VAG DSG CAN support

[AndreyB]

Since we have Hellen121VAG sounds like next step would be to make some VAG gearboxes happy via CAN?

[AndreyB]

Some info at https://www.maxxecu.com/webhelp/advanced-vag_dsg.html

https://mdac.com.au/2021/04/11/dsg-control-with-rabbit-ecu/ WOW that's an AMAZING write-up. I wish the Rabbit guy was involved with rusEFI wink wink!

[Wonderingwobble]

IDK if we can gleam anything from his github or not. I've posted a link to rabbitecu before. I think we where talking about DI at the time. I've been following him for some time now myself. https://github.com/RabbitECUProject

[nyl]

Most used gearboxes in projects are DQ500 and DQ250. Pre-MQB platform, if you buy MQB platform variants you will probably get away easier with mechatronics swap than reflashing, i think the hardware is a bit different also in the mechatronics.



Quote from vwvortex:

"DO NOT buy the DSG6 transmission from the VR6 equipped cars. It has a different bellhousing bolt pattern and WILL NOT FIT to your 4 cylinders engine.

DO NOT buy the DSG6 transmission from the 2015-on cars (MQB platform). In these units, the mechatronic is attached to the immobilizer system and will not work on your car. Also, for reflashing these units, you need a brand flashing tool with an online connection and account, because only the Virtual Read (VR) is possible. And again without the immo permission, you can not write it back .

If you want to buy a DSG from the TDI car-its ok, but you have to have the equipment for reflashing it OR somebody who can do it for you because you need to correct shift points, torque limiters, load maps, launch settings etc. If you don't have it-DO NOT buy the TDI DSG for your project."

Trimis de pe al meu GM1913 folosind Tapatalk

[nmstec]

I might have the tool for programming those DSG immo boxes. Havent done it in years, but im pretty sure I have before. They call it component protection.

[Abricos]

The aim of SFD

Product analyses in the VW Group have shown that there is an increased requirement for protection of data in vehicles. This is also the case for Vehicle Diagnostic Protection. The previous procedure (activation of security access by way of a 5-digit login code) no longer conforms to the state of the art. As of 2020 – beginning with the market entry of the MQB37W (Golf 8) – there will be a cross-brand introduction of the SFD procedure in order to provide Vehicle Diagnostic Protection.

SFD will be introduced in two project stages:

Stage 1 comprises access protection of protected diagnostic objects in control units and the verifiability of this access on an individual level. The protection requirement will be defined for specific control units and diagnostic objects. The protection requirement is limited to specific writing services (codings, adjustments, parametrisations) and routines. Normal reading services (e.g. readout of control unit event memories) will not be SFD-protected. The functions of data string downloading with boot loader data strings, flashing and/or update programming as well as flash data security are also not affected by SFD.

Stage 2 includes, as a supplement to stage 1, tamper protection of diagnostic contents upon integration of the diagnostic contents by end-to-end safeguarding of diagnostic data between VAG IT back end systems and control units. In order to be able to log access to diagnostic contents requiring protection in future, the IT security organisation requires strong user authentication to be enforced. It is therefore necessary to use two-factor authentication, which can be implemented, for example, by using

PKI-cards
SecurID-cards
Applications that generate one-time passwords (e.g. Google Authenticator or Microsoft Authenticator).
In a first transition phase, however, weak authentication by way of a username and password will initially be introduced when using the Dealer Portal. The transition to strong authentication by means of the Group Retail Portal will be developed in parallel.

The SFD process requires the vehicle diagnostic tester to have an online connection

[MWP]

Wow.

So the HTG style of DSG/DCT control (removing/replacing the entire gearbox control ecu) is going to be the only way to use these going ahead.

[bri3d]

Long time lurker, this is the first time I have something useful to post. A few notes about DQ250 DSG:

* DQ250 and DQ250-MQB does not have SFD. SFD is a gateway thing from Golf 8, basically you need a signed token to perform Long Coding and Adaptation. It's not really related to swaps, immobilizer, or component protection, which were already secured, it's just a way to take away more of your rights to fix your own car under the guise of "security." So it's basically evil and stupid but a complete aside to this conversation.

* DQ250-MQB *does* have Immobilizer, not Component Protection. At a technical level they are two different systems completely. At a conceptual level the big difference is that the physical car key is a part of the Immobilizer system, while CP just binds modules to the gateway. I agree that the best option here is just not to use DQ250-MQB. If you want to use a DQ250-MQB there are commercial tools that use an exploit in the supplier boot loader to "bench write" the DSG module and you can use these tools to write a patched software with the immobilizer disabled, but this is a cost and workload you can also avoid by using an older mechatronics that don't have immobilizer.

* The messages you want to send to the DSG are documented in two places, the KMatrix and the Funktionsrahmen. If you can find either document for a vehicle with the DSG you are trying to use, you are in good shape. Otherwise, you can also sniff the powertrain/Antrieb CANbus on a working car and do some tedious reverse engineering. Basically, the KMatrix is the master documentation for the CAN communications for a given VW vehicle platform. If you can find one of these, it's just a matter of reading and writing. The Funktionsrahmen is the master documentation for a control module - it will at least document the ECU messages sent to and received from the TCU, for example.

* Here are some pointers, that RabbitECU documentation is extremely good and is probably a better starting place:

The most important ECU -> TCU messages and what I know about them:

0x280 mMotor_1 : Byte 2 Indicated Torque, Byte 3/4 RPM, Byte 5 Indexed torque, Byte 6 Pedal %, Byte 7 torque loss (AC/ alternator/ blah blah), Byte 8 Driver Requested Torque
0x288 mMotor_2: Byte 2 Coolant Temperature, a lot of other flags in here but not sure how much they matter.
0x488 mMotor_6: Byte 2 Target Torque for Gearbox, Byte 3 Actual Torque for Gear, Byte 4 Altitude Correction for Baro, Byte 5 ?? Byte 6 gearbox intervention capability, the high side of the last byte is some kind of counter I think.

You'll also want to zoom in on 0x448 mWaehlhebel_1 which is the gearshift lever if you are using a newer mechatronic where this goes over CAN.

There are a couple other important messages, 0x1A0 Bremse_1, 0x5A0 Bremse_2, and 0x4A0 Bremse_3 .

Going the other way, 0x440 and 0x540 are the key messages sent from the TCU back to the ECU to request torque intervention across a shift.

I hope this helps. The best way to start is probably to get a CAN dump from a car with the donor mechatronics version and zoom in on the messages I have suggested across various driving conditions and a shift, or get the FR for the ECU from that platform or the KMatrix if possible.

I have not actually done this swap but started down the road so I figured I would give you all what I know as a place to start. Again, the RabbitECU docs actually look better for this so I'd definitely start there, but I can help if wanted

[AndreyB]

Exactly reading RabbitECU documentation and talking to Matt RabbitECU is the way to go with DSG _if_ we go DSG.

As of right now that's not on the action plan since no committed DSG beta tester. Our development efforts are mostly driven by alpha/beta tester availability.

[Abricos]

Long time lurker, this is the first time I have something useful to post. A few notes about DQ250 DSG:

* DQ250 and DQ250-MQB does not have SFD. SFD is a gateway thing from Golf 8, basically you need a signed token to perform Long Coding and Adaptation. It's not really related to swaps, immobilizer, or component protection, which were already secured, it's just a way to take away more of your rights to fix your own car under the guise of "security." So it's basically evil and stupid but a complete aside to this conversation.

* DQ250-MQB *does* have Immobilizer, not Component Protection. At a technical level they are two different systems completely. At a conceptual level the big difference is that the physical car key is a part of the Immobilizer system, while CP just binds modules to the gateway. I agree that the best option here is just not to use DQ250-MQB. If you want to use a DQ250-MQB there are commercial tools that use an exploit in the supplier boot loader to "bench write" the DSG module and you can use these tools to write a patched software with the immobilizer disabled, but this is a cost and workload you can also avoid by using an older mechatronics that don't have immobilizer.

* The messages you want to send to the DSG are documented in two places, the KMatrix and the Funktionsrahmen. If you can find either document for a vehicle with the DSG you are trying to use, you are in good shape. Otherwise, you can also sniff the powertrain/Antrieb CANbus on a working car and do some tedious reverse engineering. Basically, the KMatrix is the master documentation for the CAN communications for a given VW vehicle platform. If you can find one of these, it's just a matter of reading and writing. The Funktionsrahmen is the master documentation for a control module - it will at least document the ECU messages sent to and received from the TCU, for example.

* Here are some pointers, that RabbitECU documentation is extremely good and is probably a better starting place:

The most important ECU -> TCU messages and what I know about them:

0x280 mMotor_1 : Byte 2 Indicated Torque, Byte 3/4 RPM, Byte 5 Indexed torque, Byte 6 Pedal %, Byte 7 torque loss (AC/ alternator/ blah blah), Byte 8 Driver Requested Torque
0x288 mMotor_2: Byte 2 Coolant Temperature, a lot of other flags in here but not sure how much they matter.
0x488 mMotor_6: Byte 2 Target Torque for Gearbox, Byte 3 Actual Torque for Gear, Byte 4 Altitude Correction for Baro, Byte 5 ?? Byte 6 gearbox intervention capability, the high side of the last byte is some kind of counter I think.

You'll also want to zoom in on 0x448 mWaehlhebel_1 which is the gearshift lever if you are using a newer mechatronic where this goes over CAN.

There are a couple other important messages, 0x1A0 Bremse_1, 0x5A0 Bremse_2, and 0x4A0 Bremse_3 .

Going the other way, 0x440 and 0x540 are the key messages sent from the TCU back to the ECU to request torque intervention across a shift.

I hope this helps. The best way to start is probably to get a CAN dump from a car with the donor mechatronics version and zoom in on the messages I have suggested across various driving conditions and a shift, or get the FR for the ECU from that platform or the KMatrix if possible.

I have not actually done this swap but started down the road so I figured I would give you all what I know as a place to start. Again, the RabbitECU docs actually look better for this so I'd definitely start there, but I can help if wanted

you forgot a lot of small little things without which the transmission will not work correctly ...
Like speed - dsg don't have speed sensor
I love FAZIT security

Screenshot_20211127-200010__01.jpg (403.68 KiB) Viewed 2790 times

[nyl]

DSG takes speed info from ABS unit MK60 ABS+ESP version, upon conversation instrument cluster also needs reflash in order to use signal from ABS unit for speed

Trimis de pe al meu GM1913 folosind Tapatalk

[nmstec]

DSG takes speed info from ABS unit MK60 ABS+ESP version, upon conversation instrument cluster also needs reflash in order to use signal from ABS unit for speed

Trimis de pe al meu GM1913 folosind Tapatalk

Not a real problem, you can get around it by pulling it out of ABS yourself, and sending it out as a TCM packet. Thats what im doing with the harleys.