DBMandrake
Posts: 286
Joined: Mon Mar 20, 2017 4:57 am
Location: Scotland

Re: Hack DC charging - limit to 30kW

Thu Dec 05, 2019 2:26 am

coulomb wrote:
DBMandrake wrote: Actually doing that though would require an ECU modder who was willing to reverse engineer the firmware in the BMU - not an easy task I would think!

I have tried to do that. I have had no success getting to the BMS master firmware; I've had limited success reverse engineering the CMU firmware.

I'm not aware of anyone that has achieved this, so sadly, I think that the temperature spoofing or the CAN in the middle solution are the only viable solutions.

That's what I was afraid of.

There are significant flaws with the ideas of spoofing temperature sensors or man in the middle CAN bus though.

The man in the middle system on the CAN bus connection to the Chademo port ignores the fact that you also need to limit charging during regenerative braking. If it's more than 30kW (which I think it might be - I need to take some measurements with Canion) then you are still going to overcharge the batteries during regenerative braking. In short bursts, for sure, but still over stressing the cells.

For the temperature sensor spoofing idea, This won't give you a smooth control of charging speeds. In my testing if the cells go below about 11C the peak charge rate (achieved at low SoC) is abruptly halved to about 22kW. Below approx 0C it drops again suddenly to about 15kW and I am sure there are steps below that too.

At the other end, the full 43kW is allowed up to 40C and then it abruptly drops to about 15kW from memory. (I have measured it but don't have the figure at hand) So there is no faked temperature you can choose that would give you 30kW.

Also you have to keep in mind that this temperature reading is used to control cooling for the pack. If you pretend that the pack is only 10C to drop the charge rate in half the A/C and fan will not come on to cool the pack even if it is in fact overheated. Not good.

Or if you fake above 40C the fan and A/C will both come on full blast and may over cool the battery if it was already not very warm. So you would not be able to regulate the battery pack temperature during rapid charging which makes using alternative replacement cells even more risky.

So I'm really hesitant about the temperature sensor spoofing approach due to it screwing up temperature management of the pack.

Another factor is how would you actually implement it ? It would require CAN bus interception between the CMU's and the BMU using some sort of man in the middle device similar to the Chademo idea.

I really can't see a good solution to this other than figuring out how to reprogram the BMU, so somebody needs to get out a jtag interface and soldering iron on a spare BMU and get to work. :twisted:

Has anyone approached one of the ECU unlocking services to see whether they would be willing to attempt to reverse engineer the ECU firmware given a spare unit to work with ?
- Simon

EV: 2011 Peugeot Ion
ICE: 1997 Citroen Xantia V6

dracekvo
Posts: 30
Joined: Tue Sep 11, 2018 12:18 am
Location: Czech. Rep.

Re: Hack DC charging - limit to 30kW

Thu Dec 05, 2019 4:57 am

For regeneration.
Is possible just drive not D but on C.
But whot doing C if I will press brake pedal? I cant test it. I have Peugeot ION. There is B and C hidden, but i can unlock.

About thermal hack.
I dont need exactly 30kW. 22kW is good.

I mean on BMS board is classic thermistor. It is possible remove him and replace any small mCU (pic, atmega).
mCU will simulate 10°C all time (no start heating, no start cooling). Only if temperature goes from normal value. mCU stop simulate and start return real temperature.

I hope this is clear. My english is bad.

kiev
Posts: 1226
Joined: Sun May 03, 2015 7:15 am
Location: The Heart o' Dixie
Contact: Website

Re: Hack DC charging - limit to 30kW

Thu Dec 05, 2019 7:31 am

Your english is fine; And your most clever and excellent idea of using a PIC or ucontroller to simulate the temperature sensors is great!

There are 3 sensors on each CMU board and 22 boards. But i wonder if the DCQC current pull-back might be triggered by only one sensor reading low, or a few sensors reading low, or if all must agree. For example if only one sensor in 5 or 10 modules would cause it to trigger, then it would reduce the amount of extra components and soldering.

We don't know much about this Mits Operating System, but i'm wondering if it is programmed such that if any one sensor is out of range with all the rest, then it is considered a sensor fault; but if several are low then it believes that it is getting cold outside?
kiev = kenny's innovative electric vehicle

DBMandrake
Posts: 286
Joined: Mon Mar 20, 2017 4:57 am
Location: Scotland

Re: Hack DC charging - limit to 30kW

Thu Dec 05, 2019 8:15 am

kiev wrote:There are 3 sensors on each CMU board and 22 boards. But i wonder if the DCQC current pull-back might be triggered by only one sensor reading low, or a few sensors reading low, or if all must agree. For example if only one sensor in 5 or 10 modules would cause it to trigger, then it would reduce the amount of extra components and soldering.

We don't know much about this Mits Operating System, but i'm wondering if it is programmed such that if any one sensor is out of range with all the rest, then it is considered a sensor fault; but if several are low then it believes that it is getting cold outside?

It only takes one cell temperature sensor to trigger changes in charging speeds or battery pack cooling.

One sensor below 11C will halve the charging rate to 22kW. One sensor above 20C will enable the blower fan, one sensor above 30C will enable blower+A/C compressor, one sensor above 40C will cut the charging rate etc...

I've confirmed this by monitoring cell temperatures and charging rates with Canion, including on a trip I went on where I was testing the car to its limits and actually managed to get the hottest cell up to 46C after multiple motorway/rapid charge sessions in a row...

My concern with only varying a single sensor would be whether too great a difference between cells would result in a fault code being set. Having said that, in the above instance of 46C the coldest sensor at the same time was only 30C and no fault was set. When the car is repeatedly Chademo charged or driven hard the cell temperatures can diverge quite dramatically.

Hmm... perhaps simply hard coding one sensor to read around 10C would be all that's needed as the higher and lower temperature readings from other cells would still initiate further speed reductions when very cold or very hot and/or bring on the blower fan and/or AC at higher temperatures despite one cell still reading 10C...
- Simon

EV: 2011 Peugeot Ion
ICE: 1997 Citroen Xantia V6

kiev
Posts: 1226
Joined: Sun May 03, 2015 7:15 am
Location: The Heart o' Dixie
Contact: Website

Re: Hack DC charging - limit to 30kW

Sat Dec 07, 2019 6:49 am

DBMandrake wrote:It only takes one cell temperature sensor to trigger changes in charging speeds or battery pack cooling.

One sensor below 11C will halve the charging rate to 22kW. One sensor above 20C will enable the blower fan, one sensor above 30C will enable blower+A/C compressor, one sensor above 40C will cut the charging rate etc...

I've confirmed this by monitoring cell temperatures and charging rates with Canion, including on a trip I went on where I was testing the car to its limits and actually managed to get the hottest cell up to 46C after multiple motorway/rapid charge sessions in a row...


That is excellent testing! And exactly answers the question of how many sensors.

And so the temperature might be spoofed either low or high to limit the rate, but the high end enables blower and A/C to help cool the pack.
kiev = kenny's innovative electric vehicle

dracekvo
Posts: 30
Joined: Tue Sep 11, 2018 12:18 am
Location: Czech. Rep.

Re: Hack DC charging - limit to 30kW

Tue Mar 10, 2020 12:41 pm

Today I make order 6pcs Lanzhd 21700 5000mAh for testing from aliexpress.
Chinese copy samsung. Cells 18650 3300mAh is very good.
http://forum.mypower.cz/viewtopic.php?f ... ad#p117640

If I make good calculation. On LEV50 dimension is possible take 20psc.

So I will make test what happend if charger current will be 6.25A (chademo charging 125A) with limit 4,1V. Maybe cells 21700 can do it.
If will be degradated fast or overheat. Will be necessary make temperature hack.

dracekvo
Posts: 30
Joined: Tue Sep 11, 2018 12:18 am
Location: Czech. Rep.

Re: Hack DC charging - limit to 30kW

Tue Mar 31, 2020 4:27 am

First stress test. I was simulate chademo charging. 125A / 20cells = 6,25A to one cell.
Charging from 3.3V to 4.1V. Current 6.2A. Cell did not exceed 40°C
Now I make exact cappacity test. And I will repeat stress test many times (between 50 and 100). After that i will make again cappacity test.

If will battery not degradate too much. Chademo hack is not necessary.

Return to “Batteries and Battery Management”