RKS+CAN Adapter für CAN-Bus Sniffing
CAN-Interface
CAN Hardware, CAN Software, CAN Protokolle - CAN-Bus Forum für Dein CAN-Bus Projekt. CAN-Bus und Elektronik.

Jetta V 2.0L TDI GRA


 
Neues Thema beginnen Auf Beitrag antworten Weitergeben, Thema teilen Lesezeichen setzen Druckansicht CANhack.de - Übersicht » Motor CAN
Autor Nachricht
hasenwerk



CAN Hacker seit: 29.12.2016
Beiträge: 4
Karma: +0 / -0   Danke, gefällt mir!
Wohnort: Kanada

Kostenloser Account, kein CAN Entwicklungs-Support

Beitrag03-01-2017, 2:32    Titel: Jetta V 2.0L TDI GRA Antworten mit Zitat

Bitte entschuldigen Sie mein Englisch auf diesem Deutschen Forum. icon_rolleyes.gif

I am trying to get a 2009 2.0L TDI CBAA engine running in my Volkswagen T3. I have figured out all the necessary CAN information with the exception of the Cruise Control (GRA).

From my traffic sniffing, I have discovered 0x03A = GRA and that it is 3 bytes of information. However when I feed the ECU this information, it doesn't change that status of the switches when I monitor measuring block 006 in VCDS.

0x0 = 0x2+"offset"
Off = 0
On = -1
(-) = -3
(SET) = -21
etc . . .

0x1 = Binary representation of switch:
00000000 = no buttons pressed
00000001 = ON
xxxxxx1x = CANCEL
xxxxx1xx = Decelerate
xxxx1xxx = Accelerate
xxx1xxxx = Set
xx1xxxxx = Resume

0x2 - Clock
Repeats: 20, 52, 84, 116, 148, 180, 212, 244, 20, 52 . . .

0x3 - Always "0"


What else is needed for the ECU to use my inputs for GRA???

Pedal inputs are all correct (all show 0). Speed is shown in the first block of 006. Accelerator pedal input is working . . . I have a strong feeling it is depending on another address as well... I'm stuck!

mit freundlichen Grüßen!
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Gehe in Dein Profil um mehr über die Verlinkung Deiner Webseite zu erfahren.
majonez
CAN-Profi
CAN-Profi


CAN Hacker seit: 31.07.2013
Beiträge: 37
Karma: +12 / -0   Danke, gefällt mir!
Wohnort: Breslau

CAN Support

Beitrag03-01-2017, 20:20    Titel: Jetta V 2.0L TDI GRA Antworten mit Zitat

Hello and welcome.
From my notes the cruise control system buttons are at ID 0x289. Source of the message is at comfort bus (steering wheel module) and then this message is translated to ID 0x38A by the gateway and forwarded to the powertrain bus later.

Code:
byte0: XOR checksum

byte1:
00000000 = CCS off
0000000? = stuck ON
000000?1 = pressed OFF
00000?01 = decelerate (-)
0000?001 = accelerate (+)
000?0?01 = decelerate (-) stuck
00?0?001 = accelerate (+) stuck
?0000000 = ACC coded

byte2:
0000000? = set
000000?0 = resume
0000??00 = coding. 11 = GRA im blinkerhebel, 01 = GRA im drittenhebel
0x?X = counter from 0x00 to 0xF0

byte3:
00000100 = distance-
00001000 = distance+
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden  
hasenwerk



CAN Hacker seit: 29.12.2016
Beiträge: 4
Karma: +0 / -0   Danke, gefällt mir!
Wohnort: Kanada

Kostenloser Account, kein CAN Entwicklungs-Support

Beitrag03-01-2017, 20:29    Titel: Jetta V 2.0L TDI GRA Antworten mit Zitat

majonez hat folgendes geschrieben:
Hello and welcome.
From my notes the cruise control system buttons are at ID 0x289. Source of the message is at comfort bus (steering wheel module) and then this message is translated to ID 0x38A by the gateway and forwarded to the powertrain bus later.

Code:
byte0: XOR checksum

byte1:
00000000 = CCS off
0000000? = stuck ON
000000?1 = pressed OFF
00000?01 = decelerate (-)
0000?001 = accelerate (+)
000?0?01 = decelerate (-) stuck
00?0?001 = accelerate (+) stuck
?0000000 = ACC coded

byte2:
0000000? = set
000000?0 = resume
0000??00 = coding. 11 = GRA im blinkerhebel, 01 = GRA im drittenhebel
0x?X = counter from 0x00 to 0xF0

byte3:
00000100 = distance-
00001000 = distance+


Thank you for this information! I'll check my code again and see where it gets me.

Re: byte3 - this is the separation distance for the Active Cruise Control (ACC) system?
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Gehe in Dein Profil um mehr über die Verlinkung Deiner Webseite zu erfahren.
hasenwerk



CAN Hacker seit: 29.12.2016
Beiträge: 4
Karma: +0 / -0   Danke, gefällt mir!
Wohnort: Kanada

Kostenloser Account, kein CAN Entwicklungs-Support

Beitrag05-01-2017, 5:42    Titel: Jetta V 2.0L TDI GRA Antworten mit Zitat

hasenwerk hat folgendes geschrieben:
majonez hat folgendes geschrieben:
Hello and welcome.
From my notes the cruise control system buttons are at ID 0x289. Source of the message is at comfort bus (steering wheel module) and then this message is translated to ID 0x38A by the gateway and forwarded to the powertrain bus later.

Code:
byte0: XOR checksum

byte1:
00000000 = CCS off
0000000? = stuck ON
000000?1 = pressed OFF
00000?01 = decelerate (-)
0000?001 = accelerate (+)
000?0?01 = decelerate (-) stuck
00?0?001 = accelerate (+) stuck
?0000000 = ACC coded

byte2:
0000000? = set
000000?0 = resume
0000??00 = coding. 11 = GRA im blinkerhebel, 01 = GRA im drittenhebel
0x?X = counter from 0x00 to 0xF0

byte3:
00000100 = distance-
00001000 = distance+


Thank you for this information! I'll check my code again and see where it gets me.

Re: byte3 - this is the separation distance for the Active Cruise Control (ACC) system?


I've gone over everything in my code and I think the ECU is still missing something.

In the car with GRA set to OFF it is:

0x0 0x1 0x2 0x3
20 0 20 0
52 0 52 0
84 0 84 0
116 0 116 0
148 0 148 0
180 0 180 0
212 0 212 0
244 0 244 0
20 0 20 0

GRA set on ON

0x0 0x1 0x2 0x3
21 1 20 0
53 1 52 0
85 1 84 0
117 1 116 0
149 1 148 0
181 1 180 0
213 1 212 0
245 1 244 0
21 1 20 0


The above examples match what your description says. Yet if I feed that to my ECU the ECU won't change state like it should - Group 006 the "Switch Blocks" always shows 01000000 which is the same as the car if the regular system is running. Is there something else that needs to be active before the ECU will accept the input?

Side note, if I read 0x38a as 8 bytes, bytes 3 to 7 do have values... but they seem sudo-random. 105,33,250,209 is the most common (>50% of the time), 0,0,31,0 254,255,255,250 255,0,0,160 are examples of some of the output.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Gehe in Dein Profil um mehr über die Verlinkung Deiner Webseite zu erfahren.
majonez
CAN-Profi
CAN-Profi


CAN Hacker seit: 31.07.2013
Beiträge: 37
Karma: +12 / -0   Danke, gefällt mir!
Wohnort: Breslau

CAN Support

CAN-Diagnose gefällt das.
Beitrag05-01-2017, 22:28    Titel: Jetta V 2.0L TDI GRA Antworten mit Zitat

hasenwerk hat folgendes geschrieben:

Group 006 the "Switch Blocks" always shows 01000000 which is the same as the car if the regular system is running. Is there something else that needs to be active before the ECU will accept the input?

Did you connect physical CCS enable pin in the engine ECU to +12V?
Did you calculate checksum properly?
Did you maintain the counter the right way?
hasenwerk hat folgendes geschrieben:

Side note, if I read 0x38a as 8 bytes, bytes 3 to 7 do have values... but they seem sudo-random. 105,33,250,209 is the most common (>50% of the time), 0,0,31,0 254,255,255,250 255,0,0,160 are examples of some of the output.

How did you read 4-byte message as 8-byte? You can't do this icon_smile.gif Random values are probably a garbage from microcontroller's RAM.

Cheers, Michal.
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden  
hasenwerk



CAN Hacker seit: 29.12.2016
Beiträge: 4
Karma: +0 / -0   Danke, gefällt mir!
Wohnort: Kanada

Kostenloser Account, kein CAN Entwicklungs-Support

Beitrag07-01-2017, 3:45    Titel: Jetta V 2.0L TDI GRA Antworten mit Zitat

majonez hat folgendes geschrieben:
hasenwerk hat folgendes geschrieben:

Group 006 the "Switch Blocks" always shows 01000000 which is the same as the car if the regular system is running. Is there something else that needs to be active before the ECU will accept the input?

Did you connect physical CCS enable pin in the engine ECU to +12V?
Did you calculate checksum properly?
Did you maintain the counter the right way?
hasenwerk hat folgendes geschrieben:

Side note, if I read 0x38a as 8 bytes, bytes 3 to 7 do have values... but they seem sudo-random. 105,33,250,209 is the most common (>50% of the time), 0,0,31,0 254,255,255,250 255,0,0,160 are examples of some of the output.

How did you read 4-byte message as 8-byte? You can't do this icon_smile.gif Random values are probably a garbage from microcontroller's RAM.

Cheers, Michal.


CCS enable pin? Do you mean F, F36 and F47? These conditions are set correctly. What pin is that on the EDC17? Basically I can connect the ECU to the car's CAN bus and it works when I press the buttons on the stalk. Connect it to my microcontroller's (Arduino with CAN shield) CAN bus and it doesn't do anything.

If I read 0x38A as an 8 byte read as opposed to a 4 byte read, I get that "fluff", so yeah, random stuff no doubt. I am sending out a 4 byte write to the bus so I *should* be good.

Can anyone confirm that writing *only* to 0x38A is all that is needed to control GRA on the EDC17 ECU?
Nach oben CAN Hacker - Profil anzeigen Private Nachricht senden Gehe in Dein Profil um mehr über die Verlinkung Deiner Webseite zu erfahren.
Neues Thema beginnen Auf Beitrag antworten Weitergeben, Thema teilen Lesezeichen setzen Druckansicht CANhack.de - Übersicht » Motor CAN
Gehe zu:  
Du kannst keine Beiträge in dieses Forum schreiben.