Looking for some CAN bus data of PQ and MQB platform cars

[CanCoder]

0xFD is the ESP_21 which is checksum protected, but I have not found the 0x31B (ESP_24) in the DBC file.
It is interesting, why they are using two different CAN IDs for the speed transmitting?
If you can send a full log it would be nice, thanks in advance.

 

[Alex640]

Can you post some example for the vehicle speed reading?
Or can you post a whole CAN bus sniff when the car is moving?
I will try to search the CAN bus ID for the vehicle speed.

Speed 40, 60, 0-70, 0-103-0 Km/h
https://drive.google.com/file/d/1QFrPiySvm4arJL0xMPL8AVVGYy7cL7Ll/view?usp=sharing

 

[CanCoder]

Thank you very much!
I will need some days until I can decode the data, but I will try to make charts in Excel from it.

 

[CanCoder]

It seems I have found the structure of the 0x31B (ESP_24):
byte 0: checksum
byte 1: counter
byte 3: speed/2 (half of the actual speed)
The rest of the bytes are unknown for me.

 

[CanCoder]

And here is the chart:

MQB-dash-kmh hosted at ImgBB

Image MQB-dash-kmh hosted in ImgBB

ibb.co

My message to Uwe/to a moderator: is it possible to permit to me posting without waiting for moderator approval? Is it possible to upload images without using external websites (I have phyisical copy from every image, but I am afraid after some months these photos may can be deleted from the ibb.co?

 

[Ronaldo]

It seems I have found the structure of the 0x31B (ESP_24):
byte 0: checksum
byte 1: counter
byte 3: speed/2 (half of the actual speed)
The rest of the bytes are unknown for me.

I couldn't find any documents about ESP_24, all I know is what I've found when I was analysing CANbus messages in order to write code to control a MQB instrument cluster:

bytes 2 and 3 contain vehicle speed (16 bit, least significant bits in byte 2).

bytes 5 and 6 contain a wheel rotation counter (11 bit, 8 bits in byte 5 and 3 lowest bits in byte 6). The maximum value for that counter is byte 5=FF and byte 6=07. After FF 07, the counter value doesn't increase to byte 5=FF and byte 6=08, neither returns to 00 00. Instead it sets byte 5=00 and byte 6=10. It seems that the fifth bit set to 1 in byte 6 is some kind of flag indicating that the rotation counter has reached its maximum at least once. The counter is reset to all zeros when the vehicle spead goes down to zero, then starts counting again when vehicle starts to move. The information from the counter is checked by the instrument cluster against the vehicle speed and the wheel circumference (taken from the message ESP_20) and the ESP_24 message can be rejected if it finds data to be inconsistent (in this case, a DTC fault is set and the speed needle drops to zero).

bytes 4 and 7 seem to be zero all the time, so I have no idea what they are for.

 

[khaledabdulaziz]

The bench needs some organization .

I luckily figured it out on Sunday. One thing that I did is - I wired the T15 connections from the steering wheel column to the BCM as they should be wired (so basically three separate wires between BCM and steering column unit). That didn't make it work.
Then I looked at the BCM connections again - BCM has multiple 12V pins (one for left light supply, one for door supply, ...) and initially I only had one (the one that has no special function) connected. So I connected all of them. And suddenly the thing came alive.

The next thing that wasn't working were the steering column controls again. But this time I figured it out - there is a LIN bus connection going from steering column electronics unit to gateway. And that one needs to be connected. I always assumed that the steering column would generate the messages for steering controls, but apparently it just forwards the LIN bus to the gateway and that one then does the magic.

So finally:

The next step now is to inject my ESP32 somewhere on the bus. My thinking is just break the convenience bus coming from gateway to cluster and then wire up two CAN transceivers so I can basically selectively let through some of the messages, while modifying the others. The only downside is that then I won't get consumption information on the radio and stuff like that.

you've done great work and thanks for posting the pinout, i have a question, if i have only cluster and gateway along with key, will i be able to turn on clusters on bench ? or do i have to get full setup, i have cluster and gateway for skoda octavia 2015 1.4 petrol
Edit.: i was able to read the immo data even when clusters are not fully on, but if i wanted to add a key, i wont be able to see whats happening, thats why i need it to be fully on