1. Attachments are working again! Check out this thread for more details and to report any other bugs.

Reverse engineering the BMS - HV ECU communication protocol

Discussion in 'Gen 3 Prius Technical Discussion' started by vjkomix, May 13, 2021.

  1. vjkomix

    vjkomix New Member

    Joined:
    May 13, 2021
    2
    0
    0
    Location:
    Salford
    Vehicle:
    2010 Prius
    Model:
    Active
    Hi there,

    So I'm trying to reverse the comm protocol between the battery management system and the hv ecu.

    The chip responsible for comm in the bms is NEC 780113(A), pin 26 and 27 on the chip. These according to the manual have an UART hardware config. Please find attached the datasheet. Who wants to check: p.22, 39, 266.

    I have hooked up the oscilloscope (Hantek 1008c) to these 2 channels. A video of the capture:



    What I'm struggling to understand is what protocol it is in order to go further to sniff it and reverse engineer. I have ordered a smart oscilloscope for that. Hope it helps.

    If the community has any ideas, please post.
     
    #1 vjkomix, May 13, 2021
  2. PriusCamper

    PriusCamper Senior Member

    Joined:
    Mar 3, 2012
    11,330
    4,614
    0
    Location:
    Pacific Northwest, USA
    Vehicle:
    2007 Prius
    Model:
    Two
    #2 PriusCamper, May 14, 2021
  3. vjkomix

    vjkomix New Member

    Joined:
    May 13, 2021
    2
    0
    0
    Location:
    Salford
    Vehicle:
    2010 Prius
    Model:
    Active
    BMS chip:

    Wed May 12 13-33-05.jpg

    Datasheet attached.
     

    Attached Files:

    #3 vjkomix, May 14, 2021
  4. wheezyglider

    wheezyglider Active Member

    Joined:
    Mar 12, 2011
    247
    178
    0
    Location:
    SF Bay Area
    Vehicle:
    2010 Prius
    Model:
    Five
    Just from the thumbnail that looks a lot more like CAN (or anything differential like modbus) than UART serial. No time to peruse that datasheet right now though...
     
    #4 wheezyglider, May 15, 2021
  5. tkelly2784

    tkelly2784 New Member

    Joined:
    Aug 20, 2021
    2
    1
    0
    Location:
    Oregon
    Vehicle:
    2011 Prius
    Model:
    One
    I'm lazy, has anyone done this for a gen1 or gen2?

    P. 226

    "Asynchronous serial interface (UART) mode This mode supports the LIN (Local Interconnect Network)-bus."

    Hey it looks like it will probably be the LIN rather than a UART since LIN is standardized for automotive use and you can access LIN data through Toyota scanning systems.

    If you can get the LIN data through whatever module is hooked up to CAN you could be reading the data on the LIN and CAN at the same time and make it really easy on yourself.

    This is an explanation for how to look into LIN data for a resistive cabin heater.

    I can't post links but if you search for

    "Fiat 500e cabin heater"

    the first hit on DIYelectriccar will show you an example of LIN hacking.

    P. 226 goes on.

    "LIN stands for Local Interconnect Network and is a low-speed (1 to 20 kbps) serial communication protocol intended to aid the cost reduction of an automotive network. LIN communication is single-master communication, and up to 15 slaves can be connected to one master. The LIN slaves are used to control the switches, actuators, and sensors, and these are connected to the LIN master via the LIN network. Normally, the LIN master is connected to a network such as CAN (Controller Area Network). In addition, the LIN bus uses a single-wire method and is connected to the nodes via a transceiver that complies with ISO9141. In the LIN protocol, the master transmits a frame with baud rate information and the slave receives it and corrects the baud rate error. Therefore, communication is possible when the baud rate error in the slave is ±15% or less."

    it also shows you how the protocol works, but I would just use a LIN scanner over an O-Scope, even if you have to build one with a transceiver.
     
    #5 tkelly2784, Aug 20, 2021
(You must log in or sign up to post here.)