VAG Gateway (J533) **0907530 conversation to “Extended CAN data bus”

VAG Gateway (J533) **0907530 conversation to “Extended CAN data bus” (it’s a copy version of write-up by rubik, and something new updated by Laura)

I am working on following Project and looking for some more experience users feedback.

SUBJECT: Audi A4/B8 or A5/Q5 CAN Gateway (J533)- Gateway conversation to “Extended CAN data bus”.
GOAL: to be able to convert VAG Gateway to support Extended CAN data bus – so drive support retrofits requiring Gateway swap can be done by addition of few extra component on PCB.

Short Introduction in regards to VAG CAN buses.

When you connect to the diagnostic port of an VAG vehicle you don’t actually communicate with each control module directly, you communicate with the Gateway which is communicating with the modules on various networks: CAN, LIN, MOST and Flexray. There are also different CAN networks too, such as: Drivetrain CAN, Convenience CAN, Comfort CAN, Extended CAN, Discrete CAN, just to name a few. There are also high and low speed CAN (not to be confused with CAN high and CAN low) referring to the data transfer speeds. When two control module on different networks need to share data they communicate through the gateway. In some cases control modules communicate on more than one network, ex. ABS module communicates on Flexray and Powertrain CAN (very dependent on year and model).

“Extended CAN data bus ” – is separated high speed CAN bus design especially to support following Drive Support Systems:

• High Beam Assist (HBA); 8N7; automatically adjusts headlights from high-beam to dipped-beam when another vehicle is approaching
• Side Assist / Line Change 7Y1; Audi side assist. Aids the driver when changing lane. Audi side assist monitors the area behind your car, using radar sensors located discreetly in the rear bumper, informing the driver with a visual warning signal in the door mirror if there is a vehicle in the driver’s blind spot or approaching quickly from behind.
• Line Assist / Line Departure; 7Y2; Audi lane assist helps the driver to stay in lane alerting them if they move off.
• Adaptive Cruise Control (ACC); 8T4; Audi adaptive cruise control. Automatic distance regulation, using radar sensors to maintain required distance by braking and accelerating.

All mentioned above systems (main control modules) are connected to Extended CAN data bus

VAG/Audi/VW/Skoda Gateways comes in two flavors:
– CAN – regular twisted wire CAN bus
– MOST – (containing optical port) and regular twisted wire CAN bus

Both CAN and MOST Gateway modules come with extra Extended CAN data bus represented as different index “X” on the VAG part number module and can by recognize in ETKA if a module supports any of the systems.

As an example, Audi A4/B8, A5, Q5:

Part No SW: 8T0 907 468 J; CAN SW index ”J” represents module supporting CAN HIGH bus
Part No SW: 8T0 907 468 N; CAN SW index ”N” represents module supporting CAN HIGH bus
Part No SW: 8T0 907 468 AB HW: 8T0 907 468 H; CAN SW index ”AB” represents module NOT supporting CAN HIGH bus
Part No SW: 8T0 907 468 AC HW: 8T0 907 468 J; CAN SW index ”AC” represents module supporting CAN HIGH bus

Part No SW: 8T0 907 468 F; MOST SW index ”F” represents module NOT supporting CAN HIGH bus
Part No SW: 8T0 907 468 G; MOST SW index ”G” represents module supporting CAN HIGH bus
Part No SW: 8T0 907 468 L; MOST SW index ”L” represents module supporting CAN HIGH bus
Part No SW: 8T0 907 468 Q; MOST SW index ”Q” represents module supporting CAN HIGH bus

In case of any Drive Support System retrofit, Gateway module need to be replaced with module supporting Extended CAN data bus unless a car is already equipped with one of the mentioned Drive Support System (HBA, Side Assist, Line Assist, ACC).

Car with any of Drive Support Systems must already be equipped with Gateway module with Extended CAN data bus

Extended CAN data bus is physically located on PIN-7 and PIN-17 on Gateway 20 PIN connector 8E0972420.

As I was retrofitting my A4/B8 with all Drive Support systems I had to change my CAN Gateway (J533) from 8T0907468AB (not supporting Extended CAN data bus) to 8T0907468AC.

The new module I purchased had exactly the same SW and HW version:
H06 – Hardware version
0117 – Software version (can now be updated to latest SW revision 0120 (flash file 8T0907468___0120.sgo)

Original:
Address 19: CAN Gateway (J533) Labels: 8T0-907-468.clb
Part No SW: 8T0 907 468 AB HW: 8T0 907 468 H
Component: GW-BEM 5CAN H06 0117
Revision: GB800053 Serial number: xxxxxxxxxxxxxxxx
Coding: 00C303
Shop #: WSC xxxxxxxxxxxxx
VCID: xxxxxxxxxxxxxxxxxx

New:
Address 19: CAN Gateway (J533) Labels: 8T0-907-468.clb
Part No SW: 8T0 907 468 AC HW: 8T0 907 468 J
Component: GW-BEM 6CAN H06 0117
Revision: HB800053 Serial number: xxxxxxxxxxxxx
Coding: 00C303
Shop #: WSC xxxxxxxxxxx
VCID: xxxxxxxxxxxxxxxxxx

Gateway was replaced, coded and Component Protection removed at Audi shop then I could successfully complete my retrofits.

Before the Gateway swap I did documented HW PCB of both units for further study and find out that PCB of both modules are the same (as per HW revision) only few components are missing when comparing both Standard and Extended CAN data bus.

8T0 907 468 AB (selected EEPROM yellow)

8T0 907 468 AC Extended CAN (selected EEPROM yellow)

I decided to take a challenge and solder missing components on my original Gateway. I already successfully done similar conversion for Audi Instrument cluster ACC retrofit; see the blog: http://www.audi4ever.com/v2/blog/details…index.html

Module comparison analysis:
=================
*** Gateway Original; CAN; 8T0907468AB; SW (H); from 07-02-2011 ***

D70F3433(A); NEC 16-bit Microcontroller
Atmel ATA6662 LIN Transceiver
TLE6250G – Infineon Technologies AG – CAN-Transceiver
TJA1041AT High-speed CAN transceiver with standby and sleep mode
TJA1055T/c Enhanced fault-tolerant CAN transceiver
ATMEL102; 25640AN; S027 – SPI Serial EEPROMs
T6020AM – Low-Current Microcontroller for Watchdog
***NOTE missing: TLE6250G and – EPCOS; C104; 0046; 86 – in regard to “AC” version

*** Gateway Full; CAN; 8T0907468AC; SW (J); from 24-03-2010 ***

D70F3433(A); NEC; 16-bit Microcontroller
Atmel ATA6662 LIN Transceiver
TLE6250G – Infineon; TLE6250 High Speed CAN-Transceiver
TJA1041AT High-speed CAN transceiver with standby and sleep mode
TJA1055T/c Enhanced fault-tolerant CAN transceiver
ATMEL008; 25640AN; S027 – – SPI Serial EEPROMs; (AT25640)
T6020AM – Low-Current Microcontroller for Watchdog
=================

See the list of missing components compering to Extended CAN data bus module:

TLE6250G x1 Infineon Technologies AG – CAN-Transceiver
EPCOS; C104; 0046; 86 x1 galvanic isolation on the CAN
Resistor 33 ohm x2
Resistor 1301 ohm x2 (blue)
Micro capacitor ?? x1
Micro capacitor ?? x1
Micro capacitor ?? x1

Base on given component list looks like there is missing single CAN Transceiver dedicated for Extended CAN data bus and several resistors and capacitors missing plus EPCOS looking like galvanic isolation on the CAN. PCB is fully ready to accommodate missing components.

I guess that Extended CAN is disabled on HW level and software should support once missing component are installed. Let test it?

In addition I decided to clone an ATMAL EPROM, ATMEL102; 25640AN; S027 from my running Gateway “AC” to the old one “AB” so I should have pretty the same setup/config (except data stored on NEC Microcontroller).

I am aware that Component Protection data are stored as well on D70F3433(A); 16-bit Microcontroller but my aim was to see if Extended CAN data bus and all connected modules will start to communicate even if Component Protection fault is raised. If basic Gateway is correctly converted Extended CAN data bus should come up and modus connected to it should be reachable.

(donor module: for missing components: Gateway Passat B6; CAN; 3C0 907 530 C; HW 3C0 907 951 A; from 13-04-2006)

RESAULTS:
After Gateway swap from current SW: 8T0 907 468 AC/ HW: 8T0 907 468 J; GW-BEM 6CAN H06 0117 to SW: 8T0 907 468 AB/ HW: 8T0 907 468 H GW-BEM 5CAN H06 0117 fitted with all missing components and EEPROM clone:

– Extended CAN data bus on PIN-7 and PIN-17 is not working. Converted Gateway module does not communicate with modules hooked on Extended CAN data bus.
– I can successfully communicate with all modules using VCDS interface except modules on Extended CAN data bus.
– Component Protection is not present anywhere!
– I can switch Ignition and engine ON.
– After fault code clean up I am always left with proper fault codes in relation to Declared modules on Extended CAN (01-Engine complains of missing 13: Auto Dist. Reg (ACC) operating on Extended CAN; 09: Cent. Elect. (J519) complains on missing 20: High Beam Assist, and so on …..
– There is single alarm on 56: Radio (J503); SW: 8T1 035 186 P; Component: Concert3; I am not able to clear, but the radio fully function as far as I was able to test.
03157 – Functionality limited due to Communications Disruption

VCDS Log after component addition and EEPROM clone (yellow color shows differences)

9

CONCLUSIONS:
My conclusions are not as expected but at least I learned that EEPROM clone “suppressed” Component Protection fault.
I know that CP is not permanently fixed but somehow got suppressed by EEPROM clone. I did not run extended tests to confirm full functionality after EEPROM clone.

I am pretty sure that hardware wise lower version of the Gateway module should work well with extra added components.
As we can see in my case SW revisions are the same on both modules 0117 (not a problem also to flash both to latest SW revision).

It brings to conclusion that the same SW is loaded on both types of modules the only difference I still believe is to be on HW level (missing components to Extended CAN data bus).

But it seems there is some SW/flag check performed against virtual memory available on D70F3433 Microcontroller where HW capabilities are stored and that would be pretty difficult for me to sort out.

Maybe there is some config/flag which requiring change (Basic/Extended Gateway) but it must be on NEC Microcontroller as EEPROM chip did not fix it.

Before I took up the challenge to play with my CAN Gateway I also had a chance to look on MOST Gateway PCBs I came to the same conclusion, see pictures below:

Gateway 8T0907468F MOST CAN basic (selected EEPROM yellow)

Gateway 8T0907468G MOST with Extended CAN data bus

Anyone who could provide a feedback and contribute to my Project is welcome.

I know of AVID/FVDI/Abrites tolls features but Component Protection is not a topic of the Project!
Unfortunately I do not have advanced programmer to read/write NEC Microcontroller.

Can I take advantage of VAS5054A head unit?

As mention on the beginning GOAL: is to be able to convert VAG Gateways to support Extended CAN data bus – so retrofits requiring Gateway swap can be done by addition of few extra component on PCB from different VAG Gateway donors.

EDIT:
… after extra research…I know a lot of tool for VAG CS:

NEC / Renesas V850 series Programmer

Autologic

Vas Pc GeKo online (cracked for one year)

Abritus Avdi original

VVDI2 from X-Horse

FVDI 2018 from Fly

Autel IM608 (was IM600)

Tips and guides from digital-kaos.co.uk:

NEC / Renesas V850 series Programmer

it looks NEC / Renesas V850 series Programmer is required (e.g. CarProTool) to read/write flash memory attached to the V850 Fetch Bus (VFB) interface of the V850E CPU core of D70F3433(A) 32-bit Single-Chip Microcontroller.

Seems data related to Gateway version and capabilities are stored on Microcontroller and the only way to enable hardware features are through microcontroller programming…

1.Smok xcan+keymaker or Xhorse VVDI

When you will tool which is fastest and you have maximum control of what you do then choose Smok xcan+keymaker(dash immo probably wider then AVDI).

When you will something what is good but not excellent with wider coverage(passat, a6/q7) then choose VVDI2.

2.AVDI and X-dash

Depend what you asking for about CS. If you want it for AUDi Component Security adaptation for all modules, then AVDi is only one I would trust.

If you want to do keys then X-dash from SMOK is best bet for all cars with metal blade key up to 2014 , except Kessy, Example Golf 5 and 6 and etc.

3.Autologic or VAS with GeKo

AVDI not best for this, only Autologic or VAS with GeKo has good coverage. AVDI is ok but only supports some modules.

4.VAS PC

I think older models can do it with clone Avdi / abrites etc…..but if you want to make all years/devices perhaps you should really pay much more money.

Vas Pc online cracked seems a very good option …

Seems better of all and perhaps gives you the highest coverage. (but not reverse enginerring options mileage etc….)

5.VAG Geko

VAG Geko cracked is unreliable, used it to update an ecu…… no file available on server (not vag’s server) plugged in genuine ODIS and flash completed in 5 minutes

VAG Geko Official is not expensive if you do your sums beforehand but can be limited for some jobs if others have been altering things on car (i.e. if a key has been added and data was altered then when changing any security related components will result in a fail from FAZIT server) as dealers have no idea what has been tampered with a new identitiy is recommended.

AVDI Genuine is probably one of the best options along with genuine vag geko…. that should get most jobs done.

6.Autel IM608

VW or Audi component protection is mentioned when describing IM600 (now IM608)

Tips and guides from real pros:

I think ODIS COMPONENT PROTECTION is your best option.

That is, you can enable or disable component protection with any tool working perfectly with ODIS software. As for personal use, we are not taking about things are the genuine or copy, but looking for the most cost-effective and working way to do something and save a lot. ODIS crack but tested version should work but you have to buy the online account (user name and password) yourself. Also, vendors will advise tool confirmed to work with ODIS crack they have, usually VXDIAG VCX ODIS, VAS5054A, VAS 6154 and the like.

Component protection is a VW Audi Group database. It tracks each individual electronic component, and which vehicle it is allocated to.

Essentially, component protection acts like an electronic padlock, tethering components to your vehicle. If we need to undertake any coding, adaptions, or basic settings of a component we need to release its padlock. That’s where ODIS comes in.

It tracks components right from the production line, but also applies to any parts purchased and fitted at a later date. For example, if you require a new control module it will need to be coded to your car using ODIS, through our licensed connection to the VW Group servers in Germany. Without component protection many, if not all, of a component’s functionality will be limited.

Component protection also helps to eliminate vehicle or component theft. If a theft is reported VW Audi Group’s component protection database updates and raises a red flag to prevent those components from being coded to another vehicle. ODIS will detect the red flag, prevent us from performing the coding and alert VW Audi Group. This is especially useful for second hand parts, making sure they are sourced only through reputable outlets.