Per the 451 Service Manual, p 24, the battery management system and the contactors for disconnecting the high voltage output are located within the battery module. There is a connector on the rear passenger side of the battery that runs everything that's high voltage.
Unlike some other electric vehicles, the high voltage Service Disconnect in the Smart (Located under the instrument panel in the left footwell) doesn't actually disconnect the battery. It disconnects the control lines to the contactor relay inside the battery. Many cars have a Center of Pack disconnect, that physically interrupts the main conductor in the battery, which is much safer. The battery terminals will not be live if this disconnect is pulled, however the battery is still live internally. I don't like this.
Pulling this Service Disconnect, it would then be safe to pull the main battery power line. I'd still be wearing voltage rated gloves and safety glasses for this operation.
The manual states that all high voltage DC will be discharged within 5S. I'd wait longer, and test the high voltage bus with a good voltmeter and gloves before trusting that it was really not live.
OK, now you have a wire that could potentially be the point where you hack in an extra battery, of the same number of cells in series as your original. In theory. This wire is exposed to the elements, water, road dust and flying gravel, so your connection better be very robust.
Another important point: The interface between this line and your range extender *must* be a relay. This line can't be left live all the time, or the battery will go flat when you park.
The onboard charger won't charge your battery. A separate charge plug, or a tap on the J1772 connector to your own onboard charger, will be needed to fill up. There may be issues with the J1772 interface at a public charging station, as you are now pulling more power than the car is "telling" the charging station about. Or not.
P56 shows a diagram of CAN bus points. The High Voltage State of Charge indicator instrument gets it's info from the CAN bus, which in turn talks to the HV battery BMS. Your hacked battery can not talk to the state of charge indicator, and you will have no idea of the additional range and state of charge unless you buy an aftermarket meter like this one
It doesn't come right out and say this, but the HV Battery contactor relay is almost certainly controlled by the CAN bus. Unless we want to start hacking into THAT, like these guys
are, we'll need a separate control for our range extender battery main contactor relay.
Some ideas for controlling this relay on your range extender batt: Simply operate the relay from a part of the 12V system that is powered when the car is powered, operate it from a manual switch, or get an Arduino CAN bus shield
and sniff the bus for the right signal. If I lost you right there, then run away screaming right now I don't blame you.