BMW GENERATION 5 packs (IX3 etc) - opening / reuse / reverse engineering

[Swing]

Hi all,

This might become a general thread for Generation 5 packs used in BMW IX3 and other models since 2021/2022.

I'm opening up a Gen 5 BMW EV pack, a ~80kWh one.
They come in different sizes up to 111kWh, but they all use the same cells. Typically in 2p but I think the 111kWh uses 3p?

Anyway, mine has 8 modules of 9s2p and 2 modules with 11s2p making 94s.

I intent to reuse this, with hopefully not too much effort.
Earlier BMW packs like the Hybrid packs and the i3 were all managed with CSC slave boards on the modules.

These Generation 5 packs don't have slave boards on the modules, as the modules can very too much for that (I think that is the reason)
So the whole wiring loom goes to one place.
But what I have found is that the central managing module is also called CSC, and in fact CSC-6M.
It just seems to be 6 times 16s CSC modules on one PCB. With a very clear CAN bus connection.
What is not clear is how to power it, and if it is 12v or 5v.

But since it seems like 6 CSC modules, I have good hopes that it follows the same CAN bus communication as the BMW plugin hybrid packs (also 16s) and that it is already manageable with SIMPBMS / EVS-BMS or other.

My question is, how do you guys figure out the pinning of all of this?
I have some CAN tools, and I just want to power up the CSC board to see the CAN bus data.
But I am very reluctant to just guess what the power wires are, and possibly destroying 5v stuff with 12v or other kind of malfunctions.

At this point I wasn't able to open up the CSC-6M completely, perhaps later.

[Swing]

For now I just have some rough measurements of the modules.
They are ~11cm high including a liquid cooling plate under it.
They are 31.5cm wide without the flange, which seems to be 2cm on each side.
The 9s block seems about 56.5cm long and the 11s seems 68 to 69cm long. (4 cells more)

CSC 6M module for all the cell voltages and temps

2 Wire interface labeled as COM which must be the CAN bus.

There is a connector from the main PCB to the small CAN board, so 2 of the 4 wires must be for power. 5 volt most likely?

This is the module where the low voltage connector is on the outside of the pack.
This connector comes into the pack and should have 12v and CAN amongst others

The CPC boards on the modules. Same PCB for 9s and 11s, you can count the cell wires. Temp sensors probably on the other side?

[Swing]

So the main question is how you guys always figure out the wiring?
My knowledge is good enough to work on this safely and reuse these kind of modules, but for the wiring it would be great to have some source of info.

[tom91]

Like this pack?

viewtopic.php?t=4763

These packs do not use CAN internally but a protocol unique to the chips used int the BMS.

If you label and disconnect the CSC connectors and open it to take a better pictures of the PCB we can analyse it further.

[Swing]

Ha Daniel also has one, great. I missed that topic for some reason.

Even though the i4 pack is a bit different in the cell setup, the rest is the same.
And so the BMS setup will be the same.

If it is not CAN it is going to be a lot more effort.

Hopefully the temp sensors are the same as in other BMWs so the 16s CMUs can de be used directly

[yasko]

Interesting BMS solution.
I suspect that communication is some variant of the ISO-SPI protocol. It usually uses a two-wire connection, and I see a small PCB in the picture with two wires and an isolation transformer. This link probably goes to the central BMS.

If you can give me the part number of the chip in the CSC, I can probably tell you more about the communication protocol.

[Swing]

I opened the main CMU, it is glued but not to hard to open.

It consists of a single COM port PCB, and two PCBs which read the cells. These two PCBs actually consist out of 3 PCBs onto one PCB.
Everything is connected through with 4 wires. So most likely 2 wires for communication and 5v and GND.

The main chip is Panasonic AN84912UA 12584040, 6 times.

Here is a PDF Datasheet of a comparable one, though it only manages 10 cells instead of 16s.
https://www.datasheets360.com/pdf/954756336527486306

It mentions a 5v and 3.3v VDD.

I think this is different from the NXP and TI solutions I have seen here before for reverse engineered BMS boards that aren't CAN.

[Swing]

[tom91]

that makes it a pain, as it will be Panasonics take on how to do ISO-SPI/ISO-Whatever.

So not directly reusable without reverse engineering it from a signal level.

[Swing]

that makes it a pain, as it will be Panasonics take on how to do ISO-SPI/ISO-Whatever.

So not directly reusable without reverse engineering it from a signal level.

Yes. I think, at this point if I want any quick results, I'm probably better of putting on a different BMS.
But I don't see what kind of temperature sensors are being used.

I have BMW 16s CMU boards from a PHEV pack, so with your BMS I can manage this pack. (94s compared to 96s)
But, I'm not sure on the temperature sensors. If I can just connect the temp sensors to the BMW 16s CMU or add my own.

[EV_Builder]

I will investigate. Maybe I build the BMS and try it.

[Swing]

I will investigate. Maybe I build the BMS and try it.

You must have some info on the protocol, or have some of the hardware to investigate it?

Anyway, it might be more useful to talk to the BMU, the battery pack as a whole.

[yasko]

The main chip is Panasonic AN84912UA 12584040, 6 times.

What a wired BMS solution! I can't find any information about this chip.

Panasonic transferred its semiconductor business to Nuvoton. Now, there are some BMS chips:
https://www.nuvoton.com/products/batter ... qualified/
But these are new-generation chips, and of course, there is now a publicly available datasheet.

I'm sure AN84912UA uses ISO-SPI for communication and probably supports 20S cell configuration.
But it will require serious hacking without documentation.

In this case, being at the BMU level will be easier. I'm interested in seeing what the BMU looks like

[Swing]

In the BMW i4 thread some pictures of the BMU but no detailed pics of the main chip although its likely the main chip from Panasonic

[Swing]

Ok so I opened the BMU. That should give some people some more clues.

I didn't do any power up and checking for communication or anything, just opening and taking pictures.

The BMU is on a liquid cooling plate.

It turns out the main BMU PCB has an Infineon tricore mictrocontroller on there. I guess that is not a very specific chip to deduct anything.
At this point it is probably more useful to try and power it up and figure out where the can bus is.

These 4 blocks are probably contactors...
The BMU seems to have a lot of high voltage connections, I think it has seperate charge point and drive point take of on it.

The bottom is also a PCB with major power lines on it.
I am assuming there are only measurement functions on there but haven't checked properly.
As can been seen, this part is liquid cooled

This is the main PCB where the only recognizable chip is the Infineon Tricore mcu

[Swing]

Here the full Infineon microcontroller part number

https://www.infineon.com/cms/en/product ... 4f200n-dc/

So, it seems this MCU talks to the Panasonic BMICs to get the cell data.

I think this BMU is pretty complex and specific, and not common enough, to put in a lot of effort to reuse as a whole.
But, if there is an easy way for it to dump the cell values, it could be convenient.

I don't have a proper (usb) scope for that to check the SPI bus, and I don't know where to apply 5v or 12v

[Swing]

I will investigate. Maybe I build the BMS and try it.

In this case, being at the BMU level will be easier. I'm interested in seeing what the BMU looks like

Does the above answer some of your questions?

Probably not, it may require some signal level debugging.
I don't have a (usb protocol) scope for that

[Swing]

By the way, these are the temperature sensors, two per module.
I haven't tried much other than to measure resistance over pins that weren't giving any cell voltage (so they must be sensor related) but I could measure any resistance value over any combination.
So probably something digital or something to apply a voltage over?

[yasko]

I think these sensors are NTC, probably 10k. They are used widely for temperature measurement in batteries.

Regarding Infineon MCU, I've seen the same in Pegout e208 BMU. In that implementation, the BMS gives much information, including cell voltages. More info in this thread: viewtopic.php?t=2675

But I can't guarantee that both BMUs are similar. We must see some CAN traffic. This will require powering the BMU and sniffing the CAN bus.

For communication with Panasonic BMICs, there should be some transceiver chip on the board. Usually, the MCU talks to it over SPI, and then this chip translates the signals.

[Swing]

Ok thats great.
It sure would be nice to have the pinout, although it probably just requires some trying to apply 12v and what not. I don't really have a clue to start on, it will just be trying.
Hopefully I can identify the CAN wires as they are often twisted.

But yeah, I'm sure there is a pretty big chance once you know the wires, you will get some useful data on the CAN bus without sending anything.

[Swing]

I'm struggling with the pinout. The CAN bus was very quickly found, a twisted wire and measuring 120 Ohm.
There are enough indications of what 12v+ is, the ground perhaps also, but probably needs a wakeup / key on kind of extra signal.

I'll post some pics later

[tom91]

You need to reverse engineer the power supply on the board, look for big caps, diodes and chips with big heat sink or on big pads. then look at datasheets.

[Swing]

You need to reverse engineer the power supply on the board, look for big caps, diodes and chips with big heat sink or on big pads. then look at datasheets.

Well, these are the times I notice I am a software engineer

But it seems that the positive and negative are not that hard.
This is the PCB of the low voltage connector on the front of the pack.
Below is the connector outside the pack.
There is a copper part sticking out that had connection to the battery pack casing, but it is not connected (directly) to one of the pins. So it doesn't seem to be 12v ground.

Anyway, there is a bigger component that is connected to two groups of 3 pins each. That clearly seems to be 12v positive and negative.
The pins are combined on this PCB.

On the main BMU PCB they are not combined, there they have seperate paths.

Here, on the main BMU PCB, you can see the 3 wires coming on on the top left (now on the white connector). No longer combined, but on the other PCB they are.
These 3 wires on the top left are colors RED, BLACK+RED and BLACK+BLUE.
The other wires are all a variant of BROWN, which is a common color with BMW for ground.
So that seems to make sense.

I am not at the battery pack anymore, but it seems I should have probably connected at least 3 pins to 12v+ and 3 pins to 12v ground.
I had 5 at most. So that might explain something.

But, I probably will still need to apply 12v to some other pin as well for an ON signal.

[nedim]

If you need pinout I can give you, now I am repairing one battery from ix3.

Cheers

[cloudy]

I'm also working on Gen5 packs - have started some documentation on the dala wiki:
https://github.com/dalathegreat/Battery ... 7-Platform

I also have a battery emulator feature branch that has basic support already. https://github.com/dalathegreat/Battery ... ix-support. Currently don't have contactors, balancing or iso measure working (I also need to crash reset my SME) but the rest works. Is anyone able to get some logs from an IX/iX3/i4/i7 on the canFD bus between SME/EME/CCU/BDC?

Thanks!