Testbench setup?

[Pow3rus3r]

Did you try the message Diagnose_01 ? I can send you some samples from my car in case you need it.

opendbc/vw_mqb_2010.dbc at master · commaai/opendbc

democratize access to car decoder rings. Contribute to commaai/opendbc development by creating an account on GitHub.

github.com

Thank you for the reply!

Yes, I tried "Diagnose_01" but it seems that the date/time from this message is only used for diagnosis (the time stamps for the fault codes). The displayed date/time seems to be in another message.

I think, it will be sent over BAP message. I figured out that there is a BAP message called "BAP_Uhrzeit_FSG_01" on ID 0x97331110 which seemingly contains the date and time for the MIB headunit. But for figuring this out I need a trace from the CAN-Infotainment of an Audi A6/A7 C8, Audi Q5 FY facelift or an Audi A4 B9 facelift. Maybe anybody can send me a trace of that?

 

[Ronaldo]

I think, it will be sent over BAP message. I figured out that there is a BAP message called "BAP_Uhrzeit_FSG_01" on ID 0x97331110 which seemingly contains the date and time for the MIB headunit. But for figuring this out I need a trace from the CAN-Infotainment of an Audi A6/A7 C8, Audi Q5 FY facelift or an Audi A4 B9 facelift. Maybe anybody can send me a trace of that?

Are you sure about the ID 0x97331110 or did you mean 0x17331110? If so, maybe you could find it useful to check the info on this page:

Сниффим CAN-Inf MQB (пока что дополняемая)

Изначальная цель работ, это организовать автоматическое включение рециркуляции при работе вебасто. По результату есть запись. А тут, на правах записок на полях, буду накидывать инфу, которую накопал.…

www.drive2.ru

0x17331110 seems to be a polymorphic message with different lengths and contents, defined by the first two data bytes. I worked on similar messages when I was decoding the TPMS BAP messages in the MQB platform (TPMS has some 10 or more different content types for the same message ID) and that really makes it so much harder do analyse. I've checked my trace files and found some of the 0x17331110 formats mentioned on the page, especially the "only time" and "only date". Examples:

34 50 17 05 1C (year 23, month 05, day 28)
44 51 16 20 0B (hour 22, minute 32, second 11)

 

[Pow3rus3r]

Are you sure about the ID 0x97331110 or did you mean 0x17331110? If so, maybe you could find it useful to check the info on this page:

Сниффим CAN-Inf MQB (пока что дополняемая)

Изначальная цель работ, это организовать автоматическое включение рециркуляции при работе вебасто. По результату есть запись. А тут, на правах записок на полях, буду накидывать инфу, которую накопал.…

www.drive2.ru

0x17331110 seems to be a polymorphic message with different lengths and contents, defined by the first two data bytes. I worked on similar messages when I was decoding the TPMS BAP messages in the MQB platform (TPMS has some 10 or more different content types for the same message ID) and that really makes it so much harder do analyse. I've checked my trace files and found some of the 0x17331110 formats mentioned on the page, especially the "only time" and "only date". Examples:

34 50 17 05 1C (year 23, month 05, day 28)
44 51 16 20 0B (hour 22, minute 32, second 11)

Oh, yes, I mean ID 0x17331110 (this is the "BAP_Uhrzeit_01" message). I will check it out and try to manipulate these messages on mit MIB unit. Maybe I will get the time displayed correctly.
Do you know if this message ID is on your CAN trace of your MQB car, too? I thought, it will maybe a MLBevo thing?

Thank you!

 

[Ronaldo]

Oh, yes, I mean ID 0x17331110 (this is the "BAP_Uhrzeit_01" message). I will check it out and try to manipulate these messages on mit MIB unit. Maybe I will get the time displayed correctly.
Do you know if this message ID is on your CAN trace of your MQB car, too? I thought, it will maybe a MLBevo thing?

Thank you!

Yes, the message ID found on my trace files is 0x17331110, so probably BAP codes are the same in MQB and MLBevo, right?
BTW, where did you get the BAP message name/ID from? I found no reference about BAP codes anywhere when I was doing my decode work.

 

[Pow3rus3r]

Yes, ssems to be the same. I've tested to send the both messages on the bus but the time/date doesn't change on the MMI display.

I've found the ID 0x17331110 on google but without any further description of the messages

 

[Ronaldo]

Yes, ssems to be the same. I've tested to send the both messages on the bus but the time/date doesn't change on the MMI display.

I'm posting below a 30 seconds set of 0x17331110 messages from my trace files. Maybe you can make your MMI get proper date/time by sending the whole set to the canbus, then trying to reduce the set until you find out which messages are needed or not. I think it's worth a try. (First field is timestamp, second is the message ID, third is size, others are data).

0.610881    17331110x    8    B0    07    34    5E    00    01    01    00
0.660706    17331110x    5    44    51    0C    25    31            
0.710824    17331110x    4    F0    00    00    00                
1.611085    17331110x    8    34    42    03    00    11    00    04    01
1.660667    17331110x    5    44    51    0C    25    32            
2.610907    17331110x    8    80    08    34    43    38    03    C8    BE
2.660720    17331110x    5    44    51    0C    25    33            
2.710723    17331110x    5    C0    00    00    00    00            
3.610439    17331110x    3    34    44    0A                    
3.660569    17331110x    5    44    51    0C    25    34            
4.610136    17331110x    3    34    4E    05                    
4.660094    17331110x    5    44    51    0C    25    35            
5.609969    17331110x    3    34    4F    00                    
5.659787    17331110x    5    44    51    0C    25    36            
6.609950    17331110x    5    34    50    15    05    1E            
6.659929    17331110x    5    44    51    0C    25    37            
7.609984    17331110x    5    34    51    0C    25    37            
7.659975    17331110x    5    44    51    0C    25    38            
8.609612    17331110x    4    34    54    01    01                
8.659431    17331110x    5    44    51    0C    25    39            
9.609438    17331110x    8    34    58    FF    FF    FF    FF    FF    FF
9.659353    17331110x    5    44    51    0C    25    3A            
10.609078    17331110x    8    34    5A    02    00    00    00    00    00
10.658884    17331110x    5    44    51    0C    25    3B            
11.609131    17331110x    8    80    07    34    5B    00    01    01    00
11.658989    17331110x    5    44    51    0C    26    00            
11.708998    17331110x    4    C0    00    00    00                
12.608848    17331110x    8    90    07    34    5C    00    01    01    00
12.658704    17331110x    5    44    51    0C    26    01            
12.708824    17331110x    4    D0    00    00    00                
13.608738    17331110x    8    A0    07    34    5D    00    01    01    00
13.658747    17331110x    5    44    51    0C    26    02            
13.708693    17331110x    4    E0    00    00    00                
14.608650    17331110x    8    B0    07    34    5E    00    01    01    00
14.658771    17331110x    5    44    51    0C    26    03            
14.708582    17331110x    4    F0    00    00    00                
15.608894    17331110x    8    34    42    03    00    11    00    04    01
15.658705    17331110x    5    44    51    0C    26    04            
16.608739    17331110x    8    80    08    34    43    38    03    C8    BE
16.658666    17331110x    5    44    51    0C    26    05            
16.708623    17331110x    5    C0    00    00    00    00            
17.608727    17331110x    3    34    44    0A                    
17.658650    17331110x    5    44    51    0C    26    06            
18.609156    17331110x    3    34    4E    05                    
18.658762    17331110x    5    44    51    0C    26    07            
19.609086    17331110x    3    34    4F    00                    
19.658883    17331110x    5    44    51    0C    26    08            
20.608754    17331110x    5    34    50    15    05    1E            
20.658722    17331110x    5    44    51    0C    26    09            
21.608445    17331110x    5    34    51    0C    26    09            
21.658492    17331110x    5    44    51    0C    26    0A            
22.608463    17331110x    4    34    54    01    01                
22.658547    17331110x    5    44    51    0C    26    0B            
23.608509    17331110x    8    34    58    FF    FF    FF    FF    FF    FF
23.658211    17331110x    5    44    51    0C    26    0C            
24.608171    17331110x    8    34    5A    02    00    00    00    00    00
24.658238    17331110x    5    44    51    0C    26    0D            
25.607960    17331110x    8    80    07    34    5B    00    01    01    00
25.658052    17331110x    5    44    51    0C    26    0E            
25.707929    17331110x    4    C0    00    00    00                
26.607961    17331110x    8    90    07    34    5C    00    01    01    00
26.658090    17331110x    5    44    51    0C    26    0F            
26.707914    17331110x    4    D0    00    00    00                
27.608205    17331110x    8    A0    07    34    5D    00    01    01    00
27.658034    17331110x    5    44    51    0C    26    10            
27.708130    17331110x    4    E0    00    00    00                
28.608398    17331110x    8    B0    07    34    5E    00    01    01    00
28.658141    17331110x    5    44    51    0C    26    11            
28.708235    17331110x    4    F0    00    00    00                
29.608579    17331110x    8    34    42    03    00    11    00    04    01
29.658407    17331110x    5    44    51    0C    26    12            
30.608540    17331110x    8    80    08    34    43    38    03    C8    BE
30.658447    17331110x    5    44    51    0C    26    13            
30.708490    17331110x    5    C0    00    00    00    00

 

[Pow3rus3r]

Ok, I sent the messages with this timing on the bus, but date/time haven't changed So I will try to get a CAN trace of a MLBevo car. Maybe there are further messages needed

 

[nugentp]

Maybe a stupid question on this thread and apologies now if I have missed it, but what are some good SW tools (free or not) for some entry level CAN Bus sniffing ? I was thinking to just put something together with Arduino using a CAN shield and some open-source code as the basis for something to start with, but I will be delighted if there is a faster route unless it costs a lot of money.

Related question - is the CAN Bus traffic on VAG vehicles in the clear or encrypted (or just headers in the clear and body encrypted) ?

 

[Ronaldo]

Maybe a stupid question on this thread and apologies now if I have missed it, but what are some good SW tools (free or not) for some entry level CAN Bus sniffing ? I was thinking to just put something together with Arduino using a CAN shield and some open-source code as the basis for something to start with, but I will be delighted if there is a faster route unless it costs a lot of money.

I'm no CAN bus specialist, just made some traffic monitoring a few years ago when I was building a converter circuit for a TPMS module for my car, and writing code for a signal generator for a testbench so I'm probably not the best source for advice on tools. I have a USB interface that works with Cangaroo, an open source can bus analyzer. I also wrote my own code for capturing traffic directly with the Arduino with a MCP2515 interface, but soon realized that standard Arduino is not fast enough to process the high volume of messages in a 500kbps bus. Too many messages are lost. It works much better if it's intended to send a few messages instead of monitoring traffic.

Related question - is the CAN Bus traffic on VAG vehicles in the clear or encrypted (or just headers in the clear and body encrypted) ?

AFAIK, standard CAN bus messages are not encrypted at all.

 

[Pow3rus3r]

I'm using a Peak PCAN USB Interface with Savvy CAN for injecting messages into the bus and the Peak PCAN-view for logging the whole bus

 

[nugentp]

Thanks both for that info - super useful.

I'm using a Peak PCAN USB Interface with Savvy CAN for injecting messages into the bus and the Peak PCAN-view for logging the whole bus

Any reason to use Savvy CAN for transmission instead of Peak PCAN-View which offers transmit and receive function in the same tool ?

 

[Pow3rus3r]

(For me) the data format of PCAN-view is better (*.trc [txt] files), SavvyCAN saves the logs as *.csv files.

 

[Pow3rus3r]

The BAP Clock protocol seems to be much complexer then I thought. I've not managed to get a displayed time/date on my MIB unit. Now I have connected a MQB instrument cluster and it works fine (now the MIB unit adopted the time from the instument cluster and gets the time over gps if there is a valid gps signal).

Does anybody know how to manipulate the fuel level sensors resistence to the instrument cluster? There ale 3 pins (T18/11 T18/14 and T18/15) for the level sensor. T18/11 is the signal ground - but how are the other 2 pins connected? I tried a 100 Ohm resistor between signal ground and Pin 14 and 15, but I didn't get a displayed fuel level.

 

[nugentp]

So I extended my A1 bench loom with a pair of door control modules and front door locks (its a 3-door bench and I sourced the parts cheap). I used OE looms to get everything hooked up like factory on the driver side and I made my own mini loom from the passenger module to the lock - checking everything against official WD etc.

I have modules 09, 17, 19, 25, 42, 46, 52 connected.

Long story short - I got to a point where I could run successfully output tests on the door modules - you need the doors closed for that so thats easy enough to simulate. I was able to see the door status bits reflected in a correct looking way and lock / unlock with the internal button or the key switch on the drivers door lock.

Then I wanted to clear faults on the BCM for lack of anti-theft module, rear broken glass sensor and that the tailgate lock was not consistent as none of those are on the bench loom or faked in some other way, so I set to making the relevant coding changes on the BCM which were accepted OK.

Following that, I am now unable to access the BCM with VCDS presenting a suggestion that it is because the doors are locked - despite them showing as unlocked on the door modules. Consistent with this is that the door locked / alarm LED flashes and I cannot find the right combination of steps to get things in a state where the BCM is happy that the car is unlocked.

I even tried unplugging everything and powering it all down for a good amount of time but the problem persists annoyingly. I already verified the door status switches on both sides seem to be working fine. Its also weird that when I power up the bench with both doors open that the alarm/locked LED still flashes so something is badly out of sync somehow. Any ideas getting of jail welcome.

I have a feeling that I will need to simulate the CAN message from the drivers door module to the BCM to unlatch the locked state.

 

[nugentp]

I am assuming the main mistake I must have made was to have changed BCM coding while the car was locked, so thats maybe how i got things out of sync. Its kind of crazy. Guessing to get out of jail I will need to sniff the 'wake' and 'unlock' messages from the CONV bus on a real A1 and replay that sequence into the bench BCM to try and restore some sense of sanity. Seems like I will be needing to buy some new toys from PEAK and get my hands dirty.

On my bench loom I used a resistor hack to wake up the cluster by avoiding a need for the SWC, but this may also be part of the problem as I expect the SWC will be source of wake messages when the ignition key is turned on. I am only guessing at this stage - seems inevitable that some decent amount of bus sniffing and capture will be needed to start understanding all this CAN milarkey.

 

[nugentp]

A general question about CAN bus sniffer devices - do they need to be the 'high speed' (FD) type to work with all modern VAG vehicles or does the regular type suffice for our needs (supporting up to 1Mbps iirc) ?

 

[Uwe]

A general question about CAN bus sniffer devices - do they need to be the 'high speed' (FD) type to work with all modern VAG vehicles or does the regular type suffice for our needs (supporting up to 1Mbps iirc) ?

Depends where you're sniffing and how "modern" the car is.

-Uwe-

 

[nugentp]

Say 2011 Audi A1 convenience bus for starters (thats the bench loom I would like to unlock by sniffing a real car)... but if you have any clues on what vehicles/years/bus types could benefit from having the FD version that would help justify the extra spend in case I ever encounter them !

 

[Uwe]

Say 2011 Audi A1 convenience bus for starters

Nah, I'm pretty sure that won't be FD.

but if you have any clues on what vehicles/years/bus types could benefit from having the FD version that would help justify the extra spend in case I ever encounter them !

If I had to guess, nothing older than MQB, but I'm not sure it's required there. Trouble is once you get into some of the newer, higher-end cars, you'll run into Flexray and even Ethernet as well.

-Uwe-

 

[saarnet]

Did somebody get MQB37w working on bench?

I tried with a Radio Composition (Model: MIB3E_MQB37w_BT, P/N: 5H0035869A, Panasonic) from VW Caddy V SB.

I connected on quadlock pin 17 -> GND, pin 18 -> +12V and a CAN Bus sniffer on T12f Pin /6 -> CAN-H and T12f Pin /12 -> CAN-L.

With this setup I do not receive any data on CAN bus and the radio does not turn on.

I then read in this thread that for MQB Klemme 15 has to be signalized on CAN Bus. I prepared an arduino (wemos d1 r1) with a can shield and code from #189 and #221. (Thanks @Ronaldo ).

Now the MIB3 does respond with cyclic CAN messages, but I can still not turn the unit on.

Has somebody an idea what could be needed in addition?

In the next step I will to connect a gateway from Golf 8 (5WA907530B) GW 2020 High.