Reverse Engineering the Battery Capacity Message on a Toyota bZ4X and Subaru Solterra

Recently, I delved into reverse engineering the battery capacity messages on the Toyota bZ4X and Subaru Solterra. This post will walk you through the process, focusing on decoding a specific message that reveals the battery's state.

The Command and Response

The key to understanding the battery capacity lies in interpreting the diagnostic messages from the vehicle's electronic control units (ECUs). Below is the command used to request battery capacity data and the corresponding response.

Command

0x221D3E3

• 0x22: Manufacturer-defined service
• 0x1D3E: The parameter ID (PID) requested
• 0x3: Length of response (optional)

Response

0x74F1013621D3E4D8B4D
0x74F218F4D8E4D924D92
0x74F224D904D8D4D8E00

Breakdown

• 0x74F: This identifies the ECU that is responding, which in this case is the Battery ECU.
• 0x10: Indicates a multi-line response.
• 0x13: This denotes the amount of data in the response (0x13 = 19 bytes).
• 0x21: This marks the second response in a multi-line response.
• 0x22: This marks the third response in the multi-line response.

The multi-line response is strung together to form a continuous data stream:

0x621D3E4D8B4D8F4D8E4D924D924D904D8D4D8E

Let's decode the individual components of this response.

Decoding the Battery Capacity

The data points in the response can be interpreted as follows:

1. 0x62: Indicates a response to a manufacturer-defined service.
2. 0x1D3E: The PID being responded to.
3. 0x4D8B: Converted from hex to decimal, this becomes 19,851.
4. 0x4D8F: Converted from hex to decimal, this becomes 19,855.
5. 0x4D8E: Converted from hex to decimal, this becomes 19,854.
6. 0x4D92: Converted from hex to decimal, this becomes 19,858.
7. 0x4D92: Converted from hex to decimal, this becomes 19,858.
8. 0x4D90: Converted from hex to decimal, this becomes 19,856.
9. 0x4D8D: Converted from hex to decimal, this becomes 19,853.
10. 0x4D8E: Converted from hex to decimal, this becomes 19,854.

To convert the values to ampere-hours (Ah), divide the decimal values by 100. The result gives the battery capacity for various battery stacks in Ah. Multiplying this by 355.2V and dividing by 1000 results in the energy capacity of the battery in kilowatt-hours (kWh).

Interpreting the Results

The eight unique values represent data points for the "Hybrid/EV Battery Stack Full Charge Capacity" for stacks 1-8. However, the service manual mentions that there are only four battery stacks in the Toyota bZ4X and Subaru Solterra. This discrepancy suggests that these values might be redundant, or they could be representing subsets of the four main stacks.

Interestingly, the service manual also references another data item called "Latest Hybrid/EV Battery Full Charge Capacity."  I suspect that this data item is contained in the next PID (0x1D3F). Further exploration of this PID could potentially reveal more about the current state of the battery, complementing the data we've already decoded.

For now, I'm going to assume that there are eight sensors, and they all contribute to the total battery capacity. Therefore, the PID request is 0x221D3E, the expected header is 0x747, and the formula for calculating the total battery capacity is:

(((A*256+B)+(C*256+D)+(E*256+F)+(G*256+H)+(I*256+J)+(K*256+L)+(M*256+N)+(O*256+P))/8)*355.2/100/1000

This formula averages the eight sensor values and applies the necessary scaling to convert the result into kilowatt-hours (kWh).

Unfortunately, I was unable to find these data items in Techstream to confirm their exact meaning. The values may correspond to individual cell blocks or other subdivisions within the battery stack.

Conclusion

While there are still some uncertainties about what each data point precisely represents, this analysis provides a valuable starting point for further exploration.