General Tech Help Good at troubleshooting? Have a non specific issue? Discuss general tech topics here.

CANbus hacking on an IPace

Thread Tools
 
Search this Thread
 
  #1  
Old 01-19-2021, 03:02 PM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default CANbus hacking on an IPace

Hi,

I have started decoding the CANBus on the IPace. I have identified pretty much all ECU (I know only the ID (RX-TX) for the moment), and existing PID on each ECU.
I am at the stage where I need to identify the usage/description of each ECU. I have found that in the high end of PID (range F100-F1FF) there is a lot of Jaguar part number like
J9D3-19C273-AG
HY32-14F217-AC
J8A2-14C433-AD
JPLA-14D459-AE
....
Is there a place where I can found what those part number refer to ? That will help identifying the ECU role.
 
  #2  
Old 01-19-2021, 05:17 PM
MoJo88's Avatar
Senior Member
Join Date: Dec 2020
Location: London
Posts: 216
Likes: 0
Received 59 Likes on 40 Posts
Default

Post the node ID's and I'll try to help identifying the ECU role. 7xx
 
  #3  
Old 01-19-2021, 05:47 PM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

I have posted all my finding here :

https://docs.google.com/spreadsheets...zceFcUSfk2lVz8

So the ECU ID I have identified are

706, 710, 716, 720, 726, 730, 731, 732, 733, 734, 736, 737, 740, 741, 742, 743, 744, 746, 747, 751, 752, 753, 754, 764, 775, 785, 792, 797, 7a2, 7a3, 7a4, 7b1, 7b2, 7b3, 7c3, 7c4, 7c6, 7e0, 7e2, 7e4, 7e5, 7e6

Thanks
 
  #4  
Old 01-19-2021, 06:00 PM
MoJo88's Avatar
Senior Member
Join Date: Dec 2020
Location: London
Posts: 216
Likes: 0
Received 59 Likes on 40 Posts
Default

706 - ipma
710 - chcm
716 - sdlc
720 - ipc
726 - bcm
730 - pscm
731 - rfa
732 - gsm
733 - hvac
734 - hcm
736 - pam
737 - rcm
740 - ddm
741 - pdm
742 - drdm
743 - prdm
744 - dsm
746 - epic
747 - epicb
751 - tpm
752 - omm
753 - dcdc
754 - tcu
764 - z-flr
775 - rgtm
785 - rhvac
792 - atcm
797 - sasm
7a2 - idma
7a3 - psm
7a4 - aam
7b1 - cmr
7b2 - hud
7b3 - imc
7c3 - hcmb
7c4 - sodl
7c6 - sodr
7e0 - pcm
7e2 - bbm
7e4 - becm
7e5 - bccm
7e6 - abs
 

Last edited by MoJo88; 01-20-2021 at 09:05 AM.
  #5  
Old 01-19-2021, 07:16 PM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

Thanks a lot.
You seem to have a lot of info. Any chance you also have PID description per ECU . I know that is a lot, thouhands....
If I have to pick one : BECM
 
  #6  
Old 01-20-2021, 02:44 AM
MoJo88's Avatar
Senior Member
Join Date: Dec 2020
Location: London
Posts: 216
Likes: 0
Received 59 Likes on 40 Posts
Default

No I don't, would be nice though. I would've liked to do the same thing as you but just don't have the time at the moment.

Also, Z-FLR = Adaptive Cruise Control Module (Called CCM on pre MY19).
 

Last edited by MoJo88; 01-20-2021 at 09:07 AM.
  #7  
Old 01-22-2021, 08:33 AM
MoscowLeaper's Avatar
Senior Member
Join Date: Apr 2012
Location: Israel
Posts: 606
Received 339 Likes on 190 Posts
Default

However the can hacking on i-pace is useless. The can bus goes into a GWM, which forwards a can data to flexray network (and most of the modules on this car are a flexray ones), so only basic diag info is present in CAN and there's a little you can do with a car via CAN.
 
  #8  
Old 01-22-2021, 10:51 PM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

Originally Posted by MoscowLeaper
However the can hacking on i-pace is useless. The can bus goes into a GWM, which forwards a can data to flexray network (and most of the modules on this car are a flexray ones), so only basic diag info is present in CAN and there's a little you can do with a car via CAN.
It depends on what you you want to do.
To start with, I am interested in providing more information about the car to the driver than what Jaguar has decided to provide. For example the battery temperature is a very important data to know in order to understand the charging rate and limitation.
That's the kind of info I am looking for.
 
  #9  
Old 01-24-2021, 09:59 AM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

Now, with the latest sample data I collected this morning (ext. temp is -14c) I am 95% sure that the battery temperature can be read on the CANbus on ECU ID 7E4[7EC] (BECM), and the PID for the battery temperature are 0x492B, 0x492C, 0x492D, 0x492E, 0x492F, 0x4930. These are the 6 values for the 6 plates in the battery. The EV battery coolant outlet temperature sensor is on 7E4[7EC]:0x491B, and the EV battery coolant inlet temperature sensor is on 7E4[7EC]:0x491C. The formula for those temperature is (value-40), and the result is in deg celcius. The external ambient temperature can be read on the HVAC module 733[73B]:0x9924, and the formula is (value*0.5 -40). If you have a way to read the High Speed CANbus (pin 6/14 on the diagnostic connector), ie. TorquePro, you can read it yourself.
Now my next quest will be the Volt and Amp of each 36 cells of the battery. or 9 x 4 group of 108 pouchs.
 
  #10  
Old 01-24-2021, 08:04 PM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

On the BECM module, PID 0x4910, 0x4911, 0x4914 seems to be the real battery % (divide the value by 100). At 100% of battery , this value is around 9600 (9600/100 = 96%), and with a linear regression, I can extrapolate that the value would be around 3% with the dash says 0% of battery. SO I can see a real 3% when the dash says 0%, and a real 96% at 100%.
 
  #11  
Old 01-25-2021, 09:23 PM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

PID 0x4913 on BECM seems to be the max regen:
- 2 bytes
- when battery is fully charged => 0
- when battery SOC =93%, 950
- when battery SOC =82, 4600
- when battery SOC =60, 10600
- when battery SOC =8, 15000

So if you take that value and divide by 100, this gives 150kw at 8% of SOC, 106kw at 60%, etc...
 
  #12  
Old 01-25-2021, 09:27 PM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

PID 0x498f on BCCM seems to be the Voltage of the charger plugged in the car
Unplug: 0
plug on 240v:
- 76 7a
- 77 32,
- 79 18,
- 76 8d,
Plug on 120v:
- 38 2a

If you take that (value / 128), you have something close to 240 or close to 110.
 
  #13  
Old 01-26-2021, 02:05 PM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

In the BECM module, PID 0x4901, 0x4909, 0x490e ,0x490f are all within the same value range (36000-44000). If we divide them by 100, that could be a battery voltage.

Since the battery pack is organized with 9 cells in serie, and 4 groups of 9 cells in parallel, I am expecting to have 4 values for these 4 groups in the range of 36000-44000. That's what we have.

Now I am looking for the Amp (something around 58Ah per cell, or 232Ah per row
 
  #14  
Old 01-27-2021, 09:00 AM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

PID 0x490A on BECM is interesting. it is a one 1 Byte. On my sample data, the min is 58 and max is 146. If I apply the formula (value/2 - 40), just like the external temperature sensor , this PID gives a value close to the external temperature when the car stand still in the driveway, without charging, this value goes up a bit when the car is charging on the 240v charger, but significantly higher (+33c) when I did a fast charge yesterday, even if the external temp was -5c. Could be an internal temp sensor on an electronic module.
 
  #15  
Old 01-29-2021, 09:07 AM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

This is the status so far for the BECM

PID Description Formula Unit
4886
4887
48c2
4900
4901 Voltage for battery row#1 (9 modules) (256A+B)/100 Volt
4902
4903 Max voltage of the pouch cells (256A+B)/1000 Volt
4904 Min voltage of the pouch cells (256A+B)/1000 Volt
4905 Maybe a temperature of a componant ?? (A*0.5)-40
4906 Maybe a temperature of a componant ?? (A*0.5)-41
4907 Maybe a temperature of a componant ?? (A*0.5)-42
4908 Maybe a temperature of a componant ?? (A*0.5)-43
4909 Voltage for battery row#2 (9 modules) (256A+B)/100 Volt
490a Maybe a temperature of a componant ?? (A*0.5)-43
490b
490c Battery current in and out ((256A+B)-0x8000)/24 or 25 Amp
490d
490e Voltage for battery row#3 (9 modules) (256A+B)/100 Volt
490f Voltage for battery row#4 (9 modules) (256A+B)/100 Volt
4910 Average Battery SOC (256A+B)/100 %
4911 Min Battery SOC (256A+B)/100 %
4912 ??? Battery current ??? (256A+B)/160 Amp
4913 Max Regen (256A+B)/100 Kw
4914 Max Battery SOC (256A+B)/100 %
4915
4916
4917
4918
4919
491a
491b EV battery coolant outlet temperature A-40 DegC
491c EV battery coolant inlet temperature A-40 DegC
491d
491e set of bit / flag
491f
4920 maybe some voltage 256A+B Volt
4921 maybe some voltage 256A+B Volt
4923 set of bit / flag
492b Battery CSC #1 temperature A-40 DegC
492c Battery CSC #2 temperature A-40 DegC
492d Battery CSC #3 temperature A-40 DegC
492e Battery CSC #4 temperature A-40 DegC
492f Battery CSC #5 temperature A-40 DegC
4930 Battery CSC #6 temperature A-40 DegC
4931
4933
4934
4935
4936
4937
4938
4939
4941
4944 set of bit / flag
4945 set of bit / flag
494e set of bit / flag
4970
4971
497a maybe some voltage 256A+B Volt
497b maybe some voltage 256A+B Volt
497c maybe some voltage 256A+B Volt
497e
497f
4980
4981 maybe some voltage 256A+B Volt
498c
d015
d018
d019
d020
d021
d05b
d100
d10e set of bit / flag
d14d
d703
dd00 Elaspe time since factory built (16777216*A+65536*B+256*C+D)/10 Second
dd01 Odometer 65536*A+256*B+C KM
dd02
dd04
dd05
dd06
dd08
dd09
 
  #16  
Old 01-29-2021, 11:00 AM
ken sampson's Avatar
Junior Member
Join Date: Dec 2020
Location: Annapolis
Posts: 11
Likes: 0
Received 1 Like on 1 Post
Default

looks like we have so very smart people here. Would anyone know where I could find the ECU pinout diagram on the 2020-2021 F-Pace SVR?
Thanks
 
  #17  
Old 02-06-2021, 08:53 AM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

Some new PIDs on HVAC ECU (733)....

- the PID 99BF seems to be the fan RPM. With fan on speed 1, it gives 3500, on speed 2, it gives 5500, speed 3, 6000, on speed 4, 6600, on speed 5, 6900, and speed 6 and 7, 7000. Direct value, no formula.

- PID 9854 ,9855 ,9856 ,9857 are 4 temp sensors for the four seats in the cabin, with a good guess for 9856 for the driver's seat, and 9857 for passenger's seat. Formula is (value/5-16).

- PID 981C may be the current on the heater,

- PID 9805 seems to be related to the fan rotation, but it is not the RPM. Maybe the voltage on fan ?
 
  #18  
Old 02-06-2021, 10:22 AM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

Some PIDs on the TPMS ECU (751):
  • 0x2076, 0x2077, 0x2078, 0x2079 are the pressure for the four wheels in kPa, just like the value in the API
  • PID 0x2A0A, 0x2A0B, 0x2A0c, 0x2A0D are the temperature of the tire. Formula is (value-50)
 
  #19  
Old 02-08-2021, 10:28 AM
dernotte's Avatar
Junior Member
Thread Starter
Join Date: Jan 2021
Location: Montreal
Posts: 19
Likes: 0
Received 2 Likes on 1 Post
Default

Some PIDs on the PSCM module (Steering wheel):

Only 4 interesting PID : 3014 ,d907 ,d908 ,d909
  • PID D909 seems to be the angle of the steering wheel. 2 bytes, signed value. Positive on the left, negative of the right. (A/10), in degree.
  • PID D908 seems to be the driver's pressure on the steering wheel. 2 bytes, signed value.
  • I guess D907 should be the car's pressure on the steering wheel, and I don't know what is the other one (3014).
 
  #20  
Old 03-21-2021, 08:02 AM
Kermit68's Avatar
Junior Member
Join Date: Mar 2021
Location: Rome
Posts: 4
Likes: 0
Received 0 Likes on 0 Posts
Default

Originally Posted by MoJo88
706 - ipma
710 - chcm
716 - sdlc
720 - ipc
726 - bcm
730 - pscm
731 - rfa
732 - gsm
733 - hvac
734 - hcm
736 - pam
737 - rcm
740 - ddm
741 - pdm
742 - drdm
743 - prdm
744 - dsm
746 - epic
747 - epicb
751 - tpm
752 - omm
753 - dcdc
754 - tcu
764 - z-flr
775 - rgtm
785 - rhvac
792 - atcm
797 - sasm
7a2 - idma
7a3 - psm
7a4 - aam
7b1 - cmr
7b2 - hud
7b3 - imc
7c3 - hcmb
7c4 - sodl
7c6 - sodr
7e0 - pcm
7e2 - bbm
7e4 - becm
7e5 - bccm
7e6 - abs
Hi Mojo88, any chance you can help me too with I-Pace MY21 ECU identification? Most of the ECU are the same as in MY19/20 but not all. For example I'm still looking for the TCU ... This the list I came up with:

(see following msg)

Thanks in advance for any help ;-)
 

Last edited by Kermit68; 03-22-2021 at 05:49 AM. Reason: bad attachment


Quick Reply: CANbus hacking on an IPace



All times are GMT -5. The time now is 10:15 AM.