Hack DC charging - limit to 30kW

[dracekvo]

Hello,

There is someone clever person? My question is simple. Is a way how to limit DC charging to 30-40 kW?

 

[DBMandrake]

In what circumstances and to what end ?

Keep in mind that the maximum power (current actually) is negotiated between the car and the charger. The charger is able to signal to the car the maximum power that it can provide, and there are actually many 22kW Chademo rapid chargers out in the wild that don't operate to a full 43kW.

 

[dracekvo]

In my head is solution. Replace battery LEV50 to 18650 cells (25pcs). But here is limit to charing current about 80A (30kW).
In my country is only 50kW chademo.
This is too much for battery from 18650 cells. If I will use this charging method, battery will be quick degradation.

I mean. Somewhere in car software must be value where is write maximum DC current. But question is where. And how to change it.

 

[DBMandrake]

I understand now.

Ultimately the charging current decision is made by the BMU, so the cleanest way to achieve it would be to reprogram the BMU to limit the maximum charging rate.

Actually doing that though would require an ECU modder who was willing to reverse engineer the firmware in the BMU - not an easy task I would think!

The other option would be to intercept the Chademo communication and insert a "man in the middle" device that understood the protocol and modified the communications between the BMU and the Rapid charger unit. Also not easy.

 

[kiev]

i wonder if the temperature of the pack could be used to throttle back the DC charging current?

For example use some sort of variable voltage to simulate the pack temperature and fake out the BMU.

 

[Don]

Maybe source a better 18650 cell?? Some Teslas came equipped with 18650's and they don't mind charge currents a lot higher than 30 Kw

Don

 

[kiev]

Tesla uses active cooling with a liquid loop that touches each cell, so they can push higher currents than a passive or air-cooled system.

 

[Don]

Tesla uses active cooling with a liquid loop that touches each cell, so they can push higher currents than a passive or air-cooled system.

True, but not all 18650's are created equal, are they? Some can safely be recharged at a higher rate

Don

 

[dracekvo]

Yes, high drain cell is way. But
I find Molicel 2000mAh. If I will use 25pcs cappacity will be 50Ah. No range upgrade. No sense try replace LEV to another cells.
Molicel have 6A charge current. 6x25 = 150A. Nice for imiev.
https://nexun.pl/pl/p/Molicel-IHR18650C-2050mAh/592

Is Molicel with higer capacity 2600 or 2800mAh with 6A charge too. But price is too much.

https://eu.nkon.nl/rechargeable/li-ion/18650-size/molicel-p26a-imr18650-2600mah-5a.html
https://eu.nkon.nl/rechargeable/li-ion/18650-size/molicel-inr18650-p28a-2800mah-35a.html

 

[coulomb]

Actually doing that though would require an ECU modder who was willing to reverse engineer the firmware in the BMU - not an easy task I would think!

I have tried to do that. I have had no success getting to the BMS master firmware; I've had limited success reverse engineering the CMU firmware.

I'm not aware of anyone that has achieved this, so sadly, I think that the temperature spoofing or the CAN in the middle solution are the only viable solutions.

 

[DBMandrake]

Actually doing that though would require an ECU modder who was willing to reverse engineer the firmware in the BMU - not an easy task I would think!

I have tried to do that. I have had no success getting to the BMS master firmware; I've had limited success reverse engineering the CMU firmware.

I'm not aware of anyone that has achieved this, so sadly, I think that the temperature spoofing or the CAN in the middle solution are the only viable solutions.

That's what I was afraid of.

There are significant flaws with the ideas of spoofing temperature sensors or man in the middle CAN bus though.

The man in the middle system on the CAN bus connection to the Chademo port ignores the fact that you also need to limit charging during regenerative braking. If it's more than 30kW (which I think it might be - I need to take some measurements with Canion) then you are still going to overcharge the batteries during regenerative braking. In short bursts, for sure, but still over stressing the cells.

For the temperature sensor spoofing idea, This won't give you a smooth control of charging speeds. In my testing if the cells go below about 11C the peak charge rate (achieved at low SoC) is abruptly halved to about 22kW. Below approx 0C it drops again suddenly to about 15kW and I am sure there are steps below that too.

At the other end, the full 43kW is allowed up to 40C and then it abruptly drops to about 15kW from memory. (I have measured it but don't have the figure at hand) So there is no faked temperature you can choose that would give you 30kW.

Also you have to keep in mind that this temperature reading is used to control cooling for the pack. If you pretend that the pack is only 10C to drop the charge rate in half the A/C and fan will not come on to cool the pack even if it is in fact overheated. Not good.

Or if you fake above 40C the fan and A/C will both come on full blast and may over cool the battery if it was already not very warm. So you would not be able to regulate the battery pack temperature during rapid charging which makes using alternative replacement cells even more risky.

So I'm really hesitant about the temperature sensor spoofing approach due to it screwing up temperature management of the pack.

Another factor is how would you actually implement it ? It would require CAN bus interception between the CMU's and the BMU using some sort of man in the middle device similar to the Chademo idea.

I really can't see a good solution to this other than figuring out how to reprogram the BMU, so somebody needs to get out a jtag interface and soldering iron on a spare BMU and get to work. :twisted:

Has anyone approached one of the ECU unlocking services to see whether they would be willing to attempt to reverse engineer the ECU firmware given a spare unit to work with ?

 

[dracekvo]

For regeneration.
Is possible just drive not D but on C.
But whot doing C if I will press brake pedal? I cant test it. I have Peugeot ION. There is B and C hidden, but i can unlock.

About thermal hack.
I dont need exactly 30kW. 22kW is good.

I mean on BMS board is classic thermistor. It is possible remove him and replace any small mCU (pic, atmega).
mCU will simulate 10°C all time (no start heating, no start cooling). Only if temperature goes from normal value. mCU stop simulate and start return real temperature.

I hope this is clear. My english is bad.

 

[kiev]

Your english is fine; And your most clever and excellent idea of using a PIC or ucontroller to simulate the temperature sensors is great!

There are 3 sensors on each CMU board and 22 boards. But i wonder if the DCQC current pull-back might be triggered by only one sensor reading low, or a few sensors reading low, or if all must agree. For example if only one sensor in 5 or 10 modules would cause it to trigger, then it would reduce the amount of extra components and soldering.

We don't know much about this Mits Operating System, but i'm wondering if it is programmed such that if any one sensor is out of range with all the rest, then it is considered a sensor fault; but if several are low then it believes that it is getting cold outside?

 

[DBMandrake]

There are 3 sensors on each CMU board and 22 boards. But i wonder if the DCQC current pull-back might be triggered by only one sensor reading low, or a few sensors reading low, or if all must agree. For example if only one sensor in 5 or 10 modules would cause it to trigger, then it would reduce the amount of extra components and soldering.

We don't know much about this Mits Operating System, but i'm wondering if it is programmed such that if any one sensor is out of range with all the rest, then it is considered a sensor fault; but if several are low then it believes that it is getting cold outside?

It only takes one cell temperature sensor to trigger changes in charging speeds or battery pack cooling.

One sensor below 11C will halve the charging rate to 22kW. One sensor above 20C will enable the blower fan, one sensor above 30C will enable blower+A/C compressor, one sensor above 40C will cut the charging rate etc...

I've confirmed this by monitoring cell temperatures and charging rates with Canion, including on a trip I went on where I was testing the car to its limits and actually managed to get the hottest cell up to 46C after multiple motorway/rapid charge sessions in a row...

My concern with only varying a single sensor would be whether too great a difference between cells would result in a fault code being set. Having said that, in the above instance of 46C the coldest sensor at the same time was only 30C and no fault was set. When the car is repeatedly Chademo charged or driven hard the cell temperatures can diverge quite dramatically.

Hmm... perhaps simply hard coding one sensor to read around 10C would be all that's needed as the higher and lower temperature readings from other cells would still initiate further speed reductions when very cold or very hot and/or bring on the blower fan and/or AC at higher temperatures despite one cell still reading 10C...

 

[kiev]

It only takes one cell temperature sensor to trigger changes in charging speeds or battery pack cooling.

One sensor below 11C will halve the charging rate to 22kW. One sensor above 20C will enable the blower fan, one sensor above 30C will enable blower+A/C compressor, one sensor above 40C will cut the charging rate etc...

I've confirmed this by monitoring cell temperatures and charging rates with Canion, including on a trip I went on where I was testing the car to its limits and actually managed to get the hottest cell up to 46C after multiple motorway/rapid charge sessions in a row...

That is excellent testing! And exactly answers the question of how many sensors.

And so the temperature might be spoofed either low or high to limit the rate, but the high end enables blower and A/C to help cool the pack.

 

[dracekvo]

Today I make order 6pcs Lanzhd 21700 5000mAh for testing from aliexpress.
Chinese copy samsung. Cells 18650 3300mAh is very good.
http://forum.mypower.cz/viewtopic.php?f=39&t=4602&view=unread#p117640

If I make good calculation. On LEV50 dimension is possible take 20psc.

So I will make test what happend if charger current will be 6.25A (chademo charging 125A) with limit 4,1V. Maybe cells 21700 can do it.
If will be degradated fast or overheat. Will be necessary make temperature hack.

 

[dracekvo]

First stress test. I was simulate chademo charging. 125A / 20cells = 6,25A to one cell.
Charging from 3.3V to 4.1V. Current 6.2A. Cell did not exceed 40°C
Now I make exact cappacity test. And I will repeat stress test many times (between 50 and 100). After that i will make again cappacity test.

If will battery not degradate too much. Chademo hack is not necessary.

 

[stoatwblr]

Has anyone approached one of the ECU unlocking services to see whether they would be willing to attempt to reverse engineer the ECU firmware given a spare unit to work with ?

There is a complete set of 2011 ECUs for sale nearby to me (london UK) for about $120

The owner is a EV hobbyist who was forced to scrap his imiev after the motor controller failed in a non-repairable fashion. We discussed the idea of BMU reprogramming to handle NMC cells (different discharge profile) rather than using Francisco Shi's MiTM device and he suggested these would be ideal for that purpose

Please bear in mind if dropping substutute cells into the pack that CHEMISTRY MATTERS

The existing cells are LiMn and their discharge curve is different(flatter) than LiPo cells. What that means is that if you drop in a single replacement for a LEV50, even if it's 100Ah, it will appear to the BMC as if it's got 1/3 or less that capacity. The same applies if you change out the entire pack with LiPo

IE: You MUST exchange like-for-like chemistry when replacing cells (even though the "full" and "flat" voltages are the same) or replace the entire pack in one go

The problem with that - is that nobody makes LiMn cells anymore, so you're left with scrounging LEV50s from scrapped vehicles.

The problem with replacing all 88 cells with another BEV2 format unit is cost and reprogramming the BMU - the latter being the nut nobody has cracked yet