[retepsnikrep]

This thread is to discuss usage of the Honda Fit LTO Lithium block OEM BMS boards.

The LTO 12 cell blocks each have a 12 cells BMS with unique CAN ID.
Others have done some research on these and that info will shortly be added to this thread.

Using that info I have connected an LTO BMS to the BCM Replacer and am now able to read the cell voltages via the CAN bus.

We probably won't be able to enable the LTO balancing function, however this is a very useful addition to our armoury for people wanting to use the LTO packs.
It makes the purchase of an Orion2 less critical if you are prepared to do manual balancing when the cell voltage deviation indicates attention is reqd.
That may be a very infrequent occurrence as anecdotally the LTO blocks have been reported to stay well in balance.

As far as the BCM Replacer is concerned, you do not need a B board or tap modules if you don't want them.
The BCM Replacer will run with just an A board to communicate with the LTO stuff.
This halves the cost of the BCM Replacer system to around $400...

Note. One of the taps on the display is shown as 2.7v this is correct as the led in the BCM Fooler matrix causes this effect.
The other 11 taps are all around 8-900mv..

 

[44Now]

Peter, Thanks for this breakthrough. This could be a good middle ground approach to LTO conversions. Aside from the cost of the Orion2 BMS, I was not keen on using the Orio2 BMS was connecting all the cell tap wires and the resulting issues if they got pinched or shorted.

 

[IamIan]

Can we transfer all this to an LTO BMS forum thread please...

I'll start one if people want to add the stuff they have posted.

I now have the BCM Replacer talking to the LTO bms boards and displaying the voltages.

Hey all. Ian mentioned to me that you guys were talking about these Honda LTO battery modules at InsightFest, and he asked me to share with you guys what I had figured out about them so far. Ian had sent me one of the modules several months ago and I've been looking at them off and on.

Here's some basic info to start with. There's 12 cells to a module, 2.4V nominal voltage per cell, 1.5V-2.7V range (for regular LTO cells anyway, I assume these are the same).
The BMS reports cell voltages over the CAN connection. The bitrate is 500kbit/s.

The CAN ID always stays the same, and the voltage info is sent in sets of three CAN frames, 8 bytes each. I actually was able to find somebody else that had figured the protocol out, so I'll just link to their explanation:

Could someone help me figure out this HONDA BMS? - Endless Sphere

The board I tested has CAN ID 0x209 rather than 0x20A, so I assume they're probably hardcoded and you need a set of modules that don't have conflicting CAN IDs. If you have duplicate IDs you'll need to run a separate CAN bus for each module, which wouldn't be the worst thing since an Insight only needs three modules (presumably each module, with two boards and two sets of cells, would have unique IDs).

It's easy to read the cell voltages, so we can do that at the very least. I don't know how to make the boards balance the cells, though. I intentionally discharged one of the cells by about 20mV and left the BMS board powered for several hours, but the cell voltages never changes, so you probably have to command cell balancing with a certain CAN message. I have no idea how to figure this out without monitoring the bus in a real car, unfortunately.

The board is split into two isolated halves, with a transformer for power and an optoisolator for communication. One side handles the CAN communication and the other side does battery management. I looked at the serial communication going between the two halves. It looks like the CAN side sends a packet to request data from the BMS side, then the BMS side sends back a bunch of data. The CAN side then sends that out over CAN.
I can't quite decipher how the serial data correlates to the CAN data, but it must somehow. Just need to look at it more.
I've attached a logic analyzer dump that you guys can look at (you need to rename it from .txt to .logicdata). You'll need Saleae's Logic program (https://www.saleae.com/downloads/). This has the serial communication going both ways as well as the CAN messages. SERIAL_TX is from the CAN side to the BMS side, and the SERIAL_RX pin is from the BMS side to the CAN side. The serial is 625,000bps with odd parity.

For reference, all the cells in my pack are ~2.410V, while the lower cell is ~2.388V. The lower cell is cell 12, and the last cell voltage in the CAN data.


Here's the cell layout in the module:

Here's the pinout of the connector. It has 8 pins, but there's only 6 in the harness. The two sets of CAN pins are just shorted together, it's done to make the harness wiring easier.

Here's the connection points for the serial communication between the two halves:

Here's the bottom of the board (nothing terribly useful, and it's a bit of a pain to desolder all the battery taps to access this):

That's about everything I know right now. I know the info is a little scattered, please let me know if you have questions and I'll be happy to explain more. Check the logic analyzer dump though, it helps a lot to see what's going on.

 

[jime]

The BMS board is connected to some sort of car harness by a short multiwire pigtail. Though only 6 conductors are used by the board, an additional 2 wires are hooked to a temp sensor on some packs and these 2 wires are wired to pins in the car harness end. Though off subject a bit for the current discussion, the sensors might figure somehow into some future thermal plan.

Unfortunately, my limited sample indicates the temperature sensors are on only about 1 in 6 to 1 in10.

Interesting thread and glad the strong heads are onto the problem.

 

[eq1]

Very cool breakthrough. I like that this can enable reuse of something that up to now would have been turned to waste... Can't add anything helpful, but I'll be paying attention to what's going on.

 

[retepsnikrep]

I think I have one of the LTO temp sensors, i'll look at it..
We might be able to add it or you can do what we did on Tims car.
We simply reused his 4 x oem ntc thermistors from his old NIMH pack and put one in four of his packs.
They are already wired, read and used by the BCM replacer so it's a P&P doodle to use them.

 

[psifreak]

I have been using 3 Fit LTO packs for about 7k miles now. They seem to be staying well balanced per pack, although one of my packs (2 Bricks) seems to have different capacity (more/less?) than the others, over the last 7k miles this pack has drifted by about -2v total (1v per brick).
I have also been working on getting the LTO BMS to work, I as you have figured out the can data packet that the BMS spews when powered but I haven't figured out how to get it to balance the cells, It doesn't seem to do this automatically I have a test pack that has a low cell and have tried charging it with the BMS powered and I cant get it to balance.
From the look of the BMS it appears to be a passive type so to me it seems like if it was powered that it would just keep the pack balanced, although that doesn't appear to be true, I have tried sending a couple different generic Honda module enable packets with no luck.
From what I have seen the packet that is transmitted seems to show the lowest voltage in the brick first and move onto the highest with each transmission, 29/500 can structure, 3 packets with a can id, 4 cell voltages and checksum each, 12 bits per cell (4096) or a theoretical resolution of @.65mv (assuming a max per cell votage of 2.7) per bit. I am using a Sparkfun Can module with a Atmel chip to control it.
If you want me to try any thing on my end let me know I have 2 test bricks 1 has a low cell and im not afraid to experiment on it.

 

[psifreak]

I just read Marios post and realized that he basically found every thing that I have (and more) at least I know I'm not out in left field with what I have so far.
The only thing I'm confused about is that he mentions the batery voltage being 8 bit (FF) but I am seeing the voltage for a single cell move 12 bits (FFF) am I doing something wrong?
As an example with a tap voltage of 2.318v I see a hex value of 619 and with 2.411v I see 6AF.

 

[retepsnikrep]

Psifreak interesting stuff.

It's strange the bms sends out the lowest cell first then in order until the highest.
That means you can't be sure of a cells physical position in the block relative to the data stream format.
Cell 1 might be cell 1 one day but then cell 5 or 12 in the data stream the next day.
I wonder if it does it like that all the time even if they are perfectly balanced? How does it order them then?

Interestingly my fake cells are all about 0.890V except one at 2.7V (cell11) and that has not moved to position 12 in the stream. :? Not consistent.

I think the 12bit resolution is right. That correlates with my readings.

We should attach a 0-5v voltage to a tap and see what happens to work out the maximum range.
I'll do that today..

How do you think the checksum byte is being calculated?

What makes you think it is 29/500 and not 11/500 (My board is ID 0x204)

What enable packets have you tried sending and what cars are they from?

Any idea what the BMS chip is? Data sheet? It doesn't appear to be LTC/TI

How do your two blocks react on the same CAN bus?

How is the temperature sensor integrated?

Do you know the BMS 8 pin connector part?

 

[retepsnikrep]

Just doing some testing and the input range of each tap is 0 - 5.016V
For a 12 bit ADC (4096) this gives a theoretical resolution of ~1.224mv
You perhaps could use the boards with other chemistries if you wanted within the 0-5V tap range.

That would give a total voltage across all taps of 60V if you had all at 5V..

The taps did not move around (change position) in the data stream as voltage changed so my research shows they are fixed which makes sense.

Your result in this area don't correlate with mine, perhaps your cells are just in voltage order naturally?

My board does not have an input socket for the two pin thermistor, perhaps that plugs into other boards or directly into a seperate harness?

My readings show it to be a standard 10k ntc that reads ~9k at warm room temp 23C or so. They should be easily readable with the BCM replacer and look up table.

 

[retepsnikrep]

Mario.

I've attached a logic analyzer dump that you guys can look at (you need to rename it from .txt to .logicdata). You'll need Saleae's Logic program (https://www.saleae.com/downloads/). This has the serial communication going both ways as well as the CAN messages. SERIAL_TX is from the CAN side to the BMS side, and the SERIAL_RX pin is from the BMS side to the CAN side. The serial is 625,000bps with odd parity.

I'm confused by this. Is it reversed

Looking at the logic data Serial_TX, it's full of info and quite long messages, and would seem to be encoded cell voltages, and other stuff, but you say it is going in the other direction from the CAN to the BMS chip?
Or am I misreading what you have put?

Ditto Serial_RX that is a short message, and because we aren't putting anything (commands) into the CAN end is basically zeros that are being sent over the isolation to the BMS chip.. We aren't telling it to do anything, but you say it's going the other way BMS > to > CAN?
As there isn't anything in these messages it can't possibly generate the cell voltages on the CAN side from these.

 

[retepsnikrep]

To determine the relationship between the SERIAL and CAN data I suggest watch/record the data streams while you turn the voltage up/down on one or more taps.. Useful info maybe but perhaps not vital.

I note the CAN chip seems to be sending 4 x repeating 15 byte packets to the BMS chip with header $80,81,82 & 83.. It also has a CRC at the end.

That gives 13 data bytes x 4 packets.. Currently in your capture they are all zeros.

If we send commands to the BMS chip directly on that serial line we might learn something..
We could cut the track to stop the CAN chips output to the BMS chip interfering with our spoof device.

Maybe it's as simple as a 1 in position 1 in packet $80 turns on balancing for Cell1.. Who knows..

 

[retepsnikrep]

This is an interesting list of available BMS chips.
If we can identify which one the LTO is based on we might get some more clues about the comms protocols from a data sheet.
Have a look see if we can spot anything..

http://liionbms.com/html/BMS_IC_table.html

 

[psifreak]

Something crazy happened with brick $204 this pack was bought cheap because the strap on the first lug had been blown apart by a short subsequently that first cell has always been low, but after sitting for a couple months this cell now seems to be at the same level as the others in this pack, the only thing I did was complete the circuit between the tap and the lug before letting it sit. I currently have a potentiometer completing the circuit between the lug (whats left of it) and the tap so I can adjust the tap voltage. I cant seem to repeat the lower voltage cell being first in the order so I must have been doing/seeing something wrong.

Here is what I get with 1 board connected, this is raw hex with no formatting besides separating the id.

Get data from ID: 0x204
32 06 19 61 96 19 00 1C //loop1
-----------------------------
Get data from ID: 0x204
61 96 19 61 96 19 01 6B //loop2
-----------------------------
Get data from ID: 0x204
61 96 19 61 96 19 21 B4 //loop3
-----------------------------
Get data from ID: 0x204
31 F6 19 61 96 19 00 0F //loop4 beginning
-----------------------------

The last 2 bytes seem to be a checksum of some sort I'm not very familiar with can data so maybe it is used for something else and I'm just used to serial data.

Here is with 2 boards connected

Get data from ID: 0x203
61 C6 1D 61 D6 1C 21 B7 //loop1
-----------------------------
Get data from ID: 0x204
2A D6 18 61 96 19 00 0A //loop2
-----------------------------
Get data from ID: 0x203
61 86 1B 61 C6 1C 00 0C //loop3
-----------------------------
Get data from ID: 0x204
61 96 19 61 96 19 21 5A //loop4
-----------------------------
Get data from ID: 0x203
61 C6 1C 61 C6 1C 21 5F //loop5
-----------------------------
Get data from ID: 0x204
61 96 19 61 A6 19 02 A5 //loop6
-----------------------------
Get data from ID: 0x203
61 C6 1E 61 D6 1D 02 A7 //loop7 beginning

The lower id board seems to take priority in the stream. All the cells in brick $203 are +/- .001 of 2.324v and brick $204 is at +/- .001 of 2.321.

I will dig throught my notes and see if I can find the packets I tried sending, I found them in a forum that was trying to get into factory honda radios with different media options.

 

[retepsnikrep]

Something crazy happened with brick $204 this pack was bought cheap because the strap on the first lug had been blown apart by a short subsequently that first cell has always been low, but after sitting for a couple months this cell now seems to be at the same level as the others in this pack, the only thing I did was complete the circuit between the tap and the lug before letting it sit. I currently have a potentiometer completing the circuit between the lug (whats left of it) and the tap so I can adjust the tap voltage. I cant seem to repeat the lower voltage cell being first in the order so I must have been doing/seeing something wrong.

Here is what I get with 1 board connected, this is raw hex with no formatting besides separating the id.

Get data from ID: 0x204
32 06 19 61 96 19 00 1C //loop1
-----------------------------
Get data from ID: 0x204
61 96 19 61 96 19 01 6B //loop2
-----------------------------
Get data from ID: 0x204
61 96 19 61 96 19 21 B4 //loop3
-----------------------------
Get data from ID: 0x204
31 F6 19 61 96 19 00 0F //loop4 beginning
-----------------------------

The last 2 bytes seem to be a checksum of some sort I'm not very familiar with can data so maybe it is used for something else and I'm just used to serial data.

Here is with 2 boards connected

Get data from ID: 0x203
61 C6 1D 61 D6 1C 21 B7 //loop1
-----------------------------
Get data from ID: 0x204
2A D6 18 61 96 19 00 0A //loop2
-----------------------------
Get data from ID: 0x203
61 86 1B 61 C6 1C 00 0C //loop3
-----------------------------
Get data from ID: 0x204
61 96 19 61 96 19 21 5A //loop4
-----------------------------
Get data from ID: 0x203
61 C6 1C 61 C6 1C 21 5F //loop5
-----------------------------
Get data from ID: 0x204
61 96 19 61 A6 19 02 A5 //loop6
-----------------------------
Get data from ID: 0x203
61 C6 1E 61 D6 1D 02 A7 //loop7 beginning

The lower id board seems to take priority in the stream. All the cells in brick $203 are +/- .001 of 2.324v and brick $204 is at +/- .001 of 2.321.

I will dig throught my notes and see if I can find the packets I tried sending, I found them in a forum that was trying to get into factory honda radios with different media options.

I think the voltage sensing circuit on your first cell in block $204 has a problem. Blown due to that short?
I have bold & underlined the suspect 12 bit data in you post..

 

[psifreak]

Here is the connector part. It is made by JST
08CPT-B-2A

JST - Connector Selector

JST is a global manufacturer of quality interconnection products dedicated to customer service, reliability and design innovation.

www.jst.com

 

[psifreak]

I currently have a potentiometer connected to that tap I will max it out and see if it follows.

Yup, It did seem to take quite a long time to catch up though maybe 3-4 seconds.

Get data from ID: 0x203
61 96 19 61 96 19 21 B5 //loop1
-----------------------------
Get data from ID: 0x204
61 66 17 61 86 19 00 08 //loop2
-----------------------------
Get data from ID: 0x203
61 96 18 61 A6 19 00 03 //loop3
-----------------------------
Get data from ID: 0x204
61 96 19 61 96 19 01 5C //loop4
-----------------------------
Get data from ID: 0x203
61 96 19 61 96 19 01 5D //loop5
-----------------------------
Get data from ID: 0x204
61 96 1C 61 A6 19 02 A2 //loop6
-----------------------------
Get data from ID: 0x203
61 96 1A 61 A6 1A 02 A4 //loop7

Also the lower hex id being first doesn't always repeat with my setup, it did the first 5 or 6 power cycles but sometimes not now that I'm messing around more. Maybe that's where I thought that the lower voltages displayed first, I need to get more scientific with my testing obviously.

 

[jime]

I think I have one of the LTO temp sensors, i'll look at it..
We might be able to add it or you can do what we did on Tims car.
We simply reused his 4 x oem ntc thermistors from his old NIMH pack and put one in four of his packs.
They are already wired, read and used by the BCM replacer so it's a P&P doodle to use them.

It would be nice to know if it is the same thermocouple characteristic as the Insight ones. Otherwise, I agree the Insight ones work out better; and it will be too hard to acquire a sufficient number of the Fit ones since they are sparsely spaced among the original packs.

 

[jime]

My board does not have an input socket for the two pin thermistor, perhaps that plugs into other boards or directly into a seperate harness?

The two pin thermistor uses 2 of 4 in a socket on the small plastic post you see about mid subpack, green for ref. From there, the two wires join the 5" pigtail harness I referred to earlier. Two wires in the pigtail then join the subpack to battery harness(not seen as yet) as lines separate from the BMS data, the 6 pins referred to earlier, for a total of 8 active pins. I'm left to think that the thermistor data is not contained in the BMS data format that you are looking at, but rather in a different word format at the subpack level. Confusing enough?

Think of the pigtail as a Y. One arm of the Y is the 2 wires hooked to the thermistor, the other arm of the Y is the 6 wires from the BMS. The tail of the Y is hooked to some sort of harness which I have called the battery harness.

 

[gts8650]

This is great progress. LTO installation will go a little faster without having to make up and route all the voltage tap wires. So far the LTO cells seem to remain well balanced. I have 14 voltage taps installed, one for every 6 cells. The voltages for all taps respond in unison under changing assist/regeneration, stepping up or down in unison by 100 mV. I've been operating in the 185V range, 2.2 V/cell, but I'm currently grid charging to 202V, 2.4V/cell. Hopefully, all cell voltages will remain well balanced.