CAN Bus messages

CAN Bus on Hyundai Tiburon operates at a speed of 500kb/s and so does the SIMK43 ECU.

SIMK43 reads the following messages for operation, if the corresponding module is present in car:

• ARBID 0x153 ASC1 Traction Control

SIMK43 sends the following messages:

• ARBID 0x545 DME4 Engine Control Unit
• ARBID 0x329 DME2 Engine Control Unit
• ARBID 0x316 DME1 Engine Control Unit

In addition to that, there are messages that are not used by the ECU, but still present on the CAN Bus:

• ARBID 0x1F0 ASC2 Traction Control

DBC file of Tiburon's CAN Bus: Tiburon_SIMK43_ESP.dbc [mirror]

Example of a candump log imported into SavvyCAN with DBC file loaded

Connection points

There is only one CAN bus found in the Tiburons, there are no gateways present.

CAN Bus is exposed on the standard pins in the OBD2 connector as in the following image (vehicle side):

Tiburon's OBD2 plug pinout, limited to power and canbus

Depending on vehicle's production date and trim, there are between 1 to 4 modules on the bus.

Modules connected to the CAN Bus

Module name	Connector name		CAN high pin	CAN low pin	CAN ID
	2.0	2.7			SIMK41	SIMK43
ECM	2.0 pinout	2.7 pinout	see pinout	see pinout		0x545, 0x329, 0x316
TCM	2.0 pinout	2.7 pinout	see pinout	see pinout
Multigauge unit (if equipped)	M42		7	1
ABS module (if equipped)	E37		11	10		0x153

Messages

DME1 0x316

Refresh Rate: 10ms

• Byte 0 - bitfield
  • Bit 0 - SWI_IGK_CAN: Terminal 15 –KEY ON
  • Bit 1 - F_N_ENG_CAN: Error – engine speed signal
  • Bit 2 - ACK_TCS_CAN: Acknowledement TCS
  • Bit 3 - PUC_STAT: Engine in fuel cut off
  • Bit 4 - TQ_COR_STAT_CAN: Status, torque intervention
  • Bit 6 - RLY_AC_CAN: Activation, air conditioner compressor relay
  • Bit 7 - F_SUB_TQI_CAN: Activation, air conditioner compressor relay
• Byte 1 - TQI_TQR_CAN

  Indexed Engine Torque in % of C_TQ_STND (including ASR/MSR/ETCU/LIM/AMT/GEAR intervention)

  Calculation = HEX * 0.39

• Byte 2 - N_ENG [LSB]
• Byte 3 - N_ENG [MSB]

  Engine Speed in rpm

  Calculation = ((HEX[MSB] * 256) + HEX[LSB]) * 0.15625

• Byte 4 - TQI_CAN

  Indicated Engine Torque in % of C_TQ_STND (based on PVS, N, AMP, TIA ,TCO, IGA, PUC so ip_tqi_pvs__n__pvs)

  Calculation = HEX * 0.39

• Byte 5 - TQ_LOSS_CAN

  Needs verification

  Engine Torque Loss (due to engine friction, AC compressor and electrical power consumption) in % of C_TQ_STND

  Calculation = HEX * 0.39

• Byte 6 - Bitfield
  • Bit 0 - ERR_AMT_CAN
  • Bit 1 - ERR_AMT_CAN
• Byte 7 - TQI_MAF_CAN

  Needs verification

  Theorethical Engine Torque in % of C_TQ_STND after charge intervention (based on MAF & IGA so ip_tqi_maf__n__maf)

  Calculation = HEX * 0.39

Example messages:

05 0B B8 0C 0B 0A 00 77

05 0C B8 27 0C 0B 46 80

0D 00 84 27 00 0B 31 82

DME2 0x329

Refresh Rate: 10ms

• Byte 0 - Bitfield

  • Bit 0 - MUL_INFO: Multiplexed information - CAN Version (CAN_VERS_CAN), - TCU configuration (CONF_TCU_CAN) - OBD freeze frame (OBD_FRF_ACK_CAN) - Torque scaling factor (TQ_STND_CAN) (6 bits long)
  • Bit 6 - MUL_CODE: Identification of MUL_INFO

• Byte 1 - TEMP_ENG

  Engine (Coolant) Temperature in °C

  Calculation = (HEX * 0.75) - 48°C

  Init: 0xFF

  Min: 0x01 (-48°C)

  Max: 0xFF (142.5°C)

• Byte 2 - AMP_CAN

  Ambient Pressure in hPa

  Calculation = (HEX * 2) + 598hPa

  Init = 0x00

  Min = 0x01 (600hPa)

  Max = 0xFE (1106hPa)

  Error = 0xFF

• Byte 3 - VB_OFF_ACT_CAN

  Detection of battery disconnection (0x10 - battery is connected)

• Byte 4 - ACK_ES_CAN

  Acknowledgement „engine stopped“

• Byte 5 - TPS_CAN

  Accelerator Pedal Position in % of PVS_MAX

  Calculation = HEX * 0.390625

  Init = 0x00

  Min = 0x01 (0%)

  Max = 0xFE (99.2%)

  PVS Error = 0xFF

  Values around 10-15% are to be expected for an un-touched pedal

• Byte 6 - ENG_CHR_CAN

  Engine Characteristic – Kind of fuel, ETS. 0xFF - gasoline

• Byte 7 - Unused

Example messages:

4F B2 82 10 00 20 FF

4F B0 82 10 00 32 FF

4F B1 84 10 00 51 FF

DME4 0x545

Refresh Rate: 10ms

• Byte 0 - Bitfield

  • Bit 0 - IM_AUTHEN_CAN: Authetication "immobilzer" (0/1), 1 bit long
  • Bit 1 - L_MIL_CAN: Lamp "check engine for OBD" (0/1), 1 bit long
  • Bit 2 - IM_STAT_CAN: Status "immobilizer" (0/1), 1 bit long
  • Bit 3 - AMP_CAN: Atmospheric Pressure [mmHg]. 5 bytes long

• Byte 1 - FCO[LSB]
• Byte 2 - FCO[MSB]

  Fuel Consumption in microliters (μl). Formula: HEX * 0,128

• Byte 3 - VB

  Battery voltage

• Byte 4 - Unused
• Byte 5 - Unused
• Byte 6 - Unused
• Byte 7 - Unused

Example messages:

F6 61 01 89

EE FA 02 89

EE 8B 02 88

Example logs

Here are some example canbus dumps. They were recorded on a 2008 Tiburon, 2.0 (cvvt) with manual transmission, fitted with ABS and ESP.

https://drive.google.com/drive/folders/1j9GmhrkH-Lm7k_E4v4JQ_gHB_lFeJ5_U?usp=sharing

2008_2.0_normal_city.log - This one features "eco-driving" around the city, without exceeding 40mph.

2008_2.0_normal_highway.log - eco-driving around the highway, without exceeding 80mph.

2008_2.0_spirited_highway.log - changing gears near the limiter until getting to the 110mph mark and mostly staying there for the whole duration of the log.

2008_2.0_spirited_city.log - dynamic stroll through the city. This is the only log during which ESP intervention happened - it's reflected in ESP's module CAN messages.

Rest of the logs should have self-explanatory names.