Info on BMW hybrid battery packs?

[jalovick]

BMW have issued a recall on a number of their PHEV models, due to the potential of contamination within the packs, which may cause a short. It's worth checking them carefully before use.

Info at https://electriccarsreport.com/2020/10/ ... fire-risk/

[storm4710]

Newtis has been closed by bmw so all newtis links at the first page is now dead

This is sucks big time, newtis was great resource.

just got word back from Newtis
i can invite people to the Newtis "archive"

so if somebody wants a link message me(I will need your email to send the invite)
if bmw finds out the "archive" is active it will be taken down permanently,
So pls keep the link on this forum,

best regards
Martin

[bobby_come_lately]

Does anyone have a pinout for the 'safety module'? Looking at re-using it but didn't take a note before I adapted the loom.

[sprocketman]

Does anyone have a pinout for the 'safety module'? Looking at re-using it but didn't take a note before I adapted the loom.

Hi,

Which pin out do you need?

this one?

[bobby_come_lately]

Does anyone have a pinout for the 'safety module'? Looking at re-using it but didn't take a note before I adapted the loom.

Hi,

Which pin out do you need?

this one?

Yes please! That's the external connector, right? Guessing it's power and CANBus and...??

[arturk]

I put together this before newtis went down.
If you scroll all the way to the right, you will see most of what you are looking for.

However I am wondering if we know how to communicate with internal controller.
It is nice piece of equipment including ISA-like sensor but it I have not seen any information how to talk to it. I may have missed it though.
Any info on that would be appreciated.

Meanwhile, I am using box but I removed original controller, wired contactors directly to external connector and fitted ISA sensor which fits nicely (with very small modification of the busbar).

[sprocketman]

Does anyone have a pinout for the 'safety module'? Looking at re-using it but didn't take a note before I adapted the loom.

Hi,

Which pin out do you need?

this one?

Yes please! That's the external connector, right? Guessing it's power and CANBus and...??

Its the conection inside the black S-Box. its just cliped into the plastic housing.
A341*1B is the conector lable to the s -box

Here is a close up of the connections.

it turns upside down for some reason when you click on it so here is another one.

Dont quote me because I havent tested it but I think the conections are :-
1 and 10 is can black
3 is 12v Red
12 is ground Grey
14 is 12v red

There are 2 cables on 7 and 16 that dont go to the loom
7 Light Blue
16 Grey

[bobby_come_lately]

Great - thanks all. Will have a play. Like the idea of dropping the ISA shunt in if I can't get the original electronics going.

[OutlandishPanda]

Hi, yes, it is absolutely possible to use the S-Box in its original form to output current and voltage.

I've spent quite some time reverse engineering the CAN messages up to about 300V and about 50A so far. I will dig out where I've got to and share. I'd really appreciate some sharing of real in-vehicle testing as I'm a bit limited with the test hardware I have at the moment.

Pins used as here:

My test setup is like this for current, using a DC current clamp and Arduino for CAN and current clamp logging and comparison, and an old PTC heater and 12V battery for a nice curvy current signal - good to work out scaling:

It has a single resistor shunt current sensor but with two independent high resolution A2Ds, an ASIL D processor, so very complex, and rather a lot of duplicated CAN signals. There are also a few complex voltage signals that seem differential in nature.

But critically, there is a pure signed current signal to a high resolution and a good battery terminal voltage available continuously on power up. I'll post where I've got to with that later.

Its way beyond me to reverse engineer the ability to control the contactors over CAN. For direct connection from SImpBMS, there is obviously all the mosfet drivers for the contactors, but complicated by both high and low side driving and current sensing etc. I guess for the ASIL D requirements. But last I looked, I think it is possible to cut the processor outputs to the drivers, solder in some flying leads and have a go at driving them independently from the Teensy. I hope that does not send the processor crazy.

I'm trying to use the 3 series PHEV pack with minimal modifications, hopefully just one Teensy with SimpBMS and a second CAN interface.

Hope that helps, and I'll send the CAN messages and my attempt at the scaling info later.

Richard.

[mdrobnak]

Does it follow any of what's here? https://www.isabellenhuette.de/fileadmi ... _IVT-S.pdf

-Matt

[bobby_come_lately]

Hi, yes, it is absolutely possible to use the S-Box in its original form to output current and voltage.

I've spent quite some time reverse engineering the CAN messages up to about 300V and about 50A so far. I will dig out where I've got to and share. I'd really appreciate some sharing of real in-vehicle testing as I'm a bit limited with the test hardware I have at the moment.

Pins used as here:
S-BOX Pins.jpg

My test setup is like this for current, using a DC current clamp and Arduino for CAN and current clamp logging and comparison, and an old PTC heater and 12V battery for a nice curvy current signal - good to work out scaling:

S-BOX Testing.jpg

It has a single resistor shunt current sensor but with two independent high resolution A2Ds, an ASIL D processor, so very complex, and rather a lot of duplicated CAN signals. There are also a few complex voltage signals that seem differential in nature.

But critically, there is a pure signed current signal to a high resolution and a good battery terminal voltage available continuously on power up. I'll post where I've got to with that later.

Its way beyond me to reverse engineer the ability to control the contactors over CAN. For direct connection from SImpBMS, there is obviously all the mosfet drivers for the contactors, but complicated by both high and low side driving and current sensing etc. I guess for the ASIL D requirements. But last I looked, I think it is possible to cut the processor outputs to the drivers, solder in some flying leads and have a go at driving them independently from the Teensy. I hope that does not send the processor crazy.

I'm trying to use the 3 series PHEV pack with minimal modifications, hopefully just one Teensy with SimpBMS and a second CAN interface.

Hope that helps, and I'll send the CAN messages and my attempt at the scaling info later.

Richard.

Thank you! You've saved me loads of time there. Got as far as stripping my board down and taking some high res pics of the underside if the connector to work out where the traces went. But can just put it all back together now.

Love to see your can messages as well. Shame we don't have a log from which we could extract contactor control.

When you say an extra CAN interface on your teensy, is that to have separate ones for the battery modules and communication with the rest of the car?

[sprocketman]

Hi, yes, it is absolutely possible to use the S-Box in its original form to output current and voltage.

I've spent quite some time reverse engineering the CAN messages up to about 300V and about 50A so far. I will dig out where I've got to and share. I'd really appreciate some sharing of real in-vehicle testing as I'm a bit limited with the test hardware I have at the moment.

Pins used as here:
S-BOX Pins.jpg

My test setup is like this for current, using a DC current clamp and Arduino for CAN and current clamp logging and comparison, and an old PTC heater and 12V battery for a nice curvy current signal - good to work out scaling:

S-BOX Testing.jpg

It has a single resistor shunt current sensor but with two independent high resolution A2Ds, an ASIL D processor, so very complex, and rather a lot of duplicated CAN signals. There are also a few complex voltage signals that seem differential in nature.

But critically, there is a pure signed current signal to a high resolution and a good battery terminal voltage available continuously on power up. I'll post where I've got to with that later.

Its way beyond me to reverse engineer the ability to control the contactors over CAN. For direct connection from SImpBMS, there is obviously all the mosfet drivers for the contactors, but complicated by both high and low side driving and current sensing etc. I guess for the ASIL D requirements. But last I looked, I think it is possible to cut the processor outputs to the drivers, solder in some flying leads and have a go at driving them independently from the Teensy. I hope that does not send the processor crazy.

I'm trying to use the 3 series PHEV pack with minimal modifications, hopefully just one Teensy with SimpBMS and a second CAN interface.

Hope that helps, and I'll send the CAN messages and my attempt at the scaling info later.

Richard.

Nice work I am using 8 modules in series so might be able to help with the higher voltage. I am powering the contractors separately also.

[OutlandishPanda]

So, the CAN bus is 500KBPS and I've found a good correlation with CAN ID 220 for battery volts on the battery side of the contactors.

This is preliminary but seemed to work out for turning ID220 in to volts:

Code: Select all

   //ID220 DC Bus Volts pure
            a=((float)(256*(int)(canMsg.data[2])+canMsg.data[1]))/256.0*p1;
            b=(((float)(canMsg.data[0]))/256.0)*(p2/p3);
            c=(((float)(canMsg.data[6]))/256.0)*(p4/p5);
            volts220=a+b+c;

With parameters:

Code: Select all

float p1=64.0;
float p2=p1;
float p3=256.0;
float p4=p1;
float p5=1024.0;

I'd be really grateful if others could try that and validate or adjust. Those parameters seemed "plausible" so hopefully that is about right? I'm new to this CAN reverse engineering.

Attached is my spreadsheet of working out the above from the raw log if that is any help to validate what I found. This has all the IDs logged, but only calculating on ID220.

I used a UK mains rectifier and high voltage capacitor to charge up to 300VDC and let it discharge through a resistor, then disconnected it when I saw 15V on my meter so I had known voltages in the log to compare to.

[OutlandishPanda]

In addition to the battery side of the contactors, there is ID 210 which measures on the DC bus side, but has a strange ratio with voltage applied on the battery terminals also. So, I've left going any further with this until I put it back in the pack and test it for real. It also needs a very strange set of parameters to get to voltage. Would be useful to know battery and DC bus volts for assessing the pre-charge process. I did wonder if it changes with current also, but I've not tested that.

Then there is ID 600 which seems to be a simpler, lower resolution voltage output with both of ID 220 and 210 embedded. Maybe it is a different measuring approach as a backup or something related to the safety earth leakage check. It might also change with current and be Wh? I've not taken that any further as yet.

Would be great if there was an accurate Wh output on CAN. I need a complete pack with a real load to check that. I'm a long way from that at the moment! If anyone can test and share the logs for a working system, maybe with a separate current clamp log and a reasonable and varying load, that would be very helpful.

Next up, current.

[OutlandishPanda]

Current seems to be on ID200 (but there is also current related data on ID110)

I found this gives a meaningful current signal:

Code: Select all

current200=((float)((256*canMsg.data[2])-(canMsg.data[0]+PCoffset+canMsg.data[1]*256)))/PCscale;

With:

Code: Select all

float PCscale=1.2;
int PCoffset = 12;

EDIT - this is probably not correct and needs testing at higher currents and use of bytes 0 to 3. Will update after more testing!


Seems strange to need that scaling factor? The offset is tiny in mA and probably different for each. Not sure if needed really and could be just inaccuracies in my current clamp and Arduino.

Attached is my spreadsheet that got me to this if any use, showing positive and negative currents.

BMW current 110 200.xlsx

(1.29 MiB) Downloaded 199 times

Again, this needs real testing as I've only got to this with a few tests. I was trying to increase current but then ran out of time.

Be great to hear of others experiences with this. Its an amazingly well engineered piece of kit which seemed a shame not to use.

[OutlandishPanda]

Hi mdrobnak,

Thanks for the reference. It does not seem related to the ISAscale sensor you referenced and very different CAN approach? That looks a nice piece of kit, but $400! The BMW S-Box is engineered and made by Lear. I think it uses a similar sensing technique, but with dual redundant and separated A2Ds, each with dual range. It also has separate voltage measuring circuits and a system to check for earth leakage, which I've not figured out yet. Maybe the basic sensor shunt is from ISAscale?

[OutlandishPanda]

bobby_come_lately, yes, my idea for SimpBMS is like this (sorry messy):

I've added a simple TFT to the SimpBMS code (that is the start up splash screen) and a second CAN bus interface over SPI. The latter turned out to be tricky to get working. I found the ACAN2515.h library for mcp2515 SPI CAN does not upset the FlexCAN library used by SimpBMS.

I'm keeping the native Teensy 3.1 CAN connection exclusively for the modules unmodified from the fantastic work by Tom. The second CAN will talk to the S-Box for current mainly, maybe voltage also (although we have that from the modules) and maybe Wh if it outputs that. It will also output data over CAN to the vehicle controller (Teensy 4.1). (That will drive an Outlander front transaxle etc.)

The screen is mainly for development and watching charging and shows the following currently:

The colour bars at the bottom represent the delta V of each cell (80 in my case) with the colours scaled from a Google project here:

https://gist.githubusercontent.com/mikhailov-work/

Which does a good job of representing values in RGB for humans to spot the relative values. Looks clearer on the screen than this photo where the greens seem to have vanished. No idea if it will be of any use yet as not tried it on the pack. My pack had 1 to 2mV cell to cell variations as received out of a vehicle, which is amazing really.

The vertical bars in the middle of the SOC ring are the module temps.

So, on one screen you can see everything coming out of the PHEV modules and S-Box. HMI designers will be horrified I'm sure!

I'm a long way from getting this implemented and working properly but will share when I get that far. I'll probably also change the screen for IPS for use in the vehicle and simplify a bit.

[pilt]

Hi OutlandishPanda,

This is great work! I too have breifly had a look at the sbox communications, because i am using a 330 battery pack and would like to use the SBox.I have not sofar decoded any of the messages from the SBox, but it looks like you have worked this out, so this is a great help!

What I have done is look at the communication from the sme to the Sbox by powering this up seperatly. It looks like ID 0x100 and 0x300 are sent by the SME, presumably to command the Sbox to close the contactors. Unfortunatly, I have not had time to go any further to manipulate the messages and see if I can get anything to happen, and now i need to rewire my setup.

I belive you would need power on pin 14 for the contactor supply also, perhaps you will see one of the CAN messages being sent by the Sbox change when you apply 12V to this pin (could be a status bit for this supply)?

I have attached a log of the SME messages, perhaps this will help. In message 0x100 it looks like there is a counter in byte1 and possibly a CRC in byte 4. However the CRC does not seem to match anything i have tried.

[bobby_come_lately]

This is fantastic information @OutlandishPanda. Thanks again for sharing.

I've started collating all this for the wiki and will post it up when I get a chance. In the meantime I'm going to experiment with those codes tonight @Pilt. Have my S-box on the bench and will get it hooked up to CAN and 12V.

[OutlandishPanda]

Hi sprocketman, I'd not suggest connecting 8 modules to the voltage measurement connector of the S-Box (three thin orange wires), that will probably exceed its capabilities significantly! No problem with the current sensor on its own up to the capabilities of the module I expect. There are lots of resistors in series in that measurement system that presumably for a potential divider for the A2D. You can get the voltages from the modules. Just a thought!

pilt, thanks, I will certainly look at the additional 12V line. I think we will need CRCs understood to get it to respond to inputs like Tom reverse engineered for the modules. I'm not assuming that is possible unless we have logs on this can line in a working vehicle, which will be a challenge I guess?

bobby_come_lately, OK great, will be good to see others experiences with this.

[mdrobnak]

Hi mdrobnak,

Thanks for the reference. It does not seem related to the ISAscale sensor you referenced and very different CAN approach? That looks a nice piece of kit, but $400! The BMW S-Box is engineered and made by Lear. I think it uses a similar sensing technique, but with dual redundant and separated A2Ds, each with dual range. It also has separate voltage measuring circuits and a system to check for earth leakage, which I've not figured out yet. Maybe the basic sensor shunt is from ISAscale?

Well if you look at the picture on the first page, you're right - they aren't the same. Go down to page 15 on the torque specs, and, wow, that looks familiar. I think they revised the IVT-S design over time. The CAN IDs are configurable, I wonder what happens if you send a "get configuration" message to it.

-Matt

[pilt]

pilt, thanks, I will certainly look at the additional 12V line. I think we will need CRCs understood to get it to respond to inputs like Tom reverse engineered for the modules. I'm not assuming that is possible unless we have logs on this can line in a working vehicle, which will be a challenge I guess?

Yes a CAN log of a working vehicle would make it easy , but I suspect we are all working with batteries not in cars, so unless someone wants to hire a BMW e we will have to play! If we can work out the CRC (if it is even a CRC) then we should be able to see what each bit does and maybe get lucky. I will check the simpBMS code, maybe the crc is the same

The big risk if we get the Sbox to control the contactors is we dont know if there is any internal logic that could open the contactors in an attempt to protect the battery (could be a hardcoded current limit for example...) This could be very bad if we dont know about this and this happens when we dont expect it!

[bobbycomelately]

Using my secondary account because something seems to have gone awry with my login tonight (I'm having a week of tech horrors).

Anyway, tried throwing the 16 unique values from pilt's capture at the S-Box tonight and got some responses but no clicking (even with 12v on pin 14). It was a very long shot.

Ox310 and 0x511 consistent in the responses to the first four I aimed at it. Not captured responses to the rest yet.

Let me know if any of this is useful. Just tried getting my head around CRCs and think I need a stiff drink.

[pilt]

Current seems to be on ID200 (but there is also current related data on ID110)

I found this gives a meaningful current signal:

Code: Select all

current200=((float)((255*canMsg.data[2])-(canMsg.data[0]+PCoffset+canMsg.data[1]*255)))/PCscale;

With:

Code: Select all

float PCscale=1.2;
int PCoffset = 12;

Seems strange to need that scaling factor? The offset is tiny in mA and probably different for each. Not sure if needed really and could be just inaccuracies in my current clamp and Arduino.

Attached is my spreadsheet that got me to this if any use, showing positive and negative currents.BMW current 110 200.xlsx

Again, this needs real testing as I've only got to this with a few tests. I was trying to increase current but then ran out of time.

Be great to hear of others experiences with this. Its an amazingly well engineered piece of kit which seemed a shame not to use.

Hi OutlandishPanda,

I had a quick look. I think the current is actually stored across 4 bytes (0 to 3). It looks like a 32bit signed integer. If you look at the 4th byte, it is either 0x7f or 0x80 depending on which direction the current is (ignoring noise and small offset).

I will have another look when i have more time

[OutlandishPanda]

Hi pilt,

Thanks for testing! I saw that both bytes 2 and 3 gave signing info and so I ignored 3 - which was bad!

I think you are right, because putting manual data into my conversion shows with just two bytes, I can't exceed 78A. I just didn't test at high enough currents. I can't go over 60A at the moment. Shows the importance of full range testing.

Looking forward to your logs when you get time and I'll try and test at closer to 100A and report back.

Thanks!