Peugeot E-208/Corsa E CATL BMS CAN decoding
Peugeot E-208/Corsa E CATL BMS CAN decoding
Hi All,
Fo my project I purchased a complete pack from a e208 that i got for a reasonable price from a breakers. However upon delivery one of the vents on the pack was damaged and the smell that was released was very akin to the smell of dead lipos, so I really wanted a way to be able to measure the cell voltages without opening the pack! Unfortunatly I didnt have any wiring diagrams for the car so I have had to crack it open anyway and turns out the dead lipo smell is actually a result of the comformal coating they use on the BMS board and slaves, so all is good (all cells 3.6V)
Anyway, now I have it open i have worked out the external connections and by applying power (wake and permanant) the BMS will send out all the cell voltages over CAN. Potentially if its possible to get access to a actual vehicle this BMS could be used as is in projects.
At the moment I have only opened the front of the pack, so have not worked out all the internal wiring. No CAN messages need to be sent to the BMS to get data and the BMS already has 120Ohm termination inside.
I have only started decoding, some of my findings:
Voltages decoded for all cells, but i dont yet know which cell is in which module! Only the lowest module is known as its accesible!.
Temps seem to be in 6d1 -> 6e6, but have not worked out scaling.
Other observations:
CAN FRAMES:
0x125
on power up
67 40 00 c4 62 58 20 00
on removing the HV measure CON (which has pack voltage on)
67 40 00 00 62 58 20 00
Charging the lowest module with 5Amps through the current shunt
67 40 01 c4 62 55 20 00
back to zero A
67 40 00 c4 62 58 20 00
pink wire
0x31b
floating
21 0a
gnd
22 12
CAN DBC file is here :https://github.com/Pilt2013/e208-CATL-BMS
PINOUT of main external connector:
White -> Pin 1 -> CAN H
Yellow -> Pin 2 -> CAN L
Brown -> Pin 4 -> Input??
Green -> Pin 5 -> BMS Wake
White -> Pin 7 -> BMS Permenant
Yellow -> Pin 10 -> Into battery pack....
Pink -> Pin 11 -> Input
Red -> Pin 12 -> Interlock Loop -> Goes to front HV connector
Green -> Pin 14 -> BMS GND
I will add a full trace later
Anyone have access to the wiring diagram for this car?
Fo my project I purchased a complete pack from a e208 that i got for a reasonable price from a breakers. However upon delivery one of the vents on the pack was damaged and the smell that was released was very akin to the smell of dead lipos, so I really wanted a way to be able to measure the cell voltages without opening the pack! Unfortunatly I didnt have any wiring diagrams for the car so I have had to crack it open anyway and turns out the dead lipo smell is actually a result of the comformal coating they use on the BMS board and slaves, so all is good (all cells 3.6V)
Anyway, now I have it open i have worked out the external connections and by applying power (wake and permanant) the BMS will send out all the cell voltages over CAN. Potentially if its possible to get access to a actual vehicle this BMS could be used as is in projects.
At the moment I have only opened the front of the pack, so have not worked out all the internal wiring. No CAN messages need to be sent to the BMS to get data and the BMS already has 120Ohm termination inside.
I have only started decoding, some of my findings:
Voltages decoded for all cells, but i dont yet know which cell is in which module! Only the lowest module is known as its accesible!.
Temps seem to be in 6d1 -> 6e6, but have not worked out scaling.
Other observations:
CAN FRAMES:
0x125
on power up
67 40 00 c4 62 58 20 00
on removing the HV measure CON (which has pack voltage on)
67 40 00 00 62 58 20 00
Charging the lowest module with 5Amps through the current shunt
67 40 01 c4 62 55 20 00
back to zero A
67 40 00 c4 62 58 20 00
pink wire
0x31b
floating
21 0a
gnd
22 12
CAN DBC file is here :https://github.com/Pilt2013/e208-CATL-BMS
PINOUT of main external connector:
White -> Pin 1 -> CAN H
Yellow -> Pin 2 -> CAN L
Brown -> Pin 4 -> Input??
Green -> Pin 5 -> BMS Wake
White -> Pin 7 -> BMS Permenant
Yellow -> Pin 10 -> Into battery pack....
Pink -> Pin 11 -> Input
Red -> Pin 12 -> Interlock Loop -> Goes to front HV connector
Green -> Pin 14 -> BMS GND
I will add a full trace later
Anyone have access to the wiring diagram for this car?
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Hi!
Nice work here!
Do you have any progress since your last post?
Thanks,
Andrei
Nice work here!
Do you have any progress since your last post?
Thanks,
Andrei
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Hi. have same batt pack. will try to communicate and will update here the pinout and etc.
-
- Posts: 527
- Joined: Thu Jul 04, 2019 6:35 pm
- Location: Somerset, UK
- Has thanked: 61 times
- Been thanked: 164 times
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
I have been playing with this in the last few days. Got a working zombie module to read the cell voltages, unfortunately it's not that practical as it uses most of the available can filters in Zombie so you are not left with much left over to run anything else. Let alone the cell temperatures.
Attached is a canlog of a the BMS master, just with 12v and wake enabled.
Module temperatures I believe are the following IDs. I think the temperatures might be in fahrenheit, one byte per value. Not sure on that though. Seems odd for a BMS from a European manufacturer to use farenheit.
0x6D1
0x6D2
0x6E0
0x6E3
0x6E4
0x6E5
0x6E6
Other IDS apart from voltage, temperatures and what has been details in the first post are as follows. Also included are typical values seen in the log. Most of these do not change for the duration of the log.
0x127
0x129 00 00 00 00 00 00 00 00
0x358 41 40 00 15 47 01 4B 45
0x359 E6 50 BD 18 57 00 00 BF
0x361 00 00 00 01 1D 71 00 00
0x362 no data
0x454 0B C3 2B B7 40 00 14 A0
0x494 0A 60 6A 07 40 0F 80 00
0x594 50 A0 00 C8 00 0F FE 00
0x6D0 FE EA 60 00 0F FE 6C 36
0x794 C8 00 00 00 00 00 00 00
Attached is a canlog of a the BMS master, just with 12v and wake enabled.
Module temperatures I believe are the following IDs. I think the temperatures might be in fahrenheit, one byte per value. Not sure on that though. Seems odd for a BMS from a European manufacturer to use farenheit.
0x6D1
0x6D2
0x6E0
0x6E3
0x6E4
0x6E5
0x6E6
Other IDS apart from voltage, temperatures and what has been details in the first post are as follows. Also included are typical values seen in the log. Most of these do not change for the duration of the log.
0x127
0x129 00 00 00 00 00 00 00 00
0x358 41 40 00 15 47 01 4B 45
0x359 E6 50 BD 18 57 00 00 BF
0x361 00 00 00 01 1D 71 00 00
0x362 no data
0x454 0B C3 2B B7 40 00 14 A0
0x494 0A 60 6A 07 40 0F 80 00
0x594 50 A0 00 C8 00 0F FE 00
0x6D0 FE EA 60 00 0F FE 6C 36
0x794 C8 00 00 00 00 00 00 00
-
- Posts: 527
- Joined: Thu Jul 04, 2019 6:35 pm
- Location: Somerset, UK
- Has thanked: 61 times
- Been thanked: 164 times
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Upon further research on other threads it seems these modules have three thermistors per module. Which match up perfectly with the data from the Can IDs, since 06E0 only uses 6 bytes rather than all 8.
Looks like one byte per temperature reading. No idea which module is which but it's good enough to get a min and max value. I'm thinking it is possibly offset by 50. My log is showing vales around 69-75, which would translate to 19C-25C. The pack was sitting in the sun all morning on a 26C day so its feasible.
Looks like one byte per temperature reading. No idea which module is which but it's good enough to get a min and max value. I'm thinking it is possibly offset by 50. My log is showing vales around 69-75, which would translate to 19C-25C. The pack was sitting in the sun all morning on a 26C day so its feasible.
- uhi22
- Posts: 945
- Joined: Mon Mar 14, 2022 3:20 pm
- Location: Ingolstadt/Germany
- Has thanked: 139 times
- Been thanked: 532 times
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Usual european temperature scalings, to pack a temperature into a byte, are
* offset -50°C, resolution 1K
* offset -40°C, resolution 1K
* offset -40°C, resolution 0.5K
Maybe one of these fit.
* offset -50°C, resolution 1K
* offset -40°C, resolution 1K
* offset -40°C, resolution 0.5K
Maybe one of these fit.
Github: http://github.com/uhi22 --- Patreon: https://www.patreon.com/uhi22
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Hi
I have corsa-e battery on bench and also have e-C4 available for can logs,
So far I can confirm that cell voltages are on showing in mV all 108 cells
6D3
6D4
6E1
6E2
6E7 - 6FF
then 54 temperature readings (offset -40C)
6D1
6D2
6E0
6E3 - 6E6
Some logs and DBC file can be found here.
https://drive.google.com/drive/folders/ ... drive_link
I'll keep updating my findings
I have corsa-e battery on bench and also have e-C4 available for can logs,
So far I can confirm that cell voltages are on showing in mV all 108 cells
6D3
6D4
6E1
6E2
6E7 - 6FF
then 54 temperature readings (offset -40C)
6D1
6D2
6E0
6E3 - 6E6
Some logs and DBC file can be found here.
https://drive.google.com/drive/folders/ ... drive_link
I'll keep updating my findings
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Awesomeopelmanta wrote: ↑Mon Sep 16, 2024 9:04 am Some logs and DBC file can be found here.
https://drive.google.com/drive/folders/ ... drive_link
I'll keep updating my findings
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Hi, Would you mind putting up a picture for the pinout of the BMC connections (12v, HVIL, CAN, ect.)? I just got a Peugeot e-partner battery and the BMC looks identical with the same layout and connectors, I am just now starting to figure the pinout so I can start sniffing the CAN connection. Would be much appreciated.
Thank you for the work so far!
Thank you for the work so far!
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
All pictures are available at the google drive resources provided by opelmantra.
-
- Posts: 527
- Joined: Thu Jul 04, 2019 6:35 pm
- Location: Somerset, UK
- Has thanked: 61 times
- Been thanked: 164 times
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
I've been working on the current sensing and SoC messages this weekend. I'm planning to use it bare bones on my new tractor battery, just have it spitting out voltages, temperatures and ideally current so I can replace the Isa shunt since it seems a shame to not use this one.
ID 0x125
SoC: byte 0, 0.4 scale. That one was quite easy.
Then for current there are two messages:
Load A: byte 2, scale 1
Load: byte 5 scale 1
At first with some of the logs from opelmanta I just ignored Load and got some sensible current readings from Load A. But that only makes sense with low level charging. When running driving logs or fast charging the two values change depending on the load and also charging/discharging.
Here are some spot value examples
No charging or discharging
Load A:0
Load:88
Charging:
Load A: 5
Load: 82
Load A:4
Load: 83
Fast charging 49kw:
Load A: 97
Load: 225
Driving
Load A: 27
Load: 121
Load A: 30
Load: 134
Subtracting 88 from Load when it is over 88 generates some sensible results. As does subtracting the value of Load from 88 when it is under. I can't quite find the pattern to recognise discharging from charging current. Nor the relation between Load A and Load. Load A makes sense for lower amps draws but seems a bit off during higher amps draws like the 49kW fast charging log.
Quite possibly some other bytes might also contribute to current data.
ID 0x125
SoC: byte 0, 0.4 scale. That one was quite easy.
Then for current there are two messages:
Load A: byte 2, scale 1
Load: byte 5 scale 1
At first with some of the logs from opelmanta I just ignored Load and got some sensible current readings from Load A. But that only makes sense with low level charging. When running driving logs or fast charging the two values change depending on the load and also charging/discharging.
Here are some spot value examples
No charging or discharging
Load A:0
Load:88
Charging:
Load A: 5
Load: 82
Load A:4
Load: 83
Fast charging 49kw:
Load A: 97
Load: 225
Driving
Load A: 27
Load: 121
Load A: 30
Load: 134
Subtracting 88 from Load when it is over 88 generates some sensible results. As does subtracting the value of Load from 88 when it is under. I can't quite find the pattern to recognise discharging from charging current. Nor the relation between Load A and Load. Load A makes sense for lower amps draws but seems a bit off during higher amps draws like the 49kW fast charging log.
Quite possibly some other bytes might also contribute to current data.
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Got digging around myself for and found that indeed the pinout was right.
Can also report probably that pin-11 is HVIL out (after AUX HV plug and front HV plug 10.6V) and pin-12 is HVIL return (330ohm to ground) 0x31B byte 0 and 1 change when HVIL is connected/disconnected.
Furthermore e-partner battery has one extra CAN on pin-3 (can-H) and pin-4 (CAN-L) that is probably for RX only as it is silent.
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Did play a little with your canbus data:opelmanta wrote: ↑Mon Sep 16, 2024 9:04 am
Some logs and DBC file can be found here.
https://drive.google.com/drive/folders/ ... drive_link
I'll keep updating my findings
0x010: is not present in the disconnected battery log
0xF0 and 0xF2: are not present in the disconnected battery log
also there are some changes going on with 0x010 during transition in ignition on/off logs
-
- Posts: 3
- Joined: Mon Nov 04, 2024 8:58 pm
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
hi there
ive also just brought the same pack... as per the thread ive got it spiting out can codes and can work out soc, voltages,temps etc but would like to know (if it is in fact known) the balancing of pack whever its auto or a can instruction and can code to close /open the contactors?
it will be for a home storage project coupled with a solax inverter
thanks
ive also just brought the same pack... as per the thread ive got it spiting out can codes and can work out soc, voltages,temps etc but would like to know (if it is in fact known) the balancing of pack whever its auto or a can instruction and can code to close /open the contactors?
it will be for a home storage project coupled with a solax inverter
thanks
-
- Posts: 527
- Joined: Thu Jul 04, 2019 6:35 pm
- Location: Somerset, UK
- Has thanked: 61 times
- Been thanked: 164 times
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Opelmanta has posted a ton of logs above. One of those has an on/off cycle I believe. So it should be possible to work out contactor operation from there. Along with a fair bit of experimentation.stuart1977 wrote: ↑Wed Nov 06, 2024 9:46 pm hi there
ive also just brought the same pack... as per the thread ive got it spiting out can codes and can work out soc, voltages,temps etc but would like to know (if it is in fact known) the balancing of pack whever its auto or a can instruction and can code to close /open the contactors?
it will be for a home storage project coupled with a solax inverter
thanks
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Having a whole pack you can easily try to replay canbus from ignition on dump provided by opelmantra - working out later what commands are critical for this.stuart1977 wrote: ↑Wed Nov 06, 2024 9:46 pm ive also just brought the same pack... as per the thread ive got it spiting out can codes and can work out soc, voltages,temps etc but would like to know (if it is in fact known) the balancing of pack whever its auto or a can instruction and can code to close /open the contactors?
-
- Posts: 3
- Joined: Mon Nov 04, 2024 8:58 pm
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
how would you go about replaying that can data?
ive got a candlelight usb apator and currently using cangaroo.
ta
ive got a candlelight usb apator and currently using cangaroo.
ta
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
I use socketcan devices on Linux + SavvyCAN for that
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Did that on my Peugeot e-partner HV battery can bus, no reaction, it looks like all the CAN bus ids that the battery sends are the same as the C4.
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
You need to make sure or HVIL and other hardware related signals are satisfied - would be good to check those on the car.
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
I think I did HVIL, just a jumper resistor of a few oms on all of the HV connectors HVIL and the HVIL in and out pin of the plug. I dont have a car, so its only guessing on my part what other signals might be.
-
- Posts: 3
- Joined: Mon Nov 04, 2024 8:58 pm
Re: Peugeot E-208/Corsa E CATL BMS CAN decoding
Gave up on deciphering the CANbus to get the relays working, reverse engineered the Relay Control Board instead, made a prototype to control them via the LilyGo board. the voltages, temperatures, and the SOC, LOAD can be read out via CANbus and the ESP32 can act as the brains controlling the relays, should be good. Going to test it out soon.https://github.com/Sjenja87/PSA_BAT_BMS ... 5089_n.jpg