I have been trying to re-purpose an iPace 90kWh battery & connect it standalone without the car.
The components which are connected are the BECM, balancer circuit boards & BEM (containing contactors).
I have the BECM connected on the desk (with just canbus & power), with a canbus adaptor into SavvyCAN at 500kHz...
It seems to be using UDS and I can write to 0x7e4 & read from 0x7ec. Which seems to be very close to a Hyundai Kona battery (they are both LG Chem)!
I've managed to use caringcaribou to dump the DIDs and cross reference to the manual ... there appears to be a lot there..
I am reading no error codes on the BECM over UDA (or am reading them wrongly !). Even though I don't have all of the equipment connected (e.g coolant sensor), the BECM is not showing any error codes. Wonder if it's just stuck? If I remove the wiring to either precharge relay coil, I get a single error occur `P0AE1-14 Hybrid/EV Battery Precharge Contactor Circuit -Circuit short to ground or open` which is as expected. But I would expect more than one error...
I have a log of the car enabling the battery and hope to use that to move forward... The main thing I haven't managed to do is engage the contactors in the BEM.
Any ideas on how I can try to engage the relays?
I thought it would be manually engaged over CAN, since the manual says:
The HV DC connector to the HVCCM.
The HV DC connector to the front inverter.
The HV DC connector to the rear inverter.
The connector for the external EV battery coolant temperature sensors.
The main wiring harness connector with 18 pins for the following connections (Not all connections are used):
The external HV interlock loop (quantity 2).
A connection from the Restraints Control Module (RCM).
The BECM monitors the following:
The EV battery module cell voltages.
Internal EV battery module temperatures.
The HV interlock loop.
The HV DC voltages at various points in the Battery Electrical Module (BEM).
The HV DC BEM current sensors in the BEM.The EV battery coolant temperature sensors on the coolant inlet and outlet connections.
The BECM also controls the contactors in the BEM to isolate the EV battery when the HV interlock loop is broken or the SDU key is removed.
The BECM communicates with the HV system and other vehicle systems through the HS CAN power mode zero systems bus.
The BECM controls the following EV battery temperature control components:
The EV battery coolant pump
The EV battery changeover valve.
When an HV DC connection on any of the previously described connectors is removed, the HV interlock loop circuit is broken. The BECM detects the break and sends the HV interlock loop status to the Powertrain Control Module (PCM). If the vehicle is stationary the PCM requests the BECM to break the HV circuit. The BECM de- energizes all 3 contactors in the BEM to electrically disconnect the EV battery and the HV circuits discharge.
The BECM records any DTC and related data. The DTC and related data are read using the approved diagnostic equipment.
The JLR approved diagnostic equipment enables certain components to be activated and also read live data.
The EV battery expansion tank coolant level sensor is hardwired by the wiring harness to the Powertrain Control Module (PCM). When the EV battery coolant in the EV battery expansion tank is less than the minimum level. The EV battery coolant level sensor sends a signal to the PCM.
There is a 10Hz ENS crash signal on the battery connector coming from the Restraints Control Module (RCM), which is engaged when the contactors are on, I wonder if that is engaging the relays?
Re: iPace battery BECM hacking...
Posted: Sun Jun 23, 2024 11:45 am
by obbardc
I have a spreadsheet with the BECM connector pinouts mapped (from service manual and existing work online):
Still have some work to do with the pinout, but for now it is functional.
So currently I have just the BECM connected on the desk, with simply:
- 12V from bench power supply connected to BECM_PWR & CONTACTOR_PWR
- CAN connected to SavvyCAN through V_CAN (120R termination resistor)
I've attached a screenshot from SavvyCAN showing the UDS ID present on this board.
I scanned the following services & read the data from that ID:
caringcaribou dcm services 0x7e4 0x7ec
Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL
Supported service 0x11: ECU_RESET
Supported service 0x14: CLEAR_DIAGNOSTIC_INFORMATION
Supported service 0x19: READ_DTC_INFORMATION
Supported service 0x22: READ_DATA_BY_IDENTIFIER
Supported service 0x37: REQUEST_TRANSFER_EXIT
Supported service 0x3e: TESTER_PRESENT
Supported service 0x85: CONTROL_DTC_SETTING
and also the following DIDs (of course data is with nothing else connected....)
P0AE1-14 - Hybrid/EV Battery Precharge Contactor Circuit -Circuit short to ground or open
Because of this error code, I thought about wiring in the precharge coils (i have just put a 50R resistor for now) to PC_CONTACTOR_PWR to PCMAIN+_CONTACTOR_C & PC_CONTACTOR_PWR to PCANCIL CONTACTOR_C Then after clearing & resetting power I get no error codes reported and if I remove that resistor the error code comes back.
I would expect many more error codes as I've not connected ANYTHING to the system....
Re: iPace battery BECM hacking...
Posted: Sun Jun 23, 2024 12:04 pm
by obbardc
After reading the error codes, the car seems to then read out a big dump from an error code using Report DTC Snapshot Record By DTC Number
TX (0x7e4 0x19 [0x04, datA, datB, datC, 0xff]) with the three bytes datA datB datC being the error code read from the previous message(e.g 0xa 0xe1 0x14 OR 0 0 0 if no reported error also seems to work)
The car logs get 506 bytes out here; manually prodding this BECM I get 460 bytes out.
No clue how to decode this message or what it contains as yet. Looks like a custom vendor message ?
I am collating the PIDs/error codes from various sources.
Still no wiser about how to enable the contactors
Re: iPace battery BECM hacking...
Posted: Mon Jun 24, 2024 3:24 pm
by obbardc
So I've written some rust to clear/read the error codes from the BECM using PC as a controller.
Manage to read some error messages now. But I still expect more. I think the BECM isn't going into the "operational" mode for some reason.
- Error codes are saved between BECM boots.
- Removing either precharge coil (~50R) => logged `P0AE1-14 Hybrid/EV Battery Precharge Contactor Circuit -Circuit short to ground or open`
- Replaying the car turning on (minus 0x7e4, 0x7ec) => no error
- Undervolting(~8V)/overvolting(~16V) module => no error
- Connecting ENS_IN to 12V, 20V, 0V, open => no error
- Badly formatted CAN UDS message (e.g sending unpadded message `cansend can0 7e4#0322f197, cansend can0 7e4#031902ff`) => no error
- Changing CAN rate to 1MHz, sending message `sudo ip link set can0 down; sudo ip link set can0 up type can bitrate 1000000; cansend can0 7e4#0322f197` => BECM hangs & `U3001-00 Control module improper shutdown` logged (Google says: `U3001-00 is an OBD diagnostic trouble code indicating a manufacturer-specific fault with the vehicle user network`)
- Changing CAN rate & removing precharge coil resistor results in two logged errors: `P0AE1-14 & U3001-00`
Re: iPace battery BECM hacking...
Posted: Mon Jun 24, 2024 5:37 pm
by obbardc
OK rescanning the uds services with caringcaribou now shows additional two services. I read it wrong before.
caringcaribou uds services 0x7e4 0x7ec
Probing service 0xff (255/255): found 10
Supported service 0x10: DIAGNOSTIC_SESSION_CONTROL
Supported service 0x11: ECU_RESET
Supported service 0x14: CLEAR_DIAGNOSTIC_INFORMATION
Supported service 0x19: READ_DTC_INFORMATION
Supported service 0x22: READ_DATA_BY_IDENTIFIER
Supported service 0x27: SECURITY_ACCESS
Supported service 0x2f: INPUT_OUTPUT_CONTROL_BY_IDENTIFIER
Supported service 0x31: ROUTINE_CONTROL
Supported service 0x3e: TESTER_PRESENT
Supported service 0x85: CONTROL_DTC_SETTING
So these are supported...
Supported service 0x27: SECURITY_ACCESS
Supported service 0x2f: INPUT_OUTPUT_CONTROL_BY_IDENTIFIER
Supported service 0x31: ROUTINE_CONTROL
The manual says 0x2020 is a possible "Self test routine" which can be played, but having no luck trying to start it. Maybe it needs security access.
P0A0A-13 High voltage interlock loop circuit open circuit
P0A9B-12 Positive&negative contactor temperature sensor circuit short circuit to power
P0ABF-64 Battery energy control module software is not at latest version Seems OK to ignore.
P0AE1-14 Hybrid/EV Battery Precharge Contactor Circuit - Circuit short to ground or open
P0B0E-14 Hybrid/EV Battery Pack Current Sensor "B" Circuit - Circuit short to ground or open
P0C42-12 Hybrid/EV Battery Pack Coolant Temperature Sensor "A" Circuit - Circuit short to battery
P0CD5-12 Hybrid/EV Battery Pack Coolant Temperature Sensor "B" Circuit - Circuit short to battery
P3043-13 Hybrid/EV Battery Cell Supervisory Circuit "A" Circuit open
P3044-13 Hybrid/EV Battery Cell Supervisory Circuit "B" Circuit open
P3045-13 Hybrid/EV Battery Cell Supervisory Circuit "C" Circuit open
P3046-13 Hybrid/EV Battery Cell Supervisory Circuit "D" Circuit open
P3047-13 Hybrid/EV Battery Cell Supervisory Circuit "E" Circuit open
P3048-13 Hybrid/EV Battery Cell Supervisory Circuit "F" Circuit open
U0064-87 Vehicle Communication Bus E - Missing message
P0A1F-93 Main current sensor failure
U3001-00 Control Module Improper Shutdown
So I will try to narrow it down to which CAN message from caringcaribou caused it to go into this "working-ish" mode....
Re: iPace battery BECM hacking...
Posted: Mon Jul 08, 2024 4:43 pm
by obbardc
@cjdell yeah, that is me in the video (chris)
We're working on Part2 as we speak, perhaps this is a working real-time "dev log"
Re: iPace battery BECM hacking...
Posted: Mon Jul 08, 2024 5:04 pm
by obbardc
So seems like sending specific UDS data to 0x012 `cansend can0 012#0210010000000000` then I get all of the above errors logged....
Re: iPace battery BECM hacking...
Posted: Mon Jul 08, 2024 7:52 pm
by pemtek
Those errors seem like something is unplugged?
I have 2 of those batteries here so I am keen to see how this goes.
Phil
Re: iPace battery BECM hacking...
Posted: Mon Jul 08, 2024 9:41 pm
by obbardc
Yeah, this is with the BECM connected on the desk (with just canbus & 12V), so lots unplugged. I am trying to reconnect bits one at a time !
Re: iPace battery BECM hacking...
Posted: Fri Jul 12, 2024 1:46 pm
by MX5EV
I just posted in the comments on this video that you should come here or to https://endless-sphere.com/. Hopefully, the battery isn't security locked. If you can read the data from the battery you can safely override the contactors and write your own code to handle when to open or close them.
Re: iPace battery BECM hacking...
Posted: Sat Mar 29, 2025 2:52 pm
by RobotDad
Hi,
I'm now the proud owner of a iPace battery! Has anyone else made any progress on using the built in BMS? In particular controlling contactors? Or is this impossible?
