E65 Reverse Engineering

Reverse engineering on PT-CAN and Local-CAN of BMW E65/E66

CAN-IDs in PT-CAN BMW E65 with MED 9.2.1

The information about the CAN messages and signals was taken from the original Bosch document that I found in a forum on the Internet. They were compared with my own BMW 760Li year of construction 09/2006 model year 2007. This car has a MED 9.2.1 installed, a further development of a MED 9.2 that was used with the E65 V8.

Message name	Transmitter	CAN ID	Message status
Torque 1	DME1 / DDE1	0x0A8	fully decoded
Torque 2	DME1 / DDE1	0x0A9	fully decoded
Torque 3	DME1 / DDE1	0x0AA	fully decoded
Retard request ACC	ACC	0x0AD	TBD, partially decoded
Torque request EGS	EGS	0x0B5	fully decoded
Torque request DSC	DSC	0x0B6	fully decoded
Torque request ACC	ACC	0x0B7	fully decoded
Transmission data 1	EGS	0x0BA	fully decoded
Steering wheel angle	SZL	0x0C4	TBD, partially decoded
Yaw request 2		0x0CA	TBD
Yaw answer 2		0x0CB	TBD
Wheel speed	DSC	0x0CE	fully decoded
Terminal status	CAS	0x130	fully decoded
Display ACC	ACC	0x190	TBD
Operation transmission selector switch	SZL	0x192	TBD, partially decoded
Operation cruise control / ACC	SZL	0x194	fully decoded
Status DSC	DSC	0x19E	fully decoded
Speed	DSC	0x1A0	fully decoded
Transmission data 2	EGS	0x1A2	fully decoded
Status ARS	ARS	0x1AC	fully decoded
Status instrument cluster	Kombi	0x1B4	fully decoded
Heat flow air condition	Ihka	0x1B5	fully decoded
Heat flow engine	DME	0x1B6	fully decoded
Engine data 1	DME	0x1D0	fully decoded
Display gearbox data	EGS	0x1D2	TBD
Speed cruise control	DME	0x200	TBD, partially decoded
Outside temperature / relative time	Kombi	0x310	fully decoded
Damper current	EDC-K	0x322	TBD
Status damper programm	EDC-K	0x326	TBD, partially decoded
Mileage	Kombi	0x330	fully decoded
Display RPM range	DME	0x332	fully decoded
Power management charge voltage	PM	0x334	fully decoded
Vehicle identification number	CAS	0x380	fully decoded
Electronic engine oil dipstick	DME	0x381	TBD, partially decoded
Vehicle type	CAS	0x388	TBD, partially decoded
Starting speed	DME	0x38E	fully decoded
Operation chasis		0x398	TBD
Power management battery voltage	PM	0x3B4	fully decoded

Module names:

• ACC: active cruise control
• CC: cruise control
• DME: digital motor electronic (gasoline engine)
• DDE: digital diesel electronic (diesel engine)
• EGS: electronic transmission control
• CAS: car access system
• DSC: dynamic stability control
• SZL: switch center steering wheel
• EMF: electromechanical parking brake
• Kombi: instrument cluster
• PM: power module
• EDC-K: electronical damper control

Some interesting links:

• BMW Standard Tools installation HowTo
• https://www.e90post.com/forums/showthread.php?t=177272&page=7
• https://github.com/commaai/opendbc
• http://bobodyne.com/web-docs/robots/MINI/CAN/Presentation/index.html
• https://www.maxxecu.com/webhelp/advanced-bmw_dct-can_protocol.html

Messages needed for the transmission operation (source, page 80)

Signals	Transmitter	Receiver	CAN ID
Transmission selector switch	SZL	EGS	0x192
Terminal status	CAS	EGS	0x130
Central locking	CAS	EGS	0x2FC
Transmission data	EGS	CAS
Engine data	DME / DDE	EGS	0x1D0
Wheel rotating speeds	DSC	EGS	0x0CE
Braking request	EMF	EGS
Transmission data display	EGS	Instr. cluster
Check Control message	EGS	Instr. cluster
Torque request	EGS	DME	0x0B5
Operating voltage	Power Module	EGS	0x3B4
Stationary consumers	EGS	Power Module