Rabbit ECU project has a new test car! After a 18 months of testing and daily driving the VE Commodore SS L98 engine project, it seemed like a good time to move on to a more high-tech platform.

The new test car is a VW GTI Mk6 with EA888 engine.

The EA888 family is an Audi-designed unit that features some of the latest engine technology such as direct fuel injection, variable valve timing and lift for intake and exhaust valves, distributorless coil-on-plug ignition and fly-by-wire throttle. Being a VW car, it is very often mated with a DSG electronically controlled gearbox.

The EA888 is the first GDI engine to be tested with the Rabbit ECU, and required the creation of some additional hardware to be able to hack the CAN bus that controls the DSG, and also add high voltage support for the injectors.

You can see the prototype hardware support board (I call it Sparkdog PF-DI) along with the Rabbit ECU running the engine in these videos:

This project log is concerned with studying the VW CAN bus and DSG in order that the DIY aftermarket Rabbit ECU can control the gear selection. At first this seemed like a daunting prospect!

But taking a closer look at the DSG reveals its simplicity - there are only power and CAN connections to the single DSG connector (see far right side of picture below). This is very different from a first generation electronic automatic transmissions, where the engine ECU was typically connected to pressure control and shifting solenoids, as well as sensors and switches.

So integrating the DSG with the Rabbit ECU is clearly a matter of CAN study and understanding, and replacing the messages lost when the Bosch OEM ECU is removed in favour of the Rabbit ECU.

To observe the CAN messages, I used the excellent 8devices Korlan USB to CAN converter, and connected to the VW powertrain 500 kbps bus by adding a d-sub connection stub close to the OEM ECU.

Unlike many cars, there is little point connecting to the under-dash OBD port because there is a gateway that stops the free flow of powertrain bus information to that connector.

Understanding how the DSG system works takes both detective work, and 'thinking like' a transmission ECU such as the one embedded inside the DSG. Or at least like an software engineer who writes code for one.

The 'need to know' information that the DSG controller would include at minimum:

1.  Gear selector position
2.  Brake pedal status
3.  Engine estimated torque output
4.  Pedal position
5.  Throttle position
6.  Manifold pressure
7.  Engine temperature
8.  Engine speed
9.  Vehicle speed

Some logical thinking into the problem, and also a study of the VW GTI Mk6 wiring diagram should lead the hacker to think that this data should be transmitted over CAN from the gear selector module (selector position), engine ECU (engine speed, temperature, etc) and ABS ECU (vehicle speed and brake pedal position).

And so the detective work starts. For CAN hacking, I use the MDAC CAN View Replay tool, connecting through Korlan.

Here is an example of a CAN message list of the powertrain CAN at key on.

By observing the CAN message list and changing the DSG shifter position, engine speed, vehicle speed and other conditions, it is possible to identify the byte positions of the data that is needed.

For example, observing CAN ID 640 the pedal status idle, open and maximum are contained in the first byte. Engine speed follows in the next two bytes.

At CAN ID 648 the coolant temperature is found by observing the data as the engine warms up after start. In this way, all of the CAN IDs and byte positions of data can be found.

The work is ongoing, but you can see a video of testing below.

The engine still needs some tuning before I can start increasing the boost above the stock ECU limits. Updates soon!

If you like this project you can also keep in touch here on Facebook.