Hyundai Kona CCS controller Topic is solved

Development and discussion of fast charging systems eg Chademo , CCS etc
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 89 times
Contact:

Re: Hyundai Kona CCS controller

Post by Jack Bauer »

That's fantastic Mike thanks so much. I should have a module to play with next week. If only the i3 logs were this easy ...
I'm going to need a hacksaw
User avatar
EVconverter
Posts: 17
Joined: Tue Dec 08, 2020 12:42 pm
Been thanked: 4 times

Re: Hyundai Kona CCS controller

Post by EVconverter »

Thanks for all your hard work on this, guys. I wish I had your technical skill in this area. Alas, my talents lie elsewhere.

I will happily work with someone to hammer this out once my build gets to the point where it's self-mobile and charging with a J1772 connector. I happen to live less than a mile from a CCS charger.
User avatar
Jack Bauer
Posts: 3563
Joined: Wed Dec 12, 2018 5:24 pm
Location: Ireland
Has thanked: 1 time
Been thanked: 89 times
Contact:

Re: Hyundai Kona CCS controller

Post by Jack Bauer »

Much appreciated.
I'm going to need a hacksaw
mikeselectricstuff
Posts: 120
Joined: Sun Nov 08, 2020 11:33 am
Been thanked: 2 times

Re: Hyundai Kona CCS controller

Post by mikeselectricstuff »

Looking at the BMW LIM , I think that looks like the better option than the Hyundai for multiple reasons - better availability, reasonable price (even if you have to buy a new one), contactor support etc.
I'm happy to do some logs of mine while charging if anyone really wants it, but I'll wait to see the progress on the i3 LIM for now.
User avatar
brainstorm
Posts: 5
Joined: Sat Jan 22, 2022 3:57 am
Location: Melbourne
Contact:

Re: Hyundai Kona CCS controller

Post by brainstorm »

Hello everyone, I hope this doesn't come across as too off-topic for this thread, but I was theorizing a bit about using my 2021 Kona for V2H purposes... so this hack might tangentially involve the CCS controller ;)

Looking through the following info sources (let me know if there's more around):

1) The information on this thread.
2) The 2020 Hyundai service docs copy (1-day portal) I got from a nice internet guy over email.
3) Mike's video about the HV junction box:



I'm a bit skeptical about what Mike proposed: exposing the front CCS DC pins by forcing the HV junction box relays open and then putting a load on those two pins in the front would work (I'd love that to be possible)?

I guess that the main 3 levels of car systems cross-checking and potential concern for me would be:

1) Battery pack-level BMS circuitry detecting CCS port leakage that isn't accounted for (motor, battery care, cockpit electronics, etc...). Perhaps that CCS controller messages for that warning could be silenced?
2) Some other computer connected to the CAN gateway/hub accounting for that as well?
3) Some electrical isolation in this path I'm not accounting for (similar debate as Tesla's V2G rumored capabilities but ultimately infeasible at a circuit board/mosfet topology level):




I examined the official/public firmware updates for maps (perhaps the same ones they update at the dealership), but most of its payload looks encrypted so I guess that decryption happens on one of the ECUs. If anybody has dumped *that* "main" firmware I'd like to have a look at it with radare2, send me those to brainstorm at nopcode dot org.

Anyway, food for thought, I just wanted to get this out of my chest somewhere and here seems to be the right spot ;)
mikeselectricstuff
Posts: 120
Joined: Sun Nov 08, 2020 11:33 am
Been thanked: 2 times

Re: Hyundai Kona CCS controller

Post by mikeselectricstuff »

My primary reason for not persuing this (yet) is that I don't know how easily any fault conditions can be reset if detected - in particular the isolation monitoring.
From what I currently know, I don't think it monitors the voltage at the DCFC pins on the connector side of the CCS contactors - the DC pins definitely measure open-circuit, and there is nothing in the service manual schematics to indicate any monitoring in the chargeport assembly. I'd probably want to look inside the chargeport to confirm this at some point.
It is possible that there is some monitoring of power draw - as there is no current monitoring in the HVJB, there probably is monitoring within the PTC heater, heatpump, aircon compressor and DC-DC as it can show power drawn by each system onscreen.
My hunch is that it probably doesn't use these for fault detection as it's unlikely to happen in the case of a real fault ( which doesn't trigger isolation monitoring).

Looking at the architecture, it appears that there is no way of it monitoring the CCS current alone, as it's switched to the main battery bus in the HVJB - the only current sensor shown is inside the battery pack. Considering that systems like aircon,PTC and DC/DC can be active during DC charging, it's possible that it doesn't even look at the DC charge current at all (Except maybe as an emergency trip), as it would get messy to discriminate this from current drawn by other systems.

The firmware updates available publicly are only for the infotainment unit, not any of the cars systems. There is very little info exchange between the infotainment and the rest of the car's systems.
I know for a fact that the car works just fine with borked infotainment firmware.

If I knew for definite that any error condition could be cleared without access for Hyundai's tools I'd investigate further.

The other approach would be to pretend to be a CCS charger and initiate a charge session to get it to close the contactors - this would be a cleaner approach and may also be applicable to other cars.
The only possible hurdles is that it may time out if no charge is received, or it may complain if charge current is negative. This is something that is likely to be rather implementation-dependent.

I do know from first-hand conversation with someone who has done it, that this approach works with the VW ID4.
paaa
Posts: 209
Joined: Fri Dec 06, 2019 8:59 pm
Location: Dublin & Kilkenny Ireland
Has thanked: 2 times
Been thanked: 11 times
Contact:

Re: Hyundai Kona CCS controller

Post by paaa »

From my experience with a Kia Niro phev , looking into the manual after 4 starts warning light will reset and dtc will remain as inactive. Also car scanner app seems to work, so might help.Would one of the loop dc current multimeter do and you just put it around charge port dc cabling.
User avatar
brainstorm
Posts: 5
Joined: Sat Jan 22, 2022 3:57 am
Location: Melbourne
Contact:

Re: Hyundai Kona CCS controller

Post by brainstorm »

mikeselectricstuff wrote: Mon Jan 24, 2022 1:33 pm My primary reason for not persuing this (yet) is that I don't know how easily any fault conditions can be reset if detected - in particular the isolation monitoring.
From what I currently know, I don't think it monitors the voltage at the DCFC pins on the connector side of the CCS contactors - the DC pins definitely measure open-circuit, and there is nothing in the service manual schematics to indicate any monitoring in the chargeport assembly. I'd probably want to look inside the chargeport to confirm this at some point.
It is possible that there is some monitoring of power draw - as there is no current monitoring in the HVJB, there probably is monitoring within the PTC heater, heatpump, aircon compressor and DC-DC as it can show power drawn by each system onscreen.
My hunch is that it probably doesn't use these for fault detection as it's unlikely to happen in the case of a real fault ( which doesn't trigger isolation monitoring).

Looking at the architecture, it appears that there is no way of it monitoring the CCS current alone, as it's switched to the main battery bus in the HVJB - the only current sensor shown is inside the battery pack. Considering that systems like aircon,PTC and DC/DC can be active during DC charging, it's possible that it doesn't even look at the DC charge current at all (Except maybe as an emergency trip), as it would get messy to discriminate this from current drawn by other systems.

The firmware updates available publicly are only for the infotainment unit, not any of the cars systems. There is very little info exchange between the infotainment and the rest of the car's systems.
I know for a fact that the car works just fine with borked infotainment firmware.

If I knew for definite that any error condition could be cleared without access for Hyundai's tools I'd investigate further.

The other approach would be to pretend to be a CCS charger and initiate a charge session to get it to close the contactors - this would be a cleaner approach and may also be applicable to other cars.
The only possible hurdles is that it may time out if no charge is received, or it may complain if charge current is negative. This is something that is likely to be rather implementation-dependent.

I do know from first-hand conversation with someone who has done it, that this approach works with the VW ID4.

Thanks Mike for addressing many of my points, much appreciated!

I've just edited my original post adding the two Tesla V2G videos for which I'm a bit concerned (which refer to point 3)... I'm not sure if Hyundai's CCS power systems are anywhere similar to Tesla's, but the author of the videos makes a compelling case as to why the board as-is for sure cannot handle high currents if it's not for the regular CCS charging usecase by examining how mosfets are arranged. In other words: setting aside the fault clearing stuff via software, how can we make sure that the current handling capacity for the involved V2X usecase will not surpass (blow?) something in that path?
mikeselectricstuff
Posts: 120
Joined: Sun Nov 08, 2020 11:33 am
Been thanked: 2 times

Re: Hyundai Kona CCS controller

Post by mikeselectricstuff »

Any V2H/V2G type application is going to be doing way less current than the car running or rapid charging, so the answer is simple - just put fuses in line with whatever you are connecting.
This can easily be done inside the CCS connector, as we'd typically be looking in the low tens of amps range.
The car audio industry do some in-line holders for 38mm cartridge fuses
Img_0423.jpg
paaa
Posts: 209
Joined: Fri Dec 06, 2019 8:59 pm
Location: Dublin & Kilkenny Ireland
Has thanked: 2 times
Been thanked: 11 times
Contact:

Re: Hyundai Kona CCS controller

Post by paaa »

Does anyone have and can logs of one of the 28kwh ionic charging hoping to pickup battery pack charge connector and charge control module, just want to see what else is on powertrain can message wise is missing.
paaa
Posts: 209
Joined: Fri Dec 06, 2019 8:59 pm
Location: Dublin & Kilkenny Ireland
Has thanked: 2 times
Been thanked: 11 times
Contact:

Re: Hyundai Kona CCS controller

Post by paaa »

found on the internet
Attachments
charger-CCS.log
(348.23 KiB) Downloaded 298 times
User avatar
uhi22
Posts: 771
Joined: Mon Mar 14, 2022 3:20 pm
Location: Ingolstadt/Germany
Has thanked: 111 times
Been thanked: 471 times

Re: Hyundai Kona CCS controller

Post by uhi22 »

Just saw this thread. I own a Ioniq28 and could provide some CAN traces, if this helps. On the orange/green CAN distributor under the hood near to the right wheel I made measurements and found some interesting signals from BMS (current, voltage) for https://github.com/uhi22/IoniqMotorCAN. Not sure whether this is the same CAN where also the CCS interface is connected. But at least I found also the CCS inlet voltage on this CAN, which shows 500V during the CableCheck phase. The CCS Inlet voltage is in message 0x542, byte 6 and 7, scaled in 0.1V.
User avatar
uhi22
Posts: 771
Joined: Mon Mar 14, 2022 3:20 pm
Location: Ingolstadt/Germany
Has thanked: 111 times
Been thanked: 471 times

Re: Hyundai Kona CCS controller

Post by uhi22 »

Added a CAN trace and a CAN message definition file (DBC) of a CCS charging session of Ioniq28 (model year 2018) into https://github.com/uhi22/IoniqMotorCAN/ ... ter/Traces
peternooy
Posts: 26
Joined: Wed Jul 06, 2022 3:35 pm
Has thanked: 5 times
Been thanked: 14 times

Re: Hyundai Kona CCS controller

Post by peternooy »

mikeselectricstuff wrote: Mon Jan 24, 2022 1:33 pm The other approach would be to pretend to be a CCS charger and initiate a charge session to get it to close the contactors - this would be a cleaner approach and may also be applicable to other cars.
The only possible hurdles is that it may time out if no charge is received, or it may complain if charge current is negative. This is something that is likely to be rather implementation-dependent.

I do know from first-hand conversation with someone who has done it, that this approach works with the VW ID4.
Several month ago, I did similar test with MG EP 2022 (a Chinese made EV). I hook this car with my EVSE which has "power module" disabled, and start a charging session. The process stop at PreCharge, which is correct. The vehicle will loop for PreCharge voltage to reach the required level if not it will timeout in 7 sec. (session data attached)

To me the approach to trick a car to close it's DC contactor, thinking it is being charge will not work. There are many steps down the chain that will break.

Anyway, I aggreed with Mike that we should acquire knowledge to reset "HV fault" before moving futher. Then try inject CAN command to close DC contactor and see what else will break.

Edit 1: Add the pcap file for test session with BYD-ATTO3, same result (session stop) but with slighly different behaviour. The ATTO3 send SessionStopReq right a way when receive PreChargeResponse message. I guess it panic when learn that voltage level specified in V2G message (419 v) is differ from actual value presented at charge port (0 v).
Attachments
byd-atto3-3.pcap00.zip
(3.3 KiB) Downloaded 198 times
mg-ep9.pcap00.zip
(25.25 KiB) Downloaded 190 times
User avatar
projectgus
Posts: 47
Joined: Tue Dec 08, 2020 10:33 am
Location: Castlemaine, Australia
Has thanked: 23 times
Been thanked: 14 times
Contact:

Re: Hyundai Kona CCS controller

Post by projectgus »

uhi22 wrote: Fri Jan 13, 2023 6:52 am Added a CAN trace and a CAN message definition file (DBC) of a CCS charging session of Ioniq28 (model year 2018) into https://github.com/uhi22/IoniqMotorCAN/ ... ter/Traces
This DBC file is amazing, thank you! I've only had a quick look, but it seems like many messages are the same as the Kona. This will save many hours of staring at dumps! :D

May I ask where the file is from? It looks like part of it is the same as opendb's hyundai_kia_generic.dbc, but only part. Did you create this yourself?

BTW folks, there are now two 2021 Kona DC fast charge PCAN logs in this repo: https://github.com/projectgus/hyundai-kona-ev-can-logs - one from a charge session that didn't initiate due to a fault and one from a normal charge session. (See this thread for more info on related Kona project.)
User avatar
uhi22
Posts: 771
Joined: Mon Mar 14, 2022 3:20 pm
Location: Ingolstadt/Germany
Has thanked: 111 times
Been thanked: 471 times

Re: Hyundai Kona CCS controller

Post by uhi22 »

Yes, I took the opendb file and hoped that it helps me, but a lot of messages did not match with my CAN. So I kept only some which may still be applicable, but also these may be misleading. By analyzing some raw traces, I found out some interesting signals and created their definitions from scratch. I have some more on my paper scripts, still with questionmarks and guesses.Made also some timing analysis to understand which messages come from the same control units.
User avatar
uhi22
Posts: 771
Joined: Mon Mar 14, 2022 3:20 pm
Location: Ingolstadt/Germany
Has thanked: 111 times
Been thanked: 471 times

Re: Hyundai Kona CCS controller

Post by uhi22 »

Back to the Kona / Ioniq CCS controller topic: According to what it reports for a GetSoftwareVersion, it contains a QCA7005. I'm playing with the idea, to find out what a QCA7005 would need to be happy, with the goal to connect it to any controller. Just needs SPI as I understood. At the moment I see the QCA7005 for around 17 dollars in low quantity here: https://www.digipart.com/part/QCA7005-AL33
If somebody has an Ioniqs (or Konas) charge control module flying around and does not need it, maybe it's possible to donate it for a deeper analysis.
User avatar
uhi22
Posts: 771
Joined: Mon Mar 14, 2022 3:20 pm
Location: Ingolstadt/Germany
Has thanked: 111 times
Been thanked: 471 times

Re: Hyundai Kona CCS controller

Post by uhi22 »

I could not resist, removed the driver seat, found the CCM and started some investigations. Not more than we already read above, but always nice to see it with the own eyes :-) Stored the results here: https://github.com/uhi22/Ioniq28Investigations
User avatar
larsrengersen
Posts: 114
Joined: Tue May 28, 2019 9:42 am
Has thanked: 9 times
Been thanked: 24 times

Re: Hyundai Kona CCS controller

Post by larsrengersen »

uhi22 wrote: Sun May 28, 2023 8:05 pm If somebody has an Ioniqs (or Konas) charge control module flying around and does not need it,
Where are you based?
Think I have one and won’t use it on short notice.
Can at least borrow it to you and donate/sponsor the shipping costs.
Send me an e-mail lars (at) evcreate (dot) nl if that helps so we can discuss things further and send it to you.
User avatar
uhi22
Posts: 771
Joined: Mon Mar 14, 2022 3:20 pm
Location: Ingolstadt/Germany
Has thanked: 111 times
Been thanked: 471 times

Re: Hyundai Kona CCS controller

Post by uhi22 »

I'm in southern Germany. I think borrowing will not work, because there are good chances that it will not survive. I plan to read out the SPI flash (should be possible) and if I find the equipment, will try to connect to the controllers debug port and make a dump of its memory. Just to see what is possible. I see the risk that something goes wrong and the unit is bricked. For the "uncritical tests" I can use the unit from my car.
User avatar
larsrengersen
Posts: 114
Joined: Tue May 28, 2019 9:42 am
Has thanked: 9 times
Been thanked: 24 times

Re: Hyundai Kona CCS controller

Post by larsrengersen »

Ok, I see. Well, then I'll just donate it. I've not followed everything in detail. But from what I've heard you did a lot of work for an Opensource CCS solution. So I'm happy to contribute to that by donating the unit including shipping. Can you send me an e-mail (lars (at) evcreate (dot) nl) with your details? And I'll send it to you.
User avatar
uhi22
Posts: 771
Joined: Mon Mar 14, 2022 3:20 pm
Location: Ingolstadt/Germany
Has thanked: 111 times
Been thanked: 471 times

Re: Hyundai Kona CCS controller

Post by uhi22 »

While Lars' Kona controller is still on the way to me (many many thanks for this), I took my Ioniqs CCM on the bench, and investigated its CAN requirements. Turns out, that it does not need much to be happy: We need to sent three CAN messages to it, and it sends four messages. Not all content of these is clear at the moment. Found a "CCS trigger bit" which seems to start the PLC communication, and also the SOC which it needs.
Updated the data base: https://github.com/uhi22/IoniqMotorCAN/ ... 8Motor.dbc and added the latest news into https://github.com/uhi22/Ioniq28Investi ... nalysis.md
Let's hope that are no real differences between the Ioniq and the Kona part.
User avatar
projectgus
Posts: 47
Joined: Tue Dec 08, 2020 10:33 am
Location: Castlemaine, Australia
Has thanked: 23 times
Been thanked: 14 times
Contact:

Re: Hyundai Kona CCS controller

Post by projectgus »

Nice work @uhi22, this is very exciting!

You inspired me to dig out my Kona CCM module and power it up on the bench. The messages so far look the same as what you've documented.

I guessed at a few more possible signals, based on the Kona DC fast charge log:
https://github.com/projectgus/hyundai-k ... 329621b212

In message 0x599 from the BMS there is another "trigger" bit (I named it CCS_CHARGE_TRIGGER for now) that goes high after the first trigger bit, just before charging starts. It stays high for the whole charge session.I guess it's either going to be a trigger for pre-charge or a signal that the EV has closed contactors. I see the "CCS_CCM_error" bit you found from the CCM message is set when the charge session ends (in my log, it is ended at the EVSE via the charge network app.) Immediately on seeing receiving a message with the CCS_CCM_error bit set the BMS 0x599 message clears the CCS_CHARGE_TRIGGER bit and sets another bit (I named CCS_error_ack), which seems to indicate the charge session is done.

Replaying my Kona DC fast charge logs into the CCM, it hasn't done anything interesting. I tried with the CCM's Control Pilot signal floating, and also with it pulled up to 12V through a 1K resistor. I'm guessing I must provide the J1772 EVSE 1kHz PWM signal with 5% duty cycle for it to wake up, is that right? Have you been injecting this signal for your tests?

A friend is dropping around tomorrow with a GreenPHY board, so we'll probably try to get bidirectional CCS2 communication up and running then.
User avatar
projectgus
Posts: 47
Joined: Tue Dec 08, 2020 10:33 am
Location: Castlemaine, Australia
Has thanked: 23 times
Been thanked: 14 times
Contact:

Re: Hyundai Kona CCS controller

Post by projectgus »

Oh also, the microcontroller debug port CON3 on the board looks the same as the eval board debug pinout for this family of MCU:
Screenshot of eval board JTAG port
Screenshot of eval board JTAG port
(Source document.)

It looks like the same family of microcontrollers is used inside the Kona and Ioniq EPCU units. On some boards the exact same debug header is used, too!

There are some old-ish patch sets to add support for the "e200 Power" CPU family to openocd, for example here. I haven't looked to see if the vendor debugger software is free to download.
User avatar
uhi22
Posts: 771
Joined: Mon Mar 14, 2022 3:20 pm
Location: Ingolstadt/Germany
Has thanked: 111 times
Been thanked: 471 times

Re: Hyundai Kona CCS controller

Post by uhi22 »

projectgus wrote: Sat Jun 03, 2023 5:43 am Replaying my Kona DC fast charge logs into the CCM, it hasn't done anything interesting. I tried with the CCM's Control Pilot signal floating, and also with it pulled up to 12V through a 1K resistor. I'm guessing I must provide the J1772 EVSE 1kHz PWM signal with 5% duty cycle for it to wake up, is that right? Have you been injecting this signal for your tests?
I did not find any "evaluation logic" on the CP pin of the CCM, only the RF path via the RF transformator. My impression is, that the CCM does only handle the RF (PLC) part, and that the PWM logic is always handled by the OBC, no matter whether it is DC or AC charging. I used pyPlc in the EvseMode (https://github.com/uhi22/pyPLC/blob/mas ... vseMode.md). I had 12V on the CP provided by the Evse via 1k, this did not change, so the Evse did not even provide the 5% PWM. Nevertheless, the PLC modem is listening and received the first message (SlacParamRequest), and the communication continued.
If you measure the CP pin with oscilloscope, you will normally see nothing, but shouldn't be the car the first one who sends a message, the SlacParameterRequest? It took me quite a while to understand this. The answer is: Yes, the car sends this message, and it is the first message. But it only sends it, if there is a HomePlug coordinator on the line, which sends cyclically its coordination packages. On my car it worked, by just have a public CCS charger plug 20cm besides my test setup, without any connection to it, just the radiated coordinator packets helped. The clean solution is, to use a homeplug modem which is configured as Evse side, this will send the coordinator packages.
Post Reply