Hey all. Ian mentioned to me that you guys were talking about these Honda LTO battery modules at InsightFest, and he asked me to share with you guys what I had figured out about them so far. Ian had sent me one of the modules several months ago and I've been looking at them off and on.
Here's some basic info to start with. There's 12 cells to a module, 2.4V nominal voltage per cell, 1.5V-2.7V range (for regular LTO cells anyway, I assume these are the same).
The BMS reports cell voltages over the CAN connection. The bitrate is 500kbit/s.
The CAN ID always stays the same, and the voltage info is sent in sets of three CAN frames, 8 bytes each. I actually was able to find somebody else that had figured the protocol out, so I'll just link to their explanation:
The board I tested has CAN ID 0x209 rather than 0x20A, so I assume they're probably hardcoded and you need a set of modules that don't have conflicting CAN IDs. If you have duplicate IDs you'll need to run a separate CAN bus for each module, which wouldn't be the worst thing since an Insight only needs three modules (presumably each module, with two boards and two sets of cells, would have unique IDs).
It's easy to read the cell voltages, so we can do that at the very least. I don't know how to make the boards balance the cells, though. I intentionally discharged one of the cells by about 20mV and left the BMS board powered for several hours, but the cell voltages never changes, so you probably have to command cell balancing with a certain CAN message. I have no idea how to figure this out without monitoring the bus in a real car, unfortunately.
The board is split into two isolated halves, with a transformer for power and an optoisolator for communication. One side handles the CAN communication and the other side does battery management. I looked at the serial communication going between the two halves. It looks like the CAN side sends a packet to request data from the BMS side, then the BMS side sends back a bunch of data. The CAN side then sends that out over CAN.
I can't quite decipher how the serial data correlates to the CAN data, but it must somehow. Just need to look at it more.
I've attached a logic analyzer dump that you guys can look at (you need to rename it from .txt to .logicdata). You'll need Saleae's Logic program (
https://www.saleae.com/downloads/). This has the serial communication going both ways as well as the CAN messages. SERIAL_TX is from the CAN side to the BMS side, and the SERIAL_RX pin is from the BMS side to the CAN side. The serial is 625,000bps with odd parity.
For reference, all the cells in my pack are ~2.410V, while the lower cell is ~2.388V. The lower cell is cell 12, and the last cell voltage in the CAN data.
Here's the cell layout in the module:
Here's the pinout of the connector. It has 8 pins, but there's only 6 in the harness. The two sets of CAN pins are just shorted together, it's done to make the harness wiring easier.
Here's the connection points for the serial communication between the two halves:
Here's the bottom of the board (nothing terribly useful, and it's a bit of a pain to desolder all the battery taps to access this):
That's about everything I know right now. I know the info is a little scattered, please let me know if you have questions and I'll be happy to explain more. Check the logic analyzer dump though, it helps a lot to see what's going on.