Forty computers.Five networks.One car.

Hold Ctrl and scroll to zoom

visible edge hidden edge HV cable position inferred

A teardown of a 2021 Audi e-tron 55 quattro

Forty computers.

Every address, part number and behaviour here was read from a real car through its diagnostic port. This is where each computer sits, what it does, and how a single message crosses the car to reach it.

Scroll to look inside

01 Under the skin

The body is only a shell for the network.

Take the panels away and a second car appears: a harness running along the sills, up the pillars and through the dash, with a computer at every place something has to be sensed or moved. Each box is an ECU, drawn in the colour of the bus it lives on.

02 Detail A · the router

Every message that changes wire passes through one box.

The gateway `` sits under the dash, left of the console. It has a port on each of the five buses and it is the only module that does. When a message has to go from one bus to another, the gateway stores it, checks it and sends it on. The pulses that stop here are doing exactly that.

It is also the only way in: a tester on the OBD socket can only ever talk to the gateway.

03 The drawing

Explore it yourself.

Drag to turn the car. Press 1 to 8 for set views. Hold Ctrl and scroll to zoom. Tap or click any module on the car, or pick one from the parts list.

04 In motion

Five things the car does, one message at a time.

System schematic

The same network as the drawing, drawn the way an engineer would. CAN and CAN FD are shared, terminated lines; FlexRay and Ethernet are stars that meet inside the gateway; LIN hangs off its master. Hover anything to see what it connects to, or trace a scenario and watch where messages have to stop at the gateway.

Module order along each line is front to rear. Termination points and the star coupler and switch inside the gateway are schematic.

Read vs. write, by group

The verbs

The locks, in order

One real exchange

Every message changes wire at the gateway, reading is free, and the cluster refuses a coding write until two other values have been written in the same session.

Step through Show the read on the car →

What worked

• Identifying every module over DoIP by reading `F187` and `F19E`.
• Reading fault memories and identification data, with no key.
• Writing the coding bits I needed, reading each one back to check it.
• The redacted secret from finding 6, which I don't publish. See finding 6.
• The animated taillights now run.

What I could not do, or chose not to

• Clear faults on seven modules. They refuse the standard clear command (finding 7). This can easily be reversed engineered but it was not a priority.
• Write to the brakes, airbag, steering or any high-voltage module. I never tried (Note 1). ... you know why ツ

Findings