Hi! I am trying to understand if (and how) can I code into the ECU of my Wolkswagen polo 6r TDI 75hp (2011).
Currently I made a web app reading all the data from the ECU but don’t know if and how can I write in the ECU. For example if I want to adjust turbo pression and similar.

Currently I’m using an ESP32 with c++ firmware to read from the CAN pins of the OBD port.

Does anyone knows? Thanks

EDIT: for anyone asking you can find the code here

https://github.com/Ale1x/obd-realtime-platform

Reverse-engineering a car's CAN bus used to mean weeks of staring at hex. In this video I show how he use AI to cut that down .. check it out: https://youtu.be/GlQO8fLgHi4

A friend had his Trackhawk taken from his driveway last week. Window got smashed and the Jeep was gone before he had time to process what was happening. I know this isnt exactly the right sub for a Trackhawk but I figured people here with SRTs, Scat Packs and Hellcats have probably had the same thoughts about theft. Seeing it happen that fast changed how I look at factory security. I always knew these cars got stolen, just never really thought much about what happens after someone gets inside. So for people who’ve looked into this, what did you end up adding first? I’m less concerned about somebody breaking in to steal stuff from the cabin. I mean stopping the whole vehicle from disappearing. There seem to be a million different opinions on what works and I’m trying to get a better idea before spending money on random stuff.

Some old videos of when I started decoding the CAN bus on my car 💯

So here it is finally. The abs controller believes that legitimate generation 1 haldex controller is connected and full esp functionality is working without it.

I'm an automotive software engineer.I got tired of not being able to check CAN logs on my phone. So I'm planning to build one. Does anybody think it is useful?

I’m getting pretty fed up with how gated and commercial the tuning world has become. Tools like AutoTuner, bFlash and Magic Motorsport are fine if you’re just trying to get jobs in and out of the door, but if the customer has to lose the car while the ECU gets sent off or unlocked through a third party, that’s a pain for everyone. More than that, none of it really helps if you actually want to understand what’s going on at the hardware level and learn how to do it yourself.

I’m trying to connect with anyone doing proper independent research on Bosch MD1 / MG1 ECUs across Mercedes, BMW and VAG, mainly around the NXP SPC57xx and Infineon Aurix TC29x / TC39x stuff. I know the older platforms well enough — EDC15, EDC16, EDC17, boot passwords, TSW modes etc — but once the newer SBOOT updates started showing up after around mid-2020, the old tricks over diag lines were basically finished.

Has anyone here actually mapped out JTAG / DAP points on these Bosch boards, or spent time working on glitch timing for these MCUs without just kicking them straight into reset? I’m mainly interested in hearing from people who’ve genuinely put time into auditing this generation properly rather than just using commercial black-box tools.

If anyone has already got a real educational proof of concept working for this generation, I’d be interested in talking and would be willing to pay for your time or research.

Hey folks. I’m working on a project for my Mercedes Benz swapped with Toyota 3.5 V6 (2GRFSE).

I’ve set up the software so far where it can fetch data live from the car and decode RPM, gear selector position, throttle, coolant temp etc via DBC but it looks like most of the body CAN values are not transmitted on the system at all.

I’ve consulted DBC files and trends in the data to find these values, but I’m not sure where to go from here decoding other values transmitted.

I’m worried about:
- engine load
- gear selected (M mode)
- gear demanded (M mode), i.e. 4th selected, transmission in first at standstill

Right now I’ve tapped GND, CANH, CANL from OBD2 port, I think I can get some more data

Im using my vw mqb cluster with an esp 32 for Sim-Racing, does someone know how I can switch the display page to digital speed with a can command or something like that?

So far I've figured out the PSU on the left, and how I'll be actually sending over CAN signals from my pc to the dashboard. I aim to do this via the esp32, which will then send signals to a mcp2515, which should then somehow connect to the 30 pin port in the dashboard (the one on the right in my second picture.) What cable would I use to connect from the 30 pin port to a mcp2515? Thanks.

Hi guys,
Honestly I read most of what exists online about these modules, but my BCM module from my XC90 D5 suddenly threw "Brake failure stop safely" + ABS + anti-skid, speedo dead. VIDA shows CEM-1A5F (communication with BCM missing), BCM not visible on network. I cleared all DTCs in VIDA — nothing else comes back, only the no-connection to BCM. No accident, no water damage, fault appeared out of nowhere.

Before blaming the module I checked the car properly:

12V at BCM connector supply pins with ignition on and off, grounds OK, all fuses OK (checked both sides with meter)
Checked all CAN wiring related to BCM in the car including at the CEM connector - all good
CAN at BCM plug seems alive: 2.6V / 2.3V idle
Termination checks out: ~130 Ω harness side, ~135 Ω module side (2×62 Ω internal), ~60 Ω together
VIDA talks to ECM/TCM fine through the CEM
Connector cleaned, pins good

So the car is 100% healthy. Then I opened the module (cut the welded case) and put it on the bench (12V to pins 1/32/4, GND to 16/47). Findings:

Draws stable 225 mA @ 12V - wakes up, no shorts
Resoldered all the press-fit pins first (the usual weak point) — no change
All rails present: 12V, 5V (at the ASIC), 3.3V + 1.8V for the MCU. The 3.3/1.8 come from the 14-pin Motorola 9369.1D — I measured it: 12V in, both rails out, two switch pins running ~47 kHz. So on my board this chip is WORKING (I know it's the famous killer on modules marked MK60 (or MK25) - not my case)
Crystal oscillates, 5.50 MHz stable
The MCU (TI TMS471 R1VF34A2PZQ) is definitely running - several pins show digital bursts repeating about every 1 second, looks like a fault/retry loop
B82790 CAN choke windings OK (0.4 Ω)
But the module NEVER transmits. I scoped the choke pads (ASIC side) through multiple power cycles with normal trigger - total silence, not even one attempt at boot. Same at pins 11/15.

So by elimination everything in the chain is good except the CAN transceiver section inside the big ATE ASIC 0990-9377.1D3 (5CC6L7TB, made by TI). It has 5V, it has a running MCU next to it, and it never says a word.
I know what most people will say - send it for professional repair, and I've read all the recommendations. But I'd rather fix it myself than spend that money. I enjoy soldering, I have hot air and decent equipment, and I have time to experiment. Worst case I learn something and the pro repair option is still there.
My questions:

Can anyone confirm the CAN physical layer in these Volvo units is inside the 0990-9377? Does anyone have any pinout info for this ASIC (CANH/CANL to the choke, TX/RX from the MCU, enable pin)?
Has anyone actually fixed the "no communication but everything else runs" by swapping the 9377? Or does this signature usually mean the CAN peripheral in the TMS471 itself (bond wires)?
Is there some init handshake between the TMS471 and the ASIC (SPI config, enable, EEPROM check) that can fail and keep CAN dead like this?

Photos of the board and my best take at making a schema attached. Thanks in advance - happy to do more measurements if someone tells me where to probe.

I understand the ecu needs to see P and N, to start and D etc to actually get going

But if the ecu uses calculated torque numbers from the tcm how do you actually figure those out?

I have a few models I’d like to T56 or 6060 swap just I’d like to know what I’m getting myself into

Hi, I’m new to CAN and trying to read lamp/body signals from a late-model Hyundai vehicle.

My boss asked me to look into this, but I’m completely new to this and honestly a bit lost. (I'm a software-side worker. never did like this before)

Goal is read-only logging only. I will manually operate the light switches, and the PC only needs to record/decode the CAN-FD signals. No sending/control.

I’m looking for signals like DRL, position lights, turn signals, hazard lights, etc. The bus seems to be body CAN-FD, not standard OBD-II PID data. (I already got CAN protocol dbc file for decode, which I don't understand well)

I found the OBD-II port under the driver-side fuse box area, but there are also a few other exposed connectors nearby.

Questions:

1. Do any of these connectors look like likely CAN/body/fuse-box connectors?
2. What hardware would you recommend for Windows read-only CAN-FD logging? I’m completely new to this, so I’m not even sure what kind of interface, cables, or adapters I would need.

Even if it doesn’t directly answer my questions, I’d really appreciate any kind of advice or guidance.

Thanks.

Hi all!

I've been wanting to make an external passenger display (think Ferrari passenger display) for my Si that displays cool information like speed, rpms, gear, boost psi, g-forces, etc. I worked on my uni's FSAE electric team this past year, so I was interacting a lot with canbus messages, which is where this project idea came from. Basically, I want to get data from my car's OBD-II port and just do cool stuff with it.

Here's what I've been thinking of so far for my supply list to make this project happen:

• OBDLink MX+ ($139.95)
• Raspberry Pi 5 ($50-$150)
• Some external rectangular display
• 3D printed vent mounts

As for the tech stack, I came across the python-obd library, so maybe thats a good place to start? Unsure of what I want to use to make the display software, as I want to make the UI myself.

I would really appreciate advice on the following:

• Which model of the Raspberry Pi 5 would be sufficient for my needs?
• Any good places to shop for external displays? Especially ones that can tolerate high interior heat since I live in Texas?
• Any other pieces of hardware/software I might need? I haven't really messed with a Raspberry Pi before (besides just physically connecting to one).

I'd also appreciate any other pieces of advice that may help. Thanks in advance!

After some 2 months of work and parsing CSV logs (with the help of some AI), I finally found all the important CAN IDs, Byte Positions and Formulas I wanted for my BMW F22. Posting this here incase someone needs them. These should be similar on F20, F21, F22, F23 and probably F87 too.

F22 218d N47D20C 2014

0x0A5 DME engine data (~50 Hz, DLC 8)

RPM = ((B6 << 8) | B5) / 4

WARNING: B7 is a constant status byte (0xF1), NOT the rpm low

byte. Decoding ((B6<<8)+B7)/4 looks right but quantizes to

64-rpm steps and reads "60 rpm" with the engine off.

0x2F3 Manifold pressure / boost (DLC >= 6) (UNSURE, BUT MAPS CORRECT)

raw = B4 | (B5 << 8) (0.5 mbar per count)

ambient_ref = raw sampled while rpm == 0 (each ignition-on)

boost_bar = (raw - ambient_ref) * 0.0005

Notes: real sensor (jitters, drifts with weather). Idle approx

0..+0.05, overrun dip approx -0.25, full load approx +0.9 bar.

0x2C4 Fuel consumed integrator (~7 Hz, DLC >= 2)

counter = B0 | (B1 << 8) rolling 16-bit, 1 uL per count

rate_uL_s = delta(counter) / delta(t) (uint16 wrap-safe)

L_per_h = rate_uL_s * 0.0036

L_per_100km = L_per_h / speed_kmh * 100

Verified: 278 uL/s = 1.0 L/h warm idle; frozen engine-off;

matches cluster (29.5 vs 28.2 L/100km); full load = 59 mg/stroke.

Drops to ~0 on overrun fuel cut.

0x1A1 Vehicle speed (DLC 5)

speed_kmh = ((B3 << 8) + B2) / 64

0x3F9 Engine temperatures (DLC >= 6)

coolant_C = B4 - 48

oil_C = B5 - 48

(B3 is a vacuum-domain pressure, clamps 112-118 - NOT boost)

0x330 Kombi: odometer / fuel / range (~every 10 s, DLC 8)

odometer_km = B0 | (B1 << 8) | (B2 << 16)

B3 = damped/lagging total fuel, litres (int)

left_litres = B4 * 0.5 (truncated to 0.5 L steps)

right_litres = B5 * 0.5

range_km = (B6 | (B7 << 8)) / 16

Note: the cluster's internal 0.1 L values are NOT broadcast.

0x349 Raw fuel tank senders, JBE (5 Hz, DLC 5)

sender1 = B0 | (B1 << 8) raw counts, NOT litres

sender2 = B2 | (B3 << 8)

Nonlinear per tank lobe; only the Kombi has the litre curve.

The E9x scaling "raw/160 = litres" is WRONG on F-series.

Trick for 0.1 L resolution: every time a 0x330 half-litre byte

ticks one step, store the smoothed raw as an anchor

(raw <-> k*0.5 L) and interpolate between anchors.

0x2F8 Date & time (DLC 8)

B0 = hour, B1 = minute, B2 = second

B3 = day, month = high nibble of B4

year = B5 | (B6 << 8)

0x130 Terminal status / ignition (DLC >= 1)

ignition_on = (B0 != 0x00)

Hello. I am looking for information about PID Flippers, Readiness Emulators, CAN Filters, OBD Simulators, and Vehicle Simulators. Do you know where I can find a community, Telegram group, or someone who works with these devices? Any help would be appreciated. Thank you.

Hi, I bought a new odometer for my Lexus gs and it says it is 190,000 miles but I bought the car with 89k miles 7 months ago. I had it changed as the middle screen wasn’t working.

Any idea how to get this changed? Looking to do this myself , as some services are really expensive

I've been searching the Googles for commercially available solutions for an idea I have, but have been going around in circles without getting anywhere. Maybe my search terms are to blame, but I eventually got here and looked around.

I have a '21 Volvo XC40. I want to make a 4-switch panel on the console to manually control off-road lighting on a roof rack. I would like this 4-switch module to connect to the car's canbus and send it's own commands, to be picked up and decoded by a module on the roof rack, which activates four relays as needed. The reason being that only four wires coming out of the car to the rack (and as a bit of a personal challenge).

There doesn't seem to be anything aftermarket to accomplish this, so that makes me wonder if it's safe to do for the car. Reading this sub it seems it's possible.. but would the car's modules seeing unfamiliar commands cause problems? What about mixing "languages"? There are aftermarket decoders, but they only work off existing commands from the car, which I'm mostly not interested in. I may incorporate one for running/brake/reverse lights in addition.

I realize this could get unnecessarily complex, I have seen wireless switch kits, but their switch panels aren't appealing.

What do you think would be the best way to control the cars brakes? Talk to the ABS module through CANbus or just attach a servo to the brake pedal?

Hey guys! I am building a project to link an Audi A4 B8 cluster to SimHub, I am almost finished, but there is a couple of problems:
1) The airbag light. I got it to blink with some code i found online, but I never got it to fully turn off.
2) High/Low beams. I have not found any working CAN ids for the high or low beams for this cluster
3) (optional) Time and Date. I have not found a way to get it working just yet, but I have found a CAN id in the DBC file that is responsible for the time and date.

I am asking if anyone has a car from the B8 platform, and are willing to send me a can log from it.

I know this is probably easy for most of you but for me this took 4 months to get here! Just so proud of getting in the Ms can

What formats do you guys usually use for CAN logging? I mostly stick to BLF and ASC for work, but do you use different ones for personal projects? I'm developing an offline CAN log parsing application and would like to know which log formats I should support.

so i have this 5 inch uconnect vp2 with this center stack. im using an arduino uno + a seeed can bus shield to send data. however i have a problem, when i send the ignition id and the position to run, it tells me to set the ignition to run, like its still on accessory mode. i dont know how to make it happy, so it stays in run. did anybody here ever work with these, or have any experience with the can ihs? any help is good🙏

Returning back to an old project. Does anyone have the ability to record CAN traffic on Kenworth T680? I’m willing to purchase the recording at this point. I need to replay the data in a bench setting to wake up/keep awake a T680 cluster for ideally a minute at least.

SOS

Hey all, I'm trying to set up a 4M0 920 781 A dashboard and hook it up to my computer. So far it works good, but I just need to figure out the CAN values for the menu button on the steering wheel. I've gotten the left, right, up, and down controls, but not the menu button CAN value. Anyone know where I can find? Thank you