Flag: Tornado! Hurricane!

 Forums >>  Job Openings  >>  Contract: Hawkins GM Electric Truck BPCM Reversing

Topic created on: January 4, 2010 15:54 CST by pedram .

General Motors 1998 S-10 Electric Truck BPCM Reverse Engineering Project

Contact
If you are interested in this project please contact Steve Hawkins: steveh [at] mountainhaus [dot] com
http://www.hawkins.info/1998_s10e_ev95installation.html

Background
We need to reprogram a 1998 GM S10E electric truck’s BPCM (Battery Pack Control Module) through reverse engineering of the c++ control program.  This vehicle is the sister car to the GM EV1 (the electric car fleet that was crushed by GM back in 2003).  About 60 of these vehicles survive in private hands.  The vehicle has two c++ software programs which GM defines as "calibrations" that control the vehicle's operations.  The first is the BPCM (Battery Pack Control Module) which operates on calibration #12225679, and the second is the PIM (Power Inverter Module) which operates on calibration #09393169.  We are focused on the first, the BPCM software for this project.  Mr. Jon Bereisa, x-Chief Engineer for the EV1 program, told us that the source code and documentation for these software calibrations were not maintained by GM and are no longer available.

Operations
These calibrations can be uninstalled and reinstalled into the vehicle via the GM TIS/SPS (Service Programming System) using the OBDII (On Board Diagnostic) connections.  These calibrations are embedded software that control the module functions.  I have acquired the GM installation programs (TIS/SPS) and tools (Tech 2) to uninstall and reinstall these calibrations; however, GM did not provide the ability to change the internal programming of the calibrations with these systems, hence the need for reverse engineering.

History
It is worth noting that there were three (3) separate versions of BPCM calibrations for this vehicle through the years; one for Delco PbA Batteries, another for Panasonic PbA batteries, and a third for Ovonic NiMH batteries.  None of these battery types are available today.  I have installed a forth type, Panasonic EV-95 NiMH batteries, which are relatively different then any of the available calibrations, thus my need to modify the software.  Additionally, with the advent of newer LiON batteries, programming will need to be adjusted yet again in the coming years to keep these vehicles alive.

General
I suspect that the parameters we wish to change are minimal and are a set of "variables" that do not require the recoding of "algorithms".  By example, the current variables vs. the new (desired) variables would reflect the following, and  we believe that these parameters are defined in a general "table" format that the system reads back to:

Current (old) programming =                         New (desired) programming =
26 traction batteries                               26 traction batteries
5 cells each                                        10 cells each
14.7 max. voltage per battery                       15.0 max
11.2 min. voltage per battery                       8.0 min.
The current charge profile =                        The current charge profile =
    16.5amps,                                           17.2amps to 98% SOC
    drops to 12amps,                                    2.0amps to 100% SOC
    9amps,                                              no overcharge.
    6amps, and
    2amps,
    with an end cycle overcharge pattern

We will also correct the minimum traction pack voltage from +/-291.2 volts  to 208 volts, among other suggested modifications, once we are able to assess the available code analyse it.

No posts found under this topic.
Active in Last 5 Minutes
NirIzr
Invisible

There are 28,225 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit