# Using the Mitsubishi CMU / BMS on LEV40 packs



## Tomdb (Jan 28, 2013)

Mind posting picture of the inside? I will dig around the net tonight to see if I can find any useful info.


----------



## bigmotherwhale (Apr 15, 2011)

Hi tom 
would you like pics of the battery pack or of the cell bms modules? 
I have already found a wiring diagram for the car and I have powered up the battery loom and read some canbus data through a USB dongle. 
however it also has a serial network which i guess tells each module to transmit its data in sequence?


----------



## Tomdb (Jan 28, 2013)

you found these posts right? http://www.myoutlanderphev.com/forum/viewtopic.php?f=10&t=1410

Slaves or cmu's communicate over a private can it seems. So best to figure out what the gateway is sending out on the canbus, of try removing the gateway and just powering up a single slave module and see if it spits out values by itself.


----------



## bigmotherwhale (Apr 15, 2011)

Here are some pictures of the pack and CMU module.

http://s936.photobucket.com/user/bigmotherwhale/library/Mitsubishi Phev Pack

they are actually very easy to work with, i easily found the circuit diagrams, powered them up with 12v and they transmit messages over CAN, Tom has kindly analysed some data I sent him, attached is a spreadsheet of one of the modules cell positions. 

I have not been able to find how to enable the balance command, I think we need someone with a working car to find the command, if anyone can help please get in touch. 
The modules are also connected in a series loop with the BMU this could be related to balancing.


----------



## kennybobby (Aug 10, 2012)

What year and model is that card from--it doesn't look like the CMU board from the 2012 Miev?


----------



## Tomdb (Jan 28, 2013)

The imiev uses boards that directly blot to the terminals instead of having a cell connector. However the data encryption on the canbus is almost identical.

These also only monitor 4 cells at a time.


----------



## AbexUK (Oct 12, 2016)

Hi, I am also interested in the Outlander CMU, and wondered if anyone has worked out how to make use of the cell balancing function? Photo of the CMU board attached.


----------



## Tomdb (Jan 28, 2013)

Do you have the boards loose? You could fool the board by increasing the voltage on one cell and see if it starts to balance.

Else you need a working vehicle/pack and monitor the canbus when charging.


----------



## AbexUK (Oct 12, 2016)

Hi, I took out one of the CMU boards to investigate, get some photos etc. I have since put it back.

I did some experiments varying the cell voltages, but I couldn't observe that anything was actually happening. The load resistors are continually pulsed while the board is active and this does not change as the cell voltages are changed.

I concluded that the CMUs must be reading the voltages and posting values to the bus, but the decision to use the cell balancing must occur elsewhere (eg the BMU) and get communicated back to the CMUs via the bus. I guess this makes sense given that there are 10 CMU's on the bus, and so there needs to be a higher level of authority before taking any action.

I don't currently have the means to monitor the CAN but this is what needs to happen next.


----------



## kennybobby (Aug 10, 2012)

The MiEV BMU is on CAN2, can that be monitored thru the obdii port, or does it require a separate connection?


----------



## Tomdb (Jan 28, 2013)

The BMU and the CMU's have a dedicated network. 

Only the vehicle canbus is on the diagnostics connector on a outlander.


----------



## kennybobby (Aug 10, 2012)

i've got an analyzer working to grab CAN messages on my Miev, is there any PIDs that you are interested to decode--i'm willing to make scans and help hack on this thang...


----------



## bigmotherwhale (Apr 15, 2011)

Yes defiantly, Tom worked out the cell voltages and temperatures but without a working car we cannot do the balance commands for the cell modules, this should be sent between the BMU and CMU at some stages during the charge, this node is only populated with the cell modules and the current sensor which there is a datasheet for so it should be pretty straightforward to filter the messages.

I think the BMU sends a message to the CMU ID and cell number to activate the bleed resistor. 

Thanks for your help.


----------



## kennybobby (Aug 10, 2012)

i have recorded 11-bit address CAN messages from both the OBDII port and from under the rear seat at the junction connector where CAN1 and CAN2 meet--it all looks the same. But there are a number of 29-bit address Extended CAN messages that nobody has identified--i would bet the important stuff is on Extended CAN...they just don't make this stuff easy to crack.

From what i can tell on the cmu chip data sheet, the balance voltage is sent to the unit and stored in memory register, then when the conditions are met and an enable is sent, it will turn on the balancing.

i'm thinking that a MUT III will be needed to really sniff this out.


----------



## bigmotherwhale (Apr 15, 2011)

you would just need to splice you can tool between the CMU to BMU, i have a feeling that the BMU is inside the battery pack on the Miev? if so that could be difficult...


----------



## Tomdb (Jan 28, 2013)

Pack disection, http://myimiev.com/forum/viewtopic.php?f=23&t=3074

Anyone seen a manual for the imiev

It is outside of the pack, info on pinouts below.

http://myimiev.com/forum/viewtopic.php?f=22&t=255


----------



## kennybobby (Aug 10, 2012)

i opened up the BMU to take a look at the circuit board, there is a microprocessor with Mitsubishi logo MH8106F, 144 pins. There appears to be a JTAG port with 10 solder pads adjacent to the processor--i wonder if it would be possible to read out the firmware thru the jtag port?

i want to solder some leads to the CAN lines going to the pack CMUs so i can easily attach the analyzer, then i will try to capture some data during charging.

i was able to capture ~25 seconds of the initial turn on of the defroster using the remote control while plugged in to level2 EVSE, pid 373 pack voltage and current response when the PTC heater came on and cycled off.


----------



## Tomdb (Jan 28, 2013)

Good stuff. Mind sharing the can capture so I can have a poke the CMU data?


----------



## kennybobby (Aug 10, 2012)

i haven't captured the BMU to CMU buss yet, but i could send you the time history of this defroster capture sorted by PID in an excel spreadsheet, or csv format, or the logicdata analyzer capture format. 

i think the CMU data starts with PID 6E1 but i haven't graphed it since it is available using CANIon android app with bluetooth OBDLink LX from scantool.


----------



## piotrsko (Dec 9, 2007)

Hackaday did an article about aquiring jtag data maybe 2-3 days ago


----------



## Tomdb (Jan 28, 2013)

kennybobby said:


> i haven't captured the BMU to CMU buss yet, but i could send you the time history of this defroster capture sorted by PID in an excel spreadsheet, or csv format, or the logicdata analyzer capture format.
> 
> i think the CMU data starts with PID 6E1 but i haven't graphed it since it is available using CANIon android app with bluetooth OBDLink LX from scantool.


We would want raw data not anything collected with the OBD protocol. 

Did anyone get a cell module from an Imiev and powered it up to capture the canbus data from that? 
Currently I would assume that the PHEV canbus data from the CMUs that I got from bigmotherwhale would be an identical layout to that for the Imiev.

So any capture off the Battery canbus would be great.


----------



## kennybobby (Aug 10, 2012)

i made some CAN captures for the buss between the BMU and the pack--with totally unexpected results. PM me if you want the scan data, but here is what showed up and i can quickly summarize it here:

This was sitting stationary with the key ON car READY with the pack ~62%, 348 volts, 3.96 vpc, temp 17C

```
Time [s],Packet,Type,Identifier,Control,Data,CRC,ACK
0.024955000000000,0,DATA,0x3C3,0x8,0x01 0x73 0x00 0x00 0x00 0x00 0x00 0x00,0x5323,ACK
0.064963250000000,1,DATA,0x3C3,0x8,0x01 0x73 0x00 0x00 0x00 0x00 0x00 0x00,0x5323,ACK
0.104951750000000,2,DATA,0x3C3,0x8,0x01 0x73 0x00 0x00 0x00 0x00 0x00 0x00,0x5323,ACK
0.144958000000000,3,DATA,0x3C3,0x8,0x01 0x73 0x00 0x00 0x00 0x00 0x00 0x00,0x5323,ACK
0.184960000000000,4,DATA,0x3C3,0x8,0x01 0x73 0x00 0x00 0x00 0x00 0x00 0x00,0x5323,ACK
```
This repeated for the full 10 second scan, looks like cell voltage was 01 73 = 3.710

i was expecting to also see cell temperatures, but it never happened.

This was a capture while driving:

```
4.906979500000000,122,DATA,0x3C3,0x8,0x01 0x72 0x00 0x00 0x00 0x00 0x00 0x00,0x2552,ACK
4.946977250000000,123,DATA,0x3C3,0x8,0x01 0x72 0x00 0x00 0x00 0x00 0x00 0x00,0x2552,ACK
4.986977500000000,124,DATA,0x3C3,0x8,0x01 0x72 0x00 0x00 0x00 0x00 0x00 0x00,0x2552,ACK
5.026973500000000,125,DATA,0x3C3,0x8,0x01 0x72 0x00 0x00 0x00 0x00 0x00 0x00,0x2552,ACK
```
i plugged in the EVSE to charge and made scans as the pack charged up:


```
at 10 Bars on fuel gauge:
Time [s],Packet,Type,Identifier,Control,Data,CRC,ACK
0.021493250000000,0,DATA,0x3C3,0x8,0x01 0x76 0x01 0x00 0x00 0x00 0x00 0x00,0x6988,ACK
0.061496250000000,1,DATA,0x3C3,0x8,0x01 0x76 0x01 0x00 0x00 0x00 0x00 0x00,0x6988,ACK
0.101499000000000,2,DATA,0x3C3,0x8,0x01 0x76 0x01 0x00 0x00 0x00 0x00 0x00,0x6988,ACK
0.141489750000000,3,DATA,0x3C3,0x8,0x01 0x76 0x01 0x00 0x00 0x00 0x00 0x00,0x6988,ACK
0.181500500000000,4,DATA,0x3C3,0x8,0x01 0x76 0x01 0x00 0x00 0x00 0x00 0x00,0x6988,ACK

at 12 bars:
0.010536000000000,0,DATA,0x3C3,0x8,0x01 0x84 0x01 0x00 0x00 0x00 0x00 0x00,0x7132,ACK
0.050550500000000,1,DATA,0x3C3,0x8,0x01 0x84 0x01 0x00 0x00 0x00 0x00 0x00,0x7132,ACK
0.090538750000000,2,DATA,0x3C3,0x8,0x01 0x84 0x01 0x00 0x00 0x00 0x00 0x00,0x7132,ACK

4.850720250000000,121,DATA,0x3C3,0x8,0x01 0x84 0x01 0x00 0x00 0x00 0x00 0x00,0x7132,ACK
4.890713250000000,122,REMOTE,0x0F0D0030,0x0,,0x0800,ACK
4.930716000000000,123,DATA,0x3C3,0x8,0x01 0x84 0x01 0x00 0x00 0x00 0x00 0x00,0x7132,ACK

9.090867749999999,227,DATA,0x3C3,0x8,0x01 0x84 0x01 0x00 0x00 0x00 0x00 0x00,0x7132,ACK
9.130887000000000,228,DATA,0x0C4,0x0,,0x3080,ACK
9.170884250000000,229,DATA,0x3C3,0x8,0x01 0x84 0x01 0x00 0x00 0x00 0x00 0x00,0x7132,ACK

here is 1 second with the pack full at 16 bars, possibly toggling the charge off and on, or balancing:

0.928693500000000,23,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
0.968702000000000,24,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.008703000000000,25,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.048697500000000,26,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.088707750000000,27,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.128700500000000,28,DATA,0x3C3,0x8,0x01 0x91 0x00 0x00 0x00 0x00 0x00 0x00,0x4EEA,ACK
1.168701500000000,29,DATA,0x3C3,0x8,0x01 0x91 0x00 0x00 0x00 0x00 0x00 0x00,0x4EEA,ACK
1.208702250000000,30,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.248705000000000,31,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.288705750000000,32,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.328716500000000,33,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.368709250000000,34,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.408710250000000,35,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.448721000000000,36,DATA,0x3C3,0x8,0x01 0x91 0x00 0x00 0x00 0x00 0x00 0x00,0x4EEA,ACK
1.488714000000000,37,DATA,0x3C3,0x8,0x01 0x91 0x00 0x00 0x00 0x00 0x00 0x00,0x4EEA,ACK
1.528714750000000,38,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.568715500000000,39,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.608718500000000,40,DATA,0x3C3,0x8,0x01 0x91 0x01 0x00 0x00 0x00 0x00 0x00,0x50C6,ACK
1.648719250000000,41,DATA,0x3C3,0x8,0x01 0x90 0x00 0x00 0x00 0x00 0x00 0x00,0x389B,ACK
1.688730500000000,42,DATA,0x3C3,0x8,0x01 0x90 0x00 0x00 0x00 0x00 0x00 0x00,0x389B,ACK
1.728723250000000,43,DATA,0x3C3,0x8,0x01 0x90 0x00 0x00 0x00 0x00 0x00 0x00,0x389B,ACK
1.768728250000000,44,DATA,0x3C3,0x8,0x01 0x90 0x01 0x00 0x00 0x00 0x00 0x00,0x26B7,ACK
1.808735000000000,45,DATA,0x3C3,0x8,0x01 0x90 0x01 0x00 0x00 0x00 0x00 0x00,0x26B7,ACK
1.848733750000000,46,DATA,0x3C3,0x8,0x01 0x90 0x01 0x00 0x00 0x00 0x00 0x00,0x26B7,ACK
1.888728750000000,47,DATA,0x3C3,0x8,0x01 0x90 0x00 0x00 0x00 0x00 0x00 0x00,0x389B,ACK
1.928729500000000,48,DATA,0x3C3,0x8,0x01 0x90 0x01 0x00 0x00 0x00 0x00 0x00,0x26B7,ACK
```
i first saw the third data byte go from 00 to 01 when it was plugged in to charge; it stayed at 01 during charging and then toggled 01 and 00 as the pack was reaching full.

i also recorded the main CAN buss at the same time while recording the bmu-cmu buss.

i left the CMU buss jumper wires in place in case there is some experiment to run and capture additional data.

The factory manual schematics show a K-line from the BMU to EV-ECU and also an automatic cell numbering IN-OUT wire pair from the BMU to the Pack/CMUs--i have no clue about what these are or what they do...


----------



## boekel (Nov 10, 2010)

Did anyone get further on this?


----------



## Tomdb (Jan 28, 2013)

Does anyone have an outlander they wont mind monitoring the pack canbus on?

Need a few captures to figure out how the balancing works.


----------



## kennybobby (Aug 10, 2012)

Since that previous data post i purchased an icarsoft i909 clone version of the Mitsubishi MUT-3 tool which can read the CAN datastream, and read and clear DTCs. Monitoring the BMU datastream during charging there is a data item called cell target value which was equal to the voltage of the lowest cell in the pack. This value may what was transmitted in the x3C3 ID from the BMU to the CMUs. Then when charging the bit toggling was the balancer drive enabled flag. When the pack is in the CV stage the datastream reports the balancer drive status of each cell as ON or OFF.

My pack has a low cell which just can't seem to catch up. All the other cells indicate balancer ON while the bad cell has balancer OFF--but it is about 150mV lower than all the rest.

My guess is that the BMU sends the target cell voltage to the CMUs along with an enable flag for the balancer drives, then the CMUs control the balancing for their cells. The CMUs must be reporting the balancer status since the i909 could read it, but i'm puzzled why i couldn't see this data when i monitored the battery CAN buss (as reported in the data post earlier).

i bought a BMU unit and indeed there are 2 separate CAN buss transceivers--one for the vehicle and one for the battery. The main processor is a Mitsubishi chip marked as MH8106F. There is an unpopulated ten pin connector pad (2 rows of 5) that may be a JTAG port.

press on regardless--endeavor to persevere...


----------



## Tomdb (Jan 28, 2013)

Hello Kenny,

We had the Imiev nailed down good. So that should be easy.

However the information I am after is the later Outland PHEV, slightly different bms slaves.

Has 2 messages that give the voltages then one message with temperatures. 
Need to find the construction of the 'control' message. 

So if anyone has monitored the BMU CMU and done a full capture?


----------



## Tomdb (Jan 28, 2013)

Gotten a capture of a Outlander module balancing, this has given me the ability to decode the balance command.


----------



## bigmotherwhale (Apr 15, 2011)

Amazing,  I was beginning to think i would have to use cheap Chinese balance modules. Thanks Tom

P.S I can send you a CMU if you want to play with it.


----------



## Tomdb (Jan 28, 2013)

I got my self a CMU or two.

https://github.com/tomdebree/OutlanderPHEVBMS

Here is some arduino code, it puts the cmu values into arrays. 
Also it can now control the balancing, at the moment set to lowest cell voltage.

Please take note, i had to use a strange CAN bus libary as other ones did not work on my new laptop.


----------



## Tomdb (Jan 28, 2013)

Now just like the Outlander the Imiev CMUs are decoded and working.

Github: https://github.com/tomdebree/ImievBMSV2

This means they now also will work with my SIMP-BMS.
https://www.diyelectriccar.com/forums/showthread.php/fs-tesla-vw-outlander-bms-master-198263.html


----------



## Coulomb (Apr 22, 2009)

kennybobby said:


> i made some CAN captures for the buss between the BMU and the pack...
> 
> This was sitting stationary with the key ON car READY with the pack ~62%, 348 volts, 3.96 vpc, temp 17C
> 
> ...


Actually, I believe that this is actually (with 0x173 = 371)
(371 / 200) + 2.1 = 3.955 V, just under your average pack voltage.
In other words, the value in the packet is the voltage in units of 5 mV (or the voltage in volts multiplied by 200), with a 2.10 V required offset.

This is a set point, not a measurement. If the LSB of the third byte (the bypass enable bit) is set, then bypassing will occur at 10 mV more than this threshold.

There are other flags in bit 1 of the third byte, and bits 0 and 1 of the fourth byte; I haven't gotten to what they do yet. I suspect they're to do with timeouts, so possibly error related.

I'll provide more details elsewhere, I just thought I'd correct this one as I saw it.



> i was expecting to also see cell temperatures, but it never happened.


As you've figured out since, there is a set of CAN packets with IDs 0x611 to 0x6C4 that provide actual cell voltages and temperatures. These also use the weird 200th of a volt with 2.1 V offset encoding. The reason for the 2.1 V offset seems to be that they calculate another set of voltages with 10 mV units and also a 2.1 V offset; these would fit into a single byte for voltages of 4.65 V or less. But they don't seem to be used.



> The factory manual schematics show a K-line from the BMU to EV-ECU and also an automatic cell numbering IN-OUT wire pair from the BMU to the Pack/CMUs--i have no clue about what these are or what they do...


It took me the longest time to figure out what the global variable representing the CMU ID was all about. (So that was a breakthrough when it came  ) There is code that delays for an amount of time proportional to the CMU ID less one, and pairs of zeroes in a serial data stream seem to indicate the CMU ID. It's tricky when all 12 CMUs are running identical software in read-only flash memory, but they all have to do different things... this is how they solve that problem. I'd say that auto cell numbering out on the BMU connects to the input of a serial port on CMU1, they daisy chain through to CMU 12, and CMU12's serial output connects to auto cell numbering in on the BMU (for some sort of sanity check or checking for a dead CMU or cable perhaps). The exact details escape me, but if I flap my hands hard enough, I can sort of convince myself it could work


----------



## paul(uk) (Jun 4, 2019)

hi,
I know this is an old thread but we have a BMS interface that reads the CAN and can communicate with the LEV40 BMS module PCB. it can reading temperatures and voltages plus controlling balancing https://www.secondlife-evbatteries.com/bms.html


----------



## hoverjudge (Jan 12, 2020)

Hi Paul
Will the SIMP BMS work with the I-Miev battery pack. It has the LEV50 cells and 12 battery modules


----------



## Tomdb (Jan 28, 2013)

Yes it does and should be listed as an option on the link for purchase.


----------



## Oymyakon (Jun 21, 2021)

Hi Guys,
Sorry, I am late to the party. 
Did anyone sort out the CMU numbering system on an Outlander. I am just starting my first EV project and I have bought an outlander pack.
but one of the CMU is erratically reading Cell 1 nad 2. it jumps from 5v to 1.6 etc etc.
I think I need to replace the CMU but I am worried it will have the wrong ID.
Any help would be much appreciated.


----------



## bigmotherwhale (Apr 15, 2011)

Oymyakon said:


> Hi Guys,
> Sorry, I am late to the party.
> Did anyone sort out the CMU numbering system on an Outlander. I am just starting my first EV project and I have bought an outlander pack.
> but one of the CMU is erratically reading Cell 1 nad 2. it jumps from 5v to 1.6 etc etc.
> ...


I had an erratic cell voltage like this, it turned out to be because i had dismantled the pack, the bolts that hold the bus bars down also connect the end cells to the bms, try tightening the bolts.
Not sure about the ID 
regards


----------



## Oymyakon (Jun 21, 2021)

Hi,
Thanks, i have already checked that. This is slightly different it swaps cell 1 &2 from 5v to 1.3v and then swaps back.


----------



## bigmotherwhale (Apr 15, 2011)

Could it be a can communication error? or a loose connection on the cell terminals or connector, I would probably say its the latter, pay close attention to the wire connecting to the bms / CMU between cell 1 and 2, If you need a spare CMU try asking on here or look on ebay, there are sellers offering cells they probably have no idea what to do with the boards.


----------



## Fam69 (11 mo ago)

Hi. I'm sorry but I quite don't get it how to use software from Tom. Can someone post a tutorial how it all works? Do I need Arduino? Does this software work with other versions of teensy?How to read data from CMUs with this contraption.


----------

