Hyundai Kona powertrain components (PCAN)

[Pelland]

Hi Projectgus,

I have had good luck getting diagnostics using an OBDLink LX dongle and this Android app

I got the bluetooth module to try the android app. I must confess I wasn't expecting much as I paid more for shipping than the module.

I have been looking at ScanDoc for a while, but wanted to wait until I at least had something running before parting with lots of money.
On line demo here https://scandoc.online/last/0/32/2/72/3/0

I looked at the OBDLink LX dongle you linked to and it's relatively pricey, compared with the one I have, but less than ScanDoc. However since ScanDoc looks to match the Hyundai software I've decided to buy that. Fingers crossed it's as good as it says.

I think you're right about only UDS. I've run a set of UDS scans from Savvycan and it's found a whole list of addresses that respond.
I'll put them up on github once I've done some more work on confirming which module matches which ID.

Now for some pictures for those interested.

a new look "Battery Kona"

No HV connections yet, don't want to let the magic smoke out too soon.

A most surprising result from first power up.

I was quite surprised by how much came straight up.
Running my scan tools didn't show very much and I wondered why I wasn't getting anything from the BMS or motor.

I had started by putting in one fuse at a time while checking the current draw. When I got to the IG3 fuses that's when everything came to life, with a load warning buzzer.
Then I realized I populated all the main fuses but hadn't got to the fuses in the PCB block.
Added them and current draw increase but still nothing. While looking for an easy place to T into the P-CAN bus I discovered that it doesn't go directly between the main and front loom. It goes right around the car via the floor loom.
After all the rabbit hole mentioned previously I'm now getting lots of good data.

[projectgus]

Great stuff, Pelland! I'm really impressed you got the vehicle to come up in that state.

I have been looking at ScanDoc for a while, but wanted to wait until I at least had something running before parting with lots of money.
On line demo here https://scandoc.online/last/0/32/2/72/3/0

Oh wow, this looks incredibly useful! I had seen one of the more expensive scantools (Autel IIRC) had integrated some Hyundai GDS functions, but ScanDoc looks about 20% the price! I'm very interested to hear how this goes. Being able to run the "actuator tests" and "utility" operations (and maybe CAN log them, haha!) would be amazingly useful. I note the IGPM has an actuator test for "Ignition 3 relay", which might help solve the mystery of when the "EPCU Wakeup" signal changes...

I think you're right about only UDS. I've run a set of UDS scans from Savvycan and it's found a whole list of addresses that respond.
I'll put them up on github once I've done some more work on confirming which module matches which ID.

I had started a partial list of these myself, but I hadn't published it anywhere. I've just put it up on my Kona DBC repo here in case it's of use: https://github.com/projectgus/kona-ev-d ... nostics.md

Some of these may be wrong, for example I've written down UDS IDs for both water pumps at some point but I'm actually not sure the water pumps have UDS functions... Corrections/updates/rewrites welcome.

[uhi22]

I can confirm the both EPCU identifier pairs, the Ioniq uses the same. One for the inverter part and one for the VCU part.
https://github.com/uhi22/Ioniq28Investi ... munication

[Pelland]

Hi ProjectGus,
I found your UDS list when I went to download the latest version of your DBCs, Great resource thanks.

I'll rescan the waterpumps directly an see if they respond

I've been playing with the Airbag module as I'd like to work out what's needed to clear the crash symbol on the dash. I might want to use the dash in my conversion, once I work out what that is.

I have found that the Airbag module talks mainly on C-CAN with a single once per second message on P-CAN, That one is already in the DBC.
a UDS scan only gets responses from P-CAN (Two addresses), nothing from C-CAN. Odd since it's C-CAN is where the main message activity is.

Send 0x7D2 response 0x7DA. Send 0x7F1 response 0x7F9.
Notes and logs on Github https://github.com/Pelland-Coupe/EV_Hac ... g%20Module

Looks like I have 12 DTCs but they don't match the GSW DTM list. More work to be done if my scan tool arrives.

[Pelland]

I've written down UDS IDs for both water pumps at some point but I'm actually not sure the water pumps have UDS functions

I've just run a UDS scan on the BMS EWP and yes it does respond - send 0x715 reply 0x71D. Nothing in the generic range seems to be supported but could support some vendor specific. Logs here https://github.com/Pelland-Coupe/EV_Hac ... s/UDS-scan

[projectgus]

Thanks for sharing those logs, I'll add the UDS IDs to the table.

I've been playing with the Airbag module as I'd like to work out what's needed to clear the crash symbol on the dash. I might want to use the dash in my conversion, once I work out what that is.

FWIW if an airbag has deployed then you probably won't be able to clear the "crashed" signal via diagnostics. Manufacturers typically require the Airbag ECU to be replaced after deployment.

You could probably spoof the messages though, and figure out which bit to clear in the message so the warning goes away. The airbag also sends a PWM "crashed" signal to the BMS on a dedicated wire (Fakon has an implementation of this).

[uhi22]

Found a video which explains the PCAN messages to and from the VESS (virtual engine sound system).


And the related GitHub, also containing some connector pinouts
https://github.com/ereuter/vess

[Pelland]

My ScanDoc module has arrived and a quick test seems to show it's as good as the online demo.
No problems listing DTCs from BMS & VCU. Open/close contactors, read VIN etc.

FWIW if an airbag has deployed then you probably won't be able to clear the "crashed" signal via diagnostics.

Yes I was aware of that, I was looking to see what I needed to spoof to clear the dash. I have seen a couple of places advertising to re-write Airbag modules to clear the issue. Probably accessing the firmware directly is my guess.

What I thought was a "Crash" indication on the dash is actual indicating that the forward collision detection isn't working. Hardly surprising since none of it is plugged in. Funny what you can find if you RTFM.

Anyway if anyone has any specific diagnostic tests they would like a CAN log please let me know.

[Pelland]

I've captured some logs for running ScanDoc diagnostics against MCU, VCULDC, and IGPM for anyone interested.
https://github.com/Pelland-Coupe/EV_Hac ... us/ScanDoc

I'm very please with the ScanDoc tool so far.

[Pelland]

I've been playing some more and now have the transmission park fooled into thinking it is locking and unlocking the transmission while it remains locked. Not long to HV power up
]

Crude but effective

I've also scanned the IGPM to find what messages it originates and what IDs it passes between the buses. M-CAN is proving to be a little bit frustrating as it runs ISO 11898-3 which isn't compatible with the standard high speed can interface ICs. I've made some progress using discrete transistors to do some interfacing, I've mapped all IDs passed between P-CAN, B-CAN, C-CAN, & D-CAN.
hyundai_kona_ev/CAN Bus/IGPM sweep

The IGPM originates a surprising number of messages.

I've also been pulling together information on all IDs, module originated from, and bus sent on.
hyundai_kona_ev/CAN Bus/CAN signals

[Pelland]

Some progress.
After working my way through clearing power train DTCs the last one was a LIN error saying it couldn't talk to the battery.
Hardly surprising since the only thing left of the battery was the positive terminal. Everything else including the negative lead and sensor went west when the truck hit it.

I managed to get a replacement lead and sensor at a reasonable price, all the way from Lithuania.

The lead finally arrived and I installed it. This cleared the last powertrain DTC. So with much excitement I pushed the brake peddle and hit the start button AND nothing happened, just the Blue light that I've always had.

So on to clearing DTCs on the IEB. It's not happy about the lack of ABS sensors or the EPB motors. Also complaining about not hearing from some missing modules.
The ABS sensors are current devices, passing about 10mA when not sensing the magnet and dropping to about 6mA when the magnet is present.
A 1K2 ohm resistor seems to make the IEB happy, unless the 12V battery drops to low then the IEB complains of sensor out of range, rather than short/open. Some times the DTC will clear just by plugging in the sensor, or resistor, and some times it seems to capture the error and needs a power cycle to re-evaluate the situation.

During the numerous power cycles I suddenly got the little green car and it went into run mode. It required all ABS sensors (or resistors) to be in place, but I still had the EPB errors.

Success woo hoo.

Power down and try again AND no success. I can occasionally get it to go into run but not consistently.
There's something else it's not completely happy about and I seem to be catching it off guard occasionally and get it to go into run.

Still a major step forward.

[projectgus]

That's massive, well done! Are you planning to actually install all the components like the IEB in the conversion, or are you still deciding about that part?

[Pelland]

That's massive, well done! Are you planning to actually install all the components like the IEB in the conversion, or are you still deciding about that part?

I'm not intending to do a complete "rebody" of a Kona but will probably use the IEB and steering column at least. I don't have a specific target in mind yet. I had something in mind but the CFO wants something a bit bigger and more comfortable so we're looking at options while I get all the bugs sorted with the bits I have.
Replacement charge port has arrived so now I need to repair the lunched connector on the LVDC. I could only find an 11Kw one with 5 wires where my Kona was a 7.2Kw changer with only 3 wires. So a bit of grafting is going to be required.

[Pelland]

First a note for anyone who can read the forum when not logged in but gets an error once logged in. See this thread viewtopic.php?t=6583

After months of investigation today I have finally achieved successful and consistant turn on/off.

I spent hours checking my logs against the logs ProjectGus has kindly made available. Every message I had that didn't match for some reason I would try simulating.
Many thanks to ProjectGus for making his Bench-Kona code available. I have hacked it extensivly and now have Bench_IEB, bench_OBC etc. But that wasn't the problem.

The more I played the less often I could get turn on.

Time to review the EE21 connections.
I had just pushed the male & female pins together with a bit of heatshrink. It had all been bathed in battery acid and I'd given it a bit of a clean but nothing fancy so thought the connections might be bad.

Looks like we have some work to do.

So I reterminated all the EE21 wires and E/R-A PCB block connector.
After 3 days I'd reterminated all the wires. Cut each one back to clean wire and solder the joint.

Still no success.

The EBC had been giving me trouble when I pushed the brake peddle, some times it would pulse violently and give lots of errors that needed to be cleared. So I pulled all the calipers off the car and connected them up. I now have EPB working and the EBC behaves nicely.
Still no turn on though.

Last night I had a brainwave. I had been completely ignoring the Aircon, which had lots of DTCs because everything had been lunched.
Looking through the 21 DTCs I found 2 important ones:
B247013 E-comp interlock fault
B181813 PTC heater interlock fault
Both associated with the HV DC system.

I jumpered the plugs to bypass the interlocks and WOO HOO we have run.

Further investigation shows that I don't need the aircon at all. If I disconnect the P-CAN from the A/C controller I can get consistant turn on. However if the P-CAN is connected the above DTCs MUST be cleared to get turn on.

These errors clear bits in 0x5F5 byte 5. If either bit is cleared turn on is prevented.
PTC interlock
0x5F5 byte 5 C9 with interlock OK 49 with Error
E-Comp interlock
0x5F5 byte 5 C9 with interlock 89 with Error

I have pulled copies of ProjectGus' DBCs (Another thanks due) and been doing my own updates and have included these bits. My latest update are on my GitHub.