Joined
Last Online
Recent Posts
posted in Howto read more

I've read that the Skoda is pretty similar to the Audi/VW, so I'd expect it to have 3 separate canbus's too: comfort, infotainment, and engine. The speed and rpm are on the engine canbus, and I believe the speed is also available on infotainment canbus for the nav to read. Since you're on the comfort bus, you likely don't have the data you're looking for. I tapped into the comfort and infotainment buses behind the instrument cluster, which was pretty easy. I followed this pinout on my B7 A4: http://www.audizine.com/forum/showthread.php/486720-RB4-Cluster-connection-pinout?p=7611852&viewfull=1#post7611852.

posted in Howto read more

I have a few more traces that I wanted some help understanding.

When the ignition is turned on, but the radio fuse is pulled, I only see ID 0x428 sending the same payload indefinitely:
<pre><code>ID Len Payload
428 6 08 02 80 00 00 00</code></pre>

When is the ignition is turned on (knowing that the radio would turn on too), I see this (filtered for only items in the 0x420-0x4A0 range, up to the first 0x261 message):
<pre><code>ID Len Payload
428 6 08 02 80 00 00 00 (repeated many times, but truncated here)
428 6 08 01 00 00 00 00
436 6 16 02 80 00 00 00
436 6 16 01 00 00 00 00
428 6 08 02 00 00 00 00
428 6 08 01 00 00 00 00
436 6 08 01 00 00 00 00
428 6 16 01 00 00 00 00
436 6 08 01 00 00 00 00
428 6 16 01 00 00 00 00
261 8 20 20 20 20 20 20 20 20
436 6 08 01 00 00 00 00
428 6 16 01 00 00 00 00
436 6 08 01 00 00 00 00
428 6 16 01 00 00 00 00
261 8 39 39 2E 35 00 20 20 20</code></pre>

Why are there multiple 0x436 being sent, and with different payloads? Looks like the radio continually sends 0x436 with payload '08 01 00 00 00 00' indefinitely.

If I then remove the radio fuse, and with the CBT, send the 0x436 ID with payload '08 01 00 00 00 00', I'm still unable to see any of my custom messages on the DIS. For some reason, if I send the message with 6 bytes (0202043608010000000006), the CBT seems to hang...it works if I pad two more bytes of 00 and change the length to 8 (02020436080100000000000008). Maybe I need to code this into firmware instead of just sending the 0x436 and 0x261 from the serial port because the car's expecting these at a much faster rate?

posted in Howto read more

Yes, I see the 0x436 and 0x428 IDs, along with a few 0x661 keep-alives. Here's a trace that I captured from the moment the ignition was turned on, until the RNS-E started sending 0x261 and 0x263.

<pre><code>436 16 02 C0 01 00 00 00 00
436 16 02 C0 01 00 00 00 00
436 16 02 C0 01 00 00 00 00
436 16 02 C0 01 00 00 00 00
436 16 02 C0 01 00 00 00 00
436 16 02 C0 01 00 00 00 00
436 16 02 C0 01 00 00 00 00
436 16 02 C0 01 00 00 00 00
436 16 02 C0 01 00 00 00 00
60E C5 00 00 00 00 00 00 00
351 45 01 00 21 1B 75 8F 18 speed
623 00 12 29 46 15 04 20 15 time
653 02 02 04 00 00 00 00 00
436 08 01 00 00 00 00 00 00
428 16 01 00 00 00 00 00 00
604 00 00 00 00 00 00 00 00
661 00 01 12 00 00 00 00 00 audio source
351 45 01 00 21 1B 75 8F 18 speed
353 0F C7 0B C0 7E 22 09 00
436 08 01 00 00 00 00 00 00
625 DB B3 CF 6A 39 00 00 00
428 16 01 00 00 00 00 00 00
604 81 00 00 00 00 00 00 00
661 81 01 12 A0 00 00 00 00 audio source
351 45 01 00 21 1B 75 8F 18 speed
662 00 00 00 00 00 00 00 00
42F 16 01 00 00 00 00 00 00
42F 0F 02 80 00 00 00 00 00
6D1 A1 0F 8A FF 4A FF 00 00
6D0 10 C5 22 10 00 00 00 00
6D1 B1 00 00 00 00 00 00 00
436 08 01 00 00 00 00 00 00
42F 16 01 00 00 00 00 00 00
6D1 20 C6 3C F0 00 2A 20 41
6D1 11 56 58 20 2A 20 00 00
635 00 00 01 00 00 00 00 00 light state
261 20 20 20 20 20 20 20 20 DIS line 1
263 20 20 20 20 20 20 20 20 DIS line 2</code></pre>

So it sounds like the DIS ring has a hierarchy, with the radio station information being lowest priority, maybe bluetooth caller ID or navigation being the next higher priority, and highest priority being things like light bulb or battery low warnings. Instead of doing the man-in-the-middle to filter out the radio station DIS information from the RNS-E, I could probably spoof a bluetooth message using ID 0x265/0x267 because I don't have a bluetooth module--just need to know what the "ring" request from the OEM bluetooth is. Does anyone know?

posted in Howto read more

Do you know how to join the "ring"? That'll be useful if I ever replace the RNSE with an aftermarket radio. My ultimate goal is to display the boost pressure instead of the radio information.

posted in Howto read more

I have an Audi A4 (B7). I've been able to successfully sniff out the DIS messages from my RNS-E using the same method that @jamesatfish wrote up at http://forum.canb.us/discussion/91/identifying-steering-wheel-button-packets-an-example (excellent write up!).

I can successfully send a message to the DIS by using the CBT command 02020261484579205345787908. I see the message for a split second before the RNS-E overwrites it by sending a new command ID 0x0261 with the radio station that's currently selected, but at least I know my setup is working.

If the RNS-E is off and I send my same message using the CBT, nothing is displayed on the DIS. Is there a command that the RNS-E is sending to the DIS to "enable" radio messages? Through all my bus sniffing, I haven't been able to find anything specific.


Looks like your connection to CANBus Triple was lost, please wait while we try to reconnect.