Evmetrics - Jaguar I-Pace OBD2 & CAN Research

JLR Architecture & The I-Pace Battery

Reverse engineering the Jaguar I-Pace requires understanding the Jaguar Land Rover (JLR) diagnostic architecture. Unlike simpler EV implementations, the I-Pace uses a secure gateway and extensive UDS (Unified Diagnostic Services) messaging to access the BECM (Battery Energy Control Module).

🔋

TOPOLOGY

36 Modules

LG Chem Pouch Cells. Arranged in 36 modules (12 cells each). Diagnostics typically report Module Voltages, not 432 individual cells.

🛡️

ACCESS CONTROL

BECM @ 0x7E4

The Battery Energy Control Module usually resides at ID 0x7E4. It responds on 0x7EC. Requires UDS Mode 22.

🔌

CONNECTION

OBD2 Gateway

The OBD2 port is firewalled. Standard requests work, but raw CAN sniffing requires tapping the bus behind the GWM (Gateway Module).

Why Standard ELM327 Apps Fail

Many generic OBD2 apps attempt to use standard Mode $01 PIDs (like 01 0C for RPM). The I-Pace provides very limited data via standard PIDs. To read Cell Voltages or precise SoC, the app must implement ISO 14229 (UDS). This involves sending multi-byte queries to specific controllers.

Mode $01 (Legacy) ❌

Mode $22 (Enhanced) ✅

// Typical JLR Request Flow

TX: 7E4 03 22 49 02 00 00 00

RX: 7EC 10 1A 62 49 02 ...

TX: 7E4 30 00 00 00 00 00 00

RX: 7EC 21 AA BB CC ...

Decoding JLR UDS Mode $22

Interact with the bytes below to understand how the I-Pace communicates battery data. This example shows a request for SoC (State of Charge).

TRANSACTION: READ DATA BY ID (DID)

ISO-TP 15765-2

Request (To BECM)

CAN ID: 0x7E4

03

22

49

02

00

Response (From BECM)

CAN ID: 0x7EC

05

62

49

02

55

AA

Hover over any byte above to decode its meaning.

Reverse Engineered PIDs

Community findings from WattCat, Power Cruise Control, and OpenDBC users. These PIDs are specific to the I-Pace BECM.

Data Point	Service	DID (Hex)	Formula / Notes
State of Charge (Display)	22	0x4902	A / 2.55 (Rough estimate) or raw scaled.
State of Health (SoH)	22	0x498E	Specific to BMS calibration. Often stuck at 100% until software H264 update.
HV Battery Voltage	22	0x4988	(A*256 + B) / 64 (Volts)
Module Voltages	22	0x9900 - 0x9924	Range of IDs for individual modules. Multi-frame response required.
Battery Current	22	0x4983	Signed Integer. Positive = Regen, Negative = Discharge.

⚠️ Warning: JLR ECUs are sensitive.

Aggressive polling (requesting data too fast) can cause the dashboard to light up with "Gearbox Fault" or similar errors. Always use a delay (e.g., 50ms) between UDS requests.

BECM Data Simulator

Simulating the 36 LG Chem Modules found in the 90kWh Pack. Interact with the controls to see how "Voltage Sag" affects the pack under load.

Pack Voltage

398.0 V

Max Imbalance

8 mV

Motor Load (Amps) 0 A

Parked Full Launch

Simulate Module #12 Defect Injects 200mV drop (Bad Cell Group)

Live Visualization

*The I-Pace BMS balances these 36 modules. A delta > 50mV usually indicates a fault requiring module replacement.