A friend of mine received his ZE50 last week. Only a few days later we had a successful “CANbus sniffer session”. As I indicated in another post it seems the E-bus of the car, which in the past was wired directly to the OBD2 (SAE-J1962) connector, is now firewalled. And indeed, in the list of ECU’s of the ZE50 there is what is called a “Secure Gateway”.

First indications are the gateway needs to be mildly coaxed into letting us through, but for non-evasive stuff like CanZE does, there is no cryptographic authentication involved.

There are a LOT of new boxes in the ZE50. Some have 11 bit addresses, some 29 bits, and some seem to be able to use both. Let’s call that “interesting”.

So where are we now? Well, we have a few reasonable assumptions now. At the moment, I am making minor changes to the CanSee dongle so it supports 29 bits addressing and it’s internal table of ECU’s contains the new boxes. That is reasonably straightforward and almost done.

Next, I will add a simple screen to the experimental section of CanZE and see if we can make that work flawlessly. Just a few fields. To test that it will require another round trip to my buddy who will kindly let me plug in my gear into his car. This is a crucial step. If this goes as expected, the remainder is just work.

We need to upgrade the driver for the ELM dongles to enable 29 bit mode, and finally we need to go over each and every field to see if we can use the old definitions or need to adjust.

So, there is a plan now, there is decent logging data, and fairly good field definitions. But first I need to get rid of the flu 🙁

I had my hands on a ZE50, but unfortunately no CLIP tool was available to “tap”. Things have definitely changed.

  • The SAE1962 (“OBD2”) connector has moved to the A pillar just in front of the handle to open the bonnet;
  • The MM CANbus has been removed from the connector;
  • The V CANbus has been replaced with what seems to be a diagnostic bus.
  • The exposed CANbus is completely silent. At this moment my conclusion is that the connector is now connected to a separate gateway (port). It does not relay the free frame chatter and needs to be “coaxed” into delving deeper into the car. To make that happen I need to have a session with a real, updated CLIP tool.

It seems we’re right on time finishing up the “Use ISOTP mode” setting, because I doubt free frames will be made available at all.

Thanks to SpeakEV user B9er we can present you even more pictures of a gutted Q model BCB and Filter. Contrary to my earlier thoughts, the neutral current sensor is in the black box. BTW, this part failed and he is looking for a second hand BCB or black box. Leave a comment here if you have one for sale for him please. And now for the eye candy…..

Coil, capacitor block, charger electronic block
More charger electronics block
Opened
It’s main board
Motor Neutral current sensor location
Power part
Current sensor board

The next two are from the filter module. One relay is the L3-N relay, the other bridges a pre-charge set of resistors. Remember this post? Yep, that’s it!

One of the two relays in the filter
Other side of the PCB, 4 big solder joints are the two relays; right one is pre-charge bridging the resistor bank

The Tire IDs (and pressures) are conveniently labeled Front Left, Front Right, etcetera, but the car has no separate receivers for the individual wheels. It just sees four values coming in and checks it. Enough for the warning light, but not for us users. We want to make sure the pressure is stated for the correct wheel, and the ID for the correct wheel is displayed.

We’re in a pickle a bit as we received a report that the Rear IDs in CanZE are swapped, while we have followed available documentation. As none of the developers have a TPMS equipped car, it’s impossible to experiment. So in case you are a “tire guy” with a TPMS equipped ZOE, please do some experiments and confirm (or deny) said report. Thanks!

I’ve been busy recoding the interface between my home automation and ZE services as Renault changed their entire apps and API to “MY Renault”. That worked out with the kind help provided by James. All back on track again in Node-RED.

While doing some research I ran into a post from one of the developers on the French forum. This was one of the things he mentioned that has always been “somewhat known”, but more precisely formulated now.

  • Start of charge
  • During charging, every 30 minutes (every 15min for Z.E. 40)
  • End of charge
  • Beginning of a journey
  • During the trip, every 30 minutes (every 15min for Z.E. 40) or every 5% of SOC (state of charge of the battery)
  • End of a trip
  • Before sleep (3 min after lockout) if the battery value has changed since the last message
  • Before sleep (3 min after lockout) if the car is not connected, a charge is programmed and the charge level is less than 100%
  • Low battery alert
  • Instant pre-conditioning set point.

The Range screen has been fixed and needs some explanation. In essence it compares the available range calculated by the car to three different ranges:

  • The first number is a range based on the current energy content of the battery and the worst consumption;
  • The second number is the same, based on average consumption. One would expect this to be the same as the car reported range, but it isn’t;
  • The thirst number is the same but using the best consumption.

The consumption numbers are calculated by the car. The second number can made a bit worse using the slider to adjust for sporty driving. In my case, leaving it at -10% seems to be about right.