Page 1 of 1

Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Mon Feb 26, 2024 1:33 pm
by johu
This morning I ran the Zoe motor with the i3 inverter. I found 12V on the excitation results in 1.3A of current. Did get up to 15 Hz then it desychronizes and just rattles. I supplied excitation from a battery. When supplied from a power supply it jumps around a lot when running.

Anyway, it's about the inverter, not the motor. Got it on the table here and trying to get some life out of it. Connected chassis to GND and the yellow wire to 12V. Then results in 5 mA of current. The red wire doesn't really do anything. Also monitored the CAN channels but they don't produce anything either. Put one of the CAN messages from here on the bus but that doesn't wake it up either.

The colours in the wiring diagrams seem to be all in French and abbreviated. Also supplied 12V directly to the large elcap bu that also yielded nothing.

Ok, onto the gate driver board. I did ring out a few signals, like pins of the bidirectional isolator that send the PWM across the galvanic barrier. And the current sensors.

Weirdly all 5V supplies are split up. The low side isolators share common 5V, the high side another common 5V (I assume it's 5V) and another 5V goes to the current sensors. All not interconnected. Weird.

Tried to fire up the gate drive power supplies but also with no luck. Fed 12V to the larger film caps next to something that looks like a driver IC but that resulted in no current draw at all.

Not the best start, hints appreciated

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Tue Feb 27, 2024 10:57 am
by johu
Everybody's gotta have a Damien.
Got some CAN logs and just played some back into the sleepy inverter and suddenly it wakes up and draws roughly 900 mA :)

The inverter itself responds with 0x196, 19F, 1A1, 422, 42C and 511 most of which are not in the table above.

EDIT: it's sufficient to keep sending message 0x423 to keep the inverter awake and sending CAN.

Still not sure if I can make it run that way but at least no I can take measurements

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Thu Mar 28, 2024 12:21 pm
by johu
Taking baby steps. I'm trying to figure out the position sensor which I expected to be a resolver. But it isn't.
I have the wiring diagrams and there the pins are called
- Ground
- Supply (measures as permanent 5V)
- Position Signal 1
- Position Signal 2

So I though ok, it must be some sort of position sensor IC that outputs a sin and a cos signal. So had the Analog Discovery supply 5V and then measured Signal 1 and 2. Hmm Signal 2 jumps to 5V, Signal 1 stays at 0. Moving the motor yields no change.

So I thought maybe it's some data protocol, one of them is clock an the other an encoded position. So clocked one signal with 500 kHz while monitoring the other. Nothing. Hints appreciated

For reverse engineering the inverter I'll need to make a brakeout board first because of all the flatflex
grafik.png

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Thu Mar 28, 2024 1:14 pm
by tom91
How hard is it to remove the board to look at the physical IC for the position sensor?

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Fri Mar 29, 2024 12:45 pm
by johu
tom91 wrote: Thu Mar 28, 2024 1:14 pm How hard is it to remove the board to look at the physical IC for the position sensor?
I tried to do so today and that led to the answer :D The connector in the back (i.e. where the phase cables enter) is NOT the position sensor. It is the temperature sensor and part of the interlock loop.

The position sensor sits in the front, et voila:
position sensor.png
EDIT
Next I tried supplying with 4V instead of 5V:
position sensor 4V.png
That shifts the signal into the input range of our ADC

Then I connected channel 2 to phases 1 and 2 and supplied the excitation winding with 12V:
position sensor 4V and phase.png
So respolepairs=polepairs
The ratio is more important then the absolute value.

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Wed Apr 10, 2024 7:16 pm
by johu
Now continuing with some more gate driver research. The isolators are ISO7421 from TI. https://www.ti.com/product/de-de/ISO7421

They have one forward one reverse channel. Traced the 6 forward channels that gives me the 6 gate drive signals and the 6 reverse channels give me the 6 desat signals. The forward channels have a 200 Ohm series resistor

Then there are separate logic supplies for high and lowside, and separate supplies for the current sensors.

With all that and the many, many GNDs 43 out of 50 pins of the gate drive ribbon are now traced.

The excitation ribbon is just 20 pins, 6 GNDs, 2 15V and various 5V supplies. I think I'll just trial and error that as it's hard to measure

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Thu Apr 11, 2024 4:37 pm
by johu
First cut of a breakout board with mini mainboard for first tests
grafik.png

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Mon Apr 22, 2024 8:36 pm
by johu
Good testing day today. Got the main inverter and the exciter inverter going.
1713815378169.jpg
All runs fine from 3V3 control signals.

I haven't found temperature and bus voltage signals so maybe that is on SPI comms again. But I also found that I forgot to break out two pins so will check these next.

Latest pin map is attached

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Tue Apr 23, 2024 7:22 pm
by johu
And we have liftoff :)

Applied about 2A excitation current and then did the syncofs calibration. Then used idlespeed to spin at 1000 rpm. Works a treat. Emits some alien sounds, not sure if that is mechanical or electrical. Video coming soon.

Remaining question: how do we determine inverter temperature and bus voltage?
And for another experiment: how do we enable the DC/DC converter?

Re: Renault Zoe (Continental) Inverter Reverse Engineering

Posted: Mon Apr 29, 2024 6:37 pm
by johu
Spied the "comms" with the DC-DC converter today by sandwiching a breakout board between stock logic board and DC-DC converter.

It is mostly static voltages but there is some rather strange comms going on.

On one pin the logic board sends an 11.2 MHz clock, on another a 2.8 MHz clock at 1.8V levels and finally it receives a 9.95 MHz clock and data and two other pins. I reckon it is a sync serial unidirectional protocol because I couldn't find any data upstream of the logic board. I captures a few frames.

Code: Select all

7E BF 80 D6 BF 11 7C BF 5F F9 6C BF 1F FE F6 BF AF
7E BF 80 D6 BF 11 7C BF 5F F9 6C BF 1F FE EC BF 87
7E BF 80 D6 BF 11 7C BF 5F F9 6C BF 1F FE DE FC 9F F5
7E BF 80 D6 BF 11 7C BF 5F F9 6C BF 1F FE CC BF AF 87 FE
The Analog Discovery seems to have a hard time keeping up with the speed so there might be bytes missing. A remember 7E being some HDLC delimiter so I just assumed it to be a frame start or end. Could apply some voltage to see if something changes.