MK6 VW CAN

I apologize for the English, my German isn't good enough for technical postings (or anything else for that matter! ), also there isn't a better place for CANbus hacking!

I'm working on later generation VW CAN messages (2013 Jetta TDI), I'm quite surprised on the amount of data VW exposes on the "infotainment" bus (did they combine comfort and infotainment?).

So far, this is what I've figured out:

Code:

0x35B - Engine speed/temp       - byte1 = low byte RPM       - byte2 = high byte RPM       - byte? = Coolant temp? 0x29B - Vehicle speed?       - byte1 = low byte speed       - byte2 = high byte speed 0x5C1 - Steering wheel controls 0x291 - Remote control/Door lock button status       - byte0 = remote buttons (0x81 lock, 0x41 unlock, 0x11 trunk, 0x21 panic)       - byte1 = interior lock buttons (0xAA unlock, 0x55 lock) 0x2c1 - Stalk status?       - byte0 = blinker status (0x01 left, 0x02 right)       - byte1 = wiper status (0x10 spray, 0x02 intermittent, 0x04 low speed, 0x08 high speed) 0x381 - Driver's window status 0x3B1 - Passenger's window status 0x4BD - Rear passenger's window status 0x4B9 - Rear driver's window status       - byte1 = auto roll switch (0x10 up, 0x20 down)       - byte2 = window level (0x00 up, 0xff down)

These seem to be just status messages, but I don't see any command messages pop up when working locks or windows... Maybe I just need to dig more, but I was hoping maybe someone could enlighten me?

Hi,

why should there be any "command messages" on the bus when you are pressing the window switches directly? The switches are connected to the control units in the doors, it makes not much sense to translate a switch status, send it over the bus to a control unit 10cm next to it.

Just check which messages occur when you keep the "close" / "open" buttons on the remote control unit (FFB) pressed. In this case, the bus MUST deliver the information (command) what should be done with the windows.

Best, Rainer

That's what I thought, but when I send the same message, nothing happens.

The only message that I can send that does anything are steering wheel controls (0x5c1), anything else is ignored.

Maybe the new "Display Changes" view of KCANMonitor is helpful?

Unfortunately, this is with my own custom hardware and software...

On 0x35B, byte 4 doesn't appear to be coolant temp, but rather oil temp on my 2013 Jetta TDI. It seems to top out around 110 degrees C, way too hot to be coolant.
Byte 5 isn't a temperature either like on other models, it's pedal status.

On 0x621, it would seem that byte 4 is fuel level (changes when I unplug the fuel level sender), and byte 2 seems to be another temperature value, not sure what though... Maybe outside temperature?

In my case coolant is on byte number 3 (counting from zero) :
ID: 0x35B, byte3=coolant temperature.
Formula: Coolant = ((B3-64) * 0.75)
ID:0x621:
byte0:xx?xxxxx - parking brake
byte0:xxxxx?xx - low washing fluid level
byte3:x??????? - fuel level
byte3:?xxxxxxx - low fuel
byte5: dashboard backlight intensity
byte6: dashboard light sensor

Maybe that's what I'm missing, the *0.75, Everywhere else that I've seen shows it as "byte-64"...

0x621 all looks correct, my low fuel light came on this morning and I noticed the value changed, I figured that was because of the light status. Though I can't say that I noticed if byte0 changed with my parking brake.

Yes, coolant temp is definatly (byte3-64)*0.75, confirmed on my 2013 Jetta TDI... Maxed out at exactly 90 degrees C.

0x35B - Engine
Byte 1 - RPM H
Byte 2 - RPM L
Byte 3 - Coolant Temp
Byte 4 - Pedal status

RPM=(Byte2*256)+Byte1)/4
Coolant Temp=(Byte3-64)*0.75

0x3C3 - Steering status
Byte 0 - Steering angle HiByte
Byte 1 - Steering angle LoByte
Byte 2 - Steering torque HiByte
Byte 3 - Steering torque LoByte

Angle in degrees = ((Byte1*256)+Byte0)/91? (91 seemed to come out correctly on my microcontroller with integer variables)
Any ideas on toque divider? I'm assuming the data is in Nm.

0x359 - Speed
Byte 1 - Speed HiByte
Byte 2 - Speed LoByte

I'm assuming it has the same dividers as the old 0x351 message:
MPH = ((Byte2*256)+Byte1)/322
KPH = ((Byte2*256)+Byte1)/100

0x621 - Gauge cluster data
Byte 3 - Bits 0-6 = Fuel remaining in liters, bit 7 = low fuel light on

These seem to be just status messages, but I don't see any command messages pop up when working locks or windows... Maybe I just need to dig more, but I was hoping maybe someone could enlighten me?

You can't control the locks or windows from the infotainment bus, they can only be used from convenience bus. For some reason they appear also on infotainment, but replaying them doesn't work. But if tap in the convenience bus, they work well.

I have it on the comfort bus now, but same result...
I can send the steering wheel control message, but that's the only one that responds.

I can't get blinkers, wiper, locks, windows, etc to respond.

Do I need to be registered in the ring (0x4XX)?

Edit:
Something is weird on this car, or at least this generation... Nothing responds to my messages, except for the steering wheel controls, and there isn't a single message that's for the windows (like on MK5 Golf, message 0x181), but there are the individual doors (0x381, etc).

I need to connect to my Wife's 2012 Beetle and see if it's the same...