Soul Spy?

[mtndrew1]

I have too done some research and found that the diagnostic toolkit mentioned should do the job. If someone is serious about buying this product and put some effort to dump the data and present it here, I am willing to donate some dollars for the purchase. Anyone else?

I would also pitch in a little to help.

 

[SiLiZiUMM]

This is great AlKl! What CAN are you listening to? C-CAN I suppose?

Sidenote, how about creating a shared document like the Leafers did to document the CAN messages?
https://docs.google.com/spreadsheets/d/1K83MpqxrGzLBj4P5evtz1W0itB6dxF_16fchWpPKS0E/edit#gid=0

I can start one if you want!

Birkeland : I would join too!

 

[TyrelHaveman]

ID 18 byte 0: doors; byte 3 and byte 5: light, byte 8: seat belt

I thought CAN messages could only be 8 bytes long, but this one has at least 9 bytes (0 through 8)? Did you mix up the numbering, maybe?

 

[AlKl]

There appears to be an easier way for us do all this.

I'm not sure if this is a help for OVMS. As already mentioned the Diagnostic Tester only gets responses to special requests.
I don't know if such requests can be implemented in the OVMS software? You need a special timing, send a Tester present, change sessions, probably us a security access with seed&key and evaluate the answers.
Maybe a OVMS insider can answer if this is possible?

This is great AlKl! What CAN are you listening to? C-CAN I suppose?

Yes, all ID's are on the C-CAN.

Sidenote, how about creating a shared document like the Leafers did to document the CAN messages?
https://docs.google.com/spreadsheets/d/1K83MpqxrGzLBj4P5evtz1W0itB6dxF_16fchWpPKS0E/edit#gid=0
I can start one if you want!

Yes please create one, i will add the values i found.

ID 18 byte 0: doors; byte 3 and byte 5: light, byte 8: seat belt

I thought CAN messages could only be 8 bytes long, but this one has at least 9 bytes (0 through 8)? Did you mix up the numbering, maybe?

Yes of course we only have 8 bytes, i mixed it up, i corrected the values in my original post (seat belt is in byte 7)

ID202 byte 1+2 (12 bit signed) is the current used power. Factor 0.041666 for the 81kW

 

[SiLiZiUMM]

Here we go!

https://docs.google.com/spreadsheets/d/1FaZnCVpb0Jw-q4mLg24hjyTprjw9ZGCG2c39hBpj2Ko/edit?usp=sharing

For everyone, if you want write access just PM me, I'll add you gladly!

AIKI : Please review the values I added to the sheet to make sure the good bits are documented (to avoid 0-based/1-based errors). If you could add message length as well that would be great!

 

[notfred]

Can we relabel as 0-7 rather than 1-8 please? As an embedded software developer that's what I'm used to seeing.

 

[SiLiZiUMM]

Can we relabel as 0-7 rather than 1-8 please? As an embedded software developer that's what I'm used to seeing.

Done!

 

[TyrelHaveman]

Here we go!

https://docs.google.com/spreadsheets/d/1FaZnCVpb0Jw-q4mLg24hjyTprjw9ZGCG2c39hBpj2Ko/edit?usp=sharing

Oops. I guess I wasn't the only one with that idea. I created this last night but was waiting for AlKl's response to my question before posting.

https://docs.google.com/spreadsheets/d/1YYlZ-IcTQlz-LzaYkHO-7a4SFM8QYs2BGNXiSU5_EwI/edit?usp=sharing

 

[SiLiZiUMM]

So,
last weekend i made again some traces and found out following:
ID4B0 is the tire rotation speed: 4x 16Bit values (Intel Format). I used factor 0,033 to get km/h.
ID594 byte 5 is a 8Bit SOC value (factor 0,5 for %) (maybe for display)
ID598 byte 4+5 (Intel format) is a precise SOC value. I calculated factor 0,00445 according to SOC.
Some diagrams of the trace are in the German forum: http://www.goingelectric.de/forum/kia-soul-ev/ovms-fuer-den-soul-t9741-10.html#p250271
So i think we have first values to work with...
I also got following status bits:
ID 18 byte 0: doors; byte 3 and byte 5: light, byte 7: seat belt
ID 50 byte 1: wiper & light; byte 2: turn signal & wiper
D 120 central locking system
ID 433 byte 2: Parking break switch status

Example msg:
55D 67 84 46 E1 20 50 00 01
Byte 0 = 67; Byte 7 = 01

I was able to validate a few values tonight. I have an ELM327 based OBD2 reader, a Konnwei KW902 (the one recommended for Leaf Spy Pro).
594/598 : Yes!
433 : On my side, I see byte 0 flipping (0x00 parking brake off, 0x01 parking brake on). Then again, I think my configuration is messed up (when byte 0 is 0x01, I only see 2 data bytes as payload)

 

[JejuSoul]

Am still researching to see how others solved this problem.
Have just found that BMW owners have gone the 'shady' route by using bootleg versions of the official software.
see - http://www.mybmwi3.com/forum/viewtopic.php?f=11&t=1616
which links to a site in China
http://www.ebay.com/itm/OBD2-BMW-ENET-Date-Ethernet-to-OBD-Interface-Cable-E-SYS-ICOM-Coding-F-Series/321502160627

So to summarise
Tesla owners use OBD2 to SMS using a SIM card device. Then OVMS software.
Leaf owners use OBD2 over Bluetooth. Then Leaf Spy.
BMW owners use OBD2 over Ethernet. Then bootleg official software.

The first two have reverse engineered the database, the latter has just used a bootleg.

 

[TyrelHaveman]

I spent some time in the car last night reading messages manually off the bus with my ELM327 and a terminal. I confirmed most of the items that AlKl found, and went into more detail figuring out what some of the bits mean inside of the status messages, so I can now identify which turn signal is on, what the wiper settings are, etc.

I added my findings to my spreadsheet: https://docs.google.com/spreadsheets/d/1YYlZ-IcTQlz-LzaYkHO-7a4SFM8QYs2BGNXiSU5_EwI/edit?usp=sharing

I also had the odd problem that SiLiZiUMM saw where the message 433 would shorten to only 2 data bytes (instead of 8) when the parking brake is on!

 

[TyrelHaveman]

I spent some time in the car with it parked but on a couple days ago and just populated a bunch of the messages in my spreadsheet with the values I was seeing. We can compare these to what we see while driving and at other states of charge and such to try to figure out what might be there. I also created an "Expected" sheet in there which lists the values that are displayed in Kia's service software, so we have an idea of what kind of things to look for. We can mark where we find them once we've done so.

Thanks to a couple of you who have also requested access to the sheet and have been adding information! I'm excited to see this collaboration getting going.

https://docs.google.com/document/d/13baeivEqWKFGZowXk2QCjbsSNeXA18oHj4u6iYXaoTs/edit?usp=sharing

 

[SiLiZiUMM]

I spent some time in the car with it parked but on a couple days ago and just populated a bunch of the messages in my spreadsheet with the values I was seeing. We can compare these to what we see while driving and at other states of charge and such to try to figure out what might be there. I also created an "Expected" sheet in there which lists the values that are displayed in Kia's service software, so we have an idea of what kind of things to look for. We can mark where we find them once we've done so.

Thanks to a couple of you who have also requested access to the sheet and have been adding information! I'm excited to see this collaboration getting going.

https://docs.google.com/document/d/13baeivEqWKFGZowXk2QCjbsSNeXA18oHj4u6iYXaoTs/edit?usp=sharing

Me too! We will use sheet as it's the most complete to date. On my side, I'll add a few notes to it when I'll have time. I also started working on an Android project.

 

[2soul]

Interesting project!

I have 2 Soul EV's so would love to see this coming to life. An Android app would be terrific, even better if it could somehow be run on the navi unit. I've been thinking about getting the GDS kit from e bay that will allow you to see detailed battery information, but haven't had the time to check it out. I might just get it, being prepared to lose the money.

Which ELM327 adapter should I get if I want to help out? Any of the cheap ones on e bay?

 

[notfred]

Which ELM327 adapter should I get if I want to help out? Any of the cheap ones on e bay?

I have a cheap bluetooth ELM327 adaptor from ebay and while I only spent about 10 minutes with it last night I was having problems getting it to monitor the bus.

I suspect there's just too much traffic for it to monitor the full bus as the speed is one difference between the cheap Chinese copies and the real ELM327s (mine reports v1.5 so it's definitely a cheap Chinese copy). I think it likely that once the decoding effort of dumping the full bus traffic is complete then the slow cheap Chinese copies would manage with the filtered listening and specific requests.

 

[JejuSoul]

An ELM327 adapter that has been recommended as working is the Konnwei KW902
Available for 15USD here http://www.ebay.com/itm/ELM327-Bluetooth-WiFi-KW902-OBD-II-Car-Auto-Diagnostic-Scan-Tools-Red-/262060423800?hash=item3d0404ba78&item=262060423800&vxp=mtr
I have just ordered one of these. I will use it connecting to an android phone over bluetooth.
Even though the car's navi is an android tablet computer it is very unlikely we will be able to hack into it and install our own software.

The 'official' diagnostic software is here. (Without the official 5000usd price.)
I would only advise getting this if you are confident you know how to install and use it.
The GDS software is here http://www.adkautodiagnostic.com/v214-gds-vci-software-for-hyundai-kia-500g-sata-format-hdd-p-2493.html
You would also need the toolkit - http://www.adkautodiagnostic.com/v15-gds-vci-for-kia-hyundai-firmware-v202-with-trigger-module-p-2329.html

 

[notfred]

That's another cheap Chinese copy rather than a real one.

Just the ELM327 chip is $21 from the manufacturer http://elmelectronics.com/obdic.html and that's without the connector, the Bluetooth chip and the CAN transciever to say nothing of the other bits needed to make the board.

At this point I'm considering building my own ELM327 circuit just to avoid getting hit with one of the copies http://elmelectronics.com/obdtips.html

 

[TyrelHaveman]

This is also a cheap Chinese one but I've had reasonable success with it, just monitoring one message ID at a time: http://smile.amazon.com/gp/product/B00PJPHEBO?psc=1&redirect=true&ref_=oh_aui_detailpage_o00_s00

USB is also an option, although this one I got doesn't work on Windows 8 or newer (so I set up a Linux VM):
http://smile.amazon.com/gp/product/B005FEGP7I?psc=1&redirect=true&ref_=oh_aui_detailpage_o00_s01

By the way, the OBD-II port in the Soul EV is in a very unfortunate position: under a cover on the left side of the dash. And it's RIGHT under the cover; so if you stick a Bluetooth adapter on it, you won't be able to put the cover back on. I tried using this but even it's too big to close the cover over: http://smile.amazon.com/gp/product/B00KYH9COE?psc=1&redirect=true&ref_=oh_aui_detailpage_o00_s00

 

[notfred]

Spent some more time tonight with my cheap chinese copy of the ELM327 and the car in the garage on charge. With filtering I'm able to pull in the ids that others are seeing. Here's an additional bit of info, I thought I'd try some standard OBD-II commands and found the following:

>090a
7EA 10 17 49 0A 01 00 00 00 
7EC 10 17 49 0A 01 42 45 43 
7EA 21 00 00 00 00 00 00 00 
7EC 21 4D 2D 42 2B 45 6E 65 
7EA 22 00 00 00 00 00 00 00 
7EC 22 72 67 79 43 74 72 6C 
7EA 23 00 00 00 00 00 00 00 
7EC 23 00 00 00 00 00 00 00 
>

So at 7EA we have an ECU that doesn't want to tell us what it is, but at 7EC we have "BECM-B+EnergyCtrl".
The ECU at 7EA is the one that responds with the VIN to a 0902 request.

 

[notfred]

By the way, the OBD-II port in the Soul EV is in a very unfortunate position: under a cover on the left side of the dash. And it's RIGHT under the cover; so if you stick a Bluetooth adapter on it, you won't be able to put the cover back on. I tried using this but even it's too big to close the cover over: http://smile.amazon.com/gp/product/B00KYH9COE?psc=1&redirect=true&ref_=oh_aui_detailpage_o00_s00

The port is just clipped in, if you squeeze the sides you can push it back through towards the fuse box. That may get you enough room to get that right angled ribbon cable on, or you may be able to wiggle the port all the way out of the plastic holder and pull it up to the gap where door handle is.