Looking for some CAN bus data of PQ and MQB platform cars

[roli]

Hi there!
Let me preface this by saying that I am not in the car repair business, but I somehow got into the hobby involving car parts . And you people that work with cars are probably the ones that can offer some help.

My current project is basically connecting car instrument clusters to the computer for the purpose of playing games. Short demo clip of my project is here:

And the actual link to the project (if anyone wants to try it themselves): https://github.com/r00li/CarCluster

Doing this basically means either piecing together different CAN messages from various sources - usually forums such as this and/or simply brute forcing the CAN messages until you get what you want.

In the above demo video you can see this working fairly well, with one exception... speed needle occasionally drops to 0 even though it shouldn't. For the above PQ platform Polo this was traced to the CAN message 0xDA0. Nobody seems to be able to figure out what exactly needs to be sent there so we are filling the last two bytes with random data, which seems to keep the cluster mostly happy.

So I am looking for either somebody who ideally knows what is hiding in that CAN message, or... a few s long CAN bus traffic dump of a car that is in motion. Sadly this needs to be done from the actual instrument cluster/motor CAN bus and not through diagnostic port since the juicy data is mostly filtered out by the gateway. PQ platform cars seem to be mostly similar. So something like the Polo 6R/Superb 2, ... anything VW from around 2010 will probably do.

For the next step of the project I am also looking to add support for more modern MQB based clusters - targeting something like Golf 7 primarily. Again looking for a CAN bus traffic dump for one of the MQB based cars. All I need is a few seconds from a car that is in motion.

If anyone could provide this data I will be really grateful.

 

[jyoung8607]

Great idea, and nice work so far! The cluster clearly doesn't like something about your speed signal, it's jerky. I glanced at your github repo and see the messages you're using, among other things, Bremse_1 (0x1a0) has a counter that you probably need to fill in.

I can set you up with most of the data you need. I can dump it out to CSV if you really want, but it's better if you have an Ubuntu install that you can build the openpilot tools environment, because cabana (the CAN reverse engineering tool) in conjunction with the existing opendbc database will pretty much immediately answer most of your remaining questions.

 

[roli]

Awesome, yeah I've looked at cabana before, but didn't try it out yet. I will set it up, because that does look very useful. And if you can get me the full trace that would be really awesome.

The jerkiness I think comes from the fact that the cluster is updated through wifi more than anything else. I will check the counter though. I know that I am already adding it to 1a0, but I need to check if it's in the right place.

The speed drop is definitely connected to the DA0 somehow. Because fiddling with that I can get it stable with certain values and certain speeds. I just can't quite figure out the correlation. Unless it's also connected to something else and it's the combination that makes it unhappy.

 

[roli]

Ok, finally managed to set up cabana and everything that was needed. I played around with the included Golf 4 dbc a bit, but sadly that one seems a bit too old to have any useful data. Looks like almost no IDs are shared.

From your screenshot however... the 0x1A0 counter is apparently 4 bits only, while I am feeding it the whole byte. And apparently I have to order the wrong way around - it should be in byte 7 and not 0 apparently. Definetly gonna try to change that one to see what happens.

 

[Ronaldo]

In the above demo video you can see this working fairly well, with one exception... speed needle occasionally drops to 0 even though it shouldn't. For the above PQ platform Polo this was traced to the CAN message 0xDA0. Nobody seems to be able to figure out what exactly needs to be sent there so we are filling the last two bytes with random data, which seems to keep the cluster mostly happy.

Good job! I developed a project with Arduino to generate CANbus codes for testing electronic modules, including the instrument cluster, some time ago and I had the same problems as you: couldn't find info anywhere about the cluster, so I had to find it by myself through sniffing on a real car and by trial and error. I posted about my testbench device on another thread:

Testbench setup?

I'm trying to setup my own "testbench" and I'm getting there. It's not done yet, but more and more ready ;) Installed gateway, BCM, cluster, door + passanger module and infotainment 5F system. All modules are originally from my Touran where I have upgraded some modules except for 5F that I...

forums.ross-tech.com

My Audi A3 cluster had the same dropping of the speed needle after a few seconds, even though I was sending an apparently correct ESP_24 (0x31B) message to the cluster. This message contains fields for the current speed and for a distance counter. The cluster was registering a DTC with a fault like "speed and distance implausible" (sorry for not remembering exactly what the message was, it was in German), so you can check with VCDS if your cluster is setting the same DTC. In this case, I could only solve that when I started sending also the ESP_20 message (0x65D), which contains the tire circumference. It seems that the cluster checks the distance counter rate against the speed and tire circumference in order to verify consistency. If it's not right, the DTC is set and the speed needle drops to zero. The CANbus IDs you mention seem to be different than mine, but probably you are experiencing the same error.

After sending the right data in ESP_24 and ESP_20 (timing intervals between successive ESP_24 messages also seem to be important for the check, mine was 50msec) everything worked like a charm.

P.S.: how I know the names ESP_24, ESP_20 and other corresponding to message IDs? By selectively blocking one message at a time then checking for the "missing XXXX message" DTCs on the cluster.

 

[roli]

Great info. Yeah, the sniffing part is why I am here . I sadly don't have any VW cars currently, so I can't do it on my own cars. And friends that do have them don't seem to like the idea of me poking around their cars wiring.

I don't have any way of checking the DTCs on my cluster, so doing checks like this is a bit hard. But if I can get a proper sniff of a similar vintage car then I should be fine, just that the experimentation might take a bit longer.

And thanks for the info about timing being important. I am currently updating the whole thing every 10-15ms and the cluster seems slightly unhappy with that. Mostly if I turn on the ABS light/parking brake light. They flicker. But when I was initially sending the data every 5ms they would actually cause the cluster to reboot. That's why I increased the time to 15ms. But increasing the time too much causes the speed drops to last too long and become more frequent. My guess is that since I am using random in the 0xDA0 message the cluster at some point gets a value that it is happy with and with faster speed the likelihood of some messages being correct increases.

 

[jyoung8607]

Ok, finally managed to set up cabana and everything that was needed. I played around with the included Golf 4 dbc a bit, but sadly that one seems a bit too old to have any useful data. Looks like almost no IDs are shared.

Now that you have Cabana working, I've marked route "3cfdec54aa035f3f|2022-07-19--23-45-10" as public, so you should be able to launch Cabana with that route (make sure to surround the route name with quotation marks) and you can explore live data from that car. It's a NMS Passat, basically PQ35/PQ46 messaging, substantially similar to PQ25 messaging.

If it's a PQ car, that DBC should be a match. The name is outdated and we've added a bunch of other messages to it.

 

[jyoung8607]

And thanks for the info about timing being important. I am currently updating the whole thing every 10-15ms and the cluster seems slightly unhappy with that. Mostly if I turn on the ABS light/parking brake light. They flicker. But when I was initially sending the data every 5ms they would actually cause the cluster to reboot. That's why I increased the time to 15ms. But increasing the time too much causes the speed drops to last too long and become more frequent. My guess is that since I am using random in the 0xDA0 message the cluster at some point gets a value that it is happy with and with faster speed the likelihood of some messages being correct increases.

Each message has a frequency it's intended to be sent at. They're not all the same. Most of the interesting stuff is either 100Hz or 50Hz, some are slower. You'll be able to see the frequencies in Cabana.

 

[roli]

Now that you have Cabana working, I've marked route "3cfdec54aa035f3f|2022-07-19--23-45-10" as public, so you should be able to launch Cabana with that route (make sure to surround the route name with quotation marks) and you can explore live data from that car. It's a NMS Passat, basically PQ35/PQ46 messaging, substantially similar to PQ25 messaging.

If it's a PQ car, that DBC should be a match. The name is outdated and we've added a bunch of other messages to it.

Yep, I can open the route.

Thank you so much for this! This will be really helpful. The current instrument cluster that I am working on is a Škoda Superb 2 which is pretty much a Passat - PQ46 platform. So this should match very nicely. Not sure how much time I will have this week to work on it, but I will update you guys on the progress when I have something figured out.

 

[Ronaldo]

Great info. Yeah, the sniffing part is why I am here . I sadly don't have any VW cars currently, so I can't do it on my own cars. And friends that do have them don't seem to like the idea of me poking around their cars wiring.

If you are interested in MQB data, I have a few dumps I collected from my own Audi A3 8V CANbus communication and I can send to you in case you're interested. I plan to post the source code for my CANbus message generator on my own Github page, as soon as I have time to review and clean up the code to make it readable. Currently I only have published a few projects about a TPMS message converter, a generator for the Klemmen_Status_01 message (that "wakes up" control modules) and a program to reverse calculate the CRC algorithm of MQB CANbus messages so I can find the "padding byte" used as a key for CRC calculations. Maybe you'll find something useful anyway:

ronaldocordeiro - Overview

ronaldocordeiro has 3 repositories available. Follow their code on GitHub.

github.com

 

[roli]

If you are interested in MQB data, I have a few dumps I collected from my own Audi A3 8V CANbus communication and I can send to you in case you're interested. I plan to post the source code for my CANbus message generator on my own Github page, as soon as I have time to review and clean up the code to make it readable. Currently I only have published a few projects about a TPMS message converter, a generator for the Klemmen_Status_01 message (that "wakes up" control modules) and a program to reverse calculate the CRC algorithm of MQB CANbus messages so I can find the "padding byte" used as a key for CRC calculations. Maybe you'll find something useful anyway:

ronaldocordeiro - Overview

ronaldocordeiro has 3 repositories available. Follow their code on GitHub.

github.com

Yeah, I am very interested in the MQB dumps as well. I just got a T-Cross cluster from somebody who wants me to work on it so that is next on my list.
If you don't want to post those publicly just yet then you can email them to me at roli.r00li [that at thing] gmail.com.

 

[Ronaldo]

Yeah, I am very interested in the MQB dumps as well. I just got a T-Cross cluster from somebody who wants me to work on it so that is next on my list.
If you don't want to post those publicly just yet then you can email them to me at roli.r00li [that at thing] gmail.com.

PMed you on your email

 

[roli]

Some progress update... Since Ronaldo sent me the MQB code for his bench setup I started with that first instead of PQ. I have most of the basics integrated into my setup now - speed, RPM, gear indicator, backlight brightness and blinkers all work nicely.

Currently looking for some information on the TPMS and light CAN messages. For TPMS it looks like the CAN ID is 0x64A, and while sending all 0 clears the TPMS light it sadly also causes the speed to drop, which is obviously not desired . So if anyone has a proper message structure for this... let me know. I looked at the openpilot, but sadly couldn't find anything regarding that.

I am also looking for the CAN messages for the light system - mostly basics like fog lights/high beams.

 

[Ronaldo]

Some progress update... Since Ronaldo sent me the MQB code for his bench setup I started with that first instead of PQ. I have most of the basics integrated into my setup now - speed, RPM, gear indicator, backlight brightness and blinkers all work nicely.

Currently looking for some information on the TPMS and light CAN messages. For TPMS it looks like the CAN ID is 0x64A, and while sending all 0 clears the TPMS light it sadly also causes the speed to drop, which is obviously not desired . So if anyone has a proper message structure for this... let me know. I looked at the openpilot, but sadly couldn't find anything regarding that.

I am also looking for the CAN messages for the light system - mostly basics like fog lights/high beams.

That's good news. Glad to know it helped. The ID for TPMS on MQB is 0x5f9. Sending it with all zeros at a 500 ms interval should clear the alert. Did you check my coding for TPMS? It's for a specific solution, but it contains all the info to format TPMS data on a cluster (in case you get a cluster with support to TPMS... or maybe a Digital Cockpit Cluster some day, who knows?)

GitHub - ronaldocordeiro/Audi_A3_TPMS_on_MIB1: Arduino based CANbus message converter for VAG 8S0907273 TPMS module retrofit on Audi A3/S3 8V with MIB1 multimedia system

Arduino based CANbus message converter for VAG 8S0907273 TPMS module retrofit on Audi A3/S3 8V with MIB1 multimedia system - GitHub - ronaldocordeiro/Audi_A3_TPMS_on_MIB1: Arduino based CANbus mess...

github.com

 

[roli]

After some more playing around I figured out the TPMS light. Both 0x64A and 0x5f9 are related to TPMS, but on my cluster 0x64A is the one that actually makes the light go away. What was needed was the correct interval though. Sending it every 500ms as you suggested solved the speed dropping issue. If I was sending like other messages - every 50ms then the speed would drop. Playing around with 0x5f9 I get the TPMS status to appear on the display (and warnings about tire puncture and such).

 

[jyoung8607]

@roli If you'd like some more interesting MQB data to look at, and you don't easily get motion sickness, you might find this data useful. This is from my 2018 Volkswagen Golf R doing some "spirited driving" last month at a Golf R/R32 owners gathering here in the US. And yes, my hand positioning sucks, I'm working on it.

3cfdec54aa035f3f|2023-04-13--10-35-24

 

[roli]

Awesome! Thank you for that. I will have a look. I didn't have much time to work on this in the past week. But last week I did actually publish my first version of the project with MQB support. This is very largely based on the data that Ronaldo shared with me.

But I am still missing some data, and your capture might have it.

I am also on the lookout for the steering wheel control data. The reason for that is - I want to change the display and hopefully spoof the existence of a head unit. Because that would allow me to display arbitrary text in the middle display, which would be very nice. So if anyone has that for an MQB platform car... would be appreciated.

 

[Uwe]

yes, my hand positioning sucks,

I'm surprised you didn't take a hands-free approach and let OpenPilot do the work...?

-Uwe-

PS: That video is really fun to watch at 2x speed!

 

[Ronaldo]

Awesome! Thank you for that. I will have a look. I didn't have much time to work on this in the past week. But last week I did actually publish my first version of the project with MQB support. This is very largely based on the data that Ronaldo shared with me.

Great job! I read on your webpage that you plan to control the fuel gauge using a digital potentiometer. I designed a circuit and wrote code for a X9C103P potentiometer some time ago that I was using to test flap actuators for a HVAC, controlling it with a Digispark board, but the code for full Arduino implementations is the same. I'll share it with you if you're interested (warning: the X9C103P is non-volatile, so you will have a very realistic fuel tank simulation and will have to remember re-fueling the car after some driving).

 

[roli]

Thats similar to what I currently have. I am using the X9C102P instead. The thing works perfectly on the Polo cluster, but on my Škoda Superb cluster it only goes to half the tank when it should be full. My guess being that Superb uses the dual fuel level senders, while Polo does not. Not sure about the T-Cross one, haven't tried that one yet. So I guess I need to add another pot so I can simulate both senders and that should hopefully be it. Long story short... I think I have the code side handled on this one. Just have to figure out the wiring.