Renault Zoe (Continental) Inverter Reverse Engineering

[johu]

This morning I ran the Zoe motor with the i3 inverter. I found 12V on the excitation results in 1.3A of current. Did get up to 15 Hz then it desychronizes and just rattles. I supplied excitation from a battery. When supplied from a power supply it jumps around a lot when running.

Anyway, it's about the inverter, not the motor. Got it on the table here and trying to get some life out of it. Connected chassis to GND and the yellow wire to 12V. Then results in 5 mA of current. The red wire doesn't really do anything. Also monitored the CAN channels but they don't produce anything either. Put one of the CAN messages from here on the bus but that doesn't wake it up either.

The colours in the wiring diagrams seem to be all in French and abbreviated. Also supplied 12V directly to the large elcap bu that also yielded nothing.

Ok, onto the gate driver board. I did ring out a few signals, like pins of the bidirectional isolator that send the PWM across the galvanic barrier. And the current sensors.

Weirdly all 5V supplies are split up. The low side isolators share common 5V, the high side another common 5V (I assume it's 5V) and another 5V goes to the current sensors. All not interconnected. Weird.

Tried to fire up the gate drive power supplies but also with no luck. Fed 12V to the larger film caps next to something that looks like a driver IC but that resulted in no current draw at all.

Not the best start, hints appreciated

[johu]

Everybody's gotta have a Damien.
Got some CAN logs and just played some back into the sleepy inverter and suddenly it wakes up and draws roughly 900 mA

The inverter itself responds with 0x196, 19F, 1A1, 422, 42C and 511 most of which are not in the table above.

EDIT: it's sufficient to keep sending message 0x423 to keep the inverter awake and sending CAN.

Still not sure if I can make it run that way but at least no I can take measurements

[johu]

Taking baby steps. I'm trying to figure out the position sensor which I expected to be a resolver. But it isn't.
I have the wiring diagrams and there the pins are called
- Ground
- Supply (measures as permanent 5V)
- Position Signal 1
- Position Signal 2

So I though ok, it must be some sort of position sensor IC that outputs a sin and a cos signal. So had the Analog Discovery supply 5V and then measured Signal 1 and 2. Hmm Signal 2 jumps to 5V, Signal 1 stays at 0. Moving the motor yields no change.

So I thought maybe it's some data protocol, one of them is clock an the other an encoded position. So clocked one signal with 500 kHz while monitoring the other. Nothing. Hints appreciated

For reverse engineering the inverter I'll need to make a brakeout board first because of all the flatflex

[tom91]

How hard is it to remove the board to look at the physical IC for the position sensor?

[johu]

How hard is it to remove the board to look at the physical IC for the position sensor?

I tried to do so today and that led to the answer The connector in the back (i.e. where the phase cables enter) is NOT the position sensor. It is the temperature sensor and part of the interlock loop.

The position sensor sits in the front, et voila:

EDIT
Next I tried supplying with 4V instead of 5V:

That shifts the signal into the input range of our ADC

Then I connected channel 2 to phases 1 and 2 and supplied the excitation winding with 12V:

So respolepairs=polepairs
The ratio is more important then the absolute value.

[johu]

Now continuing with some more gate driver research. The isolators are ISO7421 from TI. https://www.ti.com/product/de-de/ISO7421

They have one forward one reverse channel. Traced the 6 forward channels that gives me the 6 gate drive signals and the 6 reverse channels give me the 6 desat signals. The forward channels have a 200 Ohm series resistor

Then there are separate logic supplies for high and lowside, and separate supplies for the current sensors.

With all that and the many, many GNDs 43 out of 50 pins of the gate drive ribbon are now traced.

The excitation ribbon is just 20 pins, 6 GNDs, 2 15V and various 5V supplies. I think I'll just trial and error that as it's hard to measure

[johu]

First cut of a breakout board with mini mainboard for first tests

[johu]

Good testing day today. Got the main inverter and the exciter inverter going.

All runs fine from 3V3 control signals.

I haven't found temperature and bus voltage signals so maybe that is on SPI comms again. But I also found that I forgot to break out two pins so will check these next.

Latest pin map is attached

[johu]

And we have liftoff

Applied about 2A excitation current and then did the syncofs calibration. Then used idlespeed to spin at 1000 rpm. Works a treat. Emits some alien sounds, not sure if that is mechanical or electrical. Video coming soon.

Remaining question: how do we determine inverter temperature and bus voltage?
And for another experiment: how do we enable the DC/DC converter?

[johu]

Spied the "comms" with the DC-DC converter today by sandwiching a breakout board between stock logic board and DC-DC converter.

It is mostly static voltages but there is some rather strange comms going on.

On one pin the logic board sends an 11.2 MHz clock, on another a 2.8 MHz clock at 1.8V levels and finally it receives a 9.95 MHz clock and data and two other pins. I reckon it is a sync serial unidirectional protocol because I couldn't find any data upstream of the logic board. I captures a few frames.

Code: Select all

7E BF 80 D6 BF 11 7C BF 5F F9 6C BF 1F FE F6 BF AF
7E BF 80 D6 BF 11 7C BF 5F F9 6C BF 1F FE EC BF 87
7E BF 80 D6 BF 11 7C BF 5F F9 6C BF 1F FE DE FC 9F F5
7E BF 80 D6 BF 11 7C BF 5F F9 6C BF 1F FE CC BF AF 87 FE

The Analog Discovery seems to have a hard time keeping up with the speed so there might be bytes missing. A remember 7E being some HDLC delimiter so I just assumed it to be a frame start or end. Could apply some voltage to see if something changes.

[CarlSVB]

well im happy to see this thread, i have been waiting for someone to start the reverse engineering on the zoe. I have access to a complete running zoe and also have a complete disassembled zoe, and I mean completely everything minus the steel shell. if there is any way that I (mechanical engineer) or my business partner ( control systems engineer) can do to assist the development please reach out. reach a long way though as we are in Australia

[johu]

Have been going at the inverter again the last few days. Last entity to figure out is the DC/DC converter.
It used to run by simply dumping recorded CAN messages but now I cannot get it back up. Inverter turns on and sends its CAN and also draws 750 mA from the 12V battery but then it doesn't put anything into the battery as it did before.

Only obvious difference is the lack of the motor. I've connected all HV cables to close the interlocks and also bridged the one on the LV side. Will it not DC/DC convert if it doesn't see a valid resolver or temperature signal?

[johu]

Testing the next iteration.
- Exciter PWM now connected to mini mb user PWM
- Exciter current connected to udc input
- 15V boost converter for supplying exciter and inverter
- Hooked up 6 desat signals to and-tree
- LDO for variable voltage to sin/cos encoder (currently set to 3.9V) - shifts the output signals into the ADCs dynamic range
- Mini MB can be soldered directly to adapter board for lower profile so it doesn't collide with the gate driver PCB
- Bolt holes revised but still not perfect

There are some shortcomings still
- No measurement of inverter heatsink temperature - I hope it just throws a "desat" signal when overheating
- No measurement of udc - not really needed since the board won't perform contactor control
- No operation of DC/DC converter

Will now extend the software to detect the adapter board and allow closed loop exciter current control

Using an offset of 3195 for exciter current sense and a gain of -50 digits/A

[Jack Bauer]

Nice work Johannes. Will be good to have another motor/inverter combo useable

[oberbastler]

First cut of a breakout board with mini mainboard for first tests
grafik.png

Hello JoHu,

do you have the pinouts of the two black connectors of the mainboard?
Especialy the CAN pins.
Please share it.

Thanks.

BTW: Very good job!

[johu]

Tried running the DC/DC again today by feeding voltage from an adjustable transformer in two of the AC pins which generated 390V DC on the bus. I also shorted out the three interlocks and then dumped the CAN log. Instead of DC/DCing the isolator of the motor exciter circuit gave out the smoke

I can't get this damn thing to fire up anymore. So I think I'll give up on this for now but would appreciate if someone else could pick up

do you have the pinouts of the two black connectors of the mainboard?

Not sure if it's still relevant...
The longer cable is temperature and interlock
1, 2 - temperature sensor
3, 4 - interlock
5 - shielding

The shorter one is position
1 - sin
2 - 5V
3 - GND
4 - cos
5 - shielding

The only other important signal is the twisted pair beige/white which is CANL/CANH
You can supply via the wire or the DC/DC outlet

[dimonlipko]

I can give you pinout of PEB connectors)

If it PEB from ZOE, there one EV CAN and one CAN between PEB and BCB (charger).