Pages: [1] 2
Author Topic: CAN message generated from paddles?  (Read 10498 times)
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« on: October 25, 2021, 08:40:44 PM »

Can/will anyone share the CAN message ID and payload for paddle up/down that dsg reads? On slow CAN it’s 0x289 bit 4 directly from J527.
However, I assume gateway passthough some message to fast CAN for dsg to read.

I don’t have a gateway to sniff (dsg swapped mk4).


Thanks
Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 134


« Reply #1 on: October 26, 2021, 09:59:07 AM »

ID 0x38A, byte 4
bit0 = tiptronic_tip_down
bit1 = tiptronic_tip_up

Gateway sends this to powertrain CAN.
Is this what you are looking for?
« Last Edit: October 26, 2021, 10:01:02 AM by terok » Logged
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #2 on: October 26, 2021, 01:52:29 PM »

ID 0x38A, byte 4
bit0 = tiptronic_tip_down
bit1 = tiptronic_tip_up

Gateway sends this to powertrain CAN.
Is this what you are looking for?


Exactly what I was looking for. Thank you. I’ll double check, I don’t think the mk4 gateway does this. J527 does have direct access to fast/drivetrain BUS. I don’t understand why it doesn’t broadcast this info itself.
Logged
cherry
Sr. Member
****

Karma: +26/-2
Offline Offline

Posts: 260


« Reply #3 on: October 26, 2021, 05:24:09 PM »

Wasnt MK4 paddles wired to DSG directly? But i think this require some old mechatronic...
Logged
aef
Hero Member
*****

Karma: +69/-46
Offline Offline

Posts: 1601


« Reply #4 on: October 27, 2021, 01:51:32 AM »

Wasnt MK4 paddles wired to DSG directly? But i think this require some old mechatronic...

R32 DSG is Cxx Mechatronic and the paddles are directly connected to T20/3 and T20/14 at the mechatronic.

Logged
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #5 on: October 27, 2021, 10:04:12 AM »

My research turned up the same info. However, MK4 DSGs are rare and for VR6s.

I doubt anyone has tried hardwiring to same pins on a newer DSG to test if functionality still exists without flashing DSG.
And you would need to know the separate resistance of the paddle switches.

This question is for 4cyc DSG DQ250 on ME7.5 1.8T dash and ecu and a MK5+ steering wheel (really a 8P A3 steering wheel for my project).

My current options:
- use 8P wheel + J527 + custom module to read slow CAN 0x289 and broadcast 0x38A on fast CAN
- use 8P wheel + J527 + find a way to modify MK4 gateway to broadcast 0x38A
- use 8P wheel + custom module to read/write LIN to wheel and broadcast 0x38A
- use 8P wheel + modify wheel wiring to bypass LIN + custom module to read direct paddle contacts and broadcast 0x38A

Leaning toward first option at the moment since I already have a custom LCD reading fast CAN. I can leverage work done on that project.


MK4 R32 diagram below for reference.
« Last Edit: October 27, 2021, 12:29:02 PM by elRey » Logged
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #6 on: October 27, 2021, 10:23:42 AM »

ID 0x38A, byte 4
bit0 = tiptronic_tip_down
bit1 = tiptronic_tip_up

Gateway sends this to powertrain CAN.
Is this what you are looking for?


I assume the rest of the payload mirrors 0x289 on slow/convenience CAN, correct? And same broadcast frequency?

edit: it looks like cruise info is in that same ID. I hope this does not interfere with my non-CAN cruise controls. Sad
« Last Edit: October 27, 2021, 10:26:24 AM by elRey » Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 134


« Reply #7 on: October 27, 2021, 11:56:18 AM »

My understanding is that newer mechatronic units do not have analog inputs for paddles. I have not tested this.

If you have J527 already, imo easiest option is number one. Then you can also do other stuff if needed.
If you don't have it, i would read LIN directly and broadcast that forward.

You have parameter in ecu which tells where CCS information is coming, so should not interfere.

I have no information about convenience 0x289.
Btw, byte 1 is checksum for this packet, 8bit sum.
Tx interval 20ms.

Quote
GRA_Neu   0x38A   CHK_GRA_Neu         1   0..7   8   gültiger Wert   0   255   0 .. 255      0   1      
GRA_Neu   0x38A   GRA_Hauptschalter      2   0   1   gültiger Wert                     0 1   Gerastet Aus EIN
GRA_Neu   0x38A   Abbrechen         2   1   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   KurzTip_down         2   2   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   KurzTip_up         2   3   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   LangTip_down         2   4   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   LangTip_up         2   5   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   Bedienteil_Fehler      2   6   1   gültiger Wert                     0 1   i. O. Fehler Bedienteil
GRA_Neu   0x38A   Codierinfo_SMLS         2   7   1   gültiger Wert                     0 1   GRA codiert ACC codiert
GRA_Neu   0x38A   Tip_Setzen         3   0   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   Tip_Wiederaufnahme      3   1   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   Sendercodierung         3   2..3   2   gültiger Wert                     0 1 2 3   Bordnetzsteuergeraet Lenksaeulenmodul Motor SG nicht belegt
GRA_Neu   0x38A   BZ_GRA_Neu         3   4..7   4   gültiger Wert   0   15   0 .. 15      0   1      
GRA_Neu   0x38A   Tiptronic_Tip_Down      4   0   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   Tiptronic_Tip_Up      4   1   1   gültiger Wert                     0 1   Tippschalter nicht betaetigt Tippschalter betaetigt
GRA_Neu   0x38A   ACC_Zeitlueckenverstellung   4   2..3   2   gültiger Wert                     0 1 2   Taste nicht betaetigt Dist -1 Dist +1
GRA_Neu   0x38A   Tiptronic_Limiter      4   4   1   gültiger Wert                     0 1   Limiter aus Limiter ein
GRA_Neu   0x38A   Typ_Hauptschalter      4   5   1   gültiger Wert   0   1   0 .. 1      0   1      
GRA_Neu   0x38A   void            4   6                                             
GRA_Neu   0x38A   Tiptronic_Tip_Fehler      4   7   1   gültiger Wert                     0 1   i.O. Fehler erkannt
« Last Edit: October 27, 2021, 12:22:17 PM by terok » Logged
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #8 on: October 27, 2021, 02:00:28 PM »

Great information. Thank you. I also just found same info in different format: ( I like your format better )

Description:
CHKSM: checksum
Bit addr. 0, bit num. 8, initial value 0
Valid range of values ​​0x00..0xFF

S_HAUPT: GRA / ADR - main switch
Bit addr. 8, bit num. 1, initial value 0
0 switched off, 1 switched on
RCOS message: mrmGRA

T_AUS: GRA / ADR - Tip switch "Off"
Bit addr. 9, bit num. 1, initial value 0
0 tip switch not activated, 1 tip switch activated
RCOS message: mrmGRA

T_VER: GRA / ADR - Tip switch "Decelerate"
Bit addr. 10, bit num. 1, initial value 0
0 tip switch not activated, 1 tip switch activated
RCOS message: mrmGRA

T_BES: GRA / ADR - Tip switch "Accelerate"
Bit addr. 11, bit num. 1, initial value 0
0 tip switch not activated, 1 tip switch activated
RCOS message: mrmGRA

ZU_VER: GRA / ADR delay; is not processed
Bit addr. 12, bit num. 1, initial value 0
0 Don't accelerate, 1 accelerate
RCOS message: mrmGRA

ZU_BES: GRA / ADR accelerate; is not processed
Bit addr. 13, bit num. 1, initial value 0
0 Don't delay, 1 delay
RCOS message: mrmGRA

F_BTL: GRA / ADR - keypad error
Bit addr. 14, bit num. 1, initial value 0
0 OK, 1 control lever error
RCOS message: mrmGRA

T_SET: GRA / ADR - Tip switch "Set"
Bit addr. 16, bit num. 1, initial value 0
0 tip switch not activated, 1 tip switch activated
RCOS message: mrmGRA

T_WA: GRA / ADR - Tip switch "Resume"
Bit addr. 17, bit num. 1, initial value 0
0 tip switch not activated, 1 tip switch activated
RCOS message: mrmGRA

COD_SND: Sender coding
Bit addr. 18, bit num. 2, initial value 0
00 On-board power supply control unit
01 steering column module
10 engine SG
11 not used
RCOS message: mrmGRA

Z_Count: message counter
Bit addr. 20, bit num. 4, initial value 0 Valid range of values ​​0x0..0xF

T_TDN: tip-down; is not processed
Bit addr. 24, bit num. 1, initial value 0
0 tip switch not actuated, 1 tip down

T_TUP: Tip-Up; is not processed
Bit addr. 25, bit num. 1, initial value 0
0 tip switch not actuated, 1 tip up

T_DST: ADR - Tip switch distance request; is not processed
Bit addr. 26, bit num. 2, initial value 0
00 Key not pressed
01 Nobody wants distance
10 Desired distance greater
11 not used

ZU_LIM: Limiter on; is not processed
Bit addr. 28, bit num. 1, initial value 0
0 tip switch not actuated, 1 tip up

F_BTLT: Tiptronic control unit error; is not processed
Bit addr. 31, bit num. 1, initial value 0
0 tip switch not actuated, 1 tip up
« Last Edit: November 11, 2021, 10:23:52 PM by elRey » Logged
aef
Hero Member
*****

Karma: +69/-46
Offline Offline

Posts: 1601


« Reply #9 on: October 28, 2021, 12:27:23 AM »

Do you have a Exx or Fxx Gearbox including gear selector?

Have you logged the up and downshifts while manually shifting?

Maybe you can wire your paddles to the switches in the shifter, idk.

Logged
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #10 on: October 28, 2021, 06:10:53 AM »

Do you have a Exx or Fxx Gearbox including gear selector?

Have you logged the up and downshifts while manually shifting?

Maybe you can wire your paddles to the switches in the shifter, idk.



I have logged those. The selector does not use physical switches. Instead it uses hall effect sensors for selector location. Nice thought tho.
Logged
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #11 on: October 28, 2021, 08:33:43 AM »

edit:
nevermind. I finally found it in FR (searching terms shared here by terok - thanks)

chksum = byte 2 XOR byte 3 XOR byte 4

FR section = GGCGRA <- just found this
end edit


Btw, byte 1 is checksum for this packet, 8bit sum.


CHKSM: checksum
Bit addr. 0, bit num. 8, initial value 0
Valid range of values ​​0x00..0xFF

I'm onto this part. Since my setup might ignore any cruise control data, I want to use those bits for my own purposes. This requires me to calc the checksum instead of just repeating what's on slow CAN 0x289 with it's checksum already calculated.

With that said. I've been looking at the data and I cannot grasp how overflow/carry over is applied to checksum.
example data:





« Last Edit: October 28, 2021, 09:32:42 AM by elRey » Logged
terok
Full Member
***

Karma: +8/-3
Offline Offline

Posts: 134


« Reply #12 on: October 28, 2021, 10:06:08 AM »

I'm not sure i understand the problem.
If you do 8bit XOR, there's no overflow.
Logged
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #13 on: October 28, 2021, 10:15:29 AM »

No problem now. I was just adding/summing bytes, not XOR. It wasn't until I found the info in FR that I realized I needed to XOR.

My edit at the the top of my previous post was me saying I had found the answer to that post.
Logged
elRey
Hero Member
*****

Karma: +32/-1
Offline Offline

Posts: 565


« Reply #14 on: November 13, 2021, 07:24:46 PM »

So, it looks like I need to turn off ECU sending 0x38A messages before I inject my own. I'll ask here before I create a new post:

Can someone help me locate CW_CAN_R from this assembly code:



I still down know how to follow memory location offsets:

Code:
movbz   r4, byte_FA05
shl     r4, #1
mov     r5, [r4+word_8132B4]
and     r5, #8

^ know this is checking for CW_CAN_S bit 3
« Last Edit: November 13, 2021, 07:27:00 PM by elRey » Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.032 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)