CAN bus hacking thread

[solder]

Moving right along ... my 2015 Spark EV has a s96p2 configuration for the cells, with 6 Sections of 32 cells each. There is a voltage sensor for each cell, and a temperature sensor for each Section. (Compare to 1 voltage sensor for each 3 cells, and 8 Sections on the 2014, according to the manual.)

Here's how it matches up with the service manual -- All PIDS were requested from 7E7 with mode 22.

PIDS 0, 20, 40 -- unknown 32-bit (00000001, 00000001, 40000000)
42 -- BECM voltage (33C3 = 13251 / 1000 = 13.251v)
40D3 -- 5V Reference 1 (0045 = 69 * (5 / 2^16) + 5 = 5.00105v
40D4 -- 5V Reference 2 (0026 = 38 * (5 / 2^16) + 5 = 5.00058v
???? -- System Power Mode (Doesn't even make sense on this car)
???? -- Battery Pack Low Resolution Current Sensor
???? -- Battery Pack High Resolution Current Sensor
???? -- Battery Pack Terminal 1 Voltage
40D7, 40D9, 40DB, 40DD, 40DF, 40E1 -- Section 1-6 Temperature -- 0x3F = 63 - 40 = 23 deg C = 73 deg F
4181 - 419F -- Battery 1-31 Voltage (fully charged is D332 = 54066 * (5 / 2^16) = 4.125V
41A4 -- Battery Pack Coolant Temperature 1?
41A5 -- Battery Pack Coolant Temperature 2?
4200-4240 -- Battery 32-96 Voltage
44B9 - 44C1 -- Unknown 16-bit (~6FC0), maybe BICM Cell 1-9 Overvoltage temperature?)
8002 -- unknown 8-bit (02)
8043 -- unknown 8-bit (09)
82A3 -- State of Charge, unknown units (0xC6 is fully charged, 0xAC is -14.7kWh)
(note -- from C001 upward, numbering of consecutive PIDs skips xxxA-xxxF)
[...]
C111-C206 -- Battery 97-192 Voltage
[...]

You should be able to try these out in Torque Pro, as long as you specify 7E7 as the OBD2 header and 22 as the mode (meaning, pid 22-C206 should read out Battery 192 Voltage). I still need to figure out how the voltages are represented on a 2014 Spark EV, and the State of Charge units are a mystery.

 

[CANtronix]

Informations i have are for the Volt's VICM.
They are pretty different, as the diagnostic adresse itself is 0x7e4.

The PIDs are also different, e.g. :
State of Charge is 432F and 255 = 100%.

Dont have any information about the Spark EV

 

[Nashco]

Good work, solder, you're clipping along well! I haven't had a chance to tinker much lately, "life" has been getting in the way of fun stuff. Meanwhile, there's some really interesting stuff going on here:

http://forums.evtv.me/?forum=403618

The info on the Lear charger is especially interesting, I expect it's common with our Spark EV. Sure would be nice if we can figure out how to double up the 3.3 kW chargers to get 6.6 kW!

Bryce

 

[solder]

Good work, solder, you're clipping along well! I haven't had a chance to tinker much lately, "life" has been getting in the way of fun stuff. Meanwhile, there's some really interesting stuff going on here:

http://forums.evtv.me/?forum=403618

The info on the Lear charger is especially interesting, I expect it's common with our Spark EV. Sure would be nice if we can figure out how to double up the 3.3 kW chargers to get 6.6 kW!

Nice find! I will try to help them out, but it won't even let me post a message until my account is manually approved. Do you know if they still have those chargers available at a good price? Someone mentioned $550 in that post, but I can't find where they are for sale for that price. All I see is something for $1595, which is much less of an impulse buy for me.

Back to the subject at hand -- we can issue diagnostic commands to many different controllers to read data, and even in some cases (temporarily) modify the vehicle's behavior -- e.g. change the recirculation valve flap position. Working out the native CAN messages that the ECU normally uses to do this is yet another exercise.

Using command 0x22 (ReadDataByParameterIdentifier), I can read the following out --
Hybrid Power Control Manager 2 (HPCM2) -- 0x7E4 / 0x7EC:

40E9=[0147] Battery resistance (unit 1/32767 Ohm)
41A3=[020E] Capacity?  no units  
41B0=[639C] 14V power avail (1 W? per unit)
41C4=[1985] Avg Batt Voltage — 3.92 unit 1/39.32 V)
4329=[1964] Min Batt Voltage — 3.90 unit 1/39.32 V)
432B=[1985] Max Batt Voltage — 3.92 (unit 1/39.32 V)
432C=[0C]   Battery cell # with maximum voltage 
433C=[02FE] Max Battery voltage — (unit 0.52 V)
433B=[01AA] Min Battery voltage -- (unit 0.52 V)
432D=[02D4] Battery voltage -- (unit 0.52 V)
4356=[FFFA] — battery pack current -0.90A  (-4915 to 4915, so 16bit signed 1/9832 A per unit)
43AF=[B70A] high res state of charge, 72% (1/25600 % per unit)
8334=[B7] displayed state of charge, 72% (1/256 % per unit)

Anyone have any ideas about that Capacity number, 0x020E? It's not clear if that's a measure of the State of Health of the battery, or just a battery pack type. (it's the closest thing to an SoH that I have found thus far)

Back to the Battery Energy Control Module (7E7 / 7EF) -- turns out, only half of the PIDs I found with my (brute-forcing) approach are documented. Here are the ones I'm confident about:

40D3, 40D4 Battery Pack High/Low Res Current Sensor (units unclear, see above?)
40D7, 40D9, 40DB, 40DF, 40E1 Battery Section temperatures (deg C, offset from -40)
41A4, 41A5 Battery Coolant temperatures
4181-419F, 4200-4240.  96-112 Battery Cell bank voltages (depends on 2014 vs 2015) (units are 5/65536 V)
That leaves a bunch of things like flags, some voltage ranges (C214-C218), some temperature ranges (C207-C213), and a second set of battery voltages (C100-C206 / C245-C259 for 2014, C111-C206 for 2015)

Is there anything else anyone is specifically looking for? I have some charger codes to give to the evtv guys, not sure if they will help.

 

[bicycleguy]

I would be interested in those charger codes. Have you been able to look while DC quick charging? Is there a code for the high voltage relay to the input port?

 

[solder]

I would be interested in those charger codes. Have you been able to look while DC quick charging? Is there a code for the high voltage relay to the input port?

Unfortunately, I don't have the DC quick charging option on my car, but there are a number of measurements that can be taken of various relay states; I'll try to grab some of that info to show you what is available.

Depending on how much you care, I do know a few people with the DCFC option, and I *might* be able to pull a favor or two (The main obstacle is convincing my friends that my contraptions won't break their precious cars...)

 

[zzcoopej]

Hi,
I am the author of the EvBatMon suite of CAN/OBD Apps, and we are trying to support all EV over time. I have tried contacting user "soldier" to discuss supporting the Chevy Spark EV in our App, however they have not responded to my PM's.
If you are interested in helping us out in supporting the Chevy Spark EV, please make contact via PM or our website http://www.EvPositive.com.

 

[kevin]

Hi,
I am the author of the EvBatMon suite of CAN/OBD Apps, and we are trying to support all EV over time. I have tried contacting user "soldier" to discuss supporting the Chevy Spark EV in our App, however they have not responded to my PM's.
.

Tragically, "Solder" recently died of a heart attack with no warning - he was only 35.

kevin

 

[Nashco]

Tragically, "Solder" recently died of a heart attack with no warning - he was only 35.

kevin

Wow, that's a real bummer! I had enjoyed hacking away with Ben in the background, he was a really sharp guy and I appreciated his passion for sharing knowledge to help the community rather than just helping himself. I wondered why he wasn't getting back to me lately, but figured he was just busy with more important stuff.

Another reminder to live life to the fullest, you just never know when your number will get pulled.

Bryce

 

[zzcoopej]

Tragically, "Solder" recently died of a heart attack with no warning - he was only 35.

Thanks for getting back to me kevin, sorry to hear of the passing of "solder", sounded like a great guy.

Is anyone else interested in helping us out support the Chevy Spark EV in our App by doing some testing on their EV?

 

[Anonymous]

Still looking for someone to help test the app? I have access to a Spark and a Volt.

 

[nikwax]

Is anyone else interested in helping us out support the Chevy Spark EV in our App by doing some testing on their EV?

sounds interesting, what is involved?

 

[zzcoopej]

sounds interesting, what is involved?

Hi nikwax, you will need a bit of simple tech know-how (eg transfer android files, take screenshots), an OBD adapter and an Android device. Get in touch with us via our website www.evpositive.com or PM if you want to help out.

 

[nikwax]

I'm iOS only in my mobile world

 

[zzcoopej]

I'm iOS only in my mobile world

We have an iOS version of our App in development with release planned for August. You can keep up to date with progress here http://www.evpositive.com/apps.html

 

[NORTON]

I'm iOS only in my mobile world

Do you know how much a 7" Android tablet can be had for?
I plan on leaving my old Samsung Tab2 mounted in the Spark as a dedicated instrument page.
That is, if it does what I want.

I didn't have any luck getting an OBD-BT adapter running Torque Pro to work in the Spark EV,,, yet.
This set up worked great in a Volt and a Prius Gen 3.

 

[nikwax]

I'm iOS only in my mobile world

Do you know how much a 7" Android tablet can be had for?

If it's anything more than zero, I'm perfectly willing to wait for the iOS version

 

[fox]

Anyone know if there was a major update to any of this, I now have a spark ev and a 500e and would like to modify the crap out of the spark, if the motor has 400lbs torque, there has got to be ways to make this thing stupid fast beyond what seems to be the best work I've heard/seen of on it by Nashco/Bryce. Try to love life!

 

[SparkevBlogspot]

Torque may be large, but power isn't. For example, I can exert 1000 ft lb of torque with my long wrench, but that doesn't mean I can move the car quickly since my power is still about 100 watts.

Because the battery is power limited, you won't be able to hack much more power. With power taper at higher speed, you won't get much over 90 MPH top speed with current gearing. If you can hack the speed limiter, best might get close to 100 MPH, but no more.

If you can change the gear ratio for higher top speed, acceleration will suffer; might be as slow as Nissan Leaf in 0-60 MPH! Then top speed will be abut 130 MPH.

If you're talking about acceleration with different gearing, that won't help much since tires will slip; factory setup acceleration is at the limits of street tires due to 50-50 weight distribution. 500e is quicker to 30 MPH due to 60/40 weight distribution which helps FWD traction.

If you can manage much stickier tires and different gear ratio, best you can get for 0-60 MPH would be about 6.5 seconds.

I analyze these in my blog post using the torque curve.

http://sparkev.blogspot.com/2016/06/sparkev-performance-analysis.html

 

[user 1070]

Torque may be large, but power isn't. For example, I can exert 1000 ft lb of torque with my long wrench, but that doesn't mean I can move the car quickly since my power is still about 100 watts.

Because the battery is power limited, you won't be able to hack much more power. With power taper at higher speed, you won't get much over 90 MPH top speed with current gearing. If you can hack the speed limiter, best might get close to 100 MPH, but no more.

If you can change the gear ratio for higher top speed, acceleration will suffer; might be as slow as Nissan Leaf in 0-60 MPH! Then top speed will be abut 130 MPH.

If you're talking about acceleration with different gearing, that won't help much since tires will slip; factory setup acceleration is at the limits of street tires due to 50-50 weight distribution. 500e is quicker to 30 MPH due to 60/40 weight distribution which helps FWD traction.

If you can manage much stickier tires and different gear ratio, best you can get for 0-60 MPH would be about 6.5 seconds.

I analyze these in my blog post using the torque curve.

http://sparkev.blogspot.com/2016/06/sparkev-performance-analysis.html

I've been wondering about this. It seems the Spark limits current draw substantially after 40MPH. Is this related to a motor limitation? If the current draw is higher below 40MPH, there shouldn't be any reason why it would need to be limited at higher speed. It's not like the batteries can distinguish speed from throttle demand. I suspect it's an artificial limitation, but unsure what the purpose would be. Perhaps to keep temperatures down? By why not only restrict the current draw when the batteries or motors exceed a temperature threshold? Why do it all the time? I'm hoping someone can crack the Spark ECU and unleash its full performance.