The ZombieVerter VCU Project

[Dilbert]

OK on the 100 byte HTM frames, i can recover valid data from all 4 of them. 3 had an extra byte at the start, but once that is taken out the data looks good.

On the MTH frames it seems to repeat after 120 bytes which is good, but i'm still looking at it now.

[Dilbert]

OK all frames now check out, both MTH and HTM. There was a shift of 1 or 2 bytes at the start of some of the MTH frames, but once i removed that all of the checksums and data look good. Also knowing about the heart beat counters made it easy to identify the checksums etc...

Frame formats for MTH look to be similar across all the boards which damian tried this morning, which is a good sign too!

I've attached a zip of the data in CSV format if anyone is interested.

[Jack Bauer]

That is good news:)

[Dilbert]

I've also had a quick look at the HTM data, we know some of the values need tweaking but it also looks good.

In the htm_prius_bench3 and htm_prius_bench4 i can see byte 94 operating as the heartbeat counter, incrementing every 2 frames as i would expect. It also wraps around to 0 after 512 frames too. That doesn't seem to be happening in the htm_prius_bench2 file, there must be a reason for this, possibly an older version of software was used to generate it.

[Jack Bauer]

Well thats weird. No software changes at all. I'll run it again.

[Dilbert]

Yep I checked the others to see if it was a wrap around issue.

Grab some htm data on power up with that board.

[Jack Bauer]

here we go.

[Jack Bauer]

So on the E46/Leaf front we are precharging and switching and sending torque commands to the leaf inverter. Sadly its not responding as I'm sure I have screwed up the messaging somewhere along the line. Good news is we are receiving valid data from the inverter. I have pushed a few updates to the repo :

-Display pot and pot 2 in off mode to allow throttle calibration
-using the digital inputs to indicate ignition on/off (t15) status for startup and shutdown.
-fix v2 and v3 voltage readings from the isa shunt.

[mdrobnak]

Nice! Can you run that MPG meter backwards to display KW? Gas-o-meter also CAN controlled?

Sort of. It uses the current speed of the vehicle + fuel delivered to calculate MPG. So, yes, you _can_ do that if you want, but it'll be some fun math.

There's also a little bit of dampening going on there. Not the non-linear mess of the temperature gauge, but still.

Yeah I think it is. good idea.

Edit : fixed isa shunt v2 and v3. its was the Damien classic : signed value in an unsigned variable.............

Of course LOL

After testing the ISA stuff on the CP ECU project, I'll finish the cleanup for BMW E39/46 selection like I did with the E65/GS450.

-Matt

[Jack Bauer]

Thanks Matt. Want to wait until I get the leaf motor turning as I may have a few more tweaks coming along:) and I want to get an M3 instrument cluster so I can rev to 9k!

[mdrobnak]

Thanks Matt. Want to wait until I get the leaf motor turning as I may have a few more tweaks coming along:) and I want to get an M3 instrument cluster so I can rev to 9k!

Can do. On another note, the oil temperature gauge is _not_ dampened. But I don't think we'll see much M3 cluster swaps going on, so :: shrug ::

Remember, buy a cluster with _less_ miles than what you've got. Although I think you're in trouble anyway. Do you have the DME for the car still?

If so, if you really want to do that:
* Put the DME in, and cycle the ignition a few times (wait maybe 5 - 10 seconds during on, and 20 seconds during off)

Then the LCM and DME and IKE will all have the same mileage saved.

Then you should be able to swap the IKE (with same or lower miles) and it'll sync the mileage over from the DME and LCM.

Otherwise, you'll have the tamper dot on the new cluster.

-Matt

[Jack Bauer]

...uhhh the dme went with the engine long ago! I did get an M5 cluster for the E39 and was able to reprogram the vin and millage not fitted it yet because too many cars:) Seems I can get e46m3 smg clusters from the US for very cheap compared to local. Anyway a bit off topic:)

On the leaf front this is a goldmine : https://github.com/dalathegreat/leaf_can_bus_messages
Seems I wasnt sending the vcu heartbeat in one of the messages. Gen 2 inverter doesn't care but gen1 is very picky. Will test tomorrow.

[mdrobnak]

...uhhh the dme went with the engine long ago! I did get an M5 cluster for the E39 and was able to reprogram the vin and millage not fitted it yet because too many cars:) Seems I can get e46m3 smg clusters from the US for very cheap compared to local. Anyway a bit off topic:)

On the leaf front this is a goldmine : https://github.com/dalathegreat/leaf_can_bus_messages
Seems I wasnt sending the vcu heartbeat in one of the messages. Gen 2 inverter doesn't care but gen1 is very picky. Will test tomorrow.

LOL. Ok well nevermind then, looks like you're set.

Good find re: messages. Interesting that the newer generation is more tolerant of missing messages.

[Dilbert]

OK i flipped back to look at the HTM data again, and i done up a difference spreadsheet between when i just started the car and didn't drive and when i drove it in EV mode. This highlights what needs to change to make MG2 go!

I've taken the top 7 rows of the HTM data from the Auris, i believe only the first row is init data (but it seems to be sent twice) and put them into a 2D array, along with some code mods. hopefully this will bring the inverter to life and we get some inverter whine!




//set inv_status = 0
inv_status = 0;


uint8_t htm_data_init[7][100]={
{0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,4,0,25,0,0,0,0,0,0,0,0,0,0,136,0,0,0,160,0,0,0,0,0,0,0,95,1},
{0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,4,0,25,0,0,0,0,0,0,0,0,0,0,136,0,0,0,160,0,0,0,0,0,0,0,95,1},
{0,30,0,0,0,0,0,18,0,154,250,0,0,0,0,97,4,0,0,0,0,0,173,255,82,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,4,75,25,60,246,52,8,0,0,0,0,0,0,138,0,0,0,168,0,0,0,1,0,0,0,72,7},
{0,30,0,0,0,0,0,18,0,154,250,0,0,0,0,97,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,4,75,25,60,246,52,8,0,0,0,0,0,0,138,0,0,0,168,0,0,0,2,0,0,0,75,5},
{0,30,0,0,0,0,0,18,0,154,250,0,0,0,0,97,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,0,4,75,25,60,246,52,8,0,0,0,0,0,0,138,0,0,0,168,0,0,0,2,0,0,0,75,5},
{0,30,0,0,0,0,0,18,0,154,250,0,0,255,0,97,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,255,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,255,4,73,25,60,246,52,8,0,0,255,0,0,0,138,0,0,0,168,0,0,0,3,0,0,0,70,9},
{0,30,0,2,0,0,0,18,0,154,250,0,0,16,0,97,0,0,0,0,0,0,200,249,56,6,165,0,136,0,63,0,16,0,0,0,63,0,16,0,3,128,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,16,0,75,12,45,248,21,6,0,0,16,0,0,0,202,0,211,0,16,0,0,0,134,16,0,0,130,10}
};


// put into case 6

if(inv_status>5)
{
if (dma_get_interrupt_flag(DMA1, DMA_CHANNEL7, DMA_TCIF))// if the transfer complete flag is set then send another packet
{
dma_clear_interrupt_flags(DMA1, DMA_CHANNEL7, DMA_TCIF);//clear the flag.
dma_write(htm_data,100); //HAL_UART_Transmit_IT(&huart2, htm_data, 80);
}

}
else
{
dma_write(&htm_data_init[ inv_status ][0],100); //HAL_UART_Transmit_IT(&huart2, htm_data_setup, 80);

inv_status++;
if(inv_status==6){
memcpy(htm_data, &htm_data_init[ inv_status ][0], 100);
}
}

[Jack Bauer]

Cool:) Will test this morning. So i overwrite what is in case 6 with the above and likewise htm_data_init?

[Dilbert]

Yea i think the old init data was in an array called htm_setup, which isn't used anymore....

[Dilbert]

I've also found some interesting data that gets sent just before the vehicle starts to drive, i believe when it comes out of park. It is sent right beside the torque command for MG2, see attached graph. The hybrid control module also sets this variable for one cycle at row 3, but i think that might be a bug in their code.

[Dilbert]

I wonder could the blue line indicate some sort of limit value, as my foot was probably on the brake when it drops down.

On that drive cycle, i went back and forth in the drive a few meters, then went out of the driveway onto the road and reversed back in.

[Jack Bauer]

ok, well the bad news is when i uploaded the firmware with the mods it locked up the processor. My eagle eye had spotted the memcpy instruction earlier so on a hunch i commented it out purely to see if it let the processor bootup. It did...AND THE INVERTER IS NOW AWAKE AND WHINNING AT ME!!!! No response to a torque command as yet but its alive! Dilbert, you sir are a steely eyed Toyota man:)

[Jack Bauer]

Scratch that its turning!!!! I didn't have the vcu in run mode!

[Dilbert]

WOW!

[Dilbert]

ya can't beat a replay attack!

A few more things to figure out in the HTM and MTH data streams, but its looking good.

I want to put the MTH return data which Damien grabbed yesterday into an excel file, so we can see if they all send the return info in the same places

Its interesting that it worked without the memcpy in there, we could just put the last row of data from the 2D array in as the htm_data default values.

[Jack Bauer]

Yeah its running away on the bench like it was all in a days work:)

Few quick notes :

-like the gs450h it doenst care about dc bus voltage
-it also doesnt care about any of the interlock wires. just give it 12v and sync serial and its your pal.
-rpm seems stuck at 48 for now likewise heatsink temp reading wrong buts thats all small fry.

[Jack Bauer]

So we are running in what would be reverse in the vehicle and it doesnt respond to "reverse" torque. Also worth noting this transaxle has a welded psd so mg1 is being turned also.

[Dilbert]

I've plotted the torque values for MG2 and they seem to be sending the same value 3 times. One of them seems to be 1/2.