MQB platform Test Bench Attempt.

[Meesters]

Hello,

Recently I retrofitted a 556B highline RVC. After succesfully managed to calibrate it in Golf 7.5 I want to play with the adaptations to change for example the tire size. Only in developer mode it asks for security acces code, in other diagnostics modes I can't do anything, problem is that I need security acces code. Does anyone knows the correct code? Or how to acces the adaptations?

Great thanks!

Greets Chris.

 

[DV52]

Chris: Hi.

Until a few years ago, I was an active member of the VCDS forum. However, I made an ethical decision to cease supporting the forum after I was censored by the founder of Ross-Tech for having different views on US gun control. Uwe Ross holds ultra right-wing views on this matter - which is his right as an American. However, the VCDS forum is a public forum and simply holding different views is NOT a reason for censorship - IMO, of course!

Anyhow, during my time as a VCDS forum member - I created a reasonably fulsome list of "known" security codes for MQB platform cars like your Golf mk7.5.

You can find my list HERE. As a further point - I suggest that you note the caution in my opening paragraph about module lock-out if incorrect codes are attempted.

As I say in my link - these modules are very unforgiving to wrong security codes!!

Don

 

[Meesters]

Thanks Don, Very friendly for sharing all your knowledge all the time. Practically every VAG related forum that I visit, you participate. Where do you find the time .
It's a shame political opinions drive people apart.

Sadly the security code is not the right one for 6C RVC. There are a few different types of diagnostics modes. Practically all modes reject any adaptation and gives the error "function unavailable", except for "developer mode". When in developer mode, and I change an adaptation, it asks for a security code, but it is not 20103. It is by the way not the first time that I had to change to another diagnostics mode before it was possible to change coding/adaptations.

So thanks anyway Don, the list you have provided will come to use some day!

So if anyone has more information about the subject, it would be great! Maybe it isn't even possible to change adaptations in 6C?

Great thanks!

 

[DV52]

Thanks Don, Very friendly for sharing all your knowledge all the time. Practically every VAG related forum that I visit, you participate. Where do you find the time .

Sadly the security code is not the right one for 6C RVC. There are a few different types of diagnostics modes. Practically all modes reject any adaptation and gives the error "function unavailable", except for "developer mode". When in developer mode, and I change an adaptation, it asks for a security code, but it is not 20103. It is by the way not the first time that I had to change to another diagnostics mode before it was possible to change coding/adaptations.

So thanks anyway Don, the list you have provided will come to use some day!

So if anyone has more information about the subject, it would be great! Maybe it isn't even possible to change adaptations in 6C?

Great thanks!

@Meesters :Thanks for the kind words!!

hmm.......... OK about 20103- as I say in my link, this particular security code was suggested by @mastertommy (a VCDS forum member).

As you may be aware, finding new security codes for MQB platform cars that have NOT previously been in the public domain is as rare as finding rocking-horse sh#t!!

BUT there is a way to do it!! ALL you need is two pieces of kit: a VCP cable and a MQB test bench (I have both - see the pic below).

VCP has a facility called "login-finder" - it's a brute-force process that keeps the module open while it tries EVERY 5-digit-number in a range which is set by the user. I used this method to find the security codes with my name in the list in my link.

For example, for 79153 in the Engine Control Unit (see my link), I fired-up my test bench with my VCP cable plugged into the OBD port and I set-up "login-finder" to poll for the range 00000-99999.

The entire end-to-end polling-process took a little over 8 hours - but after completion, VCP reported 79153 and 27971 (the latter security code was already in the public domain).

So, it can be done!!

Don

 

[Meesters]

Thanks, I got VCP but no test bench, although I could make a bench meanwhile (I think). Maybe I will order a bench cable set on ali, I have a spare gateway high, BCM mid+ and tacho, would that be enough?

 

[DV52]

@Meesters : I've not used the Alliexpress cable set-up to simulate a test-bench.

Of course, I'm aware of the claims of the Alliexress manufacturers but I suspect that my definition of "test-bench" might be a tad different to theirs!!

One of my pivotal learnings from constructing a few versions of my test-bench is the importance of the CAN wake-up signal on MQB platform cars. As you will know, the modules go into a sleep state when the ignition is switched-OFF. Waking-up the modules (which is fairly important on a test-bench) ain't that easy - and NO, it's NOT just a matter of generating a Terminal 15 voltage!!

Again, as I suspect you already know - the wake-up signal on a MQB platform car happens as a CAN message which is initiated via the steering wheel module (the CAN message is continuously repeated whilst the ignition lock is in the first position).

So, I found in my early generation test-bench that simply connecting various modules together via a simple wiring loom ain't of much value because the entire test-bench remains in the sleep state when powered-up! I suspect that this restriction also will be binding on the Alli- style test-bench because it's just a bunch of wiring looms and multiple connectors!

Anyhow, I discovered for my later generation test-bench that I needed to add a steering wheel module AND a simulated ignition lock.

I started a "test-bench" thread on the Ross-Tech forum that describes my learning-curve - which might be of interest HERE. As you will read, later contributions to my thread use a can-message simulator (Arduino based) to generate the wake-up signal!

An alternative to my test-bench suggestion is to hook-up your VCP- cable to the physical car and use a battery-charger to keep the voltage-rail healthy for the polling period. Of course it means that the car can't be used - but if the process happens overnight - this might not be such a problem!

The other requirement for "Login-finder" that I failed to mention is that it also requires a correct security-code to open the module for the subsequent brute-force process. I assume/hope that 20103 will suffice for this purpose - but it might be prudent to first try 20103 with your VCP cable as proof-of-concept !

Don

PS: Is it just me - or are other folk being bombarded by forum advertisments? I understand the need for the forum to generate funds from ads - but it seems to me like this forum web-pages are devoted to ads with actual member posts being minor additions!!

Message to the forum decision-makers: I don't understand why seeing multiple versions of the same advertisment on a web-page is helpful for anyone (both users and/or advertisers)!! Please get the priorities correct!

 

[Meesters]

Good morning Don,

Thanks again for your detailed explanation. I had already noticed that your test bench setup is not exactly an Aliexpress set.

I'm going to look into it more, I really enjoy tinkering with these kinds of things anyway. It started a few years ago with a polo, and later an A3, where I mainly did some retrofits, or had the more complicated upgrades done, because I thought those nice options should not be missing. Until 2 years ago, when I was forced to buy a very bare Golf, and I have now tackled almost the entire car, albeit with some help from a friend every now and then. So what started as adding missing options has turned into a real hobby, and I can't get enough of it. Unfortunately, I actually joined a bit late, and MQB is almost a thing of the past, but who knows what will happen in the future.

I also have a clock spring with the levers, so I mainly need an ignition lock or something that simulates that to wake things up. As I said, I'm going to read up on it in a quiet moment and see what is possible. The option of putting the car on a trickle charger is also a good option.

Thanks again!

Have a nice day, greetings Chris.

 

[DV52]

@Meesters: OK - if you already have the steering wheel module (the thing you call "a clock-spring with the levers") - then you only need to buy the rotary electrical switch that sits at the end of the ignition key barrel on a real car (see my test-bench picture and the item below)

The part number for the rotary switch for a Golf mk7 is 5Q0-905-849C and it's not expensive (about $20 AUD).

On my early version test-bench, I just used a series of wire connections joined together to a four-pole, single-throw switch - instead of the official rotary switch. This is how the 8 x pin connector in my picture above is connected as the ignition key is moved across positions:

So, if you wanted to simulate ignition-ON (i.e. the CAN wake-up state) - join together pins #3, #4, #5, #6 to a basic 4 x pole ON/OFF switch!!

If you go this route - I suggest that you use a method that can switch the ignition-ON state AFTER the test-bench is powered-UP (instead of just permanently joining the pins together without a switch). This gives the modules time to stabilize post the application of a Terminal 30 voltage and before the ignition-ON simulation is applied!

Don

 

[Meesters]

Hi @DV52 ,

Haha, forgive me for the language barrier. I now even use Google Translate to be able to express myself better.

Well, back to the topic, your input may have brought the answer to my question closer. I think, to make things easier for myself, I'll go for an Ali cable set. And then I go for the "Brute Force" solution. "Luckily", I still have a spare camera, which I bought second hand as a 568B camera, but turned out to be just a 556B.

If a result comes out, I will publish it here.

Thank you again.

Greetings Chris.

 

[Meesters]

@DV52

After starting to read your thread on the Ross-Tech forum (Which goes a little slowly because of the language), I now decided to go the hard (fun) way. As you advised I start with the basics to understand the topology. So my main goal is to combine the gateway with the BCM and make it accessible. After that I want to add also the steeringwheel module with the ignition switch.

I have 2 questions already:

1: I'm thinking about using maybe original connectors instead of jumper wires, because I have a large variety of pins, that I easily can install in the connectors.
Because of the length off the topic, and time it takes for me to read, maybe you could already reveal if there are partnumbers for different types of connectors to be found somewhere in the topic.

2: You think the 6C can be accessed with the basic setup as described above?

Thanks in advance.

Chris.

 

[DV52]

Chris: Because of the quality of your writing style in these posts, I hadn't appreciated that reading English would be a problem - but yes, I can now understand your difficulty in plowing through my long thread on the Ross-Tech site!

As for your question, none of the various versions of my test-bench that I built over a long time have used OEM plugs/sockets: they have ALL been wired together using hand-made connectors and/or stuff that I have had in my "junk-box". I have tried to keep costs low!

I guess the first decision that you might want to make on this matter is understanding your longer term objective for the test-bench! In my case, I had no particular objective other than using the test-bench to learn about CAN networks and to a degree, it was successful for this task!

However, my test-bench is now used by other folk from my local forum to learn about "Leuchte Programming" (which is the computer language on MQB platform cars to control exterior lighting). So, different folk attempt to code various lighting effects on my "virtual mk7" without the risk of breaking a real car. To date no one has managed to destroy my test-bench despite some very strange programming attempts!!

If I had to start test-bench construction again with knowledge that I now have about how it would be eventually used - I would add some OEM module plugs/sockets because occasionally I've had to repair/re-make my hand-made connectors (different modules/wires are sometimes moved when the test-bench is used). The Alliexpress solution at least provides a solution that has these OEM connectors.

No, I don't have a list of part numbers for ALL modules - but you don't need OEM connectors on ALL test-bench modules! Think about how the CAN network is wired on a test-bench and you will concude that for most modules, the ONLY connections needed are the CAN high/low wires and the 2 x power-supply wires (and perhaps a Terminal 15 wire). With just these 4/5 x wires, the diagnostic device that plugs into the OBD-port should be able to poll the module

The exception is the Gateway module because for this module, the test-bench needs connections for up-to 6 x CAN buses (depending on which other modules are used), power-supply wires and the connections for the OBD port. So, I suggest that you use an OEM connector for this module (see Alliexpress item number 4001191290025, or other similar sellers)

In my case and because of my emphasis on "Leuchte programming", it would have been beneficial to also use OEM connectors for the 3 x sockets on the BCM because the vast majority of the spaghetti-nest of wires in my test-bench picture are for the simulated car lighting panel

Don

PS: the other important matter to understand about a test-bench is Component Protection (CP). In my case and again because I wanted to keep costs low, the modules were purchased from various sellers. Unless you source the key modules on the test-bench from the same car as the donor Gateway module, your test-bench will be CP restricted. In the main, CP errors do NOT impact coding functions, or module access on affected modules. However, CP errors will have some effect on the module - see the screen on the dashboard module in my test-bench picture)

 

[Meesters]

Goodmorning Don,

I agree completely with all of your post. I ordered already the following parts among some other parts:

I agree about what is exactly the goal, well in the first place, to Brute force the security acces code of the 6C RVC module. Furthermore, for the moment, not to much except having a little fun with it. So after buying the basic parts to make it work, I do try to keep the costs low also. Maybe I might buy indeed the BCM connectors, did see them already online. I do have the one for the steeringwheel module, since I retrofitted a heated steering wheel. About that, on my SW module is an 7 pin connection for the ignition switch, so I think SW module for facelift might be slightly different? I did already order the ignition switch you recommended, it was € 10,- with cable. I think I try to cut it nicely with a very small special scissor, and repin if necessary. If this doesn't work I'll buy the right one, which is probably 5Q0-905-849A.

I also found an interesting site btw.
https://vwts.ru/articles/electro/fitting-locations-skoda-kodiaq-front.html
I have same SW module is in this car, but way more info could be found on this site.

All components that I have for the moment, came from my own car, except for the gateway . So if I'm correct, CP must be removed from every component if wanted/required. But I know how to do that, I have the tools, and if so, I think I immediately try to do all at once, since this is not free.

To be continued.

Chris.

PS. You are right about the advertisement on this site. Sometimes it is placed in a real annoying way, what results that actually posts are pushed completely to the side.

 

[DV52]

Chris: Arrhh.......... yes, I forgot to mention the "f" word (not the expletive!! ). Ain't worth doing anything on a test-bench unless it's fun!! My hunch is that those that build a test-bench are a particular type of individual - not your average person (meaning that their definition of "fun" is very distinctive). Which is a good thing!!

One further suggestion - I suggest that you also think about the power-supply requirement for your test-bench. Of course this depends on what modules you intend to connect. On my test-bench which has a hand-full of modules, the electrical current draw in the CAN wake-up state is about 1 amp (so, approximately 14 Watts)

I chose to use a proper regulated variable-voltage power-supply that I also use for general electronics repairs - but you may not have this option. The Alliexpress option uses a "cube" 12V power-supply which is perfectly OK! If you have ambitions to hook-up a MIB to your test-bench at a later time, be aware that adding this one-module can double the amps needed from the power-supply (without speakers).

And finally, I made a specific PCB with a few terminal-strip connectors for +12V/earth module wires for the T30 power-supply because each new module extends the need for additional connectors. Generating a T15V supply on a MQB platform test-bench is done via a relay (J329) which is triggered via pin #13, Socket A on the BCM. My original test-bench always had a BCM, so I used an old telecom relay from my junk-box - but you might consider using a simple single-throw, single-pole switch for this purpose if your test-bench does NOT include a BCM. My power-distribution PCB also includes an extra terminal-strip connector for the T15V rail

Good luck on your build - and enjoy!!

Don

 

[Meesters]

Don,

Thanks for all the different advices, I'll keep you updated time by time (or ask for some more advice maybe ).

Chris

 

[Meesters]

Hi @DV52,

So first parts arrived, and immediately I start to craft of course .

Gateway is recognised and working, but Steeringwheel module is not recognised although.

The ignition switch came eventually without a cable so I modified a cable that I had, to make a bridge between pins 3, 4, 5 and 6 to simulate ignition.

Furthermore I connected te 20 pin connector from the steeringwheel module the following way:

pin 1: kl30
pin 2: kl31
pin 3: can low convenience (pin 5 gateway)
pin 4: can high convenience (pin 15 gateway)
pin 14: t15
pin 16: t15

I did the following procedure:

1. Connect 12V
2. Ignition
3. T15

Do I miss something?

Great thanks for your advice!

Greets Chris.