There is one master BMS and six secondary modules. Each secondary has two identical sections: BMS chip (76PL455ATQ) and MCU for communication. There is galvanic isolation between the BMS IC and MCU. (Picture)
Each section monitors nine cells (3 battery modules) or 18 cells for one secondary module. The I-pace battery is a 108S configuration consisting of 36 battery modules. Part of the BMS schematic is here.
There is an internal CAN bus between the master and secondary modules at 500kbps speed. The ISA current shunt is also connected to this bus.
As the first step, I started exploring the secondary modules. There is a 20-pin connector for power supply and communication. The mating part is Molex 34824-0204.
After attaching 12 V to the module, it starts sending CAN data (it requires a CAN bus termination):
No battery module is connected in this test. The data repeats every 100 ms.(000.085557) can0 124 [8] 39 1E 01 FF 6F 00 FF C8
(000.000039) can0 123 [8] FF FF DF FF 3F FF FF FF
(000.000535) can0 121 [8] 1F FF 1F FF 1F FF FF FF
(000.000031) can0 122 [8] 3F FF 9F FF 1F FF FF FF
(000.011435) can0 114 [8] 39 1E 01 FF 6F 00 FF 78
(000.000220) can0 113 [8] FF FF DF FF 3F FF FF FF
(000.000222) can0 111 [8] 1F FF 1F FF 1F FF FF FF
(000.000282) can0 112 [8] 3F FF 9F FF 1F FF FF FF
The next step was to connect three battery modules. (I have only four available at my lab) There is a specific connection order, and I followed the BMS schematic. After that, the data looks promising:
I've filtered CAN data only from the section with connected cells, and it was easy to find that frames 111, 112, and 113 contain cell data. The first six bytes in each frame are three cell voltages, and the last two are temperatures.can0 114 [8] 39 1E 01 58 70 64 3F 10
can0 113 [8] 0E F7 0E F8 0E F8 39 39
can0 111 [8] 0E F5 0E F5 0E F6 39 39
can0 112 [8] 0E F5 0E F5 0E F6 39 39
The cell voltage encoding is straightforward: 0xEF7 = 3831mV; I'm unsure if the temperatures 0x39 = 57 may be divided by four to get the actual temperature.
For frame 114, I can say nothing except that byte 8 is alive counter. I will do more testing, and now I'm attaching one log file with live data.
And one picture of the device under test:
To be continued...