# Reverse Enginnering the Nissan Leaf BMS Serial Protocol...



## WolfTronix (Feb 8, 2016)

Hello,

I have a 2013 Nissan Leaf battery pack, which I am using to reverse engineer the serial protocol between the microcontroller and the balancing ICs, so I can reconfigure the pack for use in my Solectria E10, and still use the BMS.

I recently purchased a 2013 BMS on eBay and it was different than the one that came with my battery pack, so I suspect it was actually an earlier version...

The BMS that came with my battery pack uses D15120 balancing ICs.
The BMS that I got on eBay uses D15110 balancing ICs.

I have sniffed the serial protocol, and it is different between the two types of Balancing ICs.

If anyone has the Nissan Leaf BMS left over from a conversion, I would be interested in buying it if it matches the one in my battery pack.

The BMS I am looking for has:
Plastic backer, not metal.
One gray and black connector, not all white connectors:
http://www.wolftronix.com/E10_LithiumUpgrade/images/IMG_5574.jpg

Has the D15120 balancing ICs, not the D15110 balancing ICs.

If you want to follow the progress:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html
http://www.youtube.com/playlist?list=PLQdu_G7xyFIQ-hNQHEqc3in4qWGy6dpfp

Thanks, 
Wolf


----------



## palmer_md (Jul 22, 2011)

WolfTronix said:


> Hello,
> 
> I have a 2013 Nissan Leaf battery pack, which I am using to reverse engineer the serial protocol between the microcontroller and the balancing ICs, so I can reconfigure the pack for use in my Solectria E10, and still use the BMS.
> 
> ...


Very nice work on your reading of the data. I have one, but unfortunately it is from a 2011 which has the old bms as well. I'm probably going to go with an Orion BMS when I get mine installed in a vehicle.


----------



## WolfTronix (Feb 8, 2016)

palmer_md said:


> Very nice work on your reading of the data. I have one, but unfortunately it is from a 2011 which has the old bms as well. I'm probably going to go with an Orion BMS when I get mine installed in a vehicle.


Thanks,

My Solectria E10 is 144V nominal.
So I am reconfiguring the pack for 2 parallel stacks of 20 modules in series (150V).
The BMS already support a split pack.
So I just need to bypass the extra balancing chips.
And figure out the protocol to read the voltages and turn on the balance shunts.

The critical part will be seeing if the balance chips take care of the balancing on there own or if the microcontroller makes the decisions.

i.e, the microcontroller scans all 96 cells, then sends out the target voltages to the balancer chips.

Or the microcontroller scans all 96 cells, then sends out the individual shunt states to the balancer chips (I suspect this is what it does).

Either way I should know more after this week. I am building a quick battery cell simulator, so I can vary the voltages across the cells to see how the microcontroller reacts, and what packets it sends back and forth. 

If this all works, then I plan on getting another 2 Nissan Leaf packs later on, should get me around a 180 - 200 mile range in the truck.

Thanks, 
Wolf


----------



## Weisheimer (May 11, 2009)

The videos are great!
Very impressive that you've shown a textbook example of decoding the data.

I realize that you will already know that this family of BMS is used in most of the AESC battery systems, including the Better Place packs that were available for a short time.

Thank You for posting all of this.


----------



## WolfTronix (Feb 8, 2016)

I am not sure if the better place packs use the old BMS or the newer one... They have different serial protocols, See this video:
http://youtu.be/pyUQn75jWd0

Hopefully the video is more exciting than a text book. 



Weisheimer said:


> The videos are great!
> Very impressive that you've shown a textbook example of decoding the data.
> 
> I realize that you will already know that this family of BMS is used in most of the AESC battery systems, including the Better Place packs that were available for a short time.
> ...


----------



## Tomdb (Jan 28, 2013)

The data you are reading is the communication bus from the bms to the car right?

This is a serial bus and not a Canbus? Mind sharing how you decoded the messages to get the voltages and other data, would be quite useful for others looking to use a Leaf pack with bms.


----------



## WolfTronix (Feb 8, 2016)

Tomdb said:


> The data you are reading is the communication bus from the bms to the car right?
> 
> This is a serial bus and not a Canbus? Mind sharing how you decoded the messages to get the voltages and other data, would be quite useful for others looking to use a Leaf pack with bms.


The CAN bus side, BMS to rest of car had been mostly worked out here:
http://www.mynissanleaf.com/viewtopic.php?t=17470

I am working on the serial protocol between the microcontroller and the 24 balancing chips.

When I reconfigure the pack for my truck, I will only have 20 balancing chips... This will cause the BMS microcontroller to get really unhappy... It keeps looking for the missing balancing chips and starts reporting trouble codes, and the VCU shuts down the pack contactors.

So I plan on figuring out how the BMS microcontroller talks to the balancing chips, so I can insert my microcontroller and use all the existing BMS hardware.
Kind of like a brain transplant. 

A more elegant solution would be to read out the flash and decompile the BMS microcontroller, then modify the firmware such that it has 20 balancing chips... But I am not sure what, if any protections they have against this. Reverse engineering the serial protocol seems easier to me then reverse engineering byte code assembly. 

However, I think for what I am planning, swaping in my microcontroller is the better route... Especially since I can then work with an IDE and tools and a microcontroller I am familiar with.

Also, since I will have up to six parallel strings of 20 modules in series, I want my version of the BMS to have control of its individual stack contactor. So if any cell fails I can detect it and disconnect that string from the pack automatically. Parallel stacks dumping energy into another stack with a shorted cell can be really bad. 

I also want my version of the BMS to talk to my existing NLG4 charger, and AMC320 motor controllers, limiting regen and current draw for limp home mode.

Hope that answers your question,
Wolf


----------



## zaxxon (Jul 11, 2009)

WolfTronix said:


> I am not sure if the better place packs use the old BMS or the newer one... They have different serial protocols, See this video:
> http://youtu.be/pyUQn75jWd0
> 
> Hopefully the video is more exciting than a text book.




The BMS module in the Better Place pack I have seen, have the all white connector set. Markered: 285UF00A00 (--B) TC1209


----------



## bigmotherwhale (Apr 15, 2011)

why dont you just trick the BMS by supplying the correct voltages to the lines that aren't connected to cells? eg with a divider network and an isolated supply. 


I realise im proabbly teaching my grandma to suck eggs here... but i thought it was worth a mention


----------



## WolfTronix (Feb 8, 2016)

bigmotherwhale said:


> why dont you just trick the BMS by supplying the correct voltages to the lines that aren't connected to cells? eg with a divider network and an isolated supply.
> 
> 
> I realise im proabbly teaching my grandma to suck eggs here... but i thought it was worth a mention


That is exactly what I am going to do this weekend. So I can reverse engineer the serial protocol. 

I have a 4 adjustable power supplies (1.97V to 4.62V) that I am going to hook up to one of the balance chips, (replacing the last 4 cells on the ground side of the pack).

Then I am going to adjust the voltages and see what changes in the serial protocol.

If I am lucky, and I set the voltages higher than the rest of the cells in the pack, I am hoping that I will see some packets that turn on the balance shunts for the higher "cells".

I might also need to trick the current sense to make the BMS think it is charging... Unless it really needs to talk to the Nissan Leaf battery charger to enable balancing mode...


----------



## WolfTronix (Feb 8, 2016)

Made some more progress over the weekend. 

Bytes 6,7,8, 9 and 10 contain the cell voltage data.

Cell voltages are packed 10 bit, 2's complement signed.

The balancing chips must contain a fully differential front end.
Even samples are +- odd samples are -+ with respect to the cell.

It looks like the Microcontroller takes the average between the samples to remove any front end bias one way or the other.

Still working on the unknown bytes in the serial stream... 

Video
http://youtu.be/z2ZqNtZ8TMc

Depending on when you see this post... I might have updated the web site:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html

Thanks, 
Wolf


----------



## WolfTronix (Feb 8, 2016)

Made some more progress last night (did not get to work on it over the weekend, had to do taxes). 

Bytes 11 and 12 contain a "fifth cell" voltage data. This appears to measure the balancer chips internal linear regulator. The linear regulator takes the combined 4 cell stack voltages down to 4.12-ish volts to power its self.

The reference voltage is packed 11 bit, 2's complement signed, but is only ever positive, thus full scale is 1023 = 4.545V. This is different from the individual cells... but it does not appear that the reference voltage is sampled differentialy. So this might be correct.

The remaining bits in Byte 12 and byte 13 might contain a battery "health" type value or "balanced" value (still working on this, might be missing a bit or 2), The value seems to act like a bell curve with respect to the 4 cell stack voltage. 

If the cell voltages are above 4.2V, the value is low.
If the cell voltages are in the 3.2V - 4.2V, the value is higher.
If the cell voltages are lower than 3.2V, the value is low.

I will try and see what the value does when the cells are "balanced" vs not "balanced". Might gain some more insight.  

I am also going to mod my battery simulator to short and open each cell with some jumpers... See if that triggers any flags in some of the 0 bytes, and/or affects the above battery "health"/"balanced" value.

Depending on when you see this post... I might have updated the web site with this new info:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html

Thanks, 
Wolf


----------



## WolfTronix (Feb 8, 2016)

"Perturb and observe" is working. 

The most interesting thing is that the LEAF BMS balances all the time.
Once cells are out of range the balance shunts start tuning on, will probably post a video tonight.

More info:

Bytes 13 and 14 contain a "sixth cell" voltage data. This appears to measure the balancer chips internal ground connection. Typically returns 0... but every once in a while there is a 1 bit change. Still not sure, but I think it is 11 bit, 2's complement signed, like the reference voltage measurement.

Byte 16 upper 2 bits seems to encode some chip status... I have seen these change, but not sure what they mean.

Bytes 4 and 5 are also status bytes... Upper and lower nibbles encode shunt status, over volt status, under volt status and converter fault status.

Byte 3 upper 2 bits also encode chip status... I have seen 0xF2 become 0xFA if the cell voltages get too low, such that it has problems powering its self.

Most importantly 
Command packet:
0x55 0x99 0xXX 0xFY 0xZZ
controls the balance shunts.

Such that:
0xXX = 0x21 - 0x38 = chip address
0xFY = lower nibble is which shunt should be enabled.
0xZZ = CRC8 check sum.

There are a few other control packets that I don't know what they do yet...

I am going to heat up the three temperature sensors and see if any of the control packet data changes. Same with adjusting the current sensor.

Then I think I have enough info to start modifying the BMS for different pack configurations. 

Depending on when you see this post... I might have updated the web site with this new info:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html

Thanks, 
Wolf


----------



## AntronX (Feb 23, 2009)

Great work, cant wait to see your progress on DC converter.


----------



## Coulomb (Apr 22, 2009)

WolfTronix said:


> The most interesting thing is that the LEAF BMS balances all the time.


Interesting. A friend of mine and I had a quick look at the Leaf BMS, and concluded that the bypass resistors must be 430 ohms. So that's less than 10 mA of bypass current. If this is correct, we figured it must be bypassing all the time. Your findings seem to confirm this theory.

http://forums.aeva.asn.au/bms-and-contactor-box_topic4278_post56055.html

Do you have a way of measuring the bypass current? Or can you confirm or disprove our tentative conclusion? Just curious.

Edit: the schematic down a few posts might also come in handy, in the unlikely case that you haven't found one yet.


----------



## WolfTronix (Feb 8, 2016)

Yeah the shunt resistors are only 430 ohms so under 10mA.

Actually the balancer chips when active draw 5mA (when the shunt is off), and 0mA (need a better meter), when not sampling the cells.

The current was measured using a 1ohm resistor on my cell simulator:









I am uploading a youtube video with the findings right now... but it still has about 4 hours left to upload (I have a slow internet connection). ;P

It should get added to this playlist:
http://www.youtube.com/playlist?list=PLQdu_G7xyFIQ-hNQHEqc3in4qWGy6dpfp

Thanks, 
Wolf


----------



## WolfTronix (Feb 8, 2016)

Here is the latest video:
http://youtu.be/E-hDNjh4qyc

Enjoy,
Wolf


----------



## Tomdb (Jan 28, 2013)

thanks for the work. 

Also good diagram of the cell simulator, will be usefull to reverse engineer any bms system.


----------



## WolfTronix (Feb 8, 2016)

Tomdb said:


> thanks for the work.
> 
> Also good diagram of the cell simulator, will be usefull to reverse engineer any bms system.


No problem... 

For those that want to recreate it:

On the primary of the transformer, the MOSFETs are turned on out of phase with each other at around 50kHz, (slightly less than 50% duty cycle to prevent cross conduction).

And I would multiply all the resistors by 1000, (except the 1 ohm current sense resistor).

The resistor values are scaled for the 100 ohm 20 turn pots I all ready had... and the regulators get a bit warm to the touch.

Also, there is a 0.1uF ceramic cap across each 33uF electrolytic cap.

And cap values where chosen from the stock I all ready had... 

It is literally built out of spare parts, here is a time lapse video of its construction:
http://youtu.be/TVPOZZTasEg

Thanks, 
Wolf


----------



## WolfTronix (Feb 8, 2016)

Over the last few days I mapped out all 100 pins of the Nissan Leaf BMS microcontroller.

And I finished a board layout to adapt a dsPIC33EV256GM106 microcontroller to the PD70F3236 microcontroller footprint.

This will let me replace the existing microcontroller, and then I will have full control over the BMS hardware. 

Enjoy:
http://youtu.be/1minD17pGnQ

Depending on when you see this post... I might have updated the web site with this new info:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html


----------



## WolfTronix (Feb 8, 2016)

Removed the microcontroller during my lunch hour today at work:









I also recorded a video using the hot air desolder station with a 100-pin TQFP removal tip. Will upload later tonight when I get home. 

I wanted to see what was under the micro before I sent the gerber files to make my adapter board... 

I will put down a layer of Kapton tape to keep the traces on my PCB from shorting on the ground pad under the microcontroller. I don't trust the solder mask as an insulator.


----------



## WolfTronix (Feb 8, 2016)

Here is a link to the video:
http://youtu.be/rdgMTXMr0Hs

Thanks for watching.


----------



## WolfTronix (Feb 8, 2016)

Board files off to the fab:


----------



## framuga (May 17, 2016)

interesting thread. any progress? if you have decided to replace the microcontroller must know all the communications protocol. you have this information?


----------



## WolfTronix (Feb 8, 2016)

framuga said:


> interesting thread. any progress? if you have decided to replace the microcontroller must know all the communications protocol. you have this information?


The info is posted on my website:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html

It is still a work in progress...

I have a few more customer projects to get done, then I can get back to working on my personal projects. 

If you want to see what I am working on:
www.youtube.com/wolftronix


----------



## framuga (May 17, 2016)

It's fantastic. what I know is that we can interpret the messages the BMU poured into the CAN bus and display voltages, etc SOCs, as does spyleaf. the BMU leaf performs equalization on its own initiative, or is activated by instruction CAN bus?


----------



## WolfTronix (Feb 8, 2016)

framuga said:


> It's fantastic. what I know is that we can interpret the messages the BMU poured into the CAN bus and display voltages, etc SOCs, as does spyleaf. the BMU leaf performs equalization on its own initiative, or is activated by instruction CAN bus?


The CAN bus displays the state of the balance shunts (on / off).
But the state of the balance shunts (on / off) are not controlled by CAN bus.

The balance shunts are controlled internal to the BMS.


----------



## framuga (May 17, 2016)

fantastic. I'm trying to adapt the BMU to a battery pack leaf with fewer cells, half. therefore the system should only act autonomous and externally control the charger off and on. It is so? I could cheat the system by cells with dummy read voltage. for example with a dcdc converter and splitter zener


----------



## WolfTronix (Feb 8, 2016)

framuga said:


> fantastic. I'm trying to adapt the BMU to a battery pack leaf with fewer cells, half. therefore the system should only act autonomous and externally control the charger off and on. It is so? I could cheat the system by cells with dummy read voltage. for example with a dcdc converter and splitter zener


If you do it that way, I think you will have balancing issues...
If your cells are above the Zener voltage, the BMS will be shunting all the cells.
If your cells are below the Zener voltage, the BMS will be shunting all the Zeners.

What I would do:
Because the midpoint of the BMS is isolated...
Leave half the pack connected to the BMS as is.
Then take the other half, remove the cells and wire the BMS lines one to one to the first half cells. 

For example:

Cell 1 --- BMS Sense 1 and 49
Cell 2 --- BMS Sense 2 and 50
Cell 3 --- BMS Sense 3 and 51
...
Cell 46 --- BMS Sense 46 and 94
Cell 47 --- BMS Sense 47 and 95
Cell 48 --- BMS Sense 48 and 96

Take caution while doing this,
If you get them out of order you will damage the BMS.

And in this configuration you MUST have your fuse and/or contactor on the high and/or low side of the total pack. 

You CAN'T have the fuse and/or contactor at the midpoint of the pack, (this will damage the BMS if it ever opens).


----------



## framuga (May 17, 2016)

Big Deal. Fantastic admirable observations and their work. It is only isolated in the middle of pack voltage chips? I really need a pack of 18 or 19 leaf cells it would need. This makes 36 or 38 lines of AD converters are used. The rest could work with dividers zener above the maximum cell value so that they are continually equalizing. But it does not seem good solution. I could think of removing the shunt resistors dissipation for unused lines. It can be an alternative.


----------



## framuga (May 17, 2016)

Hello everyone. how much current equalization finally uses the ASIC?


----------



## ybpvin (Jul 11, 2019)

hi boys!
Prompt an algorithm! 
I cannot decode tension on uart from D15110. Tried different methods.


----------



## framuga (May 17, 2016)

Hi all. I have also tried without success to find out the coding of the voltages in the D15110 package. I believe that the Wolftronic simulation method should be followed, adjusting and seeing the changes of the packages.


----------



## framuga (May 17, 2016)

It is a pity that Master Wolf has abandoned the project.


----------



## ybpvin (Jul 11, 2019)

I addressed Wolftrinix, but in reply received only the reference to its resource.
I collected on a table the scheme with emulation of accumulators. I will investigate))


----------

