Looking for some CAN bus data of PQ and MQB platform cars

[jyoung8607]

I am also on the lookout for the steering wheel control data. The reason for that is - I want to change the display and hopefully spoof the existence of a head unit. Because that would allow me to display arbitrary text in the middle display, which would be very nice. So if anyone has that for an MQB platform car... would be appreciated.

I'm actually not sure what message the infotainment buttons are in, I've never looked.

I'm currently only wired up to log the Powertrain and Extended CAN buses, but I can get the CAN gateway to mirror Convenience CAN out to the DLC and get it there. Will try to do that soon.

 

[jyoung8607]

I'm surprised you didn't take a hands-free approach and let OpenPilot do the work...?

comma three with the fisheye cams can see around the hairpins now, and as you can see it's trying to plan a path to drive, but we're pretty far outside the model's normal training. Also, I can't apply enough steering torque via the Lane Assist API to do anything useful on the Dragon, even at low speeds. There's several layers of safety controls in both openpilot and the VW EPS that stop me from going above 3.0 Nm effective applied torque.

PS: That video is really fun to watch at 2x speed!

I just tried that and damn, that made ME seasick.

 

[nugentp]

I have been wanting to dabble in CANbus with my Arduino for a while. This thread gives some clues for good places to start further education!

 

[roli]

I'm actually not sure what message the infotainment buttons are in, I've never looked.

I'm currently only wired up to log the Powertrain and Extended CAN buses, but I can get the CAN gateway to mirror Convenience CAN out to the DLC and get it there. Will try to do that soon.

Yeah, on the PQ platform the buttons are on the convenience CAN. I am assuming it's the same on the MQB. The infotainment CAN is also an area of interest to me. Though for my purposes the most interesting is of course the instrument cluster CAN since it combines all of them.
I see that you have a fully digital instrument cluster and I am praying that the button IDs aren't different on the lower spec models. Though I fear they might be.

I have been wanting to dabble in CANbus with my Arduino for a while. This thread gives some clues for good places to start further education!

Coming soon to your desk...

 

[roli]

Speaking of the above wire mess. Any ideas why the steering wheel controls wouldn't be working with my setup?

I have the steering wheel multi function buttons connected to the steering wheel electronics control unit (GND, IGN and LIN - I find it a bit odd that there is no dedicated power, just terminal 15), then I connected this to the gateways CAN Convenience. The gateway has the engine CAN connected to my arduino, and then the "combi CAN" goes to the cluster. When I turn the key the steering wheel electronics unit generates the ignition signal (I checked, I get 12V on it), and the gateway is definitely doing something because I see a lot more activity on the CAN bus with it connected. But despite that the steering wheel controls do not work.

I know from previous experiments with Arduino only that I could at least open the menu. Am I missing something? One thing different from a normal setup (besides the missing car) is that I have clusters terminal 15 permanently wired to 12V. But not sure if that would affect anything. Or do I need some other module for the bastard to start working?

 

[Ronaldo]

Speaking of the above wire mess. Any ideas why the steering wheel controls wouldn't be working with my setup?

I have the steering wheel multi function buttons connected to the steering wheel electronics control unit (GND, IGN and LIN - I find it a bit odd that there is no dedicated power, just terminal 15), then I connected this to the gateways CAN Convenience. The gateway has the engine CAN connected to my arduino, and then the "combi CAN" goes to the cluster. When I turn the key the steering wheel electronics unit generates the ignition signal (I checked, I get 12V on it), and the gateway is definitely doing something because I see a lot more activity on the CAN bus with it connected. But despite that the steering wheel controls do not work.

Do you mean you connected your Arduino to the powertrain canbus on the Gateway? Did you try connecting the Arduino directly to the convenience bus? I don't think power connections are an issue, since I don't even have a key switch and everything works. The gateway does set an internal DTC fault when the "ignition on" pin doesn't match the info from the CAN bus Klemmen_Status message, but it doesn't stop the module from working.

I know from previous experiments with Arduino only that I could at least open the menu. Am I missing something? One thing different from a normal setup (besides the missing car) is that I have clusters terminal 15 permanently wired to 12V. But not sure if that would affect anything. Or do I need some other module for the bastard to start working?

I finally found some time to run some testings on my car, especifically on MFSW CAN bus messages. My previous dumps of CAN bus traffic didn't have any 0x5bf address messages because I really didn't use any of the MFSW functions while driving, but this time I checked all buttons and got the complete info. I found out that, despite the message ID being the same, the 0x5bf message differs from the data I had from other car models. So maybe there are model-specific issues that could be causing your cluster not to respond. Are you sure your MFSW is the same brand/model of your cluster's?

In my car, the MFSW CAN bus message is 4 byte long and the commands for the onboard computer are the following (all values in hex):

01 00 01 11 - Menu
02 00 01 11 - Right Arrow
03 00 01 11 - Left Arrow
06 00 01 11 - Wheel Uo
06 00 0F 11 - Wheel Down
07 00 01 11 - OK

These commands should be followed by a "no button" message (00 00 00 11), otherwise the cluster may become unresponsive, especially after sending left/right arrow codes. Maybe it's worth a try even though your cluster is different from mine.

 

[roli]

Do you mean you connected your Arduino to the powertrain canbus on the Gateway? Did you try connecting the Arduino directly to the convenience bus?

Yes. And, no I haven't. Though I probably should to see if anything changes when I press a button.

So maybe there are model-specific issues that could be causing your cluster not to respond. Are you sure your MFSW is the same brand/model of your cluster's?

The gateway, steering wheel, steering column electronics unit and cluster are all from different cars (and model years) - but all from Superb 2.

I know that cluster responds to 0x29, 0, 0, 0, 0, 0, 0, 0 sent to 0x5c1, but that is the only thing that works. I got the codes from this page http://blog.dietmann.org/?p=324 . That's why I got the wheel and other stuff in the first place - because I wanted to see what the deal is.

I will try the sequences that you sent on my MQB cluster. I doubt they will do anything on this PQ one .

 

[nugentp]

Yeah, on the PQ platform the buttons are on the convenience CAN. I am assuming it's the same on the MQB. The infotainment CAN is also an area of interest to me. Though for my purposes the most interesting is of course the instrument cluster CAN since it combines all of them.
I see that you have a fully digital instrument cluster and I am praying that the button IDs aren't different on the lower spec models. Though I fear they might be.


Coming soon to your desk...

LOL - have had worse (or better - depending on your outlook on such things) !

 

[roli]

I might have found why my buttons don't work... I have the 5K0-953-549 steering wheel electronics control module - which according to this page: http://wiki.ross-tech.com/wiki/index.php/Steering_Wheel_Control_Module_Versions is lowline variant, so it probably doesn't support the steering wheel controls. Now to find a suitable replacement that will

 

[roli]

Well... while waiting for my new electronics unit for the PQ cluster I went poking around my MQB cluster. Looks like I poked something that I shouldn't have.

As far as I know this is pretty much where the story for this cluster ends. Unless one of you guys knows anything that I don't.

For reference... I was poking around on the CAN address 0x5bf, trying different combinations to see if changing some stuff might give me working steering wheel controls.

 

[jyoung8607]

If all the components on your bench are from different cars, yeah I expect you to trip Component Protection eventually. I'm surprised you didn't earlier.

In the future, be especially careful with 0x6B4 on MQB and 0x5D2 on PQ. Those are periodic multiplexed messages that broadcast the car's VIN and a bit of Component Protection data. I *think* the CAN gateway is the sender, but I'm not sure. Definitely don't spam random stuff at those arb IDs to see what happens. You COULD try MITM filtering those messages away from components you care about. I don't know if that would do anything to rescue a component that's already tripped into protection mode, but might possibly save you in the future.

 

[roli]

For the above MQB cluster I don't have any other components at all. And the only address that I was playing with was 0x5bf.

I am now thinking of getting a matching set. What would I need to stop the CP from getting triggered on a cluster - or would recover it? Would the ECU, gateway, key/lock set and cluster be enough? Somebody suggested I would also need a matching BCM and ELV... can anybody confirm that?

 

[jyoung8607]

I'm afraid that I'm not deeply familiar with Component Protection itself, I'm just aware of some basics. There are a lot of test-bench builders here on the forum though, and a lot of folks who specialize in "unconventional" means of overcoming Component Protection, so hopefully someone more knowledgeable on that can contribute.

Speaking very broadly, I've never heard of a controller going into CP (or at least, not irrevocably so) due to missing controllers, just mismatched ones. It's possible there's some sort of maximum timer for ignition-on without having seen expected CP master messaging from the gateway.

 

[Ronaldo]

If all the components on your bench are from different cars, yeah I expect you to trip Component Protection eventually. I'm surprised you didn't earlier.

For that reason, in my workbench project I included a switch to disconnect the gateway and send only the messages from the Arduino to the module being tested. But, inadvertently, I forgot to check the switch and tested the instrument cluster with the gateway connected. Nothing happened. I've been testing the cluster with and without the gateway connected to the bus for months and I have no idea if it should or shouldn't activate CP. So I think I'm not so helpful on this subject.

In the future, be especially careful with 0x6B4 on MQB and 0x5D2 on PQ. Those are periodic multiplexed messages that broadcast the car's VIN and a bit of Component Protection data. I *think* the CAN gateway is the sender, but I'm not sure.

In my tests I verified that the 0x6B4 message is sent by the instrument cluster itself (at a 200ms rate), so I suppose the gateway only forwards it. So I suppose there must be another message the cluster has to receive in order to activate its own CP.

 

[roli]

For that reason, in my workbench project I included a switch to disconnect the gateway and send only the messages from the Arduino to the module being tested. But, inadvertently, I forgot to check the switch and tested the instrument cluster with the gateway connected. Nothing happened. I've been testing the cluster with and without the gateway connected to the bus for months and I have no idea if it should or shouldn't activate CP. So I think I'm not so helpful on this subject.

From what I gathered from other places the PQ platform clusters (except Audi) are generally considered to be safe to work on the bench. As in they don't have any specific component protection. The (again non-Audi) MQB ones were also believed to not have "full SAFE" (so only the little SAFE message in the corner), but apparently I managed to trigger it in mine. And then the MQB Evo ones are pretty much useless.

So yeah, now I am thinking of getting a matching set from a Golf 7, but first I need to find some info on what exactly needs to match for the CP to "go away".

 

[roli]

Well, things are getting more and more fun... and not in a good way.

I just heard from another guy with an MQB Polo cluster (same as my T-Cross) whose cluster went into CP without him doing anything weird - just running the code from my github. So the theory that CP activates after some time without seeing some other devices on the network is seeming more and more likely. Now it could be that this is a total time, or a time after start - both me and the other guy had the clusters running for over an hour when this happened. It could also be that this is limited to some slightly newer clusters - like the MQB Polo or T-Cross that are both 2017+ years.
I have a complete set of MQB hardware from the same car on the way, so hopefully I can use that safely, but we will see.

I've also received a PQ steering column electronics module thingy from a car which had MFSW and transplanted it into my Superb 2 setup... and nothing. Buttons don't work (no backlight on them either). Not sure what is going on there. This is a module that I've seen described as a suitable upgrade for a Superb 2 if you want to retrofit MFSW (though the module is from Golf 6). The gateway and cluster are also from a Superb that had MFSW, so this should be coded correctly and work. My only remaining idea is that I either did something wrong in the wiring or my steering wheel is actually broken (it was absolutely filthy when I got it... so could have very well been left somewhere outside).

According to others I should have gone with BMW or Merc who apparently don't have these issues .

 

[roli]

Well... finally some good news. I finally had some time to work on the PQ clusters. I have created/updated both of my sketches for PQ25 (Polo) and PQ46 (Superb) clusters. Thanks to the data from @jyoung8607 . Sadly I still can't get the steering wheel controls to work, but since those clusters are not my primary focus I will live with it.

I also got a MQB Golf 7 cluster to replace my T-Cross one. And I am happy to see no indications of CP on there. Even in normal operation there are no SAFE indicators anywhere. Could be that it's a bit too early for CP?
And thanks to @Ronaldo I also got the basic trip computer working. Still can't access the detailed menu, but at least I can switch between those main displays.

 

[V8Joel]

@roli If you'd like some more interesting MQB data to look at, and you don't easily get motion sickness, you might find this data useful. This is from my 2018 Volkswagen Golf R doing some "spirited driving" last month at a Golf R/R32 owners gathering here in the US. And yes, my hand positioning sucks, I'm working on it.

3cfdec54aa035f3f|2023-04-13--10-35-24

Hey jyoung8607. I'm reverse engineering an MQB Golf R cluster for a bench project very similar to everyone else here. Would you mind please sharing your CAN logs with me also? My email is joelsadler10@gmail.com.

Thank you so much.

 

[jyoung8607]

Hey jyoung8607. I'm reverse engineering an MQB Golf R cluster for a bench project very similar to everyone else here. Would you mind please sharing your CAN logs with me also? My email is joelsadler10@gmail.com.

Thank you so much.

The route `3cfdec54aa035f3f|2023-04-13--10-35-24` is marked public so anyone can look at it, just need to download and build openpilot. That will include Cabana, the reverse engineering tool in the screenshots.

 

[siLc]

I have created/updated both of my sketches for PQ25 (Polo) and PQ46 (Superb) clusters.

Superb 2 is PQ35. PQ46/47 are only Passat B6, B7 and CC.