can we replicate BTH data gs450h/prius?... Unlocking the PHEV

[lastphaseofthis]

Abstract: The goal of this project is pretty clear, keeping the hybrid a hybrid, but swapping to bigger higher voltage batteries. 3 outcomes become possible:
1. upgrading existing toyota/lexus hybrids from NIMH to lithium and increasing the usage of the electric system for high MPG in mixed use mode.
2. enabling 30 to 50 miles( or more depending on the battery installed) of pure electric driving.
3. swap the hybrid motor and trans into other chassis, and keeping the hybrid system functional( this is the one i am most concerned with)

We know that the protocol is CSI and we can use a denso chip to communicate

if no one has the ability to setup logic sniffer on the bth line, i would like to know which logic sniffer will work best for this?
green x that Damien has seem to be the minimum?> but i only need 1 channel..

I have an stm bluebill, and a Arduino Due on the way... also i have a zombie inverter i purchased a month ago. my test bests are 07 Prius and 07 gs450h ( have both full cars, gs450h down for headgasket/studs. )

i have images of wiring diagrams but cant seem to upload yet. probably too fresh of a member

i plan to put the whole v6 and gs450h trans.... into my..... RV with a 116kwh lithium. we currently live in it on a 48v 15kwh battery and 3kw of solar on the rv and 3kw array on land next to it.
i could use 120 cells of lifepo4 6 cells per block would be 22v, so a step down or voltage clamp to bring the block voltages down to 18.5, and i may try this method on the prius... but this will keep the dc to dc and limit the electrical output to 30kw,,, from what i have read... will still be ok for increasing the overall MPG but doesnt allow for full electric travel....
the blue pill spitting data to the Hybrid CPU would possiblely over come these if the dc to dc converter is also by passed, but i dont think the toyota logic will like that? but it seems to work with zombie vcu that way?
Thoughts?
after I can upload imagines will make a separate thread.

[tom91]

So all you want to do is keep EV mode and replace the NMIH cells and corresponding monitoring circuit with Lithium cells and circuits to tell the Hybrid controller what to do?

Or are you proposing something else? As this will lock you into all the Lexus limits of the EV mode ect. Only difference being you have a stronger and larger battery to draw power from.

I would say the challenge then becomes keeping the Lexus ECU and Hybrid controller happy enough outside a Lexus GS450h

[lastphaseofthis]

So all you want to do is keep EV mode and replace the NMIH cells and corresponding monitoring circuit with Lithium cells and circuits to tell the Hybrid controller what to do?

Or are you proposing something else? As this will lock you into all the Lexus limits of the EV mode ect. Only difference being you have a stronger and larger battery to draw power from.

I would say the challenge then becomes keeping the Lexus ECU and Hybrid controller happy enough outside a Lexus GS450h

that would suffice as a bare minimum giving us higher mpg until the battery depletes...
what i am hoping for is that within the data on bth there is information that will enable the highest kw possible, around 30kw. id like to use around 50kw max from the 116kwh lifepo4.
i could do this with 20 voltage dividers taking 22v down to 18.5v and that is the current path to victory... but skipping the deviders and having a logic board reading my battery then sending data on bth to the lexus ecu so that its happy.

in theory the zombie inverter with cuustom firmware would work, as it can talk csi

[tom91]

data on bth

Literally what I said, replace the BMS (Battery Voltage Sensor is what Lexus call it) and spoof the BTH comms. You would need to figure out what sort of serial they are, it seems to be a one way datastream as there is only one pair. Best to scope it to see if it looks like MTH or HTM.

Getting more power might not be possible due to firmware limits in the Hybrid Controller or Limits in the Inverter. Where do you get the 50kW from or idea it would be possible?

[lastphaseofthis]

50kw is just the desire. i guess the thought was if there was someway of running the toyota ecu without the buck converter. you have to by pass it for the zombie, but the zombie still talks to the regular firmware from toyota inside the hybird controller. so thats why i think by passing the dc dc to unlock more then 30kw is possible
the heart of my question is this

if no one has the ability to setup logic sniffer on the bth line, i would like to know which logic sniffer will work best for this?
green x that Damien has seem to be the minimum?> but i only need 1 channel..

and i'll add can the zombie inverter be used as a sniffer? is there a way to see the data coming in on the lines? i could just wire mth pair to the bth pair and read it> or maybe just get the ciricut going from the original snifffing thread.

[tom91]

but the zombie still talks to the regular firmware from toyota inside the hybird controller

No. It talks direct to the inverter. That is the key bit of info you are missing.

[lastphaseofthis]

ah ha! that is what i am missing so behind the 30kw dc dc it will have to be.

Hi, this may give some insight
operating a factory Gs450h, with 98 Lipo4, switched parallel to the Nimh 288v, judicially when voltages are acceptably matched.
The Boost converter limits the available power to 37kw.
This is a bit low for some driving circumstances , maybe 5%. . Stratagem was to avoid percieved problems like steep hill starts, etc.
Have operated in this mode for many months as a test program, when gathering some idea if how it all works, and it worked well for me. Have some ideas to increase the usability, on the project list..much to learn..
For simplicity follow the advice above.

i found this with some more digging around and seems like a back up idea if i cant get voltage converters i have coming to play nicely...

[Corvairius]

3. swap the hybrid motor and trans into other chassis, and keeping the hybrid system functional( this is the one i am most concerned with

I can confirm this part is reasonably doable. You will need complete harness, computers, and main accessories such as the brake booster with its stroke sensor. I successfully swapped everything from a 2010 Prius into my 1964 Corvair and was able to get everything working. It's now running mid engined in the back of the Corvair and has been very reliable all summer, plenty of power! The prox fob still works, press to start and it goes right to ready mode every time.

[lastphaseofthis]

I can confirm this part is reasonably doable. You will need complete harness, computers, and main accessories such as the brake booster with its stroke sensor.

On the gs450h, the brake stroke simulator is ran thru the skid ecu, is it the same on the prius? Did u bring the skid ecu over and not the pump and lines? Where did you sever that system? I removed the abs pump/skid fuses and regen worked off throttle and shifting the simulated gears down.. brake regen was lost... but it sounds like I can retain the skid ecu and brake stroke assembly stuff. Great.


I will likely swap the full dash and ac system as well as the steering gear. Big tasks.


Sounds like a cool project

[Corvairius]

Did u bring the skid ecu over and not the pump and lines? Where did you sever that system?

I actually brought the whole system over, skid control ecu, brake master and all. I relocated it to the rear of the car, actuating it with a hydraulic clutch master/slave combo. I plumbed the lines to their appropriate wheels. Right now I'm working on faking the rear abs sensor signals to match the front sensors, my last remaining fault codes are the lack of rear sensors and a random airbag computer comms fault.

I want to incorporate the zombieverter into my build and either write code or pay someone to write code to implement the engine and command an aftermarket ecu to behave as a range extender generator when I add more battery capacity.

It's called corvairius on instagram if you want to check it out, it was my daily all summer.

[0tik]

Are you sure that car throws an error code when voltage is higher than 18,5v or is it just an assumption? If you're satisfied with Man in the middle behind BMS then apart from soc spoofing you would probably be able to filter error codes that come from BMS too. If not then spoof voltages sent to main ECU?

[lastphaseofthis]

Are you sure that car throws an error code when voltage is higher than 18,5v or is it just an assumption? If you're satisfied with Man in the middle behind BMS then apart from soc spoofing you would probably be able to filter error codes that come from BMS too. If not then spoof voltages sent to main ECU?

18.5 is just a guess, but id be willing to disect and test a battery ecu, to find out its limit.

[lastphaseofthis]

18.5 is just a guess, but id be willing to disect and test a battery ecu, to find out its limit.

so 6 lifepo4 cells at 3.5v limited by the bms in to each voltage block starting at 21v and ending at 15v if cells taken down to 2.5v. likely only taken down to 3.0 and 18v pet block. and the ecu is still in used and working back at original voltages.

[0tik]

Great. I was about to say that I can test 88s li-ion battery in the next week but it is still only 360v. Nowhere close to your 420v. Great news. Do you have real time reading of this new battery stats from its BMS and therefore can tell us how car behaves with it?

Wait, I think I did not understand at first. Do you mean that the car discharged battery to 18v by itself? You really did not give much info here.

[lastphaseofthis]

Great. I was about to say that I can test 88s li-ion battery in the next week but it is still only 360v. Nowhere close to your 420v. Great news. Do you have real time reading of this new battery stats from its BMS and therefore can tell us how car behaves with it?

Wait, I think I did not understand at first. Do you mean that the car discharged battery to 18v by itself? You really did not give much info here.

the setup was a regular prius battery with the green wire from voltage block 1 positive cut and an adjustable voltage sourced was put in line, then turned up until the battery pcm reported 21.4v, now i will check the gs450h battery ecu for the same and then build a 120s battery for it, which will be 30ah at first, then later 300ah for the rv, if the 30ah doesnt fry the dc to dc, anybody know the limits of the dcdc input side? thats the next hurtle

[lastphaseofthis]

so i took my solar array and wired all 12 panels together and hooked them up, charged up the 288v cap that is part of the buck/ boost on top of the gs450h inverter.
it was 385v so i added another panel and reached:

so 120 lifepo4 sells will make 420v at 3.5v per cell, but i can charge to 3.49 per cell and it will be well within what i have tested here today.

the next test will be adding 60v to the factory battery and hitting the whole inverter assembly with 420v and seeing if the igbts can handle it, as well as the coils for the inverter. i bough a spare inverter to test the boost buck voltage handling ability, so this test cost me 200. but i didnt fry anything yet so i have a good spare still

[0tik]

Supplying a stationary car for a few minutes is some kind of a start but driving a 100 kilometers with new battery on board is the real test.

Shame I only have spare 88 pieces of liion from my i-miev. Liion from C-Max hybrid, phev or Prius would fit the best inside Lexus. Stacking such small cells would be much easier.

[0tik]

Okay i did some research. Ford old ass 5ah cells are not so common in eu. Prius li-ions aren't cheap either given their age. But turns out Yaris from 2020 onward uses liion in 48s/0,75kwh package. Corolla and RAV4 from 2020 onward uses 72s 1.1kwh pack Toyota ought to sit again on their math because 1.1/72 doesn't equal 0,75/48. Corolla is an odd one because I have found part number G9280-47150 with 0,85kwh and 56s cells.

I still have to do the math on their prices versus Headway 38120HP. But toyota seems to be cheaper (and lighter!) than headway at the first glance

[lastphaseofthis]

my LiitoKala 20ah have arrived, now i will build maybe a 70s (5 cells per block) first, but may just shoot for the 84 pack with 6 cells per block.

this is 24s for my gokart that pulls 100a, exactly there rated max.

the ford fusion cells were my first experience with bolting cells together. heres me on a sailboat.
https://youtube.com/clip/UgkxDyPee2OgB_ ... Qbx98kzKfe

[0tik]

Alright, I am sorry. This post was a waste of readers time. It didn't bring anything new. I basically reinvented the wheel here.

[Jacobsmess]

From memory the white and black pairs were the serial comms cables MTH - and +, HTM - and + etc.

[0tik]

Okay. It seems i was lost in my head. Partly by this thread not being exclusive to a single topic. So does nobody knowledgeable wants to decipher what's going on bth(battery to hybrid, most likely talks CSI) lines? I am willing to buy hardware to do the sniffing and upload logs here. By the way, what about REQ and CLK?
Now lets say i'd want to learn about CSI protocol. Is there any thread explaining it? Or is it just like a canbus - a single message X bytes long that has various values included inside. Someone figured out it's 79 bytes long for HTM. How was that discovered?

[0tik]

A slight bump on the road to success. bth- is stuck at low and doesn't move. Using pin 10 or 11 as GND. Pins 2 and 3 cause DTC and engine+fans turn on.

[0tik]

Another attempt but an odd one. Plugged to channel 4 and 5. got only an output on channel 0 and a short glitch on ch. 4&5, and it doesn't make sense for me. This analyzer must be faulty. I'm ordering another one soon.
https://drive.google.com/file/d/1LGMz9l ... sp=sharing
Edit: Tried LogicAnalyzer sketch for arduino uno with OLS software but no luck either.
Edit 2: https://openinverter.org/wiki/File:Toyo ... attern.png
Oh my god! Could i have used usb serial dongle hooked up to canbus transceiver the whole time? Will see soon. Its a bummer though that description of a file is the only place i could find this info
Edit3: Nope. That didn't work on the battery plug nor on obd port. Although I didn't plug car's GND to computer's GND. Also I cant say for sure if SN65HVD230 is talking serial on the other end or something else.

[0tik]

New logic analyzer arrived and worked! Here's the data again. captured by Saleae Logic 2.


Observations-
-when one side transmits, other one is silent.
-Message length differs.
-message terminates at a same bit value on both channels.
-since shortest datastream between common value is 3 bits, either first or last common bit must be part of a message.