Soul Spy?

[AlKl]

Good news everyone!

I made a trace of the KIA's diagnostic software and i found in the trace nearly all information we want (All Cell Voltages, temperatures, battery voltage, charge/discharge power, ...).
I will add the information to our spreadsheet.

I'm not going to do any more random probing of the OBD-II modes. It is obvious that doing so can make things happen and I'm afraid something is going to get messed up now.

Yes i think it doesn't make sens to just try different command, when we don't know what to expect.

Every PID on mode 20 returns 01 60 from both 7EA and 7EC.

Service 20 is StopDiagnosticSession, and the positive response is 60. (a positive response is always service ID+40)

I have done at least 2,500 random PIDs on modes 10, 11, 14, 21, 22, 23, 25, 26, 27, and 30.

Lots of PIDs on mode 10 cause the brake system to freak out and display all the warnings on the dash.

Some PIDs on mode 11 make a relay click somewhere in the left side of the dash, and the dome lights flash off (I had a door open so they were otherwise on).

This services are from KWP2000 protocol, which is old but obviously used by most ECU's in the system.
Service 10 is StartDiagnosticSession, it's needed to change the session of the ECU. E.g. if you want special data.
Service 11 is ECU Rest, therefore the system acts wired. But no problem, after a few seconds the ECU is back to normal.
Service 14 is CleadDTC's
Service 21 ReadDataByLocalID (used by die KIA Diagnostic Tester)
Service 22 ReadDataByCommonID
Service 23 ReadMemoryByAddress
Service 25 is not defined
Service 26 SetDataRates
Service 27 SecurityAccess
Service 30 InputOutputControlByLocalID

Most Services need subfunctions to get correct responses, otherwise you get a negative response (7F) with a detailed response code (e.g. 12 = subfunction not supported)

So what we need to get our information from the battery is:
The tester sends from CAN-ID 7E4 and the BMS (i asume) answers from 7EC.
First we have to change the session:
Tester -> 02 10 90
Response: 02 50 90 (10+40 = 50 = positive response)

an with service 21 (readDataByLocalID) we get all battery data.

this 5 request are used:
02 21 01 -> details in spreadsheet
02 21 02 -> returns cellvoltage 1 to 32
02 21 03 -> returns cellvoltage 33 to 64
02 21 04 -> returns cellvoltage 65 to 96
02 21 05 -> details in spreadsheet

the time between session change and first request should only last a few seconds, otherwise the ECU returns to default session and doesn't answer the request.

I hope we can add this request in the OVMS SW soon, to get detailed information from the car.

BR, Alex.

 

[notfred]

Awesome!

As well as reading information, do you also have the data for triggering the various bits that the diagnostic software can do? I'm thinking about when you change the coolant you need to trigger the pump to run, and before you change the rear brake pads you need to trigger the electric parking brake to back off fully, that kind of thing? How about the TPMS, both reading the pressures and also writing new sensor ids for swapping winter and summer tyres?

 

[user 394]

Yes really awesome!
Is it possible to tigger "normal" (Not service related) actions - Like starting the heater/AC, and let it run for 30 minutes, unlocking doors etc. via remote (SMS?/Wifi/etc) (Like the Tesla remote app)
(Sorry for asking stupid quesions)

 

[JejuSoul]

Finding all the battery data. That is fantastic. Congrats!

 

[TyrelHaveman]

Outstanding! Thanks Alex!

FYI, something I did might have screwed up the car's HVAC system. When on "AUTO" it now always blows heat on the highest speed possible, at the highest temperature possible, even if it's set really low. My wife's taking it to the dealer on Friday, but if you noticed anything that I might be able to send to fix that myself, that'd be great....

SiLiZiUMM, I really like the start of the UI you have on your Android app. I would love to collaborate with you on that, if you want to stick it up on github or something. Or we could create a gitlab team to keep it more private. I've been working on a Windows desktop program myself that I was using for my test probing and such.

 

[SiLiZiUMM]

Very very nice!

Some questions:

1) Are "services" the same as "modes" in the Wikipedia article here : https://en.wikipedia.org/wiki/OBD-II_PIDs#Modes ? This is hex right, so service 10 is actually 0x10, not 0xA?

2) About the Change Session command, do you know what the 90 means?

3) Does the car needs to be started to make this work? Does this work while it's running (I would assume not)?

4) Is there a Stop Session command required?

Tyrel : woops for the HVAC! :roll: :lol:
Yes it's a good idea to collaborate on that one, I'll clean things up and I'll PM you something over the weekend, trying to explain what I did so far!

 

[TyrelHaveman]

Some questions:

Even though your questions were probably directed at Alex, I'll answer a couple.

1) Are "services" the same as "modes" in the Wikipedia article here : https://en.wikipedia.org/wiki/OBD-II_PIDs#Modes ? This is hex right, so service 10 is actually 0x10, not 0xA?

Yes

3) Does the car needs to be started to make this work? Does this work while it's running (I would assume not)?

I will test this shortly. I would assume it needs to be on, and probably works while driving, otherwise why would motor RPM be part of the data?

4) Is there a Stop Session command required?

I had the same question!

Tyrel : woops for the HVAC! :roll: :lol:
Yes it's a good idea to collaborate on that one, I'll clean things up and I'll PM you something over the weekend, trying to explain what I did so far!

Great! I look forward to it, Pierre-Étienne!

For the HVAC, I wonder if it's stuck in a diagnostics mode. Since mode 20 is "StopDiagnosticSession" maybe I'll throw a bunch of PIDs at that again and see if it fixes it.

 

[TyrelHaveman]

It's play time!

First of all, doing mode 10 90 causes all the dummy lights on the dash to come on. That's not something we'd want to do while driving!

However, I discovered that you don't need to be in that mode to get this info. You can, at any time, send 21 01, 02, 03, 04, and 05 and get responses. You also don't need to send them from 7E4. Whatever my ELM327 does by default is working.

Here's what I get (cleaned up):

Sending OBD command: 2101

7EA: 10 0E 61 01 F0 00 00 00
7EA: 21 1D 06 16 03 00 00 00
7EA: 22 00 00 00 00 00 00 00

7EC: 10 3D 61 01 FF FF FF FF
7EC: 21 35 23 28 23 28 03 00
7EC: 22 04 0D 70 14 13 13 13
7EC: 23 13 13 13 00 14 B3 2A
7EC: 24 B3 18 00 00 82 00 00
7EC: 25 26 B4 00 00 27 F3 00
7EC: 26 00 0E 0D 00 00 0E 1C
7EC: 27 00 05 D3 93 45 01 58
7EC: 28 00 00 00 00 03 E8 00

Sending OBD command: 2102

7EA: 10 21 61 02 FF FF 80 00
7EA: 21 83 AC 00 00 00 00 00
7EA: 22 00 00 00 04 00 00 00
7EA: 23 00 00 1C 00 44 40 3F
7EA: 24 FF 07 FF 07 AE 51 00

7EC: 10 26 61 02 FF FF FF FF
7EC: 21 B3 B3 B3 B3 B3 B3 B3
7EC: 22 B3 B3 B3 B3 B3 B3 B3
7EC: 23 B3 B3 B3 B3 B3 B3 B3
7EC: 24 B3 B3 B3 B3 B3 B3 B3
7EC: 25 B3 B3 B3 B3 00 00 00

Sending OBD command: 2103

7EA: Command not understood

7EC: 10 26 61 03 FF FF FF FF
7EC: 21 B3 B3 B3 B3 B3 B3 B3
7EC: 22 B3 B3 B3 B3 B3 B3 B3
7EC: 23 B3 B3 B3 B3 B3 B3 B3
7EC: 24 B3 B3 B3 B3 B3 B3 B3
7EC: 25 B3 B3 B3 B3 00 00 00

Sending OBD command: 2104

7EA: Command not understood

7EC: 10 26 61 04 FF FF FF FF
7EC: 21 B3 B3 B3 B3 B3 B3 B3
7EC: 22 B3 B3 B3 B3 B3 B3 B3
7EC: 23 B3 B3 B3 B3 B3 B3 B3
7EC: 24 B3 B3 B3 B3 B3 B3 B3
7EC: 25 B3 B3 B3 B3 00 00 00

Sending OBD command: 2105

7EA: Command not understood

7EC: 10 2C 61 05 FF FF FF FF
7EC: 21 00 00 00 00 00 13 13
7EC: 22 14 00 00 00 00 23 28
7EC: 23 23 28 00 01 50 13 13
7EC: 24 00 00 01 00 00 01 35
7EC: 25 00 00 00 00 00 00 00
7EC: 26 00 00 00 00 00 00 00

The car at this time is displaying 26% SOC on the dash. Outdoor temp is 48 deg F (9 deg C). Battery may be a bit warmer than that since we just went for a drive.

After some manual decoding based on what Alex added to the spreadsheet, I got all this out of there:
SOC = 26.5%
Available Charge Power = 90 kW
Available Discharge Power = 90 kW
Batt DC Voltage = 344.4 V
Module 1 Temp = 20 deg C
Module 2 Temp = 19 deg C
Module 3 Temp = 19 deg C
Module 4 Temp = 19 deg C
Module 5 Temp = 19 deg C
Module 6 Temp = 19 deg C
Module 7 Temp = 19 deg C
Module 8 Temp = 20 deg C
Max Cell Voltage = 3.58 V
Max Cell No = 42
Min Cell Voltage = 3.58 V
Min Cell No = 24
Aux Batt Voltage = 13.0 V
Cum. Charging = 990.8 Ah
Cum. Discharge = 1022.7 Ah
Cum. Charging Energy = 359.7 kWh
Cum. Discharge Energy = 361.2 kWh
Cum. Operating Time = 106 hours?
Isolation Resistance = 1000 kOhm
All 96 Cell Voltages = 3.58 V
Bat In Temp = 19 C
Bat Min Temp = 19 C
Bat Max Temp = 20 C
Airbag Duty = 80%
Temp1 = 19 C
Temp2 = 19 C

Now I'm going to find out if my wife can do a little bit of driving while I sit in the car with my laptop, to see exactly where the motor RPM might appear....

 

[TyrelHaveman]

I had Trish drive and monitored 21 01. Definitely looks like motor RPM is there, but twice:

At 20 miles/hour (32 km/h):
7EC: 28 08 98 08 98 03 E8 00 (0898h = 2,200)

At 30 miles/hour (48 km/h):
7EC: 28 0C 80 0C 80 03 E8 00 (0C80h = 3,200)

At 50 miles/hour (80 km/h):
7EC: 28 15 18 15 18 03 E8 00 (1518h = 5,400)

When going slowly in reverse:
7EC: 28 FF 9C FF 9C 03 E8 00 (FF9C = -100)

I'm not sure why the same thing is twice in a row. Maybe they just have two sensors in there for redundancy.

You could calculate the vehicle's speed using this. Approx: km/h = rpm / 68; or mi/h = rpm / 110

 

[AlKl]

As well as reading information, do you also have the data for triggering the various bits that the diagnostic software can do? I'm thinking about when you change the coolant you need to trigger the pump to run, and before you change the rear brake pads you need to trigger the electric parking brake to back off fully, that kind of thing? How about the TPMS, both reading the pressures and also writing new sensor ids for swapping winter and summer tyres?

No, not yet. The best way is to trace the log and compare the data with the diagnostic tester display. But without it it's hard to decode the data and i wouldn't send a write command without knowing exactly what it does
I think the command "02 1A 8B" with CAN-ID 7D6 reads the TMPS ID's and with "02 27 01 00" (security access) and "10 12 3B 8B 11 11 11 11 22 22 22 22 33 33 33 33 44 44 44 44" you can write the sensor ID's (according to the trace, but no waranty)

Is it possible to tigger "normal" (Not service related) actions - Like starting the heater/AC, and let it run for 30 minutes, unlocking doors etc. via remote (SMS?/Wifi/etc) (Like the Tesla remote app)

If the command is supported from the ECU it should be possible. But again, we have to know what command to send.

FYI, something I did might have screwed up the car's HVAC system. When on "AUTO" it now always blows heat on the highest speed possible, at the highest temperature possible, even if it's set really low. My wife's taking it to the dealer on Friday, but if you noticed anything that I might be able to send to fix that myself, that'd be great....

I don't think that you screwed up something? Session changing and ECU Reset won't harm the system. And you haven't written data with a service command?

2) About the Change Session command, do you know what the 90 means?

No, not exactly. It's a definition for a special session. The manufacturer can use values between 80 and FF. I only saw two session command till now: 90 and 81. After powering on the ECU is in default session, but for testing or flashing the ECU has to change to sepecial session (extended / Programming sesion).

3) Does the car needs to be started to make this work? Does this work while it's running (I would assume not)?

It depends how it is implemented in the ECU. Sometimes it is not allowed to change the session while driving (due to security reason). However i wouldn't try to change session during driving, because it's possible that e ECU return to default session with a ECU reset and this could be dangerous during driving.

4) Is there a Stop Session command required?

Also depends on the implementation. Usually the ECU returns to default session after a timeout of some seconds. Therefore the service "Tester Present" ($30 exists. The tester is sending this command about every second and the ECU knows that the tester is still present and stays in the session. So i think we don't need it.

However, I discovered that you don't need to be in that mode to get this info. You can, at any time, send 21 01, 02, 03, 04, and 05 and get responses. You also don't need to send them from 7E4. Whatever my ELM327 does by default is working.

Thats great, it's much saver not to use session changing in OVMS.


So now we need someone who will work on the OVMS SW on github (https://github.com/openvehicles/Open-Vehicle-Monitoring-System) for the soul.
I'm not really good in programming "c" and the first version was only made to help us start. ("dexterbg" is actually working for the Twizy project).

 

[TyrelHaveman]

I have created another sheet in the spreadsheet that compares my 21 01 and 21 09 results with AlKl's results, and also mine when parked (but on) vs driving. The differences are highlighted and I wrote notes explaining the differences in things we understand. There are also differences in things that we don't understand, which will maybe help us understand them. Look for the bold text in my notes on the side for that.

 

[SiLiZiUMM]

I'll try on ours tomorrow. Tyrel, with the ELM you only send 02 21 01 for example?

Also, what does the 2 first answer lines do? Starting with 10 and 30? Control stuff?

 

[TyrelHaveman]

I'll try on ours tomorrow. Tyrel, with the ELM you only send 02 21 01 for example?

Also, what does the 2 first answer lines do? Starting with 10 and 30? Control stuff?

With the ELM327, you just need to send "2101" (or "21 01"). The 02 at the beginning of Alex's examples is just the length, which the ELM327 calculates and includes automatically. 2102, 2103, and 2104 will give the cell voltages, and 2105 has the other interesting stuff in it.

I suggest turning on headers with "ATH1" first.

On the ELM327 I don't see the line starting with 30 like Alex does; my guess is it's related to flow control and the ELM327 takes care of that. But the first line starting with 10 is the initial response to the message, and it's always the same for a particular request. The CAN specification probably describes it. I do know that, for example, where you see 61 01, that means a successful response to 21 01 (40 is added to 21 to get the 61). The second byte probably encodes the length and some other flags.

 

[JejuSoul]

I have had a quick look at my battery voltages.
I saw SOH=100% , SOC=74% , all 96 batteries at 3.92V

Two questions
1. Clearly the voltage drops as your SOC is used up. Is there a formula for this relationship?
2. Why are we all seeing SOH=100% ? (Admittedly 3 is a small sample. Actually 4 if we count the car used to take photos in the service manual)

My car is 6 months old - logically SOH should be less than 100%. (98% is what I expected)
Here is a lab test result for the batteries in our car.

My first guess is that I am looking at the wrong data for SOH.
Or perhaps it rounds this number to the nearest 5 percent.
Or perhaps it is measuring usable capacity. ?

 

[SiLiZiUMM]

Tyrel : ok thx!
Jeju :
1. This is normal, it actually depends on the battery chemistry. This could be deduced if we had the battery tech specs sheets (which we dont). Meanwhile, if you look at AVT tests (http://avt.inl.gov/fsev.shtml) you can see a discharge curve (battery pack V vs Ah discharged) that should be more or less the same as individual cell voltage vs SOC. The advertised battery capacity is 27kWh and the actual is more around 30.4kWh. From the service manual, the SOC should be within 5 and 95%. What numbers do you get if you fully charge?

2. SOH formula depends a lot on number of parameters, which are defined by the BMS. My first guess would be too that we are looking at the wrong data, but that should be validated with the Kia tool. I would doubt that this number is rounded to 5%.

BTW how did you get that chart?

 

[AlKl]

Also, what does the 2 first answer lines do? Starting with 10 and 30? Control stuff?

10 = first frame and 30 is flow control, see here: https://en.wikipedia.org/wiki/ISO_15765-2

With the ELM327, you just need to send "2101" (or "21 01").

With witch ID do you send on the bus, and how do you address the different ECU's?
You get a different response when you send from 7E2 (answer from 7EA) and when you send from 7E4 (answer from 7EC).
Maybe you send from the functional tester address (7DF) and all ECU's (who are supporting the command) are answering?

2. Why are we all seeing SOH=100% ? (Admittedly 3 is a small sample. Actually 4 if we count the car used to take photos in the service manual)

The SOH value is not confirmed yet in our spreadsheet, maybe you can add/post your full answer to compare?

 

[JejuSoul]

Just had a longer look at the numbers.
Currently all 96 batteries are at 3.78V - SOC(real) 57% - SOC(display) 59% : Anyone know why there are 2 values for SOC?
I think the data I used for SOH above is wrong. The value is 1000. It would be the Insulation resistance in Ohms.
I am guessing that the data we want is the first 6 bytes on row 24 after calling 2105.
Reason - the sequential order of the data we have found is the same as in the Kia Diagnostics.
The next 4 items after heat 2 temperature are
Max Deterioration
Max Deterioration Cell No
Min Deterioration
Min Deterioration Cell No

We have values from 3 different cars
Mine - 00 19 0B 00 00 01
Tyrel - 00 00 01 00 00 01
Alex - 00 53 36 00 08 01

In the Diagnostics no deterioration at all is represented by 4 zeroes. Tyrel has a new car perhaps.
My car is 6 months old and has driven about 6500km.
It would be good if someone with a high mileage could comment here with their numbers.

SiLiZiUMM: I discussed the cell data with 2016Electric here - http://www.mykiasoulev.com/forum/viewtopic.php?f=14&t=386&start=10
The image I showed earlier is from http://energy.gov/sites/prod/files/2014/05/f15/APR13_Energy_Storage_d_III_Adv_Battery_Dev_0.pdf

The image you mention (battery pack V vs Ah discharged) is presumably this one -

 

[BigEdgar]

JejuSoul (and others working on the SoulSpy) - I don't have high mileage, only 200 miles so far, but I should be getting my ELM327 bluetooth scanner in the mail today (the same one Tyrel referenced in an earlier post on this thread). If it's helpful, I can hook it up and check any values if one of you felt like providing some instructions (I have a few Android devices that I can pair with the ELM327, and I could also hook it up to a Windows 8 laptop).

 

[TyrelHaveman]

With witch ID do you send on the bus, and how do you address the different ECU's?
You get a different response when you send from 7E2 (answer from 7EA) and when you send from 7E4 (answer from 7EC).
Maybe you send from the functional tester address (7DF) and all ECU's (who are supporting the command) are answering?

I'm not specifying anything and I get responses from all ECUs at once, so it's probably using 7DF by default.

Tyrel has a new car perhaps.

Yes, it's less than a month old with about 900 miles (1500 km) on it.

I have a LEAF that still showed 100% SOH when it had over 20,000 miles on it. I think there can be some small amount of deterioration and it'll still show 100%.

I think those bytes make sense for the deterioration.

The value of 1000 could be 100.0 -- there are a lot of values we see that are divided by 10 to get the actual values.

We need to find a car that has something other than 1000 kOhm for isolation resistance. But we should expect to see SOH somewhere as well, because it is displayed by the diagnostic tool.

 

[TyrelHaveman]

Our Soul was at the dealership today trying to figure out what's wrong with the climate control. They said that it thinks the temperature in the cabin is -26 degrees (didn't specify C or F). They don't know how to fix it yet so we're getting the car back. But this gives me a chance to look for -26 C (0xE6) or -26 F (-32 C, 0xE0) on the CAN bus, where the rest of you are probably seeing more reasonable numbers around 0x14.

Of course, it could be on the M_CAN which I can't look at with the ELM327...

If you have ideas of where to look, let me know.