1. Attachments are working again! Check out this thread for more details and to report any other bugs.

Pseudo code, strategy for CAN PHEV control methods?

Discussion in 'Prius PHEV Plug-In Modifications' started by lesdit, Apr 21, 2011.

  1. ken1784

    ken1784 SuperMID designer

    Joined:
    Dec 18, 2003
    2,940
    1,359
    67
    Location:
    Yokohama, JAPAN
    Vehicle:
    2010 Prius
    Model:
    N/A
    Please refer to page-9 of following document.
    http://www.autoshop101.com/forms/Hybrid06.pdf

    Ken@Japan
     
    1 person likes this.
  2. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    You should use two wires; CAN_L (low, pin 14), CAN_H (high, pin 6) compared to GND (ground, pin 5). To power your micro, there is 12 Volts on pin 16.
    In my case the ELM interface will act as an interpreter, in you case you will have to interact with the CAN bus directly. That seems more difficult, let’s say it's a greater challenge.
    I assume what is meant in the document is that the ELM can handle several protocols, on which page did you read about the six different messages?

    Thanks Vincent and Ken for your input, it is slowly becoming clear to me how it all works.

    Progress at this end: I added a label field that displays the interface identifier. When sending ‘AT Z’ the ELM responds with ‘ELM327 v1.3a’ and this is displayed as the caption of the label, also a button in the program that lights up from read to green. Now I need to do the same in order to check if the connection with the CAN bus is working properly.

    Next thing will be a constant loop in which a the value of a variable is displayed. The rpm seems a good one to start with. Maybe I should put an extention cord to the car and program behind the wheel.

    Still a long way to go and I wonder if we will ever be able to spoof the system the way we want but this is a lot of fun anyway.
     
    1 person likes this.
  3. vincent1449p

    vincent1449p Active Member

    Joined:
    May 24, 2004
    894
    331
    0
    Location:
    Singapore
    Vehicle:
    2012 Prius c
    It is the max if you're using COM port. If you're using USB, it can be set up to 500kbps (page 50). See e.g. on page 53.

    Some owners are already using ELM327 with VB. Have you check the links I provided?
     
  4. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    Thanks for the info.
    If the elm327 can send messages as well as receive , you may be able to spoof the battery SOC without too much work, becuase if what I read is correct you can listen for the SOC message ( from the battery ecu ) and as soon as you see it, send your own version with the SOC you wish. The hybrid controller takes the last message, ignoring the first.

    To keep the ICE off is harder, as it seems you must cut the CAN bus to the ICE ecu, and use the micro to pass all the messages to the ICE through the micro, altering the one message that requests engine power ( turning it on ).

    I am sure there are some other details, but that's how I read it so far.
     
    1 person likes this.
  5. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    Sounds logical. Wouldn't the ICE stay off if the car assumes the SOC is still somewhere around 70% and you are still driving at low speed?

    @ Vincent1449p: when writing the previous message I was in a hurry to get to work, but I will read those messages now. Hopefully I can do some more tests this evening.
     
  6. Floyd2

    Floyd2 progressio per sententia

    Joined:
    Aug 23, 2009
    106
    23
    0
    Location:
    Netherlands, Europe
    Vehicle:
    2006 Prius
    Model:
    II
    Whom it may interest, a little about the VB code. The first time the MSComm.Input command is used it does not show the ‘>’ command prompt but it will after that. I captured the response to the ‘AT Z’ command in a string, it shows the sent command and the identification of the ELM bridge/interface, and used this routine in the Connect_Click() event. The string includes the initial command (it seems default the ECHO is ON), linefeeds and carriage returns so I had to clip them out. The result is displayed as the caption on a label so that other devices can be used as well.

    It results in: ELM327 v1.3a
    It takes about half a second before a response is given, so as a temporary measure I added a simple loop that does some needless counting and then continues. Not a very elegant solution but I will get to that later and put a delay timer in.

    Next thing I did was see if I could get some information directly from the CAN bus. I use rpm because that is an easy one to start with.
    This time it is returning 3 lines of 4 bytes each, and it takes a bit longer so I used a delay of about 2 seconds. I will tidy that up later and include it in a loop so the value is constantly updated.

    Stripped of the ‘>’ prompt and the original ‘010C’ command the result with the ICE off is:

    When revving the ICE a little the values were:

    With the formula (( A*256) + B ) /4 I should be able to calculate the RPM and display the value. But I wonder why 3 lines of values are returned? This also happens in the RealTerm program so it has nothing to do with the VB code.
     
    1 person likes this.
  7. lopezjm2001

    lopezjm2001 Senior Member

    Joined:
    Apr 14, 2009
    1,146
    407
    5
    Location:
    Sydney Australia
    Vehicle:
    Other Electric Vehicle
    Model:
    N/A
    Hi Floyd,

    Good to see that you are finally progressing with your Elm327 SOC spoofing project. I believe that such a device has to be connected close to the battery ECU on the CAN bus. This allows the device to capture the SOC message going out of the Battery ECU and change the SoC value. This information I found on Dick Norms website ://www.hybridinterfaces.ca]CAN-view index , I am taking a shortcut as i have a BMS+ on order which has SoC spoofing. Anyhow there is probably information about this on this website. Similarly there must a way to fool the ECM so that EV keeps staying on over 45km/h so the ICE will not start.
     
    1 person likes this.
  8. lopezjm2001

    lopezjm2001 Senior Member

    Joined:
    Apr 14, 2009
    1,146
    407
    5
    Location:
    Sydney Australia
    Vehicle:
    Other Electric Vehicle
    Model:
    N/A
     
  9. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    I believe that the spoofing of the SOC will not keep the ICE off , but will keep it 'more off' , if there is such a thing. If you demand more power with the gas pedal , the engine will still help out with your request to get going. The CAN bus must be cut between the hybrid controller and the engine ECU to keep the engine off . When you cut the connection, you insert a micro there that allows messages through, but modifies the message that asks the engine for power to zero power.

    If I am not correct , please let me know.


    For SOC spoof, the VB program could listen for the SOC message, and immediately sent your fake SOC right after with 70%. Maybe floyd2 can try this out ? So the BMS+ does not keep the engine off, but tends to keep the engine off until you demand lots of power, like keeping up with traffic.
     
    1 person likes this.
  10. lopezjm2001

    lopezjm2001 Senior Member

    Joined:
    Apr 14, 2009
    1,146
    407
    5
    Location:
    Sydney Australia
    Vehicle:
    Other Electric Vehicle
    Model:
    N/A
    SOC spoofing will not make any difference in EV mode. But in stealth mode it should cause the the Hybrid ECU to draw more power from the HV battery pack to run the electric motor so more electrical power is drawn. The same applies during ICE assist mode.
     
    1 person likes this.
  11. lopezjm2001

    lopezjm2001 Senior Member

    Joined:
    Apr 14, 2009
    1,146
    407
    5
    Location:
    Sydney Australia
    Vehicle:
    Other Electric Vehicle
    Model:
    N/A
    The problem of SOC spoofing is that you need to keep monitoring the real SOC. Otherwise if the real SOC strays outside the 40% and 80% limits the Toyota HV battery will most likely be damaged. So Floyd needs to write a VB program to calculate the amp hours going in and out of the HV battery and calculate the SoC whilst spoofing and then you can setup the fake SoC to be 10-15% higher than the real SOC.

    If the real SOC runs down to 0% it can kill the HV battery. If the real SOC runs to 100% and the HV fan is not running the HV battery could explode. At the very least you would be shortening the HV battery life.
     
    1 person likes this.
  12. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    Mucking with SOC does not change how the battery controller keeps the battery charged, unless you are also externally charging the battery at the same time, such as the 'enginer' system does.
    The battery ecu does not receive any commands from anything else in the car.

    I would like to know the approch to use if you are replacing the HV battery with a substitute 10KWh pack, for example. Do the kits out there keep the existing relays from the old pack, and essentially splice in the lithium pack where the old nickel battery connected ? How about the voltage taps and the thermal sensors from the old stock system ? Spread them into your replacement pack? I think some of the systems out there keep the Toyota battery controller as-is, but I'm not sure how the SOC is kept by the original battery controller.
    Floyd2: What are your intentions for extra battery?
     
    2 people like this.
  13. lopezjm2001

    lopezjm2001 Senior Member

    Joined:
    Apr 14, 2009
    1,146
    407
    5
    Location:
    Sydney Australia
    Vehicle:
    Other Electric Vehicle
    Model:
    N/A
    A lot of answers to your questions can be found on this website

    (www.hybridinterfaces.ca)
     
  14. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    I got an email back from Norm of BMS+ fame, he basically said that his stuff is really meant for the parallel multiple prius pack style of doing things. To keep the original toyota bms going with a replacement battery, you have to fake the 17 voltage taps. Seems easy enough .
    I don't think he has tried the spoofing of the messages to the ICE at this time, although his board that does the BMS+ sounds like it could also filter those messages as well, with the firmware changed to target the right packets , obviously.
    So about 75 cells of 40Ah lifepo4 sounds about right for a replacement battery, right ? That's 4200 USD for the cells. Add BMS, add spoof boards, add charger. Am I up to $8500 yet ( cost of good plug in PHEV kit ) ?
     
    2 people like this.
  15. Flaninacupboard

    Flaninacupboard Senior Member

    Joined:
    Apr 25, 2010
    1,297
    213
    0
    Location:
    Midlands - UK
    Vehicle:
    2010 Prius
    Model:
    N/A
    I read that this BMS
    48 cell system: $950 | Orion Li-Ion Battery Management System
    is a pin-for-pin replacement of the battery ECU. It manages your lithium packs, and gives the desired data to the prius. so while your lithium pack is 100% to 30% it will report 80% SOC and a high CDL to the prius (making it want very much to discharge the battery) and then once your lithium pack hits 30% it'll tell the prius 65% SOC to make it happy not to draw or charge the battery too much (normal prius mode).


    I don't think the price of the big PHEV kits is outrageous, there is probably $2,000 or so profit in each.
     
    GG707 likes this.
  16. lesdit

    lesdit New Member

    Joined:
    Apr 15, 2011
    32
    13
    0
    Location:
    United States
    Vehicle:
    2006 Prius
    Model:
    N/A
    That does look like the best BMS I've seen. Has dual Canbus too, so that they can spoof battery info.
    For $1160 or so, I hope that does not need per battery boards as well.... it seems to be a centralized unit that contains all needed circuitry. So about $5500 for batteries and bms with battery SOC spoofing. add charger, ICE ECU spoof board , a lot of custom fab work for battery box, wiring, etc. No warranty for bad cells, etc. hmmmm.


     
    1 person likes this.
  17. Flying White Dutchman

    Flying White Dutchman Senior Member

    Joined:
    Dec 29, 2007
    4,374
    313
    0
    Vehicle:
    Other Non-Hybrid
    Model:
    N/A
    bump
    did anyone get anywhere with the soc spoofing?
    or after trying gave up and got a device already doing this ;-)