[bjornh]

Hello friends,

I'll start with the TL;DR to save you time: Does anyone know the necessary CAN codes/messages to activate a K-CAN2 based iDrive/CIC controller?

First of all; I'm not even sure I'm in the right place. So mods, If there's a better place for my question, feel free to move the thread.

So, I purchased a 'low' iDrive CIC controller like this on ebay the other day, hoping to integrate it into my good old E46. Yes - I know; there's no K-CAN network in the e46. My plan is to interface the controller with an arduino + CAN shield and connect it to a tablet. Seeing as there's a bucket load of information around on how to use these controllers on independent CAN networks, I took a chance and purchased one.

Well, suffice to say, my success has been limited so far. It turns out the unit I got was from a recent F model, which I recently discovered uses the K-CAN2 (500kbps) bus as opposed to the regular first-generation K-CAN (100kbps) that you'll find in the E9x/E6x and older Fxx.

Unfortunately all the documentation I've found so far revolves around the older K-CAN1, and it seems that the KCAN2 CON units expect different init/wakeup messages than the older KCAN1 based units. So far I've successfully lit up the controller by sending message ID 0x202 with data 0xfd 0x00 to the controller, which effectively illuminates the controller for 4-5 seconds before it goes back to sleep. I interpret this as a sign that the actual CAN communication is working like it should.

This is where my luck stops though. It won't react to any of the standard wake-up messages that the KCAN1 devices supposedly respond to. Examples I've tried:

// This works: Lights the controller up for a few seconds until it goes back to sleep
{ 0x202,  2,   { 0xfd, 0 } }

// Tried: Data request, according some obscure document 'volcano.at' referred to
{ 1272,   8,   { 0,    66,   254,  1,    255,  255,  255,  255   } };

// Tried: CIC wake-up. [URL="http://www.loopybunny.co.uk/CarPC/k_can.html"]This page[/URL] claims this is required on KCAN1, 
// but is apparently not the same for KCAN2 (Confirmed by the URL above)
msg M_CICWAKE       = { 0x273,  8,   { 0x1d, 0xe1, 0,    0xf0, 0xff, 0x7f, 0xde, 0x04  } };

// Tried: Ignition status, as described [URL="http://www.loopybunny.co.uk/CarPC/k_can.html"]here[/URL]. According to misc forum posts this should wake a KCAN1 controller, but again it does nothing for my KCAN2 controller.
msg M_CARSTARTED    = { 0x130,  5,   { 0x45, 0x40, 0x21, 0x8f, 0xfe } };

I wrote an arduino sketch to send all of these in loop every 500ms and check for messages back. So far nothing has yielded results (Apart from the illumination one)

Unfortunately I don't have access to a vehicle with a KCAN2 bus, if I did I would try to sniff and analyze the required messages myself. I was hoping someone here had already done just that.

Any guidance/advice as to what I would need to do to wake this thing up would be greatly appreciated._a__a2_

 

[kiwidave72]

Hello friends,

I'll start with the TL;DR to save you time: Does anyone know the necessary CAN codes/messages to activate a K-CAN2 based iDrive/CIC controller?

First of all; I'm not even sure I'm in the right place. So mods, If there's a better place for my question, feel free to move the thread.

So, I purchased a 'low' iDrive CIC controller like this on ebay the other day, hoping to integrate it into my good old E46. Yes - I know; there's no K-CAN network in the e46. My plan is to interface the controller with an arduino + CAN shield and connect it to a tablet. Seeing as there's a bucket load of information around on how to use these controllers on independent CAN networks, I took a chance and purchased one.

Well, suffice to say, my success has been limited so far. It turns out the unit I got was from a recent F model, which I recently discovered uses the K-CAN2 (500kbps) bus as opposed to the regular first-generation K-CAN (100kbps) that you'll find in the E9x/E6x and older Fxx.

Unfortunately all the documentation I've found so far revolves around the older K-CAN1, and it seems that the KCAN2 CON units expect different init/wakeup messages than the older KCAN1 based units. So far I've successfully lit up the controller by sending message ID 0x202 with data 0xfd 0x00 to the controller, which effectively illuminates the controller for 4-5 seconds before it goes back to sleep. I interpret this as a sign that the actual CAN communication is working like it should.

This is where my luck stops though. It won't react to any of the standard wake-up messages that the KCAN1 devices supposedly respond to. Examples I've tried:

// This works: Lights the controller up for a few seconds until it goes back to sleep
{ 0x202,  2,   { 0xfd, 0 } }

// Tried: Data request, according some obscure document 'volcano.at' referred to
{ 1272,   8,   { 0,    66,   254,  1,    255,  255,  255,  255   } };

// Tried: CIC wake-up. [URL="http://www.loopybunny.co.uk/CarPC/k_can.html"]This page[/URL] claims this is required on KCAN1, 
// but is apparently not the same for KCAN2 (Confirmed by the URL above)
msg M_CICWAKE       = { 0x273,  8,   { 0x1d, 0xe1, 0,    0xf0, 0xff, 0x7f, 0xde, 0x04  } };

// Tried: Ignition status, as described [URL="http://www.loopybunny.co.uk/CarPC/k_can.html"]here[/URL]. According to misc forum posts this should wake a KCAN1 controller, but again it does nothing for my KCAN2 controller.
msg M_CARSTARTED    = { 0x130,  5,   { 0x45, 0x40, 0x21, 0x8f, 0xfe } };

I wrote an arduino sketch to send all of these in loop every 500ms and check for messages back. So far nothing has yielded results (Apart from the illumination one)

Unfortunately I don't have access to a vehicle with a KCAN2 bus, if I did I would try to sniff and analyze the required messages myself. I was hoping someone here had already done just that.

Any guidance/advice as to what I would need to do to wake this thing up would be greatly appreciated._a__a2_

Hi,

Did you have any luck getting the controller to work for you?

Im having the same sort of issues, but not to sure what CAN type controller i have.

David

 

[shaik786]

Did you try reading messages from the controller with the bus set at 100Kbps and 500Kbps?

 

[kiwidave72]

Did you try reading messages from the controller with the bus set at 100Kbps and 500Kbps?

so tonight i had a bit of a play with the sending different commands to wake it up...and at different speeds.

after a few tires i now have a working controller ... will work on getting the rotary sending messages tomorrow.

 

[larry_bml]

Can you please tell me speed and necessary CAN message and CAN ID that you used for communicating with controller?
I'm trying to play with an F10 CIC controller too, but no luck .

Maybe you can help me.
Thank you.

 

[tatu]

Can-id

It is CAN-ID of the controller.

Controller dial=0x264
Data during 6Byte, 3Byte position value (counter)

Controller button=0x267
Data during 6Byte, 3Byte, 4Byte, 5Byte position value
(There short press and long press and release signal)

 

[randomrat]

I hate to revive an old thread, however I am also experimenting with CAN and the iDrive controller.

I have also successfully woken up the controller and I can also adjust the brightness of the controller.

What was it you did to start receiving messages from the controller as I am getting no messages. Is there something I am missing out?

 

[whueser]

Hello,
First, sorry for my bad english.
I also try to work with the bmw rotary knob outside the vehicle. but I find nowhere the codes to initialize the knob. thats why I do not receive any codes from the rotary knob.
so I would be glad if anybody of you get the communication with the rotary knob allready succsessfull working and could give me the necessary codes.
thank you in advance.

 

[Chaminda13]

Hi
Has anyone identified the Canbus code needed to initialize the Idrive controller?

 

[2real4u]

Here's what you need for ZBE3 and ZBE4

zbe3_wakeup.id = 0x0560;
zbe3_wakeup.extended = false;
zbe3_wakeup.length = 8;
zbe3_wakeup.data.byte[0]=0x00;
zbe3_wakeup.data.byte[1]=0x00;
zbe3_wakeup.data.byte[2]=0x00;
zbe3_wakeup.data.byte[3]=0x00;
zbe3_wakeup.data.byte[4]=0x57;
zbe3_wakeup.data.byte[5]=0x2F;
zbe3_wakeup.data.byte[6]=0x00;
zbe3_wakeup.data.byte[7]=0x60;

Send every second

 

[PeterOraios]

Here's what you need for ZBE3 and ZBE4

zbe3_wakeup.id = 0x0560;
zbe3_wakeup.extended = false;
zbe3_wakeup.length = 8;
zbe3_wakeup.data.byte[0]=0x00;
zbe3_wakeup.data.byte[1]=0x00;
zbe3_wakeup.data.byte[2]=0x00;
zbe3_wakeup.data.byte[3]=0x00;
zbe3_wakeup.data.byte[4]=0x57;
zbe3_wakeup.data.byte[5]=0x2F;
zbe3_wakeup.data.byte[6]=0x00;
zbe3_wakeup.data.byte[7]=0x60;

Send every second

@2real4u
Hi,
i was researching for the can-bus id's for the bmw ZBE4 controller and i stumbled at your reply.
Is there any chance to share all the init and poll id's for this controller?
And also for future troubleshooting what is the proper sequence and frequency of those messages
For example
1) InitController ID, once
2) InitTouch ID, once
3) Poll, every 1sec
4) etc

Thanks in advance.

 

[danilo081]

Did anybody finish this project?

Pm me for solution...

 

[danilo081]

I solved all of this ... will post solution for controler

 

[danilo081]

My controler 9317695
K-CAN2

Can bus Standard 11bit identifier - 500kbps [for K-CAN 100kbps ]

Pinout
1 +12 1 |*|
2 -GND 2 |*|
3 CAN HIGH 3 |*|
4 CAN LOW 4 |* |

# WAKE UP
###############################
-> 202: FD
-> 202: FD
//send it twice to wake up controler

-> 563: 63 // start sending this every 1000-1500 milisec to keep it active

# INIT
##################################
//On first reply <- "5E7: 99 01 1D 16 06 FF FF FF" respond with

-> 273: 1d e1 00 f0 ff 7f de xx

//8th byte xx takes values between 00 and FF
//I got success not sending 8th byte at all but 100% working solution is to send 4th recieved byte from 5E7 message above -> [16]
//5th byte from 5E7 = [06] - not initialized [01]-initialized
// now buttons and rotary are initialized and next 5E7: message have 5th byte = 01

# BACKLIGHT
##################################
//To regulate backlignt send

-> 202: YY

//YY is from 00 tp FD to dim
//"202 FE" wil turn light off and if you stop sending "563: 63" iDrive cotroller will go to sleep

# SLEEP
#################################
//to put controler to sleep again, stop sending -> "563: 63" and send

-> 202: FE

# BUTTON DEFINITIONS
################################
// fife butons have c0 on 5th byte
// 6th byte is button specific
// 4th byte is event specifyc

<- 267: E1 FD YY XX C0 08 AUDIO
<- 267: E1 FD YY XX C0 01 MENU
<- 267: E1 FD YY XX C0 40 TEL
<- 267: E1 FD YY XX C0 04 OPTIONS
<- 267: E1 FD YY XX C0 02 BACK

// XX - 4th byte takes values:
// 01 - press
// 02 - hold
// 00 - relese
// YY is just counter of messages goning in cycle from 00-ff and around again allways increasing

# Joystick press and directions
#################################
// Stick button have DE on 5th byte
// Direction buttons have DD on 5th byte Stick button jabe DE on 5th byte
// 4th byte is buton and event specific

## STICK-BUTTON
<- 267: e1 fd 3b 01 de 01 - press
<- 267: e1 fd 3b 02 de 01 - hold
<- 267: e1 fd 3c 00 de 01 - relese

## STICK-UP
<- 267: e1 fd 3d 11 dd 01 - press
<- 267: e1 fd 3d 12 dd 01 - hold
<- 267: e1 fd 3e 00 dd 01 - relese

## STICK-RIGHT
<- 267: e1 fd 43 21 dd 01 - press
<- 267: e1 fd 43 22 dd 01 - hold
<- 267: e1 fd 44 00 dd 01 - relese

## STICK-DOWN
<- 267: e1 fd 3f 41 dd 01 - press
<- 267: e1 fd 3f 42 dd 01 - hold
<- 267: e1 fd 40 00 dd 01 - relese

## STICK-LEFT
<- 267: e1 fd 41 81 dd 01 - press
<- 267: e1 fd 41 82 dd 01 - hold
<- 267: e1 fd 42 00 dd 01 - relese

# Joystick ROTATION
#################################
// Bbte 1 and 2 are fixed
// Byte 3 is just counter of messages goning in cycle from 00-ff and around again, allways increasing
// Byte 4 turn positions, 00-ff and around again increesing for CW and decreasing for CCW by [+-1]
// Byte 5 "round counter" when byte 4 is FF and with CW one more "CLICK" increase byte 5 by one and oposite when byte 4 is 00 one more clik in CCW direction byte 5 going -1
// my solution on code is to calculate turns directions is to "JOIN" Byte5 and Byte4 "B5B4"bp8 = [b5]*0x100 + [b4] and calculate difference betwen turns
// EXAMPLE:
// we are at <- "264: e1 fd 4c ff 1f 1e"
// [0x1F]*0x100+[0xFF] = 1FFF(hex) = 8191(dec) CW turn adds +1
// so we get <- "264: e1 fd 4d 00 20 1e"
// [0x20]*0x100+[0x00] = is 2000(hex) = 8192(dec)

## CW turns examples
<- 264: e1 fd 4c ff 1f 1e
<- 264: e1 fd 4d 00 20 1e
<- 264: e1 fd 4e 01 20 1e
<- 264: e1 fd 4f 02 20 1e
<- 264: e1 fd 50 03 20 1e
<- 264: e1 fd 51 04 20 1e

## CCW turns turns examples
<- 264: e1 fd 52 03 20 1e
<- 264: e1 fd 53 02 20 1e
<- 264: e1 fd 54 01 20 1e
<- 264: e1 fd 55 00 20 1e
<- 264: e1 fd 56 ff 1f 1e
<- 264: e1 fd 57 fe 1f 1e
<- 264: e1 fd 58 fd 1f 1e

# responses
#############
<- 277: E1 9D 04 FF // just reply on init, for me not of interest
<- 567: 00 00 00 00 00 00 00 67 // If you see this you are late on "563: 63" message so reduce delay

NOTE: When controler is at sleep, send first message 2 or 3 times. I am sending 202 fd twice to wake it up. You will see lights.
my raware used mpc2515+Jta1050 can @ SPI board / ANY SPI MCU

I hope this TOP SECRET NOBODY WANT TO SHARE CODE , is solved once for all

 

[Kyokochan92]

Hi there, sorry for reviving an old thread.
I am trying to run a 2016 F10 on a bench and bought a HU_High NBT with the iDrive controller and Screen from Ebay. Unfortunately, I tried all the wake up comments posted above but it didn't work.
My NBT only responded with the following message but the screen didn't turn on:

5E3 # 26 88 F5 01 63 FF FF FF

and

563 # 00 00 00 00 FF FF 00 63

I was sending it at 500kbps. Is there anything that I'm doing wrong over here or is the HDD within the NBT fried?

Any kind souls can help me out with this please? Thank you!!

 

[egisz]

Hi,

I have connected rasperry pi to HU_CIC video input and want to control applictaion with idrive.
I can capture idrive controller can messages and translate them to keyboard events. But I have problem.
I can control my application, but it also controls CIC UI, so it's annoyng...
Have anybody tried to hijack idrive so that it does not send to CIC or fool CIC system to not capture idrive rotary or buttons?

I know chineese Carplay/ Android auto solutions like this have this feature. I have no idea how they do this.

 

[egisz]

I've spend several hours trying to trick CIC, but useless...
Read several tutorials of general Canbus hacking, it mentions messages replay as one of hacking ways.

So I tried to capture canbus ID #267 message and reply with multiple fake canbus messages, but it anyway triggers CIC menu.

For example this code filters idrive rotary press messages, extracts byte 2 (counter) and injects multiple fake messages with same counter, of long press (byte 3 = 02)

candump can0 |  awk '{if ($2 == 267 && $4 == "E1"  && $5 == "FD" && ($7 == "00" || $7 == "01")) { for(i=0; i<5; i++) system("cansend can0 267#E1FD"$6"02DE01"); }}'

Also tried to send byte 3 as FF, 01, no difference...
Even tried to flood canbus with lots of frame 267 messages, it still works

while true; do cansend can0 267#BA12801E; sleep 0.02; done

does anybody have deeper experience with this?