Communicating with the Lexus GS450h Inverter/Converter

Topics concerning the Toyota and Lexus inverter drop in boards
Post Reply
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

Update: The work on this project is considered to be complete. Damien has created a functional controller based on the information and work done in this thread. Please see here for information on the controller, and how to purchase or build you own.

Feel free to use this thread for technical discussion regarding the communication interface for the Toyota/Lexus inverters, but please refer to the support thread above for any specific questions regarding the use of this controller.

Note that much of the information in this thread (especially in the earlier posts) may be outdated.

bench test 2 3d4.xlsx
(4.11 MiB) Downloaded 385 times
Hi all!

I originally posted this thread on the diyelectriccar forum, but was advised that it may be better suited in here.

I noticed that Damian has also recently been looking into these inverters by means of a custom control board. I'm hoping to establish communication with the factory controller to trick the inverter to thinking that it is still in the car. The hope is that I can take advantage of the work already done by Toyota in controlling this inverter.

I currently own a 2007 GS450h which I am using to source the data packets that are sent from the Hybrid ECU ("HV ECU")

I purchased a used GS450h motor drive unit ("transmission" / "gearbox") and an inverter as well at the end of last year. The inverter is sitting on my bench in pieces.

I also grabbed as much of the service data regarding these units as I could from lexustech.eu within a 1 hour subscription. Although a diyelectriccar user has also figured out the connector pins and typed it out so I don't have to:
hilux.2sv;983945 wrote:We now have some more information after studying the wiring diagrams and DTC repair documents.

Signals from HVC-ECU to INVERTER/CONVERTER:
Pin 23/22 HTM+/- --> MOSI, differential using CAN transceiver, about 60...100 bytes (1.6ms), 120Ohm termination on both ends
Pin 21 DRN1 --> shield for HTM+/-
Pin 3/2 MTH+/- --> MISO, differential using CAN transceiver, about 60...100 bytes (~1.6ms), 120Ohm termination on both ends
Pin 1 DRN2 --> shield for MTH+/-
Pin 14/13 CLK+/- --> SCK, differential using CAN transceiver, about 500kHz, 120Ohm termination on both ends
Pin 12 DRN4 --> shield for CLK+/-
Pin 34/33 REQ+/- --> select from HV-ECU to INV/CONV, differential using CAN transceiver, about 3ms, repeated every 4ms (250Hz), 120Ohm termination on both ends
Pin 32 DRN3 --> shield for REQ+/-
Pin 25 HSDN --> emergency shutdown, from HVC-ECU (monitored for fault detection), high active, 3kOhm pull down resistor
Pin 36 DRN8 --> shield for HSDN
Pin 35 ILK1 --> interlock out to HVC-ECU, all okay --> low level, gnd
Pin 24 ILK0 --> interlock in from interlock switch, all okay --> low level, gnd
Pin 16 G1 --> petrol engine speed signal input, about 12,5Hz at idle
Pin 5 DRN5 --> shield for G1
Pin 10/11 +B/+B2 --> from IGCT2 relay (IG), fuse 10A
Pin 30/31 GND1/GND2
This is useful info, when compared to the connector on the inverter unit (all pictures are click-for-big!):

Image



I pulled the unit apart to inspect the board. I drew a brief schematic for the relevant parts:

Image



The board appears to use a proprietary transceiver, a DENSO SE617. There is no datasheet for this unit. I guessed the pin names from examination of the board.

A pair of 62R resistors with a capacitor to ground, and a common mode choke (actual part number is ZJY2401) provides the only protection and noise suppression.

The microcontroller used is a NEC 76F0080GC. Again, no datasheet or specs for this.

The 5V rail for the transceivers is shared with the microcontroller, the resolver-to-digital converters, and some other parts, here's a brief look at it, I didn't examine too far, I guess it's a buck converter from the 12v input. Not much in the way of noise suppression?

Image



I'll likely piggyback off of this 5V supply for my own controller.




So, the control signals....

It first appeared to be SPI over LVDS. The Toyota names for the pins are likely alternate names for MOSI, MISO, CLK. However, in practice, whene examining the nature of the data stream, it does not follow the SPI standard.


  • HTM = High-voltage ecu To Motor-generator ecu - since the HV ECU (the Hybrid ECU) in the car is the master, this is MOSI. This is the signal which we will need to replicate to control the inverter.
  • MTH = Motor-generator ecu To High-voltage ecu - This is MISO. From this we get status updates back from the inverter.
  • CLK = This is the SPI clock. The Lexus system uses a 500KHz clock. The data packets from MOSI and MISO don't generally exceed 100 bytes, and I've managed to get stable packets without overlap from as low as 250KHz. Data from MTH will output in time with this clock (on a rising edge)
  • REQ = this is the status request line from the inverter. For the Lexus, this is a 1ms high pulse followed by a 3ms space, basically a 250Hz square wave at 25% duty cycle. In reality, the inverter outputs a packet of around 100 bytes whenever it detects the leading edge of a pulse, so a CS or SS line can be used to trigger this. The pulse can be half high for the duration of the packet, or as long as you like. One pulse = one packet.


When talking about high and low here, I am referring to the differential signal. Since these are normally inverting, in reality the microcontroller likely receives a low pulse to trigger a packet output.

I set up the inverter on the bench, and fed it the following:
  • 12V to both 12V pins
  • 0V to both 0V pins
  • ILKI and ILKO both grounded (not sure this matters yet)
  • HSDN to 12V (not sure this matters yet)
  • Shorting wire in the interlock connector for the AC compressor (not sure this matters yet)
  • 250KHz square wave to CLK+ and -
  • 250Hz square wave at 25% duty cycle to REQ+ and -.
  • Logic analyser to CLK, REQ and MTH. All 3 of the - line are tied together by this, they don't seem to mind (they really do mind if you do this on the car, however!)
A typical packet looks like below:

Image

The packet does not follows the SPI convention. Each "byte" has a start bit, 8 data bits, and a stop bit, as below:

Image

The packet is 100 bytes wide, with many bytes being 0. A typical packet looks like below:

Code: Select all

00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,11111111,11111111,
00000000,00000000,00100100,01100000,00000000,00000000,10011000,00000000,00000000,00000000,
00000001,11001000,01000000,00000000,00000000,00000000,00000000,10000000,00000000,00000100,
00000000,00000001,10000011,10111111,11111111,11111111,11111111,01101011,01010000,00000000,
00000000,00011000,10011000,00000000,00000000,00000100,01110010,11110001,00001000,00000000,
00000000,00000000,00000001,01001000,01000000,00000000,00000000,00000000,00000000,00000000,
00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,
00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,
00000000,10000000,10100000,00000000,10000000,00000000,00011000,00000000,00011000,00000000,
00000000,11010111,10000000,00000000,00100000,11111111,00000000,01110011,00011011,10110000

After sampling a few hundred of these, it seems that the inverter output (for an inverter on the bench with no motor connected) is below:

Image


I ran the same test with the inverter connected to the car. I am only able to connect to one of the 4 lines at a time, id I try multiple, the - lines ground through the logic analyser and causes the car to generate a DTC and disable the hybrid system. I tried using diodes on the grounds to allow for some separation, this worked, but the data I received was corrupt.

I'll attach an Excel file showing a few hundred packets of the inverter both on the bench and on the car.
bench test 2 3d4.xlsx
(4.11 MiB) Downloaded 385 times
I also did the same to the HTM line, to see what the hybrid ECU sends the inverter on startup. As expected, the first few (hundred!) packets are unique, and then it seems to settle down. Again, it's in the spreadsheet.

Next up is to request torque from the motors (shift into R or D and move the car) and see how the states change.

I'm also starting to get parts together to talk to this unit with a microcontroller, rather than a signal generator and logic analyser. I purchased a TI SN65LVDT41PW LVDS Transceiver which contains 4x transmitters and 1x receiver.


I spent the next day looking into communication to this unit. From what I've seen/read online about SPI, it seems that SPI does not use start and stop bits. Also, SPI only transmits clock pulses as data is being requested. This unit accepts a "constant" clock, and outputs a 100 x 10-bit packet each time the REQ line is triggered. The clock runs constantly throughout. I also noticed that if the clock stops momentarily, the data keeps flowing without a clock pulse.

Because of this, I cannot read this as a SPI signal. My attempts to use a microcontroller set to transmit/receive SPI result in the microcontroller outputting 8 clock pulses, then a brief pause, then another 8 clock pulses, etc. This results in data being received, but the data is corrupt - the microcontroller just receives what was being sent at the time it attempted to read from the inverter. I've attached my code below.

Another interesting thing is that the inverter board waits for 39 clock pulses after receiving a REQ pulse, and starts to output on the 40th pulse.

I'm now looking at how to receive (and later transmit!) this bit stream. I can generate the clock pulses and REQ pulses easily, but to receive data synced to the clock pulses? 'm not sure how. I'm currently using a Teensy 3.2, the digital input pins are too "slow" to receive this data. Since the clock is at 500KHz, I'm currently looking to check for a 0 or 1 at my "data in" pin every 2us. The inverter sends data on a rising edge of the clock pulse.

All I really need to do is be able to grab this entire packet in a 1000-long array or similar, I can likely remove the start and stop bits and bit-shift the remainder into an array of integer variables afterwards.

Of course, I also need to be able to do the same in reverse, to talk to this unit.

Attached is the following images (click for big)

1. An overview of the data received.
2. A close-up of the start of each packet
3. A close-up of the middle of each packet, where things are more interesting than "00000000"

Note that since this is a differential signal, it is likely inverted, so the 1 11111111 0 you see in the first packet is actually "0 00000000 1". I am not using a differential transceiver right now, although I do have one on the way.

Image

Image

Image


Below is the code used to attempt to read from this unit. The code does appear functional, although I'm not sure if this is the correct way to approach this! As mentioned above, the issue is:
  • The inverter waits for 39 clock pulses before outputting data, following a REQ high signal.
  • The inverter needs a constant clock, the code below produces 8 clock pulses, followed by a gap (presumably as the "for" loop runs)
  • The inverter outputs start and stop bits, so each byte is 10 bits long, SPI expects 8, so everything gets shifted. This wouldn't worry me, I imagine this is fixable in code, but when running constantly, each 100-byte data packet is represented differently to the program - if it was consistent then things would be easier. I guess it's an issue with timing.

Code: Select all

#include <SPI.h>

#define req_pin 10
// MOSI: pin 11
// MISO: pin 12
// SCK: pin 13

//definitions
#define inverter_msg_length 100

//global variables
int inverter_msg[inverter_msg_length]={0};

void setup() {
  Serial.begin(9600);
  SPI.begin();
  pinMode(cs_pin, OUTPUT);

  //SPI.setBitOrder(MSBFIRST);
  //SPI.setDataMode(SPI_MODE0);
  //SPI.setClockDivider(SPI_CLOCK_DIV32);
  delay(100);
}

void loop() {

  digitalWrite(req_pin, 1); //send request
  SPI.beginTransaction(SPISettings(500000, MSBFIRST, SPI_MODE0));
  Serial.println("Start of transmission.");

  for (int i=0;i<inverter_msg_length;i++) inverter_msg[i]=SPI.transfer(0);
  
  SPI.endTransaction();
  digitalWrite (req_pin, 0);
  Serial.println("End of transmission.");

//print results
  Serial.println("\t0\t1\t2\t3\t4\t5\t6\t7\t8\t9");
  Serial.println("   ------------------------------------------------------------------------------");  
  for (int j=0;j<10;j++)  {                             //print 10 rows
    Serial.print(j*10);if(j==0)Serial.print("0");Serial.print(" |\t");              //row heading 
    for (int k=0;k<10;k++){Serial.print(inverter_msg[j*10+k]);Serial.print("\t");}       //print 10 columns of data
    Serial.print("\n");
  }

//delay, so the serial monitor is readable for now  
  delay(500);
}
One thing to note is that the "REQ" line is not a chip select line, it does not need to be held low (high for me for now) throughout the transmission, it needs to simply be a pulse. For this Toyota system, it is a 1ms pulse, repeated after 3ms. The data transfer takes around 2ms. you can see this in the pictures above.

Of course, any knowledge on this subject would be greatly appreciated! I'm somewhat of a novice at programming, and have barely touched SPI, hopefully I'll be able to build something useable to control this unit!

Thanks :)
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by Jack Bauer »

That is excellent work. One of my main reasons for going with a custom control board was due to not having a vehicle available to test and to allow different voltages and motors. Glad to help if I can just up to my ears in projects:)
I'm going to need a hacksaw
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

Hi Damian, good to hear from you.

If I can't get any luck with the method I'm using, I will likely end up using a custom board as well. For now, it appears that the control of this unit is rather simple - and it's just my lack of knowledge/experience which is holding me back!

I'll be pulling more data from the car when the weather improves, I'm happy to share whatever I recover.
User avatar
celeron55
Posts: 774
Joined: Thu Jul 04, 2019 3:04 pm
Location: Finland
Has thanked: 27 times
Been thanked: 110 times
Contact:

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by celeron55 »

Instead of weird SPI or anything like that, isn't that just synchronous serial data? Configure a USART for it and you'll get a data stream.

If not anything else, try to get a data capture of a full drive cycle.
User avatar
sfk
Posts: 289
Joined: Mon Jan 14, 2019 8:29 pm
Location: Wellington, NZ
Has thanked: 2 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by sfk »

That's a very comprehensive post that beyond my understanding but I have plans for using a gs450h drivetrain and so I'm dependant on smarter people like you figuring this out! In general it seems most robust to remove the original control board and take full control. Best wishes. Looking forward to your progress.
-< Mazda Eunos JC Cosmo rotary -> EV conversion w/ Lexus GS450H gear >-
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

celeron55 wrote: Sun Jul 28, 2019 5:57 am Instead of weird SPI or anything like that, isn't that just synchronous serial data? Configure a USART for it and you'll get a data stream.

If not anything else, try to get a data capture of a full drive cycle.
I'm not familiar with communication protocols. I've had a look at USART, but have no idea how to implement it on a Teensy 3.2. I guess that's todays project!
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

I've spent a few hours on this, thanks to the help from the guys on the PJRC (Teensy) forum. I'm using a workaround to receive this data, basically creating a 500KHz PWM signal and then capturing whatever stream comes out of the inverter. The issue is that the UART in the Teensy doesn't know about the PWM signal, so it's receiving it asynchronously. Any my results are below:

Image

Not quite correct!
hilux_hx
Posts: 8
Joined: Mon Jul 29, 2019 12:10 pm
Location: Berlin, Germany

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by hilux_hx »

Hi @all,
that's great that someone else is working on the GS450h/LS600h system. With Bigmouse his help we got the transmission / inverter running with our own control module.
It's not SPI, it's a synchronous serial communication. You have to use a micro-controller with USART for that. So the Teensy doesn't work, but a Arduino Due does.
CLK is continues 500kHz regardless of transmission. Transmission and reception is not aligned. transmission starts on falling edge of REQ and reception some time after rising edge of REQ. It doesn't matter how narrow or long the REQ pulse is.
You can use basically any 5V CAN transceiver for that (4 of course, one for each signal). Because most transceivers have a dominant time out detection after 1ms, you REQ pulse can not be longer than this 1ms. That's like the OEM Lexus/Toyota timing. You can make it much shorter, if you want.
I used an ATxmega128A1U with external SDRAM for testing and capturing the HVC-Bus datastream. The USARTs with connected DMA channels work really great for the HVC-Bus.
Transmission data are 80 bytes, reception 100 as far as I remember for the GS450h/LS600h. The last 2 bytes are the checksum over all data bytes.
A big problem is enabling and controlling the internal HV DC/DC converter. Up to now we didn't get this working. But would be helpful for supply 288V to the 12V DC/DC converter, AC compressor and heater. A lower voltage battery charger could be used for charging the HV battery pack if this is working.
2004 Toyota Hilux KDN165 Double Cab conversion - using Lexus LS600h transmission and inverter.
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

hilux_hx wrote: Mon Jul 29, 2019 12:12 pm Hi @all,
that's great that someone else is working on the GS450h/LS600h system. With Bigmouse his help we got the transmission / inverter running with our own control module.
It's not SPI, it's a synchronous serial communication. You have to use a micro-controller with USART for that. So the Teensy doesn't work, but a Arduino Due does.
CLK is continues 500kHz regardless of transmission. Transmission and reception is not aligned. transmission starts on falling edge of REQ and reception some time after rising edge of REQ. It doesn't matter how narrow or long the REQ pulse is.
You can use basically any 5V CAN transceiver for that (4 of course, one for each signal). Because most transceivers have a dominant time out detection after 1ms, you REQ pulse can not be longer than this 1ms. That's like the OEM Lexus/Toyota timing. You can make it much shorter, if you want.
I used an ATxmega128A1U with external SDRAM for testing and capturing the HVC-Bus datastream. The USARTs with connected DMA channels work really great for the HVC-Bus.
Transmission data are 100 bytes, reception 80 as far as I remember for the GS450h/LS600h. The last 2 bytes are the checksum over all data bytes.
A big problem is enabling and controlling the internal HV DC/DC converter. Up to now we didn't get this working. But would be helpful for supply 288V to the 12V DC/DC converter, AC compressor and heater. A lower voltage battery charger could be used for charging the HV battery pack if this is working.
Thanks for the reply and the advice. I have replied to your post on diyelectriccar, here is is here as well :)
This is great info, many thanks!

I've been in touch with the people at PJRC (Teensy manufacturers) and it seems that indeed the Teensy can't handle USART. Shame as I planned to mount it inside the inverter casing next to the inverter PCB.

I've got a Due in a box somewhere, if I can find it then I'll start again with that!

Thanks for the tips on the communication protocol. It all aligns with the measurements I've taken.

I've been reading up on USART implementation on various Arduino units. I actually came to the same conclusion that I'd need a Mega or Due for this, as I need more than one UART (I need to talk CAN bus as well as to the serial monitor as well!). The Due is actually a good fit, as it uses 3.3v logic, which pairs well with the 3.3v transceivers in the inverter.

Good to hear that regular CAN transceivers work, I imagine they would. I've gone ahead and ordered a SN65LVDT41PW from TI, this unit has 4 transmitters and one receiver, which I think will make for a simplified PCB.

Good to hear that the checksum is just a sum of the other bytes in the packet! Do you know the format of the checksum? i.e byte 99 or byte 100 the most significant byte?

Information on configuring the Arduino units for USART seems thin on the ground. I've found one forum post that talks about disabling a clock pin and handing control of it over to the UART to allow it to generate the synchronous clock. If this how you managed it as well? Are you able to help with the code for this? It doesn't seem very familiar!

I haven't looked at the converter (yet). To be honest it's out of the scope of this project, for now at least. I'm not sure if you can set the voltage through the USART packets, I imagine not, I imagine it is set at 650v <> 288v on the inverter PCB. I imagine that the signals within the unit may need to be intercepted.

In fact, do you have a list of which bytes of the packet are for what? I noticed that there are some which change depending on inverter state, etc, but some of them I'm not sure about. Are they temperature readouts? Resolver readouts, etc?

I have a Toyota scan tool, it gives me a great deal of information from the inverter including heatsink temperatures, resolver angles and rpm, motor torques, etc. Of course, with all the data changing all at once, it's a matter of educated guesswork to reverse engineer!

Of course, any info would be greatly appreciated.
hilux_hx
Posts: 8
Joined: Mon Jul 29, 2019 12:10 pm
Location: Berlin, Germany

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by hilux_hx »

synchronous full duplex USART communication
one start bit - 8 data bits, LSB first - one stop bit

checksum = byte80*256 + byte79 (most significant byte: 80, should be little endian)
checksum calculation = byte1+byte2+...+byte77+byte78

Use a 5V CAN transceivers (like in your schematic of the inverter) which have 3.3V IO levels. For me the Microchip MCP2562FD-E/SN (separate IO supply pin) works great. It's an CAN-FD transceiver, but that doesn't matter.

Arduino doesn't support synchronous USART configuration, but it's easy to enable this (for DUE):

#define REQPIN 9

void setup_hvcbus(void)
{
// set REQ pin to output high as default
digitalWrite(REQPIN, HIGH);
pinMode(REQPIN, OUTPUT);

// Synchronous Serial on AT91SAM3X8E (USART0 TXD pin TXD0 --> Serial1 "ARDUINO DUE TX1/D18")
// Synchronous Serial on AT91SAM3X8E (USART0 RXD pin RXD0 --> Serial1 "ARDUINO DUE RX1/D19")
Serial1.begin(250000); // 500kHz, set to 250000 due to different baudrate calculation for synchronous mode, Serial1.begin() uses asynchronous baudrate calculation

// Synchronous Serial on AT91SAM3X8E (USART0 CLK pin SCK0 --> Serial1 "ARDUINO DUE SDA1/D70")
PIOA->PIO_ABSR |= 1<<17; // set peripheral B (--> USART0 SCK0)
PIOA->PIO_PDR |= 1<<17; // let peripheral control pin (--> USART0 SCK0)
USART0->US_MR |= 1<<4 | 1<<8 | 1<<18; // set CLK/8, synchronous mode, enable SCK clock output
}
2004 Toyota Hilux KDN165 Double Cab conversion - using Lexus LS600h transmission and inverter.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by Jack Bauer »

One question I would have is can the inverter be run with less than 600v on the bus using its own logic?
I'm going to need a hacksaw
hilux_hx
Posts: 8
Joined: Mon Jul 29, 2019 12:10 pm
Location: Berlin, Germany

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by hilux_hx »

Attention:
uC output levels are inverted for the CAN transceivers, like for any UART output

high level --> 0, idle
low level --> 1

REQ triggers:
transistion from high level to low level --> trigger MTH transmission (uC RX)
transistion from low level to High level --> trigger HTM transmission (uC TX)

maximum time of uC REQ low level (H->L to L->H) < 1ms (CAN transceiver dominant time-out detection, depents on CAN transceiver, look in the datasheet)

OEM repetition rate is 4ms. Not sure if the inverter cares about it. Don't think so.
2004 Toyota Hilux KDN165 Double Cab conversion - using Lexus LS600h transmission and inverter.
hilux_hx
Posts: 8
Joined: Mon Jul 29, 2019 12:10 pm
Location: Berlin, Germany

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by hilux_hx »

Yes it can be run with lower voltage. The inverter seems not to care about the HV bus voltage. No electronic modifications on the inverter side necessary. Just applying the HV DC voltage to the bus bars directly, bypassing the internal boost/buck converter which is limited to 37kW output power.
2004 Toyota Hilux KDN165 Double Cab conversion - using Lexus LS600h transmission and inverter.
hilux_hx
Posts: 8
Joined: Mon Jul 29, 2019 12:10 pm
Location: Berlin, Germany

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by hilux_hx »

HSD-Analyzer for monitoring and simulating the HVC-Bus. Uses an ATxmega128A1U with 4MB SDRAM attached and USB serial port connection for capturing/transmitting/receiving data. Can act as Sniffer for both HTM and MTH, as master (HVC-ECU) and as slave (INVERTER):
HSD-Analyzer_1.jpg
HSD-Analyzer_2.jpg
HSD-Analyzer_3.jpg
HSD-Analyzer_4.jpg
Adapter for the OEM wire harness for sniffing the HVC-Bus datastreams. Works for the Toyota RAV4h (Gen. 4) and the Lexus LS600h (basically the same system as the GS450h):
HVC-Bus_Adapter_RAV4h+LS600h.jpg
Sniffing data in my RAV4h:
HSD-Analyzer_RAV4h_1.jpg
HSD-Analyzer_RAV4h_2.jpg
HSD-Analyzer_RAV4h_3.jpg
HSD-Analyzer_RAV4h_4.jpg
2004 Toyota Hilux KDN165 Double Cab conversion - using Lexus LS600h transmission and inverter.
hilux_hx
Posts: 8
Joined: Mon Jul 29, 2019 12:10 pm
Location: Berlin, Germany

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by hilux_hx »

Data stream is different for the RAV4h because it has 3 inverters, one additional for the rear axle motor and a built-in 12V DC/DC converter.

HTM data bytes: 105
MTH data bytes: 140

But I have access to a LS600h from a Toyota dealer if necessary.

We still not know how to control the buck/boost converter, which would be good for supply of 288V to the AC compressor, HV heater and external 12V DC/DC. Would even open up some additional charging possibilities for the HV battery.
A friend of me thinks the buck/boost converter is working autonomous and everything will be controlled by the MG1 and MG2 commands. Not sure, hope it's not the case. However turning the motors is still possible without it.
2004 Toyota Hilux KDN165 Double Cab conversion - using Lexus LS600h transmission and inverter.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by Jack Bauer »

Excellent. I can't wait for an opensource solution. Glad now I got pulled away from the logic board project:)
I'm going to need a hacksaw
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 87 times
Contact:

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by Jack Bauer »

Any updates?
I'm going to need a hacksaw
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

It's been a while since I posted an update on this. I've been playing with a few things at the same time. Looking at the AC compressor communication, disassembling the HV converter, and designing a PCB to talk to the inverter.

Here is the board I've come up with. It's based on an Arduino Due as mentioned above, it also contains IO for the following:

Image
  • Transmission PB1,2,3, SL1, SL2, SP
  • MOSFETS to drive 14 additional outputs, I am using this for my coolant loop, which consists of 2 pumps, 3 sets of fans, and 5 flow control valves.
  • 2x CAN busses (one for my DC-DC converter and coolant heater, both from a Volt, the other for whichever BMS I choose). Can transceivers are 3.3v logic and 5v transmission.
  • SPI and I2C outputs. SPI for the GS450h AC compressor, I2C for external IO....the Due doesn't have enough IO for this project. External IO is mostly for car integration, it will connect to the PRNDS selector and run the gauge cluster.
  • Isolated inputs for ignition key positions and the brake pedal.
  • Analog inputs from dual accelerator pedal hall effect sensors, and a pressure sensor for brake vacuum (I'll probably just use a MAP sensor).
  • 8x NTC temperature sensor inputs (MG1, MG2, Trans fluid, Oil Pump, Heater, Radiator inlet, Radiator outlet, Ambient).
  • TVS arrays on all non isolated inputs.
  • Reverse light output.
  • 3x additional MOSFETs for relay control for the inverter/12v logic system, oil pump power, and vacuum pump power.
  • PWM output for the oil pump.
  • 12v > 5v buck converter (eBay unit, mounted to the board), and a 3v3 linear regulator for logic power supply.
  • Breakout connectors for any unused Due pins
All of it fits on the 152x162mm PCB which fits inside the RX7 ECU enclosure. I have recycled the RX7 ECU connector and housing, I will use the original 76-pin connector assembly in the car. I have used every pin and have had to use the chassis itself as a ground for the MOSFETs.

As usual, lots of scope creep on this, and the best part of a week to research everything that I need. Lots of time spent assigning the 4 plugs for the RX7 connector to various functions so that the harnesses can be separated (the harnessare are Cooling, Transmission, Inverter/CAN, and Interior).

I'm still looking at the HV converter in the inverter/converter unit. I've made a hand drawn schematic and will do a write up shortly. It looks like it will be controllable with PWM to the high/low IGBT sets, just need to figure out where to inject that.


Edit: I guess I never mentioned that I was able to communicate with the inverter (eventually) and get stable response. However the data received at the Arduino doesn't come close to matching what I've read on a logic analyser. I guess I'm introducing an offset somewhere, or ignoring every xth data bit, since everything seems "shifted" slightly. The checksum is also nowhere near what it should be.
User avatar
sfk
Posts: 289
Joined: Mon Jan 14, 2019 8:29 pm
Location: Wellington, NZ
Has thanked: 2 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by sfk »

Sounds amazing and very comprehensive. I assume it's for an FD conversion? I have a JC Cosmo waiting and I expect there could be a lot of similarities.
-< Mazda Eunos JC Cosmo rotary -> EV conversion w/ Lexus GS450H gear >-
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

Jealous of your Cosmo! Love those cars :)

I guess I should apologise, I didn't see that this thread had gone onto page 2, so I missed out on all the excellent comments and discussion here.

I imagine the HV converter is controlled from the same logic board as the inverters, and has a setpoint at 288v. The PCB inside the converter housing doesn't contain a microcontroller. Likely there is PWM being sent from the inverter control PCB to gate drivers within the converter housing. It should be possible to intercept and replicate these signals, all you'd need is:

Voltage sense HV (650v) side
Voltage sense LV (288v) side
PWM high side (boost)
PWM low side (buck)

Then, you would:

1. Read the two voltages
2. Determine the operation mode based on the readings:
----if the LV side is at your charger output voltage (e.g. 360v), then you must be charging, so boost this, adjusting the PWM duty to hit the HV voltage
----if the LV side is less than the charger output voltage and less than the desired bus voltage (e.g. less than 288v), then buck the 650v bus down, adjusting the PWM duty to meet the setpoint

3. Send PWM to the appropriate gate driver, with voltage feedback to adjust the duty to suit.
4. Repeat as necessary. Change operation mode if needed.

I'd add a CAN transceiver as well so I can monitor the status, I imagine this wouldn't be fed back via the MTH packets.

There are also two temperature sensors plugged into the same connector as the Converter PCB, one is converter inductor temperature, the other looks like the water plate temperature. Not sure if these make it out with the MTH data, they likely do, but even if not, these could be taken into a microcontroller and sent via CAN.
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

Rather than spend time drawing these up, here are my handwritten notes.


Converter PCB removed. This is soldered on, it looks like a connector to the IGBT module but it was very very tight and I didn't want to risk damage.

Image


Contents under PCB. One bus bar from the inductor has been removed already. Not shown is a resistor which connects between the A and B marks on the plastic housing.

Image


Wiring schematic overlayed in MSpaint. Note that the capacitor on the right contains two connections to one side, I guess it's used as a bus bar.

Image


IGBT module.

Image


Schematic of a typical buck/boost converter. Wolftronix on YouTube did a nice video on the design of these, which was a nice refresher before I tore into this unit. It's been 12 years since I last touched buck and boost converters!

Image


Sketch of the "wiring" inside.

Image


Finding the flyback diodes inside the IGBT module, using those to determine the location of the IGBTs.

Image


Still not entirely sure if I found them all, thre are two terminals of this module which have no connection. These may just be used as junctions for the other components.

Image


Final schematic. Capacitor values were written on the capacitors, resistor was checked with a multimeter, inductor with a function generator and oscilloscope (1v pk-pk 20KHz signal with no inductor, dropped to 0.5v pk-pk at 22.7KHz with the inductor, L=sqrt(1/3).R/(2.pi.f), r = 50 ohms).

Image


That's mostly where I'm up to now. I'm also sorting out communication with the AC compressor at the same time! I plan to sell my GS450h soon and am trying to get as much data from it as possible.
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

hilux_hx wrote: Tue Jul 30, 2019 1:12 pm HSD-Analyzer for monitoring and simulating the HVC-Bus. Uses an ATxmega128A1U with 4MB SDRAM attached and USB serial port connection for capturing/transmitting/receiving data. Can act as Sniffer for both HTM and MTH, as master (HVC-ECU) and as slave (INVERTER):

HSD-Analyzer_1.jpg
HSD-Analyzer_2.jpg
HSD-Analyzer_3.jpg
HSD-Analyzer_4.jpg

Adapter for the OEM wire harness for sniffing the HVC-Bus datastreams. Works for the Toyota RAV4h (Gen. 4) and the Lexus LS600h (basically the same system as the GS450h):

HVC-Bus_Adapter_RAV4h+LS600h.jpg

Sniffing data in my RAV4h:

HSD-Analyzer_RAV4h_1.jpg
HSD-Analyzer_RAV4h_2.jpg
HSD-Analyzer_RAV4h_3.jpg
HSD-Analyzer_RAV4h_4.jpg

Great job on this! One question, is the connector you used the same as the one on the inverter PCB? I have been trying to find the part for this. I believe that it's a TE TH025 series. I have ordered a single female pin, TE part 1123343, in the hope that it fits the housing (the dimensions seem to match an existing pin).

I need to extend the original wiring from the inverter logic board to the external connector (which I will replace with a more common connector, currently looking at a 31-pin Deustch connector as Ampseals in that pin count seem a little large).

The inverter/converter needs a 28 pin connector:

2x power: vcc and gnd
8x communications: htm, mth, clk, req, high and low for each
12x resolver
6x shields (4 communications, 2 resolvers)

In addition, I'd add a CAN pair for converter feedback, plus another shield. So total of 31.


The following wires from the original connector shouldn't be needed

ilko/ilko (tied to ground internally?)
hsdn (tied to 12v internally?)
g1 and its shield (engine rpm, not used)
hilux_hx
Posts: 8
Joined: Mon Jul 29, 2019 12:10 pm
Location: Berlin, Germany

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by hilux_hx »

Connectors are TE .025 series style. Sometimes from different suppliers, e.g. Misumi, Yazaki, Sumitomo, Tokai Rika, ...
These have different crimp terminals, but all fit together. It doesn't matter who the manufacture is.

TE .025 40-pin is: 1318389-1
TE .025 crimp terminals (contact lance): 1123343-1 (strip) or 1318143-1 (single pieces)
TE .025 crimp terminals for I think Sumitomo connectors (hinge lock) and TE hybrid .025/.040: 1674311-1

Hope that helps. I use the OEM connector socket of the LS600h ECU (same as on the Prius ECUs). The TE .025/.040 connectors fit these nicely, if you cut off the keying. I have the OEM wiring harness from the transmission and inverter, so this was the easiest way to connect everything together.
2004 Toyota Hilux KDN165 Double Cab conversion - using Lexus LS600h transmission and inverter.
xp677
Posts: 435
Joined: Sat Jul 27, 2019 10:53 am
Location: UK
Has thanked: 1 time
Been thanked: 13 times

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by xp677 »

That's great, many thanks. I'll use the existing connector shells from inside the inverter and add my own (longer) wires to an outside connector.

What did you do about the connector on the LS600h inverter? Did you source a mating connector for it or fit your own?
hilux_hx
Posts: 8
Joined: Mon Jul 29, 2019 12:10 pm
Location: Berlin, Germany

Re: Communicating with the Lexus GS450h Inverter/Converter

Post by hilux_hx »

xp677 wrote: Mon Aug 12, 2019 5:18 pm What did you do about the connector on the LS600h inverter? Did you source a mating connector for it or fit your own?
I brought a used Lexus LS600h engine/transmission wire harness. I was lucky, the seller cut off all necessary connectors from the other harness (inverter, oil pump controller, HVC-ECU) for me. So I got all the mating connectors and was able to modify these parts to make my own special wiring harness.
Besides these I use a lot of TE Multilock .025/.040/.070/(.090 only wire2wire) series connectors for unsealed applications, AMPseal, Superseal 1.5 and APEX 2.8 for most sealed applications.
2004 Toyota Hilux KDN165 Double Cab conversion - using Lexus LS600h transmission and inverter.
Post Reply