openinverter forum

Thanks to the automotive industry trying desperately to hold onto the ICE as long as they can we have been gifted mild hybrid parts. The current specimen is from Johannes favorite automaker. Purchased just recently from ebay Germany :
https://www.ebay.de/itm/AUDI-A6-A7-4G-A ... 4579021396

It seems to be brand new and never fitted to a car. As the seller has quite a few and I observed some minor chips and scuffs on the casing I'm guessing its a qc reject straight from the factory.

A small donation to the Audi tech info website later and we have a wiring diagram from an A6 with just such a unit. 5 pins out of a possible 8 are populated. +12v , CANH,CANL,LIN and a wierdo called SIG that seems to pump out a 125Hz square wave. Anyway, with 12v and 48v applied it sits there looking at me doing nothing but consuming a steady 120mA from 12v. Sigh....always the hard way...... without any can logs or info I set off via the long road. Some savvycan fuzzing later we find it wants to see 0x3c0 with byte2 bit2 set to wake up. You're welcome.

Attached some can logs. I have observed what looks like rotor rpm in 0x1a0 byte 2 and 48v voltage in 0x1ac bytes 6 and 7.

The rotor does not cog so is either wound or induction. I'd bet the former.

Now just to find the control commands..............

I'll ask just for the fun of it : anyone got a can log from a vw mild hybrid?

I'm no help, sorry, but I was looking at one of these a little while back with the intention of cracking the back open and driving it directly... cheating, I know, but...

Oh that is one compact unit

The BMW document shows an excitation winding.

Don't know anyone with a mild hybrid VW, sorry...

No worries Johannes:) I'm going to hold off on opening it up as from what I can see the inverter is totally potted and getting it open will destroy that part. If folks want stuff like this to become available for the conversion community then some effort other than what I can achieve/afford will be needed.

And on a positive note its only 0x7fe possible messages now as I've already found one!

So 2 days roughly to make it spin then

Progress .....

Hahah thought you might give in to curiosity

I was expecting mosfets! They look like tiny IGBTs?

annnddd this is as far as we can get without permanent damage. They fit the inverter on back then laser weld the stator wires to the inverter.

bugger worth a go.

Bet it'd run with a prius inverter, a touch overkill perhaps hahaha

What appeals to me about this is the all in one aspect.

Some progress. Seems 0x3c0 byte2 bit 1 is KL15 via can : So we just told it the ignition is on and it wakes and starts sending us messages. Now problem is I'm not firing off the counter and checksum so it don't like me.
Source :
https://github.com/commaai/opendbc/blob ... b_2010.dbc

And I see overvolting potential to 63V

Yeah, the all-in-one is a great feature.

48-63V would work nicely with a single BMW module (and plenty of others!)

Hi Great work

yep audi also have a 12v version which i have of the starter generator from the SQ7 but that operates on the lin bus below are some of the spec about the 48v version.

now if only someone had the lin bus decode or has a hybrid golf in london i could plug my scanner into.

Thats a great bit of info thanks. I'm wondering about just grabbing an ecu and powering it on the bench. Of course it wont spin up the unit but would pump out the can ids with the counter and checksum that could then be played with. Might work for your lin application also...

Do you have any tips specific to fuzzing? Any method to deciding on ids to start with?

Just messing around with a VW contactor control board to see if I can get it to close the contactors.

Fuzzing is kind of a last resort for me but no other real choice with this application. Few things to be aware of :

-Does the message contain any counters,checksums or crc bytes? if so and you just fuzz them its really unlikely you will get anywhere. Case in point here with the starter/alternator the command bytes use a counter and checksum. You may find the format of those in other messages received from the device under test or another element. I've put those can logs up here but no one seems to care enough to help with that part.

-Fuzz a group of ids first all set to 1's and then 0's then random.

-Use two computers. one to fuzz one to monitor.

Hope that helps.

Thanks, sounds like I need to use more intelligence before using the scattergun. There's 2 wires I've not managed to identify the usage of as of yet, I'm thinking they may be a safety interconnect.

It's quite a steep learning curve, hopefully I can be of some use when I've started ascending the curve.

watching this, very intriguing and possible an option for motorcycle conversions!

there's also the starter generators from the kia niro and Hyundai iconic its a permeant magnet motor with 14kw max output. this has a simple 3phase output so you have to make your own controller for it. but it has a built in resolver. the same setup is on the BMW i8
just another one of my many projects to get round too

These would be great for an electrically assisted wheel barrow

Dilbert,
- Or maybe a ride-on lawmover conversion

Yeah. good job we didn't waste any time on that Toyota hybrid stuff. Someone told me those inverters can only do 100amps ....