Prius Gen3 Inverter Hacking

[Dilbert]

Ok I’ve made up a logger to capture the data, will be the weekend before I can connect it up.

Interesting the avr usart supports sync mode, so we could drive one of these from an arduino. I used a Leonardo for the logger, so I have the usb to push the data to a PC nice and fast. It can decode the gs450 data coming from the due correctly so should work on the car.

[Jack Bauer]

Great news. Will be very interesting to see.

[Dilbert]

I got the logger onto the car this evening, kinda hard to back probe the connectors on the inverter. I found that if i cut down some arduino stacking headers i could connect to both the + and the - line, so i done that for the clock, TX and RX pins.

I'm still processing the data, but the good news it looks like the Auris/Prius variants also TX 100 bytes of data back to the hybrid control unit. I've run a script on the data and all the checksums look good. I will dig a little deeper into this tomorrow, but so far so good. I've gathered quite a bit of data, but have just included the first few lines here.

I will look at the data going into the inverter now.

[Jack Bauer]

Fantastic work. This could end up as the gs450h for front wheel drive systems.

[Dilbert]

I tried looking at the RX data going to the inverter, it does seem to repeat, but I haven't been able to make sense of it. I think in the dark I might have flipped the CAN+ and CAN- lines, hence I haven't been able to decode it and verify the checksums for the Rx data.

I'm happy with the Tx data captured, from my brief look some aspects might be slightly different to the GS450 data packet, but it needs further work.

What i plan to do is pop out the glove box as see is it easier to connect at the hybrid ECU end of that cable. I can then connect in my CAT5 cable/plug so can i do some proper logging.

I'm debating putting an AND gate into my logger so i can AND the RX lines from the CAN transceivers to log both sides of the conversation at the same time. I could probably do it with two diodes and a pull-up resistor also.

[Dilbert]

I ended up running a nice long CAT5 cable into the house so i could look at the data coming off the car in comfort. I also got my logic analiser out of storage. Both proved to be quite useful.

HTM data = 100 bytes (not 80)
MTH data = 120 bytes (not 100) (atleast 30 bytes near the end are all zero's)

HTM always starts with 001E
MTH always starts with 000C

The frames are overlapped, see attached capture from the scope.

I've saved the raw capture from the analyser as a wfm file, does anyone know good software to read this format? i believe it is an old tek format?

[Jack Bauer]

Very interesting. I'll see if I can rig up a Gen 3 prius inverter and transaxle on the bench. Might be useful for finding things like motor rpm and direction etc. If it behaves like the lexus and doesnt care about bus voltages etc then this could be a big game changer.

[Dilbert]

I've transfered the data into excel and started looking at trying to decode it.

It is interesting that both frames are +20 bytes from the lexus design. My next step will be to log both sides of the data when the vehicle is moving in EV mode, then compare it to the baseline data.

Yes if you could hook up one on the bench, you could turn MG1 and MG2 by hand and extract some of the values that way, from the MTH data frame. I guess you could inject in the HTM frame i've grabbed from mine and see the inverter give back a MTH frame. I need to get the REQ signal also logged, so far i've been able to decode the data without this signal, but if we are going to re-produce it we should know the timing.

[Aquinax]

It looks like Damien is too busy to update github at the moment

I don’t understand anything, the repositories increased from 34x to 37x, but I do not see new ones ...

[Mouse]

I do not see new ones ...

Maybe it's there but not publicly visible at the moment?

[Kevin Sharpe]

I do not see new ones ...

Maybe it's there but not publicly visible at the moment?

different thread (here) but the answer is the same I'm sure...

Yes all will be shared once the boards are received and tested.

What would be the point in releasing completely untested board designs to GitHub when in the next week or so we'll know whether the new designs work?

[Aquinax]

I hope the solution not only of my alternative problem will be in the repo

[Dilbert]

Captured some data moving back and forth on MG2 only. So far i've only managed to pull the DC bus voltage out of the MTH frame, as it seems to be in the same position as the lexus one.

[arber333]

Yes i also just redrilled my board, there is enough space under the current sensors to fit the boards.

[Jack Bauer]

For those desperately scouring github for the new designs (which by the way must include the JLC bom and cpl files I'm told) and contacting me in every conceivable way since the last video here is an idea. If I've been stupid enough to opensource everything I've done with electric vehicles over the last decade what makes you think I'd stop now? Let's imagine the scenario where I did release all the files straight away. JLC would be happy campers as everyone and his dog would be uploading gerbers and placing orders. Fast forward 10 days or so and to my horror I realise I made an error on the board!!!! Not exactly unprecedented I might add. All those wounded souls who might have to cut a track or swap out an smd part would be on here screaming for me to be strung up from the nearest fast charger. Not a pritty picture is it?

Soooo why not let me do these things with my money and time and effort so you don't have to?Then you can safely ignore the bloated prices on my webshop and place your own orders. Sound ok? BTW the boards shipped from JLC yesterday so won't be long now.

[Aquinax]

Yeah but how do I know that you didn’t get rolled up, already got prototypes and are not in a hurry with implementation?
I think everyone is unbearable and cant wait

[Kevin Sharpe]

I think everyone is unbearable and cant wait

Isn't that the truth

[Dilbert]

I wrote some excel macros to help extract and plot the data. I think that the MG2 torque is in the same position as the lexus GS450, which is good news. The graph below shows the car going forward and back in the driveway very slowly.

Does the toque value of 300 seem in the right ball park?

I think there's a couple of rows of bad data in my log file, hence there are a few glitches.

[Dilbert]

I was wondering to people think this would be a better thread to document the reverse engineering of the Gen3 Prius / Auris Inverter? We could get a mod to move over the posts from the other thread.

[MattsAwesomeStuff]

I was wondering to people think this would be a better thread to document the reverse engineering of the Gen3 Prius / Auris Inverter? We could get a mod to move over the posts from the other thread.

Yeah, the "Toyota Useful Bits" thread is more about what to salvage or plan to salvage off of a junker. This thread seems more suitable to be posting datalogs of CAN sniffing like you're up to.

[Jack Bauer]

Yeah 300 for slow moving would be about right. I'll see if I can migrate these posts over to the hacking thread.

[Jack Bauer]

I think the move worked.

[Dilbert]

Yes, that worked perfectly thanks.

I'm starting to wonder why they need to send down so many bytes to control 2 motors. I can see with the frame coming back they probably got carried away with debug data. I will capture an engine start cycle to see if MG1 torque is in the same place.

It's also interesting that one data frame doesn't complete fully before the other one starts coming back out. We might have to consider using interrupts for the incoming data, so nothing gets lost. It also means we might not know if we are communicating properly until we have everything set up on the bench.

I'm planning to source a gen 3 prius/auris inverter and connect it up to the transaxle I have.

[Jack Bauer]

First batch of prototypes have arrived from JLCPCB. Initial observation is that this is top tier board building. As good as anything I have ever seen in my career and better than anything local who have charged a hell of a lot more.

I'd like to appeal for some calm in relation to the whole JLC build. I won't be responding to anymore "DAMIEN! WHEN ARE YOU RELEASING THE JLC BOM AND PLACEMENT FILES!" type of emails or messages on here or otherwise. The boards will be tested. Errors if found corrected. Webshop and github will then be updated and videos made. The vast majority of people are great and appreciate the effort involved but some seem to think I'm their personal design engineer. Newsflash! I'm not.

Now in relation to the webshop we'll be making a few changes. There will be three tiers of board available to buy :

1) Board direct from JLC as I receive them with listed smt placed, unprogrammed and untested. This will replace the bare boards currently on sale.
2) Board direct from JLC as I receive them with listed smt placed, programmed but untested. This gets around the need for programming the micros.
3) Board with all components both listed smt and non listed smt and through hole placed, programmed and tested.

[Aquinax]

Damn, I want it.shut up and take my money! How much by the way?

* I was drunk and excited