evmetrics
ECU Database
Every mapped ECU address, the hardware manufacturers behind them, and the silicon that connects them — because when two vehicles share the same chip, what we learn on one applies to both.
How OBD talks to ECUs
The OBD port is a gateway onto the vehicle's CAN bus. Every ECU on the bus has a CAN TX header address (e.g. 7E4).
Sending ATSH 7E4 to the ELM327 adapter directs subsequent UDS frames to that ECU.
EVMetricsOBD uses UDS ISO 14229 Service $22 (Read Data By Identifier) to query each ECU — the same service manufacturers use in dealership diagnostic tools.
A request of 22 XX XX to header 7E4 asks the BECM for a specific data identifier (DID). The ECU replies with a raw hex byte stream that a formula converts to a human-readable value (e.g. 91.5% SoC).
The key insight: once we know the DID addresses and formulas for one ECU, we can apply that knowledge to any vehicle using the same ECU hardware.
14 ECUs · Best-in-class coverage
The I-Pace has a 3-bus CAN topology. Most ECUs live on HS-CAN (500 kbaud, ATSP6); body and TPMS ECUs may be on MS-CAN (125 kbaud).
| Header | ECU Name | Function | Supplier / Hardware | Status |
|---|---|---|---|---|
| 7E0 | ECMEngine/Vehicle Control Module | Speed, odometer, DTC counters, 12V via Mode $01 | Denso / JLR (powertrain gateway) | Confirmed |
| 7E4 | BECMBattery Energy Control Module | HV battery: voltage, current, SoC, SoH, cell voltages, thermal, module banks | Continental / JLR BEV — NXP MPC5xxx core | Confirmed |
| 7E5 | BCCMBattery Charger Control Module | On-board charger control; AC charging management | Brusa / JLR supply chain | Research |
| 726 | BCMBody Control Module | Lighting, locking, power distribution | Continental / JLR — NXP S32K or MPC5xxx | Mapped |
| 730 | PSCMPower Steering Control Module | Steering angle, steering torque, ADAS input | ZF / TRW — Infineon TriCore based | Research |
| 733 | HVACClimate Control Module | Fan RPM, refrigerant pressure, duct temps, seat heating, interior sensors | Behr-Hella / JLR — NXP or Renesas MCU | Confirmed |
| 736 | PAMParking Aid Module | Ultrasonic proximity sensors, parking assist | Valeo / Bosch | Research |
| 751 | TPMSTyre Pressure Monitoring System | Tyre pressure (PSI) and temperature (°C) per corner | Huf Secure Mobile — RF receiver + CAN gateway | Confirmed |
| 753 | DCDCDC-DC Converter Module | HV to 12V conversion; 12V rail management | Continental / Shinry Technologies | Mapped |
| 764 | ASCMActive Speed Control Module | Adaptive cruise control, forward collision sensing | Bosch / Continental radar ECU | Research |
| 797 | SASMSteering Angle Sensor Module | Steering wheel angle rate for ADAS / stability control | Bosch / ZF — embedded in steering column | Research |
| 7E2 | BBMBattery Boost Module | 12V battery boost / EV pre-charge control | JLR internal | Research |
| 7C4 | SODLSide Object Detection Left | Blind spot monitoring — left side radar | Bosch LRR / SRR radar module | Research |
| 7C6 | SODRSide Object Detection Right | Blind spot monitoring — right side radar | Bosch LRR / SRR radar module | Research |
Key ECUs across upcoming platforms
| Header | ECU | Platform | Function | Supplier / Silicon | Status |
|---|---|---|---|---|---|
| 7E4 | BMCBattery Management Controller | Hyundai/Kia E-GMP | Full HV battery: SoC, SoH, cells, thermal, pack V/I | LG Energy Solution / Hyundai Mobis — Infineon or Renesas RH850 | Research |
| 7E2 | VMCUVehicle Management Control Unit | Hyundai/Kia E-GMP | Motor torque, regen level, charge power, stability control | Hyundai Mobis — Infineon AURIX TC27x | Research |
| 7A0 | BCMBody Control Module | Hyundai/Kia E-GMP | TPMS (all 4 tyres in one response), locking, lighting | Continental / Hyundai — NXP S32K | Confirmed |
| 7C6 | ClusterInstrument Cluster | Hyundai/Kia E-GMP | Odometer (3-byte km), display SoC, trip data | Visteon / Hyundai Mobis | Confirmed |
| 770 | GatewayCentral Gateway | Hyundai/Kia E-GMP | CAN routing, OBD2 Mode $01 translation | Continental / Aptiv — NXP S32G | Mapped |
| 7E4 | BMSBattery Management System | VW MEB Platform | SoC, charging data, battery temps in hvBattery group | Samsung SDI / VW in-house — Infineon AURIX TC27x (Bosch BMS firmware) | Research |
| 7E4 | HVBJBHV Battery Junction Box | Ford EV (BEV3/GE2) | Full battery: voltage, current, SoC, SoH, cell voltages, thermal | Ford/Continental — NXP MPC5xxx or S32K based | Research |
| 6B4 | BMUBattery Management Unit | Stellantis e-CMP / STLA Small | Full battery: voltage, current, SoH, cell voltages, thermal | Saft / PSA in-house — STMicroelectronics SPC58x (PSA tradition) | Confirmed |
| 6A2 | VCUVehicle Control Unit | Stellantis e-CMP / STLA Small | SoC, vehicle speed, ambient temperature gateway | Continental / PSA — STMicro SPC5xxx | Confirmed |
| 7E4 / LBC | LBCLithium Battery Controller | Renault CMF-B (Zoe) | SoC, pack voltage; ZE50 uses 29-bit CAN extension | Renault / LG Chem — STMicro SPC560 family | Confirmed |
| 797 | BMSBattery Management System | Nissan Leaf / CMF-EV | SoC via GID count, pack voltage, temperature | Calsonic Kansei (now Marelli) — Renesas SH-7055 (ZE0/ZE1) / RH850 (Ariya) | Confirmed |
| D01635 | BECMBattery Energy Control Module | Volvo/Polestar CMA | SoH (4-byte DID), SoC via Mode $01 gateway; 29-bit extended CAN | Zenuity / Volvo Cars — Renesas RH850 P1x series | Confirmed |
| 7E4 | BMSBattery Management System | Porsche J1 / PPE, Audi e-tron GT | SoC and pack-voltage DIDs identified; full data TBD | Samsung SDI / Bosch — Infineon AURIX TC29x (shared with VW Group) | Research |
| 7A2 | PKCPower and Key Control | Fisker Ocean | ECU identification only; direct BMS unconfirmed | Magna / Fisker — unknown | Research |
The chips inside automotive ECUs
Automotive ECU suppliers design hardware around a handful of MCU families from a few chip manufacturers. Understanding who makes the silicon — and which vehicles share it — is the key to cross-platform PID research.
AURIX TriCore TC2xx / TC3xx
Why this matters: If we confirm a DID address on a VW MEB BMS, there is a strong probability the same address exists on Porsche J1/PPE and Audi e-tron GT — all run Bosch BMS firmware on AURIX silicon. Differences appear at the formula level, not the service level.
MPC5xxx / S32K / S32G PowerPC
Why this matters: JLR BECM (7E4), Ford HVBJB (7E4) and Hyundai BCM (7A0) are all believed to use NXP-based Continental hardware. The UDS service structure (DID ranges, response framing) tends to be consistent across Continental firmware — knowledge from the I-Pace BECM DID map can guide hypothesis-formation for Ford and Hyundai battery ECUs.
SPC5xxx / SPC58x Automotive
Why this matters: Stellantis e-CMP and Renault CMF-B share the same ECU silicon tradition. The internal DID address structure mapped for the Stellantis BMU provides a framework for cross-referencing against Renault's equivalent range on similar hardware generations.
RH850 / SH-7055 / R-Car
Why this matters: The Nissan Leaf BMS (Calsonic/Marelli) and Volvo CMA BECM both use Renesas. The 29-bit extended CAN approach on Volvo's BECM D01635 is a Renesas hardware feature (AUTOSAR MCAL layer). Similar patterns appear in the Ariya BMC, suggesting the ZE0→Ariya upgrade path shares firmware conventions.
TMS570 / C2000 / BQ-series BMS ICs
Why this matters: Ford HVBJB (7E4) uses TI BQ-series cell monitoring ICs at the analogue layer, with a CAN-connected MCU handling UDS. The data addresses reflect the way TI BMS data is packed into 16-bit registers — a pattern that may appear in other vehicles sourcing batteries from the same LG/Ford supply chain.
Bosch BMS / EDC17 / ME17 firmware
Why this matters: If a PID is confirmed on one Bosch-firmware BMS, there is a high probability the same DID exists on Porsche J1 and Audi e-tron GT — because all three use the same Bosch BMS firmware build, just with different calibration constants. This cross-manufacturer DID consistency has been confirmed internally across the Porsche J1 and VW MEB platforms.
Silicon families = shared DID structure
The research strategy for expanding platform coverage is built around silicon and firmware family analysis. Each confirmed PID on a known platform becomes a hypothesis for all platforms sharing the same supplier chain.
Bosch BMS family (VW MEB → Porsche J1 → Porsche PPE)
All three platforms use Bosch BMS firmware on Infineon AURIX silicon. The DID address map is shared at the firmware base layer — only calibration constants differ between vehicle variants. Confirmed: the SoC and pack-voltage DIDs are present and return the same byte format on all three. This cross-confirmation is not coincidence — it is direct evidence of a shared firmware base.
Research hypothesis: VW MEB SoH-candidate DIDs (currently in research) will likely yield matching addresses on Porsche J1/PPE. Confirming SoH on VW MEB unlocks it for both Porsche platforms simultaneously.
Continental/NXP family (JLR BECM → Ford HVBJB → E-GMP BCM)
JLR BECM (7E4), Ford HVBJB (7E4) and the E-GMP BCM (7A0) are all supplied by Continental or tier-1 partners using NXP PowerPC (MPC5xxx or S32K) silicon. The UDS service $22 framing, flow control (ATFC) requirements and response structure are consistent across Continental firmware.
Research hypothesis: The JLR BECM DID range is JLR-proprietary, but the pattern of using a fixed high-byte address prefix per ECU is a Continental firmware convention. Applying the same prefix-sweep strategy to Ford and Hyundai battery ECUs is the correct research approach.
STMicro SPC5 family (Stellantis BMU → Renault LBC)
Stellantis (PSA/FCA) and Renault share decades of joint platform development and both use STMicroelectronics SPC5xxx ECU silicon in their battery management hardware. The Stellantis BMU (6B4) and Renault LBC (7E4) address spaces differ — but the UDS service structure, response framing and byte packing conventions (e.g. signed int16 for current, A-40 thermal offsets) are consistent.
Research hypothesis: Renault Zoe R90/R110 battery parameter DIDs are confirmed and documented internally. The STMicro convention of grouping related DIDs in sequential addresses suggests Renault Zoe R135/ZE50 extended-CAN battery data follows the same numbering scheme in an adjacent range — pending confirmation of the 29-bit extended addressing.
Renesas family (Nissan Leaf BMS → Volvo CMA BECM → Nissan Ariya)
The Nissan Leaf BMS (Calsonic/Marelli, Renesas SH-7055 Gen 1) and Volvo CMA BECM (Renesas RH850) share the same MCU manufacturer. The Renesas AUTOSAR MCAL layer includes native CAN extended-frame support — explaining why Volvo's BECM uses 29-bit CAN (ATSP7 + ATCP1D + ATSH D01635) while most other vehicles stay at 11-bit.
Research hypothesis: The Nissan Ariya BMC likely uses a newer Renesas RH850 variant (matching the Volvo BECM generation). If Ariya uses 29-bit extended CAN for BMS access, the addressing pattern would be analogous to Volvo CMA — and SoH data accessible via a similar 4-byte DID structure.
Common CAN header addresses
Many vehicles share the same OBD-II standard header ranges, which is why 7E0–7EF is a reliable starting point for any new vehicle investigation.
| Header range | Standard use | Notes |
|---|---|---|
| 7DF | OBD2 functional broadcast (all ECUs) | Mode $01/$03 queries broadcast to all responding ECUs |
| 7E0 | Engine / PCM (ISO 15765-4 default) | Standard engine ECU address across all OBD-II compliant vehicles |
| 7E1 | Transmission / TCM | JLR TCM confirmed; many other OEMs use this address |
| 7E4 | BMS / BECM (de facto EV standard) | Used by JLR, E-GMP, VW MEB, Ford, Porsche J1/PPE — not mandated by any standard but convergently adopted |
| 7E8–7EF | ECU responses to 7DF broadcast | 7E8 = ECM reply, 7EC = BECM reply (7E4+8) |
| 7C0–7CF | Body/safety modules | ADAS, radar, LIDAR — OEM-specific |
| 700–76F | Body/comfort modules | BCM, HVAC, TPMS, parking aid — OEM-specific addressing |
| 6xx | Extended body/domain modules | Stellantis uses 6B4 (BMU), 6A2 (VCU) — non-standard OEM allocation |
| 18DAxxF1 | 29-bit extended CAN (ISO-TP) | Used by Volvo CMA BECM (D01635), some Renault ZE50 LBC, some gateway modules |