Skip to content

The bundled Ioniq 2017 profile

The repo's most developed profile, ioniq-2017, is the worked reference example for the bring-your-own-car journey (see Bundled profiles for the full list of what ships). It turns canair into a ready-to-use diagnostics toolkit for the 2017 Hyundai Ioniq Electric (28 kWh, AE platform) — read live battery, motor, charging, climate, and body data over WiFi with no dealer tools.

Browse it on GitHub: profiles/ioniq-2017/.

Set it as your default profile once, and every canair command below just works without repeating --profile:

canair profile use ioniq-2017

It's also the best thing to study: it shows what a mature profile looks like (verified parameters with sources, research: backlogs, IOControl actuators, scan logs), which is exactly the shape you're building toward for your own car.

Your car may differ

This profile was built and verified against one specific vehicle (a 2017 28 kWh Ioniq Electric, NL market). PIDs, byte layouts, and available signals can differ across model years and markets — and even between two cars of the same year running different ECU firmware/part numbers. Treat this profile as a strong starting point, not a guarantee: if a value looks wrong on your car, re-verify it against your own captures rather than trusting the label (see Define & verify). Check an ECU's part/firmware with canair identity <ECU>.

At a glance
Vehicle 2017 Hyundai Ioniq Electric, 28 kWh, AE platform (NL market)
ECUs mapped 30 (all registered with identity)
PIDs 99 active/draft
Parameters 377 decoded (233 verified, 144 unverified/candidate)
IOControl DIDs 107 actuators (UDS 0x2F)
Research backlog 75 open reverse-engineering leads

These numbers are generated by scripts/gen_profiles_index.py (CI checks they are current), derived from the same data as canair validate pids --stats and canair research.

What it decodes

  • Battery (BMS) — state of charge, pack voltage/current/power, all 96 individual cell voltages, module temperatures, and state of health.
  • Motor & drive (MCU / VCU) — gear, motor torque and RPM, inverter/motor temperatures, and vehicle speed.
  • Chassis (ESC / EPS) — vehicle speed and individual wheel speeds (FL/FR/RL/RR from the ESC), plus a strong-but-unverified steering-angle candidate on the EPS.
  • Charging (OBC / CCM) — AC and DC (CCS) charging state, charge-port lock; the CCM (Charge Control Module, PLC for DC fast-charging) is identified on the bus.
  • Climate & body (HVAC / BCM / IGPM) — HVAC/climate state, tyre pressures/temperatures (TPMS), and body controls (locks, trunk, lights, indicators).

IOControl actuators

The profile defines 107 IOControl DIDs (UDS 0x2F) for hardware you can safely toggle from the CLI — lights, horn, locks, charge-cable lock, mirrors, wipers — all of which auto-release when the diagnostic session ends. The IGPM actuators work from deep sleep with --wake.

canair io IGPM          # interactive actuator TUI
canair io IGPM --did BC01  # e.g. low beam (held until Ctrl+C)

Actuation is confirm-first and reversible, but it does drive real hardware. See Safety.

ECUs on the bus

30 ECUs are registered. The most decoded:

ECU TX Role
BMS 0x7E4 Battery Management System
MCU 0x7E3 Motor Control Unit (inverter)
VCU 0x7E2 Vehicle Control Unit
OBC 0x7E5 On-Board Charger + LDC/DC-DC
ESC 0x7D1 Electronic Stability Control (wheel speeds)
EPS 0x7D4 Electric Power Steering
IGPM 0x770 Integrated Gateway & Power Module (body, IOControl)
BCM 0x7A0 Body Control Module / TPMS
HVAC 0x7B3 Climate control
CLU 0x7C6 Cluster / instrument panel (odometer)

…plus AAF, ADM, AMP, AVN, BSD-L/R, CCM, DDM, GSA, MFC, PSM, RCAM, SCC, SKM, SRS, VESS, WPC, and a few still-Unknown-* modules. List them all with:

canair ecu               # every ECU + PID/param/verified counts
canair ecu BMS           # one ECU's identity + per-PID breakdown

Exploring the profile

Everything the profile knows is queryable through canair — no need to read the YAML by hand:

canair read BMS:2101         # read + decode the battery PID (live car)
canair decode BMS 2101 --stats  # value ranges from captures (offline)
canair coverage               # what's still undecoded
canair research --summary     # the open RE backlog

The source of truth is profiles/ioniq-2017/ecus/ — one file per ECU, each carrying that ECU's identity, scan log, DTC meanings, PIDs, parameters, and research leads. See Profiles for the bundle layout.

A note on the hardware quirks

Ioniq ECUs drop to a low-power state when idle, so the first diagnostic request after a pause is slow and can even time out — retry once before concluding a PID/ECU is dead. The OBD-II port is also gateway-isolated: ECUs answer request/response, but there's almost no unsolicited broadcast traffic to sniff passively. These are captured in profiles/ioniq-2017/profile.yaml.

Sources & attribution

This profile stands on the shoulders of the wider Hyundai/Kia EV reverse-engineering community. Many parameters were seeded, cross-checked, or corrected against the following public sources — thank you to their authors. (Cross-vehicle sheets often differ by a byte or two, so everything here was re-validated against the actual car — see Define & verify.)

If your work is referenced here and you'd like different attribution (or you spot a decode that traces back to a source not listed), please open a PR or issue — see Contributing.