How to generate valid zones in a JSON? (e.g. Traction Battery for Peugeot e-208)

[veecle-stefan]

BMU_CTE1.json
Hi everybody,

I hope I didn't overlook any documentation, but I couldn't find any systematic way of creating a JSON file for a not-yet supported ECU.

I will describe what I did to create my JSON for the battery management system (BMU_CTE1) on a Peugeot e-208.

---

Background

The BMU on the e-208 is supplied by CATL. The ECU identifiers are:

• TX ID: 6B4
• RX ID: 694
• Protocol: uds
• ECU name: CATL-BMU_CTE1 EMC00 (from zone F08F)

---

How I found the zones

I started from the JSON files for already-supported ECUs in the repo to understand the format, then wrote sweep JSONs that query zone addresses systematically using the UDS ReadDataByIdentifier (service 22) request.

A few things I learned along the way:

No security access needed for reading. All zones below are readable in extended diagnostic session (1003) without unlocking security. I deliberately did not attempt security access or any writes.

Ranges swept:

• Full (all 256 addresses): F0xx, F1xx, C0xx, D8xx, D9xx, DAxx, DBxx, 0Dxx
• Sparse (xx00, xx01, xx02 per high byte): 02xx–EFxx
• Sparse (xx00 + xx10–xxF0 steps): F2xx–F9xx
• Also checked: 22xx–29xx, B0xx, D0xx, E0xx, E1xx–E8xx

---

Confirmed zones

55 zones respond in total. The attached BMU_CTE1.json includes all of them. I haven't decoded scaling factors yet — zone names in the data tab are just their address for now.

Standard UDS identification (F0xx / F1xx): part number, serial, SW/HW version, production date, ZA/ZI zones — all standard PSA UDS ident, nothing surprising.

Live sensor values — cross-referenced with CarScanner, these are confirmed telemetry DIDs (not configuration zones):

Zone	Notes
D810	Pack voltage
D815	Pack current
D816	Cumulative charge
D817	Temperature
D860	Cell configuration
D861	Min cell voltage
D865	Power
D86F	–
D870	–

Remaining unclassified zones — respond with data, unknown purpose, could be config/telecoding or additional telemetry:

D802, D811, D812, D813, D814, D822, D862, D863, D866, D867, D868, D869, D86A, D86C, D86D, D871, D872, D873, D874, D875, D876, D877, D878, D87A, D87B, D87C, D87D, D87E, D87F, D89C, D89D, D89E, D900, D901, E082

---

Open questions

1. More systematic way to convert DiagBox → JSON: I'm using DiagBox to interact with all ECUs and then sniff the traffic using an OBD Y-splitter. Is there a more systematic way? In the DiagBox directory I see a lot of tele_xxx folders with what looks like XML-based ECU descriptions — has anyone parsed those to extract zone definitions directly?

2. Cell voltage coding — In a recall in June 2023, the dealer updated the coding and the car has since charged only to 4.08V/cell instead of the previous 4.15V. I'd like to find where this limit is stored, at least for reading. It doesn't appear to be exposed via any ReadDataByIdentifier address in the ranges I swept, so it might be embedded in a multi-value payload in one of the unclassified zones above — or perhaps in the tele_xxx files.

3. Security key for writing — The ZI zone (F0FE) contains 0107 at bytes 4–5, which matches the VCU key on this platform. I haven't confirmed whether this also works for the BMU.

4. D900 / D901 — Both respond but return all zeros across multiple reads. Possibly unwritten telecoding zones, possibly reserved.

---

Any pointers welcome — especially from anyone who has worked on other PSA EV ECUs (e-2008, Corsa-e, Mokka-e) where the BMU might be the same CATL unit.