2014 red kia rio 1.6 GDI M/T busted dreams

[AndreyB]

would 11A peal / 6A hold damage pump valve solenoid?

image.png (14.09 KiB) Viewed 62812 times

[AndreyB]

it's the other way around: default peak 5/hold 3 it's buzzing and not building pressure
with 11A/6A test is a clear loud click and it builds pressure even overshoots

image.png (371.46 KiB) Viewed 62809 times

[AndreyB]

Longer video


Stock ECU reference to compare sounds

[AndreyB]

Need some progress on https://github.com/mck1117/wideband/issues/215

[AndreyB]

1mV=100mA

peal 420mV=42000mA=42A? huh.

hold 180mV=18000mA=18A? Am I doing something wrong?

[kb1gtt]

You can change the scale on the scope to avoid the need to calc this in your head. It can read on screen directly in amps.

Also it's measuring magnetic flux. Verify that it reads 0 when the probe is in the same area, but without a wire in the loop. AKA a near by motor or similar magnetic field can induce a signal. You might be reading that external signal and applying that reading to the wire when it might be external noise.

Some of these clamps are more sensitive in one direction then the other. Perhaps check flipping the clamp so current runs the other way through the probe. I usually read forward and reverse then average usually matches that I get from better measurement tools. The both directions trick usually gets you like 5% better reading.

Does it have a zero adjustment?

Hmm seems base frequency is around 500Hz. I expect the probe has a fairly flat response up to around 10kHz. Seems you should be mostly okay frequently wise.

I guess connect resistor to battery, you know volts and ohms, so you know amps. See if it measures as expected.

[kb1gtt]

Oh also the scope might be set to something like 10x I think it wants to be set to 1x. Would you expect it's really 4.2A instead of 42A?

[AndreyB]

https://rusefi.com/docs/pinouts/proteus/?connector=black35&pin=10 suggest Proteus LS13 (one of channels with a fly-back diode) for main relay control. On this car I do not see your typical little box "engine control relay" - relays are part of the engine junction box? Are those not your regular legacy mechanical relays?


Anyway - no idea how I have not noticed that sooner, but with ignition key OFF and proteus very much off connecting LS13 causes whatever load on main relay OUTPUT side to light up, with the junction box making a weird sounds?!

Is it a mistake to suggest LS13 as main relay control line? Is this specific relay odd in some way? Am I going nuts?

image.png (46.98 KiB) Viewed 62501 times

WhatsApp Image 2023-06-29 at 01.33.43.jpg (332.38 KiB) Viewed 62501 times

WhatsApp Image 2023-06-29 at 01.34.01.jpg (427.94 KiB) Viewed 62501 times

Apologies for vertical video

[AndreyB]

^^^ was me not understanding electricity. Low side outputs with fly-back are totally not suited to drive main relays.

[AndreyB]

Not sure about absolute units so let's just compare scope photos of HPFP valve control. See image names to see which one is which.

[AndreyB]

OEM CAN bus traces https://github.com/rusefi/rusefi_documentation/tree/master/OEM-Docs/Kia/2013-CAN-logs

image.png (246.94 KiB) Viewed 62312 times

ID=128,Type=D,Length=8,Data=001700001B2C1A03
ID=129,Type=D,Length=8,Data=4085600000000063
ID=160,Type=D,Length=8,Data=00530000003E
ID=161,Type=D,Length=8,Data=8080808064
ID=339,Type=D,Length=8,Data=200010FF00FF103E
ID=356,Type=D,Length=8,Data=0008000000000A02
ID=357,Type=D,Length=8,Data=EDF77F0000000560
ID=399,Type=D,Length=8,Data=00301A008063
ID=497,Type=D,Length=8
ID=544,Type=D,Length=8,Data=FF03AF030000E60F
ID=608,Type=D,Length=8,Data=051A000000A54337
ID=672,Type=D,Length=8,Data=E000609839129E08
ID=688,Type=D,Length=5,Data=5600000715
ID=704,Type=D,Length=8,Data=11
ID=790,Type=D,Length=8,Data=041B00001A2C007F
ID=809,Type=D,Length=8,Data=D77A7E0E114A0010
ID=848,Type=D,Length=8,Data=0010B47E8000005A
ID=898,Type=D,Length=8,Data=40FE0F0000000008
ID=1072,Type=D,Length=8,Data=00A00000000006
ID=1264,Type=D,Length=8,Data=4000260000D6E31D
ID=1349,Type=D,Length=8,Data=CD17007F61FF5FFF
ID=1440,Type=D,Length=8,Data=04
ID=1442,Type=D,Length=4,Data=25029101
ID=1508,Type=D,Length=3
ID=1520,Type=D,Length=2
ID=1530,Type=D,Length=8
ID=1532,Type=D,Length=5,Data=95
ID=1680,Type=D,Length=8,Data=00000100000034

[AndreyB]

idling with rusEFI

Code: Select all

ID=240,Type=D,Length=8,Data=0016000000000067
ID=241,Type=D,Length=8,Data=4100800664009001
ID=242,Type=D,Length=8,Data=B304BC020A000A
ID=243,Type=D,Length=8,Data=D9013C001027C004
ID=244,Type=D,Length=2,Data=8002
ID=245,Type=D,Length=4,Data=14170707
ID=256x,Type=D,Length=7,Data=784100800664
ID=259x,Type=D,Length=7,Data=783C001027C004
ID=260x,Type=D,Length=7,Data=788002F000C004
ID=339,Type=D,Length=8,Data=20A130FF00FF200F
ID=356,Type=D,Length=8,Data=0008010000000F06
ID=357,Type=D,Length=8,Data=EBE77F0100000D7F
ID=400,Type=D,Length=8,Data=A0010D402F03
ID=401,Type=D,Length=8,Data=EC00C8030000FF
ID=402,Type=D,Length=8,Data=A0003F270A02
ID=403,Type=D,Length=8,Data=010FD30200007C
ID=497,Type=D,Length=8,Data=08
ID=544,Type=D,Length=8,Data=FF03AA030000E00F
ID=688,Type=D,Length=5,Data=5700000727
ID=704,Type=D,Length=8,Data=11
ID=848,Type=D,Length=8,Data=0010348383000024
ID=1072,Type=D,Length=8
ID=1264,Type=D,Length=8,Data=4000700000D6E31D
ID=1440,Type=D,Length=8,Data=04
ID=1442,Type=D,Length=4,Data=25029101
ID=1508,Type=D,Length=3,Data=04
ID=1520,Type=D,Length=2,Data=01
ID=1530,Type=D,Length=8
ID=1532,Type=D,Length=5,Data=95
ID=1680,Type=D,Length=8,Data=00000100800038
ID=250937344x,Type=D,Length=2,Data=8F01

[AndreyB]

Comparing between OEM and rusEFI snapshots we see at least four IDs are missing
Those have a bit of info at https://github.com/commaai/opendbc/blob/master/hyundai_kia_generic.dbc

EMS_DCT11_128 = 0x80
EMS_DCT12_129 = 0x81
EMS11_790 = 0x316
EMS14_1349 = 0x545

Now we take OEM trace and clearly see something checksum-ish in the last byte. It pays to pay attention and see that DBC clearly says 4 bits for counter and four bits for checksum - at first I did not pay attention and wasted an hour assuming that whole byte is some sort of a checksum with a round buffer. Here is the most telling sequence - note how last nibble (one hex symbol is called nibble, right?) is going from 0 to F, and how penultimate nibble just goes backwards unless first seven bytes change?

6458 1885524027.288 DT 0081 Rx 8 40 84 5F 00 00 00 00 DF
6476 1885524037.049 DT 0081 Rx 8 40 84 5F 00 00 00 00 C0
6493 1885524047.812 DT 0081 Rx 8 40 84 5F 00 00 00 00 B1
6509 1885524057.288 DT 0081 Rx 8 40 84 5F 00 00 00 00 A2
6525 1885524067.295 DT 0081 Rx 8 40 84 5F 00 00 00 00 93
6542 1885524077.270 DT 0081 Rx 8 40 84 5F 00 00 00 00 84
6557 1885524087.300 DT 0081 Rx 8 40 84 5F 00 00 00 00 75
6576 1885524097.438 DT 0081 Rx 8 40 84 5F 00 00 00 00 66
6591 1885524107.064 DT 0081 Rx 8 40 84 5F 00 00 00 00 57
6611 1885524117.058 DT 0081 Rx 8 40 84 5F 00 00 00 00 48
6627 1885524127.306 DT 0081 Rx 8 40 84 5F 00 00 00 00 39
6645 1885524137.038 DT 0081 Rx 8 40 84 5F 00 00 00 00 2A
6660 1885524147.060 DT 0081 Rx 8 40 84 5F 00 00 00 00 1B
6678 1885524157.279 DT 0081 Rx 8 40 84 5F 00 00 00 00 0C
6694 1885524167.298 DT 0081 Rx 8 40 84 5F 00 00 00 00 FD
6711 1885524177.711 DT 0081 Rx 8 40 84 5F 00 00 00 00 EE
6725 1885524187.069 DT 0081 Rx 8 40 84 5F 00 00 00 00 DF
6745 1885524197.303 DT 0081 Rx 8 40 84 5F 00 00 00 00 C0
6762 1885524207.544 DT 0081 Rx 8 40 84 5F 00 00 00 00 B1
6778 1885524217.059 DT 0081 Rx 8 40 84 5F 00 00 00 00 A2
6794 1885524227.308 DT 0081 Rx 8 40 84 5F 00 00 00 00 93
6813 1885524237.063 DT 0081 Rx 8 40 84 5F 00 00 00 00 84
6829 1885524247.316 DT 0081 Rx 8 40 84 5F 00 00 00 00 75
6846 1885524257.305 DT 0081 Rx 8 40 88 5F 00 00 00 00 26
6861 1885524267.079 DT 0081 Rx 8 40 88 5F 00 00 00 00 17
6879 1885524277.298 DT 0081 Rx 8 40 88 5F 00 00 00 00 08
6895 1885524287.753 DT 0081 Rx 8 40 88 5F 00 00 00 00 F9
6912 1885524297.050 DT 0081 Rx 8 40 88 5F 00 00 00 00 EA
6928 1885524307.299 DT 0081 Rx 8 40 88 5F 00 00 00 00 DB
6946 1885524317.060 DT 0081 Rx 8 40 88 5F 00 00 00 00 CC
6962 1885524327.312 DT 0081 Rx 8 40 88 5F 00 00 00 00 BD
6981 1885524337.438 DT 0081 Rx 8 40 88 5F 00 00 00 00 AE
6995 1885524347.080 DT 0081 Rx 8 40 88 5F 00 00 00 00 9F
7013 1885524357.447 DT 0081 Rx 8 40 88 5F 00 00 00 00 80
7028 1885524367.311 DT 0081 Rx 8 40 88 5F 00 00 00 00 71
7045 1885524377.302 DT 0081 Rx 8 40 88 5F 00 00 00 00 62
7059 1885524387.088 DT 0081 Rx 8 40 88 5F 00 00 00 00 53
7078 1885524397.064 DT 0081 Rx 8 40 88 5F 00 00 00 00 44
7094 1885524407.335 DT 0081 Rx 8 40 88 5F 00 00 00 00 35
7113 1885524417.444 DT 0081 Rx 8 40 88 5F 00 00 00 00 26
7127 1885524427.086 DT 0081 Rx 8 40 88 5F 00 00 00 00 17
7147 1885524437.511 DT 0081 Rx 8 40 88 5F 00 00 00 00 08
7162 1885524447.309 DT 0081 Rx 8 40 88 5F 00 00 00 00 F9
7179 1885524457.706 DT 0081 Rx 8 40 88 5F 00 00 00 00 EA
7194 1885524467.079 DT 0081 Rx 8 40 88 5F 00 00 00 00 DB
7212 1885524477.315 DT 0081 Rx 8 40 88 5F 00 00 00 00 CC
7227 1885524487.323 DT 0081 Rx 8 40 88 5F 00 00 00 00 BD
7246 1885524497.300 DT 0081 Rx 8 40 88 5F 00 00 00 00 AE
7260 1885524507.092 DT 0081 Rx 8 40 88 5F 00 00 00 00 9F
7279 1885524517.075 DT 0081 Rx 8 40 88 5F 00 00 00 00 80
7296 1885524527.563 DT 0081 Rx 8 40 88 5F 00 00 00 00 71
7313 1885524537.080 DT 0081 Rx 8 40 88 5F 00 00 00 00 62
7329 1885524547.327 DT 0081 Rx 8 40 88 5F 00 00 00 00 53
7345 1885524557.073 DT 0081 Rx 8 40 88 5F 00 00 00 00 44
7363 1885524567.559 DT 0081 Rx 8 40 88 5F 00 00 00 00 35
7378 1885524577.076 DT 0081 Rx 8 40 88 5F 00 00 00 00 26
7394 1885524587.331 DT 0081 Rx 8 40 88 5F 00 00 00 00 17
7412 1885524597.092 DT 0081 Rx 8 40 88 5F 00 00 00 00 08
7428 1885524607.328 DT 0081 Rx 8 40 88 5F 00 00 00 00 F9
7447 1885524617.436 DT 0081 Rx 8 40 88 5F 00 00 00 00 EA
7460 1885524626.851 DT 0081 Rx 8 40 88 5F 00 00 00 00 DB
7481 1885524637.520 DT 0081 Rx 8 40 84 5F 00 00 00 00 0C
7496 1885524647.338 DT 0081 Rx 8 40 84 5F 00 00 00 00 FD
7513 1885524657.689 DT 0081 Rx 8 40 84 5F 00 00 00 00 EE
7528 1885524667.102 DT 0081 Rx 8 40 84 5F 00 00 00 00 DF
7546 1885524677.335 DT 0081 Rx 8 40 84 5F 00 00 00 00 C0
7561 1885524687.303 DT 0081 Rx 8 40 84 5F 00 00 00 00 B1
7579 1885524697.049 DT 0081 Rx 8 40 84 5F 00 00 00 00 A2
7593 1885524706.816 DT 0081 Rx 8 40 84 5F 00 00 00 00 93
7613 1885524717.062 DT 0081 Rx 8 40 84 5F 00 00 00 00 84
7628 1885524727.071 DT 0081 Rx 8 40 84 5F 00 00 00 00 75
7649 1885524737.523 DT 0081 Rx 8 40 84 5F 00 00 00 00 66
7662 1885524747.063 DT 0081 Rx 8 40 84 5F 00 00 00 00 57
7679 1885524757.064 DT 0081 Rx 8 40 84 5F 00 00 00 00 48

[AndreyB]

Next step google "Hyundai checksum"

https://github.com/commaai/openpilot/blob/master/selfdrive/car/hyundai/hyundaican.py has something cool but not helpful - those are 8 bit checksum.

Next hit https://github.com/commaai/panda/blob/master/board/safety/safety_hyundai.h and code around line 152 is a hit!

Thus we get Lua code

Code: Select all

function hyuindaiSumNibbles(data, seed)
  local sum = seed 
  for i = 1, 7, 1
  do
    b = data[i]
    sum =  sum +  (b % 16) + math.floor(b / 16) 
  end 
  return (16 - sum) % 16 
end 

where seed is packet counter and Kia tachometer needle moves!

WhatsApp Image 2023-07-08 at 11.03.54.jpg (164.74 KiB) Viewed 62275 times

[AndreyB]

Just drove around the block! That's first time for rusEFI GDI.

HPFP would not build pressure at 8Amp peak. HPFP would very sporadically build pressure at 9Amps. 10amps seems to be working!

Obviously fully untuned but working tach via CAN bus.
https://rusefi.com/online/view.php?msq=1501
Log too big for REO - see attachment

[AndreyB]

current Lua script

tune with gear detection https://rusefi.com/online/view.php?msq=1502

[AndreyB]

[AndreyB]

Usability progress time

https://rusefi.com/docs/pinouts/Hyundai-Kia-PB-platform-adapter/

kia-pb-adapter.jpg (198.42 KiB) Viewed 61993 times

wire-candy.jpg (293.28 KiB) Viewed 61993 times

[ykill]

Impressive work!
I think the next step would be DI LS

[AndreyB]

Next step White accent sister vehicle in PR

https://rusefi.com/online/view.php?msq=1539

[AndreyB]

You see this ECU bracket right? You see how it has 9101120041 part number? Now note how google does not know that part number. Not a single hit. WTF

image.png (1.95 MiB) Viewed 58082 times

image.png (993.9 KiB) Viewed 58082 times

image.png (1.08 MiB) Viewed 58082 times

[AndreyB]

white sister talks Spanish

[AndreyB]

I wonder if mine is affected by this

[AndreyB]

white sister talks Spanish

was since renamed to https://rusefi.com/online/index.php?vehicleName=AccentTurboBestia&user_id=675

[AndreyB]

GDI gives you so much power it busts clutch lines!!!

WhatsApp Image 2024-03-17 at 20.07.37_629747ab.jpg (202.02 KiB) Viewed 10926 times

[NormanAlphaspeed]

Did testing with Kia Rio

This log has:
.knock sensing and timing retard working (a bit too retard happy but we added timing on purpose and it has unknown-age 87 octane fuel)
.detected gear working (not being passed into current gear)

https://rusefi.com/online/view.php?log=1359


Tune used with that log is
https://rusefi.com/online/index.php?vehicleName=red&user_id=675&sorts[uploadedMsq]=-1&sorts[uploadedLog]=-1