Open Source Analysis of Hyundai / Kia CAN messages, and other Programs using them.

[JejuSoul]

Here are some sites with Open Source Analysis of Hyundai / Kia CAN messages.

27kWh Kia Soul EV - GoogleDocs: Kia Soul EV CAN Messages

64kWh Kia Niro EV - GoogleDocs: Kia e-Niro Can messages

28kWh Hyundai Ioniq Electric - GoogleDocs: ioniq-pid-analyse-community.xlsx

Does anyone know any more? Are there extra values seen on these sites that we can use here?

[birkir]

Nice find! For the Kia Niro, Hyundai Kona would also apply, right?

Where would you have to plug into the CAN bus to get these kinds of information?

[sunnyhaibin]

@JejuSoul Hello! In the "command" spreadsheets, how did you send those commands and have the car accepted the commands in 0x770? I'm trying this out in the 2020 Hyundai Sonata, which the messages are almost identical to the Kia Niro EV except the EV related messages.

I entered Diagnostic Session via \x10\x03, received positive response \x50\x03, then tried to send the commands to 0x770 as mentioned here, but I kept receiving negative response \x7F\x2F\x33 for all commands sent to this ECU after.

[henkhoo]

Hi , i have a ( Niro HEV ) Hybrid 1,5Kw battery, spitting out the following HEx messages. looking for SOC , Volt and others.

Where to look for it ?

22285 670 8 9E 7 34 8 A8 6D 4 0
22286 51E 8 0 0 0 0 C 0 0 0
22287 588 8 45 9 0 0 0 6D 0 0
22288 5AD 8 B9 B9 0 0 14 14 0 55
22289 5AE 8 ED 0 6D 13 C 0 0 0
22290 5AF 8 0 0 0 0 0 0 0 0
22301 5F1 8 A8 16 45 9 0 0 0 0

[fish-face]

@JejuSoul Hello! In the "command" spreadsheets, how did you send those commands and have the car accepted the commands in 0x770? I'm trying this out in the 2020 Hyundai Sonata, which the messages are almost identical to the Kia Niro EV except the EV related messages.

I entered Diagnostic Session via \x10\x03, received positive response \x50\x03, then tried to send the commands to 0x770 as mentioned here, but I kept receiving negative response \x7F\x2F\x33 for all commands sent to this ECU after.

Not sure if we're looking at the same stuff or not, but I have the following sniff from a session with an ELM327 scanner:

-->  41 54 53 48 37 34 34 0d                           ATSH744.
<--  4f 4b 0d 0d 3e                                    OK..>
-->  31 30 30 33 31 0d                                 10031.
<--  37 34 43 30 36 35 30 30 33 30 30 33 32 30 31 46   74C065003003201F
-->  32 32 45 30 30 32 36 0d                           22E0026.
<--  37 34 43 31 30 32 33 36 32 45 30 30 32 46 46 46   74C102362E002FFF
<--  37 34 43 32 31 30 30 46 30 30 30 30 30 30 30 30   74C2100F00000000
<--  37 34 43 32 32 41 30 30 30 30 30 30 30 30 30 30   74C22A0000000000
<--  37 34 43 32 33 30 30 30 30 30 30 30 30 30 30 30   74C2300000000000
<--  37 34 43 32 34 30 30 30 30 30 30 30 30 39 39 30   74C2400000000990
<--  37 34 43 32 35 31 37 41 41 41 41 41 41 41 41 41   74C2517AAAAAAAAA

I saw you also talking about this magic string "1003" and wondered if you knew any more about it - I don't really understand that this is doing but I think 1003 is always sent before querying ECU 744.