Peugeot E-208/Corsa E CATL BMS CAN decoding

[pilt]

Hi All,

Fo my project I purchased a complete pack from a e208 that i got for a reasonable price from a breakers. However upon delivery one of the vents on the pack was damaged and the smell that was released was very akin to the smell of dead lipos, so I really wanted a way to be able to measure the cell voltages without opening the pack! Unfortunatly I didnt have any wiring diagrams for the car so I have had to crack it open anyway and turns out the dead lipo smell is actually a result of the comformal coating they use on the BMS board and slaves, so all is good (all cells 3.6V)

Anyway, now I have it open i have worked out the external connections and by applying power (wake and permanant) the BMS will send out all the cell voltages over CAN. Potentially if its possible to get access to a actual vehicle this BMS could be used as is in projects.

At the moment I have only opened the front of the pack, so have not worked out all the internal wiring. No CAN messages need to be sent to the BMS to get data and the BMS already has 120Ohm termination inside.

I have only started decoding, some of my findings:

Voltages decoded for all cells, but i dont yet know which cell is in which module! Only the lowest module is known as its accesible!.

Temps seem to be in 6d1 -> 6e6, but have not worked out scaling.

Other observations:

CAN FRAMES:
0x125

on power up

67 40 00 c4 62 58 20 00

on removing the HV measure CON (which has pack voltage on)

67 40 00 00 62 58 20 00

Charging the lowest module with 5Amps through the current shunt

67 40 01 c4 62 55 20 00

back to zero A

67 40 00 c4 62 58 20 00

pink wire
0x31b
floating
21 0a
gnd
22 12

CAN DBC file is here :https://github.com/Pilt2013/e208-CATL-BMS

PINOUT of main external connector:

White -> Pin 1 -> CAN H
Yellow -> Pin 2 -> CAN L
Brown -> Pin 4 -> Input??
Green -> Pin 5 -> BMS Wake
White -> Pin 7 -> BMS Permenant
Yellow -> Pin 10 -> Into battery pack....
Pink -> Pin 11 -> Input
Red -> Pin 12 -> Interlock Loop -> Goes to front HV connector
Green -> Pin 14 -> BMS GND

I will add a full trace later

Anyone have access to the wiring diagram for this car?

[Drw91]

Hi!
Nice work here!
Do you have any progress since your last post?

Thanks,
Andrei

[geduxaz]

Hi. have same batt pack. will try to communicate and will update here the pinout and etc.

[LRBen]

I have been playing with this in the last few days. Got a working zombie module to read the cell voltages, unfortunately it's not that practical as it uses most of the available can filters in Zombie so you are not left with much left over to run anything else. Let alone the cell temperatures.

Attached is a canlog of a the BMS master, just with 12v and wake enabled.

Module temperatures I believe are the following IDs. I think the temperatures might be in fahrenheit, one byte per value. Not sure on that though. Seems odd for a BMS from a European manufacturer to use farenheit.
0x6D1
0x6D2
0x6E0
0x6E3
0x6E4
0x6E5
0x6E6

Other IDS apart from voltage, temperatures and what has been details in the first post are as follows. Also included are typical values seen in the log. Most of these do not change for the duration of the log.
0x127
0x129 00 00 00 00 00 00 00 00
0x358 41 40 00 15 47 01 4B 45
0x359 E6 50 BD 18 57 00 00 BF
0x361 00 00 00 01 1D 71 00 00
0x362 no data
0x454 0B C3 2B B7 40 00 14 A0
0x494 0A 60 6A 07 40 0F 80 00
0x594 50 A0 00 C8 00 0F FE 00
0x6D0 FE EA 60 00 0F FE 6C 36
0x794 C8 00 00 00 00 00 00 00

[LRBen]

Upon further research on other threads it seems these modules have three thermistors per module. Which match up perfectly with the data from the Can IDs, since 06E0 only uses 6 bytes rather than all 8.
Looks like one byte per temperature reading. No idea which module is which but it's good enough to get a min and max value. I'm thinking it is possibly offset by 50. My log is showing vales around 69-75, which would translate to 19C-25C. The pack was sitting in the sun all morning on a 26C day so its feasible.

[uhi22]

Usual european temperature scalings, to pack a temperature into a byte, are
* offset -50°C, resolution 1K
* offset -40°C, resolution 1K
* offset -40°C, resolution 0.5K
Maybe one of these fit.

[martii]

Hi. have same batt pack. will try to communicate and will update here the pinout and etc.

How it's going I'm considering buying one

[opelmanta]

Hi

I have corsa-e battery on bench and also have e-C4 available for can logs,

So far I can confirm that cell voltages are on showing in mV all 108 cells
6D3
6D4
6E1
6E2
6E7 - 6FF

then 54 temperature readings (offset -40C)
6D1
6D2
6E0
6E3 - 6E6

Some logs and DBC file can be found here.
https://drive.google.com/drive/folders/ ... drive_link

I'll keep updating my findings

[martii]

Some logs and DBC file can be found here.
https://drive.google.com/drive/folders/ ... drive_link

I'll keep updating my findings

Awesome

[Yevhen]

Hi, Would you mind putting up a picture for the pinout of the BMC connections (12v, HVIL, CAN, ect.)? I just got a Peugeot e-partner battery and the BMC looks identical with the same layout and connectors, I am just now starting to figure the pinout so I can start sniffing the CAN connection. Would be much appreciated.

Thank you for the work so far!

[martii]

Hi, Would you mind putting up a picture for the pinout of the BMC connections (12v, HVIL, CAN, ect.)? I just got a Peugeot e-partner battery and the BMC

All pictures are available at the google drive resources provided by opelmantra.

[LRBen]

I've been working on the current sensing and SoC messages this weekend. I'm planning to use it bare bones on my new tractor battery, just have it spitting out voltages, temperatures and ideally current so I can replace the Isa shunt since it seems a shame to not use this one.

ID 0x125

SoC: byte 0, 0.4 scale. That one was quite easy.

Then for current there are two messages:
Load A: byte 2, scale 1
Load: byte 5 scale 1

At first with some of the logs from opelmanta I just ignored Load and got some sensible current readings from Load A. But that only makes sense with low level charging. When running driving logs or fast charging the two values change depending on the load and also charging/discharging.

Here are some spot value examples

No charging or discharging
Load A:0
Load:88

Charging:
Load A: 5
Load: 82

Load A:4
Load: 83

Fast charging 49kw:
Load A: 97
Load: 225

Driving
Load A: 27
Load: 121

Load A: 30
Load: 134

Subtracting 88 from Load when it is over 88 generates some sensible results. As does subtracting the value of Load from 88 when it is under. I can't quite find the pattern to recognise discharging from charging current. Nor the relation between Load A and Load. Load A makes sense for lower amps draws but seems a bit off during higher amps draws like the 49kW fast charging log.

Quite possibly some other bytes might also contribute to current data.

[Yevhen]

All pictures are available at the google drive resources provided by opelmantra.

Got digging around myself for and found that indeed the pinout was right.


Can also report probably that pin-11 is HVIL out (after AUX HV plug and front HV plug 10.6V) and pin-12 is HVIL return (330ohm to ground) 0x31B byte 0 and 1 change when HVIL is connected/disconnected.

Furthermore e-partner battery has one extra CAN on pin-3 (can-H) and pin-4 (CAN-L) that is probably for RX only as it is silent.

[martii]

Some logs and DBC file can be found here.
https://drive.google.com/drive/folders/ ... drive_link

I'll keep updating my findings

Did play a little with your canbus data:

0x010: is not present in the disconnected battery log
0xF0 and 0xF2: are not present in the disconnected battery log

also there are some changes going on with 0x010 during transition in ignition on/off logs

[stuart1977]

hi there

ive also just brought the same pack... as per the thread ive got it spiting out can codes and can work out soc, voltages,temps etc but would like to know (if it is in fact known) the balancing of pack whever its auto or a can instruction and can code to close /open the contactors?

it will be for a home storage project coupled with a solax inverter

thanks

[LRBen]

hi there

ive also just brought the same pack... as per the thread ive got it spiting out can codes and can work out soc, voltages,temps etc but would like to know (if it is in fact known) the balancing of pack whever its auto or a can instruction and can code to close /open the contactors?

it will be for a home storage project coupled with a solax inverter

thanks

Opelmanta has posted a ton of logs above. One of those has an on/off cycle I believe. So it should be possible to work out contactor operation from there. Along with a fair bit of experimentation.

[martii]

ive also just brought the same pack... as per the thread ive got it spiting out can codes and can work out soc, voltages,temps etc but would like to know (if it is in fact known) the balancing of pack whever its auto or a can instruction and can code to close /open the contactors?

Having a whole pack you can easily try to replay canbus from ignition on dump provided by opelmantra - working out later what commands are critical for this.

[stuart1977]

how would you go about replaying that can data?

ive got a candlelight usb apator and currently using cangaroo.

ta

[martii]

how would you go about replaying that can data?

I use socketcan devices on Linux + SavvyCAN for that

[Yevhen]

Having a whole pack you can easily try to replay canbus from ignition on dump provided by opelmantra - working out later what commands are critical for this.

Did that on my Peugeot e-partner HV battery can bus, no reaction, it looks like all the CAN bus ids that the battery sends are the same as the C4.

[martii]

Did that on my Peugeot e-partner HV battery can bus, no reaction, it looks like all the CAN bus ids that the battery sends are the same as the C4.

You need to make sure or HVIL and other hardware related signals are satisfied - would be good to check those on the car.

[Yevhen]

You need to make sure or HVIL and other hardware related signals are satisfied - would be good to check those on the car.

I think I did HVIL, just a jumper resistor of a few oms on all of the HV connectors HVIL and the HVIL in and out pin of the plug. I dont have a car, so its only guessing on my part what other signals might be.

[stuart1977]

just some bits ive drawn up may help

[Yevhen]

Gave up on deciphering the CANbus to get the relays working, reverse engineered the Relay Control Board instead, made a prototype to control them via the LilyGo board. the voltages, temperatures, and the SOC, LOAD can be read out via CANbus and the ESP32 can act as the brains controlling the relays, should be good. Going to test it out soon.https://github.com/Sjenja87/PSA_BAT_BMS ... 5089_n.jpg

[LRBen]

Gave up on deciphering the CANbus to get the relays working, reverse engineered the Relay Control Board instead, made a prototype to control them via the LilyGo board. the voltages, temperatures, and the SOC, LOAD can be read out via CANbus and the ESP32 can act as the brains controlling the relays, should be good. Going to test it out soon.https://github.com/Sjenja87/PSA_BAT_BMS ... 5089_n.jpg

Would you be able to share your code to read the load via canbus? I could never figure out the correct calculation.