E65 N73 CAN bus

[Zeiss]

In this document: https://mega.nz/file/H55SwSST#ihZrrF6eQLv1-vUP3USn5kiGMfMDpIBpwXhy1B3CLO0 is ALL THE STUFF WE NEED!

The only thing missing there are the conversion formulas, but I have most of them. I have a DBC-File with all the signals, factors, offsets, units and etc, but there no can messages... so what I'm doing right now is creating the CAN messages and adding proper signals to the messages.

Check this:

grafik.png (17.49 KiB) Viewed 7762 times

And this, this is CAN-ID 0x0B5:

grafik.png (27.99 KiB) Viewed 7762 times

0x0B5 is fully decoded. I will update the DBC-File in my github and description.

Here is the CAN-ID 0x0CE:

grafik.png (8.14 KiB) Viewed 7760 times

[AndreyB]

Does anyone here speak German by any chance?

image.png (172.44 KiB) Viewed 7753 times

[Zeiss]

Where did you find this?

It is CAN message layout of 0x0A8, like this:

grafik.png (29.92 KiB) Viewed 7748 times

Very interesting is the first row in the table (Checksum_TORQ_1_DME), the calculation is described in a3)

[AndreyB]

Mark has pointed at https://view.officeapps.live.com/op/view.aspx?src=http%3A%2F%2Fwww.carx24.de%2FE65_Codes.xls&wdOrigin=BROWSELINK

[AndreyB]

I've converted Log2 to format consumed by https://github.com/brent-stone/CAN_Reverse_Engineering/

six clusters were identified the most obvious one is correlation between engine temperature and engine RPM warning

https://github.com/HeinrichG-V12/E65_ReverseEngineering/blob/main/docs/0x1D0.md https://github.com/HeinrichG-V12/E65_ReverseEngineering/blob/main/docs/0x332.md

Too much output to attach it all - figures.zip has half of the total figures

[AndreyB]

OMG it works!

Proteus+Lua+magic list of CAN messages https://github.com/rusefi/rusefi/blob/056f101dd49ddd6cb17bf781457d27cbf9ff684b/firmware/config/engines/bmw_n73.cpp#L38 to relay works: as soon as I changed onTick rate to 200hz (all onCanRx for all pending incoming messages are handled right before onTick invocation) I got a happy moving vehicle without any transmission-relayed messages on the gauge cluster.

logs https://github.com/rusefi/rusefi_documentation/blob/master/OEM-Docs/Bmw/2003_7_Series_e65/HeinrichG-V12-E65_ReverseEngineering/E65-760-andrey-2021-feb-13-proteus-in-the-middle-looks-great.trc https://github.com/rusefi/rusefi_documentation/blob/master/OEM-Docs/Bmw/2003_7_Series_e65/HeinrichG-V12-E65_ReverseEngineering/E65-760-andrey-2021-feb-13-proteus-in-the-middle-drive-around-block.trc

[AndreyB]

PS: INPA did not connect to TCU via RE as man-in-the-middle, some extra messages would need to be relayed to get that working I guess. Hopefully that would not be not hard to figure out - I would just need to see what new CAN packets appear on the bus when INPA is active.

[Zeiss]

You managed to make the gearbox happy with Proteus between the gearbox and the engine? What messages did you let through?

That's amazing! Congratulations!

[AndreyB]

You managed to make the gearbox happy with Proteus between the gearbox and the engine? What messages did you let through?

Yep exactly! The list is at https://github.com/rusefi/rusefi/blob/056f101dd49ddd6cb17bf781457d27cbf9ff684b/firmware/config/engines/bmw_n73.cpp#L38

[Zeiss]

Awesome!

EDIT: Just this lines:

CAN_BMW_E90_TORQUE_1 = 0x0A8
CAN_BMW_E90_TORQUE_2 = 0x0A9
CAN_BMW_E90_RPM_THROTTLE = 0x0AA
CAN_BMW_E90_DSC_TORQUE_DEMAND = 0x0B6
CAN_BMW_E90_WHEEL_SPEED = 0x0CE
CAN_BMW_E90_IGNITION_KEY = 0x130
CAN_BMW_E65_GEAR_SELECTOR = 0x192
CAN_BMW_E90_DSC_STATUS = 0x19E
CAN_BMW_E90_DSC_SPEED = 0x1A0
CAN_BMW_E90_COOLANT = 0x1D0
CAN_BMW_E90_LOCKING = 0x2FC
CAN_BMW_E90_MSA = 0x308
CAN_BMW_E90_DASH_ON = 0x332
CAN_BMW_E90_ECU_NETWORK = 0x492
CAN_BMW_GEAR_TORQUE_DEMAND2 = 0x0B5
CAN_BMW_GEAR_TRANSMISSION_DATA = 0x0BA
CAN_BMW_GEAR_GEARBOX_DATA_2 = 0x1A2
CAN_BMW_GEAR_TRANSMISSION_DISP = 0x1D2
CAN_BMW_GEAR_GANG_STATUS = 0x304
CAN_BMW_GEAR_NETWORK = 0x498
CAN_BMW_GEAR_SERVICE = 0x598

?

That's it?

[AndreyB]

I've got a couple of extra packet IDs when I've used INPA

TCU INPA request 0x0618 and ECU#1 0x612, with 0x6f1 maybe response from both.

Somebody on the internet says UDS and they mention 62x and 630x packets which I have no seen so far. See https://www.bimmerfest.com/threads/enet-can-diagnostic-messages-for-bench-coding.1398888/

[Zeiss]

BMW F-series are using diagnostic over ethernet, and not k-line like out E-Series.

I've just looked in my log files, I don't have 0x612 or 0x618 there. It really seems to have something to do with the diagnostics.The 0x6xx number range is for "services", it starts at 0x580.

[AndreyB]

BMW F-series are using diagnostic over ethernet, and not k-line like out E-Series.

E-Series ECU and TCU diagnostics seems to be CAN, it's gateway which does k-line translation. Might be similar story with F-series not that we care for our purposes at this point.

[AndreyB]

Another milestone: no scary messages with me re-packing https://www.loopybunny.co.uk/CarPC/can/0AA.html

Need to relay kick-down flag because I think I've lost kick-down without it Open issue - no "R/P/N" messages only see packets for forward gears for whatever reason.

https://github.com/rusefi/rusefi/commit/387e957df0c9578f1f46ad7e96ea464a33a44f79

2022-02-23_16_47_37_736: EngineState: LUA: original 69 2A 5 0 CE A 80 36
2022-02-23_16_47_37_737: EngineState: LUA: repacked 83 0 0 0 CE A 0 0

2022-02-23_16_47_37_737: EngineState: LUA: original 5A 1B 5 0 CE A 80 36
2022-02-23_16_47_37_738: EngineState: LUA: repacked 84 1 0 0 CE A 0 0

with current code I take RPM and PPS bytes, apply my own counter and apply my own checksum. Exciting!

[Zeiss]

Here is the definition of our 0x0AA message: https://github.com/HeinrichG-V12/E65_ReverseEngineering/blob/main/docs/0x0AA.md (Torque 3)