[Maxwell_400]

Success!

I confirm that the first seed is always the same. But I don't know if all iPace have the same seed or not. Someone else has to confirm this by repeating my experiment.

works like a charm

 

[dernotte]

Proceeding with the investigation, I found that the same request on the BECM gives, the SOH, the Voltage and 2 temperatures for each cell

Here is the answer for the first 12 cells

Digit#3 is the voltage (divide by 10)
Digit#7 and 8 are the temperature (substract 40)
Digit#11 is the SOH (divide by 2)

Cell01: 37 39 6d cb 6e 5b 3a 3a 54 c8 9e
Cell02: 37 39 71 cb 6e 5b 3a 39 54 c8 a6
Cell03: 37 39 71 cb 8e 5c 3a 3a a4 c8 a4
Cell04: 37 39 71 cb 8e 5b 3a 3a 54 c8 a2
Cell05: 37 39 71 cb 8e 5b 3a 3a 54 c8 9c
Cell06: 37 39 75 cb 8e 5b 3a 3a 54 c8 9c
Cell07: 37 39 71 cb 8e 5d 3a 3a 54 c8 9e
Cell08: 37 39 75 ca 4e 5c 3a 3a 58 c8 92
Cell09: 37 39 71 cb ae 5c 39 3a 58 c8 9e
Cell10: 37 39 6d cb 6e 5b 39 39 54 c8 a0
Cell11: 37 39 71 cb 8e 5c 3a 3a a8 c8 9a
Cell12: 37 39 71 cb 6e 5b 3a 3a a4 c8 9e

In the same vain, there is a temperature per cell. In my case it is 18c. The autel gives 2 temperatures: temp1 and temp2. This could be the "3A 3A"

 

[Trielectric]

Unfortunately, the sequence is way more complex than 1) ask to read a value 2) read the value and interpret it.
In this case it is : 1) turn the diagnostic mode 2) get into the private mode and get the seed number for the private key 3) compute a private key based on the seed and send the private key 4) if the private key is accepted start an internal routine call to get the SOH 5) interpret the returned value. I don't know if you can do this sequence 1-2-3-4-5 with ScanGauge.

I agree!

 

[Snowflake]

works like a charm

What did you use to test this?

 

[Maxwell_400]

What did you use to test this?

I used OBDLINK LX and Torque Pro, but Car Scanner or an ELM327 terminal app will also work.

 

[Snowflake]

I used OBDLINK LX and Torque Pro, but Car Scanner or an ELM327 terminal app will also work.

I haven't really done anything with Torque in ages. Heck, I didn't do much with it ever. However, it does having some scripting if anybody is up for the task:

Scripting - Torque Wiki

wiki.torque-bhp.com

 

[Maxwell_400]

I haven't really done anything with Torque in ages. Heck, I didn't do much with it ever. However, it does having some scripting if anybody is up for the task:

Scripting - Torque Wiki

wiki.torque-bhp.com

I think scripting would be perfect for reading out all the cells, I will probably give it a shot but there are not many script examples around. However I will be travelling and off grid for the next three weeks.

 

[dernotte]

I will see if I can help here, but the hardest part here is.... finding an Android device, I only have Mac, iPad and iPhone around me...
The iOs version on Apple Store seems to be a scam. You need to pay for it, and it does not work.

 

[Snowflake]

I could conceivably send you my backup phone with torque pro loaded on. I'm sure that would be the moment I need the backup phone again, though. :| I also don't know where my bluetooth obd connector is. I suppose it might work with my ethernet jobby for bimmerutility.

 

[dbwarrior]

I post my results from module1.
I have 3 data points on different Soc levels

I think, we need more datapoints for finding corelation..
I high lighted byte4 because for my i eys it is one what goes down, when SOC goes down and visa versa

 

[dbwarrior]

Here is mine loggings byte1-byte6

soc 36,3% 3611mv
Module#1 36 38 71 c3 6e 1d


soc 34,2% 3607mv
Module#1 36 38 5d c2 ae 17
Module#2 36 38 55 c2 ce 17
Module#3 36 38 59 c2 ce 15
Module#4 36 38 55 c2 8e 15

soc 34,2% 3607mv
Module#1 37 ba 11 d0 8e 86
Module#2 37 ba 11 d0 ae 84
Module#3 37 ba 15 d0 2e 83
Module#4 37 ba 0d d0 ae 83

 

[dernotte]

After further investigations with @dbwarrior , it seems like the voltage could be on byte 1&2 divided by 0x500. In this case 0x3739 / 0x500 = 11.04v

Cell01: 37 39 6d cb 6e 5b 3a 3a 54 c8 9e
Cell02: 37 39 71 cb 6e 5b 3a 39 54 c8 a6
Cell03: 37 39 71 cb 8e 5c 3a 3a a4 c8 a4
Cell04: 37 39 71 cb 8e 5b 3a 3a 54 c8 a2
Cell05: 37 39 71 cb 8e 5b 3a 3a 54 c8 9c
Cell06: 37 39 75 cb 8e 5b 3a 3a 54 c8 9c
Cell07: 37 39 71 cb 8e 5d 3a 3a 54 c8 9e
Cell08: 37 39 75 ca 4e 5c 3a 3a 58 c8 92

the value of byte 3 and 6 goes down when the SOC when up, so could be related to internal resistance ?
the value of byte 4 goes up when the SOC when up, so could be related to the current ?

 

[dbwarrior]

Here custom sensor for requesting data from module1 via car scanner App

And here is reslut when you hit "test" button:

 

[dbwarrior]

Some theorys and findings:

 

[dbwarrior]

Highest cell voltage was easy converstion.
X/2+2048

 

[dernotte]

I think we are very close to fully understand what the diagnostic routine is giving us here.
With the collaboration of @dbwarrior we have almost decoded every bytes.
If we consider the 11 bytes returned by the diagnostic routine like this example:

39 bc 2d e1 4f 0b 3b 3b 54 c8 a0

It should be read like this

39b c2d e14 f0b 3b 3b 54 c8 a0

• First value "39B" should be decoded with "value/0x50". In the case "11.5 volt". This is the voltage of the first module (out of 36)
• Second value "c2d" should be decoded with "(value/4 + 0xC00)/1000". In this case "3.851 Volt". This is the voltage of the first group of pouches (out of 3) in the 3S4P architecture of the module.
• Third value "e14" should be decoded with "(value/2 + 0x800)/1000". in this case "3.85 Volt". This is the voltage of the second group of pouches (out of 3) in the 3S4P architecture of the module.
• Fourth value "f0b" should be decode with (value/1000). in this case "3.851 Volt". This is the voltage of the third group of pouches (out of 3) in the 3S4P architecture of the module.
• Fifth and sixth are 2 temperature values (maybe the temperature on both connector, positive and negative of the module). It should be decoded with "value - 40". In this case "19 deg celcius".
• 7th and 8th still need to be decoded.
• 9th value "a0" should be decoded with "value/2". In this case "80 %". This is the SOH of the module.

 

[dbwarrior]

That "7th"=9th byte is acting interesting way.
Here is graph when Dernotte make long jouney.

 

[sciencegeek]

Temperature thresholds perhaps?

 

[dbwarrior]

Temperature thresholds perhaps?

Interesting idea. Could you describe more ?

 

[dernotte]

Internal resistance ?