you will need to be more creative. However it is not absolutely necessary so you might get away with only one resistor for programming but I strongly recommend having the terminations resistors correct when using the inverter in the car.

When running the code, you will need to open the "Serial Monitor" in the Arduino IDE and set it to a baud rate of 115200. When everything is powered up you should see CAN-messages from the inverter beeing printed in the "Serial Monitor".
If you want to save the data stored in the Inverter, type "r" and hit enter in "Serial Monitor". That should result in some extra messages containing the stored data but this have to be filtered out manually.
To program, modify the code as per: viewtopic.php?p=37224#p37224
Now, when everything is powered, type "w" and hit enter in "Serial Monitor", to write the data. You should be able to see the extra CAN-messages as a confirmation and you can also do a "r", enter, to confirm the new values are stored in the Inverter.

[sglassmann]

Yes, probably a good idea to do the programming with the inverter on the bench. Can be done in the vehicle as well but safer to do it on the bench.

THis worked great. Cost about $25 and with the help of my brother, a programmer, and your file and directions, my motor is running alot smoother.

Thanks so much and you take care. Steve

[sglassmann]

Yes, one Arduino setup is what is needed and termination resistors in both ends of the CAN-bus.
I connected as per this: http://productions.8dromeda.net/c55-lea ... tocol.html

Hey bexander, I'm looking into doing the inverter swap and it seems like I will need to write the resolver code for it to work, but I am completely clueless when it comes to CAN coding and have never touched an Arduino before. I was hoping you'd be able to lend a hand with the process of how it'd work.

I understand that I will have to modify the code values based on my motor data. Would the Arduino setup be connected to the inverter (with termination resistors) outside of the vehicle before it is installed, power up the inverter, then power up the Arduino and it will run the code automatically?

Thanks in advance.

let me know if you need any help while its fresh in my mind.

[skylitdriven]

Yes, probably a good idea to do the programming with the inverter on the bench. Can be done in the vehicle as well but safer to do it on the bench.
Power up the inverter with 12V. The arduino is usually powered via the USB or serial programmer used. If you want to catch all messages comming from the Inverter you need to power up the arduino first and then the Inverter.

Thank you so much for the advice!

let me know if you need any help while its fresh in my mind.

At the moment I'm still waiting to actually source an inverter, hopefully from within the country, so just getting an idea of the programming process that would actually be required so I can be familiar with it before diving in.

[Cees67]

Well done Dala.
I'm not sure if this is the right topic: I'm looking for a way to translate the offset code (in hex I presume) to degrees (angle). I'm using a non-Leaf inverter with a Leaf motor and I need to enter the offset as an angle.
Has anyone cracked that one?
Cheers,
Cees.

[Dala]

No clue unfortunately Cees67...

On some positive news, Leafspy integration is soon done, will make a video on it when it is available!