Long story, however I have been reverse engineering the diagnostic/E-Sys messages on an F46 (same as F45/48/56 and probably common for F series) and am writing this up here as a reference in case it's useful to someone else.
I used it to write a bench programming rig using a Raspberry Pi & a couple of cheap CAN interface modules. The code isn't pretty however I can make it available if anyone is interested.
In the description below, 0x indicates a hex number.
ENET Messages
These are exchanged between ISTA/E-Sys and the ZGW over TCP/IP (ZGW TCP server port 6801)
Each message has an 8 byte header followed by the message payload.
ISTA/E-Sys use ECU ID 0xF4. The ECU IDs are shown in E-Sys next to the ECU name.
Remember that TCP is a stream rather than datagram protocol, so you can get multiple and/or split messages within a packet.
Corresponding CAN BUS Messages
The CAN BUS packets all appear to have 11 bit identifiers (i.e. 0x000 to 0x7FF) and a maximum payload of 8 bytes.
The identifier is always 0x6nn where nn is the source ECU ID. So for example, anything from ECU 0x0D will have a CAN packet ident of 0x60D.
Some packets with less than 8 bytes of actual data are padded to an 8 byte payload. Others have shorter payloads.
The first byte of the payload (for a CAN bus message ID 0x6nn) is the destination ECU ID.
The second byte of the payload (for a CAN bus message ID 0x6nn) is:
I used it to write a bench programming rig using a Raspberry Pi & a couple of cheap CAN interface modules. The code isn't pretty however I can make it available if anyone is interested.
In the description below, 0x indicates a hex number.
ENET Messages
These are exchanged between ISTA/E-Sys and the ZGW over TCP/IP (ZGW TCP server port 6801)
Each message has an 8 byte header followed by the message payload.
- Bytes 1-4: Message length INCLUDING source & destination ECU bytes, i.e. payload length + 2
- Bytes 5-6: Not sure what it is - See below
- Byte 7: Source ECU ID
- Byte 8: Destination ECU ID
ISTA/E-Sys use ECU ID 0xF4. The ECU IDs are shown in E-Sys next to the ECU name.
Remember that TCP is a stream rather than datagram protocol, so you can get multiple and/or split messages within a packet.
Corresponding CAN BUS Messages
The CAN BUS packets all appear to have 11 bit identifiers (i.e. 0x000 to 0x7FF) and a maximum payload of 8 bytes.
The identifier is always 0x6nn where nn is the source ECU ID. So for example, anything from ECU 0x0D will have a CAN packet ident of 0x60D.
Some packets with less than 8 bytes of actual data are padded to an 8 byte payload. Others have shorter payloads.
The first byte of the payload (for a CAN bus message ID 0x6nn) is the destination ECU ID.
The second byte of the payload (for a CAN bus message ID 0x6nn) is:
- 0x0n
A short message of a single CAN frame, length "n" (max 6) - 0x1n
First frame in a longer message. Message length is 0xnyy where yy is the third byte in the payload. So for example 0x11 followed by 0x02 would indicate a 0x101 = 258 byte message, which will require 44 CAN frames (the first frame will have the first 5 bytes of the message, the remaining 6 bytes each) - 0x2n
A continuation of the message.
n is the frame order number. n wraps as it has a max of 0xF = 15.
In a multiframe message, the first frame will be 0x1n and the second frame 0x21 the 0x22 and so on up to 0x2F then 0x20 - 0x30
Message 0x30 0x00 0x02 is always sent in response to a multiframe initial frame (0x1n).
The sending ECU will/must not send the continuation frames until this has been received.
This message is not relayed over ENET. It is managed by the ZGW.
- E-Sys sends to ZGW over ENET: 00 00 00 05 00 01 F4 06 22 30 00
ZGW responds to E-Sys: 00 00 00 05 00 02 06 F4 22 30 00
ZGW sends on CANBUS with ECU 06: ID 6F4 Data 06 03 22 30 00
Note that the length stated in the ENET message (05) is 2 bytes more than that in the CANBUS data because it includes the source & destination ECU IDs
- CANBUS message sent to ECU: ID 606 Data F4 10 07 10 3C 62 F1 01
This indicates a multiframe message of 07 bytes from ECU 06 to E-Sys/ISTA
ZGW responds on CANBUS: ID 6F4 Data 06 30 00 02
ECU continues with only remaining frame. ID 606 Data F4 21 01 01
ZGW sends to ISTA/E-Sys over ENET 00 00 00 09 00 01 06 F4 10 3C 62 F1 01 01 01