DBMandrake wrote: Finding the secret sauce to easily renumber CMU's using a readily available third party diagnostic tool such as Hobdrive / icarsoft etc (no soldering/eeprom swapping) would be a breakthrough for the DIY and aftermarket repair and servicing of these battery packs.
I'm making slow progress on reading CMU firmware, and I think I've got to the stage where I can speculate how this happens.
1) It
may be necessary to start with a CAn bus message (on the bus that CMUs are on, I don't know if messages from the main CAN bus pass through the BMU to the CMU) with message ID 0x3C3 (the same one that does bypassing), with D4 set to 4 (or at least, has D4[2] set). You can't say "leave the bypass bits alone", so you have to choose what you want with the bypass bits if you want to send a 3C3 message. All zeroes for the rest of the packet should force no bypassing.
2) The BMU sends the following 5-byte packet over the daisy chain, which connects to UARTD1 on the CMU processors:
00 FF 0F 00 0E
The first byte (D1) appears to be unused, and it initialised to 0. But the BMU may send different contents.
The next 3 bytes are what sets the CMU ID. We want CMU ID 1 at the start of the chain, and strangely this is in about the middle of a table. So we need 6 non-zero pairs of bits, starting with the LSBs of D2, indicating that we don't want IDs 7, 8, ... 12. With bits 4 and 5 set to zero, the first BMU sets its ID to 1, and the rest of the bits of D2 and D3 have to be zero, or it will get cancelled. I have set both bits in the pair in my example; sometimes the CMUs send only odd bits (so e.g. D2 would be 0x55), or even bits (0xAA), or both bits (0xFF, as I have here).
The last byte (D5) is the sum of bytes D2-D4.
[ Edit: these packets are probably sent at 300bps; see next post. ]
I believe that a task function is awoken that will save the new ID into EEPROM (the first word, it seems to me, though it's possible that it moves around).
So: not terribly convenient perhaps, but it should be possible to make up a gizmo that plugs into the appropriate connector and sends the bytes.
[ Edit: "first byte" -> "first word" ]