Hacking an EV Battery From a £90,000 Car - DIY Vehicle to Grid 

Notice this video doesn’t have any sponsors? Yup… I didn’t wanna sell out to rubbish sponsors, and a lot of the big players don’t want to be associated with such a niche and potentially dangerous topic. If you wanna help fund these projects ( we’ve got loads in the pipeline! ), then feel free to drop a donation as a gift in comments, or become a channel member and get perks too! ❤

"Your comfort zone is a beautiful place, but nothings ever gonna grow there" would make a great t shirt

I am sure we can make it work Cory! Let's work on it a bit together!🙌

I love these quietly spoken electronics engineers, unassuming geniuses...

One word is not enough to describe your determination to solve this puzzle! Tenacious, persevering, determined, resolute, purposeful, dogged, single-minded, tireless, indefatigable, patient, unflagging, untiring, insistent, importunate, unrelenting describe you better! Well done for not giving up. Hope someone who knows the intricacies of the particular program developed for the Jaguar car battery can divulge what you need to know. Good luck!

It’s refreshing to see a spark taking an active interest in the deep dive side of things, but importantly staying humble about the fundamental differences between electrics and electronics without implying that it’s the same thing to those that don’t know any better - well done and best of luck getting this to work 👍

EU should legislate that all EV batteries be capable of reuse as a home battery with standard controllers, connectors, protocols etc.

The BMS ECU will go to sleep because it's not seeing activity on the CAN bus. You'll need to record a log from the iPace and play it back through SavvyCAN in a loop. Then turn off the IDs one by one until you find the network management frame it's looking for to keep it awake. I don't have any experience with the iPace CAN, but I've done extensive reverse-engineering on Teslas systems, and this is how they work.

You probably know more about the Ipace than the average Jaguar tech after this video... can't wait for Pt 2.

Best clip ever on this channel! Why? Because this is far beyond the usual small talk content and it shows what power we can unleash in so many ways. First a lot of brain power is needed, then lots of battery power and energy is unleashed and after all it's for the renewable power of the sun. Keep going! Cheers from a HV battery and solar system builder in Germany.

Cory..you're my kind of sparky. Love your approach to things, and the fact you're not afraid to experiment and learn new things. Top-man.

Have you thought about the interlock loop? (The 2 little pins on the big orange connector) These 2 little pins need to be shorted to make EV-systems or the battery work. Its a safety feature, if a module breaks or the car is in a crash then those 2 little pins wont be shorted and disables all the high-voltage systems! Including the big contactors inside the battery!

The spirit of Louis Rossman in action is a joy to behold, hack on! You crazy kids!

Are you certain you’re not plugged into the CAN’T port? 😂👊

For me it's your best video so far , awesome content mate.

Inspiring! The thousands of CAN messages are more than likely communication errors, caused by the HPCM trying to communicate with every other control unit that is missing on the car i.e ABS, BCM, and especially immobiliser.

Cory being a geek is cool as a 70 year old retired electrician/ maintenance engineer I have solved many problems thinking outside of the box . Good old RU-vidrs like you still inspired me in retirement .I have leant basic electronics and knew about needing a 60 ohm resistance on the can bus . Can't wait for the follow up video great project

WOW, what a vid, what a topic, what a fantastic idea. if ALL car manufacturers made a simple unit (or 3rd parties) to go from a old under performance battery, so it can be used like this with ANY inverter, what a way to recycle and reuse. I was hooked from the first few seconds till the end.... bring on part 2 asap.

Looks like good progress so far. One note on the relays when you open the doors, that's probably the pre-charge relay getting the vehicle HV system ready for key on by the time the driver is in the seat. The BMS will, most likely, enforce a maximum duty cycle on this relay so once you get it to close the BMS won't let you re-close it until the resistor or PTC element used for pre-charging has cooled off enough. If you're looking at CAN frames on the network to the battery you might want to take a particular interest in frames with the ID 0x10A, 0x10B and 0x10C.

On some cars, the battery does a handshake with another ECU in the car, which includes car-specific info like the VIN, so replaying the data from the car may not work on that battery.

Every HV plug will have a HV interlock that will need to be shorted ( it is a loop that connects all the plugs together. Also remember this is a car, when a car crashes and the airbags deploy the RCM module will send a CAN message to open contactors, additional to this legislation requires that there is a separate wire from the RCM that carries a square wave signal to give the all clear!

Someone pointed out the coolant loops and other connectors. See if that pile of bits has the connectors and if they have sense resistors in them, the battery ecu might be booting and checking presence of all its ports before it will take a ‘close contractors’ message. If it’s JLR they aren’t big on securing messages across components, so should take a raw message and just execute it.

Troubleshooting is so much fun. It’s like you hit a roadblock after a roadblock, frustration to no end and then, bam, it starts working and you end up with that happy face like when you guys managed to get the contactors to engage. It’s so satisfying.

I'm a Brit living in Romania, I came across an interesting company here repurposing used EV batteries. They make systems of all sizes, from small systems for off grid to large containerised systems for 3 phase commercial use.

Hi Cory, I am a high voltage technician with Audi. I would say that you are missing the control unit for the battery, on Audi its called J840. Battery management ECU, this communicates directly to the battery. Great video by the way mate.

Hands down the BEST video from your channel and about car battery reuse overall. I support Dala's EV repair long term on Patreon, but there was never such a great video as this one. Thanks for the work. You have the best hobby from my perspective!

People like you are leading the way to a perfect reuse of large battery packs. Plz push on and consider making kits at the end of your adventure for others to reuse large batterys as well.

Modern cars have a pyro fuse to prevent the car from turning over after a crash and the airbags going off. Maybe one of those fuses you pointed out need replacing? Love the concept Cory boy

I have fad Jaguar and Landrover cars for thirty years, and I had an Aquaintance that programmed the ECU's. The Eproms are separetley programmed by different people, and put together on the motherboard. The system has both a high speed and low speed Can Bus. When you open the car, the ecu starts to talk to the modules and pressing the start button sets another handshake in operation. The front left hand footwell fusebox is programmed to the dashboard. the front ecu is connected to the rear spare wheel fuseboc by fibre optics, Orange cable. Cambus are white cables. The system needs 13.2 volts to work properly, nine volts throughs a wobbly on start up. The rear seat footwell fuse boxes double up from the front fuse box. The Ecu's have Optical fuses on the inputs. One needs to follow the staring sequence to fault find the system.

This leaves me wondering if disassembling the main pack and repurposing the individual cells packs would be easier in the long run. You'd be able to optimise the packs final output stage voltages to requirements, simultaneously eliminating those three complex vehicle cam bus modifications in the process. It might also allow you to weed out any potentially deficient/defective cells in an otherwise reusable pack. When being used for lower charge/discharge applications like solar storage, there's little requirement for an integrated liquid cooling system. Thanks for sharing. 👍 This is my opinion, I could be wrong. 😉

An EV RU-vidr I watch has did this. He’s Glyn Hudson, he also added his own ASHP and converted his env200 to an EV camper. Knows about bms/cambus requirements etc. Think he used a Leaf battery for his home. He’s also a Fully Charged friend!

This is the best video for Cory so far, I just love this geeky stuff

this video is great !!! everyone wants to do this .... and why not, im still waiting for the ev charger that uses the car battery to run the house...

lol I was thinking "why are you even bothering with the CAN system, just hot wire it and let another system go the thing... 400V out: check temperature: nope cell voltage: nope Yeah no how about we don't write off the whole house :)

AMAZING...!!!!!!!!!!!!!EOL,s solder,error messages . Loved it all. I wonder if its reading that the battery is mounted vertically rather than horozontally that its reading an error?. Crack on Cory.

This should be the first option for any EV battery once the car has finished with it, alternatively, being used for grid balancing.

I can't really tell from the video if you did. But in all Power plug diodes there is a H VIL circuit. it runs around all 400V plugs and must be unbroken.

I have so many of your videos to catch up on. This was honestly so interesting, I hope that you can find the answers and get this working, awesome video Cory!

Been waiting for this one to drop, awesome thanks Cory… 😍❤️

This is a legendary endeavor and an amazing look into trying to tap into an electric vehicle Controller Area Network. Awesome video guys, really impressive.

Challenge No1. The Battery, its casing, and cooling are not designed to be used in a vertical orientation. But I am sure you got it covered.

Awesome content Cory. Raw, warts and all - soooo refreshing to see real world content. 🤓👍🏻

You will definitely need to plug in all the HVIL contacts of the battery. The big connectors at the top are more than likely to have those and the battery will definitely avoid electrocuting someone if it sees those connectors are unplugged.

I think it has been mentioned already, but that battery needs to think it is talking to the ECU/ BCM with a matching VIN. and that ecu / bcm might also need to have the "airbag / seatbelt charges blown" codes cleared so the battery thinks it is safe again.. along with a new high voltage pyro fuse. You might be better served seeing if you can get the battery to accept a charge first as that requires less things to be correct on the canbus. As you demonstrated in the working car, the contactors would not engage until all the doors were closed, your foot was on the brake, and you hit the start button - as well as the car sensing the key - none of which the battery on the wall will see. None of this is required for the battery to accept charge however. Getting the system to accept charge would eliminate some of the potential causes for it to not engage the contactors - giving you a smaller set of variables to work with.

Your comfort around 400vdc is rather worrying 😂 I would 100% use some opto isolators in line to those CAN interfaces. The last thing you want is any ground loops. In terms of the battery not responding it may be worth checking that a serial number for the main ECU is not expected by the BMS. That is just the kind of thing the manufacturers would do so you have to pay a dealer to change the battery. To help it would be a good idea to put the CAN messages on a Live / Google drive so we can see them. Some type of lockout or security code may be why the battery BMS is just going back to sleep.

Possibly a battery orientation interlock. The battery is vertical and could be a battery shut off for rollover events? Like a MEMS gyro?

Can't wait to see part two! I'm wanting to do the same, but with a Polestar battery and a FoxESS inverter. Keep up the good work

Absolutely awesome, I take my hat off to you guys. And to whoever your end client is, thanks to them for supporting the experiment - like you say, it's got to be the way forwards in terms of recycling and reuse. And as for the Tesla joke... 😂

This is an excellent video I can't wait for the next update. Hope once all this is figured out can share with the community how this was done. Excellent challenge to take up.

Looking forward to part 2 Cory. Great Video as always 👍

The big question here for me is: how in the world did you procure a 90kwh battery from a broken Jag?? Nice tinkering, love the process!

Ok Cory, this is truly fascinating & of real interest to me, so excellent work. I can't believe you commandeered a 'working vehicle' to debug all this, so cool, this is important research and discovery right here! 👍

not familiar with the jag battery, has i got a pyrofuse in the contactor bank? could be blown and bms not seeing a total battery voltage

This is brilliant, in Japan they have been doing this with prius batteries to power grocery stores. The market for this type of solution is in its infancy but will explode in time. Looking forward to the next video.

We all want to see you doing the 'can-can' dance in part 2.

Great video I look forward to seeing it working. I’m sure the problem will be something simple like a tilt switch 😂

I used to do this in testing chambers. We'd use the batteries for the thermal mass to test heat pump systems on while charging and discharging the battery in road load simulations. We used manufacturer provided DBC files that decoded the can bits and a logic controller that tricked it into thinking the car was there. All privided by the manufacturer

This is the future that everyone talks of, but it’s the first time I’ve seen it being attempted to be done. Good on ye fella.

Awesome video, very cool project. I understood most everything you guys said. Definitely want to use every lithium battery for as long as it holds a charge.

Good work, I was waiting for someone to realise the potential of the battery array from used EVs.

Another point Cory, after re-running the video, I saw your PSU is supplying 12 volts, although that’s nominal voltage it is too low. LVB batteries run at about 13.2 volts, Charging would be at about 14.5 volts. Also note there could be a tracking control unit that has its own battery.

An explosive diagram sounds like fun.

cool to see those in the industry looking towards these kind of upcycling projects. some of those all in one solutions are eye wartering expensive. have you had a look at those DIY LFP battery backup systems? like the Seplos Mason, seems like a good option for those that want a cost effective soltuion & the safety of LFP cells, also a lot less reverse engineering.

Great idea. ❤ I live in the desert of Baja Mexico totally off grid. I took the batteries out of 4 SMART cars. Each was 53V nominal. I connected them all in in parallel and hooked them to a 48V Schneider Inverter/charger. Been running 5 buildings and AC for 8 years. Have 28 solar panels. Since I went parallel I do not use BMS.

Great stuff Cory, and well done for not digging yourself into a hole with that working I-Pace, the opportunities for blow ups are high on this one. In the past ive always used OEM CAN interfaces but im going to get one of those £25.00 amazon ones and have a go with SavvyCAN that I did not know about. Re the wiring/connector a pair of green 10 way rising clamp headers plug/socket may work well for you rather than committing to hard wiring! Looking forward to part two.

This is a sick project! I hope more people try things like this

kudos man! this content is just amazing, can not wait for part 2!

Brilliant to watch Cory, I am sure you will get it going soon.

Great video. Look forward to part two and getting it working 🙂

Great work! I foolishly bought an IDbuzz thinking you could plug it in and use the vehicle battery to power my home. Turns out you can but nobody actually makes a charger that allows you to plug in and do this. One is in development but it’s going to have a chadamo plug on it which renders it useless for my application. Keep up the good work.

Some EVs have a pyro fuse inside the battery pack. You mentioned that the battery came from a crash damaged car, I wonder if the pyrotechnics fuse went off disabling the battery 🤷‍♂️

It's amazing just how complex car systems have become - and why even the main dealers cannot fix them if they go wrong :-(

its on the wall wrong position not level protected maybe

You are where the future is .... I can't wait until someone gives such projects the traction needed to make this a business. ( Octopus??) Octopus do support VTG but the cars and charges are very limited. Their tariff is called Power pack is currently compatible with: Nissan Leaf Nissan e-NV200 Mitsubishi Outlander PHEV. The chargers needed are Wallbox Quasar 1 (it's worth noting that the Wallbox Quasar 1 is no longer for sale in the UK, so you'd have to have it already installed). Octopus say they are working hard on more integrations! Total respect to you guys for doing this - lets hope someone gets in touch to give you what is needed

This is a great idea. If I knew that I could take a failed battery from my EV when I had to buy a new expensive one, I would have little hesitation to buy an EV. This should be a standard option you can buy for all EV batteries. Reuse is better than recycle.

I reckon you'd need the specific signal, from the scrapped iPace. When Nissan Leaf batteries are swapped, I believe they have to go through a matching process, to be recognised and usable.

The one major problem with the idea of using old lithium batteries is that once a battery drops below 80% of it's original capacity; they start to lose capacity much more rapidly and below 70% they are generally falling off the capacity cliff and the risk of having a shorted or failed cell increases exponentially. You might be able to eek a few hundred more charge cycles out of some batteries and chemistries but once they are at or below 70% of the original capacity, they are basically junk and one should be looking at replacement even in an offgrid/solar storage application.

Can't get enough of this kind of thing Cory. Keep it coming!!!

First video I have watched on the channel and loved it. When transmitting the CAN signal to close the contactors have you considered the sequence in which they close. You want to ensure the pre-charge contactor is first closed to prevent arcing and premature failure of the contactor. Would it be easier to use the BMS purely for voltage and temperature sampling while hardwiring connections on to the 400V poles straight into an inverter? This way, you can have control on the 230V AC side instead. The terminating resistors you are measuring are actually two 120ohm resistors wired in parallel to give you your 60 ohms. You may want to ensure these are present on the network you are using or you will have to adapt the bus.

There should be an interlock connection on all of the battery connections for motor and charge port etc I would assume these would all need to be shorted out. The interlock shuts down the battery if and cable is broken discounted for safety

I'm not related to JRL but, I used to work for a company that was using the modules out of this car. Each module 3S4P Lithium Polymer module does not have its own BMS. The important pin connections if you need to reconfigure the pack or add you own BMS? Each module has a 0V, 3.7V, 7.4V, 11.1V and two pairs going to 10K Thermistors for reading batter temperature. The bus bars are connected to each module with M6 bolts, ofcourse you already have all the bolts and connectors inside the pack. A WORD OF WARNING if you want to read the cell voltages using the connector, each tap is connected to the cells by a really thin flexible PCB if you short across a cell that will burn the trace, its not fun cutting open a module to repair!

this video was awesome cant wait to see part two

Glad to see how you're trying ro tackle this but dont envy you from what I've seen it can burn alot of hours reverse enginnering this stuff. Think it will become easier in future when more cars have vehicle to load or grid which should be able to talk to inverters natively. Also see a second life for scrapped EVs being used as battery storage in farms as they probably have the land and space to park up old EVs and with enough distance to accomodate any fires from this sort of tinkering. Good luck.

Have you check the other connectors on the top? There is also the interlock loop inside. There must be a reason, the battery shut down after 5 sesonds. Something is failed to check while bootup. It could be the battery expected a massage from other ecu's in a time window (maybe every 5 sec )?

Cory, the I-pace is particularly sensitive to the 12v battery being in good health. I know I have one! It might be worth upping the 12v to 13v to be sure. I had mine just refuse to start, i.e. the main contacter wouldn't activate. After half an hour the 12v battery had recovered to over 12.5v and suddenly the contactor went clunk! Everything was OK after that. They are very sensitive to poor 12v battery condition! You will have to write out the heatingcooling circuitry on the CANBus of course. The LG and JLR engineers have written code to protect the battery at all costs! I believe that Tesla are already using old/substandard EV cells in their Powerwalls. The cells inside the I-Pace are LG Cem cells and are used in quite a few home batteries, so when you get past the CANbus problems the rest should be plain sailing!!!

Could the battery have a level sensor as a safety mechanism? I’m not in any way an electrical specialist but I was a paramedic. The cars that would roll over in an RTC would have a special mechanism to make them safe. If this battery is not horizontal then could it be thinking it’s rolled over?

Cory: If you fancy a comparatively straightforward project once you've solved this, we've got a 2016 Leaf which is worth less as a car than its components. We'd love to turn it into a home battery but as a DIYer 400V DC is a bit outside my comfort zone! If you're interested let me know. PS: my wife bakes amazing chocolate muffins and I used to be a barista at a well known coffee chain (no, not that one) if that in any way swings it 😋

So you've got the following from CAN: Door closed, foot on brake, Start/Stop button pressed. Maybe you need information form the driver seat sensor too? (e.g. In a Volvo C40 Recharge, if you lift your butt off the drivers seat, the car doesn't like it) What about charging the battery? Would you need to record a different sequence from CAN? 'Car in Park, Handbrake on' is about the only thing I can think of. This is a fascinating project!

Part 2 is going to be epic

I love this kinda projects! But sometimes i also wish i had normal interests.. 😂

Saw a U.S. based RU-vidr who repurposed a BMW battery - but he tore it down to the cell level and added a new BMS rather than try to hack the built-in BMS. He did succeed but this is cooler!

Just a query, so when u put it on the wall will this effect the loop for the water as its use to being flat and would be putting adverse pressure on the pump?

Interesting project, I like it! The BMS communication problem is always there. My idea would be to use a deye high voltage inverter, there you can defin a battery only by voltage levels. Not perfect, but works and is easy.

Love this, waiting for pt2!!!

Love to see you solving difficult problems. Don't normally make donations but this was so good. Putting a battery like this into a boat, such as a cannal boat or something sexier would be cool project I'm incapable of but would love to see.

Hi dudes, brill video. I was thinking about this old EV car battery thing about 2 years ago. I am surprised it got so complex with the can bus! Keep it up and I am sure you will both crack it, mind your fingers on that 400 volts DC @ mega Amps and don't knack the other car 💥💥💥

scrolled through youtube, seeing this, immediatly knows, only with super power of dalathegreat!

You don't have sponsorship but every second video is an advert

You can cut the CAN wires and make a transparent gateway. This way you can deduce where the signals are going from/to. I worked for a company that hacked cars for handicapped people. Our device was injecting messages like the car horn, indicator lights and other secondary controls while actively filtering the original messages. CAN messages often have one or multiple counters, each frame increments this count up and often the last count is skipped. 0xC, 0xE, 0x0, 0x1 etc. CAN messages also use CRC as a checksum on each message. You can use CRC RevEng to reverse engineer these crc, sometimes this is impossible and you just need to hardcode a LookUpTable. Hopefully you don't need to got his deep into CAN, and just replaying the messages will be sufficient.

Another good one Cory! Keep on keeping on brother!! 😎