logging and analysis of bmw e31 8 series i-bus

Logging and analysis of BMW E31 8 Series I-bus Document: 1

Author: revtor

Logger: NavCoder v2.9.174.Beta (up log step 0045) and v2.9.176.Beta with Resler v6 USB interface

Vehicle: Custom bench setup

I-bus devices: EKM (02) and MID (01) – German 1991 BMW E31 850i (CB08272)

Initialization of the EKM and overview of all MID information screens and functions available with the ignition

key in position I (accessories).

LOG 0000

ACTION: Applied power to both EKM and MID (permanent power).

RESULT: Nothing happened on the I-bus. Even after waiting minutes, no messages appeared.

LOG 0001

ACTION: Turned ignition key to position I (accessories).

RESULT: Now the I-bus came alive. Since no power was applied to the modules before log step 0000, all

settings are default (empty). The MID display lights up with the message area showing "Uhrzeit eingeben"

and the clock area "--:--" (blinking).

While the NavCoder log was filling, some strange discarded byte rolled by and the application threw type

mismatch errors for following messages:

• 02 07 FF 82 FF FF FF FF 78 (twice)

• 02 05 01 93 FF 7F 15

• 02 05 01 90 FF FF 96

Command 82 data FF FF FF FF means date, year and day of the week are not yet set. The same applies to

time command 83 data FF FF which is shown by NavCoder as "FF:FF" but is actually "--:--".

Command 90 data FF FF sets the [GESCHW] average speed screen to "---".

Command 93 data FF 7F sets the [VERBR] fuel consumption 2 screen to "--,-". Not sure why fuel

consumption 2 uses FF 7F while fuel consumption 1 uses FF FF like all other screens. Both show as "--,-"

on the display though.

Remember that only EKM and MID were connected during this test, so the real-car output might be much

more verbose!

EXTRA: Even though the log does not reveal this, I discovered the meaning of several commands and data by

analyzing the differences between different EKM modules (I have several) and changing the module coding in

NCS Expert.

Command BC unit coding and MID special features:

• MID special features (bit-level):

o ........ ........ ...????? (probably not used)

o ........ ........ ..?..... (MID layout – 0 = right-hand drive, 1 = left-hand drive)

o ........ ........ .?...... (MID park heating – 0 = no, 1 = yes)

o ........ ........ ?....... (MID park ventilation – 0 = no, 1 = yes)

• Unit coding (bit-level):

o ........ .......? ........ (command 82 date – 0 = ddmm, 1 = mmdd)

o ........ ......?. ........ (command 88 time of arrival – 0 = 24-hour, 1 = 12-hour)

o ........ .....?.. ........ (command 8E and 8F park ventilation/heating timers – 0 =

24-hour, 1 = 12-hour)

o ........ ....?... ........ (unknown distance – 0 = km, 1 = MLS)

o ........ ..??.... ........ (unknown consumption – 00 = l/100km, 01 = US MPG, 10 =

UK MPG, 11 = km/l)

o ........ .?...... ........ (unknown speed – 0 = km/h, 1 = MPH)

o ........ ?....... ........ (alarm horn – 0 = intermittent tone, 1 = continuous tone)

o ......?? ........ ........ (command 92 fuel consumption – 00 = l/100km, 01 = US

MPG, 10 = UK MPG, 11 = km/l)

o .....?.. ........ ........ (command 86 range – 0 = km, 1 = MLS)

o ....?... ........ ........ (command 90 average speed – 0 = km/h, 1 = MPH)

o ...?.... ........ ........ (command A2 distance – 0 = km, 1 = MLS)

o ..?..... ........ ........ (command A0 outside temperature – 0 = °C, 1 = °F)

o .?...... ........ ........ (command 98, 99 and 9D speed limit – 0 = km/h, 1 = MPH)

o ?....... ........ ........ (command 83 time – 0 = 24-hour, 1 = 12-hour)

The unknown distance, consumption and speed are most likely related to service menu screens where items

like momentary range, momentary fuel consumption and momentary speed can be displayed. Since I have not

yet found a way to enter the service menu in my bench setup I don't know the accompanying commands.

Sending a custom command BC message to the EKM makes it store the new settings, but any changes to the

last byte (MID special features) are ignored. The MID special features can only be set through coding with NCS

Expert.

Command BD language and unit coding:

• Language coding:

o 00 .. (German) decimal mark "," (comma)

o 01 .. (English – United States of America) decimal mark "." (dot)

o 02 .. (not used) decimal mark "," (comma)

o 03 .. (English – Japan) decimal mark "." (dot)

o 04 .. (English – Canada) decimal mark "." (dot)

o 05 .. (French) decimal mark "," (comma)

o 06 .. (Spanish) decimal mark "," (comma)

o 07 .. (Italian) decimal mark "," (comma)

o 08 .. (English – Middle East, Australia and South Africa) decimal mark "." (dot)

o 09 .. (English – United Kingdom) decimal mark "." (dot)

• Unit coding:

o .. 00 (Germany) � command BC data 00 00 ..

o .. 01 (United States of America) � command BC data FD 5F ..

o .. 02 (not used) � command BC data 00 00 ..

o .. 03 (Japan) � command BC data 83 37 ..

o .. 04 (Canada, Middle East, Australia and South Africa) � command BC data 80 07 ..

o .. 05 (France) � command BC data 00 00 ..

o .. 06 (Spain) � command BC data 00 00 ..

o .. 07 (Italy) � command BC data 00 00 ..

o .. 08 (not used) � command BC data 80 07 ..

o .. 09 (United Kingdom) � command BC data FE 6F ..

It may seem a bit strange to have two seemingly overlapping unit codings (command BC and BD), but

command BD is only used to define geographic regions. The MID simply ignores the unit coding of command

BD and uses command BC instead. However, in the MID service menu is a feature to change the country

coding. Since I cannot enter the service menu in my bench setup I cannot yet confirm this, but I believe using

the country coding service menu option will send command BD to the EKM. Manually sending command BD to

the EKM with NavCoder always causes the EKM to send out updated unit codings through command BC (see

above).

Note that there's a bug in the unit definitions behind command BD data .. 09: Command BC is set to FE 6F

whereas one would expect DE 6F (the difference is the unit of the outside temperature). Of course this is easily

corrected by pressing the [km/mls] button when on the [A-TEMP] outside temperature screen, but it's worth

mentioning nonetheless. This bug seems to be present in all EKM versions.

The displayed language in the MID is taken directly from the language coding in command BD. When a

message is displayed, sending command BD with a different language coding will immediately update the

display with the new language. The language coding also affects the decimal mark.

Command FC K_ZAHL or impulses per kilometer: K_ZAHL is used to convert the pulses from the speed sensor

in the differential to correct mileage and speed readings. Command FC data B6 11 (11B6h) translates to 4534d

which is the exact value that is coded for K_ZAHL. Sending a custom K_ZAHL value to the EKM has no effect –

the value is read-only.

I've hinted at park ventilation/heating through commands 8E and 8F above, but I will address those another

time. This EKM is not coded for park ventilation nor heating.

COMMANDS: AA (enter immobilizer code), BC (unit coding), BD (language and unit coding), FC (K_ZAHL) and

many others.

2012-06-07 16:57:21.619: 00 00

2012-06-07 16:57:21.619: WARNING: Discarded 2 bytes: [00 00]

2012-06-07 16:57:21.629: 02 04 FF FA 01 02

2012-06-07 16:57:21.629: EKM --> GLO : Vehicle Data request, Data="01"

2012-06-07 16:57:21.659: 02 05 FF FB 07 06 02

2012-06-07 16:57:21.659: EKM --> GLO : Cmd_0xFB, Data="07 06"

2012-06-07 16:57:21.659: 02 05 FF F8 01 00 01

2012-06-07 16:57:21.669: EKM --> GLO : Cmd_0xF8, Data="01 00"

2012-06-07 16:57:21.669: 02 05 FF FB 07 06 02


2012-06-07 16:57:21.689: 00 00 00 3F 00

2012-06-07 16:57:21.689: WARNING: Discarded 5 bytes: [00 00 00 3F 00]

2012-06-07 16:57:21.719: 02 04 08 81 00 8F

2012-06-07 16:57:21.719: EKM --> 0x08: Door status, Data="00"

2012-06-07 16:57:21.719: 01 04 02 FA 03 FE

2012-06-07 16:57:21.719: MID --> EKM : Vehicle Data request, Data="03"

2012-06-07 16:57:21.739: 02 05 FF F8 01 00 01


2012-06-07 16:57:21.749: 02 05 FF FB 07 06 02


2012-06-07 16:57:21.749: 02 05 01 C8 00 00 CE

2012-06-07 16:57:21.749: EKM --> MID : Check Control Display, --- Display Off --- DB2...DBn="00"

2012-06-07 16:57:21.749: 02 04 01 AC 01 AA

2012-06-07 16:57:21.749: EKM --> MID : Cmd_0xAC, Data="01"

2012-06-07 16:57:21.759: 02 05 01 AE 00 00 A8

2012-06-07 16:57:21.759: EKM --> MID : Cmd_0xAE, Data="00 00"

2012-06-07 16:57:21.789: 02 06 FF A4 DD AB 03 2A

2012-06-07 16:57:21.789: EKM --> GLO : Cmd_0xA4, Data="DD AB 03"

2012-06-07 16:57:21.789: 02 04 FF A5 00 5C

2012-06-07 16:57:21.789: EKM --> GLO : Cmd_0xA5, Data="00"

2012-06-07 16:57:21.789: 02 06 FF BC 00 00 20 67

2012-06-07 16:57:21.789: EKM --> GLO : Country Coding, Cons=l/100km, Data="00 00 20"

2012-06-07 16:57:21.819: 02 05 FF BD 00 00 45

2012-06-07 16:57:21.819: EKM --> GLO : Cmd_0xBD, Data="00 00"

2012-06-07 16:57:21.819: 02 07 01 86 00 00 00 00 82

2012-06-07 16:57:21.819: EKM --> MID : Cmd_0x86, Data="00 00 00 00"

2012-06-07 16:57:21.829: 02 07 01 87 00 00 00 00 83

2012-06-07 16:57:21.829: EKM --> MID : Cmd_0x87, Data="00 00 00 00"

2012-06-07 16:57:21.849: 02 05 FF 83 FF FF 7B

2012-06-07 16:57:21.849: EKM --> GLO : Time, FF:FF

2012-06-07 16:57:21.859: ! ERROR: NavCoder.MSComm1_OnComm.dataBufferUpdater.dataBufferParser.showMsg

2012-06-07 16:57:21.859: ! ERROR: NavCoder - Error - Type mismatch

2012-06-07 16:57:21.859: ! ERROR: ibus Msg = 02 07 FF 82 FF FF FF FF 78 State=some valid msg,

calling showMsg

2012-06-07 16:57:21.919: 02 04 01 9C 00 9B

2012-06-07 16:57:21.919: EKM --> MID : Limit, Off

2012-06-07 16:57:21.929: 02 05 FF FC B6 11 A3

2012-06-07 16:57:21.929: EKM --> GLO : Cmd_0xFC, Data="B6 11"

2012-06-07 16:57:21.929: 02 05 01 9D FF FF 9B

2012-06-07 16:57:21.929: EKM --> MID : Cmd_0x9D, Data="FF FF"

2012-06-07 16:57:21.939: 02 05 01 98 FF FF 9E

2012-06-07 16:57:21.939: EKM --> MID : Cmd_0x98, Data="FF FF"

2012-06-07 16:57:21.939: 02 05 01 99 FF FF 9F


2012-06-07 16:57:21.949: 02 04 01 8C 00 8B

2012-06-07 16:57:21.949: EKM --> MID : Cmd_0x8C, Data="00"

2012-06-07 16:57:21.949: 02 05 01 8E FF FF 88

2012-06-07 16:57:21.949: EKM --> MID : Cmd_0x8E, Data="FF FF"

2012-06-07 16:57:21.959: 02 05 01 8F FF FF 89

2012-06-07 16:57:21.959: EKM --> MID : Cmd_0x8F, Data="FF FF"

2012-06-07 16:57:21.989: 02 05 FF A0 00 43 1B

2012-06-07 16:57:21.989: EKM --> GLO : Cmd_0xA0, Data="00 43"

2012-06-07 16:57:21.989: 02 05 01 92 FF FF 94

2012-06-07 16:57:21.989: EKM --> MID : Consumption 1, --.- l/100km



2012-06-07 16:57:21.999: ! ERROR: ibus Msg = 02 05 01 93 FF 7F 15 State=some valid msg, calling

showMsg

2012-06-07 16:57:22.069: 02 05 01 A2 FF FF A4

2012-06-07 16:57:22.069: EKM --> MID : Distance, --- km

2012-06-07 16:57:22.069: 02 07 01 88 FF FF FF FF 8C

2012-06-07 16:57:22.069: EKM --> MID : Cmd_0x88, Data="FF FF FF FF"

2012-06-07 16:57:22.079: 02 05 01 96 FF FF 90

2012-06-07 16:57:22.079: EKM --> MID : Range, --- km



2012-06-07 16:57:22.079: ! ERROR: ibus Msg = 02 05 01 90 FF FF 96 State=some valid msg, calling

showMsg

2012-06-07 16:57:22.119: 02 07 01 C0 00 00 FF FF C4

2012-06-07 16:57:22.119: EKM --> MID : Service Indicator, [ ], Data="00 00 FF FF"

2012-06-07 16:57:22.129: 02 0B 01 BE FF FF FF FF FF FF FF FF B6

2012-06-07 16:57:22.129: EKM --> MID : Cmd_0xBE, Data="FF FF FF FF FF FF FF FF"

2012-06-07 16:57:22.129: 02 06 FF BC 00 00 20 67


2012-06-07 16:57:22.139: 02 05 FF BD 00 00 45


2012-06-07 16:57:22.139: 02 07 01 86 00 00 00 00 82

2012-06-07 16:57:22.139: EKM --> MID : Cmd_0x86, Data="00 00 00 00"

2012-06-07 16:57:22.149: 02 07 01 87 00 00 00 00 83

2012-06-07 16:57:22.149: EKM --> MID : Cmd_0x87, Data="00 00 00 00"

2012-06-07 16:57:22.189: 02 05 FF 83 FF FF 7B

2012-06-07 16:57:22.189: EKM --> GLO : Time, FF:FF



2012-06-07 16:57:22.199: ! ERROR: ibus Msg = 02 07 FF 82 FF FF FF FF 78 State=some valid msg,

calling showMsg

2012-06-07 16:57:22.630: 02 05 FF A0 00 C3 9B

2012-06-07 16:57:22.630: EKM --> GLO : Cmd_0xA0, Data="00 C3"

LOG 0002

ACTION: None.

RESULT: The EKM sends out command FB with data 07 06 every minute. Probably some sort of heartbeat for

other modules on the I-bus.

COMMANDS: FB (?).

2012-06-07 16:58:21.655: 02 05 FF FB 07 06 02


2012-06-07 16:59:21.641: 02 05 FF FB 07 06 02


2012-06-07 17:00:21.647: 02 05 FF FB 07 06 02


2012-06-07 17:01:21.664: 02 05 FF FB 07 06 02


2012-06-07 17:02:21.660: 02 05 FF FB 07 06 02


2012-06-07 17:03:21.676: 02 05 FF FB 07 06 02


LOG 0003

ACTION: Entered time "12:34" and pressed the [SET/RES] button to confirm.

RESULT: The MID transmitted the time to the EKM which on its turn immediately propagated the time to

GLOBAL. The EKM also answered the MID with command BF data 01. The MID message area now shows

"Datum eingeben" and the clock area "--.--." (blinking).

EXTRA: Command BF is a confirmation command for user input. Data 01 means the action was accepted, 00

means it was refused. If for example a time of "25:00" was entered (the MID is stupid enough to allow that),

the EKM would not have set the time and replied with command BF and data 00.

24-hour time format:

• 34 12 = "12:34"

• 23 01 = "1:23"

• FF FF = "--:--"

INFO: Entering the time can be repeated later by holding the [UHR] button until "Uhrzeit eingeben" and "-

-:--" are shown again. The I-bus output is the same.

COMMANDS: 83 (time) and BF (user input confirmation).

2012-06-07 17:31:58.064: 01 05 02 83 34 12 A3

2012-06-07 17:31:58.064: MID --> EKM : Time, 12:34

2012-06-07 17:31:58.074: 02 05 FF 83 34 12 5D

2012-06-07 17:31:58.074: EKM --> GLO : Time, 12:34

2012-06-07 17:31:58.074: 02 04 01 BF 01 B9

2012-06-07 17:31:58.074: EKM --> MID : Cmd_0xBF, Data="01"

LOG 0004

ACTION: None.

RESULT: The EKM sends out the updated time to GLOBAL every minute. Note that I have filtered out the

periodical FB 07 06 (see log step 0002) and will continue doing that from now on since it clutters the log.

EXTRA: Sending command 83 data FF FF to the MID shows "--:--" (non-blinking) in the clock area when

the time [UHR] is shown.

COMMANDS: 83 (time).

2012-06-07 17:32:58.131: 02 05 FF 83 35 12 5C

2012-06-07 17:32:58.131: EKM --> GLO : Time, 12:35

2012-06-07 17:33:58.267: 02 05 FF 83 36 12 5F

2012-06-07 17:33:58.267: EKM --> GLO : Time, 12:36

2012-06-07 17:34:58.083: 02 05 FF 83 37 12 5E

2012-06-07 17:34:58.083: EKM --> GLO : Time, 12:37

2012-06-07 17:35:58.049: 02 05 FF 83 38 12 51

2012-06-07 17:35:58.049: EKM --> GLO : Time, 12:38

2012-06-07 17:36:58.046: 02 05 FF 83 39 12 50

2012-06-07 17:36:58.046: EKM --> GLO : Time, 12:39

2012-06-07 17:37:58.012: 02 05 FF 83 40 12 29

2012-06-07 17:37:58.012: EKM --> GLO : Time, 12:40

LOG 0005

ACTION: Entered date "23.01." (January 23) and confirmed with [SET/RES].

RESULT: No activity on the I-bus, but the display now shows "Jahr eingeben" in the message area and the

clock area "1991" (blinking).

ACTION: Entered year "2013" and confirmed with [SET/RES].

RESULT: Now the MID submitted the date to the EKM which on its turn immediately propagated the date to

GLOBAL (now including day of the week).

The message area on the MID is now dark and the clock area shows the date.

Subsequently pressing the [UHR] and [DATUM] buttons has no effect on the I-bus activity. The MID caches the

date and time and can toggle between both without requesting information from the EKM. This is actually true

for all information screens on the MID. For example pressing the [GESCHW] average speed button gives no I-

bus activity, but the MID shows the last received value for that screen.

I was actually disappointed by this. I had hoped the button presses would have I-bus activity as well. You can

send the MID screen data as much as you want, but you cannot remotely change the information screen

(other than check control and the text message output). I was hoping to be able to activate the service menu

momentary speed screen through a microcontroller, but it seems that's impossible…

EXTRA: Even though the year is entered as a 4-digit number, the I-bus only supports a 2-digit notation. Valid

years are from 1991 (91) up to 2090 (90). If the car survives to December 31, 2090, 23:59, the next minute it will

time travel a hundred years back to January 1, 1991, 00:00.

Interestingly the EKM also sent the MID a service interval (SIA) command C0 and will continue doing so on

certain date changes. What has the SIA to do with the date? The third and fourth byte of the SIA data form a

date where the third byte is the month from 01 to 0C (0d to 12d) and the last byte the 2-digit year. This is

related to the periodic inspection, but I don’t know how this works or what the date exactly represents. This is

also dependent on the coding of the SIA. For example US E31 are coded without periodic inspection and

always have .. .. FF FF for command C0. The first two bytes make the service interval indicator, but with

the ignition key in position 0 or I these bytes are always 00 00 .. .. and no indicator is shown.

At least one version of the EKM has a Y2K bug where March 1 2000 is replaced with the non-existing February

30 2000. There are pictures of this, but I was unable to reproduce this with any of my EKM modules.

INFO: Entering the date can be repeated later by holding the [DATUM] button until "Datum eingeben" and "-

-.--." are shown again. The I-bus output is the same.

COMMANDS: 82 (date), BF (user input confirmation) and C0 (service interval indicator).

2012-06-07 17:49:21.915: 01 06 02 82 23 01 13 B6

2012-06-07 17:49:21.915: MID --> EKM : Date, 23/01/2013

2012-06-07 17:49:21.945: 02 07 FF 82 23 01 13 03 4A

2012-06-07 17:49:21.945: EKM --> GLO : Date, 23/01/2013, wo

2012-06-07 17:49:21.945: 02 04 01 BF 01 B9


2012-06-07 17:49:21.965: 02 07 01 C0 00 00 08 13 DF

2012-06-07 17:49:21.965: EKM --> MID : Service Indicator, [ ], Data="00 00 08 13"

LOG 0006

ACTION: None.

RESULT: The EKM sends out the updated date to GLOBAL on each 23:59 to 00:00 change-over.

EXTRA: Sending command 82 data FF FF FF FF to the MID shows "--.--." (non-blinking) in the clock area

when the date [DATUM] is shown.

COMMANDS: 82 (date) and 83 (time).

2012-06-07 18:10:14.456: 02 05 FF 83 00 00 7B

2012-06-07 18:10:14.456: EKM --> GLO : Time, 00:00

2012-06-07 18:10:14.476: 02 07 FF 82 24 01 13 04 4A

2012-06-07 18:10:14.476: EKM --> GLO : Date, 24/01/2013, do

LOG 0007

ACTION: Pressing the [MEMO] button on the MID to enable the hourly beep.

RESULT: As you can see the MID does really use command 83 that is already used by the time. The EKM

immediately responds by propagating the time to GLOBAL, but strangely enough the hour now has an offset

of 80 (the time shown on the MID was "00:57"). The offset probably indicates [MEMO] is on. You might want

to make NavCoder support this notation like "00:57 MEMO".


2012-06-07 19:07:50.195: 01 05 02 83 00 C0 45

2012-06-07 19:07:50.195: MID --> EKM : Time, C0:00

2012-06-07 19:07:50.226: 02 05 FF 83 57 80 AC

2012-06-07 19:07:50.226: EKM --> GLO : Time, 80:57

LOG 0008

ACTION: None.

RESULT: The EKM sends out its minute-by-minute time updates. The [MEMO] offset of 80 remains.


2012-06-07 19:08:14.310: 02 05 FF 83 58 80 A3

2012-06-07 19:08:14.310: EKM --> GLO : Time, 80:58

2012-06-07 19:09:14.306: 02 05 FF 83 59 80 A2

2012-06-07 19:09:14.306: EKM --> GLO : Time, 80:59

2012-06-07 19:10:14.263: 02 05 FF 83 00 81 FA

2012-06-07 19:10:14.263: EKM --> GLO : Time, 81:00

2012-06-07 19:11:14.259: 02 05 FF 83 01 81 FB

2012-06-07 19:11:14.259: EKM --> GLO : Time, 81:01

2012-06-07 19:12:14.285: 02 05 FF 83 02 81 F8

2012-06-07 19:12:14.285: EKM --> GLO : Time, 81:02

2012-06-07 19:13:14.282: 02 05 FF 83 03 81 F9

2012-06-07 19:13:14.282: EKM --> GLO : Time, 81:03

LOG 0009

ACTION: Pressing the [MEMO] button once again to disable the hourly beep.

RESULT: The EKM promptly retransmits the time to GLOBAL and now the offset is gone again.


2012-06-07 19:16:45.055: 01 05 02 83 00 40 C5

2012-06-07 19:16:45.055: MID --> EKM : Time, 40:00

2012-06-07 19:16:45.085: 02 05 FF 83 06 01 7C

2012-06-07 19:16:45.085: EKM --> GLO : Time, 01:06

LOG 0010

ACTION: Pressing the [CHECK] button for a check control request.

RESULT: The MID sends a check control request to the EKM, but with the ignition key in position I, the EKM

does not answer to check control requests.

COMMANDS: 48 (check control).

2012-06-07 19:27:59.765: 01 03 02 48 48

2012-06-07 19:27:59.765: MID --> EKM : Check Control data request

LOG 0011

ACTION: While on the [VERBR] fuel consumption 1 screen, pressing the [km/mls] button to change from

metric ("l/100km") to imperial ("MPG").

RESULT: Note that the fuel consumption 2 screen gets refreshed as well (and NavCoder trips over the FF 7F

data just as with the initialization in 0001). The display shows "Verbr1 --,- MPG".

EXTRA: The MID can display values for the fuel consumption from "0,0" (00 00) to "99,9" (99 09) (although

if you take bogus values into account it starts at "-9,9" (99 0F)). Examples:

• 34 12 = "23,4" (NavCoder incorrectly displays "183,4")

• 23 01 = "12,2"

• 12 00 = "1,2"

• 01 00 = "0,1"

• 00 00 = "0,0"

• FF FF = "--,-"

NavCoder shows the fuel consumption in liters per 100 kilometers even though the country coding is set to

miles per gallon.

INFO: Even though NavCoder trips over it, the MID interprets data values not as real numbers. You can send

bogus data like 0F 0F and the MID will happily display "-0,-". This is actually true for most information

screens on the MID.

Hexadecimal data A is usually displayed as " " (space), whereas anything above B gives "-" (minus). I did not

test all combinations with A and B-F because I consider these bogus values that serve no real purpose.

COMMANDS: 92 (fuel consumption 1), 93 (fuel consumption 2) and BC (unit coding).

2012-06-07 20:16:44.711: 01 06 02 BC 02 00 20 9B

2012-06-07 20:16:44.711: MID --> EKM : Country Coding, Cons=MPG, Data="02 00 20"

2012-06-07 20:16:44.741: 02 06 FF BC 02 00 20 65

2012-06-07 20:16:44.741: EKM --> GLO : Country Coding, Cons=MPG, Data="02 00 20"

2012-06-07 20:16:44.741: 02 05 01 92 FF FF 94





showMsg

LOG 0012

ACTION: While on the [VERBR] fuel consumption 1 screen, pressing the [km/mls] button again to change

back from imperial to metric.

RESULT: The same remarks as for the previous step apply here. The display shows "Verbr1 --,- l/100km".


2012-06-07 20:17:07.433: 01 06 02 BC 00 00 20 99

2012-06-07 20:17:07.433: MID --> EKM : Country Coding, Cons=l/100km, Data="00 00 20"

2012-06-07 20:17:07.443: 02 06 FF BC 00 00 20 67


2012-06-07 20:17:07.443: 02 05 01 92 FF FF 94





showMsg

LOG 0013

ACTION: While on the [VERBR] fuel consumption 1 screen, pressing the [SET/RES] button to reset the value.

RESULT: Once again NavCoder trips over the length of the data which is now only one byte (00) whereas

NavCoder expected 2. The display shows "Verbr1 --,- l/100km".

COMMANDS: 92 (fuel consumption 1).


2012-06-07 20:23:18.297: ! ERROR: NavCoder - Error - Invalid procedure call or argument

2012-06-07 20:23:18.297: ! ERROR: ibus Msg = 01 04 02 92 00 95 State=some valid msg, calling showMsg

2012-06-07 20:23:18.377: 02 05 01 92 FF FF 94


LOG 0014

ACTION: While on the [VERBR] fuel consumption 2 screen, pressing the [km/mls] button to change from

metric ("l/100km") to imperial ("MPG").

RESULT: The same remarks as for fuel consumption 1 apply here. The display shows "Verbr2 --,- MPG".

EXTRA: The MID can display the same values as for fuel consumption 1. Data FF FF to display "--,-" works

for fuel consumption 2, but the EKM seems to use FF 7F instead. No visual difference, though.


2012-06-07 20:27:39.392: 01 06 02 BC 02 00 20 9B

2012-06-07 20:27:39.392: MID --> EKM : Country Coding, Cons=MPG, Data="02 00 20"

2012-06-07 20:27:39.412: 02 06 FF BC 02 00 20 65

2012-06-07 20:27:39.412: EKM --> GLO : Country Coding, Cons=MPG, Data="02 00 20"

2012-06-07 20:27:39.432: 02 05 01 92 FF FF 94





showMsg

LOG 0015

ACTION: While on the [VERBR] fuel consumption 2 screen, pressing the [km/mls] button again to change

back from imperial to metric.

RESULT: The same remarks as for fuel consumption 1 apply here. The display shows "Verbr2 --,-

l/100km".


2012-06-07 20:28:09.796: 01 06 02 BC 00 00 20 99


2012-06-07 20:28:09.826: 02 06 FF BC 00 00 20 67


2012-06-07 20:28:09.826: 02 05 01 92 FF FF 94





showMsg

LOG 0016

ACTION: While on the [VERBR] fuel consumption 2 screen, pressing the [SET/RES] button to reset the value.

RESULT: The same remarks as for fuel consumption 1 apply here, but now NavCoder trips over both

messages. The display shows "Verbr2 --,- l/100km".

COMMANDS: 93 (fuel consumption 2).







showMsg

LOG 0017

ACTION: While on the [A-TEMP] outside temperature screen, pressing the [km/mls] button to change from

degrees Celsius ("°C") to degrees Fahrenheit ("°F").

RESULT: The EKM sends the outside temperature via command A0. The display shows "A-Temperatur -22

°F" (no temperature sensor attached in my bench setup).

The data should be interpret as follows: WX YZ = "YZW" where Y is "+" (plus) if 0(..3) or 8(..B), and "-" (minus)

if 4(..7) or C(..F). X is never shown.

EXTRA: The MID can display values for the outside temperature in Fahrenheit from "-99" (90 C9) to "+99"

(90 09). Examples:

• 23 01 = "+12"

• 23 41 = "-12"

• 20 81 = "+12"

• 20 C1 = "-12"

• 10 00 = "+1"

• 10 40 = "-1"

• 00 80 = "+0"

• 00 C0 = "-0"

• FF FF = "--"

Why are there 4 ranges for "+" and "-"? It took me a while to figure this out but this is related to the low

temperature warning. As soon as the temperature drops below +3 °C (+37.5 °F) the unit blinks for 8 seconds.

It does this again if the temperature drops below +3 °C again after having raised to 6 °C (+43 °F). The unit

blinks when going from 0 to 8 or 4 to C. For example:

1. 20 01 � "+12 °F" (unit does not blink)

2. 20 81 � "+12 °F" (unit blinks for 8 seconds)




6. 20 81 � "+12 °F" (unit blinks for 8 seconds)

COMMANDS: A0 (outside temperature) and BC (unit coding).

2012-06-07 20:47:55.210: 01 06 02 BC 20 00 20 B9


2012-06-07 20:47:55.250: 02 06 FF BC 20 00 20 47


2012-06-07 20:47:55.260: 02 05 FF A0 20 C2 BA


LOG 0018

ACTION: While on the [A-TEMP] outside temperature screen, pressing the [km/mls] button again to change

back from degrees Fahrenheit to degrees Celsius.

RESULT: The display shows "A-Temperatur -30,0 °C". The data should be interpret as follows: WX YZ =

"YZW,X" where Y is "+" (plus) if 0(..3) or 8(..B), and "-" (minus) if 4(..7) or C(..F).

EXTRA: The MID can display values for the outside temperature in Celsius from "-99,9" (99 C9) to "+99,9"

(99 09). Examples:

• 23 01 = "+12,3"

• 23 41 = "-12,3"

• 12 80 = "+1,2"

• 12 C0 = "-1,2"

• 01 00 = "+0,1"

• 01 40 = "-0,1"

• 00 80 = "+0,0"

• 00 C0 = "-0,0"

• FF FF = "--,-"

The blinking unit is also supported.

COMMANDS: A0 (outside temperature) and BC (unit coding).

2012-06-07 20:48:09.541: 01 06 02 BC 00 00 20 99


2012-06-07 20:48:09.561: 02 06 FF BC 00 00 20 67


2012-06-07 20:48:09.591: 02 05 FF A0 00 C3 9B


LOG 0019

ACTION: While on the [GESCHW] average speed screen, pressing the [km/mls] button to change from metric

("km/h") to imperial ("MPH").

RESULT: Again a type mismatch. The display shows "Geschw --- MPH".

EXTRA: The MID can display values for the average speed from "0" (00 00) to "999" (90 99) (although if you

take bogus values into account it starts at "-99" (99 0F)). Examples:

• 34 12 = "123" (NavCoder incorrectly displays "123,4")

• 23 01 = "12,3"

• 12 00 = "1,2"

• 01 00 = "0,1"

• 00 00 = "0,0"

• FF FF = "---"

NavCoder shows the speed in kilometers per hour even though the country coding is set to miles per hour.

COMMANDS: 90 (average speed) and BC (unit coding).

2012-06-07 20:37:53.836: 01 06 02 BC 08 00 20 91


2012-06-07 20:37:53.866: 02 06 FF BC 08 00 20 6F





showMsg

LOG 0020

ACTION: While on the [GESCHW] average speed screen, pressing the [km/mls] button again to change back

from imperial to metric.

RESULT: And again a type mismatch. The display shows "Geschw --- km/h".

COMMANDS: 90 (average speed) and BC (unit coding).

2012-06-07 20:38:09.869: 01 06 02 BC 00 00 20 99


2012-06-07 20:38:09.869: 02 06 FF BC 00 00 20 67





showMsg

LOG 0021

ACTION: While on the [GESCHW] average speed screen, pressing the [SET/RES] button to reset the value.

RESULT: More type mismatches. Really, you should make the errors appear in the grid view and give the

popup a checkbox "do not show this messagebox again". The display shows "Geschw --- km/h".

COMMANDS: 90 (average speed).







showMsg

LOG 0022

ACTION: Change to the [DISTANZ] distance screen. As with all other information screens, changing the screen

does not give any I-bus activity. The display shows "Dist ---- km --:--". Enter distance "1234" and

confirm with the [SET/RES] button.

RESULT: The MID sends out the programmed distance and the EKM promptly replies back with distance and

estimated time of arrival. Just as with entering the time (log step 0003) and date (log step 0005), the EKM

checks the entered information for validity and replies with confirmation command BF data 01. The display

shows "Dist 1234 km 19:41".

The current time was 12:36 so I should arrive at 19:45. That's 1234 km in just 7 hours. While that may be

possible on the German Autobahn averaging at around 180 km/h, the EKM actually meant 19:45 tomorrow –

thus 19 hours away at an average speed of around 65 km/h. The EKM does send this correctly to the MID, but

the MID has no means to display the difference between 19:45 today, tomorrow, the day after,… Better not use

this function as travel time planner…

The time of arrival, command 88, is unknown to NavCoder. Its data structure with 4 bytes is however a bit

strange at first sight. More information in the EXTRA block below.

EXTRA: The MID can display values for the distance from "-999" (99 F9) to "7999" (99 79). Any value over 7

for the first digit is shown as "-" (minus).

• 34 12 = "1234" (NavCoder incorrectly displays "1834")

• 23 01 = "123"

• 23 81 = "-123"

• 12 00 = "12"

• 12 80 = "-12"

• 01 00 = "1"

• 01 80 = "-1"

• 00 00 = "0"

• 00 80 = "-0"

• FF FF = "----"

The MID can display values for the time of arrival from "00:00" (00 00 .. ..) to "23:59" (59 23 .. ..)

(24-hour time) or "11:59A" (59 11 .. ..) / "11:59P" (59 31 .. ..) (12-hour time) (although if you take

bogus values into account it ends at "99:99" (99 99 .. ..)). The time format is handled by the country

coding (see next log steps). Examples:

24-hour:

• 34 12 .. .. = "12:34"

• 23 01 .. .. = "1:23"

• FF FF .. .. = "--:--"

12-hour:

• 34 12 .. .. = "12:34A"

• 34 32 .. .. = "12:34P"

• 23 01 .. .. = "1:23A"

• 23 21 .. .. = "1:23P"

• FF FF .. .. = "--:--A"

Note the offset of 20 in the second byte to make the distinction between AM and PM in the 12-hour clock.

What is up with the last two bytes? Simple… That's the date of arrival. Data 41 19 25 02 in the log means the

time of arrival is 19:45 (45 19) on February 25 (25 02). The current date was (in my bench setup) February 24,

so I would arrive at the destination tomorrow evening. The MID does not display the date!

Note that the date format is reversed for the 12-hour time. Examples:

24-hour:

• .. .. 23 01 (January 23)

12-hour:

• .. .. 01 23 (January 23)

INFO: The [DISTANZ] distance screen is a somewhat special screen. It allows the user to enter a distance from

0 to 7999 km or 0 to 4999 miles and the EKM will then calculate the estimated time of arrival. As the car drives,

both distance and estimated time of arrival are updated. If the car stands still, the distance remains constant

but the time of arrival goes up. If the programmed distance has been reached (distance = 0), it will continue

counting but now negative. The screen has 4 displays modes. Imperial with 24-hour time, imperial with 12-

hour time, metric with 12-hour time and metric with 24-hour time.

COMMANDS: 88 (time of arrival), A2 (distance) and BF (user input confirmation).

2012-06-09 15:50:35.002: 01 05 02 A2 34 12 82

2012-06-09 15:50:35.002: MID --> EKM : Distance, 1834 km

2012-06-09 15:50:35.052: 02 05 01 A2 34 12 82

2012-06-09 15:50:35.052: EKM --> MID : Distance, 1834 km

2012-06-09 15:50:35.082: 02 04 01 BF 01 B9


2012-06-09 15:50:35.092: 02 07 01 88 41 19 25 02 F3

2012-06-09 15:50:35.092: EKM --> MID : Cmd_0x88, Data="41 19 25 02"

LOG 0023

ACTION: While on the [DISTANZ] distance screen, pressing the [km/mls] button to change from metric

("km") 24-hour time to imperial ("MLS") 24-hour time.

RESULT: The EKM sent only the recalculated distance as the time of arrival did not change. The same remarks

as for log step 0022 apply here. The display shows "Dist 767 MLS 19:41".

EXTRA: NavCoder shows the distance in kilometers even though the country coding is set to miles.

COMMANDS: A2 (distance) and BC (unit coding).

2012-06-09 15:50:40.119: 01 06 02 BC 10 00 20 89


2012-06-09 15:50:40.129: 02 06 FF BC 10 00 20 77


2012-06-09 15:50:40.149: 02 05 01 A2 67 07 C4


LOG 0024

ACTION: While on the [DISTANZ] distance screen, pressing the [km/mls] button to change from imperial

("MLS") 24-hour time to imperial ("MLS") 12-hour time.

RESULT: The EKM sent only the recalculated time of arrival as the distance did not change. The same remarks

as for log step 0022 apply here. The display shows "Dist 767 MLS 7:41P".

COMMANDS: 88 (time of arrival) and BC (unit coding).

2012-06-09 15:50:44.525: 01 06 02 BC 10 02 20 8B


2012-06-09 15:50:44.535: 02 06 FF BC 10 02 20 75


2012-06-09 15:50:44.535: 02 07 01 88 41 27 02 25 CD

2012-06-09 15:50:44.535: EKM --> MID : Cmd_0x88, Data="41 27 02 25"

LOG 0025

ACTION: While on the [DISTANZ] distance screen, pressing the [km/mls] button to change from imperial

("MLS") 12-hour time to metric ("km") 12-hour time.

RESULT: The EKM sent only the recalculated distance as the time of arrival did not change. The same remarks

as for log step 0022 apply here. The display shows "Dist 1234 km 7:41P".

COMMANDS: A2 (distance) and BC (unit coding).

2012-06-09 15:50:49.042: 01 06 02 BC 00 02 20 9B


2012-06-09 15:50:49.082: 02 06 FF BC 00 02 20 65


2012-06-09 15:50:49.092: 02 05 01 A2 34 12 82


LOG 0026

ACTION: While on the [DISTANZ] distance screen, pressing the [km/mls] button to change from metric

("km") 12-hour time to metric ("km") 24-hour time.

RESULT: The EKM sent only the recalculated time of arrival as the distance did not change. The same remarks

as for log step 0022 apply here. The display shows "Dist 1234 km 19:41".

COMMANDS: 88 (time of arrival) and BC (unit coding).

2012-06-09 15:50:53.578: 01 06 02 BC 00 00 20 99


2012-06-09 15:50:53.618: 02 06 FF BC 00 00 20 67


2012-06-09 15:50:53.648: 02 07 01 88 41 19 25 02 F3

2012-06-09 15:50:53.648: EKM --> MID : Cmd_0x88, Data="41 19 25 02"

LOG 0027

ACTION: The [DISTANZ] distance screen cannot be reset with the [SET/RES] button. The only way to reset

the screen is entering a distance of "0000".

RESULT: The same remarks as for log step 0022 apply here. The display shows "Dist --- km --:--".

COMMANDS: 88 (time of arrival), A2 (distance) and BF (user input confirmation).

2012-06-09 15:51:13.247: 01 05 02 A2 00 00 A4

2012-06-09 15:51:13.247: MID --> EKM : Distance, 0 km

2012-06-09 15:51:13.247: 02 05 01 A2 FF FF A4


2012-06-09 15:51:13.277: 02 04 01 BF 01 B9


2012-06-09 15:51:13.607: 02 07 01 88 FF FF FF FF 8C


LOG 0028

ACTION: While on the [REICHW] range screen, pressing the [km/mls] button to change from metric ("km") to

imperial ("MLS").

RESULT: The display shows "Reichweite --- MLS".

EXTRA: The MID can display values for the range from "0" (00 00) to "7999" (99 79). If the first digit exceeds

7, it is displayed as "+" (plus): "+999" (99 89). Examples:

• 34 12 = "1234"

• 23 01 = "123"

• 23 81 = "+123"

• 12 00 = "12"

• 12 80 = "+12"

• 01 00 = "1"

• 01 80 = "+1"

• 00 00 = "0"

• 00 80 = "+0"

• FF FF = "---"

NavCoder shows the range in km even though the country coding is set to miles.

The range value should blink when it drops below 15 km (9 miles), but I'm not sure how that is achieved. The

MID definitely doesn't interpret the value as a number, so it's either in a similar fashion as with the

temperature or there's another yet unknown command.

INFO: The "+" sign is, according to the manual, used to indicate "a range that will be corrected (measuring

tolerance)". I've noticed it after refueling.

COMMANDS: 96 (range) and BC (unit coding).

2012-06-09 17:33:03.332: 01 06 02 BC 04 00 20 9D


2012-06-09 17:33:03.362: 02 06 FF BC 04 00 20 63


2012-06-09 17:33:03.392: 02 05 01 96 FF FF 90

2012-06-09 17:33:03.392: EKM --> MID : Range, --- km

LOG 0029

ACTION: While on the [REICHW] range screen, pressing the [km/mls] button again to change back from

imperial to metric.

RESULT: The same remarks as for the previous step apply here. The display shows "Reichweite --- km".

COMMANDS: 96 (range) and BC (unit coding).

2012-06-09 17:33:08.410: 01 06 02 BC 00 00 20 99


2012-06-09 17:33:08.440: 02 06 FF BC 00 00 20 67


2012-06-09 17:33:08.470: 02 05 01 96 FF FF 90

2012-06-09 17:33:08.470: EKM --> MID : Range, --- km

LOG 0030

ACTION: Change to the [LIMIT] speed limit screen. The display shows "Limit --- km/h". Enter speed limit

"123" and confirm with the [SET/RES] button.

RESULT: The MID sends the entered speed limit to the EKM using command 99 and requests to activate the

speed limit with command 9C. The display shows "Limit 123 km/h" and the speed limit LED on the MID

lights up.

EXTRA: The MID can display values for the speed limit from "0" (00 00) to "999" (99 09) although the MID

does not permit the user to enter metric speeds over "299" (99 02) km/h or imperial speeds over "199" (99

01) miles per hour. The EKM does not accept values below 6 km/h (4 mph) or over 299 km/h (185 mph). If a

value outside these boundaries is entered, the EKM replies with confirmation command BF data 00 and resets

the speed limit to the last known valid value (or "---" if never programmed before). Examples:

Speed limit (command 99):

• 23 01 = "123"

• 12 00 = "12"

NavCoder seems to recognize command 9C, but nevertheless does not interpret its value correctly.

Speed limit status (command 9C) from MID to EKM:

• 01 (request disable speed limit)

• 10 (request reset speed limit)

• 11 (request enable speed limit)

Speed limit status (command 9C) from EKM to MID:

• 00 (speed limit disabled, recall last valid command 98 speed – limit LED off)

• 01 (speed limit disabled, recall last valid command 99 speed – limit LED off)

• 11 (speed limit enabled – limit LED on)

• 31 (speed limit enabled and programmed speed exceeded – limit LED blinks)

Middle East E31 have a factory-coded speed limit of 120 km/h independent from the [LIMIT] speed limit

screen functionality. If the factory-coded speed limit is exceeded command C9 from EKM to MID gets an offset

of 80 but this has no effect on the MID. In other words if no other speed limit is programmed, command C9

has data 80 when exceeding 120 km/h, but this command does not have any visual effect on the MID. Instead

the EKM sends a check control command to show "SPEED LIMIT" on the display. This is bloody annoying I

am told because you cannot cancel the message (it returns after a few seconds if you switch to another

screen).

COMMANDS: 99 (speed limit), 9C (speed limit status) and BF (user input confirmation).

2012-06-10 11:36:16.147: 01 05 02 99 23 01 BD

2012-06-10 11:36:16.147: MID --> EKM : Cmd_0x99, Data="23 01"

2012-06-10 11:36:16.178: 01 04 02 9C 11 8A

2012-06-10 11:36:16.178: MID --> EKM : Limit, Off

2012-06-10 11:36:16.188: 02 05 01 99 23 01 BD

2012-06-10 11:36:16.188: EKM --> MID : Cmd_0x99, Data="23 01"

2012-06-10 11:36:16.188: 02 04 01 BF 01 B9


2012-06-10 11:36:16.218: 02 04 01 9C 11 8A

2012-06-10 11:36:16.218: EKM --> MID : Limit, Off

LOG 0031

ACTION: While on the [LIMIT] speed limit screen, pressing the [km/mls] button to change from metric

("km/h") to imperial ("MPH").

RESULT: The display shows "Limit 76 MPH" as expected.

EXTRA: Two mystery commands appear: 98 and 9D. Command 99 is the programmed speed limit whereas

command 98 defines the default speed limit. In my tests the EKM always used "---" (FF FF) for the default

speed limit, so whenever the programmed speed limit was reset by the user it defaulted to "---". The EKM

can however set a different default speed limit through command 98, say for example "120" (20 01). In that

case, when the user then resets the programmed speed limit the display reverts not to "---" but "120". I do

not think this functionality was ever used.

Command 9D is the factory-coded speed limit and is "---" (FF FF) for all E31 except those for the Middle East

where it is set to "120" (20 01) when the [LIMIT] speed limit screen is metric ("km/h") or "75" (75 00) when

imperial ("MPH").

COMMANDS: 98 (default speed limit), 99 (speed limit), 9D (factory-coded speed limit) and BC (unit coding).

2012-06-10 11:36:25.150: 01 06 02 BC 40 00 20 D9


2012-06-10 11:36:25.180: 02 06 FF BC 40 00 20 27


2012-06-10 11:36:25.190: 02 05 01 9D FF FF 9B


2012-06-10 11:36:25.221: 02 05 01 98 FF FF 9E


2012-06-10 11:36:25.221: 02 05 01 99 76 00 E9

2012-06-10 11:36:25.221: EKM --> MID : Cmd_0x99, Data="76 00"

LOG 0032

ACTION: While on the [LIMIT] speed limit screen, pressing the [km/mls] button again to change back from

imperial to metric.

RESULT: The display shows "Limit 123 km/h".

COMMANDS: 98 (default speed limit), 99 (speed limit), 9D (factory-coded speed limit) and BC (unit coding).

2012-06-10 11:36:28.565: 01 06 02 BC 00 00 20 99


2012-06-10 11:36:28.595: 02 06 FF BC 00 00 20 67


2012-06-10 11:36:28.625: 02 05 01 9D FF FF 9B


2012-06-10 11:36:28.625: 02 05 01 98 FF FF 9E


2012-06-10 11:36:28.655: 02 05 01 99 23 01 BD

2012-06-10 11:36:28.655: EKM --> MID : Cmd_0x99, Data="23 01"

LOG 0033

ACTION: While on the [LIMIT] speed limit screen, pressing the [LIMIT] button to turn off the speed limit

without erasing the programmed value.

RESULT: The display still shows "Limit 123 km/h" but the speed limit LED goes off.

COMMANDS: 9C (speed limit status).

2012-06-10 11:36:32.811: 01 04 02 9C 01 9A

2012-06-10 11:36:32.811: MID --> EKM : Limit, Off

2012-06-10 11:36:32.851: 02 04 01 9C 01 9A

2012-06-10 11:36:32.851: EKM --> MID : Limit, Off

LOG 0034

ACTION: While on the [LIMIT] speed limit screen, pressing the [LIMIT] button to turn on the previously set

speed limit again.

RESULT: The display still shows "Limit 123 km/h" and the speed limit LED turns on again.

COMMANDS: 9C (speed limit status).

2012-06-10 11:42:01.644: 01 04 02 9C 11 8A

2012-06-10 11:42:01.644: MID --> EKM : Limit, Off

2012-06-10 11:42:01.644: 02 04 01 9C 11 8A

2012-06-10 11:42:01.644: EKM --> MID : Limit, Off

LOG 0035

ACTION: While on the [LIMIT] speed limit screen, pressing the [SET/RES] button to reset the programmed

value.

RESULT: The MID sends the EKM command 9C data 01 and data 10 to respectively disable and reset the

speed limit. The display shows "Limit --- km/h" and the speed limit LED turns off.

COMMANDS: 98 (speed limit) and 9C (speed limit status).

2012-06-10 11:42:05.830: 01 04 02 9C 01 9A

2012-06-10 11:42:05.830: MID --> EKM : Limit, Off

2012-06-10 11:42:05.981: 01 04 02 98 00 9F

2012-06-10 11:42:05.981: MID --> EKM : Cmd_0x98, Data="00"

2012-06-10 11:42:05.981: 01 04 02 9C 10 8B

2012-06-10 11:42:05.981: MID --> EKM : Limit, Off

2012-06-10 11:42:05.981: 02 04 01 9C 01 9A

2012-06-10 11:42:05.981: EKM --> MID : Limit, Off

2012-06-10 11:42:05.991: 02 05 01 98 FF FF 9E


2012-06-10 11:42:05.991: 02 04 01 9C 00 9B

2012-06-10 11:42:05.991: EKM --> MID : Limit, Off

LOG 0036

ACTION: While on the [TIMER] timer screen, pressing the [SET/RES] button to start the stopwatch. Initially

the display shows "Timer 0,0 sec".

RESULT: The MID uses command 86 data 00 to initialize the timer and then starts it by sending command 05.

The EKM answers command 86 twice with only a single bit difference. Data 00 00 00 00 initializes the

displayed time to "Timer 0,0 sec", whereas data 01 00 00 00 is the first stopwatch value which displays

"Timer 0 sec" (tenths of seconds are omitted when the stopwatch is running) and turns on the timer LED.

EXTRA: The MID can display values for the timer from "0 sec" (0. 00 00 00) to "99:59 h" (9. 59 59 99)

(actually 99 hours, 59 minutes, 59 seconds and 9 tenths of a second). When under a minute and frozen or

stopped, the MID displays tenths of a second. Examples:

• 00 (request reset)

• 0. 56 34 12 = "12:34 h"

• 0. 34 12 00 = "12:34 min"

• 30 12 00 00 = "12,3 sec" (show tenths of a second – timer LED off)

• 31 12 00 00 = "12 sec" (hide tenths of a second – timer LED on)

• .0 .. .. .. (timer LED off)

• .1 .. .. .. (timer LED on)

INFO: The [TIMER] timer screen is nothing but a stopwatch. The stopwatch can be started and stopped with

the [SET/RES] button and frozen or reset by pressing the [TIMER] button. In cars equipped with park

ventilation or heating, the timer screen is replaced by two programmable times on which the ventilation or

heating activates for 30 minutes.

COMMANDS: 05 (start timer) and 86 (timer).

2012-06-10 14:53:20.220: 01 04 02 86 00 81

2012-06-10 14:53:20.220: MID --> EKM : Cmd_0x86, Data="00"

2012-06-10 14:53:20.250: 01 03 02 05 05

2012-06-10 14:53:20.250: MID --> EKM : Cmd_0x05

2012-06-10 14:53:20.250: 02 07 01 86 00 00 00 00 82

2012-06-10 14:53:20.250: EKM --> MID : Cmd_0x86, Data="00 00 00 00"

2012-06-10 14:53:20.250: 02 07 01 86 01 00 00 00 83

2012-06-10 14:53:20.250: EKM --> MID : Cmd_0x86, Data="01 00 00 00"

LOG 0037

ACTION: None.

RESULT: The EKM sends an updated timer time every second. Even when the timer goes over an hour and the

seconds are no longer displayed, it will send out command 86 every second.

COMMANDS: 86 (timer).

2012-06-10 14:53:21.251: 02 07 01 86 01 01 00 00 82

2012-06-10 14:53:21.251: EKM --> MID : Cmd_0x86, Data="01 01 00 00"

2012-06-10 14:53:22.253: 02 07 01 86 01 02 00 00 81

2012-06-10 14:53:22.253: EKM --> MID : Cmd_0x86, Data="01 02 00 00"

2012-06-10 14:53:23.244: 02 07 01 86 01 03 00 00 80

2012-06-10 14:53:23.244: EKM --> MID : Cmd_0x86, Data="01 03 00 00"

2012-06-10 14:53:24.245: 02 07 01 86 01 04 00 00 87

2012-06-10 14:53:24.255: EKM --> MID : Cmd_0x86, Data="01 04 00 00"

2012-06-10 14:53:25.247: 02 07 01 86 01 05 00 00 86

2012-06-10 14:53:25.247: EKM --> MID : Cmd_0x86, Data="01 05 00 00"

2012-06-10 14:53:26.258: 02 07 01 86 01 06 00 00 85

2012-06-10 14:53:26.258: EKM --> MID : Cmd_0x86, Data="01 06 00 00"

LOG 0038

ACTION: While on the [TIMER] timer screen, pressing the [TIMER] button to freeze the display.

RESULT: The timer keeps on running, but the displayed value is frozen. Note that the EKM does not use

command 86 to display the frozen time, but 87. The display shows "Timer 6,7 sec". While frozen the timer

LED blinks.

EXTRA: Command 87 overrides and cancels the display of command 86 until unfrozen or stopped. The way

command 87 displays times is similar to that of command 86. Examples:

• 00 (request freeze)

• 01 (request unfreeze)

• 01 56 34 12 = "12:34 h" (freeze timer display – timer LED blinks)

• 01 34 12 00 = "12:34 min" (freeze timer display – timer LED blinks)

• 31 12 00 00 = "12,3 sec" (freeze timer display – timer LED blinks)

• .0 .. .. .. (unfreeze timer display and resume normal timer operation. The last received command

86 value is immediately displayed and any value that came with this command 87 message is never

shown)

Command 87 should only be used when the timer is running.

COMMANDS: 87 (freeze timer).

2012-06-10 14:53:26.959: 01 04 02 87 00 80

2012-06-10 14:53:26.959: MID --> EKM : Cmd_0x87, Data="00"

2012-06-10 14:53:26.989: 02 07 01 87 71 06 00 00 F4

2012-06-10 14:53:26.989: EKM --> MID : Cmd_0x87, Data="71 06 00 00"

LOG 0039

ACTION: None.

RESULT: Same as log step 0037, but the MID no longer refreshes its display while frozen. It's as if it now

ignores command 86.


2012-06-10 14:53:27.250: 02 07 01 86 01 07 00 00 84

2012-06-10 14:53:27.250: EKM --> MID : Cmd_0x86, Data="01 07 00 00"

2012-06-10 14:53:28.251: 02 07 01 86 01 08 00 00 8B

2012-06-10 14:53:28.251: EKM --> MID : Cmd_0x86, Data="01 08 00 00"

2012-06-10 14:53:29.243: 02 07 01 86 01 09 00 00 8A

2012-06-10 14:53:29.243: EKM --> MID : Cmd_0x86, Data="01 09 00 00"

2012-06-10 14:53:30.254: 02 07 01 86 01 10 00 00 93

2012-06-10 14:53:30.254: EKM --> MID : Cmd_0x86, Data="01 10 00 00"

2012-06-10 14:53:31.246: 02 07 01 86 01 11 00 00 92

2012-06-10 14:53:31.246: EKM --> MID : Cmd_0x86, Data="01 11 00 00"

2012-06-10 14:53:32.247: 02 07 01 86 01 12 00 00 91

2012-06-10 14:53:32.247: EKM --> MID : Cmd_0x86, Data="01 12 00 00"

LOG 0040

ACTION: While on the [TIMER] timer screen, pressing the [TIMER] button again to unfreeze the display and

continue counting.

RESULT: The timer resumes normal operation.

EXTRA: Even though the (frozen) time is included in the data of command 87 sent to the MID, it is discarded

and the display immediately displays the last received time for command 86.

COMMANDS: 87 (freeze timer).

2012-06-10 14:53:34.801: 01 04 02 87 01 81

2012-06-10 14:53:34.801: MID --> EKM : Cmd_0x87, Data="01"

2012-06-10 14:53:34.821: 02 07 01 87 70 06 00 00 F5

2012-06-10 14:53:34.821: EKM --> MID : Cmd_0x87, Data="70 06 00 00"

LOG 0041

ACTION: None.

RESULT: Same as log step 0037 and 0039 but now the MID is no longer frozen and refreshes its display again

with each command 86.


2012-06-10 14:53:35.251: 02 07 01 86 01 15 00 00 96

2012-06-10 14:53:35.251: EKM --> MID : Cmd_0x86, Data="01 15 00 00"

2012-06-10 14:53:36.253: 02 07 01 86 01 16 00 00 95

2012-06-10 14:53:36.253: EKM --> MID : Cmd_0x86, Data="01 16 00 00"

2012-06-10 14:53:37.254: 02 07 01 86 01 17 00 00 94

2012-06-10 14:53:37.254: EKM --> MID : Cmd_0x86, Data="01 17 00 00"

2012-06-10 14:53:38.246: 02 07 01 86 01 18 00 00 9B

2012-06-10 14:53:38.246: EKM --> MID : Cmd_0x86, Data="01 18 00 00"

2012-06-10 14:53:39.247: 02 07 01 86 01 19 00 00 9A

2012-06-10 14:53:39.247: EKM --> MID : Cmd_0x86, Data="01 19 00 00"

2012-06-10 14:53:40.248: 02 07 01 86 01 20 00 00 A3

2012-06-10 14:53:40.248: EKM --> MID : Cmd_0x86, Data="01 20 00 00"

LOG 0042

ACTION: While on the [TIMER] timer screen, pressing the [SET/RES] button to stop the timer.

RESULT: The MID sends command 04 and the EKM stops the timer and answers with the time at that moment.

The display shows "Timer 21,5 sec" and the timer LED goes off.

COMMANDS: 04 (stop timer) and 86 (timer).

2012-06-10 14:53:41.751: 01 03 02 04 04

2012-06-10 14:53:41.751: MID --> EKM : Cmd_0x04

2012-06-10 14:53:41.781: 02 07 01 86 50 21 00 00 F3

2012-06-10 14:53:41.781: EKM --> MID : Cmd_0x86, Data="50 21 00 00"

LOG 0043

ACTION: While on the [TIMER] timer screen, pressing the [TIMER] button to reset the displayed time.

RESULT: The display shows "Timer 0,0 sec".


2012-06-10 14:53:48.921: 01 04 02 86 00 81

2012-06-10 14:53:48.921: MID --> EKM : Cmd_0x86, Data="00"

2012-06-10 14:53:48.941: 02 07 01 86 00 00 00 00 82

2012-06-10 14:53:48.941: EKM --> MID : Cmd_0x86, Data="00 00 00 00"

LOG 0044

ACTION: Turned ignition key back to position 0 (permanent power).

RESULT: Just a single command F8 from the EKM.

EXTRA: Command F8 is the ignition key position. Examples:

• 00 .. (ignition key position 0 – permanent power)

• 01 .. (ignition key position I – accessories)

• 03 .. (ignition key position II – ignition on)

• .. 00 (code LED off)

• .. 04 (code LED on)

• .. 0C (code LED blinks)

There may be other values for command F8.

COMMANDS: F8 (ignition status).

2012-06-10 17:31:28.814: 02 05 FF F8 00 00 00


LOG 0045

ACTION: None.

RESULT: The EKM keeps on sending its usual minute-by-minute time updates and command FB data 07 06,

but exactly 2 minutes after the ignition key was turned back to position 0, the module enters sleep mode and

the I-bus is suspended. No further communication is possible on the I-bus.

INFO: If the ignition is turned on again before the I-bus is suspended, only command F8 is sent again. If the I-

bus is suspended, turning on the ignition leads to a full initialization again.

COMMANDS: 83 (time) and FB (?).

2012-06-10 17:32:06.358: 02 05 FF 83 07 16 6A

2012-06-10 17:32:06.358: EKM --> GLO : Time, 16:07

2012-06-10 17:32:10.333: 02 05 FF FB 07 06 02


2012-06-10 17:33:06.364: 02 05 FF 83 08 16 65

2012-06-10 17:33:06.364: EKM --> GLO : Time, 16:08

2012-06-10 17:33:10.330: 02 05 FF FB 07 06 02


Upgraded from NavCoder v2.9.174.Beta to v2.9.176.Beta.

LOG 0046


RESULT: The I-bus was suspended thus a full initialization is performed. The initialization does not differ much

from log step 0001, but this time the EKM has its time and date already set and some information screens

have values stored from the steps performed earlier.

Note that the type mismatch error for command 90 is fixed in NavCoder v2.9.176.Beta, but the value

NavCoder displays is totally wrong.

COMMANDS: See log step 0001.

2012-06-12 17:19:50.714: 00

2012-06-12 17:19:50.714: WARNING: Discarded 1 bytes: [00]

2012-06-12 17:19:50.734: 02 04 FF FA 01 02

2012-06-12 17:19:50.734: EKM --> GLO : Vehicle Data request, Data="01"

2012-06-12 17:19:50.764: 02 05 FF F8 01 00 01


2012-06-12 17:19:50.764: 3F 00 00 3F 00

2012-06-12 17:19:50.764: WARNING: Discarded 5 bytes: [3F 00 00 3F 00]

2012-06-12 17:19:50.784: 02 05 FF FB 07 06 02


2012-06-12 17:19:50.814: 02 04 08 81 00 8F

2012-06-12 17:19:50.814: EKM --> 0x08: Door status, Data="00"

2012-06-12 17:19:50.814: 01 04 02 FA 03 FE

2012-06-12 17:19:50.814: MID --> EKM : Vehicle Data request, Data="03"

2012-06-12 17:19:50.824: 02 05 FF F8 01 00 01


2012-06-12 17:19:50.834: 02 05 FF FB 07 06 02


2012-06-12 17:19:50.834: 02 05 01 C8 00 00 CE

2012-06-12 17:19:50.834: EKM --> MID : Check Control Display, --- Display Off --- DB2...DBn="00"

2012-06-12 17:19:50.864: 02 04 01 AC 01 AA


2012-06-12 17:19:50.864: 02 05 01 AE 00 00 A8

2012-06-12 17:19:50.864: EKM --> MID : Cmd_0xAE, Data="00 00"

2012-06-12 17:19:50.874: 02 06 FF A4 DD AB 03 2A

2012-06-12 17:19:50.874: EKM --> GLO : Cmd_0xA4, Data="DD AB 03"

2012-06-12 17:19:50.884: 02 04 FF A5 00 5C

2012-06-12 17:19:50.884: EKM --> GLO : Cmd_0xA5, Data="00"

2012-06-12 17:19:50.884: 02 06 FF BC 00 00 20 67


2012-06-12 17:19:50.924: 02 05 FF BD 00 00 45


2012-06-12 17:19:50.934: 02 07 01 86 00 00 00 00 82

2012-06-12 17:19:50.934: EKM --> MID : Cmd_0x86, Data="00 00 00 00"

2012-06-12 17:19:50.934: 02 07 01 87 00 00 00 00 83

2012-06-12 17:19:50.934: EKM --> MID : Cmd_0x87, Data="00 00 00 00"

2012-06-12 17:19:50.944: 02 05 FF 83 50 16 3D

2012-06-12 17:19:50.944: EKM --> GLO : Time & Memo, , Time=10:50

2012-06-12 17:19:50.944: 02 05 FF FC B6 11 A3

2012-06-12 17:19:50.944: EKM --> GLO : Cmd_0xFC, Data="B6 11"

2012-06-12 17:19:50.984: 02 07 FF 82 24 02 13 07 4A

2012-06-12 17:19:50.984: EKM --> GLO : Date, 24/02/2013, zo

2012-06-12 17:19:50.994: 02 04 01 9C 00 9B

2012-06-12 17:19:50.994: EKM --> MID : Limit, Off

2012-06-12 17:19:50.994: 02 05 01 9D FF FF 9B


2012-06-12 17:19:51.004: 02 05 01 98 FF FF 9E


2012-06-12 17:19:51.004: 02 05 01 99 23 01 BD

2012-06-12 17:19:51.004: EKM --> MID : Cmd_0x99, Data="23 01"

2012-06-12 17:19:51.014: 02 04 01 8C 00 8B

2012-06-12 17:19:51.014: EKM --> MID : Cmd_0x8C, Data="00"

2012-06-12 17:19:51.044: 02 05 01 8E FF FF 88

2012-06-12 17:19:51.044: EKM --> MID : Cmd_0x8E, Data="FF FF"

2012-06-12 17:19:51.044: 02 05 01 8F FF FF 89

2012-06-12 17:19:51.044: EKM --> MID : Cmd_0x8F, Data="FF FF"

2012-06-12 17:19:51.054: 02 05 FF A0 00 43 1B

2012-06-12 17:19:51.054: EKM --> GLO : Cmd_0xA0, Data="00 43"

2012-06-12 17:19:51.064: 02 05 01 92 FF FF 94





showMsg

2012-06-12 17:19:51.215: 02 05 01 A2 FF FF A4


2012-06-12 17:19:51.225: 02 07 01 88 FF FF FF FF 8C


2012-06-12 17:19:51.225: 02 05 01 96 FF FF 90

2012-06-12 17:19:51.225: EKM --> MID : Range, --- km

2012-06-12 17:19:51.225: 02 05 01 90 FF FF 96

2012-06-12 17:19:51.225: EKM --> MID : Vehicle Speed, 2575,5 kmph

2012-06-12 17:19:51.235: 02 07 01 C0 00 00 09 13 DE

2012-06-12 17:19:51.235: EKM --> MID : Service Indicator, [ ], Data="00 00 09 13"

2012-06-12 17:19:51.235: 02 0B 01 BE FF FF FF FF FF FF FF FF B6

2012-06-12 17:19:51.235: EKM --> MID : Cmd_0xBE, Data="FF FF FF FF FF FF FF FF"

2012-06-12 17:19:51.235: 02 06 FF BC 00 00 20 67


2012-06-12 17:19:51.245: 02 05 FF BD 00 00 45


2012-06-12 17:19:51.275: 02 07 01 86 00 00 00 00 82

2012-06-12 17:19:51.275: EKM --> MID : Cmd_0x86, Data="00 00 00 00"

2012-06-12 17:19:51.275: 02 07 01 87 00 00 00 00 83

2012-06-12 17:19:51.275: EKM --> MID : Cmd_0x87, Data="00 00 00 00"

2012-06-12 17:19:51.745: 02 05 FF A0 00 C3 9B


LOG 0047

ACTION: Change to the [CODE] code immobilizer screen. The display shows "Code ----". Enter code "1234"

and confirm with the [SET/RES] button.

RESULT: No I-bus activity. The code is not sent to the EKM until the ignition key is turned back to position 0

(permanent power).

INFO: The [CODE] code immobilizer screen allows the user to enter a 4-digit code before shutting down the

car. On the next entry, the code must be entered or the engine will not start and no MID functions will work

(apart from time, date and MEMO). Once the code is correctly entered, it is lost. In other words, the user has to

enter a code each time he/she wants to use the immobilizer.

In 1995 the 8 Series was upgraded with the far more advanced EWS II immobilizer system that has

transponders in the keys, but the [CODE] code immobilizer screen was kept and still works.

LOG 0048

ACTION: Turned ignition key back to position 0 (permanent power).

RESULT: The EKM sends out the change in ignition state and the MID immediately replies with command A8

and the entered code as data. Once the EKM received the code it sends out command AC data 02 to lock the

MID to the code screen. The MID display is off by now but any actions performed on the MID will prompt you

to enter the code.

The ignition status is updated with command F8 data 00 04. This causes the code LED to light up.

EXTRA: Command AC seems to have only two states: 01 (normal MID operation) and 02 (lock MID to code

screen).

COMMANDS: A8 (immobilizer code), AC (MID code lock) and F8 (ignition status).

2012-06-12 17:26:42.887: 02 05 FF F8 00 00 00


2012-06-12 17:26:42.917: 01 05 02 A8 34 12 88

2012-06-12 17:26:42.917: MID --> EKM : Cmd_0xA8, Data="34 12"

2012-06-12 17:26:42.917: 02 04 01 AC 02 A9


2012-06-12 17:26:43.207: 02 05 FF F8 00 04 04


LOG 0049


RESULT: Since less than 2 minutes went by since the last log step, the I-bus was not yet suspended and thus

the full initialization did not occur. Normally you wouldn't use the code immobilizer if you intend to restart

soon, but this way the output is not cluttered with non-related commands. The MID updated the ignition

status with command F8 data 01 04, immediately followed by data 01 0C. This causes the code LED to blink.

The display shows "Code ----" and no other screens work.

COMMANDS: F8 (ignition status).

2012-06-12 17:27:01.283: 02 05 FF F8 01 04 05


2012-06-12 17:27:01.714: 02 05 FF F8 01 0C 0D

2012-06-12 17:27:01.714: EKM --> GLO : Cmd_0xF8, Data="01 0C"

LOG 0050

ACTION: Entered "5678" (wrong code) on the [CODE] code immobilizer screen and confirmed with the

[SET/RES] button.

RESULT: The MID sends the code to the EKM which simply repeats the MID code lock. Note that entering the

code now uses command AA instead of AC.

COMMANDS: AA (immobilizer code) and AC (MID code lock).

2012-06-12 17:29:04.130: 01 05 02 AA 78 56 82

2012-06-12 17:29:04.130: MID --> EKM : Cmd_0xAA, Data="78 56"

2012-06-12 17:29:04.150: 02 04 01 AC 02 A9


LOG 0051

ACTION: Entered "1234" (correct code) on the [CODE] code immobilizer screen and confirmed with the

[SET/RES] button.

RESULT: Now the EKM releases the MID code lock and the code LED turns off.

COMMANDS: AA (immobilizer code) and AC (MID code lock).

2012-06-12 17:27:30.052: 01 05 02 AA 34 12 8A

2012-06-12 17:27:30.052: MID --> EKM : Cmd_0xAA, Data="34 12"

2012-06-12 17:27:30.082: 02 04 01 AC 01 AA


2012-06-12 17:27:30.212: 02 05 FF F8 01 00 01


logging and analysis of bmw e31 8 series i-bus

Documents