Hyundai Kona powertrain components (PCAN)

[projectgus]

I've started a project to document the messaging for the PCAN (powertrain CAN) components of the Kona. The goal is to be able to transplant as much as possible of the powertrain system into a converted vehicle.

Probably this means transplanting:

• VCU & MCU (Vehicle Control Unit, Motor Control Unit). In Kona these are on the same PCB in the "EPCU" unit but they appear to be two different logical controllers with their own CAN connection, CAN IDs, and power inputs. (translation of writeup by Kutato72, Ioniq also looks the same). EDIT: replaced PDF link with translated article link.
• BMS (Battery Management).
• SMK (Smart Key Control Module).
• OBC (Onboard Charger, including DC/DC). This lives in the powertrain "stack" as well, kind of like the Leaf.
• Charge Connector Door Module
• CCM (Charge Control Module, manages CCS2 fast charging communications.)
• EWPs (Electric Water Pumps).
• FATC (A/C Control Module), maybe.

There are also a bunch more PCAN modules that probably won't go in a conversion but may need spoofed/interpreted messages to keep everything happy:

• AAF (Active Air Flap)
• BCM (Body Control Module)
• ACU (ACM in some docs, Airbag/SRS ECU)
• IMEB (Also iBAU in some docs, Integrated Brake Assist Unit, i.e. ABS+brake booster+traction control)
• DATC (Dual Automatic Temperature Control)
• SBC, the "SBW (Shift By Wire) Control Unit" that manages the parking brake lock.

The following do not seem to be needed for a driveable vehicle:

• VESS (Vehicle Engine Sound System, speaker that plays at low speeds)

Hmm, when you write it out it's quite the list!

Smart Key is on the first list of components because it looks like VCU uses it for the immobilizer. Ideally there will be a way around this, but otherwise it's probably needed - hopefully it can just be mounted out of the way with one of the smart keys gaffer taped to it (thanks celeron55 for that suggestion).

Plan B for the EPCU is to use only the MCU functionality and send Torque Request messages from a custom VCU, Zombieverter style. That might be the best way if the Kona VCU turns out to be temperamental or unsuited to being repurposed. But given it's co-located with the MCU, it seems like the natural approach is to try and use it directly (and it also might be the only way, depending on how they are connected internally).

Donor Cars

I have a written-off 2019 Kona:

Smashed Kona with bench PSU, bunch of wires

(Thankfully Hyndai Australia confirmed before I bought this that it has had the battery recall completed, although they couldn't tell me if this particular battery was replaced or not.)

Recently my mate Oli followed me into this foolishness and picked up a 2021 model writeoff. Shown here CAN logging a DC fast charge session before he dropped it off:

Kona 2021 on a truck, plugged to DC fast charger

Oli has even more complex plans for his Kona powertrain, as he wants to incorporate a second charging source...

Logging

After several months delay when I broke a fine-pitched connector (friends don't let friends forward-probe their connectors, folks!) and bricked the car, I converted my car's "Hyundai Data Link Premium" Telemetry T-cable (I think an Australia-only implementation!) into a handy T-cable that breaks out PCAN, CCAN, BCAN and MCAN over CAT5 twisted pairs:

Building the T-cable

Canalyst-II and RJ45 breakout adapter

This connects to the "G" socket on the back of the IGMP CAN gateway/fuse module under the steering wheel, which seems like the most convenient place to get at all of the buses.

Once I solved the connector problem, this has been great. Logs from both cars are posted at https://github.com/projectgus/hyundai-kona-ev-can-logs along with some very early analysis of CAN IDs.

Diagnostics

I've had some luck digging into the diagnostic interfaces. I wanted to be able to read DTCs from all the ECUs, as it can come in very handy. Kona diagnostics seems to be a mix of UDS and KWP-over-CAN, and I think we can now read and clear DTCs from all the modules we care about. Some preliminary code for that is here: https://github.com/projectgus/car_hacki ... ai_kona_ev

I have a couple more things to log while the car is all in one piece, but soon the leap of faith starts of taking it all apart and trying to make it run on the bench...

[EV_Builder]

Well guess what, the autor is on the forum here already

"Kutato72"


" Recently my mate Oli followed me into this foolishness and picked up a 2021 model writeoff. Shown here CAN logging a DC fast charge session before he dropped it off:"

Well...atleast your battery and electronics do'nt seem to be blocked or have damage...

[projectgus]

Well guess what, the autor is on the forum here already

"Kutato72"

I was confused what this means, but I realise you mean that PDF about the Kona EPCU. Excellent news!

Edit: I realised there's a plain HTML version as well that can be easily translated, so I changed the link over.

" Recently my mate Oli followed me into this foolishness and picked up a 2021 model writeoff. Shown here CAN logging a DC fast charge session before he dropped it off:"

Well...atleast your battery and electronics do'nt seem to be blocked or have damage...

Of course we had a very good look at the battery pack (all straight despite two big hits to the body), checked for other damage, and checked the cell voltages before taking it near the DC charger (and it was only charging for about 5 minutes at 24kW, to see the messages during negotiation). There was an EV system fault code showing initially, and it correctly (and as expected) refused to initiate charging. This was because someone (maybe a confused first responder) had unplugged the control harness to the charging port door. Not sure why, maybe they thought this was the safety interlock?

[EV_Builder]

Yes sorry that's what i meant .

About that first responder..
He probably hoped it was a HVIL equiped connector.

[Kutato72]

Well guess what, the autor is on the forum here already
"Kutato72"

Thanks for the mention, I am indeed here too, although my English is a bit weak. My writings about Kona are here in PDF format:

Battery: https://varsanyipeter.hu/hyundai_kona_akku.pdf
Inverter/OBC/DC-DC: https://varsanyipeter.hu/hyundai_kona_trio.pdf

[johu]

Awesome and thumbs up for charging the car on the trailer

[projectgus]

Got together and made a bit of progress today.

Kona with front taken off

EPCU stack being slinged out

Empty Kona engine bay

Motor stack sitting on dolly

Still need to get the HV battery and some interior modules out before looking to bench testing...

The EPCU stack connects to the car via these two plugs in the engine bay fusebox only, which is expected but still good news to confirm it.

Engine bay fusebox connectors

[projectgus]

A little more progress to report, although haven't had as much time to work on this as I'd like.

Battery pack is out (used steel pipes as rollers to move it so close to the ground):

I've written out a pinout for most of the two connectors shown in the previous post. There's a few bits I'm not sure about so I won't post it online until I've verified it (but if you could use the info now, let me know!)

Still have to pull a couple more modules out of the interior, such as the Smart Key Control module, before can think about powering anything on the bench.

Have also started the long process of puzzling out the CAN logs. I'm still getting my head around SavvyCAN and how it expects you to do things.

More to come soon, I hope!

[EV_Builder]

What is your goal with the pack

[projectgus]

What is your goal with the pack

Good question... Hoping to use the battery modules with the OEM BMS and cooling functions. If also using the Kona VCU then hopefully this will mean the BMS is correctly signalling the OEM current limits, etc, which will be quite nice (even if we don't know exactly which CAN message fields it does this in!).

The pack will need the form factor changed. Hoping to emulate Zapatero's approach of breaking up into individual cooling plates, or something like it. Wiring and plumbing the OEM cell modules together between 2-3 separate battery boxes will be a pain, but hopefully not insurmountable.

There is of course a risk that the modifications put the pack sensors out of spec in some way and the BMS trips a fault, but I guess we'll see about that!

For now I'm keeping the pack closed as I want to get the motor turning on the bench first. Figure it's neater/safer to keep that stuff in one sealed box.

[powercontrol]

-- Edited my post as I found out ---

Thanks to you and @vin, I did manage to collect PCAN data from my 2019 eniro 68KWh battery - reference 37501-Q4050 with BMU 375A0-K4050.
for the ones wanting to do the same, the Hyndai/Kia documentation states EB-11 pin12 is not used. It is.
Attached are 2 PDFs, one for the cabling schematic of the EB11 and one for the BMU connectors (B01-C and B01-D)

As stated to @vin, you have made of today a very special day. I could not really sleep after I saw your posts. Many many thanks!

[projectgus]

Great news, I'm glad you figured this out! If you end up with any PCAN logs to share, please do!

[powercontrol]

I have been playing around this weekend, mixing my tests with your wealth of PCAN logs. These have been extremely useful!
Below are my findings so far - I will keep updating the google sheet when I can (sadly, the working week starts...)

https://docs.google.com/spreadsheets/d/ ... sp=sharing

I am parsing your csv with

Code: Select all

grep "<ID>" * | awk -F"," '{print $6,$7,$8,$9,$10,$11,$12,$13}' |sort | uniq

[projectgus]

That's great, thanks for sharing it. I've been struggling to find a format I like for sharing this in-progress decoding work. DBC is a horrible format for humans to read directly, so a spreadsheet may make the most sense!

Similarly I've been doing most of my analysis so far with grep/cut/sed (should learn Awk!) SavvyCAN is useful but I can't quite find a workflow that suits me when the logs have so many unknown fields. I tried building some simple analysis tools with Scapy but finding it slow with large log files.

[Engineer]

Thanks for the mention, I am indeed here too, although my English is a bit weak. My writings about Kona are here in PDF format:

Battery: https://varsanyipeter.hu/hyundai_kona_akku.pdf
Inverter/OBC/DC-DC: https://varsanyipeter.hu/hyundai_kona_trio.pdf

Thanks for sharing your analysis of the Kona battery pack and DC DC inverter. The following links provide an English translation for those that need it.
Thanks again for your help,
John

Disassembled series - Hyundai Kona battery
Written by: Warsaw. Peter -2021-08-10

https://e--cars-hu.translate.goog/2021/ ... r_pto=wapp


Disassembled series - Hyundai Kona inverter/charger/DC-DC
Written by: Warsaw. Peter -2020-10-17

https://e--cars-hu.translate.goog/2020/ ... _tr_pto=sc

[mikeselectricstuff]

I think the CCM is the CCS gateway module for rapid charging, located under the dash near the steering column.
There is a bit of info and pics in the fast charging thresd.

[projectgus]

Thanks Mike, you are totally correct. I've updated the first post.

Also added the SBC ("shift by wire control module") to the list. That's another module under the dash which drives the electronic parking brake lock. it's unlikely to be needed in most conversions, but it has some connections to the EPCU that might need spoofing.

Progress otherwise has been a bit gradual, lots of "works in progress" but nothing significant:

There is now a partial DBC file on GitHub, partly based on others' work (as linked from the README there) and partially from puzzling over CAN logs.

I've been working on a tool to convert local CSV logs & matching videos into a format that can be used with comma.ai's Cabana. I really like this tool for reversing CAN logs (it's a lot less flexible than SavvyCAN, as it's designed for just this one goal/workflow, but as a result it's very streamlined for that one workflow.)

Screenshot of comma.ai's Qt Cabana tool playing back a DC fast charging log and video

The converter tool is still a bit rough, needs manual "massaging" to get a usable result. Once it's usable as-is then I will post it online. (There is also a WIP repo based on the old version of Cabana, but that one is pretty limited. Comma.ai has deprecated that "web Cabana" and moved to a new "Qt Cabana" that runs on the desktop and already supports locally stored files.)

We also made some progress assembling a "bench Kona" to try and turn the motor, although it doesn't do anything exciting yet.

Photo of bench Kona bits

[projectgus]

Made a bit of other progress on the weekend (as well as getting distracted by the Charge Control Module, see the Hyundai CCS thread).

Powered the Shift Selector Switch (SBW) on the bench, it's a very simple module - essentially four buttons with LEDs.

Finished decoding the one CAN message it sends (ID 0x354). and updated the DBC. Also wrote a small tool that sends the one message it listens for (ID 0x200, likely from VCU/EPCU) to display the current gear:
https://github.com/projectgus/car_hacki ... _switch.py

Shift Select Module (SBW) on bench

So simple that it doesn't even care if the counter field in the incoming message is missing!

Pinout is:

1 - Ground (white)
2 - NC
3 - "Button Signal" (blue)
4 - "Gear Position" (yellow/blue)
5 - NC
6 - PCAN H (orange)
7 - PCAN L (green)
8 - NC
9 - 12V when ignition is on (brown)
10 - Memory Power 12V (white/yellow)

The "Button Signal" and "Gear Position" connections are interesting as they wire directly to the EPCU. They seem to be redundancy in case the PCAN link is broken:

Button Signal is a 100kHz 12V PWM signal where the duty cycle reflects the currently pressed button (momentary signal):

Nothing pressed - 50% duty
Reverse - 20% duty
Park - 10% duty
Neutral - 30% duty
Drive - 40% duty

The "Gear Position" line is pulled high at the SBW module end and I think it's likely to be similar, but driven in the other direction so the EPCU can tell the SBW what gear to light up even if the PCAN link is broken.

(I don't know if this info is worth copying to the wiki or not?)

After this a few mates came over and we made some progress with the "bench Kona". It can power on the "secondary EV" relay IG3 and the main ignition relay IG1 from the bench now - and for the first time we saw PCAN traffic as the modules talked to each other. Slow progress, but progress!

[projectgus]

Another small win, a friend who has another wrecked Kona lent me some parts including this EPCU control board (thanks Sam!) Powered on the bench with few other connections, one of the 3 CAN buses produces messages. Have guessed these are all coming from the VCU. Guessing the second PCAN bus connection on the board is probably an independent link to the second MCU microcontroller, which didn't become active during this bench test.

EPCU board on bench

EPCU connector

The third CAN pair on the connector is marked "CCP-CAN (Unused)". It seems to be unpowered, at least in this configuration.

There's a bit more about the connections in use in the CAN log repo, here: https://github.com/projectgus/hyundai-k ... rd-onlycsv

[HeadsUp]

Thanks for all your posts on this.

I have a 2022 Kona motor and transaxle for surgical implant into an ICE vehicle.

I was going to use an aftermarket controller due to the OEM one probably having many dozens of CANBUS inputs that would produce error codes if transplanted into another vehicle , however you appear to have broken this down very well.

Have you identified how to turn off the enquiry mode from the controller for the secondary connected devices so it doesnt look for a diagnostics handshake every split second ?

[projectgus]

I was going to use an aftermarket controller due to the OEM one probably having many dozens of CANBUS inputs that would produce error codes if transplanted into another vehicle , however you appear to have broken this down very well.

Have you identified how to turn off the enquiry mode from the controller for the secondary connected devices so it doesnt look for a diagnostics handshake every split second ?

Hi HeadsUp,

At this point driving the motor from a different inverter/controller will be the path of least resistance, by far.

I'm still working on this project, and overdue to post an update, but no breakthrough to report yet (i.e. motor does not spin on bench)!

Beyond that, there's an additional challenge of whether it's possible to spin the motor without a matching Smart Key Module (SKM) connected. There is a dedicated immobiliser connection from the EPCU to the SKM. I have a matching SKM for mine and a key, so my Plan A is to use those if there's no obvious way to bypass the immobiliser check. Some of the Tesla aftermarket controllers seem to reflash the firmware with a patched version to remove the immobiliser check, but AFAIK noone is working on anything like that for Hyundai.

[HeadsUp]

Do you by any chance have numbers for the voltage range and frequency range that feeds the motor ?

I know the 64 kWHr battery has an operating range of 245 - 421 volts DC but i cant yet find clear numbers for what i should be feeding the motor with.

Whatever drive controller i use , i will also need to test what type of signal the motor shaft encoder puts out so it talks the right lingo with the controller.

I am sure there will be other people investigating this path with the Kona Drive components.

If it was a Tesla there are many modules or boards that can be dropped in to the Tesla controller to allow the home based builder to tweak and customise the Tesla drive integration into their donor conversion ICE vehicle.

Hopefully through the work you're doing we will get closer to the day where we can buy a card , swap out the EPCU card in the Kona controller and program it to dance the way we want.

[projectgus]

Do you by any chance have numbers for the voltage range and frequency range that feeds the motor ?

Oops, I missed the email notification for this post but this morning I saw you had asked the same question on the AEVA forums and I've already replied to you there.

I 100% support trying to get the Kona motor to spin with a different controller, however please continue discussion of this in another thread (maybe this one or a new one), as it's a different challenge to reversing the CAN messages for the OEM controller.

[projectgus]

Something happened!



Still a long way from anything usable in an EV conversion. First, there are a lot of ancillary modules connected.

Second, I didn't capture it on video but the other two times I've turned the motor it has gone into uncontrolled runaway acceleration, only stopping when the Motor Control Unit triggered a "Motor Current" fault. It's a scary experience, and one that I was not adequately prepared for (there's no e-stop button on this thing!)

Here's some of my (guessed) CAN signals from the first runaway event:

Graphs from Cabana

(Graph shows: A short accelerator pedal press and release, the VCU torque request starts climbing linearly, and then eventually it goes into some other state that coincides with relatively big battery transient currents.)

I think what is happening is that the Kona VCU is looking for confirmation of vehicle speed. My laptop was feeding spoofed constant zero wheel speed data, so it thought the car was stationary. So, it progressively ramps up the motor torque request values (i.e. as if the car was parked on a hill or something, it's just trying to get the wheels to start turning.)

Weirdly, the second runaway event happened after switching to Neutral (with the VCU confirming it also thought it was in Neutral). Although again "Neutral" might really mean it's trying to hold the vehicle still, and the wheel speed data said it was already still, so...

Some official Hyundai material seems to support this theory of vehicle speed as the only speed-related feedback to the control loop, such as this Hyundai patent about motor control which includes this figure:

Patent figure

[Pelland]

Thanks projectgus and others for you great work on this.
I've just got a written off 2021 Kona and I'm starting on my own "bench Kona".
Unfortunately my Kona had the motor forcibly removed by a truck, so I have a lot of work to do rebuilding all the wiring connections before I can try powering up.
Looking forward to any progress you make & will post anything I discover along the way.

With regard to the runaway issue you had, is it practical to add a "panic button" that opens one of the many interlock connections on the various plugs? Or is there some disastrous side effect of opening one of these while it's powered up?