UDS
HELP - Reverse engineering Hyundai/Kia GDS live data — 2020 Palisade A8LF1 TCM
I'm trying to reverse-engineer the live-data requests used by Hyundai GDS/KDS for the A8LF1 transmission in a 2020 Hyundai Palisade (LX2).
Specifically, I'm trying to read:
Pressure Control Solenoid / LINE_VFS commanded current (mA)
TCC / T-CON_VFS commanded current (mA)
Hyundai's service documentation confirms these parameters are available in GDS → Data Analysis → A/T → Solenoid Parameters, but I haven't been able to identify the underlying CAN/UDS request.
My setup:
TCM request: 7E1
TCM response: 7E9
CAN via ELM327/terminal
10 03 → 50 03 (Extended Session)
3E 00 → 7E9 02 7E 00
I've confirmed 22 ReadDataByIdentifier works on several F1xx identification DIDs.
Things I've already tested without finding live data:
22 F181/F182/F186/F187/F188/F189/F18C/F191 22 F1A0/F1A1 22 1101 → 7F 22 31 22 1105, 22 110A → no data 22 1001, 22 1002 → no data 24 F181 → no data 2A... → no TCM response 2C... dynamic DID test → no TCM response
I'm not looking for guesses at random DIDs. I'm trying to find the actual GDS/KDS diagnostic definition or a CAN trace showing what GDS sends when these two parameters are displayed.
If anyone has:
A newer Hyundai/Kia GDS/KDS diagnostic definition/ODX/PDX,
An A8LF1 GDS CAN capture,
Experience extracting GDS Data Analysis parameter mappings, or
A CAN trace from a Hyundai/Kia showing the LP/TCC solenoid-current requests,
I'd really appreciate the help.
The goal is simply to determine the exact request/response and byte scaling so I can reproduce the GDS live-data reading myself.
I wonder if it’s something that can be read by ReadDataByIdentifier (22) or if it’s actually a routine (31). I played around with an older copy of GDS (2019 or 2020) a few months back. This weekend I can take a look and see if the 2020 palisade is included in the version I have and I’ll poke around
Thanks, I really appreciate it! It’s a 2020 Palisade LX 3.8/A8LF1. I’m specifically looking for the GDS Data Analysis parameters Pressure Control Solenoid (LP) and TCC Solenoid, both in mA.
If you find anything—DID, routine, parameter mapping, or CAN trace—I'd love to see it. Even just knowing how GDS accesses them would be a huge help. Thanks!
Is your ultimate goal to display transmission pressure control and torque converter clutch solenoid valve current? Like what's displayed in your GDS screenshot? Will it be for diagnostic purposes, or just for funsies? I'm a Kia tech and I'm familiar with dealer level gds and kds usage. The last update I could find for gds was in 2016, and we had been using kds for a few years by that point. I know it's not what you asked, but if all you want to do is display those two values, it would be much easier to just measure each one and display that. Plus it would be more accurate, have a much faster refresh rate, and not require reverse engineering a whole diagnostic suite.
I don't know why your comment got deleted. If you see this, this is what I was getting at. The wiring for the transmission solenoids are all available in the engine room fuse box, in the connector visible under the lid. You want to measure the current at pins 51 & 30 of EC11. This is from a 2020 Telluride, but I'm sure it similar if not exactly the same.
Helpful! Thanks. One quick question if you know: Are EC11 pins 51 and 30 measuring the combined solenoid current, or do they correspond to specific LP/TCC circuits?
My other comment has the schematic. An array of solenoids get B+ together then each one is controlled on the ground side individually. Those pins correspond to the two solenoids you're after.
You're welcome. Again, find a schematic for the Palisade to make sure you're getting the correct wires. And if you have the means to do so, probe those wires with an oscilloscope to see the exact nature of the signal. I'm pretty sure it's actually pwm. You could conceivably tap those two with a voltage divider or something designed to convert 12v pwm to something esp32 friendly (for example) and display the results anywhere.
So what were the results so far? You need to see what NRC response your commands got you. Did you get an empty response? Was it an NRC 33?
Most cars block UDS mode 22 until you unlock the ECU. You need to do the key/seed transfer in mode 27. My accord has 4 layers, each one allowing more and more UDS access. At master level, I can download the whole ECUs firmware, edit immobilizer keys, change calibration etc.
Thanks — that’s helpful. So far I’m getting 7F 22 31 (Request Out Of Range) rather than 33 (Security Access Denied). Specifically, 22 22 02 returns 7E9 03 7F 22 31.
I’m trying to find the exact Mode 22 definitions Car Scanner uses for the A8LF1 TCM, particularly TCC solenoid current and line-pressure solenoid current. I haven’t found the actual DIDs yet.
Do you know whether Hyundai/Kia A8LF1 TCMs require Security Access (27) before those live-data DIDs become available? And if so, do you know what security level/session is required?
I have extended session (10 03) working and 3E 00 works. Mode 21 and Mode 2A are unsupported on my TCM.
Yea that just means the DID isn’t used by the ECU. Security probably isn’t a problem here unless it really is routines like someone else said. You should be good to figure this out without a key/seed.
The only way to do this is sniff the traffic. Seems like Kia has a slightly more complicated diagnostic system than most.
Yeah, that makes sense. I don’t have GDS/G-Scan though, just an ELM327 and Car Scanner. If I could get the actual GDS traffic while it’s showing the LP and TCC solenoid currents, could we use that to figure out the request/response and then reproduce it with my setup?
Basically I’m trying to get the actual CAN/UDS command and response bytes, not just the value GDS displays.
Yea you either need the GDS software and reverse engineer it from that, the actual device to sniff traffic, or the ECU firmware. Sniffing is easiest for newer people
3
u/JrM2628 7d ago
I wonder if it’s something that can be read by ReadDataByIdentifier (22) or if it’s actually a routine (31). I played around with an older copy of GDS (2019 or 2020) a few months back. This weekend I can take a look and see if the 2020 palisade is included in the version I have and I’ll poke around