Interested in an unofficial Apple Watch app?

[Dee]

Also in addition to David's great shares here, forum members @rs38 and @Dee amongst others have deep knowledge on all things OBDII related

I'm just a user, like a hobbyist but rs38 has way more knowledge about this stuff than me.
But thx for the compliment. ?

Sponsored

 

[electricsidecar]

Command range is 0x221850...0x221870 for modules 1-33 inclusively.

Trying a few other exports of data, seeing some new patterns emerge. When I take an instant snapshot of every module I get the following nice grid:

module 1:  83  90 42 35  41 43 44  48  90 38 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 38 35  90 42 35  4c  90 1a 34  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 2:  21  90 2e 35  41 43 44  48  90 1a 34  90 56 35  4c  90 38 35  90 4c 35  42  90 42 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 3:  53  90 38 35  41 43 44  48  90 38 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 4:  43  90 2e 35  41 43 44  48  90 1a 34  90 56 35  4c  90 1a 34  90 4c 35  42  90 24 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 5:  31  90 38 35  41 43 44  48  90 38 35  90 56 35  4c  90 24 34  90 4c 35  42  90 10 34  90 42 35  4c  90 38 35  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 6:  73  90 2e 35  41 43 44  48  90 38 35  90 56 35  4c  90 38 35  90 4c 35  42  90 38 35  90 42 35  4c  90 4c 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 7:  63  90 38 35  41 43 44  48  90 2e 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 8:  33  90 2e 35  41 43 44  48  90 2e 35  90 56 35  4c  90 38 35  90 4c 35  42  90 38 35  90 42 35  4c  90 24 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 9:  11  90 38 35  41 43 44  48  90 2e 35  90 56 35  4c  90 38 35  90 4c 35  42  90 38 35  90 42 35  4c  90 42 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 10: 12  90 38 35  41 43 44  48  90 2e 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 24 35  90 42 35  4c  90 2e 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 11: 13  90 2e 35  41 43 44  48  90 2e 35  90 56 35  4c  90 38 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 2e 35  90 4c 35  2e  90 24 34  90 2e 35  4c
module 12: 23  90 2e 35  41 43 44  48  90 2e 35  90 56 35  4c  90 38 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 13: 14  90 42 35  41 43 44  48  90 4c 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 1a 34  90 42 35  4c  90 1a 34  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 14: 22  90 42 35  41 43 44  48  90 38 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 15: 82  90 2e 35  41 43 44  48  90 38 35  90 56 35  4c  90 38 35  90 4c 35  42  90 4c 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 42 35  90 2e 35  4c
module 16: 72  90 2e 35  41 43 44  48  90 42 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 17: 62  90 38 35  41 43 44  48  90 42 35  90 56 35  4c  90 24 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 2e 34  90 4c 35  2e  90 38 35  90 2e 35  4c
module 18: 84  90 38 35  41 43 44  48  90 38 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 38 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 19: 64  90 2e 35  41 43 44  48  90 24 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 38 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 20: 74  90 24 35  41 43 44  48  90 38 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 42 35  90 42 35  4c  90 24 35  90 4c 35  2e  90 24 35  90 2e 35  4c
module 21: 54  90 42 35  41 43 44  48  90 42 35  90 56 35  4c  90 38 35  90 4c 35  42  90 42 35  90 42 35  4c  90 24 35  90 4c 35  2e  90 42 35  90 2e 35  4c
module 22: 44  90 4c 35  41 43 44  48  90 24 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 42 35  90 42 35  4c  90 42 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 23: 34  90 24 35  41 43 44  48  90 2e 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 2e 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 24: 52  90 24 35  41 43 44  48  90 24 34  90 56 35  4c  90 2e 35  90 4c 35  42  90 24 35  90 42 35  4c  90 2e 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 25: 42  90 24 35  41 43 44  48  90 42 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 4c 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 26: 32  90 38 35  41 43 44  48  90 42 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 38 35  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 27: 24  90 2e 35  41 43 44  48  90 38 35  90 56 35  4c  90 1a 35  90 4c 35  42  90 24 35  90 42 35  4c  90 42 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 28: 91  90 38 35  41 43 44  48  90 2e 35  90 56 35  4c  90 2e 35  90 4c 35  42  90 24 35  90 42 35  4c  90 24 34  90 4c 35  2e  90 38 35  90 2e 35  4c
module 29: 81  90 38 35  41 43 44  48  90 24 34  90 56 35  4c  90 1a 34  90 4c 35  42  90 38 35  90 42 35  4c  90 1a 34  90 4c 35  2e  90 24 35  90 2e 35  4c
module 30: 71  90 2e 35  41 43 44  48  90 2e 35  90 56 35  4c  90 24 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 24 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 31: 61  90 38 35  41 43 44  48  90 38 35  90 56 35  4c  90 38 35  90 4c 35  42  90 2e 35  90 42 35  4c  90 24 35  90 4c 35  2e  90 2e 35  90 2e 35  4c
module 32: 41  90 42 35  41 43 44  48  90 38 35  90 56 35  4c  90 38 35  90 4c 35  42  90 38 35  90 42 35  4c  90 2e 35  90 4c 35  2e  90 38 35  90 2e 35  4c
module 33: 51  90 2e 35  41 43 44  48  90 38 35  90 56 35  4c  90 24 35  90 4c 35  42  90 24 35  90 42 35  4c  90 24 35  90 4c 35  2e  90 2e 35  90 2e 35  4c

So the first byte seems to almost certainly be a different data type from the other 6, which makes sense. That means the format is roughly:

Module {
  unknown: UInt8
  Cell {
    voltage: UInt16
    soc: UInt8
    unknown: UInt8
  }
  cells[6]: Cell
}

 

[electricsidecar]

Interestingly the `cell.unknown` parameters seem to be consistent across the entire battery pack in a given snapshot, but the values *do* change over time. Last night I was getting the following cell.unknown values:

4a, 6e, 78, 6e, 5a, 64

And today:

48, 4c, 42, 4c, 2e, 4c

So all of the values are lower, which seems to imply there's some correlation with the battery's charge.

 

[electricsidecar]

It looks like I'm forced to go take a road trip through the mountains now and monitor these cell.unknown values to see if/how they change over time ?

 

[romed]

seems this single cell informations arent stored in ODIS, have to sniff it on the car directly too.

Found this crazy guy. He connects battery pack using NXP transceiver to read out the cells
https://www.nxp.com/products/power-...-network-high-speed-transceiver:FRDM33664BEVB

 

[electricsidecar]

Got tons of data from the drive, now charging at an EA and got some frames from that as well. Should hopefully get to the bottom of these mystery numbers today

Btw I turned down the live notifications server because kubernetes was nothing but a headache. I’m going to spin up a simpler server at some point that just runs a basic barebones vm, but in the meantime live activities might not update anymore.

 

[romed]

try to read $227731 and $227732 - its the sum from all cells you ask in the range 18x0
additional as you mentioned soc.

seems porsche / vw will hide each single cell informations in order to make it easier for the mechanics or just to not give each separated to not see when one cell is damaged. but i think there must be then an DTC entry.

(located in ECU 8C)

 

[romed]

additional there are several formulars for Volts...

2 Bytes, 0.001x, Volt		OBD Unit and Scaling ID $0B
2 Bytes, 0.001x, Volt		Voltage
2 Bytes, 0.001x, Volt		0.001 V per bit unsigned

2 Bytes, (8/65535)x, Volt		(8/65535*internal) V
2 Bytes, (8/65535)x, Volt
2 Bytes, (8/65535)x, Volt
2 Bytes, (8/65535)x, Volt

1 Byte, 0.005x, Volt		Spannungswert im Interval [0 V; 1,275 V], Schrittweite 0,005 V
1 Byte, 0.005x, Volt
1 Byte, 0.005x, Volt
1 Byte, 0.005x, Volt

 

[ciaranob]

It looks like I'm forced to go take a road trip through the mountains now and monitor these cell.unknown values to see if/how they change over time ?

Not sure if you read my prior post but cell voltages vary directly with SoC - cell voltages range from lowest charge state at 3.2 to 4.2 at highest (as displayed on the cell voltage map - you can design any maps for any input on CarScanner so for example I also have a cell Soc map) - so yes they will vary (and as I mentioned even during 'live data' recording you'll see them vary under acceleration and use of regen etc. Apologies if I am misreading your post i.e. are you referencing something altogether different?

 

[electricsidecar]

Uploaded the raw trip data to a public Google Sheet here:

Looking at the data over time it seems like my original interpretation wasn't fully accurate. Playing with a few other interpretations but some of the voltages seem to represent a min/max value, though the voltages don't really make sense.

 

[electricsidecar]

Not sure if you read my prior post but cell voltages vary directly with SoC - cell voltages range from lowest charge state at 3.2 to 4.2 at highest (as displayed on the cell voltage map - you can design any maps for any input on CarScanner so for example I also have a cell Soc map) - so yes they will vary (and as I mentioned even during 'live data' recording you'll see them vary under acceleration and use of regen etc. Apologies if I am misreading your post i.e. are you referencing something altogether different?

The ranges are helpful! It does seem like each module only reports 6 cells instead of 12. Cell voltage + state of charge both seem correct in terms of interpretation, but still playing with interpretations of the remaining bytes in each cell block.

 

[electricsidecar]

Trip photo from today ?

 

[rs38]

nice progress in this thread!

// 7ED102E62187051916E
// 7ED21394145454A916E
// 7ED2239918C3982916E
// 7ED23399182398C916E
// 7ED2439916E398C916E
// 7ED253991823964916E
// 7ED263991643878AAAA

Which translates to the following data bytes:

62187051916e394145454a916e39918c3982916e399182398c916e39916e398c916e3991823964916e3991643878

62 18 70 appears to be the header; though I'm not sure what the 62 represents. Still working on decoding the remainder of the data.

62 is the positive response (+40hex) to the 22 of UDS readbyidentifier.
1870 is repeating the ID from the request. 2Ehex is the number of bytes sent via VAG TP2 multiple CAN frames.
This all is defined by ISO (despite TP2 afaik), all the rest is OEM specific, IDs, values, formulas, units. And the only way is to reverse-engineer it from ODIS, PIWIS, VCDS, Carscanner etc. or observations.
I spent endless hours with sniffing and interpreting PIWIS queries with a Y-cable.
The "official" SoH from PIWIS is retrieved from the BMS (8C), but the gateway surely has copies and more (lot's of consumption statistics etc.) but VCDS and PIWIS were very "shy" with retrieving relevant data from it. I think ODIS can be a very good approach as the Audi Etron GT is the same J1.

@featherless there are only 6 cell info per module as they are in 2p6s config (see also the huge Audi SSP J1)
@romed nice work with ODIS can you find the manufactor date of the Subsystem Heater2 in the thermal mgmt C5? PIWIS can, VCDS cannot, I did not find it.

I am ~98% happy with the data I can retrieve and log and process with Carscanner in the meantime. I am not sure, what I am missing. Of course the logging frequency drops quite a lot if you log too much, but that can't be improved with UDS and multiple ECUs.

My next guinea pig would be way more conveniently querying connect data from Porsche cloud services like ABRP it already does (via https://airtable.com/appnqv8fdlWYRB0D4/shrlG1kVjP03VatK9/tblCBBV23F1zBOnhI)

 

[rs38]

some pics from 2y ago, sniffing, fiddling, programming, testing dongles, emulating (ended up in the Taycanizer/TayCANlogger you will find in some old threads) and finally it was the most convenient way to provide the author of a mature mobile app - Carscanner - with the needed 0x22 IDs from Tayan.

 

[romed]

nice progress in this thread!



62 is the positive response (+40hex) to the 22 of UDS readbyidentifier.
1870 is repeating the ID from the request. 51 is the number of bytes sent via VAG TP2 multiple CAN frames.
This all is defined by ISO (despite TP2 afaik), all the rest is OEM specific, IDs, values, formulas, units. And the only way is to reverse-engineer it from ODIS, PIWIS, VCDS, Carscanner etc. or observations.
I spent endless hours with sniffing and interpreting PIWIS queries with a Y-cable.
The "official" SoH from PIWIS is retrieved from the BMS (8C), but the gateway surely has copies and more (lot's of consumption statistics etc.) but VCDS and PIWIS were very "shy" with retrieving relevant data from it. I think ODIS can be a very good approach as the Audi Etron GT is the same J1.

@featherless there are only 6 cell info per module as they are in 2p6s config (see also the huge Audi SSP J1)
@romed nice work with ODIS can you find the manufactor date of the Subsystem Heater2 in the thermal mgmt C5? PIWIS can, VCDS cannot, I did not find it.

I am ~98% happy with the data I can retrieve and log and process with Carscanner in the meantime. I am not sure, what I am missing. Of course the logging frequency drops quite a lot if you log too much, but that can't be improved with UDS and multiple ECUs.

My next guinea pig would be way more conveniently querying connect data from Porsche cloud services like ABRP it already does (via https://airtable.com/appnqv8fdlWYRB0D4/shrlG1kVjP03VatK9/tblCBBV23F1zBOnhI)

HV_HEIZER 9J1963507D you mean?

Sponsored