ZE50: A different beast

A friend of mine received his ZE50 last week. Only a few days later we had a successful “CANbus sniffer session”. As I indicated in another post it seems the E-bus of the car, which in the past was wired directly to the OBD2 (SAE-J1962) connector, is now firewalled. And indeed, in the list of ECU’s of the ZE50 there is what is called a “Secure Gateway”.

First indications are the gateway needs to be mildly coaxed into letting us through, but for non-evasive stuff like CanZE does, there is no cryptographic authentication involved.

There are a LOT of new boxes in the ZE50. Some have 11 bit addresses, some 29 bits, and some seem to be able to use both. Let’s call that “interesting”.

So where are we now? Well, we have a few reasonable assumptions now. At the moment, I am making minor changes to the CanSee dongle so it supports 29 bits addressing and it’s internal table of ECU’s contains the new boxes. That is reasonably straightforward and almost done.

Next, I will add a simple screen to the experimental section of CanZE and see if we can make that work flawlessly. Just a few fields. To test that it will require another round trip to my buddy who will kindly let me plug in my gear into his car. This is a crucial step. If this goes as expected, the remainder is just work.

We need to upgrade the driver for the ELM dongles to enable 29 bit mode, and finally we need to go over each and every field to see if we can use the old definitions or need to adjust.

So, there is a plan now, there is decent logging data, and fairly good field definitions. But first I need to get rid of the flu 🙁

22 comments on “ZE50: A different beast
  1. King Ming says:

    Good afternoon! It’s great that you have a plan and a possible way forward. Thank you for all your hard work, once again. I hope your flu gets better. Get some rest!

  2. Ashley says:

    This is great news. Thank you for all the hard work. I look forward to possibly using CanZE when I get my new Zoe.

  3. Seb Meusien says:

    Nickel, ce n’est pas une Zoé 2 qui va vous arrêter.
    Vivement la mise à jour de CanZE.
    Bon courage.

  4. Léopold Baillard says:

    Super nouvelle ! Je dispose également d’une Zoé 2019 s’il y a besoin de faire des tests, je serais ravis de filer un coup de main !

  5. Jesper says:

    Hi Jeroen! I got my ZE50 for some days, and also have a Carista dongle and a generic ELM327. Is there anything I can do to assist you? If you need a tester, I am at your service (android user). Thanks for the good work 🙂

    • Jeroen Meijer says:

      Thanks. I will roll out something in the open beta hopefully in a week or so, but it’s only fair to tamper expectations somewhat, as it needs both opening the gateway, using different addresses as well as making the dongle use 29 bits addresses on some (not all!) requests. It looks like all three are fairly easy but without a car at hand it’s easy to make an error in either one and not seeing which. Stay tuned, things WILL happen.

  6. Ivan says:


    My ZOE50 will come at the end of March and I would realy like to “spy” it.
    I already installed CanZe (Google Play) and ordered 13,86 € dongle via Aliexpress (Super ELM327 New for Konnwei KW902 Bluetooth OBD-II Car Diagnostic Tool Elm 327 OBD2 code reader scanner better than elm327 V2.1) and I hope it will work.
    I’m looking forward ZOE50 upgrade.

  7. Roberto Sonzogni says:

    We can test it on our Zoe R110 if you want 🙂

  8. albrehti says:

    What are the minimum requirements to install CanZe on smarthphone.
    I have Android 4.1.2 with 4 GB internal storage and 16 GB SD card I would like to use it just for CanZe app.
    But searching for CanZe in Play Store there is no results.
    Thank you

  9. Michael McNeela says:

    Howdy Jeroen

    Assuming you work out how to ‘coax’ the gateway into letting you through, I’d be incredibly grateful if you could let me know how (via email etc).

    I’m on a months-long adventure to retrofit a used ZE50 Easy Link (A-IVI) radio system into my ZE40 Zoe, to get Apple CarPlay (and, by happenstance, a nicer UI in general), but it looks like I’ll need to dump & replay CAN messages from a ZE50 to successfully wake the radio. Once I can wake it, I should be able to configure it to wake *on power* (or another, more compatible, wake method for the ZE40), rather than via ZE50-specific CAN messages. (Failing that, I can replay the required messages via an add-on module, but …either outcome will seemingly require a dump)

    Big thanks!

    • Jeroen Meijer says:

      What I have seen “opening” the gateway just opens it for diagnostics commands. I have not found (but admittedly also not searched for) a “transparent” mode where you can sniff all traffic. Opening the gateway is fairly simple. Send ISOTP 0x1003 to 0x18daf1d2.

  10. Robert Schneider says:

    I have build the app with the latest commit from Github, installed it on my phone and connected my ZOE 50.
    I did see some stuff, however, I also didn’t see a lot of stuff and saw Debug messages with fails. But I don’t know, what should work and what doesn’t.
    If I can be of any help with diagnosing stuff for the ZE50, let me know, I am a software engineer.
    Thanks for all of your work and best regards,

    • Jeroen Meijer says:

      Thanks Robert. At this moment the thing that I know should work are the ZE50 test (pedal position) and the LBC, read, cell temperatures and voltages. Also a few parameters on the advanced charging screen work, as is the Max battery Charge/Regen kW in the charging screen. Probably a few other will too. Torques do not work for sure at this moment.

Leave a Reply