sonstige(s) BOSCH Purion fixing+reverse engineering

[Maxis]

Hallo,

Es tut mir leid, dass ich kein Deutsch spreche. Ich benötige technische Unterstützung, um meine Purion-Reparaturen fortzusetzen.

I'm new to this forum and this is my very first post. I have a good experience in the EE/FW and I thought that fixing BOSCH would be relatively easy. No way....
Maybe someone can help here.

Symptoms:
The BOSCH e-bike (Purion+active line CX+PowerPack400) is 3.5 years old. We we got it from the shop, from time to time when I pressed the POWER button on Purion Board computer, the e-bike will not start. However, when using the power button on the battery pack it will always start (that was the case 3 years ago and we didn't bother). Then, the warranty expired and the situation got worse.
The e-bike will never start from Purion power button, but when you press on PowerPack400 the power button it will attempt to start and then will crash 3 times out of 4. If you press and keep pressed the power button for longer than 10 sec, it will restart the battery protection electronics and then - voila - the e-bike will work.
But now every time I have to restart the battery controller by pressing and holding the battery button for longer than 20sec. Otherwise - no start.

Result of the reverse engineering.
I had an assumption, that the problem was the 2x 2016 coin batteries-> wrong. Even after the replacement the symptoms are the same.
So, I've disassembled Purion, traced the PCB and connected the oscilloscope. The electronics works as follows:
1. The batteries are connected via 5.1K resistor to a bank of ceramic capacitors, which are charged to the same +6V voltage (provided by coin cells).
2. When ON button is pressed on Purion, the aforementioned capacitors charged to +6V are connected to the CAN bus transceiver via LORA (+3.3V linear regulator) and also the LM2903 comparator, which governs the PMV65XP P-MOSFET, enabling the STM32F105 uC. The microcontoller remains unpowered during the power on button press action. However, this action will send a single short pulse of 10ms duration to the CAN bus since the TJA1042 is briefly powered.
I have highlighted the traces and the components on the PCB photos (attached below)...

Why it doesn't work. IMHO, it seems that the problem isn't the Purion but the PowerPack 400. In the switched off state, PowerPack400 continuously sends the train on CAN+/- (constant pattern). If I remove the powerpack from the e-bike it will be continuously doing that on its own, even after connecting/disconnecting the charger.

If I press/hold power button on the power pack for longer than 20 sec, the activity on the CAN bus stops, but still the can bus is pulled up to 2.8V inside the powerpack.

Can you please tell me whether in the OFF state the powerpack400 keeps pulling the CAN+ and CAN- lines to 2.8V or they measure 0V? I assume, hence, that the wakeup from Purion doesn't work, since the CAN bus is already pulled to 2.8V. So, the short power on pulse from the CAN bus doesn't wake up the power pack (only its local button).

Why the Purion design is the amateur work: Purion startup function relies on the user dependent timing of the power key press (how often and how long). Even if the system operates normally, pressing quickly twice or three times in a row the power on button will only yield a single startup pulse on the first button press. Since the power is distributed by the tactile button it takes all the current from the aforementioned capacitors into the main power circuit. In other words, after a long usage period the button will not conduct the current properly.

Please, help,

Thank you and best greetings

 

[Maxis]

Update:
It's more likely that the problem is the PowerPack400. It seems that it doesn't switch off. I.e. after power off it keeps supplying the CAN+ and CAN- with 2.8V. And the bike can't be started with the power ON button on Purion.

However, there is a timer of some sort in PowerPack400. Maybe a watchdog. After approximately 12 hours, the battery trully goes off and CAN+ and CAN- are 0V. From this moment on, the e-bike can be started by pressing ON button on Purion.

 

[RadlerFranz]

I think the CAN lines should be at 0V in poweroff state.
But i'll measure it tomorrow, and also attach my scope to the Battery CAN.

 

[RadlerFranz]

Well, @Maxis, here are the detailled informations on the behaviour of the powerpacks CAN lines.
If your battery show behaviour as you mentioned, i assume a defect of the powerpack, for sure.

Behaviour of my powerpack (PP 500 frame, from 2020) :
When you detach the PP (powerpack) from the bike, there are NO voltages at all on any pin.

** A. **
(taken with Fluke 289) the voltages are
GND <=> CANx : < 10 mV
CAN+ <=> CAN- : 0,000 V
When pressing the PP button voltages appear for about 6 seconds as follows
GND <=> CANx : 3,03 V (but this is just an average, because its a CAN signal with variing pulse width, see scope below)
CAN+ <=> CAN- : 1,08 V

** B. **
Now let's take a scope:
After pressing the powerpack button, both CAN lines rise to 2,5 V against powerpack minus (GND) for 506 miliseconds.
Differential signal between CAN+ and CAN- is still zero! i think this is some kind of initialisation phase.
Afterwards CAN messages appear between CAN- and CAN+. These messages can be captured with any CAN analyzer, and are well known.
During this phase, the powerpack's PLUS output line is activated and presents the main voltage (~ 37 Volts).
This enables the BDU and the controller (Intuvia/(Kiox/Purion?...) to supply their circuits and
initialize the systemwide CAN communication.
After about 6 seconds (without response from any other controller), the system returns to powerdown mode, all voltages disappear.

** C. **
analyzing the lines with a dual channel scope in DC mode you get the results as attached.

and finally signal between CAN+ and CAN- lines:

 

[Maxis]

Dear RadlerFranz!

Thank you very much for your help. This is all super clear now!
So, in my case, as the PowerPack400 keeps powering CAN+ and CAN- lines even when the battery is on a table w/o charger plugged, it suggests that the battery electronics has a wrong behaviour (a HW or a FW fault)?

See, the powerpack switches off only after approx 12 hours. Then when I put it back on the bike, it works on the first power-up attempt.
But then when I press power off, the LED bar goes off on the battery and the controller goes off as well (there is no +36V from the battery), but the CAN bus remains active.

There are two failure modes:
- when CAN+/- is pulled to 2.8V but there is no activity (battery is OFF);
- when CAN+/- is pulled to 2.8V but there are telegrams sent by the battery (just one and the same repeating sequence)


I'll capture the traces and upload it here shortly.

Indeed, thank you, now it's 100% clear!

 

[Maxis]

@RadlerFranz

Update:

Here I've picked up two malfunction scenarios:

this is when the battery sends continuously the same pattern. +36V are absent. It will go like this for 12h-24h and then will switch off.
The packet contents doesn't change and it's different from yours. There is always the same pause between the packets -> 54us. The packet length is 95us.

If I press and hold the reset button for a long time, the battery will restart and the following pattery will be present:

The button and the charge indication on the pack works independently and doesn't not disturb the CAN train.

I'll start disassembling the powerpack now.

 

[Maxis]

@RadlerFranz

Update:

Here I've picked up two malfunction scenarios:
Anhang anzeigen 365507

this is when the battery sends continuously the same pattern. +36V are absent. It will go like this for 12h-24h and then will switch off.
The packet contents doesn't change and it's different from yours. There is always the same pause between the packets -> 54us. The packet length is 95us.

If I press and hold the reset button for a long time, the battery will restart and the following pattery will be present:

Anhang anzeigen 365513

The button and the charge indication on the pack works independently and doesn't not disturb the CAN train.

I'll start disassembling the powerpack now.

As you can also notice the CAN- driver isn't as good as CAN+ since the rise time is longer (o-scope probes are identical and compensated)....
On your o-scope capture, the signals have the identical rise/fall time, but here it's not the case...

 

[RadlerFranz]

Maxis, does your o-scope software support CAN frame decoding? It's just an idea, i'm not sure that your capture shows valid CAN frames or some other sort of signal. In case of a CAN frame it would be interesting to know the message ID.
I'm out of further ideas. It could be everything. Even a leakage current spoofing a wakeup request.
good luck!

 

[Maxis]

@RadlerFranz

No, apart from I2C/SPI/UART/ETHERNET there is no native CAN support. However, I can try doing it offline. I'll try storing the trace in CSV format and then do Python part offline.
I'll do it if I don't see anything obvious.

I also suspect some leakage which prevents communicating properly one uC to the other (pure speculation) inside the battery pack. No error codes are thrown..
First I'll dismantle and examine the power pack.
If I'll find nothing obvious, then I'll resort to the frame decoding.

12H reset likely comes from a watchdog of some sort. I'll try catching this up.

Thank you for your help again!

 

[Maxis]

Just another observation. The CAN traffic envelope seems to be intermodulated with another signal. The approx period is 100 us or 10 KHz.
Could it be the step down converter?
If the built in power converter doesn't provide a stable output this could lead to the error too.

From this forum I have understood, that VBAT+ 36V are converted to +5V by buck converter, whereas +5V to +3.3V is regulated by linear supply.

 

[paddy72]

You could measure the internal suppy voltages with a scope and look for oddities. Is it really a buck converter for 5V or just a linear voltage regulator? I guess the internal supply voltages dont have much load (in the range of a few mA), so a simple voltage regulator would do and be cheaper and easier.

Also if Can+ and Can- signals look different in rise time could mean there is no proper communication possible. But its funny that it works fine after the 24h reset. If you could trigger that reset by a switch or something this could be a workaround.

 

[Maxis]

PowerPack 400 buchering:

No clips broken, no traces left....

The rubber water gasket just disintegrated in a black goo....

IMHO, it's not designed and built to last

 

[Maxis]

Update:

The battery is OFF, but the ISL94212 is ON and the balance circuit is active! I.e. the system tries to balance the battery cells w/o a charger connected???

The resistors and cell balancing MOSFETs are HOT... 60 Degrees C.

Maybe something in the communications between the Freescale uC and the Intersil battery management IC.

+3.3V is ON and clean.

 

[Maxis]

Before I start butchering the electronics, the only last thing, IMHO, is try to balance the cells bank by bank.
I.e. the cells now measure from 3.6 to 3.9 volts and I have 4 bars out of five on the LED indicator. I'll try charging the banks separately one by one. Then hook up the electronics and see whether the system works better....

 

[paddy72]

Thats interesting that it seems to balance with no charger? It was always said that Bosch BMS only balances when charging to the top, so when the cells are near 4,2 V. I also heard there might be a fault condition where the BMS tries to discharge all cells to zero when it expects the cells to be dead/faulty. Not sure if this is true but this could be a safety measure when a battery is at its end. At least i found a lot of bike batteries with nearly all cells down to zero - so this could be true. With no discharging they would at least keep some voltage for years.

 

[Ewi2435]

I heard about that BMS try to discharge the batteries when one of the cell banks fail. After that the bms tries to discharge all the cells to make the battery safe. (No charging no potential risk).

Or there is a failure on the controller that manages the balancing.

Either way you need to check all the cell voltages. Should be the same. If one is way less, the cells are probably dying.

 

[paddy72]

The question is: what exactly are the conditions on which the BMS decides a cell bank has failed? There seems to be a disbalancethresholdvoltage from scanning the odx-files, so it might be that if this level of disbalance is reached the BMS conciders the cell bank faulty. I guess this thresholdvoltage is relatively low,
around 0,3V (not sure). So one could prevent the fault condition by manually balancing the cells before this level is reached. Of course if a cell pack is weak, it would get out of balance more often with each charge cycle - but you could prolongue the usage maybe for 1 or 2 years.

 

[Ewi2435]

As the bosch is balancing while charging everytime a difference of 0,3V can be seen as faulty battery that has reached its life expectancy.

Probably when the voltag gap ist too big or one of the cells has reache undervoltage too low which likely will not happen as the bms prevents it

 

[Maxis]

@Ewi2435
@paddy72

All the banks have different voltages from 3.6V to 3.88V. Currently I'm in a process of charging these banks manually one by one to 3.90V.

You have mentioned 0.3V difference. I wonder what seems "normal" balancing for BOSCH controller? What do you observe on a working battery?

PowerPack400 uses ISL9412 battery management controller.

And the application circuit on the page 79 of Intersil manual is quite similar to BOSCH.

 

[paddy72]

I am not sure about the 0,3V threshold level - i heard or read it somewhere, but it could be. A debalance of 0,3 V is already quite a lot for all equal cells but on the other hand could still be cured. Important is the reason for the debalancing: if there are faulty cells with high selfdischarge that would be a problem and potentially dangerous. If its more the disability of the BMS to balance correctly at higher charge values this would not be a problem so much. As from investigations in the Bosch BMS the balancing is only very subtle (in the range of a few mA) compared to charge currents of 2...6 A. It is also said that balancing only occurs near the top end of charge, so near 4,2V. You have to keep your charger going for 24 h at least to do just a little balancing. On the other hand it is not recommended to charge the cells all fully up to the end as this puts stress on the cells and decreases lifetime. But this is all not 100% proven reality - its more guessing or hear say concerning the BMS behavior. Sure is: there are missing any decent balancing resistors on the PCB.

@Ewi2435 : the balancing only happens at the end of the charge not during the whole charging period - it is said (not 100% sure here). And a balance current of a few mA against a few Amps charge current wouldn't help much, unless you balance for a few days...