MQB platform Test Bench Attempt.

[DV52]

Chris: OK

OBD11 tells the user the GIL status of each module. Look again at your OBD11 Control Unit screen - notice the color of the circle surrounding "16" for the Steering Column module

This is how the colored circles indicate the module's GIL (Gateway Installation List) status when using OBD11:

So, the black circle on the Steering column module means that it is in the GIL - but check if there are any other modules registered using my instructions below. Remove any other module until (and if) they are actually installed

Does this hex16 module have heated steering wheel facility? If so, the pin-out is different to your list

Also, have you actually generated a T15 Voltage rail on the test-bench - meaning a switched voltage?

And, i'm not sure if making "a bridge between pins 3, 4, 5 and 6 to simulate ignition" will work. This set-up means that the simulated ignition process happens at the same time that the power-supply to the module is energised (and probably before the T15 pin is energised). This is NOT what happens in a real car! As I said in my previous reply, my suggestion is to use a 4 x pole, single-throw switch

Don

PS: As general instructions for adding/deleting modules on a test-bench (in the future) - this is the process for amending the GIL when the module count changes:

1. Fire-up OBD11 software and connect to the test-bench
2. Go-to the Control Units screen (the screen in your picture)
3. Make a list of those modules that have a YELLOW colored circle - these modules are probably NOT installed in the test-bench, but they have been included in the GIL
4. Make a separate list of the modules that have a WHITE, or BLACK colored circle - these modules are installed in the test-bench but are NOT included in the GIL
5. follow the steps in the pictures below to access the GIL
   
   
   
   
6. Amend the GIL according to the lists created in Step 3 & Step 4 above
7. Go back to the Control Units screen and re-check that NONE of the modules have BLACK, WHITE or YELLOW colored circles

Don

 

[Meesters]

Morning Don, again thanks for taking the time.

OBD11 tells the user the GIL status of each module. Look again at your OBD11 Control Unit screen - notice the color of the circle surrounding "16" for the Steering Column module

Well, I understand OBD11 doesn't recognise control unit 16, and normally OBD11 pops up that there is a new control unit, but it didn't, so I added it myself, hoping it would recognise it then, but sadly that didn't help.

Does this hex16 module have heated steering wheel facility? If so, the pin-out is different to your list

It is without SW heater, and was in a working condition a few weeks ago.

Also, have you actually generated a T15 Voltage rail on the test-bench - meaning a switched voltage?

Well, the switch is still on its way, so for the moment I switch by just put and pull the wire from the electric source. Is it correct that I only need T15 for the SW collumn for the moment?

And, i'm not sure if making "a bridge between pins 3, 4, 5 and 6 to simulate ignition" will work. This set-up means that the simulated ignition process happens at the same time that the power-supply to the module is energised (and probably before the T15 pin is energised). This is NOT what happens in a real car! As I said in my previous reply, my suggestion is to use a 4 x pole, single-throw switch

Well, I made some homemade switch, but it is working. I have tested it with a multimeter, and I can make, or disconnect connection between al 4 pins at once. I had an old stalk, took the wire and pcb. Connected wires to pin 3, 4, 5 and 6. So 4, 5 and 6 go to other connector, and I cut a bit of the pcb and soldered the pins together with the wire on pin 3. See picture below

So when I slide the pcb in the 3 pin connector I make contact between al 4 pins at once. I tried do it in the same order as you explained: First 12V on the bench, I wait a little and then connect T15 and after that I "ignite", but without succes.
My hunch is just now, that the problem could lie here although, since my SW collumn has only 7 pins, perhaps the pin-out is slightly different for ignition, I will dive in to it tonight.

So great thanks for your help again, let me know if you think I misunderstood something. I'll keep you updated.

Chris.

 

[Meesters]

Ok, I did some re-pinning based on images, but it didn't come alive, so I ordered the correct ignition switch at some Czech website, since it wasn't available in my country. with part number 5Q0 905 849 A. I'll wait for that before I brake something .

 

[DV52]

I connected te 20 pin connector from the steeringwheel module the following way:

pin 1: kl30
pin 2: kl31
pin 3: can low convenience (pin 5 gateway)
pin 4: can high convenience (pin 15 gateway)
pin 14: t15
pin 16: t15

Chris: I just couldn't understand why your Steering wheel module wouldn't work - so I went back to your earlier post and copied part of your reply above.

First point that I make is the Steering wheel module has a 16 x pin connector, not "20 pin connector" as stated - I assume that this is a simple unintended error!!

Second point, I don't believe that your pin #14 and pin #15 terminations are correct. I suspect that you assumed the T15 nature of these pins from the pin-out information for the Steering wheel module (J527) - which says:

• Pin #14: Onboard supply control unit -J519- , terminal 15
• Pin #16: Onboard supply control unit -J519- , terminal 15
• Pin #7: Onboard supply control unit -J519- ,terminal S

Note: I've added pin #7 for completeness, "terminal S" means the switch in 5Q0 905 849 A that changes state when the key is physically pushed into the lock-barrel (i.e. the contacts on the "terminal S" switch join together BEFORE the ignition switch is turned)

So, reference to "terminal 15" in the descriptors above does NOT mean that these pins should be connected to a T15 voltage. I'm not sure if pin #14 and pin #15 are input pins to J527, or output pins from J527 - but these pins are NOT wired to the T15 rail in a real car

This is how the 3 x pins above are OEM wired on a real car:

When I constructed my test-bench, I started with the Gateway module and J519 module. I then added J527 and I made the connections as shown in my wiring diagram above to J519.

Also, pin #14 on the Gateway module (J533) is a T15 input signal to the module

Don

 

[Meesters]

Goodmorning Don,

First point that I make is the Steering wheel module has a 16 x pin connector, not "20 pin connector" as stated - I assume that this is a simple unintended error!!

You are right, well spotted! I must have been tired when I wrote the post.. of course this the 16 pin connector.

Second point, I don't believe that your pin #14 and pin #15 terminations are correct. I suspect that you assumed the T15 nature of these pins from the pin-out information for the Steering wheel module (J527) - which says:

• Pin #14: Onboard supply control unit -J519- , terminal 15
• Pin #16: Onboard supply control unit -J519- , terminal 15
• Pin #7: Onboard supply control unit -J519- ,terminal S

Note: I've added pin #7 for completeness, "terminal S" means the switch in 5Q0 905 849 A that changes state when the key is physically pushed into the lock-barrel (i.e. the contacts on the "terminal S" switch join together BEFORE the ignition switch is turned)

So here comes my lack of knowledge around the corner, but hey learning by doing!

Thanks for your support!

Chris.

PS, I'm going to wait until the rest of the parts have arrived, and lets hope I didn't break anything because of faulty connections.

 

[Meesters]

Hi Don,

2 more questions:

Also, pin #14 on the Gateway module (J533) is a T15 input signal to the module

Do you suggest to connect gateway pin #14 to T15S rail?

If I connect the SW module the following way, normally it should be enough for the setup without BCM?

pin 1: kl30
pin 2: kl31
pin 3: can low convenience (pin 5 gateway)
pin 4: can high convenience (pin 15 gateway)
pin 7: t15s

Thanks again!

 

[DV52]

Do you suggest to connect gateway pin #14 to T15S rail?

Yes!

If I connect the SW module the following way, normally it should be enough for the setup without BCM?
pin 1: kl30
pin 2: kl31
pin 3: can low convenience (pin 5 gateway)
pin 4: can high convenience (pin 15 gateway)
pin 7: t15s

yes for pins 1, 2, 3 and 4
no to pin 7

Maybe I need to explain the nomenclature that is used in VW wiring diagrams? My apology if you are already aware of this.

Notice T73a /54 on the first wire on J519 in my diagram above. This means:

• T73 = a connector with a Total of 73 x pins
• a = The socket designated as A on the housing of J519 - see BCM picture below
• /54= pin #54

Notice that the wire that is connected to T73a /54 above terminates on T16r /7 on J527, This means:

• T16 = a connector with a Total of 16 x pins
• r = a simple designation that distinguishes this connector from many other 16 x pin connectors in the wiring diagram
• /7 = pin #7

So, pin 7 on the SW module connects to pin #54, Socket A on J519 - NOT to the T15 rail

As I said before pin #7 on the SW module tells J519 that the ignition key is inserted into the lock barrel. There are a set of contacts at the very end of the ignition switch called "Terminal S".

When the ignition key is inserted, the black center part of the switch below is pressed down to join together these Terminal S contacts. On my test-bench I connected the 2 x wires in my picture below to the Terminal S contacts and i added a simple switch as shown . So, part of my ignition switch simulation procedure is to first operate the Terminal S switch before turning the center black turret!

Don

PS: Is there any way that you can change the heading for this thread? Clearly because of our discussion "MQB platform Test Bench" would be a more accurate heading!

 

[Meesters]

Hi Don,

I'm back from a short holiday, and most of the parts have now arrived. Wednesday and Thursday is my "weekend", and I started working on it yesterday.

First of all, I would like to return to your previous post. It's not a problem at all if you tell me something I already know, I'm happy with all the information, and it can also be useful to others.

In the end I connected everything and partly according to your explanation, especially the part of the ignition switch. I also added an extra switch for T15 here. I also took a good look at the wire diagram for Golf 7.

In the end it still didn't work and only the Gateway was reachable with OBD11, so I decided to sleep over the night first. This morning I went to exercise and then I thought, what can I do. One option was to reinstall the SW module in my car to check whether it has not broken, but that is quite a lot of work, because the car now has SW heating and then I have to swap all the wires back into a different connector. . Then the idea came to test whether the BCM works. When the car is on, the DRLs should light up. And if the ignition is off and the turn signal is to the left, the left DRL should be on. When the ignition is off and the turn signal is in neutral, the DRL should be off. I tested this by connecting a multimeter to "T46b /4". And yes, success! So my theory was correct so far. The ECUs therefore responded to the ignition and T15 signal. I also started to suspect more and more that there was a problem with the CAN-BUS.

Then I started using Odis E to see if I could do more with it than with OBD11. Odis S cannot be used, probably because there is no "Moter-ECU". With Odis E I saw that a CAN-BUS error had been stored in the Gateway, stating that there was a permanent fault on the CAN-BUS network. I then turned off the "bench" and disconnected the connectors from the CAN-BUS and restarted the bench, and sure enough, after clearing the DTCs the CAN error did not return.

It now turns out that, among other things, I had bought a breakout cable for the Gateway. This cable is normally used to easily connect additional devices to the CAN BUS. Although the color codes of the wires are correct, CAN-low and CAN-high appear to be interchanged in the Gateway breakout plug. I have always used the official wire diagram when building the bench. However, when I connected the CAN wires to the Gateway, I simply connected the cables by color, but this turned out to be the wrong way around. After I switched CAN-low and -high everything came to life.

Then I connected the RVC. Here too, it eventually turned out that the 2 CAN wires from the infotainment BUS to the Gateway break out cable are the wrong way around, in terms of color codes in any case. So after I exchanged it, the RVC also came to life.

After a bit of tinkering, I immediately started with the ultimate goal, namely cracking the security login code. So I took the VCP cable, started the software and connected to the camera. Then I went to LoginFinder via security access, and that's where everything stopped . To use the LoginFinder you need a known login code, I think to reset the time-out protection every time after an incorrect code has been tried. So without a working code you can't scan for more codes, so as far as I'm concerned it's a bit useless, to be honest.

So, long story short, project not completed .

All in all, I am enjoying it again, and I will also use the bench for other purposes in the future. I'll soon be connecting all the other ECUs I have lying around, just because I can.

So thank you again DON, I was already planning to try to build a bench at some point, so that started with this one. All your information was very welcome, and without some of your explanation I certainly would not have accomplished this so quickly.

If you have any ideas or advice, I would love to hear them.

Greetings Chris.

 

[DV52]

Chris: That's fantastic news and IIRC, it's fairly close to my experience when building the first few versions of my test-bench (albeit my difficulties were entirely different)!

You have been very fortunate to encounter the problems that you describe - because they are the ideal environment for progressing your learning-curve! Your ability to diagnose the cause of the problems and to step-through the process for a solution speaks volumes about your intellect - well done, I'm impressed!!

I hope that you confront many-more similar problems in the future!

OK - I suggest that you don't abandon your original objective for building the test-bench; Login finder is a great piece of software and I can vouch from personal experience that it does work on a MQB platform test-bench!

Looking at your VCP screenshot - I suspect that the reason why Login finder isn't working is your choice of settings on the VCP dialogue-box.

I found on my test-bench that success (or otherwise) of the polling process was critically linked to how I set-up the initial conditions! UDS/ODX modules are like the fairer-sex; they can be VERY unforgiving if not treated correctly!!

This is how I set-up Login finder on my test-bench:

Try using the values shown in my screenshot - of course the "known login" will be different for the RVC module (my picture was set-up for the hex17 module). I'm not sure how to treat the ECURst check-box on your screenshot (it's not on my version of login-in finder) - I suggest that you leave it un-ticked!

This is my understanding of how these parameters work:

• Ticking Reconnect before try will force VCP to disconnect and reconnect to the module before each new polling attempt
• Reconnect delay defines the delay time between stop and start communication request. Smaller value makes the scan faster but it can also lead to connection instability. I suggest Reconnect delay =10
• Tries between recovery defines how many FAILED logins are tried between polling attempts before starting again with a completely new poll. You will know from OBD11 that attempting to enter more than 3 x wrong security codes into a UDS module will force it to lock-out for a period of time. During this module lock-out period (which requires a T15 voltage for the lock-out timer to count-down), NO further security codes will be accepted -not even a correct security code! You do NOT want Login finder to activate this module lock-out period!!
  For most (All?) the UDS modules on my test-bench, I've found that Tries between recovery =2 has worked. Occasionally the value 3 has also been successful and larger values do increase the polling speed! However, my advice is strick to the value 2 until you get Login finder to work correctly

Unfortunately, using my settings above will slow-down the polling speed. But since this is a test-bench, the added time for the complete end-to-end process ain't really a problem (just leave the test-bench activated over-night if needed). So and IMO, the decreased polling speed is well worth the resulting increased stability!

If my values don't work on the hex6C module, try using Login-finder on the BCM - because you know that the "known login" 31347 is valid. And you could also try it on the Gateway module with "known login"=20103

When Login finder is working correctly, text about the progress of the process will appear in the bottom of my screenshot (in the area which says "Finished" and "Stopped at 42081")

Don

 

[Meesters]

Good morning Don,

Thanks again for your explanation. Unfortunately, I don't think it will work for the 6C.

- The first problem is being able to change the adaptations. This is only possible in "Developer mode", this is called "Engeneer Mode" in VCP. So I specifically need working code for that. So far I don't have it yet.

- Without the correct login code, Brute Force cracking will not work in VCP. It uses the working code to reset the number of incorrect attempts just by logging in with it. This way you don't get a "time-out".

- The delay time that can be set in VCP between the number of incorrect attempts is in milliseconds. So if it's set to 1000, it will take about a second between each set of attempts. If you could set this to 10 minutes, you could theoretically perform a brute force without a known login code. That is the time it takes after exceeding the maximum number of incorrect codes entered.

- There is one known code "801129" for 6C RVC, this is standard in OBD11, but only works in "EOL mode". So the problem remains the same, you cannot adjust any adaptations in this mode. Moreover, this code also has 6 digits instead of 5. In VCP login finder you can only enter up to 5 digits.

So I tried to do some sort of "Brute Force" attempt myself. I have made a list of many well-known security login codes, for which I used your list of login codes, among others. I then tried 2 codes each time in Developer mode, then switched to EOL mode and successfully logged in with the working code. Then I went back to Developer mode to try 2 codes again. This cycle worked, and I never timed out, so I could continue indefinitely. Unfortunately it was without result.

Maybe I'm overlooking something, or I don't understand you properly, but I don't think I can get any further with VCP in this case.

Thank you again, and we won't give up.

Greetings Chris

 

[Meesters]

Hello,

[Edit] Problem solved, wiring is correct like this.

Today I tried to connect my speedometer to the bench, unfortunately without succes .

FYI, I wired the speedometer the following way:

T18

1 - T30
10 - T31 Ground
17 - Can Low convenience --> J533 T20/5
18 - Can High convenience --> J533 T20/15

When connecting the power, the needles and the small display light up for a while, but it does not respond to the ignition signal. Also module 17 is not reachable with OBD11 for example. Also I saw the immobiliser reader should be connected to t8 and t9, but since Don don't use that I figured that it is not needed.

I think BCM might be key in this story, but I don't know what I did wrong, I have it wired the following way:

T73a

1 - T30
12 - T31
14 - T15 --> J533 T20/14
16 - Can High convenience --> J533 T20/15
17 - Can Low convenience --> J533 T20/5
44 - Ignition starterswitch T15 --> J527 T16r/14
47 - Ignition starterswitch T15 --> J527 T16r/16
53 - T31
54 - Ignition starterswitch T15 --> J527 T16r/7
63 - T31
66 - T30 Right light
73 - T30 Central locking

And that looks like this

T73c

1 - T30 Left light
4 - T30
63 - T 31
73 - T30

This is all I could find, if anybody has any suggestions I'm more than happy to hear!

Great thanks, Chris.

 

[DV52]

Chris: Good to read that the module count on your test-bench is growing.

I'm not sure if it has happened yet, but at some point in the build process, you will come to think about the test-branch as if it is a young child growing as you add more modules.

Unfortunately for a test-bench, the appropriate analogy is a "belligerent" child that refuses to behave properly! Hence your experience when adding new modules - which is the exactly same as my experience in the early stages of my build!!

So, for the dashboard module (I've not previously heard the term "speedometer" used for this module) - I'm not sure why this part of the belligerent child is behaving badly!

As you have indicated by your pin-out list for the hex17 module, there aren't many connections on this module (basically +12V & earth and CAN high/low). You have confirmed that the power-supply wires are OK because the display works on power-UP. My only suggestion is that you double-check the polarity of the CAN low/high wires! And, no offense intended, but I assume that you remembered to add the new hex17 module to the GIL (Gateway Installation List) after installation

Incidentally, my test-bench does include an immobilizer reader coil - but I added this a long time after I built the test-bench - so it's not needed at all on a functioning test-bench. I also added a simulated petrol-tank to my hex17 module (it's just a simple variable resistor) - see the dial on the top of the hex17 module in my picture

OK - now for the BCM:
Adding this module is basically the same as adding any other module (power-supply wires and CAN low/high wires). However, there are a number of power-supply pins across the 3 x sockets on the BCM and care needs to be taken regarding how the T15 rail is handled on this module (it's different to other modules)!

For the power-supply connections - the BCM has 6 x T30 wires across the 3 x sockets - like this:

I don't know what circuits inside the BCM are energized by each of these connections - so my test-bench activates ALL 6 x T30 pins

Also, my test-bench earths ALL 4 x T31 pins on the BCM: T73a /12, T73a /53, T73a /63, T73c /63

I'm not sure if you are aware how the T15 voltage pins on the BCM work - but management of these pins is a tad different.

Basically, what happens when the BCM receives the "ignition-ON" CAN message from the steering-wheel module is that it activates a relay called "J329" via pin #T73a /13. J329 is the principal relay for the main T15V rail on the car.

Because T15 is such an important part of a functioning car - VW has included into the BCM a function that engineers call a "hand-shaking" wire. The sole purpose of the hand-shaking wire is to monitor whether the T15 voltage has correctly energised. This is done via BCM pin #T73a /14 (the description for this pin in the VW wiring diagram is - Terminal 15 voltage supply relay -J329-signal line)

So, my test-bench includes a simple circuit that emulates the OEM arrangement for J329 and the handshaking-wire for the BCM T15 function - like this:

Notice that the relay is energised by BCM pin #T73a /13 and the handshaking-wire on BCM pin #T73a /14 monitors the status of the T15 rail output-voltage

Again, finally - don't forget about modifying the GIL after the BCM is energised!
Don

 

[Meesters]

Hi Don,

it is working now thanks to you, and thanks to me that it didn't.

I'm not sure if it has happened yet, but at some point in the build process, you will come to think about the test-branch as if it is a young child growing as you add more modules

for me it is more like Frankensteijn or Robocop for the moment, but when I proper going to rebuild this attempt, maybe it will!

From now on I will use the term dashboard module

For a starter, I re-checkt the T30 wiring on BCM, your photo is a copy from the golf 7 wiring diagram, which I also used, but I also used some youtube video in the beginning of this project and provided myself with some incorrect information. I repinned it how it should. I will correct my earlier post so if someone copy's that, it would work.

But that was not the main issue, I also mixed up the can wires, and this time it was my own fault, I'm not sure how, but maybe it was a little lack of light in combination with my colour blindness . Rarely that it didn't interfere with the other modules on the convenience bus.

But it light up now.

Thanks again!

 

[Meesters]

I'm not sure if you are aware how the T15 voltage pins on the BCM work - but management of these pins is a tad different.

Basically, what happens when the BCM receives the "ignition-ON" CAN message from the steering-wheel module is that it activates a relay called "J329" via pin #T73a /13. J329 is the principal relay for the main T15V rail on the car.

Because T15 is such an important part of a functioning car - VW has included into the BCM a function that engineers call a "hand-shaking" wire. The sole purpose of the hand-shaking wire is to monitor whether the T15 voltage has correctly energised. This is done via BCM pin #T73a /14 (the description for this pin in the VW wiring diagram is - Terminal 15 voltage supply relay -J329-signal line)

So, my test-bench includes a simple circuit that emulates the OEM arrangement for J329 and the handshaking-wire for the BCM T15 function - like this:

Notice that the relay is energised by BCM pin #T73a /13 and the handshaking-wire on BCM pin #T73a /14 monitors the status of the T15 rail output-voltage

This is my next step, I already bought a relay. Your information made it real clear to me. Also a 4 pin relay can be used I think? Since T87a is not in use?

Thanks again!

Chris.

 

[DV52]

Hi Don,

it is working now thanks to you, and thanks to me that it didn't.

for me it is more like Frankensteijn or Robocop for the moment, but when I proper going to rebuild this attempt, maybe it will!

Well done!

I hope that your analogy about Mary Shelley's monster is misplaced! As you will know, the novel ends by Victor Frankenstein setting himself ablaze on a funeral pyre!!

Definitely NOT the outcome that you want for your test-bench !!

But that was not the main issue, I also mixed up the can wires, and this time it was my own fault, I'm not sure how, but maybe it was a little lack of light in combination with my colour blindness . Rarely that it didn't interfere with the other modules on the convenience bus.

hmm........... color blindness, affects up to 1 in 12 males who live on this blue planet - so 8% of males (and only 1 in 200 females -0.5%).

And most folk incorrectly believe that those with color-blindness can't see red/green - which is wrong in almost ALL cases!!