Looking at MME LIN BUS - 12V BMS Intelligent Battery Sensor

[louibluey]

First look at a MME LIN BUS device for me, I will update with information as I learn how to decode this first example.

Tapped into the BMS LIN BUS here, but starting a new LIN dedicated thread. This will be of limited interest to most, but maybe some more general things can be learned, such as about LVB voltage reporting. For example, already noticing that the BMS (the sensor on the 12V battery negative terminal) stops reporting when MME is resting. That means that some monitoring via APIs and Apps is probably reporting the last value before MME went to rest. BMS reports at least voltage, current, and temperature. I think it also reports 12V LVB state of charge (soc) and possibly more.

(note: the regular continuous BMS reporting goes off during rest/sleep. It is still possible that the body control module occasionally asks for an update on some slow time schedule. Later data logging with the CSS electronics CANedge2 LIN logger should answer this question later).

First step is measure the LIN BUS baud rate. The Master (body control module) sends the rate and the slave uses that rate. I noticed during initial viewing that 10.4 kbs was working, however on closer look, at least my MME FE seems to be running about 10.7 kbs.

Using an oscilloscope with serial LIN decode for this first look. Here is an example set to trigger on device 25 (I think). The white hex numbers are the 8 data fields.

Locating the BMS device number(s) is the next job, then identifying its data fields (voltage, current, temperature) and any offset and scale factors. For some reason it seems difficult to look this up, for BMS data sheets which do not show that detail to the chip data sheets which are so detailed, it is difficult to answer this simple question. Here is an example of a Vishay sensor, which is likely different, but the kind of info needed for our MME BMS device.

Sponsored

 

[louibluey]

By triggering on device number, I got a list of all of the devices on the MME LIN bus #4. The bus goes dormant when MME goes to rest. I used the fob to do a lock or unlock to get the bus humming again. There is continuous LIN bus activity when MME is awake. The master for LIN bus #4, the body control module (BCM), requests information from some devices much more frequently than others. It might be interesting to do a histogram showing relative reporting frequency for each device number.

Example of Frame ID 0x21 trigger for device no. 61 in the list (dev. no. 8 data bytes, and checksum)

 

[louibluey]

The first goal of this work is to find and decode the LVB BMS data frames. 250 bus reports were recorded at about 1/2 second (skipped the others). Then I unplugged the BMS (the two wire connecter on the LVB negative terminal) to look for what device IDs would be missing. Well, the next 250 record did not go well, something off on the scope triggering, however device 61 displayed with only the request for data by the master, and no data or check sum. I expected that two or three of the device IDs were probably assigned to that tiny microcomputer circuit board in that little rectangular box of the BMS on the negative LVB terminal. What is a bit surprising is how many device numbers it responds too.

In the list above, 0x02 to 0x05 devices are some other device on LIN bus #4 (still got full data frames with the BMS unplugged). However, the rest from 0x21 to 0x2D (61 to AD) appear to be the BMS itself. All of those went away (checked each one manually with trigger on ID, each had only that first part of the LIN cycle remaining, with the device request data from the bcm. Just noticed an error in my chart above, 61, not 85 carries significant data (will fix it). So, most interesting are device numbers 61, E9, and AD, which probably carry LVB voltage, current, temperature, soc, and possibly more.

Here is an example for "61", BMS LIN 2 wire connector (LIN, +12V, unplugged):

 

[louibluey]

The CSS electronics CANedge2 LIN logger arrived. I tapped into the MME LIN bus #4 at the BMS on the 12V battery negative terminal, and wired the three needed wires (Vbat (12V), LIN, and ground) into a DB9 connector. Set the configuration to record LIN 0x29 (E9) because I've seen what looks like some interesting data on that LIN BMS device. Way too early to say much, but it is alive, and there is definitely data which can be seen on the ASMMMDF GUI viewer.

Also attached is a text file, if anyone wants to have a look. There is more data on this LIN #4 bus, at least two other device codes which carry what looks like useful data (this is primarily E9 data). In the text file, time is left most column in seconds. It is possible that in some cases two or more bytes should be concatenated for MSB, LSB, etc., no idea yet.

tapped in at BMS (LIN, Vbat) tape between the two and more tape all around later.

The LIN monitor in its mounting frame. It has some WIFI capability to log to a S3 server for later (way too much to all learn at one time), just logging to its SD card initially.

Here is a screen shot of the E9 (and some other data not well understood yet) using the ASMMMDF GUI viewer (first time, no idea how to use it yet), There are definitely signs of life there. Not sure why some 0x21 snuck in, that one "61" actually shows every 40 ms or so when the BMS micro is not sleeping. I'm guessing the black regions are mostly sleeping, but some data is still showing in orange and red all of time, interesting.

.

 

[louibluey]

This is digital (LIN bus data) from the BMS module sitting on the negative terminal of the 12V LVB.

I think I found the LVB voltage in the 0x21 "61" device name which runs every .04s or so (40 milliseconds). Graph, not sure why the missing portions, LIN might have gone to sleep. The Excel sheet does not seem to attach, here is the raw data if anyone wants a look (.txt). About 28 minutes, MME on for much of that time, the 21 data only ran for 21 minutes, no sure why.

The DC/DC converter was running until about 500 seconds, then turned off (pretty typical pattern, as is just above 15V for my MME when cold (32F)). y axis is voltage, x seconds. The voltage resolution appears to be about 1 mV (16 bits, but probably a wide range scale, and/or the ADC only uses 14 of the 16 bits)

 

[louibluey]

Quick update, on removing the frunk tub for the 50 Ah LVB swap, I realized that it was not smart to run that white twisted shielded cable through the louver slots on that small panel. It worked okay, the whole thing dropped through the opening in the frunk tub, but that was a pain.

Also, it turned out the LIN wires to the new, now 1" further away BMS on the negative terminal were too short. So, I just redid the LIN tap, adding a short extension this time. Now, the Canedge2 cable runs through an existing channel and small opening between the covers. This will make it much easier to remove the tub next time. Just unplug the DB 9 connector, and lift that small thin panel with the Canedge2 mounted to it out of the way.

 

[louibluey]

After replacing the LVB last night 50 Ah LVB swap, I ran a BMS (picture of BMS) LIN bus log overnight only for address 0x21, the 61 data where I found the BMS voltage record which when awake, transmits (in response to a query by the master) every 40 mS at about 25Hz with about 1mV resolution (~14 bits). The data reads near zero for short periods, not sure yet what that is (might filter them out later), and FF FF FF ... which is going to sleep and/or waking up. MME was plugged into an 11 kW chargepoint station during this entire period.

The first two graphs are the voltage data. The top shows 15V charging several times before LIN went to sleep. Note that MME was awake to just after 1,500 seconds, then there are long gaps. The second graph shows the FF FF FF ... signals (65) which are bus sleep/wake signals. The two graphs zoom in on the sleep / wake signals. Note that the time is discontinuous as the BMS goes to sleep for long periods of time (for most of the night, just waking every 15 minutes). About 45,000 data points.

Most of the graph is the first 25 minutes (1,500 seconds) after I locked the car while plugged in L2.

The 12V battery voltage shows in some data unloaded to be about 12.8V. Most interesting in the lower graphs is where clearly MME is running this LIN bus #4 every 15 minutes, presumably to check the LVB. The loaded voltage appears to be as low as 12.3V to the right, but never reached 11.9V to 12.1V which to best understanding, calls for the DC/DC converter to come on.

The last table shows the 15minute intervals for the FF FF FF ... message. Note that readings of 65 are not voltage, but those FF FF FF messages which appear on this same 0x21 data stream (actually just noticed in the table below, they are 3c, so in addition to the 21 stream).

Data as text file included below if anyone wants to work with the raw data.

 

[louibluey]

Here is the above data with the low values and FF FF FF ... lines filtered out. The graph below that shows an X-Y representation in linear time, which shows how the first 25 minutes is outsized when plotted by points (the BMS was not reporting for most of the time). Just under 14 hours total.

Finally, the third graph is of just those low values which range from 0.769 to 0.948V. In reality, they are not continuous, just short periods (plotted together they look continuous). Either they are bad measurements, or maybe (?) unlikely (?) something is shorting the battery with a diode like voltage drop at times. most likely some kind of measurement error - bogus BMS Voltage readings. Note that I do not recall seeing any such low battery voltage values when digitizing the battery voltage with a DMM to date.

X-Y plot showing the above graph in linear time

These are the low values from the top graph in the post above

 

[louibluey]

Here is another about 25 hour run of BMS 0x21 LVB voltage data (plugged in 11kW L2). Top two graphs are voltage vs time (seconds). The first shows by data points, so short time intervals when BMS is active get spread out. The second shows data by X-Y plot with linear time, where it becomes clear how the LIN Bus #4 goes to sleep (no data for long periods of time, here generally 15 min), but wakes about every 900 seconds (15 minutes) to check the voltage and other parameters not shown.

The last two graphs show a short DC/DC converter operation, where the converter comes on for about 10 seconds, to that first steep drop off, on for maybe 47 seconds (last graph is about 2 minutes wide).

Note that slight dips in battery voltage during the record (top graph), which likely reflect various levels of 12V load (stuff coming on at various times).

data attached in txt (change .asc to .txt if you need to). Note that I am only looking at two bytes on this device address. There is more data in there if anyone wants to try to decode it.

As before, deleted values below 1V, and odd lines of other addresses that seem to add in, as well as the FF FF FF ... sleep / wake lines (all of those are still in the txt file, disk removed 12/31/21).

If you look at the raw hex data with Excel, just do data load, txt, first two options default, then finish. Then add a column to the right of that with this formula: =(HEX2DEC(CONCAT(I1,H1)))*0.001

 

[louibluey]

LVB soc % from BMS - Got one more (BMS data being send to BCM by LIN bus #4) (BCM passes some BMS data by CAN bus), here is soc in 0x21 byte 8 is LVB soc % for the data above, no conversion other than hex to dec needed.

This 0x21 data (LIN bus #4) is requested by the master every 40 mS (25 Hz) when MME is On. When MME is off (not clear yet how many off states there are? OFF, resting, sleep, deep sleep?) every 15 minutes in some cases.

 

[louibluey]

To find more variables in the BMS data, I tried a case that I have some experience with from months back, accessory mode MME On, not plugged into L2. Eventually, I will put out DMMs for V and I to find/confirm data, but for now I just ran about 1.2 hours of accessory mode, leaving all MME systems on that came on, including the headlights and various heaters, including seat, wheel, and cabin heat. I have seen this many times, where in accessory mode, the DC/DC converter stays on for just under 1/2 hour, then some time later, eventually MME shuts itself off, and I have yet to see the DC/DC converter come back on in this case (maybe just because MME opts to completely turn itself off). Anyway, I knew there had been a significant reduction in LVB soc, because on opening the door, I got that message LVB low, turn MME on or off (whatever "On or Off" means, maybe it is saying, hey you left the car running, and I (MME) turned it off for you). Voltage and soc graphs, x axis in decimal hours.

The DC/DC converter ran just under 14V, a little lower days recent, but it was warmer, and LVB started out at 80% soc. With all that load on at the same time, it only got LVB up to 85%, before the DC/DC converter shut off, which I think in this scenario is by time, not % soc.

I think around 0.9 hours is where it shut down all systems, and the glitch at the end is me opening the door and turning on lights, modules, etc. Interesting that 12.3V loaded comes up over and over again in testing my FE MME. So, maybe that is the answer for this scenario, at 12.3V, rather than going down to 12.1V to 11.9V where we think MME generally turns on the DC/DC converter, MME just turned off all systems.

 

[Mach-Lee]

To find more variables in the BMS data, I tried a case that I have some experience with from months back, accessory mode MME On, not plugged into L2. Eventually, I will put out DMMs for V and I to find/confirm data, but for now I just ran about 1.2 hours of accessory mode, leaving all MME systems on that came on, including the headlights and various heaters, including seat, wheel, and cabin heat. I have seen this many times, where in accessory mode, the DC/DC converter stays on for just under 1/2 hour, then some time later, eventually MME shuts itself off, and I have yet to see the DC/DC converter come back on in this case (maybe just because MME opts to completely turn itself off). Anyway, I knew there had been a significant reduction in LVB soc, because on opening the door, I got that message LVB low, turn MME on or off (whatever "On or Off" means, maybe it is saying, hey you left the car running, and I (MME) turned it off for you). Voltage and soc graphs, x axis in decimal hours.

The DC/DC converter ran just under 14V, a little lower days recent, but it was warmer, and LVB started out at 80% soc. With all that load on at the same time, it only got LVB up to 85%, before the DC/DC converter shut off, which I think in this scenario is by time, not % soc.

I think around 0.9 hours is where it shut down all systems, and the glitch at the end is me opening the door and turning on lights, modules, etc. Interesting that 12.3V loaded comes up over and over again in testing my FE MME. So, maybe that is the answer for this scenario, at 12.3V, rather than going down to 12.1V to 11.9V where we think MME generally turns on the DC/DC converter, MME just turned off all systems.

Interesting, you should do the same in regular ON mode for several hours to see what's happening.

I assume you disabled auto-off, weird that the DC/DC shuts off after 30 mins and it just keep going until the battery hits 12.0V. Seems like a programming oversight here.

 

[kltye]

Would you happen to have any data on how many amps is being sent to the LVB while it's charging at ~15 volts? I have a ridiculous idea to use a buck converter to bring the voltage down to a more acceptable 14.4 volts for a LiFePo4 pack, but I need to match the converter's maximum power, of course.

 

[louibluey]

Interesting, you should do the same in regular ON mode for several hours to see what's happening.

I assume you disabled auto-off, weird that the DC/DC shuts off after 30 mins and it just keep going until the battery hits 12.0V. Seems like a programming oversight here.

Well, I definitely turned off auto-off recently, but just now it was on again. Good idea for a several hour ON test.

 

[louibluey]

Would you happen to have any data on how many amps is being sent to the LVB while it's charging at ~15 volts? I have a ridiculous idea to use a buck converter to bring the voltage down to a more acceptable 14.4 volts for a LiFePo4 pack, but I need to match the converter's maximum power, of course.

Should have some info soon, can measure it directly several ways (DCCT, mV voltage from the ground post to the battery negative terminal, etc.), but I really hope to find the BMS current information soon. There is a changing parameter that I cannot yet identify on the 0x21 address, but I'm starting to think current may be on one of the other BMS device addresses, perhaps reported less frequently.

Sponsored