How to generate CAN wakeup signal

[veso266]

Hello there, I have a very wierd question

I have a test bench for PQ platform which you can see on the picture: https://imgur.com/fyGPqXu

On my Bench is RNS510 and 3C0 907 530 L gateway module

I would like to simulate ignition message I use MCP2515 module with my Arduino (seerduino the only difference is that u can also put it on 3.3V operation instead of 5V)

I decided to use Instroment cluster (because I knew my RNS510 uses MFD display to send radio station information to instrument cluster so it has to have connection to this blue cable) blue cable to hook inside my CAN Netowrk

I also discovered that VW PQ cars have 3 canbuses: https://imgur.com/a/FAXZZzY Infotaiment - 100kbps Conveniences - 100kbps Drive train - 500kbps

I tried to receive some packets and discovered that packets were only uvailable on 500kbps drive train bus, 100kbps bus didn't have any data, but I guess ignition message should be on drive train bus anyway, and gateway would take care of forwarding it to RNS510 at the right speed

Since I sadly have no acsess to any PQ vehicle anymore so I don't have any real data

I did fine tune your PQ45 example, to maybe at least try to send speed to my RNS: PQKlemme15GeneratorAttempt.zip

but nothing happens, if you look at this picture: https://imgur.com/PAH2PBI RNS510 clearly doesn't see the speed packet

I know here many things can go wrong, my packet is maybe not correct, maybe I am using the wrong port to feed my CAN message to I also have acsess to radar port on my lovly harness, but since its CAN this shouldn't matter, the way I understand this is that as long as the messages reach the gateway, then it should forward them to the right module

So I am just wondering if you maybe have some CAN data from PQ platform cars somewhere or would know if it matters to what point in the CAN network you feed your data to

Thanks for Anwsering and Best Regards

[r00li]

I didn't do anything similar with PQ platform, but I did do it with MQB: https://www.youtube.com/watch?v=VAaX5-TPA4Q

At least on MQB the data for the headunit is actually coming from the instrument cluster. VW uses a protocol called BAP, which is transmitted as a single CAN ID. So, cluster gets the speed data, then sends it back to the gateway as a BAP message, and then that gets transmitted by the gateway to the infotainment CAN.

So it does matter where you inject your data. Now what you see in the video is just a testbench setup. But what I am doing in some later stages is actually using two CAN modules -> intercepting the messages from gateway to instrument cluster on one interface, then faking the data and sending it back out to the cluster on the other interface. For the other direction (cluster to gateway) I am just passing data through directly. And on my headunit the average speed and consumption work correctly.

Now this is based on MQB. Could be that PQ is a bit different. I know that on MQB, cluster is connected to the convenience CAN, while if I am not mistaken on PQ it is drivetrain.

[veso266]

I see

So the way I understand this is that if I inject data into the blue connector (instrument cluster) no matter what I do it will never reach the gateway (or even if it reaches the gateway it will discard the message, despite being correct)?

My ultimate goal is to try to send the proper Klemmen15 message so I could tell the RNS and other CAN modules on the network that the CAR is running

Simulating speed and proper VIN would also be a neat bonus

I have this harness: https://www.aliexpress.com/i/3256801217104176.html?gatewayAdapt=bra2glo4itemAdapt

Maybe the radar connector would be a better candidate to inject my wakeup messages to?

Or the OBD2 port?

I always thought the the advantage of CAN is that no matter where u feed ur data, it would always found its way to the right module

But I am begining to realize its not that way BTW: to what gateway pins u connected ur BCM (this is the device thats generating wakeup messages right?), gateway pinout hopefully didnt change between PQ and MQB platforms

[veso266]

OK, after beeping the pinout for my yellow radar connector (which I discovered should be on my drive train bus) and connecting to it according to this

PIN 8 = GND
PIN 1 = +12V

PIN 6 = CAN-H -- PIN 16 on GW
PIN 15 = CAN-L -- PIN 6 on GW

I began to see some different data

Now I just have to figure out what packet I have to send so gateway will tell RNS510 the car is running

[r00li]

So the way I understand this is that if I inject data into the blue connector (instrument cluster) no matter what I do it will never reach the gateway (or even if it reaches the gateway it will discard the message, despite being correct)?

It's a bit more complicated than that. You need to inject your CAN messages on the bus where they would actually appear.

Simulating speed and proper VIN would also be a neat bonus

I suggest you very much avoid sending the VIN packet under any circumstances. Only bad things happen with that 😄 .

I have this harness: https://www.aliexpress.com/i/3256801217104176.html?gatewayAdapt=bra2glo4itemAdapt

Maybe the radar connector would be a better candidate to inject my wakeup messages to?

Or the OBD2 port?

Definitely not the OBD2 port. That is pretty much useless for any project like this. Data on there is completely filtered and you only get the diagnostic messages on there. Nothing actually really relevant for this purpose.

BTW: to what gateway pins u connected ur BCM (this is the device thats generating wakeup messages right?), gateway pinout hopefully didnt change between PQ and MQB platforms

If I remember correctly BCM goes on the convenience CAN on MQB. And, yes. BCM is the one generating the ignition message. At least on MQB. Although on PQ I know that ignition signal originates with the steering column electronics control unit. But that is a wire.

Now I just have to figure out what packet I have to send so gateway will tell RNS510 the car is running

Good question. Unlike MQB, PQ platform uses ignition by pin (instead of CAN) for the instrument cluster, so I never looked into what exactly is the ignition packet on PQ. Question is if there even is one.

[veso266]

Well after checking my harness and beeping with multimeter according to this gateway pinout

1,2 - +12v (connection 30)
14 - +12v (connection 15 [Ignition])
11,12 - Ground connection
6 - powertrain CAN bus, low
16 - powertrain CAN bus, high
9 - DIAGNOSE can low
19 - DIAGNOSE can high
8 - Dashboard can low
18 - Dashboard can high
5 - convenience CAN bus, low
15 - convenience CAN bus, high
10 - infotainment CAN bus, low
20 - infotainment CAN bus, high
13 - to Dashboard pin15

Pin 14 is connected to 12V so gateway should have ignition signal

Also PIN1 is connected to 12V

The only pin thats not connected is PIN2 (not sure why)

So there has to be a packet missing because gateway is continiusly informing everyone with BSG_Last packet that the car is off

Also did some testing and discovered, that the infotaiment bus (100kbps one) is quiet, even if I connect from the quadlock connector (also tried the 500kbps one) can pins (where RNS510 is usualy), there is no chatting (I do have the resistor connected btw)

The quadlock connector clearly has CAN pins connected because if I disconnect the gateway, RNS510 is clearly not happy: https://i.imgur.com/B4BlY3l.jpeg

Also tried to disconnect the gateway and send with arduino what gateqay sends on what I presume is Infotaiment bus on Pin 10 and 20 with 100kbps and 500kbps)

#include <mcp_can.h>
#include <SPI.h> 

MCP_CAN CAN0(10); ​ ​ // Set CS to pin 10 

void setup()
{
​ Serial.begin(115200); 

​ // Initialize MCP2515 running at 8MHz with a baudrate of 100kb/s and the masks and filters disabled.
​ if(CAN0.begin(MCP_ANY, CAN_100KBPS, MCP_8MHZ) == CAN_OK) Serial.println("MCP2515 Initialized Successfully!");
​ else Serial.println("Error Initializing MCP2515..."); 

​ CAN0.setMode(MCP_NORMAL); ​ // Change to normal mode to allow messages to be transmitted
} 

//byte data[8] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07};
byte Diagnose_1[8] = {0x8D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0};
byte Soll_Verbauliste_neu[8] = {0x00, 0x08, 0x00, 0x00, 0x08, 0x00, 0x00, 0xC0};
byte Systeminfo_1[8] = {0xC0, 0x04, 0x62, 0xBF, 0x34, 0x53, 0xC1, 0x00};
byte Gate_Komf_1[8] = {0x17, 0x00, 0x18, 0x00, 0xC0, 0x00, 0x08, 0x00};
byte Gate_Komf_2[8] = {0xFF, 0x01, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00};
byte BSG_Last[5] = {0x00, 0x00, 0x00, 0x00, 0x03};
byte Unknown_720[7] = {0x04, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00};
byte Unknown_67A[2] = {0x18, 0x42}; 

void loop()
{
​  CAN0.sendMsgBuf(0x100, 0, 8, data);
​ CAN0.sendMsgBuf(0x7D0, 0, 8, Diagnose_1);
​ CAN0.sendMsgBuf(0x5DC, 0, 8, Soll_Verbauliste_neu);
​ CAN0.sendMsgBuf(0x5D0, 0, 8, Systeminfo_1);
​ CAN0.sendMsgBuf(0x5DC, 0, 8, Gate_Komf_1);
​ CAN0.sendMsgBuf(0x390, 0, 8, Gate_Komf_2);
​ CAN0.sendMsgBuf(0x570, 0, 5, BSG_Last);
​ CAN0.sendMsgBuf(0x720, 0, 7, Unknown_720);
​ CAN0.sendMsgBuf(0x67A, 0, 2, Unknown_67A);
​
​ 
​ Serial.println("Sending Message...");
​ delay(100); ​ // send data per 100ms
}

but nothing, RNS510 still thinks gateway is not present even if I send exacly what gateways sends Maybe my timing are not correct or something, will investigate further Did u ever try to simulate your gateway on MQB (just to fool the radio into thinking the car is running or thinking it doesn't have fuel, etc)

BTW: why would sending VIN packet be a bad idea PQ platform cars exept Audi dont use Component Protection, at least my RNS510 has a pin code

Would the gateway itself (since it is also used in Audis) enter into CP state so it would stop doing its job?

[r00li]

Yeah, definitely do check the timings. Some components can be quite unhappy with incorrect timings.

For MQB I never tried simulating the gateway sadly. Usually for this project I deal directly with clusters. And for the other project I have the BCM/Gateway/Lock/Cluster so I can get the proper ignition signal.

Yeah, on PQ you are probably safe (unless dealing with Audi) but on MQB I had a cluster go into component protection before and I could never recover it. I don't think the gateway itself would lock. But things like cluster and radio definitely. Again, probably not on PQ, but still, better to be cautious.

[MIGINC]

To get my MIB STD2 PQ to see that terminal 15 is active, I need to send it ID 0x575 - 0x47, 0x20, 0x00, 0x20