For Want of a Nail….

Is it me? Or has the pace of all this quickened markedly in the past few months. Both in the number of new trinket and toy developments, but also some sort of sea change among the populace. We’ve probably had a half dozen people in the shop here this week. That’s not unusual actually, but they tend to be from Mexico, Portugal, England, The Netherlands, Australia or New Zealand. This week we had half a dozen people from of all places CAPE GIRARDEAU and the surrounding area in and they were very curious and interested in ELECTRIC CARS. Most wanted to talk about how they could get a project started. Blow on me and knock me over. Before this week, we usually had at least one visitor weekly with a gasoline car wheezing badly that wanted to know if we repaired ICE vehicles there. Or for an oil change.

We do almost nothing locally other than appear at a few car shows and hold our annual convention. There just isn’t a lot of EV activity here. In fact, I often note that we are in the IDEAL location for our role in the EV community as we can face any of 360 different directions and simply take a single step in that direction – and we’re already getting closer to EV activity. We naturally think of ourselves as ground zero, but in this case we mean ZERO ACTIVITY in the EV world.

[jwplayer streamer=”rtmp://s3einxnpkaij93.cloudfront.net/cfx/st/” provider=”rtmp” file=”news051614-iPhone.mp4″ hd.file=”news051614-1280.mp4″ image=”http://media3.ev-tv.me/news051614.jpg”  width=”850″ height=”522″ html5_file=”http://media3.ev-tv.me/news051614-1280.mp4″]

But I am also giddy at the pace of component developments. This week we take a look at our first actual shipment of CALB CAM series cells and I’m struck by the improvement. Actually I’m struck by how little differently these cells perform, but in a dramatically smaller and lighter package.

I have an Aristocraft Torpedo 16 boat nearing completion in Georgia – it is a very small mahogany speedster/runabout that we have had specially built with a jetski jet drive on the back where you would normally hang a 25 hp outboard on this VERY light little two seater. Kind of like a retro version of Anne’s Delta. We sacrifice hugely in efficiency and performance going to a jet pump, but the safety and trailerabilty and so forth is just huge and it should make it very fun to drive and quite easy to mate a motor to. But space and weight are at a premium. I’m thinking a UQM with these new CAM cells, although rumors persist that HPEVS is coming out with a special MARINE build. Apparently Anne got Brian Seymore thinking boat at the last EVCCON – not a herculean task as Brian is already a boating enthusiast.

So while the power train is up in the air, the concept of a 40% smaller battery pack that is 20% lighter may well be worth the admittedly heroic premium these cells command on introduction.

solarboat

Woops, no that’s not the Torpedo. Let’s see….here it is….

torpedo

Ah, yes.. that’s better.

We have apparently come to terms with Scott Osborne with the SCOTT DRIVE which we will be testing very soon on our new Siemens dual test bench. This thing does about 110 kw and apparently very efficiently with the Siemens 1PV5135 motor.
The DOKA is due back from paint THIS MORNING actually (Thursday) and we plan on using one of the Better Place battery packs with a Siemens and a Scott Drive inverter on that build.

news013114

The GEVCU continues to delight and surprise me. I’m driving around this week in the THING with the new Speedo doing some range testing (about 0.94 AH per mile at 312v or 290 wH per mile) and I was overheating the DMOC645. A quick look at an iPad light pointed at the GEVCU showed me that the inverter was at 53C while the motor was at 78C and I instantly had a pretty good idea what was going on. By having both of these quite thermally dissimilar devices on the same cooling loop, despite the herculean efforts of two Derali heat exchangers, the damn motor was actually cooking my inverter.

The startling revelation was how easy it was to sort all that out. The GEVCU paints some gages on its website that are updated each 300 ms, including gages for throttle, torque, rpm, voltage, kW, kWh, but most specifically for motor temp and inverter temp which the DMOC645 dutifully reports. Instead of an hour setting up a maze of wires and temperature probes, one glance at an iPad and I knew exactly what was going on real time.

It is encouraging that with just a few dozen GEVCUs in the wild, it is gaining adherents and enthusiasts. The feedback on it has been very encouraging and in all modesty, the interface to set the throttle and brake is just an entirely new mark for inverters. It’s too easy. But as it gains enthusiasts, they tend to pull it in all directions.

We already have a cadre on the team that want to do ELM327 over bluetooth and wireless to also do connections to the tablets and phones so that actual applications can be written for them that will be smoother and faster than the little updated HTML/javascript thing I’m checking temperatures with. This past week we had one guy, who I dont’ think even has a GEVCU, jump in demanding that we basically redo the hardware to include OVMS.

OVMS is the Open Vehicle Monitoring System and it is actually a completely separate effort, also entirely open source, developed to monitor data originally on the Tesla Roadster but branching out to the Tesla Model S and Leaf. http://www.openvehicles.com

The cool thing about OVMS is that it has both GPS and GSM built in. The GPS can link you to maps and give you speed, and distance travelled and lots of neat things we would like to have. The GSM is even more cool as it lets you send SMS text messages to your car and retrieve info such as charge state and potentially raise your windows if you are concerned about rain. IT also of course let’s you LOCATE your car by SMS text message in the event it is stolen. It is very cool.

So why don’t I want it in GEVCU. Well for one thing, it already exists. The OVMS guys have done it and I think the hardware and software assembled is all of $99 or something. But more importantly, we already HAVE it. Likewise ELM327 and tablets and much more.

This is all about CAN – the Controller Area Network. GEVCU can very easily tie into the vehicle’s CAN bus from BEHIND the OBDII connector. In fact, if you have electrified a restored older vehicle that doesn’t HAVE CAN or OBDII, you kind of do have now. The GEVCU IS the vehicle controller. It can work with one that is already there, or it can BE it, it doesn’t care. But it’s on the BACK side of the OBDII connector.

OVMS plugs into the FRONT. Also ELM327 wireless modules, ELM327 bluetooth modules, and a host of other things. Hardware and software without end that mostly already exists but is still in development.

A good example is the tablet application TORQUE. Torque lets you actually develop custom gages and link them to custom CAN messages. Eventually GEVCU will be able to put all that and more on the OBDII CAN and Torque can display that data on an Android phone or Tablet. For Apple IOS, I think the competing application is called DASHCOMMAND. Perhaps even better is ENGINELINK.

ALL of that becomes available to GEVCU through the CAN bus. You will be able to just plug in the $99 OVMS module to your OBDII and GEVCU instantly gets access to the GPS data and the cell phone connection as well.

The concept isn’t to go around and collect everything done in the universe of vehicle monitoring and control, and BUILD it IN to GEVCU. The concept is to be able to access any of that you want using GEVCU. In this way, we dont’ have to ourselves invent every line of code in the universe – we can fit into this ecosphere of applications and hardware very nicely. I think it is a matter of taking care to learn the protocols and conventions that OVMS and Torque and other clearly “leading” applications are using, and efficiently encode that into GEVCU operation where it is all seamless and nothing has to be accommodated. However well or badly they are doing it already, we can use that just that way. THEY think they’re plugging into a car. GEVCU thinks it IS the car.

And that’s kind of a microcosm of the whole thing. OVMS is mostly useful to people who have bought OEM cars. Similarly Torque. You guys build your own. So you should want it to do everything any other car does, including OBDII to USE Torque and OVSM, even if it is actually a 1974 Karman Ghia.

Managing open source projects is kind of like herding 25 cats in a lightning storm using a five iron and a roll of barbed wire. At this point, EVTV actually builds a GEVCU and we do a specific VERSION of the GEVCU software, however well or badly. I think we’ll see variants of both in the future and that is all to the good. But featuritus is kind of an editorial function and if not done well leads to kind of a mess.

The key is having a clearly defined mission and not wavering from it by much – even if for just a few dollars more you COULD actually control the precise temperature of the cigarette lighter – accounting for wind and ambient temperature. No, it would not be that hard. A little PWM circuit on the 12v, a couple of sensors. Yah. We’ll look at it.

I’m also VERY excited this week about a SUPER SECRET Battery Management System that actually did get off the ground from our announcement last year and the contest I killed when some of the natives went on warpath over it. Good reason to keep it a secret now. But I can tell you that if it pans out, we will be able to measure current to an astonishing degree of accuracy not seen on ANY electric vehicle – any OEM electric vehicle indeed. And similarly voltage and temperatures. It probably WILL control CAN controlled chargers – preventing charging at cold temperatures and perhaps even controlling heaters for such charging. And if it works out, I think it will be able to accurately PREDICT cell failures long before they actually fail or even look questionable using a voltmeter.

Twelve steps forward, nine back, and of course we fall to the floor a lot. I have TEN UQM drive trains in the building with me. These motors are VERY similar in power to the Siemens but at half the size and half the weight. And we have almost entirely figured out the CAN transactions to drive it, and the GEVCU can do it admirably. Almost.

For want of a nail, a shoe was lost. For want of a shoe, a horse was lost…

As it turns out, CODA does use the UQM Powerphase 100 drive train, but they did NOT use the stock UQM firmware for the inverter and indeed they did their own VCU, which they termed an ECU, to drive it. And they quite changed everything about the exchange. We have managed to decode MOST of it. But for want of a nail…

Instead of an address 205 command used by Coda for torque, voltage, and speed control. CODA simplified this to a 204 address command that just specifiies torque, along with forward/reverse and enable/disable. IT is a small five byte data packet.

Mysteriously, byte 1 is always zero. We just can’t catch it in the act of being anything else.
Byte 2 is a sequence counter and control byte. It simply counts from zero to seven and then back to zero. Packets have to be received in order to count. And two bits of this byte set enable/disable and two other bits set forward/reverse.
Bytes 3 and 4 are the actual torque command, least significant byte first and it represents 1/2 of the torque. In other words the Inverter will produce two times the torque noted in this two byte packet. It is also directional.

The bad news is byte 5. This is some sort of checksum/hash/cyclic redundancy check/security byte. IF it isn’t right, the inverter issues a CAN communications fault and does nothing. If it IS right, the motor turns.

We can COPY captured log data of these commands, and send them to the inverter and it will do as instructed perfectly.

The problem is, we don’t know how to GENERATE it. Every time we THINK we see a pattern, it disappears in the next example. We’ve tried a number of things, but so far it has eluded us. We’ve contacted the ex CODAOIDS. None of them remembers exactly who worked on that.

This is the contrast between open source and the proprietary approach so fawned on by the OEMs. Imagine being so closed you don’t even know how you did it or who did it. The obvious purpose is that if a motor or inverter failed, you would HAVE to get one from CODA. Other UQM Powerphase units, weather used or from UQM simply will not work in a CODA car. If your inverter fails, you have to get it direct from CODA and pay whatever CODA charges for it.

Not addressed is what you do if CODA fails. It would be cruel of me to point out that this strategy apparently didn’t work out for them. And it would be easy to dismiss. The irony is that it NEVER DOES.

Texas Instruments at one time had a personal computer. So did Apple, at the same time. TI insisted that THEY be the source of all add on hardware and all software. You bought their computer, you had to buy their software. Apple had an “open” backplane for add-on cards of which nearly a hundred became available. And some clown wrote VISICALC, which sold thousands of Apple computers to people who neither new nor cared that it was a personal computer – or what a personal computer was. They just saw this spreadsheet thing demonstrated ONCE, and HAD to have one no matter the cost.

Today, Apple has a share price of $600 and their main problem is what to do with the $140 BILLION in cash that has accumulated, litering the halls and clogging up the vacuum cleaners. TI took a $100 million write down in 1985 and exited the PC business forever.

This scenario was repeated so many times and in so many ways in the PC world, that even IBM adopted the open gig. It was a cliche. An absolute. If you wanted the market for your product all to yourself, you got it – all to yourself. ANd nobody would adopt it.

Car makers have just in the past few years discovered computers in cars. The lessons are not so apparent in that people do not buy cars for the computers that are in them, just like the Visicalc buyers knew nothing of Steve Jobs or Apple or what microprocessor it ran. But it holds absolutely as true if not as readily apparent. This totally closed proprietary protection of THEIR “intellectual property” in MY car that I bought is never going to work to the advantage of any car manufacturer anywhere. They would sell MORE cars by publishing the source code and putting a book in the glove box “How to Hack the ECU on your new BMW”.

Liability? Come on. Need I point out how totally proprietary GM’s ignition switch was and how they are now paying $35 million in fines, have 13 MILLION cars in recall at the moment with the body count rising weekly, and there are STILL tuners all across the land with software and hardware to hack into the ECU on any General Motors vehicle. Has any of that worked out for them? In ANY respect?

Ford is actually making noises about a Software Development Kit to access their ECU. They just can’t QUITE pull the trigger on it it is just SOOOO scarey….

I am actually NOT annoyed with such people because they are petty, mean spirited, selfish beasts who know but one note in the symphony of life (ME, ME, ME, ME…) and whose greed overcomes the better angels of their spirits. No, I am annoyed with them because they are incapable of accurately assessing their own self interests. That the logic that propels them is flawed at inception and they go right ahead not just shooting themselves in the foot, but then to RELOAD and dump another six shells into the SAME foot is just truly annoying to behold. To have them do it over and over just eventually gets to be a noise abatement issue.

We’re kind of a VW shop. VW was the brainchild of the ARCH ENEMY of democracy, Adolph Hitler. So why do we LOVE the entire VW thing EIGHTY YEARS after he conceived it. It literally brought Germany out of post World War II economic ruin single handedly. Leading it to become one of the strongest economies in the world and one of the most BELOVED automobile marques EVER PRODUCED with a cult following WORLD WIDE 80 years and MILLIONS of cars later?

Anybody can work on it. Literally anybody. It lends itself ably to customization and adaptability. You can put a fiberglass bathtub on top of it and start a whole ANOTHER thing. It was never a very good car in any sense of the word and it was never made of very good materials – all VW’s rust while you look at them. Even if they were just restored. So why the love? Why the cults? Why an entire ECOSPHERE of support parts and goodies for cars from the 1960’s???

I hear this all the time. BECAUSE THEY WERE CHEAP!!!. It is not so, and it NEVER WAS so. I bought a Ford Pinto in 1973 brand new for $2185 because the SuperBeetle I WANTED was nearly $3400. The VW THING was $1500 MORE that year. I could have bought a NEW VETTE for the price of a VW THING. Where did this myth get started that Volkswagens were CHEAP. THey were CHEAPLY BUILT. But they were always extraordinarily EXPENSIVE to BUY.

No, they were extraordinarily OPEN. ANd they were easy to work on, and even easy to restore. So they’ve just been restored, and restored, and restored, over and over again. The ONLY car that can compete with them for cult following, is, in the irony of all ironies, the PORSCHE. And mostly for the same reason.

For want of a nail… We have a log of 27,833 CAN messages taken from a brief drive and provided to us by Brian Hall of Thunderstruck Motors – who actually drives a full blown CODA as it happens. I have imported this into an XCEL spreadsheet where we can sort on various things and compare various things ad nauseum. Perhaps among our own viewers is a budding Alan Turing looking for an Enigma project. Dan Friedrickson I know is out there and is a certified genius, or at least a self proclaimed certified fantasy genius, or at least under constant medication for being such. Perhaps he might deign entrance us with a demonstration of mental legerdemain and forward me an algorithm to produce this mystery hash byte.

Note that I am not looking for sage and puckered patronizing ADVICE on what I MIGHT DO to crack it. A heroically detailed analysis restating the problem is actually of limited interest as well. But carefully and elegantly crafted and commented C++ code to produce it would be damned handy.

Guy was driving past the Farmington State Mental hospital here in Missouri and suddenly had a flat tire. He removed the hub cap and put his lug nuts in it while changing the tire. When he put the spare in position, he knocked over the hubcap and all the lug nuts dutifully rolled off into the street and straight down a storm sewer at the curb. Now he had the car jacked up, and had the spare in place, but no way to fasten it to the wheel.

Exasperated, he stood up and noticed one of the inmates at the mental hospital standing just on the other side of the fence calmly looking at him. Well? Now what do I do?

“Why don’t you take one nut off of each of the other three wheels and use those three to secure your spare. You can drive the car to a gas station and buy new lugnuts all around.”

“Damn. That’s pretty good. How did you come up with that and be in there?”

“I’m actually in here because I’m a little crazy. That does not imply that I’m stupid as well…”

“Are you saying I am??”

“No, but I didn’t spill the lugnuts down the drain either…”

CODACANBUSCAPTURE.xlsx

85 thoughts on “For Want of a Nail….”

  1. Jack,
    Given that you can collect and re-use log entries for the CODA ECU, if you collect long enough, uh – exhaustively enough, put them in a table and be done with it. You prolly don’t need 65k torque values. Sure its ugly, but it works. And if successful, you have a reason to come back and make it right.
    Regards, JoeO

    1. That’s a logical thing to try but it is difficult for several reasons; not the least of which is that 65k tables don’t work very well with small microprocessors. Technically it could work for the GEVCU because it has enough FLASH and enough RAM to store the whole table. Also, we’re lucky in that only a small subspace of the torque values are valid. You can’t really ask for 3000Nm or anything silly like that. It probably ranges +/- 200Nm in practice. That drastically limits the values you need to store in the table and still have it work. But, the checksum value also depends on a third byte so that complicates things a bit all over again.

      1. It would be a curiously inelegant way to do deal with it and I’m loathe to do so. I would prefer to decode the byte as our first option. And find a way to reflash the inverter with stock UQM firmware as the fall back option.

        But if all else fails, it would be a simple lookup. The 84MHz ARM 3 is about 21 times faster and 4 times as wide
        as my first processor. It actually covers a multitude of sins. And there are some tricks in assembly that
        probably port pretty well in C. We’d probably do three tables. MSB with pointers to LSB packed with forward/reverse enable/disable and pointers to the byte. In4other words, spend some programming effort ahead of time to kind of generate indexed tables optimized for search.
        The actual search at 85 Mhz would be approximately nothing.

        But I would be almost embarrassed to do it that way. I don’t think it would be the Alan Turing approach.

        Jack Rickard

  2. Duane Lindsey

    RE: the log, just to confirm that the orig data is to be found thru xls line 13782 ? ( via the byte 1 def and the Timestamp I assume that the remaining rows are a manipulation of the orig data )

    1. Actually, I thought I explained it rather well. The log obviously in its original form would be in time code order. A 204 command is sent. A 209 status message comes back from the inverter. Another 204 is sent. The response that actually implements a command seems to be delayed by about four of these cycles. Displacing it by four, CHart 1 shows the commands and resulting actual torque values.

      We then sorted it on the address row so all the 204’s are together and all the 209s. So yes, the first half is 204 commands needing the 5th byte.

      Jack Rickard

  3. Very recently after watching the video of the thing dancing down the Cape roadways… I had wondered silently why the locals were not lining up at the door, even briefly touring the general area on G maps, I could not find the expected well worn path linking the schools filled with enthusiastic young ones leading to the EVTV shop either. Perhaps it is the calm before the storm of inspiration. Perhaps it’s time to extend the inspiration towards the north border as well.

    1. Actually we do receive a lot of class visits from the schools, everything from grade school kids to the local university. And i speak regularly at Southeast University to various classes there and Brain does as well.

      But recently Bubba has been stopping by to talk about electrons. Very new development.

      1. I think that EVTV viewers are missing out on some great speeches then. Perhaps video a few occasionally for the weekly show? EVTV Kids corner? It might work.

    1. Possible to find them. Look at the article, it has a link to the original Facebook photo. Find the Facebook person that took photo, I reckon he saw the trucking company name. Contact trucking company and find out where cars went Easy.

  4. I took the spreadsheet you provided and printed it in order of MSB LSB op-code = check byte..

    total commands: 13,772
    unduplicatied commands: 3,458
    ‘Ax’ op-codes: 2,906
    ‘9x’ op-codes: 550
    ‘6x’ op-codes: 1
    ‘5x’ op-codes: 1

    MSB LSB OP = Check
    7D 80 5x = FF (only instance) op 5x (0101) check byte is the same as op 9x (1001)
    7D 80 6x = 55 (only instance) op 6x (0110) check byte is the same as op Ax (1010)
    7D 80 9x = FF
    7D 80 Ax = 55
    7D 81 9x = 55

    Note the general behavior that prior ‘MSB LSB Ax’ has the same check byte as ‘MSB LSB+1 9x, looked to make sure this applies to ‘MSB FF’ and ‘MSB+1 00’.
    YES, see:
    7D FF Ax = 0D
    7E 00 9x = 0D
    7E FF Ax = 06
    7F 00 9x = 06

    Per the spreadsheet, the voltage is (MSB/LSB – 32128) / 10.
    The min voltage value encountered = 77 0B (=-165.3v); the max voltage value encountered = 85 09 (=193.1v); note 0v is 7D 80 (32128)

    My conclusion is this could be accomplished with a single lookup table using MSB LSB -> check only. if the op-code is 6x or Ax, increment the MSB LSB pair by 1 to perform the lookup as it would occur for op-codes 5x or 9x. The table needn’t be anything like 64K entries, either. If I understand right that the units are volts, the range from -400v (28128) to +400 v (36128) would be covered by MSB LSB 6D E0 to 8D 20, nominally 8000.entries. If the granularity were set at 1v instead of .1v, it need only contain 800 entries. If the LSB was stripped of its lowest 3 bits (& 08) it would contain 1000 entries.

    I tried several LRC algorithms and a CRC reverse-engineering program called ‘reveng’ found at reveng.sourceforge.net but didn’t find a match. Please don’t assume I got the LRC and CRC tests right. I hope someone comes up with the method to calculate the check byte directly.

    1. As I test hypothesis after hypothesis I’ll consider the possibility that the fifth byte calculation produces a number larger than FF with a certain frequency and that a single test line just assigns FFh when ever the equation produces a handshake greater than FF. The effort is no less optimistic than buying lottery tickets.

      1. The check byte values are distributed pretty evenly between 0 and 255, there would be more at 255 if the values were being truncated:
        0 = 16 1 = 13 2 = 16 3 = 15 4 = 13 5 = 12 6 = 15 7 = 14 8 = 15
        9 = 13 10 = 16 11 = 11 12 = 13 13 = 12 14 = 15 15 = 13 16 = 11
        17 = 13 18 = 10 19 = 15 20 = 12 21 = 11 22 = 15 23 = 15 24 = 10
        25 = 15 26 = 15 27 = 13 28 = 16 29 = 14 30 = 14 31 = 14 32 = 14
        33 = 15 34 = 16 35 = 16 36 = 13 37 = 16 38 = 10 39 = 13 40 = 13
        41 = 14 42 = 12 43 = 14 44 = 14 45 = 12 46 = 13 47 = 14 48 = 15
        49 = 15 50 = 13 51 = 12 52 = 14 53 = 14 54 = 15 55 = 12 56 = 12
        57 = 12 58 = 13 59 = 14 60 = 14 61 = 14 62 = 14 63 = 15 64 = 13
        65 = 12 66 = 15 67 = 15 68 = 13 69 = 14 70 = 14 71 = 14 72 = 15
        73 = 15 74 = 15 75 = 14 76 = 13 77 = 14 78 = 13 79 = 14 80 = 12
        81 = 14 82 = 14 83 = 12 84 = 14 85 = 11 86 = 14 87 = 12 88 = 12
        89 = 11 90 = 15 91 = 12 92 = 13 93 = 14 94 = 14 95 = 14 96 = 14
        97 = 13 98 = 14 99 = 13 100 = 15 101 = 14 102 = 14 103 = 15 104 = 12
        105 = 13 106 = 13 107 = 12 108 = 12 109 = 12 110 = 10 111 = 9 112 = 14
        113 = 16 114 = 16 115 = 11 116 = 14 117 = 16 118 = 13 119 = 14 120 = 14
        121 = 15 122 = 10 123 = 15 124 = 11 125 = 15 126 = 12 127 = 15 128 = 11
        129 = 15 130 = 13 131 = 14 132 = 13 133 = 15 134 = 11 135 = 15 136 = 13
        137 = 15 138 = 12 139 = 14 140 = 15 141 = 14 142 = 15 143 = 14 144 = 13
        145 = 13 146 = 12 147 = 15 148 = 15 149 = 13 150 = 10 151 = 13 152 = 15
        153 = 13 154 = 13 155 = 12 156 = 14 157 = 15 158 = 13 159 = 14 160 = 14
        161 = 15 162 = 15 163 = 12 164 = 15 165 = 13 166 = 15 167 = 13 168 = 12
        169 = 13 170 = 12 171 = 12 172 = 16 173 = 10 174 = 14 175 = 12 176 = 14
        177 = 12 178 = 14 179 = 12 180 = 13 181 = 13 182 = 14 183 = 15 184 = 16
        185 = 14 186 = 13 187 = 12 188 = 15 189 = 14 190 = 14 191 = 16 192 = 14
        193 = 15 194 = 12 195 = 14 196 = 12 197 = 12 198 = 13 199 = 14 200 = 15
        201 = 11 202 = 12 203 = 16 204 = 12 205 = 13 206 = 15 207 = 15 208 = 12
        209 = 14 210 = 14 211 = 14 212 = 11 213 = 13 214 = 12 215 = 14 216 = 14
        217 = 15 218 = 10 219 = 15 220 = 13 221 = 12 222 = 13 223 = 15 224 = 14
        225 = 13 226 = 13 227 = 13 228 = 13 229 = 14 230 = 11 231 = 14 232 = 15
        233 = 13 234 = 14 235 = 14 236 = 9 237 = 14 238 = 13 239 = 13 240 = 14
        241 = 14 242 = 12 243 = 14 244 = 16 245 = 13 246 = 15 247 = 16 248 = 16
        249 = 13 250 = 15 251 = 13 252 = 17 253 = 14 254 = 13 255 = 12

    1. Ok that means i will never be able to get a chat with you…….
      I’ve tried to email you, no answer
      Skype and hangout has not been very fruitful when trying to talk to you.

      Well I guess you are pretty busy with all your toys….. and now another one.

        1. No worries, I can not start with that project now anyway.
          Got load of other more pressing business going on before I can try to build that Monster IGBT controller…..

          REgards
          /Per

  5. Had a guy come by this week collecting for charity whilst I was working on the Civic. We got talking and he turned out to be a car nut. His latest escapade was turbocharging something or other to 450 HP – until it blew up. I took him for a trip round the block in the Ampera: usual trick of ghosting along in complete silence at 5 m.p.h. and then booting it. When we got back he was all ready to do a conversion himself.

  6. Thats a sweet looking little speedster being built. The Concept BMW is perfection, if only they would produce it now, and yes they need to keep the fin. I do hope they don’t ruin it. As it is it would stand well and sell well. No doubt. Im on board with Solar Roadways. I pitched a bit to them. I always felt the US should be on top of the heap. This would surly do that. Heres to a new world. 🙂

    1. Nikita Sidorov

      So, do I understand it correctly that byte 5 is the result of an unknown function of byte2, byte3 and byte 4? If so, then I would expect each value combination of byte 2, 3 and 4 to map to exactly one value of byte 5, but it’s not the case. For example:
      #2 #3 #4 #5
      7A FD 8A 0
      7A FD 8A 0A
      7A FD 8A 0E
      7A FD 8A 23
      7A FD 8A 2D
      7A FD 8A 3
      7A FD 8A 37
      7A FD 8A 3B
      7A FD 8A 3E
      7A FD 8A 42
      7A FD 8A 45
      7A FD 8A 49
      7A FD 8A 57
      7A FD 8A 7
      7A FD 8A DA
      7A FD 8A E1
      7A FD 8A EB
      7A FD 8A F2
      7A FD 8A F9
      7A FD 8A FC

      Does it mean that byte 5 also depends on some state (e.g. a value from the previous packet)?

      Meanwhile, I found it helpful to create a scatter chart that maps byte 3 to byte 5 for some constant values of byte 2 and byte 4. There is clearly a pattern. I will look further.

      1. The near perfect distribution of the fifth byte made me think it was masked from a wide binary number in constant rotation behind a byte mask. Also, the chicken and egg debate comes to mind. Could the number of bit rotation places dependent on the last data export message from the drive? The number of vendors selling encryption schemes out there are like termites after you kick over the log. Encryption keys inside the VCU and the drive are highly likely. The byte string from the drive may say ” here is the data and yes I’m ready to receive a torque command, here’s my key”

        1. Stan,

          There is no key.
          The full CAN capture is posted in the forum and you have seen it there.
          In the CODA, message 204 originates from the Drive Line Control Module, which is similar to a GEVCU.
          The UQM CAN manual refers to message 204 as being the Acceleration Limits Command.
          The remaining messages 209, 20A, 20B, 20C, 20D, and 20F originate from the UQM inverter and are parameter values reported from the inverter.
          They all follow the format and structure of the CAN manual published by UQM.
          Those messages do not contain any mysterious data that might even remotely resemble a key.

          Nikita,

          The data that you have posted doesn’t match the the data file that is posted.
          The data that is posted is quite consistent in that same values in byte 2, 3, and 4 then have a consistent value in byte 5.
          Perhaps you got a bad download as your numbers do not match anything that I have seen.

          Mike,

          You have pointed out that Byte 5 seems to only follow if “forward” or “reverse” is selected regardless of whether “disable” or “enable” is set in byte 2. That is an interesting observation.
          Just to clarify, byte 2 seems to have 2 functions that can be discerned. First is that the high 4 bits are set to 1 to select:
          1010 Enable Forward (AX)
          1001 Enable Reverse (9X)
          0110 Disable Forward (6X)
          0101 Disable Reverse (5X)
          The above are the ONLY values ever found in the high nibble.
          Then bit 5 is always a 0 and bits 6, 7, and 8 are a rolling octal “Number 5 is alive” counter.

          Bytes 3 and 4 are “requested torque” MSB, LSB times half. Byte 5 is the “WTF” value…

          I have made up the terms in quotes and they do NOT follow the documentation for message 204 from the manual.
          In fact, the UQM manual says that message 204 will contain 8 bytes! Alas, the CODA data has 5 bytes.
          The data in message 204 also fails to pay any attention to the UQM manual…

          1. weisheimer, thanks for the recap. i also think it’s important that ‘MSB LSB Ax’ has the same check byte as ‘MSB LSB+1 9x. Also, having seen the even distribution of check bytes and similar distribution of LSB (can post if anyone’s interested), my guess is to look at this as an implementation of fnx(MSB) + or – LSB. If I were just trying to discourage the casual hacker, my fnx(MSB) would be to multiply it by a prime number between 257 and 65535, presuming the controller can do 32-bits, then recombine the bytes of the integer either by adding or XORing. However, I have tried all those values and it didn’t work, although my implementation may be flawed.

          2. Stanley Cloyd

            Would they have considered a “population function” of the stay-alive counter (number of binary ones) to come up with a variable off-set of the fifth byte? A lot of hypothesis tests are off by one, two, or three.

          3. Stanley Cloyd

            Is it true that the high nibble of byte one is always 9h,Ah,or 5h? Is it true that the fourth byte is always between 122d and 130d? With 13 plus thousand 204 commands I’m not entirely sure. If our input list is complete and the third byte was uniform from 0-255 (I need to test that) then we would have 6,912 possibilities mapped to 256 outputs. On average 27 combinations would lead to a unique fifth byte. If one wanted to go to a look-up table one could, by probability/frequency-of-occurrence analysis make the look-up very fast on-average. The worst case of course would be the time bandit. Disregard the post about the stay-alive counter. That has already been ruled out.

          4. Correction: I boofed it…
            Byte 5 only observes ENABLE and DISABLE, not forward and reverse.
            Thus, either an AX or a 9X in byte 2 will result in an identical value in byte 5 when the data in byte 3 and byte 4 are the same.
            Thanks for the clarification Mike!
            That does very clearly enter into the equation.

            Mark Weisheimer

          5. Michael Harris

            Mark,
            I found the values that Nikita showed, they are with ID 209, so the file is OK he is using.

            Looking at 204 commands only and with Byte 2 MSB = A (or Forward drive)
            Appears that Byte 4 is actually the MSB of Torque. True?
            Do you understand why the top 4 bits of byte 4 are either 1000 or 0111 (8 or 7) Significant? or Just because this is the MAX torque values? Why not a 6? or a 5 or less ?

            Last, Although repetitive values of B3,B4 do result in the same B5 value, The B5 value is not unique to B3,B4.
            For example – Every instance of B3, B4 = E6 7B results in B5 = 0, however, these values also result in B5 = 0
            B4 B3 B5
            78 40 0
            79 95 0
            7A 3B 0
            7B E6 0
            7C BA 0
            7D 67 0
            7E C1 0
            7F 14 0
            80 ED 0
            81 38 0
            82 8E 0
            83 43 0
            84 0F 0

            Hope this doesn’t further confuse the trail of Byte WTF :^)

          6. Nikita Sidorov

            Thanks Michael, afterwards I did realize that I was looking at bytes of 204 and 209 messages instead of just 204.

            I found something else interesting. For fixed values of B2 and B4, there is a unique mapping from B3 to B5 except for two pairs of values of B3. The first pair of values is B3 = FF and B3 = X, the second pair is B3 = FE and B3 = Y, such that |X-Y| = 1 (in other words X=Y+1 or X=Y-1). I found this by sorting the spreadsheet by B2, B4 and then B5. To get all such pairs, I loaded the codes into a SQL table and ran this query:
            select a.h2, a.h4, a.h5, a.h3, b.h3, a.b3, b.b3, a.d3, b.d3 from codes as a inner join codes as b on a.h2=b.h2 and a.h4=b.h4 and a.h5=b.h5 where a.h3 > b.h3 order by a.h2, a.h4, a.h5;
            h2 | h4 | h5 | h3 | h3 | b3 | b3 | d3 | d3
            —-+—-+—-+—-+—-+———-+———-+—–+—–
            9 | 7D | D8 | FF | A9 | 11111111 | 10101001 | 255 | 169
            9 | 7E | D3 | FF | D4 | 11111111 | 11010100 | 255 | 212
            A | 78 | 3C | FF | D2 | 11111111 | 11010010 | 255 | 210
            A | 79 | 21 | FF | A9 | 11111111 | 10101001 | 255 | 169
            A | 79 | F4 | FE | A8 | 11111110 | 10101000 | 254 | 168
            A | 7A | 2A | FF | D2 | 11111111 | 11010010 | 255 | 210
            A | 7B | 1B | FF | 53 | 11111111 | 01010011 | 255 | 83
            A | 7B | CE | FE | 52 | 11111110 | 01010010 | 254 | 82
            A | 7C | C5 | FE | D3 | 11111110 | 11010011 | 254 | 211
            A | 7D | 0D | FF | A9 | 11111111 | 10101001 | 255 | 169
            A | 7D | D8 | FE | A8 | 11111110 | 10101000 | 254 | 168
            A | 7E | 06 | FF | D2 | 11111111 | 11010010 | 255 | 210
            A | 7E | D3 | FE | D3 | 11111110 | 11010011 | 254 | 211
            A | 7F | 7E | FF | F6 | 11111111 | 11110110 | 255 | 246
            A | 80 | 75 | FF | D2 | 11111111 | 11010010 | 255 | 210
            A | 81 | BD | FE | A8 | 11111110 | 10101000 | 254 | 168
            A | 82 | 63 | FF | D2 | 11111111 | 11010010 | 255 | 210
            A | 82 | B6 | FE | D3 | 11111110 | 11010011 | 254 | 211
            A | 83 | 52 | FF | 53 | 11111111 | 01010011 | 255 | 83
            A | 83 | 87 | FE | 52 | 11111110 | 01010010 | 254 | 82
            A | 84 | 59 | FF | D2 | 11111111 | 11010010 | 255 | 210
            A | 84 | 8C | FE | D3 | 11111110 | 11010011 | 254 | 211

            where the pairs of h3, b3 and d3 are the pairs values of B3 for which the value of B5 is the same (for a fixed B2 and B4) in hex, binary and decimal forms.

            What is so special about values of FF and FE? If we invert all the bits then we get 0 and 1, which are pretty special when you multiply something by it. So it makes me think that the WTF formula may use the value of (255 – B3).

            What function uniquely maps one number to another with a couple of exceptions?

          7. Nikita, Your explorations with sql parsing look interesting now that you have isolated your study to message 204.

            I was out of town without Internet for 2 days, thus I apologize for my slow response.

            Mike, you mention the +1 offset for Ax vis 9x and that may imply that REVERSE causes the checksum/crc/wtf byte 5 to increment by 1 in all cases. You said that in an earlier post and it bears testing.

  7. Google upsetting automobile industry today

    Google showed a car and they actually insist to drop it onto our streets next year.

    No fuel inlet, no useless stuff between or under your feet and no steering wheel in front of your stomach.

    I guess you can charge it from your laptop via usb. They did not tell us AC or DC or Tesla. Maybe we’ll see a new charging standard to compete with.

    I remember no wheel but a tiller in the Baker Electric or the Columbia was nice but I never tried it.

    Cheers
    Peter and Karin

    1. Hi Guys,
      I know this is off topic, but hopefully might get spotted by the right people 🙂 Is anyone with a better place pack actually breaking it down into individual modules to re-configure, hence not needing the frames anymore? If you are I’d be very interested in buying a pair of the cast alloy, frame end plates from you… please let me know, and sorry again for the off topic!

      Paul

          1. Michael Harris

            Paul,
            Where are you located? I’m repackaging all my modules and have sold most of the remains off to the scrap yard. However, I have at least 1 end still on the bottom of a pack. Not sure if I have the matching piece or not. I’ll check this weekend.

  8. I’ve gotten quite a way toward the solution to the Coda checksum byte. It appears that both byte 3 and byte 4 index tables by each bit within the bytes such that you XOR against the table entry for each bit. It’s somewhat confusing to explain but I did write up a long post about it on the forums. If anyone can find exceptions or how to solve them it’d be helpful. The table entries were specifically chosen to really mix up the bits of the checksum so it appears to change by seemingly random amounts based on just single bit differences. However, there is a little piece I don’t quite understand where sometimes the values in the look up table seem to change based on the input values. Still, my approach listed on the forum seems to be getting close to the answer. It’s just not there yet. Please, keep up the analysis. You never know which patterns will turn out to lead in the right direction.

    1. You and several others seem to be on the right track.
      It does appear to be bit masked via XOR or such. I am wondering (and need to explore this a bit) if it may be making an adjustment based upon a particular “parameter” such as negative torque (Regen) or direction/enable/disable status. Do you notice any kind of pattern for when the XOR function fails the your rule test?

  9. Jack,
    How many torque values do you need? A hundred? A thousand? That’s not a lot of table entries. How precise is your acc pedal or your foot?
    Regards,
    JoeO

  10. Jack, couple questions
    One: once GEVCU 5, 6, and or seven are available for purchase in the new housing with all the new components and updates, are you going to continue to carry in the store a metal housed version for use in vehicles, like Seven, that a bit noisy?

    Two: during the Thing drive you talked about alignment and setting up your builds generally with a little tow in on the front wheels to help prevent pulling from side to side, do you find this setup to work equally well for front and rear wheel drive vehicles? From what I can find adding a bit of tow out is the reccomended set up for front wheel drive vehicles but I have no experience in this area and was hoping you might and could illuminate me.

    Thanks
    Kevin

    1. @ Michael Harris,

      I’m in the UK, but will happily pay the postage from anywhere for a pair of these, let me know when you’ve had a look, as I do need a matching pair if possible. Many thanks.

      Paul

    2. I used to do front end alignments for a living in my younger days, and tow in, or tow out, is there so when you drive the vehicle, the tires go to center. Its just there to tighten all the joints, once your in motion. That’s also true with camber, cause when you roll, the front end gets lifted a bit, which changes camber, so the camber adjustments are there to bring the wheel to the best vertical position possible.

      Rear wheel drive uses toe in, and front wheel drive uses tow out.

      Roy

    1. That is a lame example. I have already made one of those. Mine goes double that speed (1,100mph) on half the power, double the range while being fully aerobatic. It is a very different concept in many ways, except one. The only thing in common to the jet car in gizmag, it exists only in my mind. 🙁

  11. Jack, I just finished watching the 5/30 episode, great update from everyone. You taunted us with a cool, black-finned gadget on the bench for the whole episode and didn’t talk about it. A new DC/DC or charger perhaps?

    1. It is in the shop, yet another DC/DC charger.

      I come from making a silly experiment, connecting yet another 12V battery to our cigarette lighter socket. It is dead normally except when ACC or ignition is on. The original battery is 12V 27Ah lead acid. The aux battery is 12V 10Ah lead acid.

      It did get me more range? I can hardly beleave it.

      In the i-MiEV the DC/DC gets liquid cooling. May be I reduced the power needed for cooling. Maybe some gremlins hiding in the 12V system.

      Cheers
      Peter and Karin

  12. Following on from my piece on the heater and the soft short, Doug Ingraham kindly emailed me with a suggestion about my problem of trashing SSRs – suggesting that it might be inductance in the long connecting wires causing a spike on the input side.

    And Jack – I think maybe you are confusing Redditch and Reading. I come from Redditch in Worcestershire (where the sauce comes from). Reading is south of the Mason-Dixon line. We Midlanders don’t always deny rumours of dreadful goings on in that part of the country

    1. Many EV’s are problematic with long power leads to motors too.
      Yes, we Northerners have also heard about the deep South. It’s where all the foreigners come from.

  13. Jack–and after the 6/30 show–Ed,

    Have you considered plumbing the DMOC and the Siemens motor in parallel from the pump? For the case of the Thing, since you have two heat exchangers, you can plumb the outlets of each component to their own heat exchanger and then dump both back together into the reservoir/fill tank.

    Your pump is probably sufficient, but if the flow is not correct you would possibly just need a “diverting’ ball valve partially closed on the motor line to increase the resistance and force more flow to the DMOC.

    Does the Ford Transit use two pumps?

    1. Jarkko Santala

      I’d also check the natural air flow direction on those heat exchangers without the fans running. Just to make sure the fans aren’t working against it. Could also be checked by swapping the fan leads, perhaps flipping the blades over if needed and comparing temperatures. My guess is they’ll suck air out of the shoulder vents, but it’s just a guess. Hot air however does like to go up and I think it’s now going the other way.

      1. Jarkko:

        An excellent point, but no the VW cooling is IN to the hip vents and down into the motor compartment and out the bottom. And that’s whas we have our fans doing.

        The problem isn’t really inadequate cooling. It is incompatible temperatures. The motor can safely go to 140C while the Inverter goes into current limit at about 50C.

    2. Chad:

      You kind of miss the point. The motor runs MUCH hotter than the Inverter. Mixing the fluids in the fill bottle or the pump is the problem, not the solution.

      We have gone to two entirely separate loops. That way they can operate at two different temperatures.

      I’m working on two cooling kits for the store, both using larger AN-8 fittings and hoses. One is a single loop system and the other is a dual BUT it does use a common Derali Heat Exchanger Ed Clausen found that features a dual cooling circuit.

      Jack RIckard

      1. Not entirely missed, it’s all energy balance. If the Siemens puts more kW of heat into the water than the radiator/fan can pull out, it doesn’t work. Since you have the two Derali’s, it was easy enough to put in more parts. I was simply stating there are other solutions. The CODA in fact has one larger radiator and the motor gets its water from the outlet of the Powerphase100. If a converter plans on using their well over sized existing radiator/fan then they could do so.

        1. All manufactured EV’s I’ve seen have two radiators.
          However, a suitable peltier cooler to pump the heat from the invertors water into the motors hot water system could be neater and smaller.

    1. Your welcome Kevin, I find that alignments are much miss understood, at least were normal driving is concerned. I used to tell people unless the adjustment were moved, a front end never really goes out of alignment, unless you have parts wore that need replacing. The reason most vehicles need an alignment is due to high of vehicle changes. When cars are brand new and get driven, the springs settle, and that’s why a new vehicle needs an alignment after so many miles, to correct those changes in height.

      If you check the vehicle height at four points on your conversion, and after the conversion get the height back to where it was, you will be back to the alignment you had before you started.

      On another note:

      I also got this email today from Vicor, there are some interesting devices in the making. I used to get a call from Vicor every so often and explained to them that they have an opportunity in the EV industry, and explained some of the things they could look at, looks like I may have put a spark in there…….

      http://www.vicorpower.com/promotions/AC_to_PoL/ChiP_Technology/DCM/lp.php

      Roy

      1. Roy, Vicor already makes DC-DC converters for EV applications through their Aegis Power division, check this out:
        http://www.aegispower.com/index.php/standard-products/electric-vehicle-power-converters

        In a prototype (work) project I used over a dozen of them, I believe the HEV2400, which is 2400W. The only problem is that they cannot be on the same HV battery bus as a motor controller that has film caps. The input circuitry of the DC-DC cannot handle it, even with adding large amounts of inductance on the input. I think I replaced each and every one of them 2 or 3 times each before the test project ended. The HV input is also in the same connector as the CAN bus. A little bit of water splash from the road and you have 300+V on your CAN bus and you instantly smoke every ECU on the CAN bus, Been there, done that.

  14. Big Congrats to Colin for working out the Infamous Coda Byte 5! And a big ole Fuck You to John Hissong of Coda Energy. I think Jack should print up t-shirts with the code like they did with the DVD encryption key. I’d buy one at EVCCON.

    1. Stanley Cloyd

      Ditto, and Jack runs a serious risk of selling out Coda motors and drives at EVCCON if not before. I doubt Colin would ever have to buy his own drink at EVCCON.

    1. Gary Livingston

      I was elated to see the news! Awesome work Collin and thank you Jack for leading us all to another pot of gold and the end of the EV-rainbow. After watching the show, I went directly to look for the little “donation” link. . . to show some appreciation. Whereditgo?? Did I miss it’s demise?

      Gary Livingston

  15. Jack, All mains supplies in the EU zone are 240V. Not 120V

    Otherwise you are right. Nissan Leafs don’t have much range. Neither do Teslas for that matter. Nikki Gordon-Bloomfield should of borrowed this friend of hers VAN.

    Single run home from London, non-stop :-

    Txxxxxx Cxxxxxxx
    13 hrs · Selective Tweets ·
    Back at 2.15 with 52kWh still in tank after 211 miles up the M1 M6 ‪#‎EV‬
    follow @xxxxxxxxx

    A Berlingo van with 156V(?) @ 540AH. Scarily charges at only 10A.

  16. 54th Hessentag Fair with 54 EVs corso.

    Jack steal it:

    https://www.youtube.com/watch?v=CtsRSQUClk0

    We created our own traffic jam in two roundabouts and finally blocked the fairs main street. Those little 3-wheelers:

    http://en.wikipedia.org/wiki/Twike

    are actually salon Teslas. They have almost got the same range. Those pedals cannot really move the vehicle but they are a good vent when standing at a red traffic light.

    Mishap? When one of the cars followed the wrong exit at a roundabout to meet some cameras, everybody else followed her. Those on the right track turned to follow us. That is when the first roundabout immediately at the fair collapsed.

    We tried to reach the next roundabout to turn but that roundabout jammed because everything between the two roundabouts jammed. Something wet hit the fan when people started turning between the two roundabouts and even pedestrians came to a halt.

    Security were not amused but common sense returned when they learned we had more kilowatts in our batteries than they could carry in a taser.

    Later in the afternon a lot of people couriously watched us clotting around an outdoor junctionbox charging.

    Cheers
    Peter and Karin

  17. I don’t know if anybody mentioned that before in this blog, but I really wonder about this very strong sweet smell coming from the CALB CA cells. Honestly from the first unboxing. Now in the hot summer it is getting stronger.
    Possibly the electrolyte is the only thing with that smell. But this would mean we have leaky cells…
    Any ideas..?

      1. When I first cracked open the Fluenza pack a faint odor was detectable. My pack sets in 65 degree F storage until the build actually starts. In the small 10′ x 12′ foot room no odors were noticeable at any later time. Others noticed the same thing.

        1. My pack also smelled when first opened, having been separated into individual module blocks for a couple of weeks now, I can still smell a slight odour from all the modules if I put my nose up against the module vents and sniff. (I do have a very acute sense of smell though!) It concerns me a little as I also have additional Leaf modules sourced elsewhere and these do not smell at all. I’m thinking it may be due to these packs sitting baking in the metal enclosure in Israel heat. I’m hoping they are OK, there is no sign of any leakage from any of the modules, all voltages were matched closely when checked and they seem to have all behaved as expected whilst discharging the pack to a lower state of charge ready for bottom balancing, but it is a concern…

          1. I had the smell also when it was first opened but nothing since. My first module is almost bottom balanced so it will be interesting to see if there is any gassing when it is charged again.

        2. My pack was similar, the smell only filled the garage for a couple days. Now the garage is back to smelling like gasoline from forgetting to turn the petcock off the motorcycle parked next to it …

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Verified by MonsterInsights