I managed to tap into the Drive Train CAN Bus today. The Audi has three CAN Busses. One for the motor, transmission, power steering and brakes basicly, the second for the air conditioning, windows and door and the third for the radio, navigation systems and so on. I need to understand the drive train bus in order to emulate an engine so that the ECU (Engine Control Unit) stays happy and, most important, so that the power steering works. The power steering turns itself off when there are no CAN Bus messages from the engine with the RPM.
I have been trying several times to access the CAN Bus through the diagnostics connector but it has been dead. Today I tried one of the contacts in the foot weell in the double floor on the driver side.
Success! It worked after I had also grounded the Arduino to the car body.
The driver side foot well with the Arduino with CAN Shield
I managed to connect my home-built Arduino CAN Bus sniffer and get a lot of data out of it.
Now I only need to understand what all of it means ;)
Actually I managed to decode one CAN Message, Id 0x280 which is RPM (hooray= and I almost managed to work out which of the eight data fields are actually used. Well, I'll get back to that.
Motorsteuergerät AMF:
ReplyDeleteKolla här: http://www.a2-freun.de/wiki/index.php/J248_-_Motorsteuerger%C3%A4t_AMF_-_Messwertbl%C3%B6cke_und_Sollwerte
Marco.
Looks interesting. What is it?
ReplyDeleteYour project is very interesting!
ReplyDeleteI work at Intendia (www.intendia.com), we develop CANbus devices and i can help you with your project.
This is what we know about the 0x280 ID
This message is sent by the Engine ECU (I suppose that you have removed that ECU by now hehehe)
Some examples:
When the engine is off the ECU sends:
09 07 00 00 16 00 16 16
When the engine is idling the ECU sends:
09 22 28 0A 22 00 22 22
byte[0] has 2 bits:
0x01 (low idle switch = accelerator pedal not pressed) + 0x08 (clutch switch = clutch not pressed)
if you press both peddals the byte will be 0x00
You should probably send this bits for (ABS/ESP) to work.
byte[1] byte[4] byte[6] and byte[7] have a very similar value, they have something to do with idle speed maintaining or engine torque but you can send 0x22 for example.
byte[2] and byte[3] are the RPM multiplied by 4 in LSB first
In the idle example (28 0A) -> 0xA28 = 2600 -> /4 = 650RPM
byte[5] is the accelerator pedal position that goes from 0x00 (not pressed) to 0xFA (fully pressed)
Contact us if you need more help with that CAN.
Best regards
Thanks David, thats great information!
ReplyDeleteI had figured out that 0x280 is for RPM but not the other functions it also has.
The power steering in the A2 needs an RPM signal to turn itself on and I used this (decimal) message for that:
9, 54, 24, 19, 45, 0, 45, 45, 8, 0
That would mean 0x1836=6196=>1549 RPM
I have a problem with the ABS and ESP warning lights being on and maybe that is because I'm not sending the correct 0x280 message. But the ABS and ESP should work even if the accelerator and clutch are not depressed, right?
Your 0x280 message is fine, but are you sending it fast enought? The engine ecu sends this message every 10ms, if you send it slower, other ECUs will notice there is a problem in the bus.
ReplyDeleteAnd you need to send the messages as soon as the ignition is on, even if you dont need the Power Steering ON you can send 0rpm, but you need to send the messages or other ECUs will notice something is wrong.
Maybe the ABS/ESP ECU needs more CAN messages from the engine.
Id 0x288 is a good candidate, its the second engine message sent every 10ms, it has important information like engine code and gearbox code.
Try to send the 0x280 and 0x288 every 10ms,
0x288 example values:
0x288 48 93 10 00 00 41 77 05
0x288 D9 93 10 00 00 41 77 05
0x288 2C 93 10 00 00 41 77 05
0x288 8F 93 10 00 00 41 77 05
The byte[0] changes this way 0x48 -> 0xD9 -> 0x2C -> 0x8F and repeats forever (this are the engine and gearbox codes from an Audi A4), you should send the codes from your engine ECU
Do you have CAN logs from your vehicle before removing the engine ecu?
Also try to erase the error codes from de ABS unit, do you have a vagcom interface?
I'll try the 0x288 message as soon as I get my new arduino and can bus shield. I managed to fry my first :(
ReplyDeleteYes, I have a can log from before I removed the engine so I will look there to get i reasonable message.
I havn't checked how fast I send the messages. Will do that to.
I sort of suspected that the ABS unit might have stored error codes. After googling around for the symptoms (the warning lamps) I also suspected low battery voltage, but after connecting the DC/DC and providing 14V the errors are still there. So, maybe using a Vagcom interface to erase the errors is a good idea.
Hi, i'm looking for infos on how to emulate the presence of a Rear View Cam and a TV control units on my Audi A6 4F equipped with MMI3G. I need it to activate the respective FBAS inputs on the MMI Main Unit that i want to use for a different goal than what Audi intended for (a multiple cam surveillance system and a GPS module used to alert for speed cams, a feature that's unfortunately unavailable to stock Audi navigation unit).
ReplyDeleteWhich shoud be the messages i have to transmit to ensure the Main Unit see the presence of these two ECUs? And should i constantly repeat the sequence every x ms?
The stock TV ECU doesn't use CAN but an optical MOST bus: in order to simply simulate the presence of the ECU could also be employed a CAN message instead of MOST?
I've logged the bus with a CAN protocol Logic Analyzer trying to sniff the codes, but i've been killed by thousand of messages...
Anyone can help me?
I am very interesting in CAN bus.
ReplyDeleteI am working with 2013 vw polo dashboard, have discovered some Pids.
Any information are welcome. pranas.slezas@infoside.lt
ReplyDeleteHello, we are working on emulating a Volkswagen car to test EHPS steering pumps but found the ID to rotate . If you have any information you would appreciate .
neg.agus@gmail.com is my mail.
Thank you.
Thanks for the info. Can you give me more info on exactly which wires you spliced in the drivers footwell ?
ReplyDeleteThanks
Hi
ReplyDeleteVery interesting. Like Jaco I'm really curious which lines you connected for the engine/ transmission/ brakes CAN. On the foto its not clear. Could you describe the pin numbefs on the green plug ? I've a 1.2 TDI, replaced the transmission and think there are other gears inside. So I would like to check the speeds.
When connected I might be able to help you with the signals