This document describes the reverse‑engineered CAN behavior required to emulate an Audi Concert radio on the infotainment / comfort CAN used in the Audi A3 8P. The goal is to allow a microcontroller (or whatever...) to behave like a factory radio so that the gateway and instrument cluster (FIS) accept it as a valid participant.
The Idea for this came when I made my custom pcb that sits between the Chinese MTK Headunit and my Car. My reason for doing all this work was because I wanted to control what is being sent into my car, and I also wanted to somehow make the Instrument Cluster display media data, like it did with the original Concert radio.
The info I have gathered has been mostly my own work and the work of the smart people on canhack.de, which long time ago figured out how to write into FIS (Fahrer-Informations-System).
Using the PCB I made, made it also possible to sniff the data traffic between the Concert Radio and the car and see how it behaves.
CAN ID Description Context 0x439 OSEK
heartbeat / ring communication Our Emulated
Radio 0x433 ? Steering
wheel ? / ring participant This is my
best guess on what this is... I am though not sure 0x363 Fis Line 1
Text 0x365 Fis Line 2
Text 0x661 Radio Alive /
Media State Important, or
else the FIS wont show the Lines and there will be Gateway errors
The text below has been copied from my unfinished word document...
The infotainment CAN uses an OSEK‑style heartbeat ring where ECUs periodically call the next participant in a logical chain. Each ECU references the next ECU by device ID. The last ECU references the first one, thus creating a ring.
When radio is connected. The following gets emitted from 0x439:
|
BYTE 1 |
BYTE 2 |
BYTE 3 |
BYTE 4 |
BYTE 5 |
BYTE 6 |
|
19 |
02 |
80 |
00 |
00 |
00 |
|
19 |
01 |
00 |
00 |
00 |
00 |
BYTE 1: ID of the next ECU / Own ID when Login or when error
BYTE 2: ECU Status
|
Byte (HEX) |
Explanation |
|
0x01 |
Normal operation |
|
0x02 |
Error detected |
|
0x11 |
Ready for standby |
|
0x31 |
All ECUs ready for sleep |
Note: I got the the info from canhack.de on what byte nr. 2 in the message means.
BYTE 3: Message Type
|
Byte (HEX) |
Explanation |
|
0x80 |
Login |
|
0x00 |
Normal operation |
In order to
Emulate Concert radio, the mcu muss send Alive / Sleep messages on 0x661 every
300 ms in order for the gateway to be happy.
This is where the things get a bit weird... (Note for me: The A0, A3 thingy)
To be finished...
This project is independent and not affiliated with Audi AG.
Impressum
Instagram
Twitter
Github
Email
Toggle Dark Mode