iPace battery BECM hacking...

Jaguar / Landrover hardware hacking
Post Reply
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

iPace battery BECM hacking...

Post by obbardc »

Hi all

I have been trying to re-purpose an iPace 90kWh battery & connect it standalone without the car.

The components which are connected are the BECM, balancer circuit boards & BEM (containing contactors).

I have the BECM connected on the desk (with just canbus & power), with a canbus adaptor into SavvyCAN at 500kHz...
It seems to be using UDS and I can write to 0x7e4 & read from 0x7ec. Which seems to be very close to a Hyundai Kona battery (they are both LG Chem)!
I've managed to use caringcaribou to dump the DIDs and cross reference to the manual ... there appears to be a lot there..

I am reading no error codes on the BECM over UDA (or am reading them wrongly !). Even though I don't have all of the equipment connected (e.g coolant sensor), the BECM is not showing any error codes. Wonder if it's just stuck? If I remove the wiring to either precharge relay coil, I get a single error occur `P0AE1-14 Hybrid/EV Battery Precharge Contactor Circuit -Circuit short to ground or open` which is as expected. But I would expect more than one error...

I have a log of the car enabling the battery and hope to use that to move forward... The main thing I haven't managed to do is engage the contactors in the BEM.

Any ideas on how I can try to engage the relays?
I thought it would be manually engaged over CAN, since the manual says:
The HV DC connector to the HVCCM.
The HV DC connector to the front inverter.
The HV DC connector to the rear inverter.
The connector for the external EV battery coolant temperature sensors.
The main wiring harness connector with 18 pins for the following connections (Not all connections are used):
The external HV interlock loop (quantity 2).
A connection from the Restraints Control Module (RCM).

The BECM monitors the following:
The EV battery module cell voltages.
Internal EV battery module temperatures.
The HV interlock loop.
The HV DC voltages at various points in the Battery Electrical Module (BEM).
The HV DC BEM current sensors in the BEM.The EV battery coolant temperature sensors on the coolant inlet and outlet connections.
The BECM also controls the contactors in the BEM to isolate the EV battery when the HV interlock loop is broken or the SDU key is removed.
The BECM communicates with the HV system and other vehicle systems through the HS CAN power mode zero systems bus.
The BECM controls the following EV battery temperature control components:
The EV battery coolant pump
The EV battery changeover valve.

When an HV DC connection on any of the previously described connectors is removed, the HV interlock loop circuit is broken. The BECM detects the break and sends the HV interlock loop status to the Powertrain Control Module (PCM). If the vehicle is stationary the PCM requests the BECM to break the HV circuit. The BECM de- energizes all 3 contactors in the BEM to electrically disconnect the EV battery and the HV circuits discharge.

The BECM records any DTC and related data. The DTC and related data are read using the approved diagnostic equipment.
The JLR approved diagnostic equipment enables certain components to be activated and also read live data.

The EV battery expansion tank coolant level sensor is hardwired by the wiring harness to the Powertrain Control Module (PCM). When the EV battery coolant in the EV battery expansion tank is less than the minimum level. The EV battery coolant level sensor sends a signal to the PCM.

There is a 10Hz ENS crash signal on the battery connector coming from the Restraints Control Module (RCM), which is engaged when the contactors are on, I wonder if that is engaging the relays?
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

I have a spreadsheet with the BECM connector pinouts mapped (from service manual and existing work online):

Still have some work to do with the pinout, but for now it is functional.

So currently I have just the BECM connected on the desk, with simply:
- 12V from bench power supply connected to BECM_PWR & CONTACTOR_PWR
- CAN connected to SavvyCAN through V_CAN (120R termination resistor)


I've attached a screenshot from SavvyCAN showing the UDS ID present on this board.

I scanned the following services & read the data from that ID:

Code: Select all

caringcaribou dcm services 0x7e4 0x7ec
Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL
Supported service 0x11: ECU_RESET
Supported service 0x14: CLEAR_DIAGNOSTIC_INFORMATION
Supported service 0x19: READ_DTC_INFORMATION
Supported service 0x22: READ_DATA_BY_IDENTIFIER
Supported service 0x37: REQUEST_TRANSFER_EXIT
Supported service 0x3e: TESTER_PRESENT
Supported service 0x85: CONTROL_DTC_SETTING
and also the following DIDs (of course data is with nothing else connected....)

Code: Select all

$ caringcaribou uds dump_dids 0x7e4 0x7ec
Dumping DIDs in range 0x0000-0xffff
Identified DIDs:
DID    Value (hex)
0x0202 00
0x48c2 000000000000000000000000433943
0x4900 0000
0x4901 0000
0x4902 0000
0x4903 0000
0x4904 0000
0x4905 50
0x4906 50
0x4907 50
0x4908 00
0x4909 0000
0x490a 00
0x490b 0000
0x490c 8002
0x490d 0000
0x490e 0000
0x490f 0000
0x4910 0000
0x4911 0000
0x4912 00000000
0x4913 00000000
0x4914 0000
0x4915 c8
0x4916 c8
0x4917 c8
0x4918 bd
0x4919 bc
0x491a be
0x491b 00
0x491c 00
0x491d 01
0x491e 0000
0x491f 0000
0x4920 0000
0x4921 0000
0x4923 00
0x492b 00
0x492c 00
0x492d 00
0x492e 00
0x492f 00
0x4930 00
0x4931 00
0x4933 04
0x4934 04
0x4935 01
0x4936 02
0x4937 02
0x4938 00
0x4939 01
0x4941 42005000046000200000000f0000000000000000000000000000000000000000
0x4944 01
0x4945 01
0x494e 8002
0x4970 0000100000000020
0x4971 31393039323530303030353430303030
0x497a 0000
0x497b 0000
0x497c 0000
0x497e 0000
0x497f 0000
0x4980 0000
0x4981 03fe
0x498c 01
0xd015 00000000
0xd018 0cffffffff000024ff0000
0xd019 0000000000000000000000
0xd020 00000000
0xd021 00
0xd05b 04
0xd100 01
0xd10e 212b212b21
0xd14d 00
0xd703 0011
0xdd00 ffffffff
0xdd01 000024
0xdd02 ff
0xdd04 ff
0xdd05 ff
0xdd06 00
0xdd08 00
0xdd09 00
0xf113 4a3944332d3130423735392d434a00000000000000000000
0xf120 4a3944332d3134433139372d434c00000000000000000000
0xf121 4a3944332d3134433139372d425300000000000000000000
0xf124 4a3944332d3134433139382d414100000000000000000000
0xf162 06
0xf163 05
0xf16a 02
0xf180 014a3944332d3134433230302d414500000000000000000000
0xf188 4a3944332d3134433139372d415900000000000000000000
0xf18c 30303035383931393037323537000000
0xf190 5341444841324131334c3146393032363600000000000000
0xfd01 11d90559272e19080000000000000000000000
Attachments
Screenshot from 2024-06-23 12-29-56.png
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

So I have managed to clear/read the BECM error code using standard UDS;

Code: Select all

count DTCs:  cansend can0 7e4#0414ffffff000000
  can0  7EC   [8]  01 54 00 00 00 00 00 00
 no errors:   can0  7EC   [8]  06 59 01 8F 00 00 00 00
 1 error:     can0  7EC   [8]  06 59 01 8F 00 00 01 00


read DTC:  cansend can0 7e4#0319028f00000000 :
no error:  can0  7E4   [8]  03 19 02 8F 00 00 00 00
1 error:  can0  7EC   [8]  07 59 02 8F 0A E1 14 2E


clear DTCs:
cansend can0 7e4#0414ffffff000000
  can0  7EC   [8]  01 54 00 00 00 00 00 00
P0AE1-14 - Hybrid/EV Battery Precharge Contactor Circuit -Circuit short to ground or open

Because of this error code, I thought about wiring in the precharge coils (i have just put a 50R resistor for now) to PC_CONTACTOR_PWR to PCMAIN+_CONTACTOR_C & PC_CONTACTOR_PWR to PCANCIL CONTACTOR_C Then after clearing & resetting power I get no error codes reported and if I remove that resistor the error code comes back.

I would expect many more error codes as I've not connected ANYTHING to the system....
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

After reading the error codes, the car seems to then read out a big dump from an error code using Report DTC Snapshot Record By DTC Number

TX (0x7e4 0x19 [0x04, datA, datB, datC, 0xff]) with the three bytes datA datB datC being the error code read from the previous message(e.g 0xa 0xe1 0x14 OR 0 0 0 if no reported error also seems to work)


The car logs get 506 bytes out here; manually prodding this BECM I get 460 bytes out.

No clue how to decode this message or what it contains as yet. Looks like a custom vendor message ?


Code: Select all

    /* Response to Snapshot record */
    // In car got 506 bytes; we got 460 ....

    // Raw Payload (with P0AE1-14set): 0x59 0x04 0x0A 0xE1 0x14 0x2E 0x10 0x28 0xDD 0x00 0xFF 0xFF 0xFF 0xFF 0xDD 0x01 0x00 0x00 0x24 0xDD 0x02 0xFF 0xDD 0x05 0xFF 0xDD 0x06 0x00 0xDD 0x09 0x00 0x49 0x00 0x00 0x00 0x49 0x01 0x00 0x00 0x49 0x02 0x00 0x00 0x49 0x03 0x00 0x00 0x49 0x04 0x00 0x00 0x49 0x05 0x50 0x49 0x06 0x50 0x49 0x07 0x50 0x49 0x08 0x00 0x49 0x10 0x00 0x00 0x49 0x11 0x00 0x00 0x49 0x12 0x00 0x00 0x00 0x00 0x49 0x13 0x00 0x00 0x00 0x00 0x49 0x14 0x00 0x00 0x49 0x15 0xC8 0x49 0x16 0xC8 0x49 0x17 0xC8 0x49 0x18 0x00 0x49 0x19 0x00 0x49 0x0A 0x00 0x49 0x0B 0x00 0x00 0x49 0x0C 0x80 0x02 0x49 0x0D 0x00 0x00 0x49 0x0E 0x00 0x00 0x49 0x0F 0x00 0x00 0x49 0x1A 0x00 0xD7 0x03 0x00 0x11 0x49 0x21 0x00 0x00 0x49 0x1F 0x00 0x00 0x49 0x1E 0x00 0x00 0x49 0x1C 0x00 0x49 0x1B 0x00 0xD0 0x20 0x00 0x00 0x00 0x00 0x49 0x41 0x00 0x00 0x40 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x0F 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x4A 0x0B 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x4A 0x0C 0x00 0x00 0x00 0x11 0x28 0xDD 0x00 0xFF 0xFF 0xFF 0xFF 0xDD 0x01 0x00 0x00 0x24 0xDD 0x02 0xFF 0xDD 0x05 0xFF 0xDD 0x06 0x00 0xDD 0x09 0x00 0x49 0x00 0x00 0x00 0x49 0x01 0x00 0x00 0x49 0x02 0x00 0x00 0x49 0x03 0x00 0x00 0x49 0x04 0x00 0x00 0x49 0x05 0x50 0x49 0x06 0x50 0x49 0x07 0x50 0x49 0x08 0x00 0x49 0x10 0x00 0x00 0x49 0x11 0x00 0x00 0x49 0x12 0x00 0x00 0x00 0x00 0x49 0x13 0x00 0x00 0x00 0x00 0x49 0x14 0x00 0x00 0x49 0x15 0xC8 0x49 0x16 0xC8 0x49 0x17 0xC8 0x49 0x18 0x00 0x49 0x19 0x00 0x49 0x0A 0x00 0x49 0x0B 0x00 0x00 0x49 0x0C 0x80 0x02 0x49 0x0D 0x00 0x00 0x49 0x0E 0x00 0x00 0x49 0x0F 0x00 0x00 0x49 0x1A 0x00 0xD7 0x03 0x00 0x11 0x49 0x21 0x00 0x00 0x49 0x1F 0x00 0x00 0x49 0x1E 0x00 0x00 0x49 0x1C 0x00 0x49 0x1B 0x00 0xD0 0x20 0x00 0x00 0x00 0x00 0x49 0x41 0x00 0x00 0x40 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x0F 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x4A 0x0B 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x4A 0x0C 0x00 0x00 0x00

    // Raw Payload (with no err set):  0x59 0x04 0x00 0x00 0x00 0x00 0x10 0x28 0xDD 0x00 0x00 0x00 0x00 0x00 0xDD 0x01 0x00 0x00 0x00 0xDD 0x02 0x00 0xDD 0x05 0x00 0xDD 0x06 0x00 0xDD 0x09 0x00 0x49 0x00 0x00 0x00 0x49 0x01 0x00 0x00 0x49 0x02 0x00 0x00 0x49 0x03 0x00 0x00 0x49 0x04 0x00 0x00 0x49 0x05 0x00 0x49 0x06 0x00 0x49 0x07 0x00 0x49 0x08 0x00 0x49 0x10 0x00 0x00 0x49 0x11 0x00 0x00 0x49 0x12 0x00 0x00 0x00 0x00 0x49 0x13 0x00 0x00 0x00 0x00 0x49 0x14 0x00 0x00 0x49 0x15 0x00 0x49 0x16 0x00 0x49 0x17 0x00 0x49 0x18 0x00 0x49 0x19 0x00 0x49 0x0A 0x00 0x49 0x0B 0x00 0x00 0x49 0x0C 0x00 0x00 0x49 0x0D 0x00 0x00 0x49 0x0E 0x00 0x00 0x49 0x0F 0x00 0x00 0x49 0x1A 0x00 0xD7 0x03 0x00 0x00 0x49 0x21 0x00 0x00 0x49 0x1F 0x00 0x00 0x49 0x1E 0x00 0x00 0x49 0x1C 0x00 0x49 0x1B 0x00 0xD0 0x20 0x00 0x00 0x00 0x00 0x49 0x41 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x4A 0x0B 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x4A 0x0C 0x00 0x00 0x00 0x11 0x28 0xDD 0x00 0x00 0x00 0x00 0x00 0xDD 0x01 0x00 0x00 0x00 0xDD 0x02 0x00 0xDD 0x05 0x00 0xDD 0x06 0x00 0xDD 0x09 0x00 0x49 0x00 0x00 0x00 0x49 0x01 0x00 0x00 0x49 0x02 0x00 0x00 0x49 0x03 0x00 0x00 0x49 0x04 0x00 0x00 0x49 0x05 0x00 0x49 0x06 0x00 0x49 0x07 0x00 0x49 0x08 0x00 0x49 0x10 0x00 0x00 0x49 0x11 0x00 0x00 0x49 0x12 0x00 0x00 0x00 0x00 0x49 0x13 0x00 0x00 0x00 0x00 0x49 0x14 0x00 0x00 0x49 0x15 0x00 0x49 0x16 0x00 0x49 0x17 0x00 0x49 0x18 0x00 0x49 0x19 0x00 0x49 0x0A 0x00 0x49 0x0B 0x00 0x00 0x49 0x0C 0x00 0x00 0x49 0x0D 0x00 0x00 0x49 0x0E 0x00 0x00 0x49 0x0F 0x00 0x00 0x49 0x1A 0x00 0xD7 0x03 0x00 0x00 0x49 0x21 0x00 0x00 0x49 0x1F 0x00 0x00 0x49 0x1E 0x00 0x00 0x49 0x1C 0x00 0x49 0x1B 0x00 0xD0 0x20 0x00 0x00 0x00 0x00 0x49 0x41 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x4A 0x0B 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x4A 0x0C 0x00 0x00 0x00
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

I am collating the PIDs/error codes from various sources.

Still no wiser about how to enable the contactors :-)

obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

So I've written some rust to clear/read the error codes from the BECM using PC as a controller.

Manage to read some error messages now. But I still expect more. I think the BECM isn't going into the "operational" mode for some reason.

- Error codes are saved between BECM boots.
- Removing either precharge coil (~50R) => logged `P0AE1-14 Hybrid/EV Battery Precharge Contactor Circuit -Circuit short to ground or open`
- Replaying the car turning on (minus 0x7e4, 0x7ec) => no error
- Undervolting(~8V)/overvolting(~16V) module => no error
- Connecting ENS_IN to 12V, 20V, 0V, open => no error
- Badly formatted CAN UDS message (e.g sending unpadded message `cansend can0 7e4#0322f197, cansend can0 7e4#031902ff`) => no error
- Changing CAN rate to 1MHz, sending message `sudo ip link set can0 down; sudo ip link set can0 up type can bitrate 1000000; cansend can0 7e4#0322f197` => BECM hangs & `U3001-00 Control module improper shutdown` logged (Google says: `U3001-00 is an OBD diagnostic trouble code indicating a manufacturer-specific fault with the vehicle user network`)
- Changing CAN rate & removing precharge coil resistor results in two logged errors: `P0AE1-14 & U3001-00`
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

OK rescanning the uds services with caringcaribou now shows additional two services. I read it wrong before.

Code: Select all

caringcaribou uds services 0x7e4 0x7ec
Probing service 0xff (255/255): found 10

Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL
Supported service 0x11: ECU_RESET
Supported service 0x14: CLEAR_DIAGNOSTIC_INFORMATION
Supported service 0x19: READ_DTC_INFORMATION
Supported service 0x22: READ_DATA_BY_IDENTIFIER
Supported service 0x27: SECURITY_ACCESS
Supported service 0x2f: INPUT_OUTPUT_CONTROL_BY_IDENTIFIER
Supported service 0x31: ROUTINE_CONTROL
Supported service 0x3e: TESTER_PRESENT
Supported service 0x85: CONTROL_DTC_SETTING
So these are supported...
Supported service 0x27: SECURITY_ACCESS
Supported service 0x2f: INPUT_OUTPUT_CONTROL_BY_IDENTIFIER
Supported service 0x31: ROUTINE_CONTROL

The manual says 0x2020 is a possible "Self test routine" which can be played, but having no luck trying to start it. Maybe it needs security access.
tom91
Posts: 1869
Joined: Fri Mar 01, 2019 9:15 pm
Location: Bristol
Has thanked: 156 times
Been thanked: 400 times

Re: iPace battery BECM hacking...

Post by tom91 »

Do you have a log of a working IPace?
Founder Volt Influx https://www.voltinflux.com/
Webstore: https://citini.com/
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

I've uploaded CAN logs from working iPace (and also the standalone battery) to https://drive.google.com/drive/folders/ ... bO1e_TCcdt
cpeacock
Posts: 1
Joined: Mon Jul 08, 2024 11:40 am

Re: iPace battery BECM hacking...

Post by cpeacock »

Do I assume this is the project?
cjdell
Posts: 1
Joined: Mon Jul 08, 2024 12:19 pm

Re: iPace battery BECM hacking...

Post by cjdell »

Sorry to hijack this thread but are you working with the same people who are behind the recent video by Cory Mac?

DIY Vehicle to Grid (Jaguar 90kWh battery)


If not you should definitely join forces. I'm keenly following this discussion as it appears many others are. I wish you the best of luck!
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

OK, I made some progress on the BECM hacking front.
Running

Code: Select all

caringcaribou uds discovery --autoblacklist 10
Scanning for arbitration IDs to blacklist
results in the following error codes logged:

Code: Select all

P0A0A-13 High voltage interlock loop circuit open circuit    
P0A9B-12 Positive&negative contactor temperature sensor circuit short circuit to power
P0ABF-64    Battery energy control module software is not at latest version    Seems OK to ignore.
P0AE1-14    Hybrid/EV Battery Precharge Contactor Circuit - Circuit short to ground or open    
P0B0E-14    Hybrid/EV Battery Pack Current Sensor "B" Circuit - Circuit short to ground or open    
P0C42-12    Hybrid/EV Battery Pack Coolant Temperature Sensor "A" Circuit - Circuit short to battery    
P0CD5-12    Hybrid/EV Battery Pack Coolant Temperature Sensor "B" Circuit - Circuit short to battery    
P3043-13    Hybrid/EV Battery Cell Supervisory Circuit "A" Circuit open    
P3044-13    Hybrid/EV Battery Cell Supervisory Circuit "B" Circuit open    
P3045-13    Hybrid/EV Battery Cell Supervisory Circuit "C" Circuit open    
P3046-13    Hybrid/EV Battery Cell Supervisory Circuit "D" Circuit open    
P3047-13    Hybrid/EV Battery Cell Supervisory Circuit "E" Circuit open    
P3048-13    Hybrid/EV Battery Cell Supervisory Circuit "F" Circuit open    
U0064-87    Vehicle Communication Bus E - Missing message
P0A1F-93    Main current sensor failure
U3001-00    Control Module Improper Shutdown
So I will try to narrow it down to which CAN message from caringcaribou caused it to go into this "working-ish" mode....
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

@cjdell yeah, that is me in the video (chris) :-)

We're working on Part2 as we speak, perhaps this is a working real-time "dev log" :-)
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

So seems like sending specific UDS data to 0x012 `cansend can0 012#0210010000000000` then I get all of the above errors logged....
pemtek
Posts: 38
Joined: Sun Jan 05, 2020 9:49 pm
Location: United Kingdom, Lancashire
Been thanked: 1 time
Contact:

Re: iPace battery BECM hacking...

Post by pemtek »

Those errors seem like something is unplugged?

I have 2 of those batteries here so I am keen to see how this goes.

Phil
obbardc
Posts: 14
Joined: Sun Jun 23, 2024 1:07 am
Been thanked: 1 time

Re: iPace battery BECM hacking...

Post by obbardc »

Yeah, this is with the BECM connected on the desk (with just canbus & 12V), so lots unplugged. I am trying to reconnect bits one at a time ! :-)
MX5EV
Posts: 8
Joined: Mon Jun 08, 2020 4:52 pm
Location: New Hampshire, USA

Re: iPace battery BECM hacking...

Post by MX5EV »

I just posted in the comments on this video that you should come here or to https://endless-sphere.com/. Hopefully, the battery isn't security locked. If you can read the data from the battery you can safely override the contactors and write your own code to handle when to open or close them.
Post Reply