E65 N73 CAN bus

[AndreyB]

They say https://github.com/brent-stone/CAN_Reverse_Engineering could help us figure out what's going on the CAN bus?

Another cool link https://www.bimmerforums.com/forum/showthread.php?2298830-E90-Can-bus-project-(E60-E65-E87-)

[AndreyB]

Those N73 parts are rare so I had to jump on the change to grab

[Zeiss]

Hey Andrey,

please check my github for logs: https://github.com/HeinrichG-V12/E65_ReverseEngineering

Some info in advance:

• CH1: Local-CAN
• CH2: PT-CAN

Log1.log:

• Key in
• ignition on
• wait some time
• 3x gas pedal to floor (NO kick down)
• ignition off
• key out
• wait till bus idle

Log2.log

• door open
• key in
• ignition on
• brake
• engine start
• engine starts with 1500rpm
• goes slow down to 750rpm (acc on)
• idle at 750rpm
• rpm slow up to ca. 2000rpm and then fast down
• ignition off
• key out
• wait till bus idle

short youtube video:



INPA: It looks like the settings don't quite fit. I'll write you what else you should check. The first message only says that the versions of scripts in INPA do not match the software version on the DME... doesn't matter, can be ignored most of the time.

[AndreyB]

Great stuff, so I top up washer fluid while others are hacking into local CAN bus

How does it align with https://www.loopybunny.co.uk/CarPC/k_can.html?

For instance message 0x130 looks to at least kind of fit into https://www.loopybunny.co.uk/CarPC/can/130.html

On the other hand I see many messages which we have while CarPC do not mention

Would you be interested to cross reference packets from your recording with CarPC data, more or less all packet types one by one?

[Zeiss]

I haven't even looked at the logs yet, just uploaded them. I'll look in the days and compare with LoopyBunny, whether they fit together halfway.

In the logs are both CANs simultaneously in it, PT and Local.

[AndreyB]

Only about 17 kinds of messages on the local bus, and about 80 kinds on the PT bus?

Just created https://github.com/rusefi/rusefi/wiki/E65-CAN-bus

[Zeiss]

First of all:

All my changes are completely 100% reversible. No cables are cut or twisted or something like that, I only work with inserts that I put between the pins/connectors/bushing/.... So I'm always able to remove the whole stuff.

The connectors used in this case are:
-> black: called "universal pin terminal uncoded" with BMW-number: 6113 6913635
-> pin-contact: 6113 0005198
-> green: called "universal socket housing uncoded" with BMW-number: 6113 6909058
-> bushing contact: 6113 0005197

Let us have a look into the ECU-Box:

ecu_box.jpg (220.12 KiB) Viewed 20090 times

1. IVM
2. DME2 (A6020), here we will connect to the both CAN buses.
3. X60204 connector, 24-pin, gray
4. X60203 connector, 52-pin, gray

Local-CAN:

• located on X60203
• X60203.51 yellow/brown: CAN_L
• X60203.38 yellow/black: CAN_H

PT-CAN:

• located on X60204
• X60204.36 blue/red: CAN_H
• X60204.37 red: CAN_L

Here is my double Y-cable (one for Local-CAN and one for PT-CAN), they shares just one pin housing:

Y-Cable.jpg (179.97 KiB) Viewed 20090 times

I extracted the pins from connectors X20603 and X20604 and pinned pins (1 & 2) in the correct locations. I pinned the previously extracted pins from the connector X20603 and X20604 into the green connector (3). That's it.

Only about 17 kinds of messages on the local bus,

Yes. It because the Local-CAN is a private CAN bus for engine ECU and only for engine ECUs. There are only five ECUs connected throw this bus:

grafik.png (41.89 KiB) Viewed 20090 times

BMW says:

grafik.png (27.44 KiB) Viewed 20090 times

and about 80 kinds on the PT bus?

Yes, here participate the whole powertrain. That means:

• ACC
• DSC
• GearBox
• DME1 and DME2
• EDC
• Dynamic drive
• Safety and gateway module
• DSC sensors
• EMF / Parking brake control module

[Zeiss]

Yes, you are right. We need to do a "man in the middle filtering". The only place you can disconnect the 6HP26 from the bus is on the 6HP26 itself, pin out and install an accessible bridge or something like that. But, 6HP26 is under the vehicle floor

I need to change the hardy washer (universal joint) on my 760. I can get to the gearbox, so it would not be a problem. I don't know when I'll get to it though, so that's a problem. Or do you have access to a lift?

EDIT:
It sholud be possible to do a "man in the middle filtering" under the hood.

grafik.png (31.88 KiB) Viewed 20077 times

Unpin pins X60094.7 and X60094.8 and build here a open bridge...

[AndreyB]

I've started googling some of the packet IDs and found something very cool!

First of all https://www.m5board.com/threads/lets-talk-dct-conversion.461873/page-21#post-7596717

(Reproduced below with my commentary added)
A8 Torque 1 K-CAN [10] 0x12 DME1/DDE1 Present on MSS65
A9 Torque 2 (10) 0x12 DME1/DDE1 Present on MSS65
AA Torque 3 K-CAN [10] 0x12 DME1/DDE1 Present on MSS65
AC Wheel torque Drive train 2 [5] 0x12 DME1/DDE1 Does not appear to be present in MSS65
B4 Wheel torque Drive train 1 [4] 0x12 DME1/DDE1 Does not appear to be present in MSS65
B6 Torque demand DSC [7] 0x29 DXC_RB/DSC_RB/DSC_CT Likely present
BF Requirement wheel torque Drive train [6] 0x1C LDM Sent from DSC module on MK60e5 cars (i.e M5)
C4 Steering wheel angle K-CAN [13] 0x29 DXC_RB/DSC_RB/DSC_CT Present on M5
CE Wheel speed K-CAN [4] 0x29 DXC_RB/DSC_RB/DSC_CT Preasent on M5
130 Terminal status [19] 0x40 CAS Broadcast by DME on M5, can probably be configured to be sent from CAS
19E Status DSC K-CAN [19] 0x29 DXC_RB/DSC_RB/DSC_CT present on M5
1A3 Raw data longitudinal acceleration [3] 0x18 SMG_M Sent by SMG module on M5
1B4 Status Kombi [14] 0x60 Kombi Present on M5
1D0 Motor data [13] 0x12 DME1/DDE1 Present on M5
1e1 Door Status Present on M5
2B2 Wheel pressure K-CAN [1] 0x29 DXC_RB/DSC_RB/DSC_CT Present on M5
2FA Seat belt contact (14) 0x1 ACSM Present on M5
2FC ZV and folding condition [11] 0x40 CAS Present on M5
308 Status MSA [2] 0x12 DME1/DDE1 Not present on M5, may not matter
310 External temperature / relative time [10] 0x60 Kombi Present on M5
330 Mileage / range [5] 0x60 Kombi Present on M5
34F Hand Brake Status Present on M5
374 Wheel tolerance adjustment [7] 0x29 DXC_RB/DSC_RB/DSC_CT Present on M5
3EF OBD data engine (3) 0x12 DME1/DDE1 Present on M5

and they link to https://www.maxxecu.com/webhelp/advanced-bmw_dct-can_protocol.html

The DCT control strategy and logic is built inside the TCU, and we "just" feed the TCU with the following data (in short, it is highly complicated):
•Torque values (engine, drivers choice, vehicle, wheel, requests, max and min values).
•Engine RPM.
•Engine CLT.
•Engine oil temperature (simulated from CLT).
•Pedal position.
•Required fuel amount.
•E-Throttle positions (simulated from pedal positions to be able to work with non E-Throttle vehicles).
•Brake pedal status.
•"Vehicle speed values" to match the stock gear ratio (if using other gear ratio than the gearbox donor vehicle, we have to recalculate this value).
•Traction control status.
•Yaw sensor data.
•Steering wheel angle position.
•Wheel pressures, circumference, tolerances.
•Brake pressures.
•Handbrake status.
•Active cruise control status.
•Seat belt status.
•Combi data, odometer, MIL status.
•Door and trunk status.
•Ambient temperature.
•Central locking status.
•Ignition key/terminal status.
•Gear position status.

•A VERY LONG list of other status values like (vehicle speed limitations, engine speed limitations, catalyst protections, engine start torque, max values if limp home and similar values....)

Note: We do not list ALL values transmitted above, many of them are check sum verified by the TCU.


MaxxECU CAN message IDs MaxxECU CAN message IDs (with my comments)
•0xAA rpm, throttle
•0xA8 torque, brake
•0xA9 torque
•0x1D0 engine data
•0x1A0
•0x2FA seat belt
•0x2FC doors
•0x308
•0x310
•0x34F
•0x3EF
•0x1E1
•0x130 ignition
•0x330 fuel, range
•0xBF
•0xAC
•0xB4
•0xB6
•0xCE
•0xC4
•0x19E ABS/braking
•0x2B2
•0x374
•0x1A3
•0x1B4

[AndreyB]

https://www.bimmerforums.com/forum/showthread.php?2298830-E90-Can-bus-project-(E60-E65-E87-)&p=29628499#post29628499 mentions tool32 as the source of a huge table in German

CAN_ID_DEZ CAN_ID_HEX CAN_ID_NAME DIAG_ID_DEZ DIAG_ID_HEX SG_NAME
0 0x00 unbekannt 0 0x00 Sender unbekannt
949 0x3B5 Status Wasserventil [6] 120 0x78 IHKA
957 0x3BD Status Verbraucherabschaltung [2] 114 0x72 KBM
250 0xFA Steuerung Fensterheber FAT [10] 0 0x0 KGM
251 0xFB Steuerung Fensterheber BFT [5] 0 0x0 KGM
252 0xFC Steuerung Fensterheber FATH [5] 114 0x72 KBM
253 0xFD Steuerung Fensterheber BFTH [5] 114 0x72 KBM
168 0xA8 Drehmoment 1 K-CAN [10] 18 0x12 DME1/DDE1
169 0xA9 Drehmoment 2 (10) 18 0x12 DME1/DDE1
170 0xAA Drehmoment 3 K-CAN [10] 18 0x12 DME1/DDE1
172 0xAC Radmoment Antriebsstrang 2 [5] 18 0x12 DME1/DDE1
173 0xAD Verzögerungsanforderung ACC [9] 28 0x1C LDM
173 0xAD Verzögerungsanforderung ACC [9] 33 0x21 ACC_Modul/ACC+NAVI
179 0xB3 Steuerung Lenkunterstützung [2] 22 0x16 AFS
180 0xB4 Radmoment Antriebsstrang 1 [4] 18 0x12 DME1/DDE1
181 0xB5 Drehmomentanforderung EGS [9] 24 0x18 EGS_MECH+NAVI/EGS_MECH
182 0xB6 Drehmomentanforderung DSC [7] 41 0x29 DXC_RB/DSC_RB/DSC_CT
183 0xB7 Drehmomentanforderung ACC [10] 28 0x1C LDM
183 0xB7 Drehmomentanforderung ACC [10] 33 0x21 ACC_Modul/ACC+NAVI
184 0xB8 Drehmomentanforderung DKG [2] 24 0x18 DKG
185 0xB9 Drehmomentanforderung AFS [3] 22 0x16 AFS
186 0xBA Getriebedaten [20] 24 0x18 SMG_M/SMG/EGS_MECH+NAVI/EGS_MECH/DKG
187 0xBB Sollmomentanforderung [7] 41 0x29 DXC_RB
188 0xBC Status Sollmomentumsetzung [7] 25 0x19 VGSG
189 0xBD Drehmomentanforderung SSG [6] 24 0x18 SMG_M/SMG
190 0xBE Alive Zähler [12] 35 0x23 ARS_Modul
191 0xBF Anforderung Radmoment Antriebsstrang [6] 28 0x1C LDM
192 0xC0 Alive Zentrales Gateway [1] 0 0x0 KGM
193 0xC1 Alive Zähler Telefon [3] 54 0x36 TEL_JAP/TEL_BPI
196 0xC4 Lenkradwinkel K-CAN [13] 41 0x29 DXC_RB/DSC_RB/DSC_CT
200 0xC8 Lenkradwinkel Oben K-CAN [6] 2 0x2 SZL_LWS
206 0xCE Radgeschwindigkeit K-CAN [4] 41 0x29 DXC_RB/DSC_RB/DSC_CT
210 0xD2 Bedienung Sitzverstellung BF [6] 101 0x65 SZM_MIT_KBUS/SZM
213 0xD5 Anforderung Radmoment Bremse [6] 28 0x1C LDM
215 0xD7 Alive Zähler Sicherheit [2] 1 0x1 ACSM
218 0xDA Bedienung Sitzverstellung FA [6] 101 0x65 SZM_MIT_KBUS/SZM
225 0xE1 Radmoment Bremse [3] 41 0x29 DXC_RB/DSC_RB
226 0xE2 Status Zentralverriegelung BFT [11] 0 0x0 KGM
230 0xE6 Status Zentralverriegelung BFTH [11] 114 0x72 KBM
234 0xEA Status Zentralverriegelung FAT [11] 0 0x0 KGM
238 0xEE Status Zentralverriegelung FATH [11] 114 0x72 KBM
242 0xF2 Status Zentralverriegelung HK [13] 114 0x72 KBM
246 0xF6 Steuerung Außenspiegel [9] 0 0x0 KGM
304 0x130 Klemmenstatus [19] 64 0x40 CAS
309 0x135 Steuerung Crashabschaltung EKP [1] 1 0x1 ACSM
351 0x15F Anforderung Winkel FFP [6] 28 0x1C LDM
370 0x172 Quittierung Anforderung Kombi [1] 98 0x62 M_ASK/CCC_GW
400 0x190 Anzeige ACC [13] 28 0x1C LDM
400 0x190 Anzeige ACC [13] 33 0x21 ACC_Modul/ACC+NAVI
402 0x192 Bedienung Getriebewahlschalter [16] 2 0x2 SZL_LWS
403 0x193 Anzeige ACC DCC [4] 28 0x1C LDM
404 0x194 Bedienung Tempomat/ACC [13] 2 0x2 SZL_LWS
408 0x198 Bedienung Getriebewahlschalter 2 [2] 94 0x5E GWS
414 0x19E Status DSC K-CAN [19] 41 0x29 DXC_RB/DSC_RB/DSC_CT
416 0x1A0 Geschwindigkeit K-CAN [14] 41 0x29 DXC_RB/DSC_RB/DSC_CT
418 0x1A2 Getriebedaten 2 [6] 24 0x18 EGS_MECH+NAVI/EGS_MECH/DKG
419 0x1A3 Rohdaten Längsbeschleunigung [3] 24 0x18 SMG_M
422 0x1A6 Wegstrecke [6] 41 0x29 DXC_RB/DSC_RB/DSC_CT
426 0x1AA Effekt ErgoCommander [10] 98 0x62 M_ASK/CCC_GW
428 0x1AC Status ARS-Modul [13] 35 0x23 ARS_Modul
436 0x1B4 Status Kombi [14] 96 0x60 Kombi
437 0x1B5 Wärmestrom/Lastmoment Klima [14] 120 0x78 IHKA
438 0x1B6 Wärmestrom Motor [11] 18 0x12 DME1/DDE1
440 0x1B8 Bedienung ErgoCommander [6] 103 0x67 ZBE_LO/ZBE
450 0x1C2 Abstandsmeldung PDC [5] 100 0x64 PDC
451 0x1C3 Abstandsmeldung 2 PDC [3] 100 0x64 PDC
454 0x1C6 Akustikmeldung PDC [5] 100 0x64 PDC
464 0x1D0 Motordaten [13] 18 0x12 DME1/DDE1
466 0x1D2 Anzeige Getriebedaten [22] 24 0x18 SMG_M/SMG/EGS_MECH+NAVI/EGS_MECH/DKG
470 0x1D6 Bedienung Taster Audio/Telefon [12] 2 0x2 SZL_LWS
472 0x1D8 Bedienung Klima Luftverteilung FA [13] 98 0x62 M_ASK/CCC_GW
473 0x1D9 Bedienung Taster M-Drive [2] 2 0x2 SZL_LWS
474 0x1DA Bedienung Klima Fernwirken [5] 64 0x40 CAS
476 0x1DC Bedienung Schichtung Sitzheizung [1] 98 0x62 M_ASK/CCC_GW
480 0x1E0 Bedienung Klima Luftverteilung BF [7] 98 0x62 M_ASK/CCC_GW
482 0x1E2 Bedienung Klima Front [11] 98 0x62 M_ASK/CCC_GW
487 0x1E7 Bedienung Sitzheizung/Sitzklima FA [7] 101 0x65 SZM_MIT_KBUS/SZM
488 0x1E8 Bedienung Sitzheizung/Sitzklima BF [7] 101 0x65 SZM_MIT_KBUS/SZM
490 0x1EA Bedienung Lenksäulenverstellung [5] 2 0x2 SZL_LWS
491 0x1EB Bedienung Aktivsitz FA [3] 101 0x65 SZM_MIT_KBUS/SZM
492 0x1EC Bedienung Aktivsitz BF [3] 101 0x65 SZM_MIT_KBUS/SZM
493 0x1ED Bedienung Lehnenbreitenverstellung Aktiv FA [2] 101 0x65 SZM_MIT_KBUS/SZM
494 0x1EE Bedienung Lenkstockstaster [6] 2 0x2 SZL_LWS
495 0x1EF Bedienung Lehnenbreitenverstellung Aktiv BF [2] 101 0x65 SZM_MIT_KBUS/SZM
498 0x1F2 Bedienung Sitzmemory BF [3] 101 0x65 SZM_MIT_KBUS/SZM
499 0x1F3 Bedienung Sitzmemory FA [4] 101 0x65 SZM_MIT_KBUS/SZM
500 0x1F4 Fernbedienung Sitzmemory BF [2] 255 0xFF unbekannt
502 0x1F6 Blinken [6] 112 0x70 LM
508 0x1FC Status AFS [4] 22 0x16 AFS
510 0x1FE Crash [12] 1 0x1 ACSM
512 0x200 Regelgeschwindigkeit Stufentempomat [7] 18 0x12 DME1/DDE1
514 0x202 Dimmung [10] 112 0x70 LM
517 0x205 Akustikanforderung Kombi [3] 96 0x60 Kombi
518 0x206 Steuerung Anzeige Shiftlights [1] 18 0x12 DME1
523 0x20B Memoryverstellung [6] 101 0x65 SZM_MIT_KBUS
523 0x20B Memoryverstellung [6] 109 0x6D SM_FA
524 0x20C Steuerung Lenksäule (4) 109 0x6D SM_FA
525 0x20D Position Lenksäule (5) 101 0x65 SZM_MIT_KBUS/SZM
528 0x210 Bedienung HUD [7] 98 0x62 M_ASK/CCC_GW
529 0x211 Status HUD [7] 61 0x3D HUD
530 0x212 Höhenstände Luftfeder [8] 56 0x38 EHC
538 0x21A Lampenzustand [13] 112 0x70 LM
540 0x21C Bedienung Night-Vision [2] 98 0x62 CCC_GW
542 0x21E Status Night-Vision [2] 87 0x57 NVC
550 0x226 Regensensor-Wischergeschwindigkeit [8] 69 0x45 RLS
550 0x226 Regensensor-Wischergeschwindigkeit [8] 112 0x70 LM
552 0x228 Bedienung Sonderfunktion [8] 98 0x62 M_ASK/CCC_GW
552 0x228 Bedienung Sonderfunktion [8] 99 0x63 CCC_MM
554 0x22A Status BFS [10] 110 0x6E SM_BF
558 0x22E Status BFSH [7] 255 0xFF unbekannt
562 0x232 Status FAS [10] 109 0x6D SM_FA
566 0x236 Status FASH [7] 255 0xFF unbekannt
567 0x237 Status Lehnenbreitenverstellung Aktiv BF [3] 90 0x5A aLBV_BF
569 0x239 Status Lehnenbreitenverstellung Aktiv FA [3] 89 0x59 aLBV_FA
570 0x23A Status Funkschlüssel [13] 64 0x40 CAS
571 0x23B Status Klima Front Erweitert [1] 120 0x78 IHKA
572 0x23C Status Bedienung Sitzkomfort FA [1] 109 0x6D SM_FA
575 0x23F Status Bedienung Sitzkomfort BF [1] 110 0x6E SM_BF
578 0x242 Status Klima Front [11] 120 0x78 IHKA
586 0x24A Status PDC [6] 100 0x64 PDC
594 0x252 Wischerstatus [8] 114 0x72 KBM
598 0x256 Challenge Passive Access [10] 64 0x40 CAS
600 0x258 Status Transmission Passive Access [4] 39 0x27 PGS
604 0x25C Bedienung Klima Zusatzprogramme [2] 98 0x62 M_ASK/CCC_GW
619 0x26B Bedienung Rollos BF [2] 255 0xFF unbekannt
620 0x26C Bedienung Rollos FA [2] 0 0x0 KGM
621 0x26D Bedienung Rollos MK [1] 255 0xFF unbekannt
622 0x26E Steuerung FH/SHD Zentrale (Komfort) [10] 64 0x40 CAS
623 0x26F Bedienung Rollos BFH [2] 255 0xFF unbekannt
624 0x270 Bedienung Rollos FAH [2] 255 0xFF unbekannt
632 0x278 Navigationsgraph [3] 98 0x62 CCC_GW
634 0x27A Synchronisation Navigationsgraph [4] 98 0x62 CCC_GW
638 0x27E Status Verdeck Cabrio [7] 36 0x24 CVM_V
644 0x284 Steuerung Fernstart Sicherheitsfahrzeug [8] 64 0x40 CAS
645 0x285 Steuerung Rollos [3] 101 0x65 SZM_MIT_KBUS/SZM
652 0x28C Bedienung Taster Vertikaldynamik [2] 94 0x5E GWS
656 0x290 Steuerung Reaktion Wasserstoff-Fahrzeug [1] 255 0xFF unbekannt
658 0x292 Steuerung Fernlicht-Assistent [2] 95 0x5F FLA
671 0x29F Fernbedienung FondCommander [5] 64 0x40 CAS
672 0x2A0 Steuerung Zentralverriegelung [10] 64 0x40 CAS
674 0x2A2 Bedienung Klima Standfunktionen [5] 98 0x62 M_ASK/CCC_GW
676 0x2A4 Bedienung Personalisierung [8] 98 0x62 M_ASK/CCC_GW
678 0x2A6 Bedienung Wischertaster [12] 2 0x2 SZL_LWS
690 0x2B2 Raddrücke K-CAN [1] 41 0x29 DXC_RB/DSC_RB/DSC_CT
691 0x2B3 Beschleunigungsdaten [2] 41 0x29 DXC_RB/DSC_RB/DSC_CT
692 0x2B4 DWA-Alarm [4] 65 0x41 DWA
694 0x2B6 Steuerung Hupe DWA [3] 65 0x41 DWA
696 0x2B8 Bedienung Bordcomputer [3] 98 0x62 M_ASK/CCC_GW
698 0x2BA Stoppuhr (3) 96 0x60 Kombi
704 0x2C0 LCD-Leuchtdichte [7] 96 0x60 Kombi
714 0x2CA Außentemperatur [9] 96 0x60 Kombi
718 0x2CE Steuerung Monitor [4] 98 0x62 M_ASK/CCC_GW
725 0x2D5 Status Heizung Heckscheibe [1] 120 0x78 IHKA
730 0x2DA Status Heckklappenlift [2] 107 0x6B HKL
738 0x2E2 Status Einstellung Video Night-Vision [1] 87 0x57 NVC
740 0x2E4 Status Anhänger (8) 113 0x71 AHM
742 0x2E6 Status Klima Luftverteilung FA [13] 120 0x78 IHKA
746 0x2EA Status Klima Luftverteilung BF [9] 120 0x78 IHKA
748 0x2EC Status Klima SH/ZH Zusatzwasserpumpe [14] 122 0x7A SH_ZH
750 0x2EE Status Klima Zusatzprogramme [2] 120 0x78 IHKA
752 0x2F0 Status Klima Standfunktionen [12] 120 0x78 IHKA
756 0x2F4 Steuerung Klima SH/ZH Zusatzwasserpumpe [13] 120 0x78 IHKA
758 0x2F6 Steuerung Licht [7] 114 0x72 KBM
759 0x2F7 Einheiten [10] 98 0x62 M_ASK/CCC_GW
759 0x2F7 Einheiten [10] 99 0x63 CCC_MM
760 0x2F8 Uhrzeit/Datum [12] 96 0x60 Kombi
762 0x2FA Sitzbelegung Gurtkontakte (14) 1 0x1 ACSM
764 0x2FC ZV und Klappenzustand [11] 64 0x40 CAS
772 0x304 Status Gang [13] 24 0x18 SMG_M/SMG/EGS_MECH+NAVI/EGS_MECH/DKG
774 0x306 Fahrzeugneigung [2] 112 0x70 LM
776 0x308 Status MSA [2] 18 0x12 DME1/DDE1
784 0x310 Außentemperatur/Relativzeit [10] 96 0x60 Kombi
785 0x311 Nachtankmenge [3] 96 0x60 Kombi
786 0x312 Service Call Teleservice [2] 96 0x60 Kombi
787 0x313 Status Service Call Teleservice [3] 54 0x36 TEL_BPI
787 0x313 Status Service Call Teleservice [3] 98 0x62 M_ASK/CCC_GW
788 0x314 Status Fahrlicht [9] 69 0x45 RLS
788 0x314 Status Fahrlicht [9] 112 0x70 LM
789 0x315 Fahrzeugmodus [7] 101 0x65 SZM_MIT_KBUS/SZM
791 0x317 Bedienung Taster PDC [1] 101 0x65 SZM_MIT_KBUS/SZM
792 0x318 Status Antennen Passive Access [7] 39 0x27 PGS
793 0x319 Bedienung Taster RDC [4] 101 0x65 SZM
796 0x31C Status Reifendruck [6] 32 0x20 RDC
797 0x31D Status Reifenpannenanzeige [6] 41 0x29 DXC_RB/DSC_RB/DSC_CT
802 0x322 Dämpferstrom [2] 57 0x39 EDCK_Modul
806 0x326 Status Dämpferprogramm [9] 57 0x39 EDCK_Modul
808 0x328 Relativzeit [9] 96 0x60 Kombi
810 0x32A Steuerung ALC [2] 112 0x70 LM
813 0x32D Anzeige HDC [3] 41 0x29 DXC_RB
814 0x32E Status Klima Interne Regelinfo [6] 120 0x78 IHKA
816 0x330 Kilometerstand/Reichweite [5] 96 0x60 Kombi
817 0x331 Programmierung Stufentempomat [2] 98 0x62 M_ASK/CCC_GW
818 0x332 Fahreranzeige Drehzahlbereich [4] 18 0x12 DME1/DDE1
821 0x335 Status Elektrische Kraftstoffpumpe [3] 23 0x17 EKP
822 0x336 Anzeige Checkcontrol-Meldung (Rolle) [3] 96 0x60 Kombi
823 0x337 Status Kraftstoffregelung DME [1] 18 0x12 DME1
824 0x338 Steuerung Anzeige Checkcontrol-Meldung [7] 96 0x60 Kombi
825 0x339 Status Anzeige Funktionen Extern [1] 98 0x62 M_ASK/CCC_GW
826 0x33A Status Monitor Front [3] 115 0x73 CID_C_H/CID_C
840 0x348 Übereinstimmung Navigationsgraph [4] 98 0x62 CCC_GW
842 0x34A Navigation GPS 1 [5] 98 0x62 CCC_GW
843 0x34B Status Sitzlehnenverriegelung FA (3) 101 0x65 SZM_MIT_KBUS
843 0x34B Status Sitzlehnenverriegelung FA (3) 109 0x6D SM_FA
844 0x34C Navigation GPS 2 [5] 98 0x62 CCC_GW
845 0x34D Status Sitzlehnenverriegelung BF [2] 101 0x65 SZM_MIT_KBUS
845 0x34D Status Sitzlehnenverriegelung BF [2] 110 0x6E SM_BF
846 0x34E Navigation System Information [6] 98 0x62 CCC_GW
858 0x35A Termin Condition Based Service [2] 98 0x62 M_ASK/CCC_GW
860 0x35C Status Bordcomputer [5] 96 0x60 Kombi
862 0x35E Daten Bordcomputer (Reisedaten) [5] 96 0x60 Kombi
864 0x360 Daten Bordcomputer (Fahrtbeginn) [2] 96 0x60 Kombi
866 0x362 Daten Bordcomputer (Durchschnittswerte) [4] 96 0x60 Kombi
868 0x364 Daten Bordcomputer (Ankunft) [2] 96 0x60 Kombi
870 0x366 Anzeige Kombi/Externe Anzeige [3] 96 0x60 Kombi
871 0x367 Steuerung Anzeige Bedarfsorientierter Service [6] 96 0x60 Kombi
884 0x374 Radtoleranzabgleich [7] 41 0x29 DXC_RB/DSC_RB/DSC_CT
886 0x376 Status Verschleiß Lamelle [3] 25 0x19 VGSG
896 0x380 Fahrgestellnummer [5] 64 0x40 CAS
897 0x381 Elektronischer Motorölmessstab [10] 18 0x12 DME1/DDE1
898 0x382 Elektronischer Motorölmessstab M [1] 18 0x12 DME1/DDE1
904 0x388 Fahrzeugtyp [13] 64 0x40 CAS
910 0x38E Startdrehzahl [1] 18 0x12 DME1/DDE1
916 0x394 RDA Anfrage/Datenablage [5] 96 0x60 Kombi
917 0x395 Codierung Powermanagement [2] 64 0x40 CAS
920 0x398 Bedienung Fahrwerk [14] 98 0x62 M_ASK/CCC_GW
921 0x399 Status M-Drive [2] 18 0x12 DME1
924 0x39C EBA Datenanforderung [5] 255 0xFF unbekannt
926 0x39E Bedienung Uhrzeit/Datum [1] 98 0x62 M_ASK/CCC_GW
928 0x3A0 Fahrzeugzustand [4] 0 0x0 KGM
931 0x3A3 Anforderung Remote Services [2] 98 0x62 M_ASK/CCC_GW
940 0x3AC Nachlaufzeit Klemme 30 fehlergesteuert [2] 0 0x0 KGM
944 0x3B0 Status Gang Rückwärts [2] 112 0x70 LM
945 0x3B1 Getriebedaten 3 [2] 24 0x18 EGS_MECH/DKG
947 0x3B3 Powermanagement Verbrauchersteuerung [8] 18 0x12 DME1/DDE1
948 0x3B4 Powermanagement Batteriespannung [11] 18 0x12 DME1/DDE1
950 0x3B6 Position Fensterheber FAT [6] 0 0x0 KGM
951 0x3B7 Position Fensterheber FATH [5] 114 0x72 KBM
952 0x3B8 Position Fensterheber BFT [6] 0 0x0 KGM
953 0x3B9 Position Fensterheber BFTH [5] 114 0x72 KBM
954 0x3BA Position SHD [10] 68 0x44 SHD/MDS
958 0x3BE Nachlaufzeit Stromversorgung [5] 64 0x40 CAS
959 0x3BF Position Fensterheber Heckscheibe [1] 36 0x24 CVM_V
960 0x3C0 Konfiguration FAS [3] 109 0x6D SM_FA
961 0x3C1 Konfiguration BFS [3] 110 0x6E SM_BF
970 0x3CA Konfiguration M-Drive [2] 98 0x62 M_ASK/CCC_GW
979 0x3D3 Status Solarsensor [1] 112 0x70 LM
980 0x3D4 Konfiguration Zentralverriegelung CKM [3] 98 0x62 M_ASK/CCC_GW
981 0x3D5 Status Zentralverriegelung CKM [4] 64 0x40 CAS
982 0x3D6 Konfiguration DWA CKM [1] 98 0x62 M_ASK/CCC_GW
983 0x3D7 Status DWA CKM [2] 65 0x41 DWA
984 0x3D8 Konfiguration RLS CKM [3] 98 0x62 M_ASK/CCC_GW
985 0x3D9 Status RLS CKM [4] 69 0x45 RLS
985 0x3D9 Status RLS CKM [4] 112 0x70 LM
986 0x3DA Konfiguration Memorypositionen CKM [1] 98 0x62 M_ASK/CCC_GW
987 0x3DB Status Memorypositionen CKM [3] 101 0x65 SZM_MIT_KBUS
987 0x3DB Status Memorypositionen CKM [3] 109 0x6D SM_FA
988 0x3DC Konfiguration Licht CKM [3] 98 0x62 M_ASK/CCC_GW
989 0x3DD Status Licht CKM [4] 112 0x70 LM
990 0x3DE Konfiguration Klima CKM [5] 98 0x62 M_ASK/CCC_GW
991 0x3DF Status Klima CKM [6] 120 0x78 IHKA
992 0x3E0 Konfiguration ALC CKM [1] 98 0x62 M_ASK/CCC_GW
993 0x3E1 Status ALC CKM [1] 112 0x70 LM
994 0x3E2 Konfiguration Heckklappe CKM [1] 98 0x62 M_ASK/CCC_GW
995 0x3E3 Status Heckklappe CKM [1] 107 0x6B HKL
1001 0x3E9 Marker 1 [1] 255 0xFF unbekannt
1002 0x3EA Marker 2 [3] 126 0x7E Diagnosetool_K_CAN_System
1003 0x3EB Marker 3 [1] 125 0x7D Diagnosetool_PT_CAN
1006 0x3EE Anforderung Fehlermeldung [1] 255 0xFF unbekannt
1007 0x3EF OBD Daten Motor (3) 18 0x12 DME1/DDE1
1008 0x3F0 Konfiguration Licht Erweitert CKM [1] 98 0x62 M_ASK/CCC_GW
1009 0x3F1 Status Licht Erweitert CKM [1] 112 0x70 LM
1012 0x3F4 Konfiguration Laderaumabdeckung CKM [1] 98 0x62 M_ASK/CCC_GW
1013 0x3F5 Status Laderaumabdeckung CKM [1] 114 0x72 KBM
1022 0x3FE Anforderung CAN_Testtool SI-Bus [5] 126 0x7E Diagnosetool_K_CAN_System
1280 0x500 Datentransfer [1] 112 0x70 LM
1280 0x500 Datentransfer [1] 120 0x78 IHKA
1984 0x7C0 CAS Programmierung Bandende 1 (3) 64 0x40 CAS
1985 0x7C1 CAS Programmierung Bandende 2 (3) 255 0xFF TOOL_BANDENDE_CAS
1986 0x7C2 CAS Applikationsnachricht 1 (3) 64 0x40 CAS
1987 0x7C3 CAS Applikationsnachricht 2 (3) 255 0xFF TOOL_BANDENDE_CAS
1152 0x480 Netzwerkmanagement 0 0x0 KGM
1153 0x481 Netzwerkmanagement 1 0x1 ACSM
1154 0x482 Netzwerkmanagement 2 0x2 SZL_LWS
1170 0x492 Netzwerkmanagement 18 0x12 DDE1/DME1
1174 0x496 Netzwerkmanagement 22 0x16 AFS
1175 0x497 Netzwerkmanagement 23 0x17 EKP
1176 0x498 Netzwerkmanagement 24 0x18 DKG/EGS_MECH/EGS_MECH+NAVI/SMG/SMG_M
1177 0x499 Netzwerkmanagement 25 0x19 VGSG
1179 0x49B Netzwerkmanagement 27 0x1B VVT1
1180 0x49C Netzwerkmanagement 28 0x1C LDM
1182 0x49E Netzwerkmanagement 30 0x1E VVT2
1184 0x4A0 Netzwerkmanagement 32 0x20 RDC
1185 0x4A1 Netzwerkmanagement 33 0x21 ACC+NAVI/ACC_Modul
1187 0x4A3 Netzwerkmanagement 35 0x23 ARS_Modul
1188 0x4A4 Netzwerkmanagement 36 0x24 CVM_V
1189 0x4A5 Netzwerkmanagement 37 0x25 RSC_VDA/SC_CT/SC_VDA
1191 0x4A7 Netzwerkmanagement 39 0x27 PGS
1193 0x4A9 Netzwerkmanagement 41 0x29 DSC_CT/DSC_RB/DXC_RB
1206 0x4B6 Netzwerkmanagement 54 0x36 TEL_BPI/TEL_JAP/TEL_MULF
1207 0x4B7 Netzwerkmanagement 55 0x37 AMP_TOP
1208 0x4B8 Netzwerkmanagement 56 0x38 EHC
1209 0x4B9 Netzwerkmanagement 57 0x39 EDCK_Modul
1210 0x4BA Netzwerkmanagement 58 0x3A KHM
1211 0x4BB Netzwerkmanagement 59 0x3B JNAV
1212 0x4BC Netzwerkmanagement 60 0x3C CDC
1213 0x4BD Netzwerkmanagement 61 0x3D HUD
1216 0x4C0 Netzwerkmanagement 64 0x40 CAS
1217 0x4C1 Netzwerkmanagement 65 0x41 DWA
1220 0x4C4 Netzwerkmanagement 68 0x44 MDS/SHD
1221 0x4C5 Netzwerkmanagement 69 0x45 RLS/RLS
1227 0x4CB Netzwerkmanagement 75 0x4B VM
1232 0x4D0 Netzwerkmanagement 80 0x50 Notstrom-Sirene
1235 0x4D3 Netzwerkmanagement 83 0x53 IBOC
1236 0x4D4 Netzwerkmanagement 84 0x54 SDARS
1237 0x4D5 Netzwerkmanagement 85 0x55 ISpeechBox
1239 0x4D7 Netzwerkmanagement 87 0x57 NVC
1241 0x4D9 Netzwerkmanagement 89 0x59 aLBV_FA
1242 0x4DA Netzwerkmanagement 90 0x5A aLBV_BF
1243 0x4DB Netzwerkmanagement 91 0x5B DAB
1244 0x4DC Netzwerkmanagement 92 0x5C Behoerde
1245 0x4DD Netzwerkmanagement 93 0x5D TLC
1246 0x4DE Netzwerkmanagement 94 0x5E GWS
1247 0x4DF Netzwerkmanagement 95 0x5F FLA
1248 0x4E0 Netzwerkmanagement 96 0x60 Kombi
1250 0x4E2 Netzwerkmanagement 98 0x62 CCC_GW/M_ASK
1251 0x4E3 Netzwerkmanagement 99 0x63 CCC_MM
1252 0x4E4 Netzwerkmanagement 100 0x64 PDC
1253 0x4E5 Netzwerkmanagement 101 0x65 SZM/SZM_MIT_KBUS
1255 0x4E7 Netzwerkmanagement 103 0x67 ZBE/ZBE_LO
1259 0x4EB Netzwerkmanagement 107 0x6B HKL
1261 0x4ED Netzwerkmanagement 109 0x6D SM_FA/SM_FA_KBUS
1262 0x4EE Netzwerkmanagement 110 0x6E SM_BF/SM_BF_KBUS
1264 0x4F0 Netzwerkmanagement 112 0x70 LM/LM_ALC
1265 0x4F1 Netzwerkmanagement 113 0x71 AHM
1266 0x4F2 Netzwerkmanagement 114 0x72 KBM
1267 0x4F3 Netzwerkmanagement 115 0x73 CID_C/CID_C_H
1272 0x4F8 Netzwerkmanagement 120 0x78 IHKA
1274 0x4FA Netzwerkmanagement 122 0x7A SH_ZH
1277 0x4FD Netzwerkmanagement 125 0x7D Diagnosetool_PT_CAN
1278 0x4FE Netzwerkmanagement 126 0x7E Diagnosetool_K_CAN_System
1289 0x509 Netzwerkmanagement 137 0x89 Xenon_Scheinwerfer_Links_ALC
1290 0x50A Netzwerkmanagement 138 0x8A Xenon_Scheinwerfer_Rechts_ALC
1291 0x50B Netzwerkmanagement 139 0x8B CNV
1393 0x571 Netzwerkmanagement 241 0xF1 Diagnosedose
1408 0x580 Dienste 0 0x0 KGM
1409 0x581 Dienste 1 0x1 ACSM
1410 0x582 Dienste 2 0x2 SZL_LWS
1426 0x592 Dienste 18 0x12 DDE1/DME1
1430 0x596 Dienste 22 0x16 AFS
1431 0x597 Dienste 23 0x17 EKP
1432 0x598 Dienste 24 0x18 DKG/EGS_MECH/EGS_MECH+NAVI/SMG/SMG_M
1433 0x599 Dienste 25 0x19 VGSG
1435 0x59B Dienste 27 0x1B VVT1
1436 0x59C Dienste 28 0x1C LDM
1438 0x59E Dienste 30 0x1E VVT2
1440 0x5A0 Dienste 32 0x20 RDC
1441 0x5A1 Dienste 33 0x21 ACC+NAVI/ACC_Modul
1443 0x5A3 Dienste 35 0x23 ARS_Modul
1444 0x5A4 Dienste 36 0x24 CVM_V
1445 0x5A5 Dienste 37 0x25 RSC_VDA/SC_CT/SC_VDA
1447 0x5A7 Dienste 39 0x27 PGS
1449 0x5A9 Dienste 41 0x29 DSC_CT/DSC_RB/DXC_RB
1462 0x5B6 Dienste 54 0x36 TEL_BPI/TEL_JAP/TEL_MULF
1463 0x5B7 Dienste 55 0x37 AMP_TOP
1464 0x5B8 Dienste 56 0x38 EHC
1465 0x5B9 Dienste 57 0x39 EDCK_Modul
1466 0x5BA Dienste 58 0x3A KHM
1467 0x5BB Dienste 59 0x3B JNAV
1468 0x5BC Dienste 60 0x3C CDC
1469 0x5BD Dienste 61 0x3D HUD
1472 0x5C0 Dienste 64 0x40 CAS
1473 0x5C1 Dienste 65 0x41 DWA
1476 0x5C4 Dienste 68 0x44 MDS/SHD
1477 0x5C5 Dienste 69 0x45 RLS/RLS
1483 0x5CB Dienste 75 0x4B VM
1488 0x5D0 Dienste 80 0x50 Notstrom-Sirene
1491 0x5D3 Dienste 83 0x53 IBOC
1492 0x5D4 Dienste 84 0x54 SDARS
1493 0x5D5 Dienste 85 0x55 ISpeechBox
1495 0x5D7 Dienste 87 0x57 NVC
1497 0x5D9 Dienste 89 0x59 aLBV_FA
1498 0x5DA Dienste 90 0x5A aLBV_BF
1499 0x5DB Dienste 91 0x5B DAB
1500 0x5DC Dienste 92 0x5C Behoerde
1501 0x5DD Dienste 93 0x5D TLC
1502 0x5DE Dienste 94 0x5E GWS
1503 0x5DF Dienste 95 0x5F FLA
1504 0x5E0 Dienste 96 0x60 Kombi
1506 0x5E2 Dienste 98 0x62 CCC_GW/M_ASK
1507 0x5E3 Dienste 99 0x63 CCC_MM
1508 0x5E4 Dienste 100 0x64 PDC
1509 0x5E5 Dienste 101 0x65 SZM/SZM_MIT_KBUS
1511 0x5E7 Dienste 103 0x67 ZBE/ZBE_LO
1515 0x5EB Dienste 107 0x6B HKL
1517 0x5ED Dienste 109 0x6D SM_FA/SM_FA_KBUS
1518 0x5EE Dienste 110 0x6E SM_BF/SM_BF_KBUS
1520 0x5F0 Dienste 112 0x70 LM/LM_ALC
1521 0x5F1 Dienste 113 0x71 AHM
1522 0x5F2 Dienste 114 0x72 KBM
1523 0x5F3 Dienste 115 0x73 CID_C/CID_C_H
1528 0x5F8 Dienste 120 0x78 IHKA
1530 0x5FA Dienste 122 0x7A SH_ZH
1533 0x5FD Dienste 125 0x7D Diagnosetool_PT_CAN
1534 0x5FE Dienste 126 0x7E Diagnosetool_K_CAN_System
1545 0x609 Dienste 137 0x89 Xenon_Scheinwerfer_Links_ALC
1546 0x60A Dienste 138 0x8A Xenon_Scheinwerfer_Rechts_ALC
1547 0x60B Dienste 139 0x8B CNV
1649 0x671 Dienste 241 0xF1 Diagnosedose
4095 0xFFF unbekannt 255 0xFF Sender unbekannt

[Zeiss]

THIS is looking very promising! Now we would have to find out which CAN IDs can be found in the log of the E65. After that, we try to decode them.

[AndreyB]

please check my github for logs: https://github.com/HeinrichG-V12/E65_ReverseEngineering

Mark and Matt have a cool suggestion to remove as many fuses from the vehicle as possible to silence many of the modules we want to temporary disable. Let me go find some fuse diagram

[Zeiss]

I think, 0x192 is our "Operation gear selector switch" message. I will sniff the days again and try to find out the values in this message.

[AndreyB]

I think, 0x192 is our "Operation gear selector switch" message. I will sniff the days again and try to find out the values in this message.

Oh yes absolutely that's the one!

I am just testing my hardware setup, still a ton of message types with many fuses removed. https://github.com/rusefi/rusefi_documentation/blob/master/OEM-Docs/Bmw/2003_7_Series_e65/HeinrichG-V12-E65_ReverseEngineering/E65-760-andrey-idling-some-fuses-pulled.trc

[Zeiss]

Hey Andrey,

I briefly analyzed the traces, I noticed something.

0x1D2 (display gear data, display in combi): in your log this message has a DLC of 5, in mine 6...

0x304 (status gear): there is neither in your log nor in mine. I think this message is sent when you actually shift the gears --> test.

0x2FC (ZV and flap status, doors, hood, ...): I have opened and closed the driver's door several times.

0xBA (gearbox data): I found it in my and your logfile.
0x1A2 (gearbox data 2): I found them in my and your logfile.

I took the CAN-IDs from this list: https://www.bimmerforums.com/forum/showthread.php?2298830-E90-Can-bus-project-(E60-E65-E87-)&p=29628499#post29628499 This list is great!

EDIT: Please check my github: https://github.com/HeinrichG-V12/E65_ReverseEngineering
I looked in my documents (DBC files) and found a few more CAN IDs. The CAN-IDs in this description are original provided by BMW for E65... It may be that the same CAN-IDs are defined completely different for the other BMW vehicles.

[AndreyB]

0x1D2 (display gear data, display in combi): in your log this message has a DLC of 5, in mine 6...

Wow

I love the https://github.com/HeinrichG-V12/E65_ReverseEngineering approach and layout!

We shall spell out message frequency/period like 100ms period on 0x130 while 10ms for 0x0A9 and 20ms for 0x0B6

[Zeiss]

For the IDs I recognize, I enter Tx method (event triggered or cycle) and the cycle time.

I've added the ecu module names in my github.

At the moment I am trying to understand the 0x3B4...

EDIT: A half of 0x3B4 is done, battery voltage and engine status.

[AndreyB]

damienmaguire has three messages which loopybunny does not have:

calls 0x332 "dash on message" https://github.com/damienmaguire/BMW-E65-CANBUS/blob/master/E65_PTCAN.ino#L136

some data on 0x192 gear lever https://github.com/damienmaguire/BMW-E65-CANBUS/blob/master/E65_PTCAN.ino#L156 I am a bit confused about "R position" vs 'R+ position" and "D pressed" vs "D+ pressed"

damienmaguire also has 0x1D2 "current selected gear message" which we would be receiving from TCU

[AndreyB]

damienmaguire

Hold on, I've just realized that this is the openinverter guy?!

image.png (587.59 KiB) Viewed 19707 times

[Zeiss]

Hey Andey,

I will sniff again on the PT-CAN between the holidays, just the messages from the SZL (switch center steering wheel), I forgot it last time unfortunately. Then we know what and when will be sent. Then I will also test the handbrake.

TCU sends several messages to the instrument cluster. The SZL sends only one request, "I want to engage D", the TCU responds with an acknowledgement. Several IDs are possible, they are in the list.

[AndreyB]

Small progress: car moves with rusEFI lua doing "man in the middle" with just four non-TCU messages relayed to TCU. While car moves it shows "transmission fault" error (as opposed to "transmission malfunction" which is displayed in case of full TCU disconnect.

Only these four messages are relayed from not-TCU side into TCU

Code: Select all

CAN_BMW_E90_RPM_THROTTLE = 0x0AA
CAN_BMW_E90_IGNITION_KEY = 0x130
CAN_BMW_E65_GEAR_SELECTOR = 0x192
CAN_BMW_E90_COOLANT = 0x1D0

With the following TCU responses relayed back

Code: Select all

CAN_BMW_GEAR_TORQUE_DEMAND2 = 0x0B5
CAN_BMW_GEAR_TRANSMISSION_DATA = 0x0BA
CAN_BMW_GEAR_GEARBOX_DATA_2 = 0x1A2
CAN_BMW_GEAR_TRANSMISSION_DISP = 0x1D2
CAN_BMW_GEAR_GANG_STATUS = 0x304
CAN_BMW_GEAR_NETWORK = 0x498
CAN_BMW_GEAR_SERVICE = 0x598

next step relaying two more non-TCU messages into TCU

Code: Select all

CAN_BMW_E90_TORQUE_DEMAND = 0x0B6
CAN_BMW_E90_DASH_ON = 0x332

any other specific messages anyone would like to volunteer

next step reencoding all non-TCU messages to the best of our understanding prior to relaying to TCU, that would be a closer simulation of rusEFI ECU producing those.

lame Lua script at https://github.com/rusefi/rusefi/blob/master/firmware/config/engines/bmw_m73.cpp

image.png (84.67 KiB) Viewed 19687 times

[AndreyB]

EV The SuperYacht BMW E65 7 Series https://openinverter.org/forum/viewtopic.php?p=691 looks like it went with Toyota gearbox

https://openinverter.org/forum/viewtopic.php?p=7929#p7929

But someone did cool decompiling

Assuming this is following BN2000 stuff, which I think it is...

The entire style of code is much more irritating - they are taking two long words (64 bits or.. 8 bytes) and just messing with them.

0xBA is something to do with gearbox control, but it should be the "Automated Manual Transmission" type - AMT. Maybe it's reused for auto gearboxes on 7 series.
0xA8 is..busy. Even with IDA's decompiling there's a lot going on here. I'm going to cut out some unneeded stuff here..

Code: Select all

 v1 = a1;
  lv_im_bls = (word_30607E >> 15) & 1;
  v2 = lv_im_bls; // Brake light switch
  lv_im_bts = (word_306066 >> 15) & 1;
  v3 = lv_im_bts; // Brake light test switch (has opposite logic value of normal)
  if ( tcc_can_ecu1 >= 14 )
    v4 = 0;
  else
    v4 = tcc_can_ecu1 + 1;
  tcc_can_ecu1 = v4; // Free running alive counter
  
  bn_can_send_temp_byte6 = v4 & 0xF | bn_can_send_temp_byte6 & 0xF0;
  v5 = tq_av >> 4; // Torque "actual value" - With external CAN interventions - This is where you tell ABS / gearbox / etc that you've lowered the torque value
  bn_can_send_temp_byte5 = (v5 & 0xFF0) >> 4;
  bn_can_send_temp_byte6 = 16 * (v5 & 0xF) & 0xF0 | bn_can_send_temp_byte6 & 0xF;
  if ( lv_at )
  {
    LOBYTE(v6) = 3;
  }
  else
  {
    lv_im_cs_pn = (word_306100 >> 11) & 1;
    v6 = lv_im_cs_pn; // Clutch switch status.
  }
    bn_can_send_temp_byte2 = v6 & 3 | bn_can_send_temp_byte2 & 0xFC;
    
  // I'm assuming the car doesn't have, or we're just gonna ignore, distance cruise control for now.
  byte_3FE89E = 3;
  bn_can_send_temp_byte1 = byte_3FE89E & 3 | bn_can_send_temp_byte1 & 0xFC;
  // Assuming no anti-roll-stabalization either
  byte_3FE89F = 3;
LABEL_26:
  bn_can_send_temp_byte1 = 4 * byte_3FE89F & 0xC | bn_can_send_temp_byte1 & 0xF3;
 
   
   byte_3FE8A0 = 0; // Equipped with Traction Control
   bn_can_send_temp_byte1 = 16 * byte_3FE8A0 & 0x30 | bn_can_send_temp_byte1 & 0xCF;
   
  byte_3FE8A1 = 3; // Shift state? We're gonna say not automatic, not AMT. If wanting to set auto, try 0.
LABEL_53:
  bn_can_send_temp_byte1 = (byte_3FE8A1 << 6) & 0xC0 | bn_can_send_temp_byte1 & 0x3F;
  
  bn_can_send_temp_byte4 = sf_tqd & 0xF | bn_can_send_temp_byte4 & 0xF0;
  tq_maf = add_r3_r4_min_neg_32768_max_7fff(tqi_maf, tq_loss);
  if ( tq_maf >= tq_asr_fast_dec_bn )
    v11 = tq_asr_fast_dec_bn;
  else
    v11 = tq_maf;
  v12 = v11 >> 4;
  bn_can_send_temp_byte4 = 16 * (v12 & 0xF) & 0xF0 | bn_can_send_temp_byte4 & 0xF;
  bn_can_send_temp_byte3 = (v12 & 0xFF0) >> 4;
  
  // Brake light switch logic:
  
    if ( lv_err_bls_plaus )
  {
    v13 = 7;
LABEL_66:
    v15 = v13;
    goto LABEL_67;
  }
  if ( !v3 )
  {
    if ( !v2 )
    {
      v13 = 0;
      goto LABEL_66;
    }
    v14 = 1;
    goto LABEL_64;
  }
  if ( v2 )
  {
    v14 = 3;
LABEL_64:
    v15 = v14;
    goto LABEL_67;
  }
  v15 = 2;
  
LABEL_67:
  bn_can_send_temp_byte0 = 32 * v15 & 0xE0 | bn_can_send_temp_byte0 & 0x1F;
  bn_can_send_temp_byte0 = state_diag_gs & 0x1F | bn_can_send_temp_byte0 & 0xE0;
  bn_can_send_temp_byte7 = 0;
  result = can_checksum_calc(v1, &bn_can_send_temp_byte7, 8, 1);
  cks_clc_ecu1 = result;
  bn_can_send_temp_byte7 = result;
  return result;
}

0xA9 is not as bad, but still bad:

Code: Select all

int __fastcall can_send_0xa9_bn_ecu_2(int a1)
{
  int v1; // r30@1
  char v2; // r4@1
  char v3; // r4@6
  int v4; // r5@8
  int v5; // r3@8
  int v6; // r3@8
  int result; // r3@8

  v1 = a1;
  v2 = lv_puc; // lv_puc = trailing throttle fuel cutoff
  if ( !lv_puc && lv_tq_dcc_inc_req && tqi_dcc_fast_inc < tqi_ref_iga_min_lamb )
    v2 = 2; // If not trailing fuel cutoff, and there's a torque increase request from the distance cruise control, and the amount it's asking for is less than the reference torque * minimum spark * lambda efficiency...
  bn_can_send_temp_byte6 = (v2 << 6) & 0xC0 | bn_can_send_temp_byte6 & 0x3F;
  if ( tcc_can_ecu2 >= 14 )
    v3 = 0;
  else
    v3 = tcc_can_ecu2 + 1;
  tcc_can_ecu2 = v3;// Free running alive counter
  bn_can_send_temp_byte6 = v3 & 0xF | bn_can_send_temp_byte6 & 0xF0;  
  lv_level_is = n_sp_is <= c_n_sp_is_thd_can; // Logical variable Idle Speed Level? Something about the Engine Idle Setpoint is less than..something that's 0 in this ECU. So that's probably going to be 0?
  bn_can_send_temp_byte6 = 16 * lv_level_is & 0x30 | bn_can_send_temp_byte6 & 0xCF;
  
  bn_can_send_temp_byte5 = tq_loss >> 4;
  bn_can_send_temp_byte4 = (((tq_loss >> 4) & 0xF00) >> 8) & 0xF | bn_can_send_temp_byte4 & 0xF0;
  
  v4 = tq_max_clu >> 4; // Max clutch torque
  bn_can_send_temp_byte4 = 16 * (v4 & 0xF) & 0xF0 | bn_can_send_temp_byte4 & 0xF;
  bn_can_send_temp_byte3 = (v4 & 0xFF0) >> 4;
  
  v5 = add_r3_r4_min_neg_32768_max_7fff(tqi_ref_iga_min_lamb, tq_loss) >> 4;
  bn_can_send_temp_byte2 = v5; // tq_min I assume.
  bn_can_send_temp_byte1 = ((v5 & 0xF00) >> 8) & 0xF | bn_can_send_temp_byte1 & 0xF0;
  
  v6 = tq_maf >> 4; // Torque from airflow
  bn_can_send_temp_byte1 = 16 * (v6 & 0xF) & 0xF0 | bn_can_send_temp_byte1 & 0xF;
  bn_can_send_temp_byte0 = (v6 & 0xFF0) >> 4;
  bn_can_send_temp_byte7 = 0;
  result = can_checksum_calc(v1, &bn_can_send_temp_byte7, 8, 1);
  cks_clc_ecu2 = result;
  bn_can_send_temp_byte7 = result;
  return result;
}

Traction control: 0xB6 - EDIT - Not 0xB9 - B9 is power steering

Code: Select all

  if ( !result && !v3 )
  {
    result = 0;
    state_tcs_intv = (v1[4] >> 4) & 3;
    lv_tcs_lih_can = 0; // Logical Variable TCS Limp Home
    lv_tq_asr_req = 0; // Logi.. Anti-Skid request (tq reduction)
    lv_tq_msr_req = 0; // MSR Request (torque add)
    switch ( state_tcs_intv )
    {
      case 1:
        lv_tq_msr_req = 1;
        break;
      case 2:
        lv_tq_asr_req = 1;
        break;
      case 3:
        lv_tcs_lih_can = 1;
        break;
    }
    v5 = 16 * v1[2];
    v6 = 16 * ((v1[1] >> 4) | v5);
    tq_tcs_fast_bn = v6;
    if ( !lv_tq_msr_req ) // If I remember right, one of these values is just a counter unless there is an MSR request..
      v6 = 16 * (v1[3] | ((v1[4] & 0xF) << 8));
    tq_tcs_slow_bn = v6;
  }
  return result;
  

Processor is PPC in Big-Endian mode.. Sorry for this not being as clean as the other stuff, but I have zero experience with this chassis. Hopefully this at least helps move things along.

EDIT: Cleaned up this a bit, should be a little more straightforward now. (And corrected - 0xB6 != 0xB9 Oops!)

[AndreyB]

another priceless post https://openinverter.org/forum/viewtopic.php?p=8217#p8217

Should be the same as the other checksums.

This is how Motec described it (LOL):

Code: Select all

/*
 * Checksum is done as follows:
 * Sum bytes 1 to 7 and 16 bit can ID
 * Add hi byte of result to low byte
 * use low byte result as checksum WTF !!!!!!!!!
 */
canID = 0xAA;
byte1 = roll;
...
checksum =      byte1 + byte2 + byte3 + byte4 + byte5 + byte6 + byte7 + canID;
checksum = (checksum / 0x100) + (checksum & 0xff);
checksum = checksum & 0xff;

Probably a better way to do that. But that's what they came up with for another BN2000 based vehicle.

That's pretty much what the assembly is doing:

Code: Select all

int __fastcall can_checksum_calc(int a1, int a2, int a3, int a4)
{
  int *mailbox_struct; // r7@1
  int v5; // r3@1
  int v6; // r6@2
  int i; // r7@4
  __int16 v8; // r4@6

  mailbox_struct = &can_routine_table[6 * a1];
  v5 = *(mailbox_struct + 0x15);
  if ( a4 )
    v6 = mailbox_struct[3]; // This is the can ID like 0xAA, etc.
  else
    LOWORD(v6) = 0;
  for ( i = 0; i < v5; i = (i + 1) & 0xFF )
    LOWORD(v6) = v6 + *(a2 + i);
  v8 = (v6 >> 8) + v6;
  if ( a3 == 4 )
    LOBYTE(v8) = (((((v6 >> 8) + v6) & 0xFF) >> 4) + ((BYTE2(v6) + v6) & 0xF)) & 0xF;
  return v8;
  

[AndreyB]

damienmaguire has three messages which loopybunny does not have

looks like this work has evolved into https://github.com/damienmaguire/Stm32-vcu/blob/master/src/BMW_E65.cpp two example of that checksum algorithm there

[Zeiss]

If you want to have original BMW WDS (Wiring Diagram System), download this: click me

Download it whenever you want, unzip and start "startme.cmd", thats it.

• if you opened a schematic, you are able to zoom it in and out with mouse wheel
• if you press the left mouse button, you can move the schematic
• if you click on link (i.e. A106, X....) in diagram, you will jump to this object in navigation tree
• right click on diagram or documentation and you are able to export this

This contains original BMW schematics and other information (description, ....) and based on WDS Version 12. WDS 12 want to have IE 6 or 7, prehistorical Java version and SVG Viewer plugin from Adobe... So, I ditched the whle stuff, extract diagrams, navigation trees, descriptions and all documents from original DVD und developed a nice gui for that.

If you find some errors --> please let me know, I'll fix this.

@Andrey: please replace jar file in your installation with this one.

[AndreyB]

Google ST_TORQ_AVL and you get https://www.e90post.com/forums/showpost.php?p=27154079&postcount=137

image.png (84.81 KiB) Viewed 19338 times

image.png (52.31 KiB) Viewed 19338 times

image.png (45.91 KiB) Viewed 19338 times

Looks like Funktionsrahmen is the magic term

[AndreyB]

Google TORQ_AVL_DMEE and you get https://www.e90post.com/forums/showpost.php?p=20572760&postcount=1449

image.png (761.26 KiB) Viewed 19334 times

[AndreyB]

My five bytes of progress https://github.com/rusefi/rusefi/commit/4bc9c39044d7c8ddbd3132c3916d2049906e072d

Please add decoding examples into https://github.com/HeinrichG-V12/E65_ReverseEngineering/blob/main/docs/0x0A8.md and https://github.com/HeinrichG-V12/E65_ReverseEngineering/blob/main/docs/0x0CE.md and I will keep taking Lua forward

[AndreyB]

most recent change this September https://github.com/dzid26/opendbc-BMW-E8x-E9x/blob/master/bmw_e9x_e8x.dbc

[AndreyB]

TORQ_TAR_EGS torque target

TORQ_TAR_DSC torque target DSC

image.png (18.8 KiB) Viewed 19329 times

image.png (14.71 KiB) Viewed 19329 times

image.png (41.36 KiB) Viewed 19328 times