# Battery Pack Sniffer and Monitor V2.0



## skooler (Mar 26, 2011)

Subscribe 

Sent from my SM-N9005 using Tapatalk


----------



## Yabert (Feb 7, 2010)

Interesting.... Subscribe.


----------



## rwaudio (May 22, 2008)

Cool evolution of the product Wolf.
I have access to a car with a volt pack (actually most of two) 90S2P in a Porsche 914. I've also done a Solectria Force with a volt pack 48S2P (fits perfect in the truck if you reconfigure slightly).

If you need any beta testing just let me know. 






WolfTronix said:


> I am working on a Version 2.0 of the Battery Pack Sniffer.
> 
> Requested Features:
> 
> ...


----------



## WolfTronix (Feb 8, 2016)

I am working on the hardware now... 
Still debating what connectors to put on it.
Then I can get boards out, and order parts.

But I will be looking for the CAN packets and how they are parsed.
Since I don't plan on acquiring the other battery packs to reverse engineer them... 

I also need to get the USB mass storage boot loader finished... (you should be able to drag and drop the .hex file in the firmware directory, and it will flash it into the micro).

Then I can add new battery packs as needed. 



rwaudio said:


> Cool evolution of the product Wolf.
> I have access to a car with a volt pack (actually most of two) 90S2P in a Porsche 914. I've also done a Solectria Force with a volt pack 48S2P (fits perfect in the truck if you reconfigure slightly).
> 
> If you need any beta testing just let me know.


----------



## rwaudio (May 22, 2008)

WolfTronix said:


> I am working on the hardware now...
> Still debating what connectors to put on it.
> Then I can get boards out, and order parts.
> 
> ...


I could send you a factory volt BMS and wiring harness if it's helpful.
The pinouts of all the connectors are available in the Volt repair manual.


----------



## WolfTronix (Feb 8, 2016)

Not sure... I would almost need access to a intact pack to read out and decode the cells, current, and temperature sensors. Control the pre-charge, contactors, and balancer (if not already controlled by the BMS).

I have not looked around, but I someone probably has decoded the CAN packets already...

On second thought it might be useful to open up the BMS and see how easy it would be to modify for use with smaller / different pack configurations.

Like swap out the microcontroller like I did on the Nissan Leaf BMS.




rwaudio said:


> I could send you a factory volt BMS and wiring harness if it's helpful.
> The pinouts of all the connectors are available in the Volt repair manual.


----------



## WolfTronix (Feb 8, 2016)

For connectors I am looking at these iGrid series from Molex:
Rated at 2A per pin.

https://www.digikey.com/products/en?keywords=5018761440

This 14 pin connector would have the following functions which should cover the majority of use cases:
+12V (2)
GND (2)
Source OUT(2)
Sink OUT (4)
ADC IN (2)
CAN (2)

https://www.digikey.com/products/en?keywords=5018761040

This 10 pin connector would have the following functions which should cover the remaining use cases:
+12V (1)
GND (1)
Source OUT(1)
Sink OUT (3)
CAN (2)
RS232 (2)


All +12V pins are connected to each other and the output from the boost converter. The Pack Sniffer can also be powered from the +12V vehicle supply with the boost converter disabled.

Source OUT pins are switched +12V PWM outputs.
Sink OUT pins are switched GND PWM outputs.
ADC IN pins are GND - 12V ranged inputs.

Example in vehicle mapping using the 14 pin connector:
Source OUT_1 [BMS Enable]
Source OUT_2 [Charger Enable]
Sink OUT_1 [Ground Side Contactor]
Sink OUT_2 [Pre-Charge Relay]
Sink OUT_3 [High Side Contactor]
Sink OUT_4 [Motor Controller Disable]
ADC IN_1 [Ignition Switch]
ADC IN_2 [Display Dimming]
CAN [BMS]

I tried to cover everything I can think of.


----------



## WolfTronix (Feb 8, 2016)

It has been a while, but I finally got the hardware built up:
I forgot the flyback diodes on the outputs. 
But it looks like there is plenty of room to bodge them in.


----------



## el ohmbre (May 28, 2009)

That's great. I've been watching for some more progress on this project. I'm excited to see how the testing goes.


----------



## WolfTronix (Feb 8, 2016)

Boost converter works (tuned the PID).
Transition from discontinuous to continuous conduction mode is nice and smooth.

+5V in and +12V out.









Note the voltage drop on +5V over the USB cable and connector.

This voltage sag was causing the LCD display to drop out when using crappy USB power banks and USB cables on the Pack Sniffer 1.

This was the main reason I decided to take +5V USB in then boost convert to +12V to run the I/O, (contactors, power the BMS, etc...).

Then linear regulate that back down to a stable +5V to run the LCD display, (it won't dim or blank, when the contactors turn on).

Then regulate the +5V down to 3.3V for the microcontroller.

The 10W boost converter will pull a max of 2A from a power bank.

For applications needing more than 10W, you can wire in an external +12V supply on either the 10-pin or 14-pin connector.

If you power the Pack Sniffer 2, with and external +12V supply, make sure you use an inline diode and fuse.

This will prevent the boost converter from back powering your +12V system when +5V USB is connected.

Now working on the SD card based boot loader...


----------



## WolfTronix (Feb 8, 2016)

SD card boot loader is now working:
https://youtu.be/fgWXuaXiOF8






Just need to optimize for space and add in some more "user experience" ( aka, error messages on the LCD display ).


----------



## boekel (Nov 10, 2010)

Superb!!

Tesla batteries next on the list?


----------



## WolfTronix (Feb 8, 2016)

boekel said:


> Superb!!
> 
> Tesla batteries next on the list?


I don't have any Tesla BMS units to play with...

If I can get the CAN messages and definitions, it should be able to read out Tesla Packs and display the info.

Same with Volt Packs, and any other CAN based BMS.

(Technically The RS232 port could also read serial based BMS units, and the expansion port could read I2C based BMS units).


----------



## Josefmifsud1974 (Sep 29, 2017)

http://www.diyelectriccar.com/forum...-hybrid-scooter-no-initialisation-188650.html
I sent you a mail or pm regarding this issue can you have a look please and if there is same feedback will be immensley gratefull for you advise


----------



## WolfTronix (Feb 8, 2016)

I responded on your other post...


----------



## boekel (Nov 10, 2010)

WolfTronix said:


> I don't have any Tesla BMS units to play with...
> 
> If I can get the CAN messages and definitions, it should be able to read out Tesla Packs and display the info.
> 
> ...


Tomdb and Ckidder have done a lot of work on this.
I can send you a BMS master board and a slave board...


----------



## Josefmifsud1974 (Sep 29, 2017)

WolfTronix said:


> I am working on a Version 2.0 of the Battery Pack Sniffer.
> 
> Requested Features:
> 
> ...


This unit you are working on sniffer 2 can be used to monitor and record the traffic of the Hybrid power pack to the main ECU of a good working scooter scooter?
Obviously I will need advise and how to proceed as im new to can bus and if possible can send you the data as required for you to view if all is possible.
looking forward for feedback and I thank you again for your support and work to help .


----------



## WolfTronix (Feb 8, 2016)

boekel said:


> Tomdb and Ckidder have done a lot of work on this.
> I can send you a BMS master board and a slave board...


I don't think I would need the physical hardware, if they have already collected CAN data and decoded the packets. The question would be if they want to share what info they have.


----------



## WolfTronix (Feb 8, 2016)

Josefmifsud1974 said:


> This unit you are working on sniffer 2 can be used to monitor and record the traffic of the Hybrid power pack to the main ECU of a good working scooter scooter?
> Obviously I will need advise and how to proceed as im new to can bus and if possible can send you the data as required for you to view if all is possible.
> looking forward for feedback and I thank you again for your support and work to help .


The Pack Sniffer 2 currently does not log CAN traffic to the microSD card.
That is a feature that will be developed in the future...

It would need the packet protocol in order to decode, monitor and display the battery pack info.

To get the packet protocol you would need to apply known voltages to the individual cells and then see what data changes in the CAN packets.

This is how I reverse engineered the CAN and LIN bus on the Nissan Leaf BMS:
http://www.wolftronix.com/E10_LithiumUpgrade/index.html

It is not really meant as a guide, but it gives you the concepts, hardware and tools needed to reverse engineer the protocol.


----------



## WolfTronix (Feb 8, 2016)

Boot loader is now done, and crammed into Auxiliary Flash. 

Main Flash will look like an ocean, compared to the pond I have been working in. 

The boot loader now has access, and can parse the config file used to set up the Pack Sniffer Application...


I have the following in mind:

1. Skip the boot loader. Force boot loader to launch the application. (Saves time on boot up, since it does not need to calculate and compare check sums).

2. LCD Page delay How many ms each page is displayed. (If you want to see everything the boot loader is doing at your own pace... or really fast).

3. LCD Display dimming. If Dimming is enabled, and tied to one of the ADC channels. (If it is dark out and you power cycle, the boot loader will cause the display to be at 100% brightness, until execution is transferred to the main application... So this would cause the boot loader to use the same dimming table as the main application). It won't blind you at night. 

What other config options should be supported while in the boot loader?


----------



## WolfTronix (Feb 8, 2016)

Ported the older Pack Sniffer 1 code over to the Pack Sniffer 2

Programmed from the SD card via the new Boot Loader. 









I need to build up some cables to connect it to my Leaf Battery Pack.


----------



## boekel (Nov 10, 2010)

Room left for this?

http://www.diyelectriccar.com/forums/showthread.php/tesla-bms-190266.html


----------



## WolfTronix (Feb 8, 2016)

Yup.

The BootLoader takes up all the space in Auxiliary Flash (24KB).

But Main program Flash is 256KB.

Since I don't have a Volt or Tesla Battery pack to reverse engineer the CAN protocols... 

I will have to wait for others to do it (and if they make that info public), then the Pack Sniffer can read/display/control other battery pack types. 

I am also adding support for the Pack Sniffer 2 to control NLG5 series battery chargers, since I will be using one...

But if I know the CAN protocol I can make any battery charger work with it.


----------



## WolfTronix (Feb 8, 2016)

Demo showing the Pack Sniffer 2 boot loading the Pack Sniffer 1 application from the microSD card.

Then reading the Nissan Leaf battery pack cell voltages and state of charge / health.


----------



## Moltenmetal (Mar 20, 2014)

Wonderful to see all this progress on OEM part re-use!

Consider me subscribed...


----------



## Kevin Sharpe (Jul 4, 2011)

WolfTronix said:


> Since I don't have a Volt or Tesla Battery pack to reverse engineer the CAN protocols...


How much of the Tesla pack would you need to make a start? Would this hardware work for now? All I'd ask in return is that you release the CAN data as open source


----------



## WolfTronix (Feb 8, 2016)

Kevin Sharpe said:


> How much of the Tesla pack would you need to make a start? Would this hardware work for now? All I'd ask in return is that you release the CAN data as open source


I am not familiar with the Tesla hardware...
But I am not sure the BMS will spit out any useful data without the cells connected.

Does the Tesla have a diagnostic display that shows the individual cell voltages?

If so, I would just need a CAN packet recording of that mode being invoked and a simultaneous picture of the displayed voltages.

Then I could decode the CAN packets from that info, no hardware needed.


----------



## WolfTronix (Feb 8, 2016)

Finished building up the remaining Pack Sniffer 2s.

Also built a hardware I/O test rig out of a 2011 Nissan Leaf pre-charge / contactor assembly, including a battery pack simulator to test CAN bus.


----------



## el ohmbre (May 28, 2009)

Great progress. 

I have all my Leaf modules configured and installed in my truck, El Ohmbre. I have the contactors, current sensors and fuses mounted on a board that will fit in one of the battery boxes. I have my new Elcon charger that requires CAN input to charge and I have the CAN spec for it.

So I think I'm ready to do "field testing" whenever you are happy with your progress. I will just need to do the wiring between the charger, contactors, BMS and Pack Sniffer 2, but I'll wait until I fully understand what I'll need to do.

I assume the Pack Sniffer 2 will get mounted in the dashboard. The charger is in the engine compartment, the BMS will be in one of battery boxes under the truck bed and the contactors will be in the other one. So I will need to figure out how to connect them all.

If you publish a wiring diagram at any point, I could go ahead and start the wiring.

Do you think I need to build a CAN monitor to watch the traffic?

-Tom


----------



## WolfTronix (Feb 8, 2016)

I have the recommended wiring diagrams done, they are the cables used in the the Hardware I/O test video.

I am working on getting everything published to my website.

Send me the Elcon CAN spec, and I can make a recommended wiring diagram for it as well.

The Pack Sniffer 2 is a CAN monitor. ;D

At this point I feel comfortable selling them, since all the hardware I/O is tested, boot loader is done, and config system works.

Everything from now on is just software/firmware updates to add features.

Number one on my list is USB to microSD card support...
Cause it would be nice to not have to keep taking out the microSD card copying the new .hex file and then reinserting it. 

Also, I wanted to provide a microSD card, but finding working microSD cards has been hard.

Of the 10 I ordered on eBay only 2 work, the others where cracked and/or just don't show up in windows. (they are obviously pulls from old cell phones).

My two working ones are the ones I used in the video...

So I think I will end up selling the Pack Sniffer 2 without a microSD card...
Perhaps most people have one floating around, from an old cell phone / camera?

The microSD card needs to be FAT32 (under 32gig), and not have a boot partition on it.

Thoughts?


----------



## john61ct (Feb 25, 2017)

No, include all that's needed, format yourself. Good ones are easy as pie to find, just not the way you're trying to save pennies.

Buy them new, respected name brands, from proven trustworthy sources with good return policies.


----------



## WolfTronix (Feb 8, 2016)

john61ct said:


> No, include all that's needed, format yourself. Good ones are easy as pie to find, just not the way you're trying to save pennies.
> 
> Buy them new, respected name brands, from proven trustworthy sources with good return policies.


Yeah, I know... But I don't want to add $20.00 to the price for a microSD card that is only needed when doing a firmware update.

If you already have a microSD card in anything (cell phone, dash cam, Raspberry PI, etc...), you can take it out, copy the file to it, and then boot load and put it back in your device. 

It should be a rare occurrence.


----------



## el ohmbre (May 28, 2009)

That is great news! My truck wants to be back on the road.

I'll send the CAN spec via email.

So I don't need to figure out a CAN monitor; more good news.

I have micro SD cards but might be bigger than 32 gb. 

As john61 says, I buy them new. My biggest problem is that I lose them.

If I can find one, I'll send it along when I send my BMS for modification.


----------



## WolfTronix (Feb 8, 2016)

No need to send me the microSD card, the files will be on the website for download.

The code for the modified BMS is running in the battery pack simulator...
So that is getting close to done. 

If you watch the last video you will see lots of old cell phone batteries.
I am going to use those to build a small scale test battery back to connect to the modified BMS.

16 cells of capacity ranging from 900mA - 1250mA.

Then I can quickly test charge and discharge cutoffs and balancing with different capacity cells.

Should be making lots of progress soon...

Then I can get my Truck back on the road too.


----------



## CKidder (Dec 12, 2009)

Kevin Sharpe said:


> How much of the Tesla pack would you need to make a start? Would this hardware work for now? All I'd ask in return is that you release the CAN data as open source


Quite a bit of my work is released open source. Here: https://github.com/collin80/TeslaBMS you'll find open source software to interface with a Tesla module. The source should be sufficient to figure out how it all works. However, the Tesla modules talk over a serial connection, not CAN. So, if you want to use CAN it would either require decoding the Tesla BMS main comm or supporting a wacky baud rate (612500) for TTL serial. I don't know if anyone has published details about the Tesla main BMS. I certainly don't have the full specs at hand. I think I saw details about how to view the actual cell voltages but it was a long time ago. 

Lots of people have successfully interfaced with the modules over TTL serial but it is a whole different ballgame from just using CAN.


----------



## WolfTronix (Feb 8, 2016)

CAN would only be useful if you are trying to communicate with the entire stock battery pack, (grid tie / inverter projects ). Not sure if anyone has tried to put a whole Tesla battery in another EV.

I don't have TTL UART signals available to the outside world... But it looks like it would be possible to de-populate the RS232 level converter and then jump the TX and RX to the outside world through the connector.

Alternatively the internal I2C can also be mapped over to TTL UART, but would require another connector to get to the outside world.

As for odd baud rates, I would change the PLL multiplier/divisor settings on the primary oscillator to get a nice even multiple of the baud rate.

With my micro: 120Mhz / 196 = 612245 which should be close enough. (if it needs to be exact, I can bump up the oscillator tune register to get 120.05Mhz).

If people want this support I should be able to kluge it in.


----------



## CKidder (Dec 12, 2009)

WolfTronix said:


> As for odd baud rates, I would change the PLL multiplier/divisor settings on the primary oscillator to get a nice even multiple of the baud rate.
> 
> With my micro: 120Mhz / 196 = 612245 which should be close enough. (if it needs to be exact, I can bump up the oscillator tune register to get 120.05Mhz).


It doesn't have to be exact. As I'm sure you're aware (but might not be general knowledge) serial protocols tend to have some acceptable clock skew. It's, of course, not possible to create millions of crystals and oscillators and have them all be 100% accurate with no variation at all. So, there's always some skew allowable. TTL serial tends to accept around 2-3% error with no issues. I use an Arduino Due (well, really the ARM SAM3X) at 84Mhz. If you divide 84M / 612500 = 137.143. Since the SAM3X can do a free integer divisor you can ask for a 137 divisor and get 613139 baud. This works fine. It's even further off than your 612245 speed. So I think it'd work fine for you. In my case I had to use logic gates to buffer the signal as the Tesla BMS modules are 5V TTL and the SAM3X is 3.3v and not 5V tolerant.


----------



## WolfTronix (Feb 8, 2016)

CKidder said:


> In my case I had to use logic gates to buffer the signal as the Tesla BMS modules are 5V TTL and the SAM3X is 3.3v and not 5V tolerant.


I lucked out, my TX line is 3.3V and my RX line is 5V tolerant.

If I use the I2C lines then both are 5V tolerant.


----------



## WolfTronix (Feb 8, 2016)

I think my zero crossing detector in my NLG511 battery charger is bad. 






This would explain why it defaults to European Mains.


----------

