NefMoto

Anyone here have any experience with this? Specifically my 2013 Jetta TDI.

I can receive messages no problem, actually have quite a lot IDs figured out, but that's not the problem.
The problem I have, is that whatever messages I transmit don't do anything.

If I transmit 0x5C1 (steering wheel controls) with the data for radio controls, the radio will react as expected (vol up/down, track next/prev, etc), but if I send MFD up/down, nothing happens.

I'm pretty sure it's not my hardware, since I can't receive no problem, and the radio at least accepts messages... But that's where it stops.

Is there some kind of security, or does my device need to be registered in the ring first? I've searched quite a bit, but there isn't a whole lot of info out there (not that I can find anyway).

Have you replicated the actual can msg entirely (logged the in-car one on the bus?) and repeated?  You may just be missing a byte or wrong canid, bit set wrong somewhere, hard to say...

Are you on the correct bus?  I assume there is more than one in the car?

Yeah, identical messages from logs.
Like I said, I can reproduce for radio steering wheel controls just fine, but the radio is the only thing to respond.

Blinkers, wipers, headlights, door locks, audio amp, etc... Nothing else will respond.

I had something else similar happen once, never got to the bottom of it, lol.

What are you using to read and send the messages? Have you checked EVERY bit?  Are they coliding with same messages from the car from another module, well not colliding but being ignored perhaps.

Same bus?

Yeah, tapped right at the back of the radio.

I've also tried from the actual "comfort bus", tapped directly at the BCM (body computer has CAN gateway built-in), same results though.
On this car, it seems the comfort bus and infotainment bus are the same, or at least carry the same messages.

My only thoughts are hat the target mcu's can controller is filtering the messages somehow.

What are you using so send the messages?

afiak it's 11 bit can?  There's no registration, termination is a very important subject in can though.

Ideas:

120R on CAN connection (might already be on your board though)
Move the connection to somewhere else.
disconnect the ECU you are cloning effectively (via fuse and retry)
Can timing is weird too, as is some of the open source libraries for MCU's and their implementation of registers etc.

Yeah, no extended IDs.

I actually had to remove the terminator from my transceiver, otherwise I got absolutely nothing.

I don't know how the target could filter it, it's all broadcast... In CAN you can't really specifically target one controller without everyone else being able to see the same messages, otherwise there's no point in a "global network" type system.

This is on my STM32F429 discovery board, but I also get the same issues with my Teensy 3.1 (which also only the radio responds to, nothing else).
So I don't think I'm sending CAN data wrong (code wise anyway), there's got to be something the modules do on wake up that I'm not.

I can try tapping it at the audio amp under the seat, see if that's any better, but if I can't get anything right at the gateway, I don't think that will work either.

Each ecu will have a filter set to ignore messages it doesn't need to see.

I admit never on VW but I've never seen a button type signal that needs registered.  The ECU's themselves will broadcast on boot, and a central controller may set a code for one not being present.  ECM for speed signal missing for example.

Give can hacker a shot with an arduino, it helped me a lot.  There's an open source drivers/flash for the MCU.

So you get speed signals broadcast, rpm etc, also button presses are broadcast but bit's change when the button is hit, possibly you are transmitting too slow?   

That's all i have :)

You may have the option of diagnostic override as well.  I did that on Volvo, once set the controller in ignores everything except the diag command on/off up/down etc.

I found that way much easier.

Yeah, thus the reason I'm posting here, it doesn't make sense to me, it SHOULD work.

I'll check out CAN Hacker, might help, my CAN logger was just kinda slapped together. lol

Everything recieves just fine, no issues at all, no hiccups at all... Just nothing happens with sending.

I guess I have more digging to do, I really wish there was more info available.

Been there lol.

That's all I can think of mate.  :(

Also some of the broadcast frames are sent sequentially if they are out of sequence then the entire message is ignored iirc.

Generally with something like can hacker you can see the pattern once you filter down to a specfic canid, you could have a race condition for example as hinted earlier.

Well, the steering wheel controls are pretty simple, there shouldn't be any sequence on that.

I did make a little progress, I was able to force the audio amp off... It seems it they're a little more picky on message transmission period, I could get it to turn off by flooding it, but it would just be for a second, but sending it for the proper 320ms per message period gets the amp to power off for about 10 seconds before the radio overrides.

So, it's progress at least.

You've got a race condition, as I said l said ;)

If ou have log files PM me with the CANiD 9origian car logs not you) button on/off times stamped.

If it's what I think it is I can suggest  a code change ;) I solved it before.

Well, yeah, obviously I'm competing with the steering column module... I didn't think it would be much of an issue, I was able to do that no problem on my old 02 Audi A6.
Granted this MK6 electronics are just a *tad* more advanced. ;)

The attached log, steering wheel ID is 0x5c1 (32ms period), the problem one of interest is at time 18017.
The other ID is 0x604 and 0x661 (audio amp, both 320ms period), at time 15379 and 15382.

Amp off:
0x604, byte 0 = 0x80
0x661, byte 0 = 0x00

Amp on:
0x604, byte 0 = 0x81
0x661, byte 0 = 0x03

Right-hand column stalk/steering wheel 0x5c1:
MFD reset, byte 0 = 0x21
MFD up, byte 0 = 0x22
MFD down, byte 0 = 0x23
vol down, byte 0 = 0x06
vol up, byte 0 = 0x07
next track, byte 0 = 0x02
prev track, byte 0 = 0x03

0x5c1 isn't really important, just more of a test case, I could just as easily use 0x2c1 and send left blinker on, or wipers low speed, etc.
I was just hoping I could override it a little easier, like with the Audi or older MK4/5 platforms.

ok looking can't sleep anyway, next time an xls will be handy (csv format actually)

I normally import it and T-SQL the crap out of it

re overrides, does VCDS or whatever support 'activations' this would be far easier to implement.

But watching fro a byte change in a loop is also easy :)

Sending the the byte change has to e done correctly..

OK CSV, so do you know byte 0 is ----------> Furthermost right?  Or is it just your code?

*bugfix :) *

Also prefix with 0x when using hex please, sorry it's a pet hate.

Re amp, hopefully you have Excel 2010+

Can you see the bit change?

Yes you can, as you pointed out.

So try and do a <30ms cycle use it as as a const and play with it)  and beat the steering wheel to the punch perhaps, there's no counters or anything I've sen on 29bit cars to worry about there.

That's my theory and iirc it  with canbus theory/docs.

Other ideas:

RTR bit as it's dominant.

Also read here http://electronics.stackexchange.com/questions/43139/transmission-of-different-messages-with-the-same-id-on-a-can-bus

If the timing doesn't' fix it look into diag commands,

You can also look into msg priorities, which iirc is part of the canid bits.

Ah my old friend canbus.  You let out IDE but, assuming all is zero?


Looks like you are breaking arbitration by sending duplicate canid's  Playing around with canid bits might help prio

Speaking to my mad self.

I managed to beat a race condition here


https://www.youtube.com/watch?v=kzcFesqruWk

But there was a counter on [04] iirc that I had to grab and increment then beat the race condition between modules, more difficult that you I think, so you should do it.

Not sure I'd do this on the ECM bus mind you, bus off whilst driving is not fun (been there).

Except for writing to the cluster for my boost gauge I always used diag commands to avoid this problem.

lol

Ok, if you start changing bits in the ID, then you're changing the ID itself... Then it'll just be filtered out by the target module, right?

I'll have to do more testing. I'm using STMicro's HAL code, so maybe there's something they're doing that doesn't jive... But then again, what are the chances of that on both the STM and Teensy's K20 chip?

depends on the mask and filter??, hey man I'm just throwing ideas out, I'm highly skilled in CAN bus/freaking so I can try to help dude, few posts ago you said everything read everything :) unless i misunderstood.

I/We ended up writing out own code for J2354 and dealer units, mcu libraries were not cutting it for what we were going towards..

Couldn't get chipkit to communicate on 125kbps CAN for example, arudino yes, both open were using source libraries.

For example my MCU puts boost on the cluster 16x2 display (vid above), has a menu system using cruise buttons, folds mirrors in on lock, shift light (lol) etc and datalogs he ECM at the same time.  Sounds similar?

So been where you are man, what language you writing in in?   Perhaps I'll see something if your using an online private repo (couldn't care about seeing the code man, wrote enough of it myself lol)

hope this comes across nice, don't mean to sound angry or pissed but haven't slept so can't tell, but I am interested in helping an seeing VAG can.

Arduino with canshield works nice but only one controller, chipkit, I suspect library is shit,  I can send the freeware libraries I used for both 500k and 125k busses for canshield it's nice to see this stuff tbh.  Most people would just reverse engineer something similar, even companies....

Also most folk on here are playing with kline....so maybe not much more input idk for sure tho :)

More on arbitation here (I could be wrong) I still say race the mofo ;)

Bosch CAN spec.

Lastly freeware canhacker/ardunio sofware https://github.com/hackingvolvo

will probably need modified for 11bit, not sure

Interesting maybe http://copperhilltech.com/projects/ard1939/

Ok, back on this a bit...

Still no success on the comfort bus, but I know for a fact it isn't a hardware issue, or anything about the way I'm sending the CAN message.
I just re-implemented my display setup to use the OBD2 port, and that works perfect, I can poll OBD2 PIDs super fast no problem, including multi-frame messages (such as 0x78, EGT sensors).

So, until someone tells me something I don't know about the MK6 VW CANbus, I'm just going to give up on this for now.

Though I haven't tried to play around on the powertrain bus, not that there's much useful there to me (other than reading messages, not much to transmit).

I guess really it's not a huge deal, the power window controls aren't exposed on this model's CANbus anyway, it's all on the LINbus now... So there goes my ideas for advanced remote windows (at least I can still roll up/down with the FOB, just not how I want to).

I've been thinking about this tonight (even checked the thread)

The canbus systems I have worked on (extensively - can send logs) are 29bit and apart from a race condition between my mcu and the phone module which was won by beating it to the punch I just used diag commands to do what I needed.

So, probably worth exploring those, there must be 'activations' for most things via factory tools for testing.

Actually I also auto enabled cruise control that was done by setting the correct bit not diag command, again different platform but it worked.

I have, as mentioned seen oddities with different mcu's like bit timing, etc too.  Mostly it just worked, but chipkit, for example I couldn't get to work @ 125k for sending when 500k would work, frames looked identical like you are saying too.

I feel your pain :)

Is this Simos ECU?

This might help http://jazdw.net/tp20