openinverter forum

Hey Pelland!

I've been very slack about updating this thread, but I have been steadily working on this project. There is some more on my blog, although that's running six months behind as well! Will put some more up soon. Starting to put together a controller that can run the minimised "bench Kona", and then it'll finally be time to put it all into a car.

Pelland wrote: ↑Sun Oct 06, 2024 12:15 am With regard to the runaway issue you had, is it practical to add a "panic button" that opens one of the many interlock connections on the various plugs? Or is there some disastrous side effect of opening one of these while it's powered up?

Maybe... there are definitely ways to trip an interlock, one of the controller functions I've got working replicates the "crash" signal from the airbag ECU and can be used for this purpose. Presumably the high voltage contactors will always open immediately for safety if you do this. If that happens in a moving vehicle the accepted wisdom is that it'll blow the motor controller and maybe other components (i.e. the energy generated by the turning motor still needs to go somewhere, and in the absence of a battery the voltage on the HV bus spikes up until something gives out.) Of course with a runaway unloaded motor there is a lot less inertia and energy than a moving vehicle, so that voltage spike will be much smaller and the power electronics might survive. I have not been brave enough to test this out.

In other testing (documented in a blog post) we found that a Kona's motor will run away if you lift the two driving wheels off the ground, without any modifications or removed modules. So I'm not hopeful that there will be a control system solution to this problem. I'm counting on fitting the motor in a direct drive setup, with a manual gearbox locked into a single gear. This isn't ideal as I'm converting a ute and I'd like an option for higher torque & lower speed sometimes, but at least it'll be safe from runaway.

Pelland wrote: ↑Sun Oct 06, 2024 12:15 am I've just got a written off 2021 Kona and I'm starting on my own "bench Kona".
Unfortunately my Kona had the motor forcibly removed by a truck, so I have a lot of work to do rebuilding all the wiring connections before I can try powering up.

Awesome! Sounds like a rough accident though, I hope it's not too mangled.

Hi Projectgus,
Thanks for your detailed response. I've been reading through your blogs, very informative.
Good point about the regen spike if the battery relays are opened.

My car is a bit of a mess around the front, fuse box is crushed and the HV connection box got ripped off. The reduction box has the rear lug broken off taking 1/2 the output bearing mount with it.
I've just finished remaking the straps from the connection box to the inverter and charger. I now need to work out the wiring for the connector into the connection box, connector was shredded.

I can across this drawing in the manual showing communication between the VCU and the inverter. .

When I get a bit further on I might investigate the inverter to see if it's possible to interface between the VCU function and the MCU function.
Could be a simpler point to control, or not

Regards,
Pelland

Pelland wrote: ↑Sun Oct 13, 2024 1:59 am When I get a bit further on I might investigate the inverter to see if it's possible to interface between the VCU function and the MCU function.
Could be a simpler point to control, or not

It's a very good idea. I had the same thought, but didn't get too far with it - the VCU and the MCU are co-housed on the same PCB (see post about halfway up the thread). That board has two PCAN connections and I thought there's a small chance that one might be VCU and one might be MCU and they could be communicating between each other via CAN (plausible if the original R&D was two modules and then they got combined in a revision). However I haven't tried to confirm this in detail - keen to see anything you figure out.

projectgus wrote: ↑Tue Oct 15, 2024 10:40 am That board has two PCAN connections and I thought there's a small chance that one might be VCU and one might be MCU and they could be communicating between each other via CAN (plausible if the original R&D was two modules and then they got combined in a revision). However I haven't tried to confirm this in detail - keen to see anything you figure out.

I had the opportunity to unplug the CAN junction connector on the motor stack and split out each module individually via a CAN bridge. Check out the dubious signal integrity:
The "MCU" CAN interface on the EPCU (pins 28 & 29 on the EPCU connector) doesn't seem to send any CAN messages at all. Even diagnostic requests, where it looks like there are separate UDS addresses for accessing the VCU and the MCU, all seem to go via the other "VCU" CAN interface (pins 9 & 10).

When I totally disconnected the MCU CAN bus connection the VCU still went into Drive, applied torque, etc. The only difference I could see is a fault code appears - U0146 which is apparently to do with gateway communications(?)

Totally disconnecting the VCU CAN bus connection caused everything to stop working - no Ready, can't drive, etc. So I guess the second interface isn't a redundant failover if the first one isn't working.

So... I'm not sure what that's about, maybe it's a leftover from an earlier stage of the design or maybe it serves some other purpose. But it seems likely to me that to control the MCU without going via the VCU would require internal modification (or replacement) of the EPCU circuit board.

Upside of these experiments, the DBC file for Kona PCAN messages is slowly filling out! The logs from this experiment are also available if anyone would like to do more analysis.

How similar do the EPCU of the Kona and of the Ioniq look like? Some Ioniq pictures I have here: https://github.com/uhi22/Ioniq28Investi ... ontrolUnit
Are these completely different designs? I would hope that they did not re-invent everything, and we could learn from the analysis of both. I hope to get a "defect" Ioniq EPCU soon to have a look at.

uhi22 wrote: ↑Fri Nov 22, 2024 11:45 am How similar do the EPCU of the Kona and of the Ioniq look like?

Very similar, if not 100% the same. Maybe the IGBTs are lower rated, and I guess firmware is probably tuned differently...?

I would hope that they did not re-invent everything, and we could learn from the analysis of both

Your Ioniq DBC file was a great starting point for the Kona DBCs I linked in the last post. Some things turned out very different to what is in there, but a lot seems to be identical.

Do we have pinouts of the external and internal connectors? I'll receive the Ioniq EPCU beginning of the week, I'm very exited to do some measurements

Pity that the dual CAN interfaces turned out to be a dead end.

I'm making progress on sticking all the parts back together. Have ordered some relays etc and while I'm waiting for them to arrive I started playing with the water pumps. The idea is to get all my various tool chains sorted out and confirm reliable connectivity etc.

The canable module I purchase appears to be faulty, I can flash the firmware OK but can't get any CAN signals in or out. So I've order some differnt can modules.
In the meantime I've loaded GVRET onto an Arduino Due and had some succes listening to the pumps. The GVRET interface isn't compatibly with the tools I have for sweeping the bus, so no luck talking to the pumps yet.

Front pump talks ID 0x570 and rear pump talks ID 0x4E4. When powered up on the bench the pump starts, reves up, then slows down and stops. Then repeats the process. Attached text doc is a brief analysis & I have logs from both free running and stalled if anyone would like a copy. I'm a NOOB, so what is the etiquite about posting details of what I've been doing? pictures of pulling the battery out, wiring looms in pieces, my board Kona layout etc.

uhi22 wrote: ↑Sun Nov 24, 2024 9:36 am Do we have pinouts of the external and internal connectors? I'll receive the Ioniq EPCU beginning of the week, I'm very exited to do some measurements

Someone made a start over on this thread: viewtopic.php?p=77179#p77179

I've posted there with the Kona external EPCU pinout, I think it's going to be the same. Suggest we keep talking about it there, as it's a separate challenge to re-using the components via CAN.

Pelland wrote: ↑Mon Nov 25, 2024 2:50 am I started playing with the water pumps

Nice work with the pumps! I actually just figured these IDs out as well. OK if I merge some of your findings into the DBC files I'm maintaining?

The pumps have "run dry" protection so you may find you get different behaviour if you plumb some liquid in.

I haven't confirmed it myself, but I think uhi22 found the pump request sent by the inverter (should match the pump with status 0x570). See this byte in message 0x523: https://github.com/projectgus/kona-ev-d ... n.dbc#L278 - I have some logs where both pumps spin up, so can probably find the equivalent message to start the BMS pump as well.

Pelland wrote: ↑Mon Nov 25, 2024 2:50 am I'm a NOOB, so what is the etiquite about posting details of what I've been doing? pictures of pulling the battery out, wiring looms in pieces, my board Kona layout etc.

I'd like to see them, for what that's worth!

]Hi Projectgus, I downloaded your latest DBCs and saw you had already added the two pump signals.
I've now got send coms working and have done a lot of searching through your various log files.

I have verified the "control" message for both pumps, 0x523 matches 0x570 and 0x4de from the BMS matches 0x4e4. I can turn pumps on/off etc and am currently mapping the alarm signals etc. Hope to connect a water tank today.

I see an alarm set each time the pump cycles, which I'm guessing is the "dry"alarm.

Will post a comprehensive summary once I've repeated the tests with water in the pumps.

Roof Kona anyone?

Started testing the front pump with water connected and so far I can't get any of the 3 alarm bits that I was seeing under various conditions without water.
With flow fully open the pump will still cycle when not receiving CAN, but doesn't produce any alarms. Restrict the flow slightly and the pump settles to a steady speed.
So more testing still to be done. If anyone knows why my thumbnails are sideways, but images is upright I'd like to know.

Pump progress.
I discovered a red herring with the PSU I was using. When the pump does a rapid ramp up the current limit bites momentarily causing a voltage dip.

So keeping the current under control for some tests and using a fixed 20A supply for others I've managed to characterise the water pumps.
See attached spreadsheets.

- Updated And again error in low volgate threshold

Front pump only listens to the inverter on 0x523 for both speed and purge.
Rear pump listens to the BMS (0x4DE) for speed and the inverter (0x523) for the purge signal.

Bit 0 is a general alarm flag indicating a specific alarms in byte 7.
Only 1 byte (byte 4) I don't understand the meaning of. It seems to be something like flow rate, but thats just a random guess.

It's been a great little excesize in CAN hacking and has improved my understanding a lot. The more I use SavvyCAN the more I like it.

Great results, Pelland! I'll roll this into the DBC file soon, too. Maybe we should do a wiki page for these pumps?

What happens on a "purge", exactly?

Pelland wrote: ↑Fri Nov 29, 2024 9:13 pm If anyone knows why my thumbnails are sideways, but images is upright I'd like to know.

This is a guess, but images can have the rotation encoded in the EXIF metadata (i.e. the image is in one orientation but the EXIF data says to apply a particular rotation when displaying it). The forum software probably ignores this metadata when generating the thumbnail, but when the browser loads the original image file it reads it. You can likely work around this by opening the photo in an image editor and exporting it again before uploading (can also be an opportunity to scale down, reduce file size, etc).

projectgus wrote: ↑Sat Nov 30, 2024 5:14 am Great results, Pelland! I'll roll this into the DBC file soon, too. Maybe we should do a wiki page for these pumps?

Nice work!
https://openinverter.org/wiki/Water_Pumps
You can create a sub page linked there for it. There's a list at the bottom of that page to try to list quick specs so people can filter through what they need.

What happens on a "purge", exactly?

Apologies, I've been looking at the pumps so closely I forgot that not everyone has been doing that.

Part of the repair process for anything to do with the cooling is to initiate a "purge" to remove any air trapped in the system. Needs the expensive Hyundai service software to that though.

With no water the pump cycles at ~0xC7 every 2 sec on for ~ 0.8S.
With full water flow it pulses very rapidly for a while then settles down to running at 0x6A.
With water but flow stopped it starts up at ~0x97 and runs continuously.
So I'm guessing there some algorithm the pump runs depending on current draw.

I'll see if I can update the spreedsheet in my previous post.

jrbe: Thanks for the pointer to the wiki page. I'll do a bit of Wiki learning before I try screwing up the existing page with what I've learnt

Pelland wrote: ↑Sun Dec 01, 2024 11:02 pm Part of the repair process for anything to do with the cooling is to initiate a "purge" to remove any air trapped in the system. Needs the expensive Hyundai service software to that though.

Ah, of course. Very cool to know how to do this without figuring out the correct diagnostic request (or even having an EPCU to send it!)

I'm on Github now.
Just put all the logs etc up for the water pumps.

https://github.com/Pelland-Coupe/EV_Hac ... ater_pumps

And we have a wiki page too.
https://openinverter.org/wiki/Hyundai_K ... lant_Pumps

Discovered error in lowvoltage threshold in spreadsheet, prvious post has been re-edited to correct. 7.9V on 9V off.
It looks like 8V is the lower limit used across a lot of things as its a standard criteris in a lot of the service sections - Battery 8V to 16V

If you're sharing images of wiring setups or diagrams like the one mentioned, compressing them for faster uploads can help. You can try image compressor tool to reduce file size without losing quality, ensuring quick sharing while maintaining clarity.

Have published the hardware and firmware I'm using to drive the "Bench Kona": https://github.com/projectgus/fakon/

More info in this blog post: https://www.projectgus.com/2024/12/fakon/

Magnificent work ProjectGus.

Looking through your connection list I see the note against the EPCU wake up signal. I wonder if this is associated with waking up the LDC to charge the 12V battery when the vehicle is turned off.
https://www.youtube.com/watch?v=1rorGxxebL8

Pelland wrote: ↑Mon Dec 23, 2024 4:21 am Looking through your connection list I see the note against the EPCU wake up signal. I wonder if this is associated with waking up the LDC to charge the 12V battery when the vehicle is turned off.
https://www.youtube.com/watch?v=1rorGxxebL8

Good thought, thanks for sharing this! I found on the bench that if I didn't drive this EPCU wake up signal to 12V when the ignition was on, the VCULDC would trigger DTC "P1A78 Check IG3 Relay or Back Up Lamp Circuit". Hard-wiring to ignition power IG1, the fault went away. IG1 isn't otherwise wired to the EPCU, so it is possible this is an "ignition on" signal from the IGPM only - although that doesn't quite match the DTC description... EDIT: Maybe it's a redundant safety check that the IG3 relay comes on and off when expected?

I did some bench experiments just now connecting the wake up signal to 12V with the ignition off, after all of the modules had gone to sleep. Nothing happened (no CAN messages received or other activity, contactors stayed shut and DC/DC turned off). It is possible that it also needs to also see some CAN signal from the IGPM to wake up, though...

I kind of expect the 12V top-up charge feature (that I didn't realise was a thing!), and also the scheduled EV charging modes, to be initiated by the OBC as this is what turns the car half-on (relay for IG3 power) when a charger is connected. But who knows! There are some CAN logs for a scheduled charge session, which might contain a clue.

I'll aim to keep the EPCU wake-up signal on a separate Fakon output just in case it turns out to be useful for something else.

In other Bench Kona news, have mostly disconnected it for now as I need to make room in my shed for the actual conversion. I hope to next power it up installed in an engine bay, unless the certifying engineer wants me to verify something on the bench first...

I've been having great success with my setup. 12V Power up has been successful and I have lots of lights etc, So now I can start playing.

Lots of rabbit holes with trying to get the D-CAN bus talking and sniffing the P-CAN. Turns out that the only scanner software that will talk to the D-CAN is OBD-facile using a USB ELM327 module. None of the other scanning software will put anything out onto the D-CAN, verified with a logic analyser.
I got a bluetooth module to try with "car scanner"but no luck connecting. the BT module works fine on my Mitsi van so not sure what's happening.

So then I tried sniffing the P-CAN. I was getting valid IDs on the logic analyser but nothing using Savvycan and various CAN modules. Wasn't till I got out the trusty old Oscilloscope that I discovered a bad connection in the CAN-H line. Turns out the logic analyzer just used the CAN-Low line.

That all killed two days.

To do something useful I downloaded the latest DBC from ProjectGus, thanks. And looked for any P-CAN UNK IDs with the idea of trying to identify their source.

I found 3 from the climate control and one from the BCM, the rest all come out of the IGPM, though not confirmed if it originates or passes them through. See text doc with my findings. https://github.com/Pelland-Coupe/EV_Hac ... -01-25.txt.

Picture to follow

Thanks Pelland. FWIW, I have had good luck getting diagnostics using an OBDLink LX dongle and this Android app. I think the Kona modules only implement diagnostics using UDS over CAN, none of the older K-Line protocol stuff (and a lot of older/cheaper OBD scanner stuff only does K-Line I think as it's a US requirement for combustion vehicles.)

Will take a look at your notes and roll new details back into my DBC repo, thanks for posting them!

Hi All,
I think I've just found one of the manufactures of the connectors for the Kona. It appears to be KET http://www.ket.com/en/main.ket

I found a full catalogue at this link https://www.google.com/url?sa=t&source= ... 8PaXTlFsrL

The link downloads a PDF from an HTTP site so Firefox gives a security warning. Proceed at your own risk.