Forums

Guest
Welcome Guest, posting in this forum require registration. Username Password Remember me

Torque » Torque OBD ECU Scanner » Torque Discussion / Ideas » [Research] BMW PIDs

Pages: [1] 2 3 4 5

Author	Topic: [Research] BMW PIDs

FntX

Member
Posts: 53

[Solved] BMW PIDs
on: July 30, 2015 (GMT)

The mistery is solved

N47 (2007-2009 Diesel Engines)

Vehicle profile ELM327 config:

AT PB E1 01\nAT CRA 612\nAT SH 6F1\nAT FC SH 6F1\nAT FC SD 12 30 0F 02\nAT FC SM1\nAT CEA 12\nAT CM 600\nAT H1\nAT SP B\nAT BI

Most useful PIDs:

Oil Temp: 2C100458 –> °C : B
Oil Age: 2C10044C –> KM : B and C
Oil Level avg: 2C10044D –> % : B [calculation unclear]
Oil Level: 2C10044E –> see “Oil Level avg”
Engine Temp: 2C100AF1 –> °C : B
Mileage: 2C1005DD –> KM : B
Fuel Level: 2C100384 –> L : B

**NOTE: “A” is not suitable because the result is always lead by 6C10

(I’m currently working out the adaption values to reflect the actual result. Stay tuned!)

All the other stuff:

Abgasdruck vor Partikelfilter 2C100420
Abgasdruck vor Turbine 2C100C94
Abgasgegendruck vor Partikelfilter – korrigiert 2C1003F0
Abgastemperatur nach AGR-K?hler 2C100776
Abgastemperatur vor dem Kat (Spannungswert) 2C10041F
Abgastemperatur vor dem Katalysator – korrigierte Wert 2C10041E
Abgastemperatur vor dem Katalysator, 2C10042C
Abgastemperatur vor dem Partikelfilter 2C10042E
Abgastemperatur vor dem Partikelfilter (Spannungswert) 2C10041D
Abgastemperatur vor Partikelfilter – korrigierte Wert 2C10041B
Absolutdruck vor Partikelfilter 2C100432
Absoluter Druck vor der Turbine 2C1003E0
Akkumulierte Betriebszeit der Regenerationen 2C1003DF
Aktuelles Motormoment 2C1007D1
Anzahl erfolgreicher Partikelfilterregenerationen 2C100407
Aschekorrekturwert vom vorherigen Zyklus 2C100409
Aschemasse 2C1003E9
Aufnahme 2C10000F
Ausgangstastverhaeltnis, Drosselklappe vor Korrektur 2C100011
Basis-Ladedruck-Sollwert 2C1001F7
Basis-Ladedruck-Sollwert (Niederdruckstufe) 2C1001F8
Batteriespannung 2C10012C
Batteriespannung Sensor 2C100042
Berechnete Restlaufleistung des Partikelfilters 2C100BA4
Betriebszeit seit dem letzten erfolgreichen Regeneration 2C100408
Bremsunterdruck 2C101069
Bremsunterdruck linearisierter Sensorwert 2C101068
Bremsunterdruck Spannungsrohwert des Sensors 2C10106A
Correctionvalue Ausschalten 2C1001B0
Differenzdruck auf dem Partikelfilter 2C10043C
Differenzdruck durch die Partikel -Filter gemessen 2C10043A
Digital gefilterter Wert der gemessenen Ru?masse 2C10040A
Drehzahl der Vorf?rderpumpe 2C1005DE
Drosselklappe Position Istwert korrigiert 2C100045
Drosselklappe Solltastverhaeltnis 2C10004C
Druck stromaufw?rts der Partikelmessung 2C10043B
Druck vor der Turbine 2C100C9C
Druck vor der Turbine 2C10043E
Durchschnittliche Regenerationsintervall 2C1003F3
Durchschnittlicher Verbrauch des Fahrzeuges seit letztem DPF Tausch 2C100402
Durchschnittsgeschwindigkeit seit der letzten erfolgreichen Regeneration 2C1003DE
Eingelegter Gang 2C1009F7
Einspritzmenge aktueller Wert 2C100500
Einspritzmenge Rohwert 2C100502
Einspritzmenge Sollwert ohne Mengenausgleichsregelung 2C100501
Einspritzvolumen der Voreinspritzung 1 nach Mengenabgleich 2C1004B0
Entfernung F?higkeit Grenze Beginnen 2C1001B1
Erfasste Batteriespannung 2C10012D
Fahrerwunsch Rohwert 2C100168
Fahrzeuggeschwindigkeit 2C10000D
Fahrzeuglaufleistung bei der letzten Regeneration 2C1003FD
F?llstandsmotor?l 2C100454
Gefahrene Strecke seit der letzten erfolgreichen Regeneration 2C1003EB
Gefilterten Generatormoment Absolut Ausgangs 2C100E10
Gefilterter Differenzdruck des Partikelfilters 2C100426
Generatorstrom 2C1001BC
Gesamte NOx-Beladungsmasse des NSC 2C10138C
Gesamte Schwefelmasse 2C10138A
Gesamter HFM-Luftmassenstrom 2C100708
Kilometerstand 2C1005DD
Kontinuierlich simulierte Partikelmasse 2C100406
Korrigierte Partikelmasse Additiv 2C100405
Korrigierter Absolutgegendruck des Partikelfilters 2C100430
Korrigierter Differenzdruck 2C100424
Kraftstoffmenge Zugeteilten Bonus 2C100451
Kraftstofftemperatur 2C100385
Kraftstoffvorf?rderdruck gefiltert 2C1002DC
Kraftstoffvorf?rderdruck Sensorwert 2C1002DA
K?hlmitteltemperatur 2C100547
K?hlmitteltemperatur 2C100005
K?hlmitteltemperatur Spannungsrohwert des Sensors 2C100546
Ladedruck -Sollwert 2C10000B
Ladedrucksollwert 2C1001F4
Ladedruck-Sollwert (Niederdruckstufe) 2C1001F6
Ladedruck-Steueranteil der Stellgr??e 2C100203
Ladelufttemperatur nach Ladeluftk?hler 2C10076F
Lambdasensor Signal Oxygen Sensor V Bank 1 Sensor 1 2C10010E
Lambdawert nach NSC 2C101389
Lambdawert vor NSC 2C101388
Lastsignal vom Generator 2C100E42
Leistung EKP gefiltert 2C100320
Luftdruck vor dem Einlassventil 2C10076D
Luftmasse pro Zylinder 2C100709
Luftmassen von HFM 2C100010
Luftmassensollwert 2C10079E
Lufttemperatur an der HFM – Position 2C100772
Lufttemperatur vor dem Verdichter 2C100C87
Meilen 2C1005DC
Mengenregelventil Ausgangstastverh?ltnis 2C1001C4
Mengenregelventil Sollwert des Ansteuerstromes 2C1001C3
Mengenregelventil Spannungsrohwert 2C1001C6
Mengenregelventil Strom-Istwert 2C1001CB
Mengenregelventil Stromsollwert von der Raildruckregelung 2C1001C2
Mengenregelventil Volumenstromsollwert der Raildruckregelung 2C1001C5
Mengenregelventil Zustand der Stellwertsteuerung 2C1001CA
Motordrehzahl 2C101881
Motordrehzahl OBD vor Korrektur 2C10000C
Motordrehzahl an der Kurbelwelle 2C1010CF
Motortemperatur 2C100AF1
Oelkilometer 2C10044C
Offset f?r Partikelfilter-Differenzdruck 2C100428
?lniveau – original 2C10044E
?lstand Mittelwert Lange Zeit 2C10044D
?ltemperatur 2C100A8C
?ltemperatur 2C100458
Pedalwertgeber 2C100049
Pedalwertgeber Sensor 2 2C10004A
Pedalwertgeberposition 2C100162
Pedalwertgebersignal 1 Spannungsrohwert 2C10015F
Pedalwertgebersignal 2 Spannungsrohwert 2C100160
Raildruck linear 2C100023
Raildruckregelung-Status des Zustandsautomaten 2C100645
Raildruckregler-Regelabweichung 2C100644
Raildruck-sollwert 2C100641
Reduktionsmittel-Schlupf seit der letzten NSC Regeneration 2C10138E
Regelabweichung des Ladedruckreglers 2C1001F9
Regelabweichung des Ladedruckreglers (Niederdruckstufe) 2C1001FA
Regenerationsstatus 2C1005AA
Regenerierung angefordert 2C100404
Rohlast an den Generator 2C100186
Rohwert des korrigierten Absolutgegendruckes 2C10042A
Ru?masse 2C1003EA
Simulierten Ru?masse 2C1003ED
Sollgeschwindigkeit FGR 2C100DE2
Sollmenge Haupteinspritzung 2C10083C
Sollwert der Einspritzmenge f?r Voreinspritzung 1 2C1004D0
Sollwert der Einspritzmenge f?r Voreinspritzung 2 2C1004D1
Sollwert des Ansteuerbeginns der Voreinspritzung 1 2C1004CF
Sollwert des Bezugswinkels f?r Ansteuerbeginn der Nacheinspritzung 1 2C1004D5
Sollwert des Bezugswinkels f?r Ansteuerbeginn der Nacheinspritzung 2 2C1004D4
Sollwert des Bezugswinkels f?r Ansteuerbeginn der Voreinspritzung 1 2C1004D2
Sollwert des Bezugswinkels f?r Ansteuerbeginn der Voreinspritzung 2 2C1004D3
Spannungsrohwert Kraftstofftemperaturf?hler 2C100386
Status – Betriebsbereich f?r die Partikelfilterdruckplausibilisierung 2C1003EF
Status – Regeneration Schloss 2C1003EE
Status – Regeneration Unterbrechung 2C1003EC
Status Freigabe der Plausibilisierung mit Umgebungsdruck 2C100448
Tankf?llstand Kraftstoff 2C100384
Tankniveau 2C100D16
Temperatur nach dem AGR-K?hler 2C100777
Temperatur nach dem Niederdruckabgask?hler 2C10077A
Temperatur vor dem Ansaugkr?mmer 2C100C91
Temperatur vor dem Ansaugkr?mmer 2C100C8F
Temperatur vor Partikelfilter 2C100434
Temperature Katalyst Bank 1, 1. Sensor 2C10003C
Temperature Katalyst Bank 1, 2. Sensor 2C10003E
Turbinendrehzahl 2C100618
Umgebungsdruck 2C100C1C
Umgebungsdruck Sensor 2C100033
Umgebungstemperatur 2C100FD2
Umgebungstemperatur 2C100046
Verbrauchte Kraftstoffmenge seit letzter erfolgreicher Regeneration 2C1003E8
Vorf?rdermenge 2C100321

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: August 18, 2015 (GMT)

I’m digging this up because through some additional research I was able to understand the stuff which is happening before – vital stuff I thought was unnecessary.

– The device filters for responses by device 612 (ECU)
– …and filters for responses with header 6F1
– It sets up for the extended address 12

So..
-> It knows out of the box that it needs to talk to “6F1” in order to reach “612” where all the magic is at.
The extended address is “12”

I tried all of the combinations (6f1 as header, 6f12c, 2c,12,…everything) but couldn’t manage to get any response.

Any ideas?

//EDIT as it seems torque needs to be modified to be able to send out 8-byte long PIDs because of the D-CAN protocol and BMW special language inside the ISO15765-2 standard and extended addressing. Although Torque is made to support custom PIDs it isn’t fully prepared for stuff like this.

A full request to the ECU would sound like this on the terminal:

6F1 12 04 2C 10 04 4D

The response would be

612 2F 10 03 6C 10 F4

The shortened variant using headers and filters is just “2C 10 04 4D” for the oil temperature.

Torque doesn’t seem to support this kind of message format at the time or I don’t understand where to put what.

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: November 11, 2015 (GMT)

I managed to set up the right ELM configuration to enable the support but unfortunately it isn’t possible to use the PIDs as display source since the PIDs can’t be larger than 6 bytes.

Here you go. This is the key into the extended PIDs for BMW e-Series type of ECU (2007+):

AT PB E1 01
AT CRA 612
AT SH 6F1
AT FC SH 6F1
AT FC SD 12 30 0F 02
AT FC SM1
AT CEA 12
AT CM 600
AT H1
AT SP B
AT BI

–> Enter this in your vehicle profile:

AT PB E1 01\nAT CRA 612\nAT SH 6F1\nAT FC SH 6F1\nAT FC SD 12 30 0F 02\nAT FC SM1\nAT CEA 12\nAT CM 600\nAT H1\nAT SP B\nAT BI

Now if you create a new “Send Command” button on your dashboard and enter “2C10044D” and press “Test Command” it succeeds and returns the value.

If only Torque would be able to send “overlength” PIDs, that would be great… 😉

piemmm

Administrator
Posts: 6073

Re: [Research] BMW PIDs
on: November 11, 2015 (GMT)

Hint received and added to the todo list

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: November 11, 2015 (GMT)

…awww this is great!
I’d be glad to beta-test it, as soon as it’s ready 😉

In the meantime I’ll go and fetch the other PIDs and post them here.

cintakc

Member
Posts: 1387

Re: [Research] BMW PIDs
on: November 20, 2015 (GMT)

Quote from FntX on July 30, 2015
Oil Level:
Command: 6F1 12 04 2C 10 04 58
Response: 612 F1 04 6C 10 31 2E

Can you give us an answer in the terminal to such a request for Engine:
Command: 6F1 12 02 1A 80

and 6F1 12 04 18 02 FF FF

thank

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: November 28, 2015 (GMT)

21A80 for the first one.

I’m sorry I can’t test this whole stuff at the moment because my precious toy was inflicted in an accident and is undergoing some cosmetic repairs at the moment…

So no guarantee on validity this time, I’m afraid

This is all header related. you need to enter the whole 8-byte string in order to get the value for the second one. This is (as far as i know) currently not supported by torque but is on the todo list (see previous post by piemmm)

For the second PID it’ll be the last 8: 18 02 FF FF
You need to specify the BMW specific header AND configuration in order to receive any data from the ECU because this mode is only meant to be triggered by official diagnostic devices!

So your first PID isn’t exactly on that super secret address room and should be readable by just entering the config I wrote before.

Just to explain what is happening, i’ll go further on and show you how the “overlength d-can” PID is thrown together:
first byte: 18 – device address
second: 02 – mode
third: actual 4-byte PID which encapsulates the module.

You might have noticed that the oil related stuff sits on the same address and this is because the sensor(s) which measure pressures, temperature, quality and level are sitting in the same compartment inside the oil sump and resemble a single device on the network.

So if you look at the whole thing: 2C 10 04 58
we are addressing on extended address 2C on mode 10 at device address 04 for the PID 58.

D-CAN, because CAN alone wasn’t complicated enough. duh.

cintakc

Member
Posts: 1387

Re: [Research] BMW PIDs
on: November 29, 2015 (GMT)

It is not very clear
take a few examples in the terminal
I am not for Torquay I write emulator
If you can link about this protocol D-CAN

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: December 3, 2015 (GMT)

It really is a “slang” of the original protocol and just uses up to 8 byte as a request. That’s all the magic, combined with the special ELM config.
I can’t post the whole communication as an example since I fear someone might trace it down.

We’re speaking of tapping licensed equipment which normally costs about 10000€

HINT: use the config I posted earlier. Without it won’t work…

cintakc

Member
Posts: 1387

Re: [Research] BMW PIDs
on: December 3, 2015 (GMT)

I do not need the whole answer, need to know the the first 4 bytes of response
you mentioned two examples, different answers, I’m confuses
http://www.loopybunny.co.uk/CarPC/k_can.html

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: December 3, 2015 (GMT)

ah well – this is easy. It usually starts at the 6th byte in this response (not counting the header 612):

FF FF

cintakc

Member
Posts: 1387

Re: [Research] BMW PIDs
on: December 3, 2015 (GMT)

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: December 9, 2015 (GMT)

I, again, completely misunderstood your question. Sorry for that!

1st) 6F1 12 02 1A 80
2nd) 6F1 12 04 18 02 FF FF

These are both requests, right? I really don’t know what these two would output and I am not eager to send any unknown commands to my ECU to test them. The only thing I know is that the second one belongs to the engine family (04 prefix).

Maybe I will stumble upon the codes when checking out the remaining functions and PIDs. I’ll let you know then…

cintakc

Member
Posts: 1387

Re: [Research] BMW PIDs
on: December 9, 2015 (GMT)

6F1 12 04 18 02 FF FF
6F1 –
12 –
04 – the number of bytes in the command
18 02 FF FF – command read errors

1A 80 – request for information on the block

but if you are afraid of, then yes, is not worth
Thank you.

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: December 11, 2015 (GMT)

If this is designed to request error codes then I will try to log the whole error code procedure of the device. I might have access to it again in January.

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: December 14, 2015 (GMT)

UPDATE:
Instead of going through the tedious process of sniffing on the wire, I cracked the database open and the result is a spreadsheet with pretty much any PID available including description (in German only but that shouldn’t be a problem…).

Now it’s only about testing them and trying to figure out how the return values are formatted, which of course is only possible as soon as the app has been updated.

Stay tuned.

cintakc

Member
Posts: 1387

Re: [Research] BMW PIDs
on: December 14, 2015 (GMT)

daVinci

Member
Posts: 2

Re: [Research] BMW PIDs
on: February 12, 2016 (GMT)

I found a thread on E46 Fanatics and this is what I was told is the oil temperature PID

EDIT – It is lot letting me post the code so I will spell it.
(Dollar sign)01 0x5c

I have to be completely honest, I do not have a clue if that is correct or even a PID format. Lets assume it is accurate. How do you use that information to start logging oil temperature?

I have Torque Pro and use it mainly in a street legal 2003 BMW 330i that sees most of its miles on the race track.
I Design and fabricate tandem bicycles and race car parts

FntX

Member
Posts: 53

Re: [Research] BMW PIDs
on: June 6, 2016 (GMT)

it’s probably this:
Engine Oil Temperature: 0x5822 -> 5822 [adaption: -40, factor: 1, °C]
or
Oil Sensor: 0x4408 -> 4408 [no adaption, factor 0.1, °C]

cintakc

Member
Posts: 1387

Re: [Research] BMW PIDs
on: June 6, 2016 (GMT)

Quote from FntX on December 11, 2015
If this is designed to request error codes then I will try to log the whole error code procedure of the device. I might have access to it again in January.

could not see

Pages: [1] 2 3 4 5

WP-Forum by: Fredrik Fahlstad, Version: 2.4
Page loaded in: 0.419 seconds.

Forums

Forums

Guest