GolfGTIforum.co.uk
Model specific boards => Golf mk7 => Topic started by: fredgroves on 17 June 2015, 14:03
-
Has anyone got a complete pin out guide to the NavPro infotainment unit?
Its a linux device so am looking to see if it can be hacked :)
Am looking for some access point to get started on, that could be a USB port or a console port or a network port. (failing that I could attack the bluetooth)?
I'm fairly sure that like most automotive kit, IT security will have been the last thing they bothered with.
Once I'm in, there are some interesting possibilities :)
-
PM me your email address. I can get you the pin outs from ELSA.
-
thanks!
pm sent :D
-
No problem. I'll send it this evening.
-
Actually, I might have found a way :)
Reading this here:
http://forums.vwvortex.com/showthread.php?7159156-Discover-Pro-Hack-may-be-possible&p=87593838
Basically, need to use VCDS to enable a diagnostic menu in the NavPro (which is the same as the Audi MMI unit - its a Harman Nvidia-Tegra 2 based unit, using QNX 1.2b. )
Once you have that, you have some serious low level access to the unit.
Next trick is to plug in a USB ethernet adapter, configure it in the menu.... so you can connect the device via a portable router to your phone.... which then enables you to activate the carnet Google navigation and inform stuff **without the VW carnet mobile phone module** (aka "premium phone prep") that was never available in the UK.
http://www.club-q5.ru/forum/showthread.php?t=4572
Ok, so you will have some clunky network kit in your car, but it sounds like a fun piece of car/network hacking to me :)
-
Actually, its not VCDS you need, its VCP
-
Kevin,
Thanks for the email!
Interesting.
I expected to see some other connectors on the back.
The "premium phone prep" device (which is basically a mobile phone) connects to this unit somehow and it definitely connects over a serial connection (the link I provided earlier talks about changing the routing on the QNX box to use the new ethernet connection and not the default PPP one - PPP is serial).
At least I am fairly sure - I need to find the link I had that showed an American dismantling his "carnet module"
-
I understood that the premium bluetooth is built into the Discover Nav with an amplifier located in the side in the boot. The same amplifier is used with Premium bluetooth and the comfort/advanced bluetooth you guys have as an option in the UK.
-
Kevin is right. The phone module is located inside the Infotainment Electronics unit in the glovebox, and amplifier in the rear C pillar.
From the VW Self Study Manual on the MK7.
(https://c1.staticflickr.com/1/351/18764812460_2fe4f0a120_o.jpg) (https://flic.kr/p/uAbyZj)
(https://c1.staticflickr.com/1/337/18952493605_b4b7ca2711_o.jpg) (https://flic.kr/p/uSLu48)
-
This was the link I was referring to :
http://www.golfmk7.com/forums/showthread.php?t=9618&highlight=carnet
A gadget which has to be basically a mobile phone in a box, buried behind the clocks...
Which is weird really, I'd have thought it would have been with the other gubbins in the glovebox.
BTW the other bizarre thing I found from what Kevin gave me.... the NavPro unit has a connector for a "TV aerial". I guess somewhere in its buried functionality it has a TV receiver too.
Might be fun to figure that one out!
-
Car Net in the US market doesn't seem to be the same as in Europe and other markets
https://carnet.vw.com/portal/en/owners/carnet/
It seems to be more along the styles of the On-Star services provided for years by the likes of GM - car tracking, emergency services tools, etc
-
Yes, I thought that too and commented when that link I pasted here came up the first time.
So the European carnet phone module is inside of that "media unit" in the glovebox we think?
I guess that would make sense, given that the SIM card slot is definitely in that unit (I can see that in my owners book). I don't think you could or would extend wiring some distance to a SIM card like that.
-
Reading the doc from Kevin again, I've figured out some interesting stuff:
1) The document he sent me shows the "media unit" in the glovebox makes no mention of the SIM card slot - I wonder if this is a UK specific VW manual...
2) The thing we all stare at in the dash is not actually the computer that drives it all - the thing in the dash is just a display and controls. The unit (known in VW speak as "J794") is actually under the drivers seat. Looks like it itself might be a plug in module - which makes sense as it would allow for Nav/NavPro to be a simple plug in board. The "box" it sits in is known as J856.
3) The TV tuner I found reference to is also another module that plugs into the J856
4) In the glovebox media unit thingy (known as a "Chip Card Reader D8") it also has a toll sender unit... this will be like a Dart tag style automatic toll both ID sender for cashless toll payments.... kinda worrying that this technology is already in our cars eh?
I'll have to go take a look at my car in a sec and see if I can look at the J856 box under the seat - looks like the modules plug in from the rear - whether the box is totally encased I don't know yet - there might be some visible connectors.
Don't suppose Kevin that there is any manuals detailing the J856 and J794?
-
Well, I've just spent best part of 20 mins looking for the J856 box under the drivers seat.
Its not on the floor and its not in the seat unit itself (there are only 2 wires to the seat, which must be for passenger protection systems - from the schematic I know the J856 must have multiple cables)
So it must be under the carpet.... oh well.
-
I found this link from VW Vortex:
http://media.ccc.de/browse/congress/2013/30C3_-_5360_-_en_-_saal_2_-_201312281600_-_script_your_car_-_felix_tmbinc_domke.html#video&t=2225
This is a hacker showing you how to gain control of the bluetooth module.
Its very interesting...
But even if you don't understand the computer geeky bit, the bit which may interest you and backs up what I was saying before - the menus on the MFD and the steering wheel buttons all communicate using CAN bus messaging.
The phone menu on the MFD is sending stuff to the bluetooth phone "computer" whereas other things you select from the screens go to different modules.
I was always under the impression that one "box" (the thing in the dash) did all of this stuff, but it seems that there are multiple systems that send formatted messages to the display unit instead.
Don't know if this is interesting to anyone else, but hey, thought I'd share it :D
-
The document I sent you is just for the wiring and plugs for each unit. I would not expect it to mention the sim card slot so i wouldn't read too much into that. Also this is a general mk7 document and covers many different regions and car specs.
The card reader you mention is for the road toll system that is Japan only so European cars don't have any of the hardware for it. There is no way VW would fit a discrete module that would just be disabled. In addition to the reader, there would be a sender unit at the top of the windscreen.
I think the reference to the TV antenna is because the amplifiers in the boot lid are combination amplifiers. Some versions are AM/FM only and some are AM/FM/TV with an additional plug that goes to the TV Tuner. It's the same for DAB. VW just fit a different amplifier The TV antenna is not wired to the unit in the glovebox.
The J794 in the glovebox communicates with the Dyna-audio and TV tuner over the MOST bus. This is plug O in the schematic for J794.
The J856 nav module under the seat must be special equipment fitment. It could be for police/emergency cars. There's no mention of it anywhere else in ELSA or ETKA. I had the front seats out out of my car when I fitted rear footwell lights and I did not see any module under the carpet. Also, as it is connected to the CAN network, it would show up in a vcds scan.
In lower spec radios, the screen and brains are combined in the centre console. There is no unit in the glovebox.
The Carnet module behind the clocks is only fitted to the GTE and e-Golf in europe.
-
In that video link I posted earlier today at 7:40 you see him show you where that J856 module is - albeit on a left hand drive car (and I think a Mk6 golf too)
Looking back at the schematic, it says the module is under the right hand seat, but I noticed the diagram shows a left hand drive car.
I must get myself a VCDS kit :)
-
In that video link I posted earlier today at 7:40 you see him show you where that J856 module is - albeit on a left hand drive car (and I think a Mk6 golf too)
Looking back at the schematic, it says the module is under the right hand seat, but I noticed the diagram shows a left hand drive car.
I must get myself a VCDS kit :)
That module in the video is the bluetooth module. Bluetooth was not integrated into the radio in mk6 generation cars (except RNS315).
On the fitting locations, if it says right side, the module is located on right irrespective of the location of the steering wheel. If a module's location moves, it will say driver's side opposed to left or right. Look at the location description for the parking aid module.
-
Ahhh ok.
Thank you!
I am guessing that if I was to look in VCDS I'd be able to see all of the discreet modules because VCDS connects via the diagnostic port to the CAM gateway (if what the hacker guy said is correct).
-
Ahhh ok.
Thank you!
I am guessing that if I was to look in VCDS I'd be able to see all of the discreet modules because VCDS connects via the diagnostic port to the CAM gateway (if what the hacker guy said is correct).
Yes vcds will show you all of the modules connected to it. If you do an autoscan, it will also show you the sub-modules that are connected on the various LIN bus networks. For example see below. 5Q0 937 084 AE is the part number of the BCM connected to the CAN Bus. But it also shows 3 sub-modules (wiper motor, rain sensor and another I'd have to look up). The sub modules communicate to the CAN bus through the BCM over their own LIN bus. There are a number of LIN buses. The rear window motors are controlled by the front door modules over a different LIN bus. The xenon range module communicates with the motors in the xenon headlights over another LIN bus.
Address 09: Cent. Elect. Labels: None
Part No SW: 5Q0 937 084 AE HW: 5Q0 937 084 AE
Component: BCM MQBAB H H16 0124
Coding: 03011E46C20122FB0B244080B11C07281800000000000000000000000000
Shop #: WSC 01357 011 00200
ASAM Dataset: EV_BCMCONTI 012001
ROD: EV_BCMBOSCH_VW37.rod
VCID: 7BFE0C91F21800C6C11-802E
Subsystem 1 - Part No SW: 5G2 955 119 A HW: 5G2 955 119 A
Component: WWS 131121 042 0551
Serial number: 131123075337
Coding: 0E4DDD
Subsystem 2 - Part No SW: 5Q0 955 547 HW: 5Q0 955 547
Component: RLFS 024 0042
Serial number: Y13M07D06H08M39S56S1
Coding: 00A8DD
Subsystem 3 - Part No: 5Q0 951 172
Component: Sensor, DWA
No fault code found.
-
Ok, I think I am starting to understand this stuff. Thanks Kevin!
-
Hi guys,
Sorry for digging up such an old topic.
Just here to inform you... I enabled WLAN Hotspot functionality on the Discover Pro MIB1 (without Premium Phone stuff).
Also, I took the glove box device out... opened it up. After googling a bit, I found that the Premium Phone module is indeed inside this device, when you've ordered it. It seems hard to retrofit.
Wlan is functioning perfectly, the only problem is: it doesn't have any internet access due to the absence of a SIM-card. Neither can it use my Phone's internet over Bluetooth. RSap isn't possible.
My final hopes are set on turning the Discover Pro into a Wlan Client, instead of a hotspot. This should be possible, I've seen several posts on German boards regarding Passats with a Wifi router in the trunk to enable internet connectivity on the DPMIB1. All we need is... the right setting.
Anyways, for those with VCDS, here's how to unlock WLAN Hotspot mode:
Module 5F
Login 20103
Long Coding:
Byte 15, bit 4 = 1 (Phone NAD)
Byte 24 bit 3 = 1 (WLAN module)
Adaptation:
WLAN: On
(7) -Vehicle WIFI_Hotspot configuration: On
(17) -Vehicle UPnP configuration: On (will enable DLNA)
After setting this, reset the machine by holding power for ~ 15 seconds.
You can now find the WLAN settings in the menu.
-
Thanks for that. Sootchucker on here has done it but I wasn't sure what settings he'd used. I'll give that a go tomorrow.
http://www.golfgtiforum.co.uk/index.php?topic=259354.msg2529819#msg2529819
-
Cool to read that :)
Still strange that VW is saying in all documentation: WLAN is inside the additional Phone module, while it actually in the same chip as the default bluetooth chip on board of every Discover Pro. Let's hope I'll be able to enable WLAN Client soon.
-
Hi guys,
Sorry for digging up such an old topic.
Just here to inform you... I enabled WLAN Hotspot functionality on the Discover Pro MIB1 (without Premium Phone stuff).
Also, I took the glove box device out... opened it up. After googling a bit, I found that the Premium Phone module is indeed inside this device, when you've ordered it. It seems hard to retrofit.
Wlan is functioning perfectly, the only problem is: it doesn't have any internet access due to the absence of a SIM-card. Neither can it use my Phone's internet over Bluetooth. RSap isn't possible.
My final hopes are set on turning the Discover Pro into a Wlan Client, instead of a hotspot. This should be possible, I've seen several posts on German boards regarding Passats with a Wifi router in the trunk to enable internet connectivity on the DPMIB1. All we need is... the right setting.
Anyways, for those with VCDS, here's how to unlock WLAN Hotspot mode:
Module 5F
Login 20103
Long Coding:
Byte 15, bit 4 = 1 (Phone NAD)
Byte 24 bit 3 = 1 (WLAN module)
Adaptation:
WLAN: On
(7) -Vehicle WIFI_Hotspot configuration: On
(17) -Vehicle UPnP configuration: On (will enable DLNA)
After setting this, reset the machine by holding power for ~ 15 seconds.
You can now find the WLAN settings in the menu.
Wow I tried the hotspot one on its own before, will be turning this on, have plans to turn a rasp pi zero into a wireless music player from a usb hard drive as I am fed up with the normal system loosing connection to the hard disk and its inability to show the full collection of music on the hard disk. Bluetooth and the pi seems to be a little badly set up at the moment.
-
Wow I tried the hotspot one on its own before, will be turning this on, have plans to turn a rasp pi zero into a wireless music player from a usb hard drive as I am fed up with the normal system loosing connection to the hard disk and its inability to show the full collection of music on the hard disk. Bluetooth and the pi seems to be a little badly set up at the moment.
Yeah, now you can use DLNA over WLAN :)
(http://i.imgur.com/7dBCbPp.jpg)
So far, here are my findings (to get back on topic) so far:
- WLAN is on same chip as bluetooth and is available in all Discover Pro devices. (the exact opposite of what VW/Audi keeps on telling us!!!)
- Developer menu can be enabled through Adaptation.
- Developer menu can be opened by holding MENU for ~20 seconds
- Screenshots can be made by pushing the right button, once developer-menu is enabled
- Overlay view of screen elements can be enabled by pushing and holding CAR button, once developer-menu is enabled
- Overlay view of screen data/names can be enabled by pushing and holding TRAFFIC button, once developer-menu is enabled
- Skin can be changed through Debug options in Developer menu
- Loudness can be disabled through the Green menu in the Developer menu
- Mirrorlink button in main menu can be enabled through Debug options in Developer menu
- WLAN is available after enabling Phone NAD bit in long coding(which enabled Premium Phone)
- DLNA is available after enabling WLAN (this is port 49152)
- Wlan packets can be sniffed and saved to SD through the Green menu in the Developer menu
Some screenshots I took:
The Developer menu:
(http://i.imgur.com/rdwFFek.png)
The "Green" menu:
(http://i.imgur.com/tO8uPsB.png)
The Mirror link button in the main menu (non functional):
(http://i.imgur.com/Y4wwEMel.jpg)
This is inside the glove-box part of the Discover Pro. The upper right area is reserved for the premium Phone module. Those two connectors at the bottom are named "HDD" and "MMX", but I don't know this industry standard so I wouldn't know how to connect to them. I didn't find the solid state drive... it's probably on that nvidea board
(http://i.imgur.com/CgD91Fn.jpg)
Googling for chip numbers, here's what I found as well:
http://electronics360.globalspec.com/article/3337/audi-mib-high-8v0035021-mib-processing-unit-infotainment-teardown
-
The little chips with the blue are probably the SSD ram chips.
-
I tried all of this with a Disco Pro that has no Sim card slot and it didn't work. :cry:
What I found was I had no bit settings in byte 15 and 24 so I tried them anyway. It accepted the changes although when I re-queried the long coding it didn't accept the byte 24 setting. Byte 15 settings was accepted and it gave me a premium phone option in the phone settings menu, although ticking it proved fruitless as it couldn't activate the premium phone (obviously).
I did find further down though there is a wireless client option near the UPnP and WLAN Hotspot settings, so turning that one might turn it into the client mode you want.
I have software version 0376 and part no. 5G0035020D.
-
thanks for your input.
It seems to me, that some (older revisions?) of the DPMIB1 do not allow people to turn this on.
I know about the WLAN Client bit, but haven't been able to get it working. But... I suspect there is some combination between the bits that I can set:
- WLAN Client
- WLAN Hotspot
- WLAN enabled
- Phone NAD
- UPNP
It's a matter of trying all logical combinations...
-
Of course WLAN client, even if it does enable, will have SSID and password settings... whether those are set in VCDS data or hard coded, I guess we won't know. Although you should be able to see if trying to connect if you sniff the wifi... that will give you an SSID.
-
Vw included a hot spot search and the ability to type a key
-
Cool!
Ok, so you just have to get it enabled :D
-
:D yes, that's all. Let's hope I'll find a way!
-
This was the link I was referring to :
http://www.golfmk7.com/forums/showthread.php?t=9618&highlight=carnet
A gadget which has to be basically a mobile phone in a box, buried behind the clocks...
Which is weird really, I'd have thought it would have been with the other gubbins in the glovebox.
I believe that the "other gubbins" is the Telematics control unit:
Here's an admap of the telematics control module (J949 @ address hex75) that shows the type of functionality that it provides
SW:5QE-035-285-A HW:5QE-035-285-A --- Telematics
;Component:OCULowMQBUS 007 0564, Coding:02730002C2823A017F1E06000000
;EV_OCULowMQB,001003,EV_OCULowMQB.rod
;Friday,09,January,2015,14:23:55:23817
;VCDS Version: Release 14.10.0 (x64) Data version: 20141022
;VCID: 438F4DBBCAC8D139329-8016
Acoustic warning for vehicle shut-down,activated
(1)-After-run time-Long term energy budget,3600 mAh
(2)-After-run time-Short term energy budget,1000 mAh
(3)-After-run time-Waiting period from sleep to standby mode,0 min
(4)-After-run time-Waiting period from standby to stop mode,336 H
(5)-After-run time-Time period for cyclic stop mode in operating mode,0 min
(6)-After-run time-Time period for cyclic standby mode in operating mode,0 min
(7)-After-run time-Time period for operating mode,0 d
(8)-After-run time-Cyclic time after the operating mode,0 H
(9)-After-run time-Connection after T. 15 on,No
(10)-After-run time-Time period for connection after T. 15 on,15 min
Antenna for telephone status,automatic
Base volume of speech output,0 dB
Deactivate production mode,0
(1)-Dimming charac. curve of green function illumination-X1,0
(2)-Dimming charac. curve of green function illumination-Y1,1 %
(3)-Dimming charac. curve of green function illumination-X2,10
(4)-Dimming charac. curve of green function illumination-Y2,1 %
(5)-Dimming charac. curve of green function illumination-X3,50
(6)-Dimming charac. curve of green function illumination-Y3,2 %
(7)-Dimming charac. curve of green function illumination-X4,100
(8)-Dimming charac. curve of green function illumination-Y4,4 %
(9)-Dimming charac. curve of green function illumination-X5,150
(10)-Dimming charac. curve of green function illumination-Y5,80 %
(11)-Dimming charac. curve of green function illumination-X6,253
(12)-Dimming charac. curve of green function illumination-Y6,100 %
(1)-Dimming charac. curve of red function illumination-X1,0
(2)-Dimming charac. curve of red function illumination-Y1,1 %
(3)-Dimming charac. curve of red function illumination-X2,10
(4)-Dimming charac. curve of red function illumination-Y2,1 %
(5)-Dimming charac. curve of red function illumination-X3,50
(6)-Dimming charac. curve of red function illumination-Y3,2 %
(7)-Dimming charac. curve of red function illumination-X4,100
(8)-Dimming charac. curve of red function illumination-Y4,4 %
(9)-Dimming charac. curve of red function illumination-X5,150
(10)-Dimming charac. curve of red function illumination-Y5,80 %
(11)-Dimming charac. curve of red function illumination-X6,253
(12)-Dimming charac. curve of red function illumination-Y6,100 %
Dimming coefficient of green function illumination,60 %
Dimming coefficient of red function illumination,40 %
Emergency telephone number,112
Fallback DNS Server,0.0.0.0
Fuel tank volume,50 l
Microphone sensitivity,0 dB
Mobile network operator,aprd3.hughestelematics.com.attz
(1)-Mobile Online services; activation threshold-Distance for activation,5 km
(2)-Mobile Online services; activation threshold-Lock time during deactivation,0 min
Mobile Online services; first host name,vw.us.p.tos.hughestelematics.net
Mobile Online services; second host name,vw.us.p.tos.hughestelematics.net
Number 1 for Info call,8774193655
Number 1 for roadside assistance,8774193653
Number 1 for roadside assistance,8774193654
Number 2 for Info call,8882915686
Number 2 for roadside assistance,8882449108
Number 2 for roadside assistance,8882449811
Production mode,00 00 00
Reference channel delay,0 ms
Safety mode for activation vehicle shutdown,activated
Safety mode for deactivation vehicle shutdown,not activated
SMS number 1 for call for help,60000004
Speed warning maximum speed,0 km/h
Status of GPS antenna,external
Test tel. number for roadside assistance,0
Threshold for vehicle movement recognition,5 km/h
User profile name,none
User profile password,none
(1)-Vehicle function list BAP-Time,activated
(2)-Vehicle function list BAP-Charge manager,not activated
(3)-Vehicle function list BAP-Multifunction indicator,activated
Vehicle shut-down; maximum speed,5 km/h
Waiting period for activation vehicle shutdown,30 s
(1)-Cycle_Data_Log_Level-Core_Service_Management,ERROR
(2)-Cycle_Data_Log_Level-Remote_Door_Unlock,ERROR
(3)-Cycle_Data_Log_Level-Remote_Honking_and_Flashing,ERROR
(4)-Cycle_Data_Log_Level-Vehicle_Health_Report,ERROR
(5)-Cycle_Data_Log_Level-Roadside_Assistance_Dealer_Maintenance_Scheduling,ERROR
(6)-Cycle_Data_Log_Level-Manual_Emergency_Call,ERROR
(7)-Cycle_Data_Log_Level-Remote_Speed_Alert,ERROR
(8)-Cycle_Data_Log_Level-Remote_Vehicle_Disabling,ERROR
(9)-Cycle_Data_Log_Level-Remote_Vehicle_Tracking,ERROR
(10)-Cycle_Data_Log_Level-Geofencing,ERROR
(11)-Cycle_Data_Log_Level-Remote_Trip_Statistics,ERROR
(12)-Cycle_Data_Log_Level-Remote_Vehicle_Status,ERROR
(13)-Cycle_Data_Log_Level-Remote_Battery_Charging_Management,ERROR
(14)-Cycle_Data_Log_Level-Remote_Pre_Trip_Climatisation,ERROR
(15)-Cycle_Data_Log_Level-Remote_Departure_Time_Programming,ERROR
(16)-Cycle_Data_Log_Level-Information_Call,ERROR
(17)-Cycle_Data_Log_Level-Automatic_Crash_Notification,ERROR
(18)-Cycle_Data_Log_Level-POI_Address_Import,ERROR
Driving_Follow_Up_Time,5 min
Emergency_Call_Trigger_Condition,crash_intensity_2
(1)-Geofencing_Area_First_Radius-Maximum value,4294967294 m
(2)-Geofencing_Area_First_Radius-Minimum value,1 m
(1)-Geofencing_Area_Highth-Maximum value,4294967294 m
(2)-Geofencing_Area_Highth-Minimum value,1 m
(1)-Geofencing_Area_Latitude-Maximum value,+2.147.483.647
(2)-Geofencing_Area_Latitude-Minimum value,-2.147.483.648
(1)-Geofencing_Area_Longitude-Maximum value,+2.147.483.647
(2)-Geofencing_Area_Longitude-Minimum value,-2.147.483.648
(1)-Geofencing_Area_Second_Radius-Maximum value,4294967294 m
(2)-Geofencing_Area_Second_Radius-Minimum value,1 m
(1)-Geofencing_Area_Width-Maximum value,4294967294 m
(2)-Geofencing_Area_Width-Minimum value,1 m
(1)-Manual_Emergency_Call-Radio_On_Trigger,On
(2)-Manual_Emergency_Call-Vehicle_Termination,On
Number_Of_Navigation_Destinations,20
(1)-Online_Services_Communication_Protocol-APN_Auth_Type,PAP_CHAP
(2)-Online_Services_Communication_Protocol-GSM_Automatic_Operator,manual
(3)-Online_Services_Communication_Protocol-PDP_Type,IPv4
(4)-Online_Services_Communication_Protocol-TCP_Max_Receive_Window,65535 B
(5)-Online_Services_Communication_Protocol-TCP_Max_Transmit_Window,65535 B
(6)-Online_Services_Communication_Protocol-Keep_Connection_Alive_If_Event_Expected_Within,10 min
(7)-Online_Services_Communication_Protocol-TCPMS,532 B
(8)-Online_Services_Communication_Protocol-PDP_Grace_Time,120 s
(1)-Online_Services_Data_Roaming-Core_Service_Management,activated
(2)-Online_Services_Data_Roaming-Remote_Speed_Alert,activated
(3)-Online_Services_Data_Roaming-Geofencing,activated
(4)-Online_Services_Data_Roaming-Remote_Vehicle_Tracking,activated
(5)-Online_Services_Data_Roaming-Remote_Vehicle_Disabling,activated
(6)-Online_Services_Data_Roaming-Core_Service_Telephony,activated
(7)-Online_Services_Data_Roaming-JobMechanism,activated
(8)-Online_Services_Data_Roaming-Remote_Door_Unlock,activated
(9)-Online_Services_Data_Roaming-Remote_Honking_and_Flashing,activated
(10)-Online_Services_Data_Roaming-Roadside_Assistance,activated
(11)-Online_Services_Data_Roaming-Vehicle_Health_Report,activated
(12)-Online_Services_Data_Roaming-POI_Address_Import,activated
(13)-Online_Services_Data_Roaming-Remote_Battery_Charging_Management,activated
(14)-Online_Services_Data_Roaming-Remote_Pre_Trip_Climatisation,activated
(15)-Online_Services_Data_Roaming-Remote_Departure_Time_Programming,activated
(16)-Online_Services_Data_Roaming-Remote_Vehicle_Status,activated
(17)-Online_Services_Data_Roaming-Remote_Trip_Statistics,activated
(1)-Online_Services_Timeouts-Transport_Protocol_Timeout,120 s
(2)-Online_Services_Timeouts-HTTP_Timeout,125 s
(3)-Online_Services_Timeouts-Secure_Connection_Timeout,120 s
(4)-Online_Services_Timeouts-PDP_Timeout,120 s
(5)-Online_Services_Timeouts-Network_Timeout,120 s
Online_Services_Voice_Roaming,activated
(1)-Pearl_Chain_Generation_Criteria-Distance,500 m
(2)-Pearl_Chain_Generation_Criteria-Driving direction,30 °
(3)-Pearl_Chain_Generation_Criteria-Speed,30 km/h
(4)-Pearl_Chain_Generation_Criteria-Height,50 m
(5)-Pearl_Chain_Generation_Criteria-Time,60 s
(6)-Pearl_Chain_Generation_Criteria-Debounce,10 m
(1)-Remote_Vehicle_Status-Remote_Vehicle_Status_Clamp_15_On_Delay,1275 s
(2)-Remote_Vehicle_Status-Remote_Vehicle_Status_Clamp_15_Off_Delay,60 s
(1)-Remote_Vehicle_Tracking_Mileage_Trigger-Maximum value,65535 m
(2)-Remote_Vehicle_Tracking_Mileage_Trigger-Minimum value,0 m
(1)-Remote_Vehicle_Tracking_Time_Trigger-Maximum value,65535 s
(2)-Remote_Vehicle_Tracking_Time_Trigger-Minimum value,0 s
Roof_Crash_Detection_Speed_Limit,30 km/h
Serial_Tracing,
Vehicle_Health_Report,15000 km
(1)-Voice_Connection_Timeouts-Call_Failed_Timer,10 s
(2)-Voice_Connection_Timeouts-Wait_Tone_Timer,30 s
(3)-Voice_Connection_Timeouts-Redial_Attempts,6
(4)-Voice_Connection_Timeouts-Redial_ACN_MEC_If_Failed,Yes
(5)-Voice_Connection_Timeouts-Redial_Timer,2 s
(6)-Voice_Connection_Timeouts-Voice_Data_Transfer_Failed_Timer,15 s
BTW the other bizarre thing I found from what Kevin gave me.... the NavPro unit has a connector for a "TV aerial". I guess somewhere in its buried functionality it has a TV receiver too.
Might be fun to figure that one out!
Yes the TV module is part of the MOST ring topology. I understand that this option is offered for mk7s that are sold into the Japanese market. Not sure why anyone would want to watch TV whilst in a car - perhaps the Japanese have particularly important TV shows that must be watched!
Here's a diagram of the MOST showing the TV module''
(http://i.imgur.com/oPEYpG2.png)