e9x bench setup

[ccfj1]

I thought I'd put together whats needed to have a working bench setup for things like flashing, coding and general testing of modules.

First thing you need is the CAS module, you will need to get the CAS, with the corresponding Key and key holder/lead and start button, if you can get the connector plug too, that would be ideal.

The CAS will allow you to power on a module (and keep it powered on). If the CAS is from Europe will also need a ELV module/emulator

You will also need a JBBR (junction box relay electronic), this will act as a gateway to the many modules that are in a car that use different CAN busses and bus speeds. Most cars have a k-can, pt-can and f-can, all of these are available in the JBBR (the f-can is a passthough though), K-CAN is 100bps, PT-CAN and F-CAN are 500bps

So in the JBBR there are 3 CAN buses:-

PT_CAN = for DDE, DSC, EPS, EKP, EDC.
K-Can = for CAS, KOMBI, CIC, CID, ZBE, KLIMA, MRS, FRM, PDC, FZD, COMBOX, TV ...
F-CAN = (SZL) requires connection to the DSC as the DSC is the gateway.

K-Can, is also shown in the TIS as just CAN, where you see CAN it means K-Can.

I also use a KOMBI on my bench so that i know that the system is powered on and at what stage (on, s1, s2 and start).

You will need a OBD port to connect your icom or k-can usb lead (inpa, nscexpert, ISTA-D, Winkftp etc).

Here are the basic pinouts of each module for minimum communication between modules.

CAS X13376 black 41pin plug
Pin 21 <----- +12v Batt Connector Block
Pin 34 <----- +12v Batt Connector Block
Pin 12 <----> GND Connector Block
Pin 25 <----> GND Connector Block
Pin 8 <----> wakeup (ignition)
Pin 26 <----> K-bus low
Pin 35 <----> K-bus high

JBBR x14270 ( the long black plug)
Pin 23 <----- GND Connector Block

JBBR x4010 23pin plug (thats connected to the fusebox base)
Pin 3 <----- +12v Batt (source) Connector Block
Pin 22 <----- +12v Batt (source) Connector Block

JBBR x14271 (the 54pin blue plug)
Pin 10 = K-bus low <----> CAS X13376 pin 26 = K-bus low
Pin 46 = K-bus high <----> CAS X13376 pin 35 = K-bus high
Pin 45 wakeup <----> (ignition) also connected to Pin 1 OBD

ELV
Pin 1 <----> GND Connector Block
Pin 2 <----> CAS EL + pin 23 CAS
Pin 3 <----> CAS EL - pin 24 CAS
Pin 4 <----> CAS PA-bus pin 30 CAS

------------------------------------------------------------------ Above is the basic to power on units -- Below is pins for connecting some modules.

Kombi
Pin 18 <----- GND Connector Block
Pin 9 <----- 12v Connector Block
Pin 7 <----> K-bus low Connector Block
Pin 6 <----> K-bus high Connector Bloc

OBD II
1: Ignition Connector Block (wakeup)
2:
4: Gnd Connector Block
5: Gnd Connector Block
6: K-bus high (pin 17 on blue 54 pin JBBR plug, x14271)
7: I have this connected to pin 30 (PA-BUS) of the CAS (not sure if this is correct???
9: F_TD this goes to the DME)
10:
14: K-bus low (pin 33 on blue 54 pin JBBR plug, x14271)
15:
16: +12v Batt Connector Block

If you want an Ethernet connection to the cic

3: Ethernet connection to cic quadlock pin 37 (black plug)
8: Ethernet connection to cic quadlock pin 29 (black plug)
11: Ethernet connection to cic quadlock pin 38 (black plug)
12: Ethernet connection to cic quadlock pin 31 (black plug)
13: Ethernet connection to cic quadlock pin 32 (black plug)

JBBR x14271 (the 54pin blue plug)
Pin 17 K-bus high <----> OBD Pin 6
Pin 33 K-bus low <----> OBD Pin 14

Pin 1 PT-CAN high <---->
Pin 2 PT-CAN low <---->

Pin 3 F-CAN low <----> this is passthough only
Pin 21 F-CAN high <----> this is passthough only

CIC CID 8 Pin plug
+12v -----> Power to CID Pin 1
GND -----> GND to CID Pin 3
JBBR x14272 Pin 29 <----> K-bus high CID Pin 5
JBBR x14272 Pin 31 <----> K-bus low CID Pin 6

CIC Controller 4 Pin plug
+12v -----> Power to Controller Pin 1
GND -----> GND to Controller Pin 2
JBBR x14272 Pin 11 <----> K-bus high Controller Pin 3
JBBR x14272 Pin 30 <----> K-bus low Controller Pin 4

CIC Base 40pin quadlock Plug
Pin 9 CAN Low
Pin 11 CAN High
Pin 12 GND
Pin 13 Radio ON (CIC)
Pin 15 +12V Power (20Amp)

Pin 29 ETH_A (OBD 8)
Pin 31 ETH_TX+ (OBD 12)
Pin 32 ETH_TX- (OBD 13)
Pin 37 ETH_RX+ (OBD 3)
Pin 38 ETH_RX- (OBD 11)

NOTE: Always check the pins with https://www.newtis.info/tisv2/a/en/ some modules vary depending on year, so always double/tripple check before you plumb in a new unit, these are the pins that worked on my setup....

Always Always try to get the OEM plugs for the modules you buy it makes it so much easier to connect them together.

For Power i use a 33a, 12v power supply and a small self made switch box.

Here is a pic of the loom i have.

 

[NoQuarter]

Thanks John!

Quality write up. The details and pics will really help others get started.

Jim

 

[ccfj1]

No worries Jim, glad to help.

 

[aus335iguy]

Mate this is great work!

 

[ccfj1]

Cheers.

I've been working out what code is being used to do module wakeup and think i have the basics done , ive written some ardunio code and tested it on my bench and can confirm that it works, so i should be able to emulate what i have on the desk to work like a cas/ key module.

So it would do away with the need for the cas, key, key holder and elv. I will look to expand it to have a obd input so updating cic and other units would be possible.

I've ordered a few parts in and will make up a couple of test units to see if they work, I will post up some pics of it when its done.

 

[aus335iguy]

That would lower the cost of entry significantly. So then youre down to just a power supply a JB and the module that you want to flash/program etc Is that correct ?

Either way; Great work!

 

[ccfj1]

^^ thats it exactly mate.

I'm thinking along the lines of a box with 4 wires.... Gnd, 12v Can_H and Can_L

Box will have push button and led to tell you when then emulator is on and running.

Then it would just be mini looms to hook up the modules needed.

Ive tested the code and its rock solid, no clinches or flickering CID screens.

 

[jockyw2001]

^^ thats it exactly mate.

I'm thinking along the lines of a box with 4 wires.... Gnd, 12v Can_H and Can_L

Box will have push button and led to tell you when then emulator is on and running.

Then it would just be mini looms to hook up the modules needed.

Ive tested the code and its rock solid, no clinches or flickering CID screens.

hi there, a while ago I had set up a test bench for my 2011 CIC consisting of a CAS (luckily no need for key is required) a JBE and a CID. Interfaces with CIC consist of ethernet, obd2 (bt), serial & jtag via the edge connector. I had to use topjtag sw for unbricking my unit after doing a few rough cloning experiments

What's missing in my configuration is an iDrive controller. I was thinking of emulating it using a script which sends messages via ipc/ch4

Would that be feasible? Someone already done this?

Best,
JockyW

 

[jockyw2001]

@ccfj1 I plan to build a K-CAN bus speed adapter with an Arduino and two CAN bus shields. The idea is to use an F-series CIC in an E-series. This stack overflow question inspired me to try this.

Since I am new to Arduino and CAN shields I wonder if you can give me some advise on what components to use. Some example code for sending a keep-alive message to the CIC would also be much appreciated.

 

[amg6975]

@ccfj1 I plan to build a K-CAN bus speed adapter with an Arduino and two CAN bus shields. The idea is to use an F-series CIC in an E-series. This stack overflow question inspired me to try this.

Since I am new to Arduino and CAN shields I wonder if you can give me some advise on what components to use. Some example code for sending a keep-alive message to the CIC would also be much appreciated.

As a guy that's done a lot of reverse engineering of the BMW CAN if these are the questions you're asking, you have a very long road ahead of you. It is not going to be easy to do what you want... The F series and E series are very different. You're going to have to translate a LOT of CAN traffic from one format to the other, you're going to have to replicate the timing and counters of all the packets on both busses in both directions, etc. Good luck to you, but this isn't something I'd attempt and this is what I do professionally.

 

[jockyw2001]

Thx a lot for your reply. I will start experimenting tomorrow once the two CAN bus shields have arrived and I can hook them up with an Arduino Uno R3. Found a CAN bus library on github and some sample code for a CAN gw. I also found the wake up messages which are sent by the CAS (E-series) or ZGW (F-series). What is a bit weird is that the CAS3 (E-series) apparently keeps the CIC (F-series) awake! Unfortunately the JBE, which is also part of my bench set-up, is not capable of translating the K-CAN 2 bus to OBD. The CID (E-series) also stays dark.

Anyway if it doesn't work I will flash the V850 IOC in self programming mode (the app fw part).

 

[derekgates]

Worth giving it a shot and trying things out... I hope you can progress and learn.

 

[jockyw2001]

Here is a quick update on what I have been doing. Definitely learned a lot and amg6975 is right this isn't as easy as I first thought. I will start a new thread with more details and code sketches next week, for now just a few main findings.

On my bench I have an E-series CAS and JBE, an F-series CIC, an Arduino Uno R3 with two cheap 8MHz clocked CAN Bus shields. One shield is connected with the CIC CAN-K2 Bus (pin 9 CAN-low, pin 11 CAN-high) and the other shield is connected with the CAN-K1 Bus with the CAS and JBE. The CAN-K1 bus operates at a speed of 100kbps and the CAN-K2 bus at 500kbps. But from the experiments I performed I learned the CAN-K2 Bus can also work fine at 100kbps. I had already noticed before that when the CAS and CIC are directly connected, the CAS can keep the CIC awake.

So what works and what doesn't:
What works is sniffing the CAN-K1 bus and I can reliably sniff the many messages sent by the CAS and the JBE: e.g. status of keyfob, doors, windows, ignition etc. I can also successfully emulate the CAS wake up with some simple code running on the Uno which just sends the wakeup message 0x45, 0x40, 0x21, 0x8f, 0xFE (can be found on Loopbunny's site) and which sniffs the messages sent by the CIC. But, ... it only works if the bus speed is set to 100kbps, no chance on doing the same thing with speed set to 500kbps. In fact nothing works with speeds higher than 100kbps. I can also sniff the messages sent by the CIC: it sends the equal or similar wake up message multiple times, with the CAN id 0x71f (sometimes the same messages have can id 0x11f or 0x01f). Also quite interesting is that if I change the wake up message to 0x45, 0x40, 0x21, 0x8f, 0x57 it can keep the v850 IOC in a permanent boot loop. In the serial console of the CIC I can see a constant message stream like this:
[MSG]@791 (14.16): COnOffExecutor::configure() - Read in configuration for onoffexecutor.
[MSG]@821 (14.15): CPOnOffRequestorCic: Executor state: Current=OFF; Requested=1 [0.821]
[MSG]@1146 (14.15): CPOnOffRequestorCic: Executor state: Current=1; Requested=1 [1.146]
[MSG]@1179 (14.15): CPOnOffRequestorCic: Executor state: Current=1; Requested=2 [1.179]
...
...

The original idea was to implement a bridge between the CAN-K1 @100kbps and the CAN-K2 bus @500kbps. I already knew that my Uno and shields fail at 500kbps, but I couldn't even get it to work when both shields are set to 100kbps

It looks like that either the Uno CAN controller is too slow, or perhaps the cheap shields are unreliable, or perhaps both the Uno and the shields are unreliable. I may try again with a 1. or 2nd generation raspi instead of the Uno, perhaps the raspi works fine @500kbps. But the first thing I want to do is to analyze the CAN-K1 bus traffic with an E-series CIC. Perhaps I can wake up the CID with some additional messages. Will keep you all posted soon in a new thread.

 

[NoQuarter]

8 years ago or so I was doing 500kbps on the PTcan with an arduino and canbus shield.

I would think anything you have now should be capable.

 

[jockyw2001]

Which shield did you use? Running @8 or 16 MHz

EDIT:
I found this post on bimmerfest and it totally makes sense: the F-series CIC also has a CAN-K1 bus, but also receives control and signalling messages via MOST from the ZGW which is also a gw for the CAN-K2 bus for devices like the iDrive controller. The question now is whether it also accepts the same control commands over the CAN-K1 bus.
I think it is time to build the F-series CIC in my E88 to see what happens ....

 

[amg6975]

I can't follow if you're trying to run K-CAN at 500kbps, which definitely won't work... it's a 100kbps bus. All nodes on the CAN bus need to run at the same speed.

 

[aus335iguy]

@Svmp this might interest you and you may be able to help

 

[jockyw2001]

@amg6975: the iDrive controller in F-series cars is connected to a K-CAN 2 bus (500kbps). Therefore I assumed the CIC is also connected to the K-CAN 2 bus. This assumption was wrong and now I know it is connected to the K-CAN 1 bus (100 kbps) and that it communicates with the iDrive controller over MOST and via the ZGW which is a gateway between MOST and K-CAN 2. I haven't looked at the wiring diagrams yet, but I am pretty sure this is the case. I will try to find a ZGW and include it in my bench setup.

 

[aus335iguy]

I heard some people use the ZGW module to flash e series CICs across MOST. What you say makes sense may be an easier way in.

 

[aus335iguy]

So a very generous person gave me this(thank you sir !)
It’s an IPO decompiler
With this we can potentially take apart how BMW flashes modules and change whatever we want.
No idea how/ if it works or how to use it. I can’t vouch for its safety either, use at your own risk!