[mudder]

This is a technical post. I'm documenting it here for posterity. Most people don't need to read this (but it's cool if you want to). This might prove useful for driving IMA system with lower pack voltages (where you can't just use a voltage divider to spoof the voltage on connector 'E'.

...

Today is the first time I've ever looked at how the MCM measures the pack voltage. If you're not familiar, connector 'E' on the MCM has two wires (RED & WHT) that are directly connected to the pack HVDC terminals.

The input circuitry inside the MCM divides the HVDC voltage by 50, which is the same ratio used inside the PDU to generate VPIN. My initial thought was that you could tie VPIN to the connector 'E' input (modified to accept 0:5 volts, see pictures below).

Unfortunately, you can't just wire VPIN (from the PDU) to the connector 'E' circuit, because the voltage on connector 'E' is always present (regardless of HVDC contactor state), whereas VPIN is zero before the contactor engages, and then ramps to HVDC/50 (e.g. 150 V_pack = 3 V_VPIN).

Due to the above, the modified MCM throws P1577 if you use VPIN. However, if you know the pack voltage (e.g. by measuring it with the LTC6804, or dividing it down and measuring it with a microcontroller), then you can generate a compatible low voltage (0 to 5 volt, e.g. with a DAC on the microcontroller).

Why is this useful?
For systems where you're increasing the pack voltage (e.g. 200 volts), this is a more complicated method to spoof the voltage. Peter's method of using a simple voltage divider is certainly easier, and I recommend that.

However, for systems where you're running a lower pack voltage (e.g. QTY2 Honda Fit EV LTO packs), you could use these findings to spoof a higher pack voltage with just a simple 0:5 volt DAC (and the internal MCM modification shown below).

...

A more in depth look at the MCM's HVDC input circuit:

IC28/29/30/31/32 are photoMOS... I wasn't able to find the part number, but that's what they are. A photoMOS is essentially an LED that controls the gate on a MOSFET. Put more simply, these ICs are ON/OFF switches.

IC29 never fires (i.e. the MCM never illuminates the internal LED, hence the IC29's switch is always OFF). Honestly I'm not sure why it's even there to begin with, as it poses a safety hazard in the event either IC31 or IC29 fails. Whatever, I've happily ignored it, and even took it off the MCM and didn't get any IMA errors. I'm 99.9% sure it does nothing.

IC30 & IC28 always turn ON at the same time, and are also always OFF at the same time. When they're on, the entire pack voltage charges the 217 nF capacitor (C90). Inrush current is limited by a 15 kOhm series resistor R237. Note that once C90 charges up, it essentially maintains the entire pack voltage across it at all times... there's a very small (0.1 volt) drop every time the ADC connects (discussed below), but essentially the entire pack voltage is always present across C90.

IC31 & IC32 are also linked together (always ON & OFF at the same time). They only turn on when IC30 & IC28 are off. Thus, either the battery is connected to C90, OR the ADC is connected to C90. In other words, these ICs serve to allow the microcontroller's ADC to sample the battery voltage without ever galvanically connecting to it. That's all these ICs do.

From here, the voltage across C90 goes through a 50:1 voltage divider (480k + 10k (R244) ), which proportionally drops the pack voltage from 0:250 to 0:5 voltage. There's then a couple current limiting resistors (R253. etc), and a zener diode pair to clamp the signal between two voltage rails.

...

This is not a good circuit from a safety perspective, as galvanic isolation does not exist. Hypothetically, there are several ways this circuit could fail, thus introducing high voltage into the low voltage sytem. Examples:
-If the microcontroller accidentally turned all ICs on at the same time, OR;
-If R244 opened (hence no voltage divider), OR;
-If IC29 failed short (hence no voltage divider).

This circuit certainly works, and there are several downstream components that limit the current, but from a safety standpoint I give this implementation a C-... I certainly wouldn't allow it if I were a tech lead on the project. But here we are.

If I were designing this circuit, I'd place an ADC on the isolated side, then transmit the result through opto-isolators. Thus, there's no way for the HVDC voltage to ever find its way onto the low voltage side.

...

So here's how I modified the MCM (internally) to allow us to spoof the connector 'E' voltage using a 0:5 volt DAC (e.g. on a microcontroller). Note that the DAC must be outputting the correct pack voltage immediately after the key is turned to ON (e.g. 3 volts if the battery is at 150 volts)... this is the reason we can't drive the modified circuit with VPIN (as explained above).

The modifications are:
-Apply DAC voltage to connector 'E' positive
-Apply ENG_GND (BRN/YEL) between IC30 & 220 Ohm resistor R211
-Short out D38/R241/D37/R238 (vertical green line). This only requires one jumper.
-Remove R244 (this slightly unbalances the ADC input, but the sample rate is so low this doesn't matter.

...

Overall, I don't plan on using this for anything. My original goal was to try and remove connector 'E' entirely (by sourcing the pack voltage from VPIN), but that didn't work, and now I've abandoned this rabbit hole.

 

[*sean*]

Thanks for posting this. I looked at this casually not long ago. I found a part called an AQV216A from Panasonic but the missing pin on the in-car package threw me off, and I concluded it was a similar but not the same part, and this led me to a different conclusion about how the circuit worked.

 

[mudder]

AQV216A has an identical footprint and is effectively the same part as the part I deduced. The part on the MCM (V216AB01) was made by the company NAIS Aromat, which was purchased by Panasonic. I couldn't find a datasheet for V216AB01, but I did find a similar part 'V214A' that matched what my probing behavior was.

I'm fairly certain the OEM part (V216AB01) initially had six pins, but pin5 was removed for increased high voltage clearance (although not really because pin5 is still present near the package case). I guess technically the missing pin5 via (on the PCB) does increase clearance... ok, fine .

 

[retepsnikrep]

Good info..

I was always surprised by the fact there was no absolute galvanic isolation in the MCM.

But is that fact used by the MCM to deduce the HV short circuit P1444 scenario where pack voltage gets into the 12v side.

I don't see how it could detect this and measure the resistance HV/LV without a non 100% isolated circuit of some sort to measure a voltage across?

IIRC the HV/LV resistance has to be at least 300k or the car throws an IMA code detected by the MCM.

 

[mudder]

The proper non-destructive way to test for galvanic isolation is to use a transformer, and then verify that the common mode voltage drifts when injecting known test pulses. If the resulting pulse on the isolated side always returns the same value, then you know there's a shared reference (i.e. the isolation has failed). You essentially want to measure uncorrelated spikes (i.e. the isolate is intact).

The MCM uses this photoMOS circuit to detect for insulation breakdown between HVDC and chassis/engine ground. In fact, you can easily reproduce P1444 by connecting the 0:5 volt ground on the wrong side of IC30. The entire reason this photoMOS circuit exists is to allow a non-isolated ADC to measure the HVDC pack voltage without also resistively connecting the HVDC pack to the low voltage side. From an electrical standpoint this goal is accomplished, but from a safety standpoint it's a bad circuit.

 

[eprom]

After reading voltage from connector E .
Can the MCM read the battery voltage from pin B16 VBATT VCM (0-5V)?
What can be the purpose of reading it in two different ways?

 

[retepsnikrep]

The MCM compares the voltages from the three different points to detect things like..

A blown main fuse.
MDM filter capacitor charging when the bypass/main contactor is engaged etc.
MDM filter capacitor discharging when contactors are disengaged etc.

Voltage variations due to some sort of high resistance in the circuit.

 

[eprom]

Can you tell me what is the third high voltage battery reading point that i missed.

edit

is it C16 Qbatt from ECM ?

 

[retepsnikrep]

The MCM only measures voltage in two places, but it gets a third value from the BCM which measures the pack voltage and sends it in serial digital form to the MCM on the BATTSCI line.