Polestar Forum banner
41 - 60 of 68 Posts
I finally figured out how to read the SoH with OBD2 by picking up bits and pieces here and there on the internet and snooping the CAN bus.

So, in short, you need to send the following CAN message: 0x1DD01635: 0x03 0x22 0x49 0x6d 0x00 0x00 0x00 0x00

0x1DD01635 is the address of the "BECM" (Battery management control module). 0x03 is the number of valid bytes following, 0x22 indicates an UDS message, and 0x496d is the DID we want to read.

The BECM will then respond with: 0x1EC6AE80: 0x07 0x62 0x49 0x6d XX XX XX XX.

0x1EC6AE80 is the "tester address", where responses are sent. 0x07 is the number of valid bytes following, 0x62 indicates that it is a response to a 0x22 request (bit 0x40 set + 0x22) and 0x49, 0x6d is the DID it is responding to. The 4 bytes after that is the SoH in 0.01% units.

My car responds with 92.10% after 160000 km.
Great find (y)You are a true hacker. Are you happy with the 92.10% SoH afer 160,000 km ?
 
Great find (y)You are a true hacker. Are you happy with the 92.10% SoH afer 160,000 km ?
Well, since I do not really know how it has developed over the years that I have had the car it is kind of hard to judge.
Was the value at 100% when I got the car? I just do not know.

But I guess 92% sounds reasonable, so I am pleased in a sort of realistic way :)
 
I finally figured out how to read the SoH with OBD2 by picking up bits and pieces here and there on the internet and snooping the CAN bus.

So, in short, you need to send the following CAN message: 0x1DD01635: 0x03 0x22 0x49 0x6d 0x00 0x00 0x00 0x00

0x1DD01635 is the address of the "BECM" (Battery management control module). 0x03 is the number of valid bytes following, 0x22 indicates an UDS message, and 0x496d is the DID we want to read.

The BECM will then respond with: 0x1EC6AE80: 0x07 0x62 0x49 0x6d XX XX XX XX.

0x1EC6AE80 is the "tester address", where responses are sent. 0x07 is the number of valid bytes following, 0x62 indicates that it is a response to a 0x22 request (bit 0x40 set + 0x22) and 0x49, 0x6d is the DID it is responding to. The 4 bytes after that is the SoH in 0.01% units.

My car responds with 92.10% after 160000 km.
Hi!
I came across your post where you explained how you retrieved the State of Health (SoH) of the battery via a UDS CAN message using the 0x496D PID on the Polestar 2 – thank you for sharing that, it was really insightful.

I'm currently trying to achieve the same on my own Polestar 2 using an OBDLink CX adapter, and I was wondering:

Which app or tool did you use to send the CAN message and receive the response?
Was it a PC-based tool (e.g., SavvyCAN, CANalyzer) or an Android app (e.g., Torque Pro, Car Scanner with PID Editor, etc.)?

Any details about your setup (device, app, connection method) would be super helpful!
Thanks in advance!

Harri
 
Which app or tool did you use to send the CAN message and receive the response?
Was it a PC-based tool (e.g., SavvyCAN, CANalyzer) or an Android app (e.g., Torque Pro, Car Scanner with PID Editor, etc.)?

Any details about your setup (device, app, connection method) would be super helpful!
Thanks in advance!

Harri
I used SavvyCAN and looked at what CarScanner does when it reads out other values from the BECM. When it tries to read the SoH however it seems to request something else which just does not work.

I found a mention on the internet somewhere (can't really find the link right now since I am not at the right computer) about which DID to read for SoH, and turned out that was the correct information. I found that information some time ago, but I never really figured out how to actually read and what IDs to use until i snooped the traffic of CarScanner.

For actually reading the value out I used a software of my own development which is a further development of this:

It should be possible to read with CarScanner or other software if you set up a custom read. There is a settings menu for that in CarScanner but it is not exactly crystal clear documented how to use, but I have never tried very hard to figure it out.
To read it with SavvyCan should be fairly easy.
 
I did not. Glad to see people poke these cars and document their findings!
I tried a bit more using Car Scanner custom sensor, however the most I got out of it was "?" instead of "NO DATA"
I tried
0322496D00000000, 22496D00000000, 0322496D etc.
I'm starting to believe my cheapo ELM clone OBD2 adapter might not support 29bit headers: Car Scanner reports "ATSH1DD01635" as "not supported by the adapter"
 
Cheap Yellow Display inside? 🤓
Well, it is cheap, but not exactly that.
I bought this OBD2 reader with a display from Aliexpress called a NEXPEAK A203, which I have reverese-engineered and developed my own custom firmware for.
I will release the firmware as open source once I am happy with how it works.
At the moment I am struggling a bit with sleep mode, if I just keep polling for data when the car wants to shut down, that stops the car from going to sleep which is obviously not a good thing.
I can detect when the car is in park, but I have not been able to figure out if/where it is signaled when the car wants to shut down.
I have figured out an algorithm that sort of works, but I am not 100% happy with it yet.
 
At the moment I am struggling a bit with sleep mode, if I just keep polling for data when the car wants to shut down, that stops the car from going to sleep which is obviously not a good thing.
Could that be a workaround for the missing camping/dog mode?
 
I did not. Glad to see people poke these cars and document their findings!
I tried a bit more using Car Scanner custom sensor, however the most I got out of it was "?" instead of "NO DATA"
I tried
0322496D00000000, 22496D00000000, 0322496D etc.
I'm starting to believe my cheapo ELM clone OBD2 adapter might not support 29bit headers: Car Scanner reports "ATSH1DD01635" as "not supported by the adapter"
I've tried through terminal with a 29bit capable obd2 adapter:
ATH1
ATSP6
ATSH1DD01635
0322496D00000000
->FC RX TIMEOUT
I assume the header address or the DID is different for my car (MY2023)
 
I've tried through terminal with a 29bit capable obd2 adapter:


->FC RX TIMEOUT
I assume the header address or the DID is different for my car (MY2023)
I have never tried using the AT commands of an ELM327 directly, so not at all sure, but I would try this:

ATH1
ATSP7
ATSH1DD01635
ATCRA1EC6AE80
03224996D00000000

ATSP7: Protocol 7 should be 29-bit 500 kbit/s, while 6 seems to be 11-bit 500 kbit/s.
ATCRA1EC6AE80: because I think you will need to tell it at what address to expect the answers.

My car is a 2021 model, I think a 2023 should have roughly the same hardware?
 
I have never tried using the AT commands of an ELM327 directly, so not at all sure, but I would try this:

ATH1
ATSP7
ATSH1DD01635
ATCRA1EC6AE80
03224996D00000000

ATSP7: Protocol 7 should be 29-bit 500 kbit/s, while 6 seems to be 11-bit 500 kbit/s.
ATCRA1EC6AE80: because I think you will need to tell it at what address to expect the answers.

My car is a 2021 model, I think a 2023 should have roughly the same hardware?
Hey, thanks for the input! ChatGPT had a lot of input on how to use the ELM327 AT commands, but I should have double checked the ATSP6... :)

I'll try using ATSP7 and the ATCR.
 
Hey, thanks for the input! ChatGPT had a lot of input on how to use the ELM327 AT commands, but I should have double checked the ATSP6... :)

I'll try using ATSP7 and the ATCR.
Still no success for this (NO DATA). I tried


ATH1
ATSP7
ATSH1DD01635
ATCRA1EC6AE80
0322496D00000000

I also tried to send the message using spaces / without trailing 0s (03 22 49 6D)
02 10 03 (Diagnostic Session) also replied with "NO DATA"
 
Still no success for this (NO DATA). I tried


ATH1
ATSP7
ATSH1DD01635
ATCRA1EC6AE80
0322496D00000000

I also tried to send the message using spaces / without trailing 0s (03 22 49 6D)
02 10 03 (Diagnostic Session) also replied with "NO DATA"
Did you put the car in to gear (Any of R N D works)?
 
41 - 60 of 68 Posts