[WolfTronix]

Hello,

I have a 2013 Nissan Leaf battery pack, which I am using to reverse engineer the serial protocol between the microcontroller and the balancing ICs, so I can reconfigure the pack for use in my Solectria E10, and still use the BMS.

I recently purchased a 2013 BMS on eBay and it was different than the one that came with my battery pack, so I suspect it was actually an earlier version...

The BMS that came with my battery pack uses D15120 balancing ICs.
The BMS that I got on eBay uses D15110 balancing ICs.

I have sniffed the serial protocol, and it is different between the two types of Balancing ICs.

If anyone has the Nissan Leaf BMS left over from a conversion, I would be interested in buying it if it matches the one in my battery pack.

The BMS I am looking for has:
Plastic backer, not metal.
One gray and black connector, not all white connectors:
http://www.wolftronix.com/E10_LithiumUpgrade/images/IMG_5574.jpg

Has the D15120 balancing ICs, not the D15110 balancing ICs.

If you want to follow the progress:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html
http://www.youtube.com/playlist?list=PLQdu_G7xyFIQ-hNQHEqc3in4qWGy6dpfp

Thanks,
Wolf

 

[palmer_md]

Hello,

I have a 2013 Nissan Leaf battery pack, which I am using to reverse engineer the serial protocol between the microcontroller and the balancing ICs, so I can reconfigure the pack for use in my Solectria E10, and still use the BMS.

I recently purchased a 2013 BMS on eBay and it was different than the one that came with my battery pack, so I suspect it was actually an earlier version...

The BMS that came with my battery pack uses D15120 balancing ICs.
The BMS that I got on eBay uses D15110 balancing ICs.

I have sniffed the serial protocol, and it is different between the two types of Balancing ICs.

If anyone has the Nissan Leaf BMS left over from a conversion, I would be interested in buying it if it matches the one in my battery pack.

The BMS I am looking for has:
Plastic backer, not metal.
One gray and black connector, not all white connectors:
http://www.wolftronix.com/E10_LithiumUpgrade/images/IMG_5574.jpg

Has the D15120 balancing ICs, not the D15110 balancing ICs.

If you want to follow the progress:
http://www.wolftronix.com/E10_LithiumUpgrade/index.htm
http://www.youtube.com/playlist?list=PLQdu_G7xyFIQ-hNQHEqc3in4qWGy6dpfp

Thanks,
Wolf

Very nice work on your reading of the data. I have one, but unfortunately it is from a 2011 which has the old bms as well. I'm probably going to go with an Orion BMS when I get mine installed in a vehicle.

 

[WolfTronix]

Very nice work on your reading of the data. I have one, but unfortunately it is from a 2011 which has the old bms as well. I'm probably going to go with an Orion BMS when I get mine installed in a vehicle.

Thanks,

My Solectria E10 is 144V nominal.
So I am reconfiguring the pack for 2 parallel stacks of 20 modules in series (150V).
The BMS already support a split pack.
So I just need to bypass the extra balancing chips.
And figure out the protocol to read the voltages and turn on the balance shunts.

The critical part will be seeing if the balance chips take care of the balancing on there own or if the microcontroller makes the decisions.

i.e, the microcontroller scans all 96 cells, then sends out the target voltages to the balancer chips.

Or the microcontroller scans all 96 cells, then sends out the individual shunt states to the balancer chips (I suspect this is what it does).

Either way I should know more after this week. I am building a quick battery cell simulator, so I can vary the voltages across the cells to see how the microcontroller reacts, and what packets it sends back and forth.

If this all works, then I plan on getting another 2 Nissan Leaf packs later on, should get me around a 180 - 200 mile range in the truck.

Thanks,
Wolf

 

[Weisheimer]

The videos are great!
Very impressive that you've shown a textbook example of decoding the data.

I realize that you will already know that this family of BMS is used in most of the AESC battery systems, including the Better Place packs that were available for a short time.

Thank You for posting all of this.

 

[WolfTronix]

I am not sure if the better place packs use the old BMS or the newer one... They have different serial protocols, See this video:
http://youtu.be/pyUQn75jWd0

Hopefully the video is more exciting than a text book.

The videos are great!
Very impressive that you've shown a textbook example of decoding the data.

I realize that you will already know that this family of BMS is used in most of the AESC battery systems, including the Better Place packs that were available for a short time.

Thank You for posting all of this.

 

[Tomdb]

The data you are reading is the communication bus from the bms to the car right?

This is a serial bus and not a Canbus? Mind sharing how you decoded the messages to get the voltages and other data, would be quite useful for others looking to use a Leaf pack with bms.

 

[WolfTronix]

The data you are reading is the communication bus from the bms to the car right?

This is a serial bus and not a Canbus? Mind sharing how you decoded the messages to get the voltages and other data, would be quite useful for others looking to use a Leaf pack with bms.

The CAN bus side, BMS to rest of car had been mostly worked out here:
http://www.mynissanleaf.com/viewtopic.php?t=17470

I am working on the serial protocol between the microcontroller and the 24 balancing chips.

When I reconfigure the pack for my truck, I will only have 20 balancing chips... This will cause the BMS microcontroller to get really unhappy... It keeps looking for the missing balancing chips and starts reporting trouble codes, and the VCU shuts down the pack contactors.

So I plan on figuring out how the BMS microcontroller talks to the balancing chips, so I can insert my microcontroller and use all the existing BMS hardware.
Kind of like a brain transplant.

A more elegant solution would be to read out the flash and decompile the BMS microcontroller, then modify the firmware such that it has 20 balancing chips... But I am not sure what, if any protections they have against this. Reverse engineering the serial protocol seems easier to me then reverse engineering byte code assembly.

However, I think for what I am planning, swaping in my microcontroller is the better route... Especially since I can then work with an IDE and tools and a microcontroller I am familiar with.

Also, since I will have up to six parallel strings of 20 modules in series, I want my version of the BMS to have control of its individual stack contactor. So if any cell fails I can detect it and disconnect that string from the pack automatically. Parallel stacks dumping energy into another stack with a shorted cell can be really bad.

I also want my version of the BMS to talk to my existing NLG4 charger, and AMC320 motor controllers, limiting regen and current draw for limp home mode.

Hope that answers your question,
Wolf

 

[zaxxon]

I am not sure if the better place packs use the old BMS or the newer one... They have different serial protocols, See this video:
http://youtu.be/pyUQn75jWd0

Hopefully the video is more exciting than a text book.

The BMS module in the Better Place pack I have seen, have the all white connector set. Markered: 285UF00A00 (--B) TC1209

 

[bigmotherwhale]

why dont you just trick the BMS by supplying the correct voltages to the lines that aren't connected to cells? eg with a divider network and an isolated supply.


I realise im proabbly teaching my grandma to suck eggs here... but i thought it was worth a mention

 

[WolfTronix]

why dont you just trick the BMS by supplying the correct voltages to the lines that aren't connected to cells? eg with a divider network and an isolated supply.


I realise im proabbly teaching my grandma to suck eggs here... but i thought it was worth a mention

That is exactly what I am going to do this weekend. So I can reverse engineer the serial protocol.

I have a 4 adjustable power supplies (1.97V to 4.62V) that I am going to hook up to one of the balance chips, (replacing the last 4 cells on the ground side of the pack).

Then I am going to adjust the voltages and see what changes in the serial protocol.

If I am lucky, and I set the voltages higher than the rest of the cells in the pack, I am hoping that I will see some packets that turn on the balance shunts for the higher "cells".

I might also need to trick the current sense to make the BMS think it is charging... Unless it really needs to talk to the Nissan Leaf battery charger to enable balancing mode...

 

[WolfTronix]

Made some more progress over the weekend.

Bytes 6,7,8, 9 and 10 contain the cell voltage data.

Cell voltages are packed 10 bit, 2's complement signed.

The balancing chips must contain a fully differential front end.
Even samples are +- odd samples are -+ with respect to the cell.

It looks like the Microcontroller takes the average between the samples to remove any front end bias one way or the other.

Still working on the unknown bytes in the serial stream...

Video
http://youtu.be/z2ZqNtZ8TMc

Depending on when you see this post... I might have updated the web site:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html

Thanks,
Wolf

 

[WolfTronix]

Made some more progress last night (did not get to work on it over the weekend, had to do taxes).

Bytes 11 and 12 contain a "fifth cell" voltage data. This appears to measure the balancer chips internal linear regulator. The linear regulator takes the combined 4 cell stack voltages down to 4.12-ish volts to power its self.

The reference voltage is packed 11 bit, 2's complement signed, but is only ever positive, thus full scale is 1023 = 4.545V. This is different from the individual cells... but it does not appear that the reference voltage is sampled differentialy. So this might be correct.

The remaining bits in Byte 12 and byte 13 might contain a battery "health" type value or "balanced" value (still working on this, might be missing a bit or 2), The value seems to act like a bell curve with respect to the 4 cell stack voltage.

If the cell voltages are above 4.2V, the value is low.
If the cell voltages are in the 3.2V - 4.2V, the value is higher.
If the cell voltages are lower than 3.2V, the value is low.

I will try and see what the value does when the cells are "balanced" vs not "balanced". Might gain some more insight.

I am also going to mod my battery simulator to short and open each cell with some jumpers... See if that triggers any flags in some of the 0 bytes, and/or affects the above battery "health"/"balanced" value.

Depending on when you see this post... I might have updated the web site with this new info:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html

Thanks,
Wolf

 

[WolfTronix]

"Perturb and observe" is working.

The most interesting thing is that the LEAF BMS balances all the time.
Once cells are out of range the balance shunts start tuning on, will probably post a video tonight.

More info:

Bytes 13 and 14 contain a "sixth cell" voltage data. This appears to measure the balancer chips internal ground connection. Typically returns 0... but every once in a while there is a 1 bit change. Still not sure, but I think it is 11 bit, 2's complement signed, like the reference voltage measurement.

Byte 16 upper 2 bits seems to encode some chip status... I have seen these change, but not sure what they mean.

Bytes 4 and 5 are also status bytes... Upper and lower nibbles encode shunt status, over volt status, under volt status and converter fault status.

Byte 3 upper 2 bits also encode chip status... I have seen 0xF2 become 0xFA if the cell voltages get too low, such that it has problems powering its self.

Most importantly
Command packet:
0x55 0x99 0xXX 0xFY 0xZZ
controls the balance shunts.

Such that:
0xXX = 0x21 - 0x38 = chip address
0xFY = lower nibble is which shunt should be enabled.
0xZZ = CRC8 check sum.

There are a few other control packets that I don't know what they do yet...

I am going to heat up the three temperature sensors and see if any of the control packet data changes. Same with adjusting the current sensor.

Then I think I have enough info to start modifying the BMS for different pack configurations.

Depending on when you see this post... I might have updated the web site with this new info:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html

Thanks,
Wolf

 

[AntronX]

Great work, cant wait to see your progress on DC converter.

 

[Coulomb]

The most interesting thing is that the LEAF BMS balances all the time.

Interesting. A friend of mine and I had a quick look at the Leaf BMS, and concluded that the bypass resistors must be 430 ohms. So that's less than 10 mA of bypass current. If this is correct, we figured it must be bypassing all the time. Your findings seem to confirm this theory.

http://forums.aeva.asn.au/bms-and-contactor-box_topic4278_post56055.html

Do you have a way of measuring the bypass current? Or can you confirm or disprove our tentative conclusion? Just curious.

Edit: the schematic down a few posts might also come in handy, in the unlikely case that you haven't found one yet.

 

[WolfTronix]

Yeah the shunt resistors are only 430 ohms so under 10mA.

Actually the balancer chips when active draw 5mA (when the shunt is off), and 0mA (need a better meter), when not sampling the cells.

The current was measured using a 1ohm resistor on my cell simulator:

I am uploading a youtube video with the findings right now... but it still has about 4 hours left to upload (I have a slow internet connection). ;P

It should get added to this playlist:
http://www.youtube.com/playlist?list=PLQdu_G7xyFIQ-hNQHEqc3in4qWGy6dpfp

Thanks,
Wolf

 

[WolfTronix]

Here is the latest video:
http://youtu.be/E-hDNjh4qyc

Enjoy,
Wolf

 

[Tomdb]

thanks for the work.

Also good diagram of the cell simulator, will be usefull to reverse engineer any bms system.

 

[WolfTronix]

thanks for the work.

Also good diagram of the cell simulator, will be usefull to reverse engineer any bms system.

No problem...

For those that want to recreate it:

On the primary of the transformer, the MOSFETs are turned on out of phase with each other at around 50kHz, (slightly less than 50% duty cycle to prevent cross conduction).

And I would multiply all the resistors by 1000, (except the 1 ohm current sense resistor).

The resistor values are scaled for the 100 ohm 20 turn pots I all ready had... and the regulators get a bit warm to the touch.

Also, there is a 0.1uF ceramic cap across each 33uF electrolytic cap.

And cap values where chosen from the stock I all ready had...

It is literally built out of spare parts, here is a time lapse video of its construction:
http://youtu.be/TVPOZZTasEg

Thanks,
Wolf

 

[WolfTronix]

Over the last few days I mapped out all 100 pins of the Nissan Leaf BMS microcontroller.

And I finished a board layout to adapt a dsPIC33EV256GM106 microcontroller to the PD70F3236 microcontroller footprint.

This will let me replace the existing microcontroller, and then I will have full control over the BMS hardware.

Enjoy:
http://youtu.be/1minD17pGnQ

Depending on when you see this post... I might have updated the web site with this new info:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html