Tuning the Lithium cars for more IMA power.

Looking at the HCH2 setup we don't currently have an easy/any way to do voltage fooling for more power.

In the G1,G2 Insight, Nimh CR-Z and HCH1 you can fool the system voltages so the car thinks it is lower than actual and thence you get more power/current.
In the G1,G2 Insight and HCH1 and Nimh CR-Z things are more modular and the inverter is a dumb slave so intercepting the necessary signals is doable.

In the HCH2 the inverter contains the integrated MCM motor control module, you have no easy way to access inverter voltage data and modify it before the MCM sees it.

So we need to find a way to reduce the voltage the inverter detects.

1) This could be by reverse engineering the analog HV detection circuit to turn down it's sensitivity. (I will look at this on the bench)
Change resistors etc.

2) Intercept digital signals on the inverter pcb board and modify them.

Now if we look at the backlit HCH2 inverter PCB we can see as expected it is in several distinct isolated sections.



The top section is the MCM (motor control module with phase sensors attached)

The middle section is the IGBT connections interface.

The bottom right section is isolated power switching via the central transformer into the IGBT's and the bottom left section.

Now the bottom left section is likely to be voltage and other data detection and this information is transmitted to the MCM (top section) probably using a simple serial signal via the two opto isolators circled in blue. There is only one way comms so I suspect this section simply spits out voltage info etc for the MCM.

Now we could analyse that serial data and then insert a little modifying (PIC) gadget across the isolated interface and simply modify the voltage data.
That's what I did with both the HCH1 and CR-Z earlier tuning projects.

Anyway that's todays task analyse that interface and apply some varying voltages to the inverter and see what is being sent across that bridge.

Got my little voltage modifying HCH2 Inverter serial data interceptor in and working.


This intercepts the voltage data from the dumb side of the inverter and passes it through to the MCM (Motor control module) side.
With this we can modify (reduce) the voltage the MCM side sees by whatever percentage we want.

So say actual pack is 250V we can reduce that by 50V ~20% easily.

We can also fool the HCH2 BCM (Battery control module by the same percentage using the simple resistor divider method)

The serial data is 16 bytes 50,000 9,E,1 (Even parity) 11 bits total.
There is a checksum at the end as well which we can calculate on the fly.

Well I took another look at the HCH2 BCM pcb and it also has an isolated dumb HV section which measures the 11 battery tap voltages.
This is sent via 25 bytes of serial data 31250,9,O,1 via and opto to the battery monitoring chip. Blue zone.






So we could use exactly the same technique as in the inverter and intercept the data and modify/reduce it as we want.

So with the HCH2 BCM we have the external voltage divider option or the internal serial data interception or do both for maximum flexibility.



So I will make up another little board to send modified data and install it inside the BCM.

We might be able to do quite a few nefarious things with a voltage divider and/or serial interceptor.

Resistor Voltage Divider.

Fake perfectly balanced tap voltages.
Reduce battery pack voltage sensed with a pre-resistor.

Serial Data Interceptor.

Fake perfectly balanced tap voltages.
Reduce battery pack voltage sensed by a set %.
Extend the life and performance of an older OEM pack by reducing it's sensitivity to minor voltage variations.

We will have to be careful as it looks like some voltage data is also passing between the HV/LV sections elsewhere on the board.
It may just be a simple voltage present check or part of the HV leak detection we shall see. Red Zone.

So I modified yet another one of my OBDIIC&C devices to receive the internal BCM serial tap voltage data stream from the LV side of the isolation OPTO.



This could be the basis of a handy gadget for HCH2 owners with standard cars wanting to find out which sticks are bad etc.


It's basically 25 bytes 31250,9,O,1 format. Weird baud rate but that's what the shortest bits says.
We have a two byte rotating header $80,$52 or $C0,$52 and then 22 bytes of voltage data and a final checksum.

In this example packet below the header is $80,$52. The checksum is $43.
The two bytes that make up each tap voltage have the high byte and the bottom nibble of the low byte combined to form 12bits of data.

If we take (Voltage Tap 1) VHB0 the first part high byte $5E and low byte $05 low nibble $5 we get $5E5 = DEC 1509 = 15.09V
This is the voltage between VHB1 (negative) and VHB0 (positive)
VHB0 is the positive high end of the pack. VHB12 is the negative low end of the pack.

POS ------ VHB0 --- VHB1 ---- VHB2 --- VHB3 --- VHB4 --- VHB5 -- VHB6 & 7 -- VHB8 --- VHB9 --- VHB10 -- VHB11 - NEGATIVE VHB12
$80,$52,-- ($5E,$05),($5E,$0D),($5E,$06),($5E,$0E),($5E,$03),($5E,$0D),($5E,$05),($5E,$0D),($5E,$05),($5E,$0E),($5E,$06),$43

Note VHB6 and VHB7 are directly connected internally via the battery main switch when it is on.
So in effect they are the same connection but provide continuity for voltage sensing on the taps either side of the switch when it is off.

The operating sensing range of each voltage tap is about 0.5V to 20.15V
Resolution is to two decimal places with accuracy of about +/-10mv or so.

There is a full 25byte serial data packet sent every 15ms.
That is about a 66hz refresh rate if you wanted maximum speed for logging/processing the tap data etc.

In the video I also show the 11 x 10k 0.1% tolerance resistor matrix divider (BCM Fooler) for simulating perfectly balanced battery taps.



With a pre-resistor (inserted where the screw terminal jumper wire is) the voltage the BCM sees can be turned down to whatever we like...
i.e A 250V Battery can become 200V as far as the BCM is concerned.

Now to build and install the little serial fooling gadget into the BCM itself.

Interestingly the Nimh CR-Z MCM/BCM module has exactly the same sort of HV detection and opto isolated serial interface!
So you could power up a module like the one in the pic and read/display the voltages in the same way as I'm doing with the HCH2 BCM.



I don't have a spare voltage tap input socket so I would have to canabilise a dead MCM to get one and
hack off the bit in green to make an adapter. Not a lot of point in ruining a good MCM.

I might as well just reverse engineer the serial data in this module and add a 3.5mm jack socket so I can plug into it with the HCH2 gizmo!!
That's tomorrow mornings project then!!

Unless anyone has a dead/spare Nimh MCM and they want to send me the PCB out of it to support this research.