openinverter forum

I've been taking a look at the contactor box inside the GTE battery some more and now have control over the main contactors and precharge over can bus. I've not yet worked out the feedback from it fully, but will update as i learn more.

https://github.com/jamiejones85/VW-GTE-ContactorBox

Very neat, these will further reduce wiring
Some say BMWs variant is being hacked as well

Yes, the Irishman is further ahead than me with his BMW box

Hi will this mean it might be possible to run the standard GTE pack without removing its controller ?
viewtopic.php?p=55404&hilit=jeep#p55404

That's a Passat GTE pack, but this is just controlling the contactor box from the internal can bus network. It doesn't at the moment work with Passat Contactor Boxes.
By Controller you mean the BMS master?

I know some of the messages the battery packs send to the external can buses but haven't tried to control them from the outside, I no longer have easy access to a pack wired with all the modules, BMS master and contactor box to play with. I may revisit in the future but at the moment I'm concentrating on the internal can bus and this EBOX as VW seem to call it.

Nice!

How did you go about figuring out the CAN bus commands?

Bit long winded, but Dom logged his car on charge, I played this log to a battery pack and recorded the inner can bus.
Then with this inner can bus log, I played it back at the contactor box, and it clicked the precharge and a contactor then it opened the again immediately but that was enough to know somewhere in there was the command to close at least one of them. So then selectively replayed ID's until I'd got it down to what was required. The chopped the log further to get a smaller list of messages.

Then I used the tool by Crasbe to get the VW magic byte and wrote an Arduino sketch that would put the counter in and calculate the correct CRC value. Using the logs I'd narrowed down the bits required for one contactor and then the precharge relay then just started flipping bits until the other contactor closed too.

The feedback messages are another task in taking an action and looking for patterns and changes.

Thanks, that's a great step into the right direction!
Can I ask what's the vw part number?

Great work, yes my pack has a lot more ic's on which would be BMS and Contactor Control, can see lot more work reverse engineering it.

My background is in electronics' is not in programming micros so will use a PLC to control contactors and Simbms cell balancing.

doing all the hardware and wire first.

Mhs wrote: ↑Sun Apr 23, 2023 11:17 am Thanks, that's a great step into the right direction!
Can I ask what's the vw part number?

Now able to instruct it to perform an isolation test . That was my end goal for this little exercise.

Bigpie wrote: ↑Sun Apr 30, 2023 2:22 pm Now able to instruct it to perform an isolation test . That was my end goal for this little exercise.

Brilliant! Have you figured out how to read the test results too?

I thought I did, but not 100% now. Need to look again.

With my code, when I request a test with an ammeter between HV and the ring terminal I get a small current for a few seconds so pretty confident it's doing a test.

Heres a couple of can logs if anyone whats a poke around. One log has 2 tests taking place, first one without loss of isolation and second with. The other has 3 tests, no loss, loss from positive HV and loss from negative HV. so 0xBA is the main controlling ID. I thought that 0xBB 3rd byte first 4 bits was the feedback, but that's not looking correct from 2Tests.csv

The DBC is a WIP and so shouldn't be taken as gospel at the moment.

Right, here's another test, if 0x97 is coming from the BMS master, you can see from this plot, it does 2 tests, and after the second test the isolation error flag is set. What I'm looking for is how the BMS master knows to set this flag from the messages coming from the Contactor Box, IDs: 0xBB, 0x15b, 0x16a95419, 0x18fed002, 0x18fed003, 0x18fed004, 0x18fed005, 0x18fed006, 0x18fed007, 0x18fed008, 0x18fed009, 0x18fed00A and 0x1a55545f

Nothing is jumping out to inform the master that there's an isolation issue. Any one fancy taking a look?

Finally got it. After an Iso test a single 0x16A9540C message is sent with the result 4th byte along seems to show resistance Not sure if the 5th will be HV positive resistance to ground, will need to test further.
I did 6 tests, 3 first without fault and 3 with a direct short to ground from the HV negative.

Hi, thanks for integrating this into the Zombie. The shunt also works? Wonder what kind of amperage the shunt and the contactors would handle?

The isolation monitoring isn't in Zombie, just FYI. I'm not sure what what they can handle, I only found the commands to close the contactors and do the isolation test, Damien did the other bits, so I'm not sure about the shunt. I think the contactors are rated 120A continuous/ 225A for 3 min / 400a for 30 seconds.

https://docs.rs-online.com/6251/0900766b80e1fbed.pdf