Communicating with the Lexus GS450h Inverter/Converter

[catphish]

Would still be interested in seeing captured waveforms though.

Thanks, I will try to capture the raw waveforms from Jackk's GS450H post them here to confirm.

[Pete9008]

It would be good if you could.

The difference is best seen when looking at the differential signal between the two conductors. If it's unipolar (returns to zero) then it's CAN, if it's bipolar then it's RS422/485.

Edit - that's assuming that they haven't added extra non standard pull ups/downs at either end!

[catphish]

Damien did a differential measurement (attached). Looks like it's 2V differential and returns to zero, which seems awful, but if that's what it is and it works, great! I would prefer to see the individual signals with reference to GND to confirm, so will do my own measurements too. It does seem like it might be CAN though.

[xp677]

I based my assumption on the IC pinout and the logic levels as well. Could easily be another type of transceiver.

The fact that CAN transceivers at the other end seem to work perfectly to communicate with this unit is another thing in favour of the theory that it's CAN transceivers in there.

[hazelnut]

Coincidentally I've been looking at this today. Here is a picture of what Lexus calls the Hybrid ECU from a 2009 Lexus GS450h. This unit talks to the inverter using 4 CAN-like interfaces.

I've buzzed out the CAN connections using the lexus wiring diagrams. From left to right there are 6 CAN modules: HTM, MTH, CLK, REQ, Gateway and ABS. The interface chips are 4 Denso Se787 and 2 Denso Se617 respectively. I could not find a manual for the Denso parts, nor what the difference is between the Se787 and Se617. However the pin out appears to be the same SOIC-8 configuration of a number of CAN chips including the MCP2561 and NXP TJA1042. My plan is to fit the Zombiverter circuit onto a PCB that fits directly into this ECU box using the original ECU connector, and thereby allowing a direct swap into a GS450h allowing the engine to be removed. Next up I need to reverse engineer the accelerator.

[0tik]

It first appeared to be SPI over LVDS. The Toyota names for the pins are likely alternate names for MOSI, MISO, CLK. However, in practice, whene examining the nature of the data stream, it does not follow the SPI standard.

• HTM = High-voltage ecu To Motor-generator ecu - since the HV ECU (the Hybrid ECU) in the car is the master, this is MOSI. This is the signal which we will need to replicate to control the inverter.
• MTH = Motor-generator ecu To High-voltage ecu - This is MISO. From this we get status updates back from the inverter.
• CLK = This is the SPI clock. The Lexus system uses a 500KHz clock. The data packets from MOSI and MISO don't generally exceed 100 bytes, and I've managed to get stable packets without overlap from as low as 250KHz. Data from MTH will output in time with this clock (on a rising edge)
• REQ = this is the status request line from the inverter. For the Lexus, this is a 1ms high pulse followed by a 3ms space, basically a 250Hz square wave at 25% duty cycle. In reality, the inverter outputs a packet of around 100 bytes whenever it detects the leading edge of a pulse, so a CS or SS line can be used to trigger this. The pulse can be half high for the duration of the packet, or as long as you like. One pulse = one packet.

When talking about high and low here, I am referring to the differential signal. Since these are normally inverting, in reality the microcontroller likely receives a low pulse to trigger a packet output.

Can you share a bit of knowledge how did you figure all of this out? I want to decipher BTH data but have no idea where to begin. All i can guess is this is miso/mosi serial data communication. Is buying saleae logic analyzer the first step on my journey, or is there something else / a better place to start?

[xp677]

Can you share a bit of knowledge how did you figure all of this out? I want to decipher BTH data but have no idea where to begin. All i can guess is this is miso/mosi serial data communication. Is buying saleae logic analyzer the first step on my journey, or is there something else / a better place to start?

Yes, a logic analyzer connected to all of the data lines will show you how they interact.

Not much use for Toyota's custom ICs, but in many cases you can track the signal lines back to the MCU and can then cross reference the data sheets.