a8b72837b5 | ||
---|---|---|
docs | ||
pictures | ||
.gitattributes | ||
.gitignore | ||
Log1.blf | ||
Log1.zip | ||
Log2.blf | ||
Log2.zip | ||
README.md |
README.md
E65 Reverse Engineering
Reverse engineering on PT-CAN and Local-CAN of BMW E65/E66
The main goal of this project is to replace the original engine control (2x DME) with rusEFI Proteus.
The other goal is to find the CAN messages needed for the operation of the installed automatic transmission (ZF 6HP26) to be able to run the transmission stand-alone...
BMW Standard Tools installation HowTo
Messages needed for the transmission operation (source, page 80)
Signals | Transmitter | Receiver | CAN ID |
---|---|---|---|
Transmission selector switch | SZL | EGS | 0x192 |
Terminal status | CAS | EGS | 0x130 |
Central locking | CAS | EGS | 0x2FC |
Transmission data | EGS | CAS | |
Engine data | DME / DDE | EGS | 0x1D0 |
Wheel rotating speeds | DSC | EGS | 0x0CE |
Braking request | EMF | EGS | |
Transmission data display | EGS | Instr. cluster | |
Check Control message | EGS | Instr. cluster | |
Torque request | EGS | DME | 0x0B5 |
Operating voltage | Power Module | EGS | 0x3B4 |
Stationary consumers | EGS | Power Module |
CAN-IDs in PT-CAN BMW E65 with MED 9.2.1
Message name | Transmitter | CAN ID | Message status |
---|---|---|---|
Torque 1 | DME1 / DDE1 | 0x0A8 | fully decoded |
Torque 2 | DME1 / DDE1 | 0x0A9 | fully decoded |
Torque 3 | DME1 / DDE1 | 0x0AA | fully decoded |
Retard request ACC | ACC | 0x0AD | TBD, partially decoded |
Torque request EGS | EGS | 0x0B5 | fully decoded |
Torque request DSC | DSC | 0x0B6 | fully decoded |
Torque request ACC | ACC | 0x0B7 | fully decoded |
Transmission data 1 | EGS | 0x0BA | fully decoded |
Steering wheel angle | SZL | 0x0C4 | TBD, partially decoded |
Yaw request 2 | 0x0CA | TBD | |
Yaw answer 2 | 0x0CB | TBD | |
Wheel speed | DSC | 0x0CE | fully decoded |
Terminal status | CAS | 0x130 | fully decoded |
Display ACC | ACC | 0x190 | TBD |
Operation transmission selector switch | SZL | 0x192 | TBD, partially decoded |
Operation cruise control / ACC | SZL | 0x194 | fully decoded |
Status DSC | DSC | 0x19E | fully decoded |
Speed | DSC | 0x1A0 | fully decoded |
Transmission data 2 | EGS | 0x1A2 | fully decoded |
Status ARS | ARS | 0x1AC | fully decoded |
Status instrument cluster | Kombi | 0x1B4 | fully decoded |
Engine data 1 | DME | 0x1D0 | fully decoded |
Display gearbox data | EGS | 0x1D2 | TBD |
Speed cruise control | DME | 0x200 | TBD, partially decoded |
Damper current | EDC-K | 0x322 | TBD |
Status damper programm | EDC-K | 0x326 | TBD, partially decoded |
Mileage | Kombi | 0x330 | fully decoded |
Display RPM range | DME | 0x332 | fully decoded |
Power management charge voltage | PM | 0x334 | fully decoded |
Vehicle identification number | CAS | 0x380 | fully decoded |
Electronic engine oil dipstick | DME | 0x381 | TBD, partially decoded |
Vehicle type | CAS | 0x388 | TBD, partially decoded |
Starting speed | DME | 0x38E | fully decoded |
Operation chasis | 0x398 | TBD | |
Power management battery voltage | PM | 0x3B4 | fully decoded |
Module names:
- ACC: active cruise control
- CC: cruise control
- DME: digital motor electronic (gasoline engine)
- DDE: digital diesel electronic (diesel engine)
- EGS: electronic transmission control
- CAS: car access system
- DSC: dynamic stability control
- SZL: switch center steering wheel
- EMF: electromechanical parking brake
- Kombi: instrument cluster
- PM: power module
- EDC-K: electronical damper control