Flag: Tornado! Hurricane!

 Forums >>  Job Openings  >>  Contract: Hawkins GM Electric Truck BPCM Reversing

Topic created on: January 4, 2010 15:54 CST by pedram .

General Motors 1998 S-10 Electric Truck BPCM Reverse Engineering Project

Contact
If you are interested in this project please contact Steve Hawkins: steveh [at] mountainhaus [dot] com
http://www.hawkins.info/1998_s10e_ev95installation.html

Background
We need to reprogram a 1998 GM S10E electric truck’s BPCM (Battery Pack Control Module) through reverse engineering of the c++ control program.  This vehicle is the sister car to the GM EV1 (the electric car fleet that was crushed by GM back in 2003).  About 60 of these vehicles survive in private hands.  The vehicle has two c++ software programs which GM defines as "calibrations" that control the vehicle's operations.  The first is the BPCM (Battery Pack Control Module) which operates on calibration #12225679, and the second is the PIM (Power Inverter Module) which operates on calibration #09393169.  We are focused on the first, the BPCM software for this project.  Mr. Jon Bereisa, x-Chief Engineer for the EV1 program, told us that the source code and documentation for these software calibrations were not maintained by GM and are no longer available.

Operations
These calibrations can be uninstalled and reinstalled into the vehicle via the GM TIS/SPS (Service Programming System) using the OBDII (On Board Diagnostic) connections.  These calibrations are embedded software that control the module functions.  I have acquired the GM installation programs (TIS/SPS) and tools (Tech 2) to uninstall and reinstall these calibrations; however, GM did not provide the ability to change the internal programming of the calibrations with these systems, hence the need for reverse engineering.

History
It is worth noting that there were three (3) separate versions of BPCM calibrations for this vehicle through the years; one for Delco PbA Batteries, another for Panasonic PbA batteries, and a third for Ovonic NiMH batteries.  None of these battery types are available today.  I have installed a forth type, Panasonic EV-95 NiMH batteries, which are relatively different then any of the available calibrations, thus my need to modify the software.  Additionally, with the advent of newer LiON batteries, programming will need to be adjusted yet again in the coming years to keep these vehicles alive.

General
I suspect that the parameters we wish to change are minimal and are a set of "variables" that do not require the recoding of "algorithms".  By example, the current variables vs. the new (desired) variables would reflect the following, and  we believe that these parameters are defined in a general "table" format that the system reads back to:

Current (old) programming =                         New (desired) programming =
26 traction batteries                               26 traction batteries
5 cells each                                        10 cells each
14.7 max. voltage per battery                       15.0 max
11.2 min. voltage per battery                       8.0 min.
The current charge profile =                        The current charge profile =
    16.5amps,                                           17.2amps to 98% SOC
    drops to 12amps,                                    2.0amps to 100% SOC
    9amps,                                              no overcharge.
    6amps, and
    2amps,
    with an end cycle overcharge pattern

We will also correct the minimum traction pack voltage from +/-291.2 volts  to 208 volts, among other suggested modifications, once we are able to assess the available code analyse it.

No posts found under this topic.

There are 31,042 total registered users.


Recently Created Topics
Ultimate Hacking Cha...
Jun/21
CreateMutex
May/31
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Immunity Debugger Re...
Aug/03


Recent Forum Posts
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack


Recent Blog Entries
crystalwade
Jul/20
test

nieo
Mar/22
Android Application Reversing

halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit