Looking for some CAN bus data of PQ and MQB platform cars

[roli]

Superb 2 is PQ35. PQ46/47 are only Passat B6, B7 and CC.

Not according to wikipedia. Of course it could be wrong.

Also not according to my feeling as somebody who owned a Superb 2 a few years back. Superb 2 is definitely based on the Passat B6/B7. You can see it as soon as you look inside. Besides... it's larger than B6/B7.

 

[siLc]

Not according to wikipedia. Of course it could be wrong.

Also not according to my feeling as somebody who owned a Superb 2 a few years back. Superb 2 is definitely based on the Passat B6/B7. You can see it as soon as you look inside. Besides... it's larger than B6/B7.

Physical properties of the vehicle can be misleading. Characteristic trait of PQ46/47 is the presence of both the CECM/BCM and CCM and the fact that the cluster isn't a part of the immo. Superb has only BCM, like other PQ35 vehicles, and cluster has immo. Also the presence of ELV and EPB vs having the standard mechanical steering lock and lever handbrake.

 

[roli]

Sadly I can't find any concrete information in the docs that I have from erwin. Sources on the internet all seem to claim PQ46, but we know how reliable that is.

I do know for sure that Superb 2 has an ELV though - if you have it specced with Kessy at least.

 

[roli]

Meanwhile I have finally received a few matching modules for my Golf 7 setup. I've wired them up for a bench setup, but sadly I am having some issues getting the cluster to wake up. So what I have connected here is the ECU, BCM, gateway, cluster and steering column electronics control unit. So when I apply power the cluster needles (just the needles) light up, and that's it. When I turn the key I start getting the T15 voltage, but the cluster doesn't wake up. Of course the cluster has CAN ignition so somebody isn't generating the correct CAN messages... but who is to blame?

My connections:

ECU:
T94 pin 5 = 12V
T94 pin 1 = GND
T94 pin 87, 92 = T15
T94 pin 67 = powertrain CAN L
T94 pin 68 = powertrain CAN H

Gateway:
pin 1, 2 = 12V
pin 11, 12 = GND
pin 14 = T15
pin 5 = convenience CAN L
pin 15 = convenience CAN H
pin 6 = powertrain CAN L
pin 16 = powertrain CAN H

BCM:
T73c pin 73 = 12V
T73c pin 63 = GND

T73a pin 14 = T15
T73a pin 16 = convenience CAN H
T73a pin 17 = convenience CAN L

Steering column electronics control unit:
T16r pin 1 = 12V
T16r pin 2 = GND
T16r pin 3 = convenience CAN L
T16r pin 4 = convenience CAN H
T16r pin 14 = T15
T16r pin 16 = T15

Cluster:
pin 1 = 12V
pin 10 = GND
pin 8 = lock immo reader coil
pin 9 = lock immo reader coil
pin 17 = convenience CAN L
pin 18 = convenience CAN H

Does anyone see something that isn't connected properly, or see any missing connections?

 

[Ronaldo]

Meanwhile I have finally received a few matching modules for my Golf 7 setup. I've wired them up for a bench setup, but sadly I am having some issues getting the cluster to wake up. So what I have connected here is the ECU, BCM, gateway, cluster and steering column electronics control unit. So when I apply power the cluster needles (just the needles) light up, and that's it. When I turn the key I start getting the T15 voltage, but the cluster doesn't wake up. Of course the cluster has CAN ignition so somebody isn't generating the correct CAN messages... but who is to blame?

I got really scared with the complexity of your workbench but that's how a workbench is supposed to look like, right? Anyway, the only CANbus message the MQB cluster needs to wake up is 0x3C0 (Klemmen_Status_01). AFAIK, if the message 0x5F0 (Dimmung_01) is not being received, backlight intensity should default to maximum. Maybe the cluster is receiving Dimmung_01 with the field corresponding to the dimmer set to zero.

 

[roli]

The bench needs some organization .

I luckily figured it out on Sunday. One thing that I did is - I wired the T15 connections from the steering wheel column to the BCM as they should be wired (so basically three separate wires between BCM and steering column unit). That didn't make it work.
Then I looked at the BCM connections again - BCM has multiple 12V pins (one for left light supply, one for door supply, ...) and initially I only had one (the one that has no special function) connected. So I connected all of them. And suddenly the thing came alive.

The next thing that wasn't working were the steering column controls again. But this time I figured it out - there is a LIN bus connection going from steering column electronics unit to gateway. And that one needs to be connected. I always assumed that the steering column would generate the messages for steering controls, but apparently it just forwards the LIN bus to the gateway and that one then does the magic.

So finally:

The next step now is to inject my ESP32 somewhere on the bus. My thinking is just break the convenience bus coming from gateway to cluster and then wire up two CAN transceivers so I can basically selectively let through some of the messages, while modifying the others. The only downside is that then I won't get consumption information on the radio and stuff like that.

 

[AINils]

How to get cabana for Windows without Hardware of comma ai? Can't find any download of that tool

 

[roli]

How to get cabana for Windows without Hardware of comma ai? Can't find any download of that tool

For windows... forget it . Your best bet is to get something like VMWare Player (it's free), then create a virtual machine and install the recommended Ubuntu version into it. The installation process is pretty straightforward if you are somewhat familiar with linux: https://github.com/commaai/openpilot/blob/master/tools/README.md
You will need like 30GB of space during the install though. This will install the complete openpilot... which includes cabana.

 

[AINils]

Linux is okay also, thanks for link will install at Linux on my proxmox Server

 

[PeteJ]

I believe I may have stumbled onto a thread that will point me at the details I'm looking for. For lack of a better term what I am looking for is a CANbus glossary for a data logger. For example address 0x7XX = Value "Y" where Y is oil pressure in BAR. Is anyone aware of a document like this or how to get it for MQB cars?

 

[tranquility]

hello together

@roli you seem to be familar with the crc an magic byte things


i try to get into can and control a speedometer. with VW PQ platform it worked a little bit. but i want to do it mith MQB platform which seems to be more difficult
sending and reading can signals via mcp2515 module works but i don´t get it to work

-rpm
-speed
-fuel level
-turn indicator
-....

if i send signals...nothing happens...maybe there have to be send a set of signals to verify messages as okay
maybe another thing is a problem. i read about magic bites which change every meassage

more informations (meassages examples etc.) will be no problem

greetings from germany, hope you understand my bad english

I believe I may have stumbled onto a thread that will point me at the details I'm looking for. For lack of a better term what I am looking for is a CANbus glossary for a data logger. For example address 0x7XX = Value "Y" where Y is oil pressure in BAR. Is anyone aware of a document like this or how to get it for MQB cars?

hello @PeteJ documents like this exist, but are kind of secret i think

 

[jyoung8607]

I believe I may have stumbled onto a thread that will point me at the details I'm looking for. For lack of a better term what I am looking for is a CANbus glossary for a data logger. For example address 0x7XX = Value "Y" where Y is oil pressure in BAR. Is anyone aware of a document like this or how to get it for MQB cars?

The term you're looking for is "CAN database" or "DBC".

opendbc/vw_mqb_2010.dbc at master · commaai/opendbc

democratize access to car decoder rings. Contribute to commaai/opendbc development by creating an account on GitHub.

github.com

It's not necessarily authoritative, and it's definitely not complete, but it should get you started.

 

[Ronaldo]

i try to get into can and control a speedometer. with VW PQ platform it worked a little bit. but i want to do it mith MQB platform which seems to be more difficult
sending and reading can signals via mcp2515 module works but i don´t get it to work

-rpm
-speed
-fuel level
-turn indicator
-....

if i send signals...nothing happens...maybe there have to be send a set of signals to verify messages as okay
maybe another thing is a problem. i read about magic bites which change every meassage

Some of the messages (the more critical ones, I suppose) exchanged in MQB platform have a CRC in the first byte, which is calculated on the remaining bytes of the message using the CRC8H2f AUTOSAR algorithm. The four lower bits of the second byte contain a cyclic counter, incremented from 0 to 15 every time a message with the same CANbus ID is sent. While calculating the CRC on the message payload, the algorithm also adds a "padding byte" at the end, for example, if it's an 8 byte message, there are 7 real bytes to use in the calculation, and an additional "8th byte", which is probably you are referring to as "magic byte". That padding byte is "secret" (as far as I know), and it varies from one message ID to another and may also be different for each value of the counter. It's possible to reverse-calculate it though, if you have samples of the CANbus message you want to generate. I wrote a code to find the values for the unknown padding bytes from a set of message data collected from the CANbus traffic. You can find it at:

GitHub - ronaldocordeiro/MQB_CRC_padding_byte_finder: Finds the values for the padding bytes used to calculate CRC in VAG MQB CANbus messages

Finds the values for the padding bytes used to calculate CRC in VAG MQB CANbus messages - GitHub - ronaldocordeiro/MQB_CRC_padding_byte_finder: Finds the values for the padding bytes used to calcul...

github.com

I wrote some Arduino code to control a MQB cluster some time ago. PM me if you are interested.

 

[tranquility]

thanks so far.
the crc is horrific for me but i keep trying to understand it

i tried your code and the "klemmen status" seems to work. but i still don´t get a speed signal there...
as far as i know, the speed signal hast to be 20ms cycle time ? in your code its delayed 100ms
don´t know if i have the newest version if i change the delay do 20ms it didnt work.

i have another solution for the "klemmen status" thing....i use gateway+BCM+steering column+key, so in this setup i don´t have to think about klemmen status...

i tried to send door open signal, which has no crc as far as i know...but this doenst work....argh

theres a thing i don´t understand: maybe the gateway blocks everything because it sends messages like: therese no ABS system, theres no eninge ecu, theres no door ecu etc etc.
if i send a door open for example. i surely have to send:
-"hello, door ecu is here, everything is fine"
-"driver door open"

just the signal "driver door open" will be ignored becose the gateway blocks it with: "error door ecu"

and for a guilty speed signal there are more messages needed than just the speed value itself ?

i can´t send pm here because i am propably not a regular member because i got no vcds serial number
maybe there is another way to contact you ?


greetings

 

[Ronaldo]

thanks so far.
the crc is horrific for me but i keep trying to understand it

i tried your code and the "klemmen status" seems to work. but i still don´t get a speed signal there...
as far as i know, the speed signal hast to be 20ms cycle time ? in your code its delayed 100ms
don´t know if i have the newest version if i change the delay do 20ms it didnt work.

i have another solution for the "klemmen status" thing....i use gateway+BCM+steering column+key, so in this setup i don´t have to think about klemmen status...

The Klemmen_Status message generator is intended only to "wake up" control modules for bench testing without the need to have a real BCM,steering column,key setup, so it's not useful for you. The message containing vehicle speed in MQB platform is ESP_21 (address 0xFD) in OpenDBC documentation. But some cars seem to use ESP_24 (0x31B), which is not documented in OpenDBC, along with ESP_20 (address 0x65D). ESP_20 contains the tire circumference and the cluster uses it to check ESP_24 distance counter field increment against the vehicle speed field. If it finds the data inconsistent, or if it doesn't receive ESP_20 at all, it drops the speedometer needle to zero after a few seconds and sets an internal fault (something like "unplausibles Signal Wegstrecke/Geschwindigkeit").

 

[tranquility]

the klemmen status will be useful in future but to keep error possibilities small i decided to first use it all

main goal is to control the mqb cluster (speed, rpm, temperatures, turn signals, error lamps)
background is an engine swap PQ / MQB.

 

[tranquility]

yeaaaah thx @roli
i ordered an esp32 module to try it with your code and it works


so my work will be to get it to work with arduino and own code with parts of your code..
i am no´t so used in programming so it will take a lot of time
but now i got new motivation because i have seend that it is possible to get it work

 

[tranquility]

yeaaaah i get it to work with my arduino....the only thing which does not work properly is....SPEED
the same problem i had with esp32 and the original code....speed drops to 0 after 10seconds or something like this...
i read about this problem somewhere...hmmmm and there was an code update which eleminated problems which speed drop to zero

@roli send help please

 

[tranquility]

i am nearly finished with the first milestone of my project.
i coded the crc calculation and the whole thing new. and came to some other stuff than the r00li code...as far as i know there are some problems in the code which generate false crc
maybe i will try it again with the cluster. and maybe the speed to zero problem is now gone. but this is not important for my project. the cluster thing was the start to learn and undestand can messages

the only message which is left with a timeout error is: BCM_01
but i think i will find a solution

today i found a very tricky thing in the klemmen_steuerung_01 message. there are messages in the byte which is used for the message counter part of the crc

 

[roli]

Hey guys! I am back with my weird shit .

I got one of these (a VW Golf 7 gear selector - part number 5Q2713023AB) and now I am looking for some information on what CAN messages I need to send it for it to be happy. Using my current MQB code for running the cluster doesn't seem to be enough. No matter if I apply the power or not, its flashing the selected gear. And if I move it to P, then it refuses to move unless I use the manual release on the side. I also tried replaying some CSV trace files that I had from before, and those don't seem to be enough either.

Reading it seems simple enough - it is sending the currently selected position in the first byte of 0x0AF message.

Any ideas on what messages do I need to send it for it to be happy?