The SECRET Ingredient!

Introduction

The modern automobile may have as many as 70 electronic control units (ECU) for various subsystems. They control practically every aspect of vehicle operation ranging from the engine, the transmission, the anti-lock braking system, the entertainment system and even the seats!. The diagram shown is an excerpt from the BMW G29 General Vehicle Electronics technical training publication. It details the controller modules and their communication busses located throughout the vehicle. Of particular note are the ZGM (Central Gateway Module), the DME (Digital Motor Electronics), the BDC (Body Domain Controller) as well as their connected D-CAN (Diagnostic CAN) and PT-CAN (Powertrain CAN) busses.

For the sections to follow, a cursory knowledge of the CAN Bus protocol and the OBD-II protocol is highly recommended. The following is a list of resources for information on these protocols:

BMW PT-CAN

The PT-CAN Bus is the primary bus used to communicate powertrain related data between subsystems throughout the vehicle. One simple example would be the DME publishes information like engine rpm and engine coolant temperature onto the PT-CAN Bus so that other modules like the Gauge Cluster (KOMBI) can display the information.

After connecting a CAN Bus interface to the PT-CAN, the message traffic on the bus can be monitored and recorded. The recorded message traffic can then be analyzed to break down the messages and develop data maps to information of interest.

Once the PT-CAN Bus messages have been mapped, the maps can be used by CAN connected devices to create supplemental data displays (Secondary Dashboards) and to create vehicle data recorders. These supplemental data displays and vehicle data recorders are extremely popular in motorsports applications.

The CAN Bus interface that we use is a RaceCapture Track Mk2 from AutoSport Labs. For details on how to interface a CAN device into the G29/J29 PT-CAN Bus, refer to our RaceCapture Integration page.

PT-CAN Bus Mapped Messages - G29/J29

Sample PT-CAN Message Processing

Below is a sample of the PT-CAN Bus Message for Engine Coolant Temperature:

CAN ID	PAYLOAD
`0x3F9`	`0x4E`	`0xFE`	`0x82`	`0x3E`	`0x81`	`0x88`	`0x33`	`0xA3`
	Not Mapped				Coolant Temp	Oil Temp	Gear	Max RPM

The data of interest has an offset of 4, with a length of 1: 0x81

The data is then scaled using the following calculation: 0x81 * 1.0 / 1.0 - 48.0

The result is an Engine Coolant Temperature of 81 °C (177.8 °F)

BMW D-CAN (OBD-II Standard PIDs)

The CAN Bus Diagram for the G29/J29 platform shows that the D-CAN (OBD-II Port) is connected to the ZGM (Central Gateway Module) and shares no connection with any other modules. Because of this, OBD service requests are marshaled through the ZGM for processing and routing.

OBD-II Standard PID requests are handled and processed by the ZGM in accordance with the OBD-II protocol standard referenced earlier.

OBD-II Standard PIDs - G29/J29

OBD-II Standard PID Request

Below is a sample of an OBD-II Standard PID Request Message for Engine Coolant Temperature:

CAN ID	PAYLOAD
`0x7DF`	`0x02`	`0x01`	`0x05`	`0xCC`	`0xCC`	`0xCC`	`0xCC`	`0xCC`
SAE Standard	Bytes to Follow	OBD-II Service Request	PID Request	Not Used

OBD-II Standard PID Response Processing

Below is a sample of the OBD-II Standard PID Response Message for Engine Coolant Temperature:

CAN ID	PAYLOAD
`0x7E8`	`0x03`	`0x41`	`0x05`	`0x79`	`0xCC`	`0xCC`	`0xCC`	`0xCC`
SAE Standard	Bytes to Follow	OBD-II Service Response	PID Response	PID Response Data	Not Used

The data of interest has an offset of 3, with a length of 1: 0x79

The data is then scaled using the following calculation: 0x79 * 1.0 / 1.0 - 40.0

The result is an Engine Coolant Temperature of 81 °C (177.8 °F)

BMW D-CAN (OBD-II Enhanced PIDs)

As discussed in the previous section, OBD service requests are marshaled through the ZGM for processing and routing. Unlike the Standardized nature of OBD Service 0x01, OBD service 0x22 is manufacturer specific. Modern BMW vehicles (F & G Series) utilize ISO 15765-2 (ISO-TP) extended addressing along with multi frame messaging to perform OBD Service 0x22 queries.

Analysis of OBD Service 0x22 message traffic has identified that BMW has implemented ISO-TP extended addressing as follows:

Query and response messages have a base CAN ID of 0x600.
The transmitting module address is added to the base CAN ID to create a functional CAN ID.
The destination module address is prepended to the CAN-TP Header in the fist byte of the message payload as specified by the ISO-TP standard.
The remaining portion of the message payload contains the data length, service request, PID and data values as specified by the ISO-TP standard.

NOTE: The implementation of extended addressing requires the ability to process multi frame responses for query return data types that are over 24-bits in length.

Sample BMW Enhanced PID Request

Below is a sample of the BMW Enhanced PID Request Message for Engine Coolant Temperature:

CAN ID	PAYLOAD
`0x6F1`	`0x12`	`0x03`	`0x22`	`0x43`	`0x00`	`0xCC`	`0xCC`	`0xCC`
0x600 + Source Address (0xF1)	Destination Address	Bytes to Follow	OBD-II Service Request	16 Bit Service 0x22 PID		Not Used
(OBD)	(DME)	Typical Service 0x22 Request Message Payload

Sample BMW Enhanced PID Response Processing

Below is a sample of the BMW Enhanced PID Response Message for Engine Coolant Temperature:

CAN ID	PAYLOAD
`0x612`	`0xF1`	`0x05`	`0x62`	`0x43`	`0x00`	`0x0D`	`0xBA`	`0xCC`
0x600 + Source Address (0x12)	Destination Address	Bytes to Follow	OBD-II Service Response	16 Bit Service 0x22 PID		PID Return Data		Not Used
(DME)	(OBD)	Typical Service 0x22 Request Message Payload

The data of interest has an offset of 5, with a length of 2: 0x0D 0xBA

The data is then scaled using the following calculation: 0x0DBA * 0.1 / 1.0 - 273.14

The result is an Engine Coolant Temperature of 80.96 °C (177.73 °F)