Some VW CAN Stuff to help out people with MK5 and some MK6 Type platform vehicles


#1

This mostly done on a Touran but most should transplant over to cars like the Golf MK6, Scirroco, Tiguan… Just depends on year and so forth but at the very least will help you find stuff.

I’ll just copy and paste most of the coding I used in car control project I did a few years back. Everything done with an App I made for Android using MIT’s program. Coding is not for M2 but should be easy enough for the eager person to convert. All of this was done on the comfort CAN BUS.

//Window Variables use ID HEX 0x391
unsigned char comfortUp[3] = { 85,128,0 }; //put windows up
unsigned char comfortDown[3] = { 170,128,0 }; //put windows down
unsigned char driverWindowUp[3] = { 1,0,0 }; //Driver windows up
unsigned char driversWindowDown[3] = { 2,0,0 }; //Drivers windows down
unsigned char passengerWindowUp[3] = { 4,0,0 }; //Passenger windows up
unsigned char passengerWindowDown[3] = { 8,0,0 }; //Passenger windows down
unsigned char rearPassengerWindowUp[3] = { 16,0,0 }; //Rear Passenger windows up
unsigned char rearPassengerWindowDown[3] = { 32,0,0 }; //Rear Passenger windows down
unsigned char rearDriverWindowUp[3] = { 64,0,0 }; //Rear Drivers windows up
unsigned char rearDriversWindowDown[3] = { 128,0,0 }; //Rear Drivers windows down

These values are manual control not just send once. So coding should look something like this(keep in mind I used Bluetooth to connect and send the commands which is why there is an input string):

if (inputString == “a”)
{
Serial.println(“Windows up”);
for (int x = 0; x < 50; x++)
{
CAN.sendMsgBuf(0x391, 0, 3, comfortUp);
delay(100);
}
}

//Door Lock Variables uses ID HEX 0x291
unsigned char lockAll[5] = { 138,85,0,1,0 }; //Lock all doors with alarm active
unsigned char unlockAll[5] = { 74,170,0,2,0 }; //unlock all doors
unsigned char lockDrivers[5] = { 0,1,0,0,0 }; //Lock drivers door
unsigned char unlockDrivers[5] = { 0,2,0,0,0 }; //Unlock drivers door
unsigned char lockPassengers[5] = { 0,4,0,0,0 }; //Lock passenger door
unsigned char unlockPassenger[5] = { 0,8,0,0,0 }; //Unlock passenger door
unsigned char lockRearPassengers[5] = { 0,16,0,0,0 }; //Lock rear drivers door
unsigned char unlockRearPassengers[5] = { 0,32,0,0,0 }; //Unlock rear drivers door
unsigned char lockRearDrivers[5] = { 0,64,0,0,0 }; //Lock rear passenger door
unsigned char unlockRearDrivers[5] = { 0,128,0,0,0 }; //Unlock rear passenger door

else if (inputString == “O”)
{
Serial.println(“Drivers door unlock”);
for (int x = 0; x < 2; x++)
{
CAN.sendMsgBuf(0x291, 0, 5, unlockDrivers);
delay(100);
}
}

//Other locking variables used ID HEX 0x381
unsigned char trunk[6] = { 128,12,190,128,34,0 }; // open trunk with short press instead of long
unsigned char fuel[6] = { 129,12,0,140,19,0 }; // open fuel door

else if (inputString == “c”)
{
Serial.println(“Opening Trunk”);
for (int x = 0; x < 30; x++)
{
CAN.sendMsgBuf(0x381, 0, 6, trunk);
delay(100);
}
}
else if (inputString == “ort”)
{
Serial.println(“Opening Fuel Door”);
for (int x = 0; x < 2; x++)
{
CAN.sendMsgBuf(0x381, 0, 6, fuel);
delay(100);
}
}

//Steering Controls used ID HEX 0x5C1 (if memory serves MK6 use 4 bytes not 1. But the base codes are the same.)
unsigned char medChangeInput[1] = { 1 }; // Change Input
unsigned char mediRightArrow[1] = { 2 }; // Right Arrow (Next)
unsigned char mediaLeftArror[1] = { 3 }; // Left Arrow (Prev)
unsigned char mediaVolumeUp[1] = { 6 }; // Volume Up
unsigned char mediaVolumeDown[1] = { 7 }; // Volume Down
unsigned char Medimenu[1] = { 10 }; // Volume Up
unsigned char mediaPhone[1] = { 26 }; // Phone
unsigned char mediUpArrow[1] = { 34 }; // Right Up Arrow
unsigned char mediaDownArror[1] = { 35 }; // Right Down Arrow
unsigned char mediaOK[1] = { 40 }; // Ok Button
unsigned char mediaMute[1] = { 43 }; // Mute

else if (inputString == “s”)
{
Serial.println(“Volume Up”);
CAN.sendMsgBuf(0x5C1, 0, 1, mediaVolumeUp);
}

Calculate Speed.
ID 0x351. Speed is contained in Byte 2. Calculation is (Speed = (buf[2] * 256) + (buf[3]-1)) / 190; )

Oil Temp.
ID 0x35B Byte 4

Water Temp
ID 0x35B Byte 3. Calculation is (waterTemp = (buf[3]-64); )

Voltage
ID 0x571 Byte 0. Calculation is (Voltage = (((float)buf[0] / 2.00) + 50.00) / 10.00; )

Well that should be enough to get A VW owner started.
My program was obviously very large but this cut version should get you going.


#2

Lots of great info here. Thanks for sharing.

Can you explain your RE process? I have yet to work with a VW.


#3

What exactly do you want to know. I am sure working on the VW isn’t to much different than other cars other than most of the work is done directly on the BUS and not OBD. But I’ll share what I can. Our shop has just launched to BMW and Mercedes so I hope over the next year to get deep into those as well.


#4

@ecsharpe
For some more information on the VW based cars check out my last post on this thread.

I posted a good starting point to understanding how diagnostics works on the VW’s and what the messages look like. I of course have a LOT more information than that including how to request versions, serial numbers, Module designation codes…

Fact is most of the information can be figured out with a few good logs while using an OEM type tool to poll the modules while sniffing. I normally save most data in decimal format and run it all through a Decimal to Ascii converter or just build a formula into excel to do it for me. Based on data received I can then figure out what most of the requests are.

I did notice that a lot of the basic requests and functions do conform to ISO standards for the protocols so that helps as well.

Since factory tools will poll multiple modules it can get hard to read sometimes. Once you know how the communication works which i posted in the other thread you can easily reorganise the signals to see what is actually happening.

For tapping into the gateway I just put together a quick passthru harness. I can unplug the gateway and put in my own harness between the gateway and the car and tap into any BUS I want to monitor.

If you need something specific as to what I’m using or how let me know.


#5

I think this is perfect. Should be enough info to help people get started with VAG stuff. We have a side project to set up data logging on a Jetta. Hopefully we can get to that and try some of this.


#6

Let me know what version Jetta you are going to do when you get round to it. I often get access to cars long enough to tap in and check things out so I can do some baseline work if you get stuck.