Soul Spy?

[goev]

I now got a fast CAN-reader, USBTin, with which I can log every message on the CAN-bus on the Soul. I've however had no luck in finding anything useful :-( It seems like most controls, lock/unlock, lights and stuff is not sent via this bus. The GDS shows it is possible to do these thing, but no messages are sent on the bus when I press any buttons. I guess we need more traces while the GDS is connected, so Alex, keep up the good work

I've been trying to locate the ambient temperature, and I think I have found it in 653 byte 5, where the temp in celsius seems to be the value/2-40.
In the spread sheet the values are 64...6D / 74 which according to my formula is 10...14 / 18 celsius. My own values where 0x63 yesterday with a temp of 9 degrees, and 0x5C today with a temp of 6.

Can anybody verify this?

Also I retried the 2F B0 x0 02-commands, but nothing happened :-(
Can anyone tell me what 10 03 mean? We also use 10 90, and what do that mean? Which sessions do we have?

 

[goev]

I'm pretty sure the ambient temperature is in byte 5 of can-id 653, and the temperature in celcius= (byte/2)-40.

 

[TyrelHaveman]

I'm pretty sure the ambient temperature is in byte 5 of can-id 653, and the temperature in celcius= (byte/2)-40.

Sweet! That makes sense for the one value I recorded when I first started looking at this (18 deg C). I'll check it again one of these days to see if it's still looking good for us.

 

[AlKl]

I now got a fast CAN-reader, USBTin, with which I can log every message on the CAN-bus on the Soul. I've however had no luck in finding anything useful :-( It seems like most controls, lock/unlock, lights and stuff is not sent via this bus.

Yes i think we already identified most of the useful values on the bus. The control stuff is not available in the default session because it would possible generate too much bus traffic...

I've been trying to locate the ambient temperature, and I think I have found it in 653 byte 5, where the temp in celsius seems to be the value/2-40.
In the spread sheet the values are 64...6D / 74 which according to my formula is 10...14 / 18 celsius. My own values where 0x63 yesterday with a temp of 9 degrees, and 0x5C today with a temp of 6.

Can anybody verify this?

Looks good in the old traces i made...

Also I retried the 2F B0 x0 02-commands, but nothing happened :-(

What response have you got? Again "7F 2F 22"? 22 means "conditionsNotCorrect". Normal condition should be: Car is in "P", Ignition on, Session changed. I can send you a description of the negative response codes if you want?

Can anyone tell me what 10 03 mean? We also use 10 90, and what do that mean? Which sessions do we have?

"10" is service "DiagnosticSessionControl"
the next byte is the sub function. Following sub functions are defined by ISO:
00 reserved
01 default session (=normal mode after powering on)
02 programming session (for flashing)
03 extended diagnostic session: This diagnosticSession can e.g. be used to enable all diagnostic services required to support the adjustment of functions such as “Idle Speed”, “CO Value”, etc. in the server's memory. It can also be used to enable diagnostic services, which are not specifically tied to the adjustment of functions.
04 safetySystemDiagnosticSession
05-3F ISOSAEReserved
40-5F vehicleManufacturerSpecific
60-7E systemSupplierSpecific
7F ISOSAEReserved

so 90 is not defined and shouldn't be used at all But not every manufacturer is sticking to the ISO...
I think we should "find" all required functions we need in the extended diagnostic session (03).

 

[TyrelHaveman]

I finally went on a trip with my wife in her Soul EV so I could record some data while quick charging and such.

In the process, I noticed that I do have a max cell degradation of 1% now. Minimum degradation is still 0%.

I did add my latest 2101 and 2105 to the spreadsheet.

 

[SiLiZiUMM]

Hi all,

It's been a while! November and December were busy as hell on my side. I should now have some time to read all the posts I missed!

We finally got our real car back from the repair shop on December 11th, 4 months later since the accident! We drove over 7000km with the other Soul EV (the white one) while we were waiting for ours.

Some interesting stuff, we went yesterday to the dealership in order to perform the SA203 recall. Initially, they should have done 2 more recalls (SA206 and RC096) but some parts were OOS. I insisted that they perform the ECU upgrade for SA203 as our vehicule had the problem while waiting for weeks parked in the repair shop parking (the 12V battery died). It seems it was a good idea to insist, as the 12V battery was only at 71% charged when we got in the shop.

I spoke a few words with the technician and looked at his Samsung tablet with the KDS software on it. Seems like the tablet uses a Bluetooth receiver as well.

He seemed busy so I didn't insisted too much but I was able to get a screenshot of the last screen he checked with some various stats:

Here's the 210x data I took just after the upgrade:

>2101 
7EC 10 3D 61 01 FF FF FF FF 
7EA 10 0E 61 01 F0 00 00 00 
7EC 21 A8 12 04 23 28 00 00 
7EA 21 FA 05 FA 02 00 00 00 
7EC 22 00 0F 2A 06 05 06 05 
7EA 22 00 00 00 00 00 00 00 
7EC 23 05 05 05 00 08 CA 5A 
7EC 24 C9 43 00 00 7E 00 00 
7EC 25 30 6F 00 00 31 BF 00 
7EC 26 00 12 26 00 00 12 25 
7EC 27 00 0D 53 83 41 00 02 
7EC 28 00 00 00 00 03 E8 00 

>2102 
7EC 10 26 61 02 FF FF FF FF 
7EA 10 21 61 02 FF FF 80 00 
7EC 21 CA CA CA CA CA CA CA 
7EA 21 7B 01 00 00 00 00 00 
7EC 22 CA CA CA CA CA CA CA 
7EA 22 00 00 00 04 00 00 00 
7EC 23 CA CA CA CA CA CA CA 
7EA 23 00 00 1C 00 35 36 35 
7EC 24 CA CA CA CA CA CA CA 
7EA 24 00 08 FD 07 4B 51 00 
7EC 25 CA CA CA CA 00 00 00 

>2103
7EA 03 7F 21 12 
7EC 10 26 61 03 FF FF FF FF 
7EC 21 CA CA CA CA CA CA CA 
7EC 22 CA CA CA CA CA CA CA 
7EC 23 CA CA CA CA CA CA CA 
7EC 24 CA CA CA CA CA CA CA 
7EC 25 C9 CA CA C9 00 00 00 

>2104
7EA 03 7F 21 12 
7EC 10 26 61 04 FF FF FF FF 
7EC 21 CA CA C9 CA CA CA CA 
7EC 22 CA CA C9 C9 CA CA CA 
7EC 23 CA CA CA CA CA CA CA 
7EC 24 CA CA CA CA CA CA CA 
7EC 25 CA CA CA CA 00 00 00 

>2105 
7EA 03 7F 21 12 
7EC 10 2C 61 05 FF FF FF FF 
7EC 21 00 00 00 00 00 05 05 
7EC 22 06 00 00 00 00 12 04 
7EC 23 23 28 00 01 50 06 06 
7EC 24 00 0F 15 00 0A 03 B1 
7EC 25 00 00 00 00 00 00 00 
7EC 26 00 00 00 00 00 00 00

 

[PIFOUKIA]

Hello from France,

For information, I'm currently working with PRIUSFAN to decode the CANBUS of my european KIA SOUL EV (some prius forums know him) , he already has decoded the CANBUS of Prius II, PRIUS III, LEXUS RX400H, LEXUS IS300H and PEUGEOT ION ( same of Citroën C-ZERO and Mitsubishi I-MIEV ) and he created the CANION app you can find on android market

Using an OBD interface connected with realterm program with the following configuration :

PORT tab :
SPEED : 1000000 bauds (enter manually this value instead of 57600 bauds default value)
COM : select the one of your usb interface

CAPTURE tab :
select timestamp YMDHS

Interface configuration commands to send with realterm:

for initial configuration at 1MB/ only :
atz (reset values)
atpp0csv04 (1MB/s setup)
atpp0con (memorize the value)

for reading :
ati (check the interface connection)
atsp6 (CAN speed 500K)
ath1 (display header)
ats1 (space between blocks)
atcaf0 (keep all the data)
atma (launch the passive reading)

Because speed is 1000000 bauds, a very good usb interface for capture is this one : https://www.scantool.net/obdlink-sx/

And because PID have to be filtered for the android app, the Bluetooth interface must be : https://www.scantool.net/obdlink-lxbt/ (in promotion on the website ^^ and 10% with 10FIRST code for subscribing to the newsletter)

We made a drive of 244 seconds in town at 70km/h max speed I think and PRIUSFAN has an Excel Macro which separates all the datas and doing a PIDs synthesis.

You can freely download the following Excel file which permit to analyse clearly the datas :

http://priusfan.info/_kiasoul/ventilateur_capture_0001.zip

On the first page named "base" you have a global analysis which contain the data of all the following sheets, you can see the PIDs, the number of time it has been seen during the record, the frequency/second of the PID, and the values :
RED means the value changed during driving you have min_max and you can see on the PID table in the following sheets what are the values for this PID.
BLACK ##xx means that the value didn't change when driving and value is "xx"

If you already have identified some of the PIDs, it will be helpful for the analyze.

If enough informations can be decoded with this passive reading of the CANBUS, the aim will be to create a similar app for android than the CANION app for Peugeot ion

I hope we will have very quickly a working app for the SOUL EV :mrgreen:

 

[TyrelHaveman]

Hello from France,

For information, I'm currently working with PRIUSFAN to decode the CANBUS of my european KIA SOUL EV (some prius forums know him) , he already has decoded the CANBUS of Prius II, PRIUS III, LEXUS RX400H, LEXUS IS300H and PEUGEOT ION ( same of Citroën C-ZERO and Mitsubishi I-MIEV ) and he created the CANION app you can find on android market

You can freely download the following Excel file which permit to analyse clearly the datas :

http://priusfan.info/_kiasoul/ventilateur_capture_0001.zip

On the first page named "base" you have a global analysis which contain the data of all the following sheets, you can see the PIDs, the number of time it has been seen during the record, the frequency/second of the PID, and the values :
RED means the value changed during driving you have min_max and you can see on the PID table in the following sheets what are the values for this PID.
BLACK ##xx means that the value didn't change when driving and value is "xx"

If you already have identified some of the PIDs, it will be helpful for the analyze.

If enough informations can be decoded with this passive reading of the CANBUS, the aim will be to create a similar app for android than the CANION app for Peugeot ion

I hope we will have very quickly a working app for the SOUL EV :mrgreen:

Hi! Thanks for joining. It would be great if you could add any information you find to our very comprehensive spreadsheet. https://docs.google.com/spreadsheets/d/1YYlZ-IcTQlz-LzaYkHO-7a4SFM8QYs2BGNXiSU5_EwI/edit?usp=sharing

We have all of the PIDs that you'll see when doing a blind ATMA like that, and have identified numerous data within them. We've also found out how to access many different components of the vehicle to get additional information, all of which you can find in that sheet (on other tabs).

 

[PIFOUKIA]

That's an impressive information

 

[JejuSoul]

I use a KW902 ELM327 Bluetooth device with Torque for reading the OBD2 data. like this one
One minor annoyance I have is that the device does not start up when the car is off. (unless charging)
The error message I get is "Not connected to the ECU"
Torque works once the car is on and will continue to work when you turn it off. (unless you finish charging)
Do other devices behave the same way?

The reason this is annoying. I wanted to discover the 12V (aka auxiliary battery) battery drain after a 10 day vacation.
I took a reading for the 12V battery before I left. 14.5V whilst the car was on and then 13.5V when I turned the car off.
I couldn't take a reading on return with the car off. Hence I turned the car on to get torque working.
Presumably doing this also causes the 12V to recharge from the main battery.
The readings taken were 14.4V whilst the car was on and then 13.5V when I turned the car off.
Hence the 12V battery appears to suffer no voltage drain at all, which seems unlikely.

... the 12V battery was only at 71% charged when we got in the shop.

According to your OBD data immediately below this the auxiliary battery was reading 12.6V.Had they charged it up in the meantime?

 

[Elmil]

I use a KW902 ELM327 Bluetooth device with Torque for reading the OBD2 data. like this one
One minor annoyance I have is that the device does not start up when the car is off. (unless charging)
The error message I get is "Not connected to the ECU"
Torque works once the car is on and will continue to work when you turn it off. (unless you finish charging)
Do other devices behave the same way?

The reason this is annoying. I wanted to discover the 12V (aka auxiliary battery) battery drain after a 10 day vacation.
I took a reading for the 12V battery before I left. 14.5V whilst the car was on and then 13.5V when I turned the car off.
I couldn't take a reading on return with the car off. Hence I turned the car on to get torque working.
Presumably doing this also causes the 12V to recharge from the main battery.
The readings taken were 14.4V whilst the car was on and then 13.5V when I turned the car off.
Hence the 12V battery appears to suffer no voltage drain at all, which seems unlikely.

Is there any terminal mode in Torque? In that case you should be able to use the 'ATRV' command that returns the 12V battery voltage seen by the ELM dongle itself, even if there is no CAN communication.

A fully charged lead-acid battery will (when charging has stopped) eventually settle around 12.7-12.8V. This will however take a long time if there is no load connected, so to get a baseline measurement it's a good idea to e.g turn the headlights on for a minute or so (with no charging and not started obviously) first.

 

[SiLiZiUMM]

I use a KW902 ELM327 Bluetooth device with Torque for reading the OBD2 data. like this one
One minor annoyance I have is that the device does not start up when the car is off. (unless charging)
The error message I get is "Not connected to the ECU"
Torque works once the car is on and will continue to work when you turn it off. (unless you finish charging)
Do other devices behave the same way?

On the Soul EV, most probably yes. It seems that the OBD port is not powered on when the car is off. I know zax123 was looking for a port that stays on when the car is off to make OVMS possible, I don't know how it's going so far.

The reason this is annoying. I wanted to discover the 12V (aka auxiliary battery) battery drain after a 10 day vacation.
I took a reading for the 12V battery before I left. 14.5V whilst the car was on and then 13.5V when I turned the car off.
I couldn't take a reading on return with the car off. Hence I turned the car on to get torque working.
Presumably doing this also causes the 12V to recharge from the main battery.
The readings taken were 14.4V whilst the car was on and then 13.5V when I turned the car off.
Hence the 12V battery appears to suffer no voltage drain at all, which seems unlikely.

The best here would be to use a multimeter to avoid a false reading (which would be caused because the 12V does not comes directly from the battery but from a power supply source with a voltage regulator). How do you take the reading with the ELM? Torque? AT RV command (this is probably what Torque use)? Data from 2101 command?

... the 12V battery was only at 71% charged when we got in the shop.

According to your OBD data immediately below this the auxiliary battery was reading 12.6V.Had they charged it up in the meantime?

Yes they did while I was waiting

 

[JejuSoul]

...The best here would be to use a multimeter ...

Yes. I am using the value for Auxiliary Battery Voltage from the BMS (ECU-7E4 PID-2101). Using a multimeter would enable us to see how accurate the BMS reading is, and you can use it when the car is off. Next time that is what I will do.

...Is there any terminal mode in Torque? ...

I don't think so.

When the car is off the Konnwei adapter does draw power (red light) and will connect via bluetooth (blue light) but does not make a connection to the OBD (green and yellow lights). I have to turn the car on (or start charging) to wake up the ECU and start a connection.

This topic is also currently being discussed on the LeafSpy thread here - http://mynissanleaf.com/viewtopic.php?f=44&t=14285&start=1390

Depending on the adapter and which model year LEAF, leaving the adapter plugged in can increase the 12V drain by a factor of five to six.
On 2011 "normal" 12V drain was something like 20 to 30 milliAmp.
With bluetooth adapter plugged in I recall it was something like 185 milliAmp.
Plugged in adapter can cause a big 12V drain.
--- are you saying it pulls power even though it won't communicate with leafspy? ---
Yes, that is my understanding for the older Bluetooth OBDII devices.
But, depending on your driving frequency 12V may survive a while.
I used Bluetooth OBDII and did not unplug or do maintainer charging for more than a year.
But it did not do that second 12V battery much good.
Died with a bad cell at the 2 1/2 year mark.

 

[goev]

Hi guys,

I've found the commands for locking and unlocking the doors:

First we need to set the correct session mode
771 3 02 10 30 00 00 00 00 00
Then we get this response:
779 3 02 50 30 AA AA AA AA AA

To lock or unlock the car, we send this command:
771 8 2f bc 1[1:0] 03 00 00 00 00
And we get this response:
779 8 6f bc 1[1:0] 03 AA AA AA AA

Have any of you found out how to detect the lock-state of the doors? CAN ID 120 is not giving much info. Also I'm having trouble with my CAN-reader/analyzer as it started giving me just "garbage" a couple of days ago, so I haven't been able to do much analyzing It's not always best to go for the cheapest solution!

 

[ZuinigeRijder]

Is there still development on going for the SoulEVSpy? What are the plans?
Currently I have also received a Konnwei KW902 and I could connect it with Torque lite.
In this forum I see that you can get the battery status and temperatures with sending 2101 till 2105.
Which AT commands need to be send with an ELM 327 terminal app?

"AT Z", // Reset all
"AT I", // Print the version ID
"AT E0", // Echo off
"AT L0", // Linefeeds off
"AT SP 6", // Select protocol to ISO 15765-4 CAN (11 bit ID, 500 kbit/s)
"AT AL", // Allow Long (>7 byte) messages
"AT AR", // Automatically receive
"AT H1", // Headers on (debug only)
"AT S1", // Printing of spaces on
"AT D1", // Display of the DLC on
"AT CAF0", // Automatic formatting off

Is the protocol for the Soul EV atsp6?
And then send e.g. just 2101
What is the correct sequence of AT commands from the beginning to get the battery data?

 

[goev]

I think atsp6 is correct.

You could send AT SH 7e4 to tell the ELM-chip the id to send from and which to read response from.
Then you can send 21 01 to 21 05

 

[TyrelHaveman]

There hasn't been a lot of work on Soul EV Spy, but I have also been working on a similar project which is making fairly good progress.

 

[ZuinigeRijder]

There hasn't been a lot of work on Soul EV Spy, but I have also been working on a similar project which is making fairly good progress.

Is this a project targetting the Kia Soul EV? Can you share more information what the goals and features are?

 

[ZuinigeRijder]

First some background of the Kia Soul EV I own. I bought my car one year old with 10.000 km driven. It was one of the first demo Kia Soul EV cars on the market in the Netherlands (2014-08-26). I do not have any clue how the car was driven the first year and how the charging behavior has been. Currently there is 18709 km driven with this car (so I drove 8709 km in ~4 months). When I did the measurement below, it was 0 degrees Celsius outside temperature, the State of Charge shown was 57% and the shown range was 65 km (70 km without using climate control).

I was able to get the OBDII data with the free "alOBD terminal" android app in combination with my Konnwei KW902 Bluetooth dongle:
https://play.google.com/store/apps/details?id=com.obd2.research

I did send the following commands (copy/paste of the terminal window):

2 > atz
atzELM327 v1.5
3 > ati
atiELM327 v1.5
4 > atsp6
atsp6OK
5 > at sh 7e4
at sh 7e4OK
6 > 2101
210103D 0: 61 01 FF FF FF FF 1: 6E 23 28 23 28 03 00 2: 06 0E 2C 08 07 08 07 3: 07 07 07 00 08 BD 2B 4: BC 58 00 00 8E 00 01 5: 9C 94 00 01 A2 2C 00 6: 00 97 D2 00 00 95 13 7: 00 4A 2A DC 45 01 6B 8: 00 00 00 00 03 E8 00
7 > 2102
2102026 0: 61 02 FF FF FF FF 1: BD BD BD BD BD BD BD 2: BD BC BC BC BC BC BC 3: BD BC BC BC BC BC BC 4: BC BC BC BD BC BC BC 5: BC BC BC BC 00 00 00
8 > 2103
2103026 0: 61 03 FF FF FF FF 1: BC BC BD BC BC BC BC 2: BC BC BD BD BD BD BD 3: BD BD BD BD BD BD BD 4: BD BD BD BD BD BD BC 5: BC BC BC BC 00 00 00
9 > 2104
2104026 0: 61 04 FF FF FF FF 1: BC BC BC BD BC BC BC 2: BC BC BC BC BD BC BC 3: BC BC BC BC BD BC BC 4: BC BC BC BC BD BD BD 5: BD BD BD BD 00 00 00
10 > 2105
210502C 0: 61 05 FF FF FF FF 1: 00 00 00 00 00 07 07 2: 08 00 00 00 00 23 28 3: 23 28 00 01 50 00 00 4: 00 74 03 00 64 0F 72 5: 00 00 00 00 00 00 00 6: 00 00 00 00 00 00 00

I looked into the Kia Soul EV Can Messages google doc (downloaded and saved, so I could add my data and compute the values):
https://docs.google.com/spreadsheets/d/1YYlZ-IcTQlz-LzaYkHO-7a4SFM8QYs2BGNXiSU5_EwI/edit#gid=0

Actually the worksheet tab BMC_Data describes 2101 and 2105.
Examples of Alex and Tyrell are in worksheet tab BMC_Compare
The BMC worksheet tab contains a description of the values and the multiply factor.

This is my data for 2101 in the same format as in BMC_Data:

10	3D	61	01	FF	FF	FF	FF
21	6E	23	28	23	28	03	00
22	06	0E	2C	08	07	08	07
23	07	07	07	00	08	BD	01
24	BC	13	00	00	8E	00	01
25	9C	94	00	01	A2	2C	00
26	00	97	D2	00	00	95	13
27	00	4A	2B	54	45	01	6A
28	00	00	00	00	03	E8	00

And computed the values myself in Excel:

State of Charge of Battery(BMS)	55.00	% (display = 57%)		
Available Charge Power	90.00	kW		
Available Discharge Power	90.00	kW		
Battery Current	6.00	Ah		
Battery DC Voltage	362.80	V		
Battery Module 1 Temperature	8.00	°C		
Battery Module 2 Temperature	7.00	°C		
Battery Module 3 Temperature	8.00	°C		
Battery Module 4 Temperature	7.00	°C		
Battery Module 5 Temperature	7.00	°C		
Battery Module 6 Temperature	7.00	°C		
Battery Module 7 Temperature	7.00	°C		
Battery Module 8 Temperature	8.00	°C		
Max Cell Voltage	3.78	V		
Max Cell Voltage No.	1.00			
Min Cell Voltage	3.76	V		
Min Cell Voltage No.	19.00			
Auxiliary Battery Voltage	14.20	V		
Cumulative Charge Current 	10562.00	Ah		
Cumulative Discharge Current	10705.20	Ah		
Cumulative Charge Energy	3886.60	kWh		
Cumulative Discharge Energy	3816.30	kWh		
Cumulative Operating Time	4860756.00	Sec	56.26	days
Inverter Capacitor Voltage	36.20	V		
Isolation Resistance	1000.00	kOhm

This is my data for 2105 in the same format as in BMC_Data:

10	2C	61	05	FF	FF	FF	FF
21	00	00	00	00	00	07	07
22	08	00	00	00	00	23	28
23	23	28	00	01	50	00	00
24	00	74	03	00	64	0F	72
25	00	00	00	00	00	00	00
26	00	00	00	00	00	00	00

And computed the values myself in Excel:

Battery Inlet Temperature	7.00	°C
Battery Min Temperature	7.00	°C
Battery Max Temperature	8.00	°C
Available Charge Power	90.00	kW
Available Discharge Power	90.00	kW
Airbag H/wire Duty	80.00	%
Battery Heater 1 Temperature	0.00	°C
Battery Heater 2 Temperature	0.00	°C
Max Deterioration	11.60	%
Max Deterioration Cell No	3.00	
Min Deterioration	10.00	%
Min Deterioration Cell No	15.00	
SOC Display	57.00	%

So it looks like the deterioration is already 11% with 18709 km driven. How does this compare with others?

 

[JejuSoul]

Currently I have also received a Konnwei KW902 and I could connect it with Torque lite.

Hi ZuinigeRijder, welcome to the forum. I too have a Konnwei KW902. There is a copy of Torque Pro on the CD that comes with it. I have posted the commands needed to read the battery data with Torque Pro. It saves time converting all the data from hex.

So it looks like the deterioration is already 11% with 18709 km driven. How does this compare with others?

We don't have much data (12 cars), but these values are in the same range as all the others (except 1 car in Switzerland). For example one car in Sweden driven 22160 km has max det 11.2%, min det 10.2%. We don't know how these values relate to actual deterioration in range because no-one has measured any yet. Posting the entire hex data is useful here because we may find a value for SOH (state of health) that has been zero in all previous datasets. There is a discussion of battery ageing in this thread http://www.mykiasoulev.com/forum/viewtopic.php?f=6&t=434