coulomb wrote:DBMandrake wrote: Actually doing that though would require an ECU modder who was willing to reverse engineer the firmware in the BMU - not an easy task I would think!
I have tried to do that. I have had no success getting to the BMS master firmware; I've had limited success reverse engineering the CMU firmware.
I'm not aware of anyone that has achieved this, so sadly, I think that the temperature spoofing or the CAN in the middle solution are the only viable solutions.
That's what I was afraid of.
There are significant flaws with the ideas of spoofing temperature sensors or man in the middle CAN bus though.
The man in the middle system on the CAN bus connection to the Chademo port ignores the fact that you also need to limit charging during regenerative braking. If it's more than 30kW (which I think it might be - I need to take some measurements with Canion) then you are still going to overcharge the batteries during regenerative braking. In short bursts, for sure, but still over stressing the cells.
For the temperature sensor spoofing idea, This won't give you a smooth control of charging speeds. In my testing if the cells go below about 11C the peak charge rate (achieved at low SoC) is abruptly halved to about 22kW. Below approx 0C it drops again suddenly to about 15kW and I am sure there are steps below that too.
At the other end, the full 43kW is allowed up to 40C and then it abruptly drops to about 15kW from memory. (I have measured it but don't have the figure at hand) So there is no faked temperature you can choose that would give you 30kW.
Also you have to keep in mind that this temperature reading is used to control cooling for the pack. If you pretend that the pack is only 10C to drop the charge rate in half the A/C and fan will not come on to cool the pack even if it is in fact overheated. Not good.
Or if you fake above 40C the fan and A/C will both come on full blast and may over cool the battery if it was already not very warm. So you would not be able to regulate the battery pack temperature during rapid charging which makes using alternative replacement cells even more risky.
So I'm really hesitant about the temperature sensor spoofing approach due to it screwing up temperature management of the pack.
Another factor is how would you actually implement it ? It would require CAN bus interception between the CMU's and the BMU using some sort of man in the middle device similar to the Chademo idea.
I really can't see a good solution to this other than figuring out how to reprogram the BMU, so somebody needs to get out a jtag interface and soldering iron on a spare BMU and get to work.
Has anyone approached one of the ECU unlocking services to see whether they would be willing to attempt to reverse engineer the ECU firmware given a spare unit to work with ?