Smart Car of America Forum banner

461 - 480 of 524 Posts

·
Registered
Joined
·
23 Posts
Alright let's get down to the nitty-gritty of this, I'd rather first give it a solid attempt to figure this out myself than send my bms overseas for a fix.....what "tool" to copy firmware from a good, non bricked bms?
(BOSCH 0 442 001 001 , 0442001001)
I am a little familiar with K-TAG or similar tuning and have a possible lead on a good bms. ANY thoughts along these lines VERY greatly appreciated. There are at least 20+ reports online of people getting started digging into these packs, but no resolution out there...

I have a plan for charging- lab power supplies are expensive & I only mentioned those because I had them already. for ~110-120v module-level charging I'll be using (adjustable) boost "step-up" dc-dc converters powered by 12v DC which will be a very slow trickle charge.. I'll also be using adjustable step-down "buck" dc-dc converters or lab power supplies for individual cell charging if desired. and at this point 6s hobby charger/s for possible cell balancing, or perhaps bluetooth enabled BMS around 14s/17s from aliexpress (again for cell balancing)..currently in my shopping cart but not yet ordered. Of course all safety precautions will be foremost including: very, very low amperage to start out, monitoring individual cell voltages, and awareness of risk of fire.

You can check the voltage by using this little tool. It's a DIY tool.
THANK YOU, can you confirm if plugged in to a vehicle with a dead HV battery, open contactors, it will read individual cell voltages/etc?
 

·
Registered
Joined
·
10 Posts
Hi friends
Problem with error

P18051C
P0AA100
P0AA400
P1D799A
U01A200
U01A100
U01A000
P1614FA
P0DE6FB
P14F300
P0DE6FA

SOLVED.
If you need help, feel free to contact me

Viber or Whatsapp +380931130000

I cannot tell you all the details, the problem is inside TC1797
For people trying to do it with clone other bms, it’s a bad idea because you’re gonna kill the current sensor!
 

·
Registered
Joined
·
87 Posts
THANK YOU, can you confirm if plugged in to a vehicle with a dead HV battery, open contactors, it will read individual cell voltages/etc?
Yes, it will. Did something similar a few weeks ago.
 

·
Registered
Joined
·
23 Posts
Re: current sensor yes anyone digging this deep should have probably come across this info already.. It's located on a main power bus bar, near/behind the bms, with a small wiring harness plugged into it. Essential to unplug/remove before attempting anything (charging cells/modules, etc especially) on the internal pack (safety precautions foremost). I've seen comments on youtube etc indicating this part may be difficult or impossible to track down if yours is damaged...as with this entire process...proceed at your own risk!

As I suggested previously - the plan would be acquire good bms module, (remove bms completely) and interface (via connector pins or circuit board) with k-tag (or other ecu/module programing 'tool'). Therefore no danger to the current sensor. Maybe someone can sell/share the file (and pin out of the connectors, bdm - bms circuit board if needed) so international shipping and hassles can be avoided?

I have not pulled my BMS yet & haven't found a visual of the BMS circuit board, but gosmartservice provides a clue, we know it is a BOSCH module, assuming now TC1797 "chip" , (many brands programmer tool potentially compatible, I will stick with K-Suite & K-tag for my initial experiments unless anyone suggests a different direction)... next step is to find any info on the circuit board/ pin out. IF the board has a common BDM interface (as opposed to having to solder to random points on the circuit board to interface), using ("bdm BOSCH adapter" or similar "bdm pin adapter", bdm frame clamp, k-tag multiplexer)...could be straightforward.. If so I will attempt the project myself. If no BDM interface on the board I think that might be where the experimenting ends for me...at that point..sending to gosmartservice becomes the obvious solution!

34673615_10216191577603602_6599295083701338112_n.jpg
 

·
Registered
Joined
·
1,181 Posts
Re: current sensor yes anyone digging this deep should have probably come across this info already.. It's located on a main power bus bar, near/behind the bms, with a small wiring harness plugged into it. Essential to unplug/remove before attempting anything (charging cells/modules, etc especially) on the internal pack (safety precautions foremost).
Unfortunately, the main posters on this long thread had no idea about the need to remove this sensor before charging the cells. This information a not anywhere that I could find save for a detached context-less discussion on needing to find a replacement sensor here:


They have since junked their ED's and left this forum.
 

·
Registered
Joined
·
10 Posts
+Current sensor
Essential to unplug/remove before attempting anything (charging cells/modules, etc especially) on the internal pack (safety precautions foremost).

If need current sensor, we have a handmaid done
Error of current sensor dead is Р0АС029


Re: current sensor yes anyone digging this deep should have probably come across this info already.. It's located on a main power bus bar, near/behind the bms, with a small wiring harness plugged into it. Essential to unplug/remove before attempting anything (charging cells/modules, etc especially) on the internal pack (safety precautions foremost). I've seen comments on youtube etc indicating this part may be difficult or impossible to track down if yours is damaged...as with this entire process...proceed at your own risk!

As I suggested previously - the plan would be acquire good bms module, (remove bms completely) and interface (via connector pins or circuit board) with k-tag (or other ecu/module programing 'tool'). Therefore no danger to the current sensor. Maybe someone can sell/share the file (and pin out of the connectors, bdm - bms circuit board if needed) so international shipping and hassles can be avoided?

I have not pulled my BMS yet & haven't found a visual of the BMS circuit board, but gosmartservice provides a clue, we know it is a BOSCH module, assuming now TC1797 "chip" , (many brands programmer tool potentially compatible, I will stick with K-Suite & K-tag for my initial experiments unless anyone suggests a different direction)... next step is to find any info on the circuit board/ pin out. IF the board has a common BDM interface (as opposed to having to solder to random points on the circuit board to interface), using ("bdm BOSCH adapter" or similar "bdm pin adapter", bdm frame clamp, k-tag multiplexer)...could be straightforward.. If so I will attempt the project myself. If no BDM interface on the board I think that might be where the experimenting ends for me...at that point..sending to gosmartservice becomes the obvious solution!

View attachment 62410
 

·
Registered
Joined
·
127 Posts
My HV battery is down to 388.3V, and I have exactly the same issue. I have two error flags that will not clear.
Unit #11 Drive train control unit
U011200 Communication with control unit "High Voltage Battery" has a malfunction
U012287 Communication with "Traction System" has a malfunction - The message is missing

Unit #12 Battery Management System
P0DE7FA Stored & Current
The cell voltage of the high voltage battery module are too high
P18051C Stored
The hardware monitoring function has detected a fault in the control unit

I have tried both the auto scan and quick erase as well as reading and attempting to clear individual faults, but these two remain un-clear-able.
I have a suspicion that we need to do something else ... perhaps some bizarre combination of dashboard button pushes ... but if anyone has a hint, please send it along.

I'm curious if anyone has successfully resuscitated one of these cars from this kind of condition.

Mine would not start or charge.
I recovered from that state by moving the wires around near ECU.
Now it starts and runs fine, unsure which wires are flaky or intermittent.
If I move them around erros return


See my error screenshot here
 

·
Registered
Joined
·
23 Posts
Finally an update, slow progress. My hv battery is removed & I’m digging in to it. Youtube videos, posts on this forum, and the mylab-odyssey site have been helpful. I’m trickle charging each of the 3 modules at ~100-130v DC, low amperage using 12v power supplies and dc-dc adjustable boost converters, all cells seem to be taking a charge ,individual cell voltages are close so far but I haven’t finished charging or started balancing yet (bus bars, bms boards, current sensors, and contactors all are disconnected). I have a plan for balancing but I’m not yet fully confident in my wiring/connections on the top- not settled on how to connect to the individual cells/contacts, preferably without removing the (3) top bms circuit boards (as the ribbon cables look fragile and I’d rather not remove boards unless necessary)..

Regarding "flashing" the BOSCH BMS (obtaining a copy of the firmware/chip from a good BMS would be part of the plan, of course), with Infineon TC-1797-512F180EX....

I’ve removed bms & removed cover to look at one side of the bms circuit board, see photos. Possibly, one could interface through pin out of the external connector ?(picture) , which has pins well labeled (1-4 & A-H)...//more likely through the edc17 / med17 type pads circled in the last photo(JTAG diagnostic PORT/interface I believe) . I'm a little lost as to what software/interface might, perhaps be able to read/write through this interface, and more research would be needed to wire it up into "boot mode".... (Typically software for writing ECU/modules might have a picture or diagram that shows a couple of wires, a jumper , resistor, or a "boot" pin, etc needed to get it to "boot mode", also likely power supply needed). I haven't found any software that mentions support of this bosch bms directly, but lots of options support ECU's with the tc1797 chip, and some minimal support for other (non-ecu) modules with this chip, but not much info out there that I can find. Some possible options for software/interface that is compatible with tricore chips: ktag,kess,fg galletto,ktm bench,infineon miniwiggler & DAS? OR ?? Any thoughts, clarification, or help greatly appreciated.

Here is a link to the TC1797 data sheet with chip pin out, tc1797 pdf , that might help, but more useful would be BMS pcb info/diagrams and/or a pin out of the external bms connector... any ideas there? alldata, mercedes, etc? Anyone here on forums like MHHauto or digital-kaos where there seem to be some knowledgable people & relevant discussion about ecu/module programming, Infineon tricore, TC1796/TC1797/1798 type, BOSCH modules, JTAG interface, etc?

A3BB27E6-5014-4738-BEA5-A567C0547027.jpeg CDFC5BAA-9AE6-4182-A92F-00519ABA126A.jpeg 3E71C128-EFC1-4FE5-B38A-ACA540444BD3.jpeg IMG_E0766[1].JPG
 

·
Registered
Joined
·
23 Posts
TESTMODE = possible "boot mode" pin ? On our bosch bms board, looks tricky to trace it to a spot on the pcb, so again any details or diagrams of the BMS board or the connector pinouts would be most helpful.
1111.jpg IMG_0773[1].JPG

Working on trying to figure out the pinout of the JTAG pads mentioned in last post (14pin) , once I've done more research I suppose I'll contact some of the companies selling chip tuning tools/software with details and see if they can point me in the right direction (what tool to bench read/write BOSCH tricore 1797 pcb with JTAG EDC17/MED17 type probe/adapter?). The images below are relevant to BOSCH ecu's with tricore tc1797, but not confirmed to be identical to our bosch BMS yet.

db8de3441e06a69d3fdabf948bd14a11.jpg 33333.jpg ade9u4eb.jpg
 

·
Registered
Joined
·
23 Posts
photo of the other side of the bms circuit board (link), anyone care to comment on the best method to remove adhesive without damaging anything- heatgun,scraper,pick? Around the plug seems tricky as well. Or it may be not needed to access once the pinout/etc is figured out.
 

·
Registered
Joined
·
10 Posts
photo of the other side of the bms circuit board (link), anyone care to comment on the best method to remove adhesive without damaging anything- heatgun,scraper,pick? Around the plug seems tricky as well. Or it may be not needed to access once the pinout/etc is figured out.
This is my photo ;)
I have use a press to separate the board from the case. just push on the plug
 

·
Registered
Joined
·
10 Posts
TESTMODE = possible "boot mode" pin ? On our bosch bms board, looks tricky to trace it to a spot on the pcb, so again any details or diagrams of the BMS board or the connector pinouts would be most helpful.
View attachment 62748 View attachment 62752

Working on trying to figure out the pinout of the JTAG pads mentioned in last post (14pin) , once I've done more research I suppose I'll contact some of the companies selling chip tuning tools/software with details and see if they can point me in the right direction (what tool to bench read/write BOSCH tricore 1797 pcb with JTAG EDC17/MED17 type probe/adapter?). The images below are relevant to BOSCH ecu's with tricore tc1797, but not confirmed to be identical to our bosch BMS yet.

View attachment 62750 View attachment 62751 View attachment 62749

it’s not easier to pay money than to spend a lot of time and still then do it with me? ?
 

·
Registered
Joined
·
23 Posts
it’s not easier to pay money than to spend a lot of time and still then do it with me? ?
Of course it is easier to send it off for a fix than to attempt to figure it out - I'm very glad that you (and Softelectronic in Bulgaria, not sure if there are any others?) have been able to figure this out - it gives me hope. I have actually sent several potential customers towards your business already. However I'm in no big hurry and like learning new things & experimenting. You had some help from other people figuring this out on another forum, it appears (see post where you were figuring it out here), so any pointers you can give that might get me or other DIY types pointed in the right direction would be greatly appreciated. I am not a shop or a business who will attempt to sell this repair.

In the last picture you're just using c4 multiplexer and xentry, which I have already. Is this for the actual "fix"/re-flashing or just code reading? Is it possible you might consider selling the bms firmware/file/pinout/process, or offering your service via remoteviewer/etc? I am willing to buy hardware if c4 multiplexer is not what you're using, as I always like new tools/toys. I think for a lot of your potential customers, sending their bms overseas is a step that they would strongly prefer to avoid, if at all possible, myself included.
 

·
Registered
Joined
·
10 Posts
  1. Of course it is easier to send it off for a fix than to attempt to figure it out - I'm very glad that you (and Softelectronic in Bulgaria, not sure if there are any others?) have been able to figure this out - it gives me hope. I have actually sent several potential customers towards your business already. However I'm in no big hurry and like learning new things & experimenting. You had some help from other people figuring this out on another forum, it appears (see post where you were figuring it out here), so any pointers you can give that might get me or other DIY types pointed in the right direction would be greatly appreciated. I am not a shop or a business who will attempt to sell this repair.

    In the last picture you're just using c4 multiplexer and xentry, which I have already. Is this for the actual "fix"/re-flashing or just code reading? Is it possible you might consider selling the bms firmware/file/pinout/process, or offering your service via remoteviewer/etc? I am willing to buy hardware if c4 multiplexer is not what you're using, as I always like new tools/toys. I think for a lot of your potential customers, sending their bms overseas is a step that they would strongly prefer to avoid, if at all possible, myself included.

  2. “You had some help from other people figuring this out on another forum, it appears (see post where you were figuring it out here)” bad advice is no help. I spent a lot of time finding a solution, unfortunately no one helped me.
 
461 - 480 of 524 Posts
Top