I'm doing a where's waldo/wally on the battery cell voltage information. I know FOR SURE they have to be in the EV-CAN messages somewhere, but for the life of me I can't figure it out just from looking at logs and decoding. I have the possibility to modify CAN data and see what happens, so that's the next step, but I'd rather figure it out before that. So, my thought process so far:
The BMS sends out, we know this for sure:
- 0x1DB which is fully decoded (voltage, current in the first 3 bytes, then 2 bytes that are always 0, a counter and a CRC)
- 0x1DC which has max. battery power, regen, commanded charge current in the first 4 bytes, then 3 unknown bytes* and a CRC
- 0x55B which has SoC, then a byte that is always 0xAA/0x55, an always-zero byte, HV isolation resistance, a counter and CRC
- 0x5BC has GIDs, state of charge in bars/SoH on a mux, two unknown stable bytes with a mux and then 3 very variable bytes**
- 0x5C0 has a mux, three temperature bytes, a linear ramping byte and a byte that alternates between 3 values according to the mux
All of the bytes in these messages have either been decoded or are too stable/uncorrelated to be voltages. The unknown bytes in 0x1DC are periodic and do not change with SoC. The 3 variable bytes in 0x5BC are a mystery to me, but they seem not to change according to SoC.
All I can figure is that the BMS somehow encodes the battery cell voltage data into message 0x5BC bytes 5-7, but how? There is no other place it can be, but the data doesn't seem to make much sense. It looks much more like battery balancing data. Or maybe it's muxed together with balancing status. Has anyone figured this out already?