How to read vw can bus

General Discussion
#3

Well the OBD port wont give you anything unless you ask for it but the rest of the CAN BUS lines will let you listen in.

Data on VAG line of cars don’t just spill data out on the OBD. You connect to the module you want information from (using a connection protocol) and you request specific information. This is not proprietary, it’s an ISO standard.

Manufacturers are mandated to have a very specific protocol on the OBD and they are not allowed to use proprietary communications. Its just that different manufactures go about the operation in different ways.

If you want to view diagnostic information only buy a cheap ELM. If you really want to see whats going on tap into a CAN BUS that has a module you want to watch and have some real fun.

I only hack VW and Audi and it can be very interesting.

#4

I follow to know if there’s some development on VAG cars.

#5

If someone gives me a more specific car I will post the wiring diagrams (Make, Model, Year, Trim). That should help everyone understand what is going on. I’m sure the set up doesn’t change much between cars and even between years, but we might as well look at a car someone has.

#6

They change a lot between the year and cars. Most VW have a single CAN going to steering but newer higher models have dual, Like most Audi’s.

Equipment varies from car to car. Some cars use comfort BUS for camera some use Dashboard new Audi’s use extended. Some steering modules use Dual can like drive-train and comfort, others may use dashboard instead of comfort, some only only have one which is normally comfort…
Newer Audi’s are plagued with FlexRay reducing how much you can even use the Macchina on.

Standard Buses on most VAG cars are:
Diagnostic BUS (OBD Port) (can be Orange/Black or Orange/Red)
Comfort BUS (Orange/Green)
Dashboard BUS (Orange/Blue)
Drive-train BUS (can be Orange/Black or Orange/Red)
Infotainment BUS (Orange/Violet)
FlexRay… Can’t sniff those. Pink and green I think? For sure Pink is one colour.

Older VW’s may have a specific DASH CAN that comes from Radio to Cluster. Can’t recall colour.

New VW’s and Audi’s with MIB system also have an isolated CAN BUS between all infotainment items such as Control panel and screen. This originates from the main MIB control unit and the MIB acts as a gateway for them for them.

#7

There should be a sort of blind “query” for all devices on bus made on gateway, just to know if a specific component is present or not. Then we should ask details on each one of them.

#8
  • Note this is all based on self learning and hundreds of hours of analyzing data. I apologize if I got any of it wrong.

Well there is for the VAG group diagnostics but I don’t think there is for regular OBD protocol.

Its a bit complicated how the original diagnostics work vs ISO OBD diagnostics.

When using VAG diagnostics a full list of possible modules is sent after the appropriate request. This includes all module installed and modules the gateway should be able to talk to if installed. In the response the modules are indicated as either present or not. It also assigns a value to the module that the diagnostics must use to initiate communications.

That value it assigns is ONLY used to start communication, as part of the connection protocol that value is reassigned again to a generic value. You can request to use a certain value but the gateway ultimately will assign a value for the tester to respond to. That generic value is what will be used during that session until the disconnect module message is sent. Then that generic value will get reused on another module. Note you can connect to multiple modules at one time so there are multiple generic values. Reconnecting to the same module is not a guarantee on the same generic value being assigned.

All messages between the gateway and the tester must also follow a specific number sequence for ever message that is sent. Failure to send the proper starting Byte will make the gateway simply ignore the message.

For diagnostics it’s much easier to stick to the OBD ISO standard but you can do much more with the VAG diagnostics since you can access/flash/control outputs and so forth with it.

Some basics to get to the gateway. First thing you need to do is send a connection request and receive the ID that all messages are going to sent by.

0x200 (1F C0 00 10 00 03 01) Tester requests communication and ID from gateway.
0x21F (00 D0 00 03 BF 04 01) Gateway Responds. Tester ID is now 0x4BF and gateway will be 0x300

A request for the module coding from The gateway:

0x4BF (14 00 03 22 06 00) Request Module Coding
0x300 (29 00 06 62 06 00 00 C3) Responce: 00C303
0x300 (1A 03)

Requesting installation list from Gateway:

0x4BF (16 00 03 22 04 A1) Request Installation List

Just some lines so I can show.

  • First Byte is always line number

0x300 (2E 00 E7 62 04 A1 19 1F) First byte line number the next 5 are the positive response to the request.
0x300 (2F 05 0D 05 31 01 01 09)
0x300 (20 20 01 01 46 21 01 01) Skipped a line for clarity. Byte 03 is start of module identification which always is 01, 46 is the number for the BCM Module 46. 21 is the assigned diagnostic value for 46. Byte 7 (01) shows the module is present. A value of (00) means the module is not installed…
0x300 (21 42 22 01 01 52 23 01)
0x300 (22 01 62 24 01 01 72 25)
0x300 (23 01 01 36 26 01 01 06) Module 06 assigned value 35. NOT INSTALLED.
0x300 (24 35 00 01 69 43 00 01)

Ok so now we know some numbers…

The tester closed communication with the gateway since it got all the IDS and wants to start talking to a module. We will use module 46 from above. We know its new value is 21

Request:
0x200 (21 C0 00 10 00 03 01)
Byte 0 module to connect to (module 46(BCM) aka 21). The the request to connect Bytes 1.
Byte 1 is the request to connect
Byte 2-3 I think is the requested ID for the tester. Always seems to be the same numbers.
Byte 4-5 is the ID the tester wants to use for the BCM in reverse 00 03. 0300… 0x300…
Byte 6 is end of request.

Response:
0x221 (00 D0 00 03 C1 04 01)
Byte 0 is blank as the tester doesn’t have any ID (assuming)
Byte 1 is positive response to connect
Byte 2-3 appears to be the modules ID backwards
Byte 4-5 is the assigned ID to the tester
Byte 6 end of request.

so if your watching the can bus all your module 46 messages are going to start with 4C1 now. All your tester messages have to be sent using ID 300 or they will be ignored.

Anyway… That’s enough for now… Good Luck.

Sorry. Should note that isn’t all the connection coding it’s the main coding though. You still have to agree with the module on the keep alive signal which is similar in communication as the module connect.

0x4D1 (A0 0F 8A FF 32 FF) Suggest Keep alive Response
0x300 (A1 0F 8A FF 4A FF) Set Keep Alive Response|

0x4D1 (A3) Send Tester Connected Message (to Keep alive)
0x300 (A1 0F 8A FF 4A FF) Keep alive response

  • Keep alive messages do not count against line counts for other requests and messages.

Ending Communication. Not to worry if you are talking to more than one module at a time. Your Tester ID is different for every module so only the module listening to the specific ID that is sending it will close.
0x4D1 (11 00 01 82) Request to close Communications
0x300 (11 00 01 C2) Positive Responce
0x4D1 (A8) - Not sure why but tester gets last goodbye by sending this byte.

1 Like
#9

That’s very interesting!!! So you reverse engineered a “commercial” tester? It’s the same idea I got some time ago.

#10

The tester I reversed engineered isn’t exactly commercial. It’s the dealer tool. “Commercial” tools only talk to one module at a time and do not use the same messages as dealer tools. There is a couple commercial tools that can get get you a lot of these messages flowing but they are a lot more expensive than an M2.

#11

I have a ODB11 dongle and my idea was to “reverse engineer” some data using a Y obdII cable with obd11 and M2.

#12

If i cut into the bcm bus wires does the door lock command actually work for you?

#13

I tapped into the comfort bus wires in the drivers door of my volkswagen and I’m still not getting any can bus messages. The vehicle still functions. all the driver door buttons still work I’m just not getting anything still

#14

Insure that the wires you are tying into are CANBUS and not LIN or some other method. Some vehicles use LIN to talk to some of their modules and NOT CANBUS. Also make sure when you do connect to the right wires that you are using the Ground, CAN+ and CAN- lines. Will also need a power supply that will supply enough power for your M2 which should be available at the same lines.

BCM is generally the central location for all of the buses and you should be able to tap into them there since the BCM tends to bridge them all.

#15

I am connected to the can bus green and orange comfort bus wires connected to the drivers door. I don’t understand why I am getting no messages. I am connected through can bit rate 100000, 125000, 250000 and even tried 500000 but nothing seems to work. When i tapped into the wires however I got an airbag fault. That might suggest that they are can bus wires.

#16

I am sorry, I am not very familiar with the VW CANBUS to know how to better help you.

Other that to say to insure you are on the right lines, not swapped, are CANBUS and find out what the rate is supposed to be. With GM’s their main CANBUS runs at 500k but the “comfort” or SWCAN bus runs at only 33k

You should also check for possible messages on the bus by rolling the windows up and down. If your door controller is the main controller you may have to send commands from other doors to get it to show anything.

When all else fails I have other devices I can hook up to verify if it is the device or me that isn’t doing something right. Just to see traffic anyhow. Such as my ScanTool SX cable with their software.

#17

Hey I noticed you’re working on VW vehicles I have a question if you could help me in any way. I tapped into the comfort bus wires in the drivers door of my volkswagen and I’m still not getting any can bus messages. The vehicle still functions. all the driver door buttons still work I’m just not getting anything still

#18

Hello my friends,

I just want to read temperature info from the VW Passat B6 climate controller, because i want to change the old displays with two OLED displays.
Can you help me to chose the correct way to solve my situation?
Please answer at the following questions:
1). it is neccesary to conect a can-bus interface to confort bus line, or it is possible to be conected everywhere?
2). do you know the address of this information?

#19

Hi subarubaru,

I am currently trying to find a way to turn off my amp when a phone call is in session. I got my hardware together to do some canbus sniffing. Do you have wiring diagrams which show where I can access the different can buses in a Passat GT 2018?

Thanks,
griff0417

#20

Hi We are trying to control a LINbus wiper motor from an Arduino.
Idea is that we use a shield from SKPang to interface to the LIN bus and hopefully build packets of information that we can send over the LINbus to activate the wipers.
However, we are ground zero!
Any suggestions on how to get the unit id? Or identify the data that the wiper motor expect to receive to activate it’s various modes?

We are thinking about sniffing the lin bus on an existing car and trying to isolate the unit id and then filter on that id to find the activation code values.

Does that sound practical?
Better still has anyone done it?
Thanks in advance
Bruce

PS Background is that we are building a custom set up. The wiper motor is from a European Caddy van (2008) and the harness is from a Passat (2019).

#21

You will have better luck going to a site that supports your Shield. That device likely has a totally different software scheme than the M2 and unless someone here has also tried to use that interface I doubt you will ever get a usable response. There are mailing lists available that might be a better help for you. Check out the car hackers handbook for more details.

#22

@kobyanthony if you have an airbag warning, you are on the canbus but wrong speed…
Test 250K and others until informations appear and no warning in cluster…