EVCCON 2015 - Day 3

Session: Arduino CAN_DUE Library Advanced Techniques - Collin Kidder

Collin's CAN_DUE library brings advanced CANbus handling functionality to the Arduino world.  All code written by the extended EVTV coding teams uses CAN_DUE.

The hardware has 8 "mailboxes" which can be used to send or receive data on the CANbus, and everything is interrupt driven using callback function registration, which is far more efficient than polling, although polling is available.

There are two independent CANbuses, you can run both independently at the same time.

To initialize a CANbus, use the begin() method call with the desired bus speed and the hardware pin connected to the bus.  You can also later adjust the bus speed.

Filtering of incoming messages is set using a number of method calls where you specify which message frame ids you're interested in.

The main data structure is called CAN_FRAME and contains all of the critical information about each incoming and outgoing message, including the message id and data.  A union data structure allows you to access the data by low and high int, four shorts or 8 bytes without casting and converting each time.

Sending data is done with the sendFrame() method call, passing in your formatted CAN_FRAME.

One thing to remember is that although Arduino sketches look like C++ code, it's not a full implementation.  For instance, you cannot use a C++ class' method as a callback target.

Very powerful CANbus apps can be written in very few lines of code thanks to this library.  Great work Collin!

News Flash: Charge.net.nz has announced that BMW wants to sponsor their fast charging network effort in New Zealand with €200,000!

Session: CHAdeMO Fast Charging Standard – Collin Kidder and Jack Rickard

Jack has decided to build a car-side CHAdeMO charging solution.  This can be fitted into any electric vehicle to provide fast-charging, slashing charging time and enabling long-distance driving by reducing range anxiety and objections over long charging times.

The expensive part of the kit is the CHAdeMO connector at about $900.  All that's needed in addition is two high-voltage, high-current contactors, a small automotive relay and the EVTV-developed JLD505 meter & CANbus controller, but this may be replaced by a GEVCU in the future.

The CHAdeMO specification lists output at 50V - 500V DC, but real-world testing shows some manufacturers are cheating on the spec by ignoring lower voltages in the range.  Usable range is about 250V - 500V which excludes most DC-motor enabled cars.  While this works for so-far every OEM manufactured car, a lot of home conversions will not be able to benefit from this.

Tesla appears to use the CHAdeMO protocol under the covers, running on 33.3kbps single wire CANbus.  They read the vehicle VIN number and only function when the VIN is validated against known Tesla vehicles.

Contrary to what most people would think, the car is in full control of the charging process.  The car requests initiation of charge, requests current and voltage levels and later requests termination of charge.  The car requests gradual increases and decreases in current at the start and end of the charge cycle.  The charger is supposed to follow these commands.

EVTV testing has shown a variety of behaviours from different manufacturers.  I wish that the CHAdeMO standards body would enforce all aspects of the spec.  At this relatively initial point in the rollout of CHAdeMO around the world, now is the time to get all devices in full compliance.  What we need is a Networld/Interop of chargers and cars.  Idaho National Labs has apparently hosted something like this and reported that everything is just fine, but we know that's not true.  From this paper from a couple of months ago it appears they only tested J1772 devices, not CHAdeMO.

Here is the list of Certified CHAdeMO chargers.  Note Blink is not on the list.

Session: Recording Battery Voltages into Excel using Voice Recognition - Al Gadja

Every Windows PC has speech recognition built in.  Control Panel -> Sound -> Recording -> Configure.  You can train the computer to better understand your voice.

He uses a $15-$20 headset with a microphone boom.  Speak naturally and let the computer lag a bit behind.

As he goes down the battery pack, he speaks the voltages followed by the word "newline".
Eg. 3.125 newline 3.129 newline 3.1209 newline.

Al has an Excel spreadsheet template that applies colors to different cell voltages and graphs charged, discharged and difference values for each cell in the pack.  This allows you to easily visualize the state of health of each battery, with the outliers clearly indicated in the graphs.

Session: Ladder Logic and Vehicle PLC Controllers - Al Gadja

PLCs are Programmable Logic Controllers, long used in industry to control any electrical or mechanical device.  Ladder Logic is a visual representation of the flow of control of the program.  You read the logic left to right.  You can place different device types in the ladder, set preferences and then draw lines.  When complete, you can run it in Simulation mode to see how the logic will work when installed into a PLC and run in the target device.

Everything in his Dodge Brothers truck is controlled through the PLC - nothing is directly wired.  It's from the Crouzet company and cost about $575 for the PLC, relay board and power supply.  It has 26 digital input ports and 26 replay output ports rated at 8A and 250V.

Session: Azure Dynamics eTransit Connect/heaters/AC/CAN - Byron Izbenhaard


Byron bought this van, has done two road trips and has put 2,000 miles on it.  He bought it for $6,500 from a Ford dealer who had no idea how to fix it, and had a lot of wrong ideas.  It turns out both battery pack interlocks were pulled out, and the Pre-Charge was not finishing.  Once he fixed that, the vehicle was running again.  One remaining issue was the heating unit was bad.  The coolant channels were full of goo and the electronics board was corroded.

He has changed to Evans Waterless coolant and a new heating unit from Eberspächer, taken from a Chevy Volt, about 1/3 the size of the original and about the same power level of 6.6 KW.  He made up a mounting bracket and attached it to the original heater location.  He made up a new hose set with transitions to the van's larger piping.

He then did a characterization of a new thermistor using an oven and determined the difference between the original one and the new one.  The solution was to add an 820 ohm resistor in series with the thermistor to get very close to the original profile.

The next challenge is to get an EVTV CANDue 2.0 board and software working to correctly drive the unit's heating capabilities.  After some trial and tribulation, the heater worked on the test bench.   Luckily the van already has 4 heater level CANbus messages in the diagnostic software, so he sniffed the bus with SavvyCAN to find the messages and used those to flash new firmware and drive the unit.  Byron mounted it in the van and it's working quite well.  The heating is controlled with the original dashboard controls, keeping the stock look and feel and avoiding the out-of-place looking switches that we sometimes find in EV conversions.

Session:  CANdo Battery Temperature Sensor - Nabil Henke and Ray Schaffler

There is a growing need for CANbus-based single-function devices.  After a problem with a thermal switch, Nabil and Ray have come up with a system that reads temperature and broadcasts the values across the CANbus.

It consists of a 2" x 2" x 1/2" white plastic module and up to 7 temperature sensor inputs.  It can also directly control Elcon / Chennic chargers.  Using a Bluetooth serial port configuration, you can install multiple modules in a car.  If any of the temperatures are too cold, it will inhibit the charger from starting.  Hooking up to a serial terminal port, you must set your charger target voltage and current in 1/10th of a volt, i.e. 124.5V = 1245.  It is fixed at 250kbs and Extended Addressing to match the Elcon charger but they're open to a firmware update to allow for baud rate changing.  They are available for $120 including 4 temperature sensors, and additional sensors cost $10 each.  Jack will have them in the evtv.me store when they can give him sufficient quantity.

Session:  Building The Little Lightn!ng Bike - Nabil Henke and Ray Schaffler

Last year they brought a 3 wheel bike called Banshee.  The students they mentor decided to do two 2-wheel bikes called Grease and Lightn!ng and things went downhill from there.  It's primary motor is an automotive alternator and uses a 48V / 10AH battery pack, built by spot-welding 18650 cells.  The cheap Kelly controller they used needs 3 Hall Effect sensors which were a pain to get working.  They used the 12-pole magnet ring from a CD-ROM drive.

Nabil and Ray are members of the Area 515 Maker Space in Des Moines, Iowa.

BBQ At Jack's House

We all headed down to Jack's house, overlooking the Mississippi river, for the first no-rain BBQ in EVCCON history.

EVCCON 2015 - Day 2

Session: John Hardy - Battery Testing

Day 2 kicked off, surprisingly on time, with John Hardy from the UK.  John returns again as our overseas battery testing expert.   He reviewed his earlier battery testing methodology and cell types.

The Headway 38120S cell had no detectable voltage drift but the first cell failed after 600 discharge / charge cycles.

He tested a shunt balancing product which simply destroyed the pack in under 100 cycles.  He is a fan of bottom-balancing your pack before assembly.

His CALB CA40fi cells lived beyond 2000 charging cycles and each of the 8 cells showed nearly identical voltage profile on the 2000th cycle, which is exactly what we want in our batteries.

John's full testing history shows that Lithium Ion batteries have no discernable drift and an extremely long charging cycle life.

John then moved to his current (no pun intended) testing of the Tesla-style 18650 LiFePO4 cells.  He has developed a new charging algorithm so has asked us to not talk about his ideas until they're protected.  I will say it's very sophisticated and looks very good!  Hoping to hear good things in the future.

Session: Collin Kidder – CAN Bus Hacking Hardware And Software
Collin's work writing software to collect and analyze CANbus traffic of existing OEM automotive components has formed the cornerstone of the reverse-engineering innovation of the world-wide EVTV team.  Due to his efforts we now can control the charger and DC-DC converters from Chevy Volts, the motor and controller for UQM/Coda vehicles, the motor and controller from Siemens/Azure Dynamics DMOC and the motor and controller from the Tesla Model S.

Collin recommends the EVTV CANDue 2.0 board as it has two complete isolated 2-wire and 1-wire CANbus connections, a temperature sensor, a MicroSD memory card slot for massive data logging and a 256kb EEPROM for persistent data storage.  It is a standard Arduino shield, meant to be stacked on top of a standard Arduino Due processor board.

Another option is the  EVTV Due board, which combines the features of an Arduino Due and a CANDue 2.0, but does not have a 1-wire CANbus port.  It has a much stronger USB port and screw terminals for power and CANbus wiring.

Jack has developed a plug-and-play device in a box to plug directly into a Tesla Model S diagnostic port which is native CANbus and Tesla cannot disable it.

GVRET is Collin's CANbus sniffing tool, driving the hardware to capture all CANbus traffic.  It is Arduino firmware and is flashed into one of the above boards.

SavvyCAN is a QT5-based app which is used to analyze the CANbus data captured by the hardware and GVRET.  QT5 supports Windows, Linux and MacOS.  It has sophisticated tools to visualize and filter messages and can also play back messages onto a live CANbus.  This is critical to fast development of an independent controller for an OEM CANbus device with no manufacturer documentation.

DBC files are used to define signals that flow on a CANbus.  As you reverse-engineer a device, DBC files save the knowledge gained and help SavvyCAN interpret the format of specific messages.

The reverse-engineering process is as follows:
- Find a convenient place to plug into the CANbus.
- Capture some bus traffic to see if it's working
- Go for a drive and capture real bus traffic
- Perform small discrete functions and save the traffic into separate small files, such as open the door lock, close the door lock, shift into neutral, press the brake pedal, etc.
- Launch SavvyCAN and isolate the meaningful messages
- Define newly discovered messages in a DBC file
- Play captured or synthesized messages back on the bus and see what happens
- Write software in a controller to perform that specific function.

Note that this is *not* easy and you will get better at message analysis as you see more devices and more ways of representing data.

Collin gave us a guided tour of SavvyCAN.  There are many, many ways to visualize the data to help you find patterns and values leading to your solution.

We have to break for lunch, Collin will continue again later this afternoon.

Session: Craig Smith - Car Hacker's Handbook 2014. – Politics and Legal Environment of Automotive Security

Next up is Craig Smith, a new EVTV speaker.  He's an expert in vehicle computer systems.  Cars are basically rolling computer networks.  He started out by talking about the current legality of vehicle hacking.  He says to always talk about "hardware".  We all know software is running inside all of these computers, but in the eyes of the law, it's all hardware.  We are already protected in law to reverse engineer components to add 3rd party devices, so the line is blurry.

Who Owns Your Car?  GM, John Deere and the Auto Alliance.  GM claims they retain copyright on the software inside and we are not allowed to look at it.  The basis of their opinion is the DMCA - Digital Millennium Copyright Act - which was originally intended for movie and music piracy.  People have proposed new Class 21 and 22 exemptions to DMCA about reverse engineering for security research and the right to understand and update firmware.  The Copyright Office has not decided on these two exemption requests yet. We are a small voice against the large corporations and their lobbyists.  No one has been sued yet though, and the industry is worried about losing the suit so the only tool they have is threatening people with potential litigation.

What can we do to help?  Share information.  Share stories.  Share data.  Collaborate.  Check out the Open Garages group and the I Am The Cavalry group.

Craig talked about other CAN sniffing hardware, from $60 open source to $5000 proprietary Kvaser and software such as SocketCAN and the Linux Can-utils package that you match up with them.  The LAWICEL protocol is a network protocol under Arduino that handles CANbus traffic like any other network device.  There are 3 CAN interfaces: Can0, SIcan0 and Vcan0.

Craig showed a demo that he created.  It uses a Playstation controller to drive a virtual car with speedometer, left and right turn signals and door locks via CAN traffic.

There are additional software layers available that run on top of CAN such as UDS that provides higher-level functions such as ECU reset, diagnostic codes, VIN number and data upload and download.  

There is an important packed called TesterPresent.  It is issued every 2 or 3 seconds and tells the car a diagnostic tool is connected.  Some functions may require this.

SecurityAccess tokens are required to update firmware.  It's a multi-step handshaking protocol to prevent easy hacking.  

Craig showed up pictures of his test bench with a junkyard dashboard and ECU and pots for changing simulated data values such as fuel level and RPM.  

We had a good Q&A session to wrap up before Craig had to leave for the airport.

Jack gave Craig an EVTV Due board to see if he can use it in his research.  Big thanks to Craig!

More Cars!

Session: Jack Rickard - Tesla Drivetrain Demonstration

We moved into the workshop area where Jack's Tesla drivetrain test bench is located.  He showed us the control panel which operates contactors and simulated the brake pedal.  He showed us the Arduino code that drives commands to the motor controller, and then he engaged drive and spun the unit up.  He demonstrated forward, reverse and neutral and creep mode.

Here is a short video from his demonstration.

For longer video and a far more detailed description of the reverse engineering of the Tesla drivetrain, please see the relevant EVTV videos here.

Now we're packing up to go to the BBQ at Jack's house.  It looks like this will be the first year we don't get rained out.

EVCCON 2015 - Day 1

Session: Introduction - Jack Rickard

This smaller event is being held at the EVTV workshop, as was originally envisioned five years ago.  We have about 45 in attendance people this morning.  Even before the cancellation, registrations were only about half of EVCCON 2014.

There are big changes happening in the world of home electric conversions and the world of EVTV, Jack's trying to listen to the signals.  Cheap Nissan Leafs, the non-2016 Chevy Volt, staff turnover at EVTV, home conversion component suppliers going out of business, and many other factors, so he's moving away from specialty suppliers towards OEM components to use in your electric conversions.
If you use a Chevy Volt charger in your car, if it fails you just order another one from GM, it will be available for years and years.  We just need to know how to hook them up and control them.  We are still in the Innovation phase in the Standard Adoption Curve so things are chaotic.  The Early Adopter phase normally starts when the technology is at 2.5% penetration, we are still at only 0.7% electric vehicle penetration vs. Internal Combustion vehicles.



The auto industry seems to have settled on the use of CANbus for communication between electronic devices around the car and that standardization helps us.  The component suppliers don't generally publish the command structures for these devices so we have to reverse engineer them.

Jack thinks there is a lot of innovation left to be discovered, like urban transportation solutions.  You'll understand if you've ever tried to park in Boston.  Storm Sondors set up a kickstarter project for an electric bicycle for $500 and 55,000 people signed up.  Shipping was slightly delayed but the bikes are getting on the road.  Sondors set up another kickstarter with a $75,000 goal and now has over $1M in subscriptions.

We also have to teach the market about the benefits of electric transportation.

Tesla is a bit of an outlier as they have proven to be very innovative, beyond what most people could imagine and making it a reality.

Session: New Zealand Fast Charge Network - Steve West and Nick Smith

Steve launched Charge.net.nz to promote electric vehicle uptake in New Zealand.  Previously, he developed the DJ software called Serato.  After becoming fabulously wealthy, he now has a stable of a Nissan Leaf, a Tesla Roadster and two Tesla Model S.  Nick is a Mechanical Engineer and is in the final stages of a Mazda Miata conversion and has joined Steve in the Charge.net effort.

Steve and another Model S owner Carl decided to do a road trip from the far north to the far south of New Zealand and they quickly realized there is a big problem with the lack of EV charging in the spread-out nature of the country, which is hindering the uptake of EVs.  Steve came up with the idea of rolling out his own DC fast charging network of about 75 stations using Tritium chargers from Australia.  The goal is to have the chargers spaced about 80 km apart.

New Zealand is well-placed for EVs as the grid is about 80% renewable energy with a massive slice of hydro power, followed by geothermal and wind.  Solar is not strong there due to a lack of government incentives and low wholesale energy prices.  Many people have an easy location to park and charge their cars and the daily average distance driven is 20 miles.  This is good for a Nissan Leaf-like car, but bad for longer trips.  Hence the need for a strong fast-charge network.

The electricity market in New Zealand is broken into 4 parts: the generation companies, the grid transmission and distribution companies and the retailers.  In order to place a charger, Steve has to locate a willing partner with a strategic location and ample electric supply such as city councils, retailers, and even gas stations, come to an agreement with 4 companies to get an electricity contract, install the hardware and publicize the new station.

Every location in the country has access to 3-phase power and power is delivered at 230V at 10 amps so high-power charging is viable both at home and at charging stations.

Currently there are only 350 EVs in the country and not all of them have a DC charging port, so the business case for deploying charging stations is very poor.  It takes someone with long-term vision to make the decision to move forward with a plan, in anticipation of a strong growth curve of EVs.

Steve's pricing model is 25 cents/kwh and 25 cents/minute.  The electricity cost is about the same as a car owner would pay at home and the time charge encourages people to charge and leave quickly, making the charger available to more customers.

The Tritium Veefil charger runs at 50 KW with CHAdeMO and CCS Type 1 plugs.  It will charge a car to 80% by default and shut off or the user can ask to push to 95% full.

Customers register on the charge.net.nz web site with a credit card and can request an RFID tag.  Users plug into the charging port then log in by swiping the RFID tag, using the PlugShare mobile app or coming soon sending an SMS.

Steve has developed the backend software in an open and collaborative way so there is interoperability between other charging networks.

Session: An Introduction to CAN networks - Jack Rickard

Jack's order of 6 Brammo electric motorcycle motors arrived during lunch and one can be yours for the low, low price of $2000.  They're 40 kw peak and 25 kw continuous power, permanent magnet, water cooled and weigh 13 kg.  Sevcon offers a compatible controller that you'll have to chase down on your own.

Vector is the primary company in the world of CANbus and it is extremely expensive.  Jack's Arduino-based boards and Collin Kidder's software have nearly replicated the functionality of Vector's product.

Craig Smith did a session at DEFCON where he showed how to "hack" the CANbus in automobiles.

Bosch invented CAN in the 1980s as the solution to reduce the weight of the proliferation of wiring up many computerized devices in cars.

Jack then described the nature of the two-wire CANbus wiring, termination, device attachment and differential signaling.  He showed the standardized layout of a data packet and its sub-components.

CANbus can run at several speeds, most devices we've seen are 250 kbps or 500 kbps.  A lot of protocol overhead is handled in hardware for you by the transceiver, you as a programmer will only care about the message id and data payload.

Masks and filters are part of the protocol and are normally handled in hardware, allowing the programmer to only be notified about interesting message ids, which significantly reduces load on the software processor.  Two devices can start transmitting at the same time and the one with the lower message id wins and is allowed to control the bus.

It was mentioned that some car devices are using Ethernet for increased bandwidth needs but this is unlikely to completely replace CAN any time soon, due to the increases in wiring requirements back to a hub or router.

Session: Arduino Programming - Jack Rickard

Jack showed us the CANbus 8-button, LED-lit device that Collin found.  Each LED ring or backlight is individually controllable over CANbus.

He then discussed the customized Arduino-based controllers that Paulo and Jack have developed.  Jack decided on using the Arduino controller universe due to the open nature, the hundreds of plug-on shields and the programming tools and libraries available.  EVTV developed the "EVTV Due" board, adding isolation and protection on all input and output pins, CAN transceiver chips, an EEPROM for persistent storage and screw terminals for power and CANbus cables.

Jack then showed the Arduino programming tool, displaying a sketch program and described the various aspects of the source code.

Last, Jack showed the Arduino-compatible shield "CanDue 2.0", codenamed "Teodora" for Paulo's mother.  It contains CANBus transceivers for two CANbus buses, Single Wire CAN and has a MicroSD card for logging data.  This is useful if you already have an Arduino board in your design and want to add CANbus handling.  This is useful for capturing data from Tesla cars.

Session: Bearing Protection - Tom Brunka / Helwig Carbon

Tom is a speaker again this year, not for his company's DC motor brushes, but for a special brush that prevents corrosion of the bearings in a motor, called a shaft-grounding brush.

Any motor driven by high-frequency Pulse-Width-Modulation is susceptible.  Motors get current and voltage induced into the rotor.  This energy tries to go somewhere and it normally finds a path from the rotor, through the bearing and into the metal shell of the motor which is usually bolted to a grounded part of the vehicle.

This added brush acts as the least-resistant path to ground, sacrificing itself to save the bearings.  Testing has shown very little wear on this brush, about 1/1000" loss during 6 weeks of continuous running.  The brush on one motor in use for 10 years wore only about 1/2".  The brush material is 91% silver, so they are quite expensive.  Tom wouldn't commit to a price.

There is no need to "seat" the brush for full effectiveness.  The brushes can be mounted so they contact the shaft or the face of the rotor, depending on available space.  The "other" bearing will have very small residual current and voltage which can be completely removed by adding a brush on the other bearing also but this may be cost-prohibitive.

Tonight is hang-around-the-shop and dinner on our own.