Kia specific OBD2 PIDs

[Hyperjetta]

Does anyone know or have access to the Kia specific PIDs for our car? Or know where I can get them? The Kia add-on for the Torque Pro app doesn't have support for the Stinger so I'm trying to get crafty.

 

[oddball]

Everyone is still holding onto whatever they've learned as trade secrets.
Happy hacking!

 

[robz32]

Unfortunately @oddball is right. Not sure how far and how quick that will take the platform, but the more people we get working on it the better.

 

[Hyperjetta]

Soo...I tried a "rainbow attack" approach to the OBD PIDs and got some strange results. Basically, I have a block of code that broadcasts a request for a specific PID using service mod 1 and then reads out any responses it gets from the CAN bus. My reader then loops and runs that block of code for every possible two digit combination of hexadecimal characters.

Pass 1 - PID 01
Pass 2 - PID 02
Pass 3 - PID 03
...
Pass 30 - PID 1E
Pass 31 - PID 1F
and so on...

The code runs beautifully, however, my car starts flashing warnings at me to check the collision avoidance system, LKA system, and a few others in no particular order.

Seemed scary so I aborted. Any ideas what I've done? lol

 

[oddball]

Invoked the sign of the beast?

Which protocol are you using? Are you sleeping between commands?
(this coming from someone that hasn't actually done any direct obd/can programming.... yet.)

 

[Hyperjetta]

Hmm, I do not pause the loop or anything if that is what you mean by sleeping. I have the CAN bus connector set to 500kbps baudrate.

As far as I know I'm using OBD2 over CAN. At least that is how I am reading/writing the frames. The arduino library does the heavy lifting of putting the full frame together for transmission, but I give it the arbitration ID and data.

For sending a query over the CAN I am using the ID 0x7DF

My data payload for sending the query is structured as:

byte 0 = number of bytes in the message (0x02 for standard query)
byte 1 = service ID (using 0x01 based on OBD2 protocol)
byte 2 = OBD2 PID (eg. 0x0C for engine RPM)
byte 3-7 = 0x00 (not used in a standard query)

The loop in my code increments just byte 2 of the query, which should in effect query the bus for every standard OBD2 parameter it supports.

 

[Terry@BMS]

Can't share any trade secrets but I will say most of the good stuff is on 0x22 not 0x01.

 

[Hyperjetta]

Can't share any trade secrets but I will say most of the good stuff is on 0x22 not 0x01.

I had suspected that when I saw all the traffic coming from...another device on the bus...

I wanted to test my loop using 01 before moving on to 21 and 22 just to make sure my code was sound. I'm worried that if I'm causing alerts to trigger on 01 I'm doing something wrong.

 

[Hyperjetta]

Just thought I'd share an update incase anyone is interested. I'm still working out of what PIDs are under 22, but I can tell you that it is using some higher level protocol for some responses as it appears to return more than the 8 byte limit. CAN-TP seems to fit the bill, and the frame formats line up so I will keep down that path until I hit a wall.

Just wondering if it might be helpful to start a spreadsheet of the PIDs I or anyone else finds.

 

[robz32]

Great find.
Keep the the updates coming.
The spreadsheet idea is a good one, for now I would say keep the investigation going and record your findings there, once someone else shows interest or needs a push to continue their digging, go ahead and share it.

 

[Thorne]

commaai/opendbc

If you tap into the raw canbus you can find some other interesting stuff. I use the above with my open pilot setup to monitor tq forexample

 

[Hyperjetta]

commaai/opendbc

If you tap into the raw canbus you can find some other interesting stuff. I use the above with my open pilot setup to monitor tq forexample

I've looked at that, but I didn't see a dbc for the Stinger. Are you reading directly from the pcan on a stinger? My little arduino gadget can read/log it if I only knew where to wire in haha.

 

[Thorne]

Sure I'll get you a link to the diagram of where we tap for comma .ai

 

[Thorne]

https://cdn.discordapp.com/attachments/524611978208215070/620205828556718080/Comma_HKMC_V9819.zip

 

[Shenanigans302]

Does anyone know much about the CLU coding?

 

[Hyperjetta]

Does anyone know much about the CLU coding?

Not sure what CLU means, so I'm thinking that counts me out haha

 

[Guest-177135]

Cluster ?

 

[Hyperjetta]

https://cdn.discordapp.com/attachments/524611978208215070/620205828556718080/Comma_HKMC_V9819.zip

This is really helpful, thank you!

After reading the spec sheet here, I'm trying to understand the DBC file and relate it in terms of what I know about CAN frames. The 8 byte data payload is clearly defined here, but the actual message ID I'm a little confused on. Is the ID listed next to each BO_ the complete message ID used in the CAN frame? For example, to only look at BO_ 1170 EMS19 frames would I set my mask/filter to 0x0492? 1170 (base 10) = 492 (base 16)

 

[Thorne]

check PMs

 

[Jaws]

So most of this stuff is going over my head, does anyone know a PID for current gear? I'd love to be able to show that on TorquePro