BMW CAN IDs Reference

Static HTML generated from the merged BMW E8x/E9x DBC. Simple offline reference for CAN IDs, messages, and signals.

Source: bmw_e9x_e8x1_merged.dbc Generated: 2026-05-03 17:27:52 Messages: 386 Signals: 426

Message Index (386 messages)

0x080 · SYNC 0x085 · Synchronization_SC_VDA 0x0A8 · EngineAndBrake 0x0A9 · Torque2 0x0AA · AccPedal 0x0AC · WheelTorqueDrivetrain2 0x0AD · Delay_request_ACC 0x0B1 · Torque_request_steering 0x0B3 · Control_steering_assist 0x0B4 · WheelTorqueDriveTrain1 0x0B5 · Torque_request_EGS 0x0B6 · Torque_request_DSC 0x0B7 · Torque_request_ACC 0x0B8 · Torque_request_DCT 0x0B9 · Torque_request_AFS 0x0BA · TransmissionData 0x0BB · Target_torque_request 0x0BC · Status_target_torque_conversion 0x0BD · Torque_request_SSG 0x0BE · Alive_Counter 0x0BF · RequestedWheelTorqueDriveTrain 0x0C0 · Alive_Central_Gateway 0x0C1 · Alive_counter_telephone 0x0C4 · SteeringWheelAngle 0x0C8 · SteeringWheelAngle_slow 0x0C9 · SteeringWheelAngle_DSC 0x0CD · Accelerometer2 0x0CE · WheelSpeeds 0x0D1 · Accelerometer1 0x0D4 · Unknown_d4 0x0D5 · Request_wheel_torque_brake 0x0D7 · Alive_Counter_Security 0x0D8 · CLU1_VDA 0x0E1 · Wheel_torque_brake 0x0E2 · Status_central_locking_BFT 0x0E3 · CLU2_VDA 0x0E6 · Status_central_locking_BFTH 0x0EA · Status_central_locking_FAT 0x0EE · Central_locking_status_FATH 0x0F2 · Status_central_locking_HK 0x0F4 · CLU3_VDA 0x0F6 · MirrorControl_0F6 0x0F7 · lateral_dynamics_ARS_VDM 0x0F9 · Vertical_dynamics_VDM_ARS 0x0FA · Control_window_lifter_FAT 0x0FB · Control_window_lifter_BFT 0x0FC · Control_window_lifter_FATH 0x0FD · Control_window_lifter_BFTH 0x0FE · Voltage_level_sensors 0x118 · Exchange_AFS_DSC 0x11E · Control_interventions_DSC_AFS 0x120 · Status_partial_setpoints_AFS_DSC_2 0x12A · Sensor_data_ROSE 0x12C · input_data_ROSE 0x130 · TerminalStatus 0x135 · CrashDisconnectControl 0x140 · Unknown140 0x150 · Request_1_ACC 0x153 · Request_2_ACC 0x159 · Object_data_ACC 0x15C · Status_ACC 0x15F · Requirement_angle_FFP 0x165 · CLU_Status_VDA 0x172 · Acknowledgment_request_Kombination 0x175 · Display_motor_data 0x190 · display_ACC 0x192 · GearSelectorSwitch_1 0x193 · DynamicCruiseControlStatus 0x194 · CruiseControlStalk 0x195 · Operation_push_button_MSA 0x198 · GearSelectorSwitch 0x19E · StatusDSC_KCAN 0x1A0 · Speed 0x1A1 · SpeedKombi_1A1 0x1A2 · TransimissionData2 0x1A3 · Raw_data_longitudinal_acceleration 0x1A6 · DistanceRoute 0x1A7 · actuation_request_EMF 0x1AA · Effect_ErgoCommander 0x1AC · Status_ARS_module 0x1B4 · InstrumentClusterStatus_KOMBI 0x1B5 · HeatFlow_LoadTorqueClimate 0x1B6 · HeatFlowEngine 0x1B8 · Operation_ErgoCommander 0x1C2 · Distance_message_PDC 0x1C3 · Distance_message_2_PDC 0x1C6 · Acoustic_message_PDC 0x1D0 · EngineData 0x1D2 · TransmissionDataDisplay 0x1D6 · SteeringButtons 0x1D8 · Operation_air_conditioning_air_distribution_FA 0x1D9 · Operation_pushbutton_MDrive 0x1DA · Climate_control_remote_control 0x1DC · Operation_stratification_seat_heating 0x1DE · Air_conditioning_controls_rear 0x1E0 · Operation_air_conditioning_air_distribution_BF 0x1E1 · DoorStatus_Counter_1E1 0x1E2 · Operation_air_conditioning_front 0x1E3 · Operation_pushbutton_interior_lighting 0x1E7 · Operation_seat_heating_seat_climate_FA 0x1E8 · Operation_seat_heating_seat_climate_BF 0x1EA · Steering_column_adjustment_control 0x1EB · Operation_active_seat_FA 0x1EC · Operation_active_seat_BF 0x1ED · Operation_backrest_adjust_FA 0x1EE · Steering_column_switch_operation 0x1EF · Operation_backrest_adjust_BF 0x1F2 · Operation_seat_memory_BF 0x1F3 · Operation_seat_memory_FA 0x1F6 · TurnSignals 0x1F8 · Operation_SHD_MDS 0x1FB · Status_EPS 0x1FC · Status_AFS 0x1FD · Status_request_EMF_KCAN 0x1FE · Crash 0x200 · CruiseControlStatus 0x201 · Status_EMF_KCAN 0x202 · Dimming 0x205 · Acoustic_request_Kombi 0x206 · Control_Display_Shiftlights 0x20B · Memory_adjustment 0x20C · Steering_column_control 0x20D · Position_steering_column 0x210 · Operation_HUD 0x211 · Status_HUD 0x212 · Height_levels_air_spring 0x21A · LampStatus 0x21C · Operation_NightVision 0x21E · Status_NightVision 0x224 · Operation_push_button_NSW 0x226 · RainSensorWiperSpeed 0x228 · Operation_special_function 0x22A · Status_BFS 0x22C · Operation_push_button_NSL 0x232 · Status_FAS 0x236 · Status_FASH 0x23A · Status_radio_key 0x23B · Status_climate_front_extended 0x23D · Request_display_climate 0x23E · Status_Klima_Fond 0x242 · ClimateFrontStatus 0x246 · Status_air_conditioning_front_control_unit 0x248 · Status_rear_view_camera 0x249 · Control_rear_view_camera 0x24A · Status_PDC 0x24B · Status_door_sensors 0x252 · Wiper_status 0x256 · Challenge_Passive_Access 0x258 · Status_Transmission_Passive_Access 0x25C · Operation_of_climate_additional_programs 0x264 · iDrive_Rotary_264 0x267 · iDrive_Buttons_267 0x26B · Operation_blinds_BF 0x26C · Operation_blinds_FA 0x26D · Operation_blinds_MK 0x26E · Control_FH_SHD_central_comfort 0x273 · CIC_Status_for_Idrive 0x277 · Idrive_Emu_Response_277 0x278 · CIC_278 0x27A · NavGraph_Sync_27A 0x27B · Status_Shiftlights 0x27D · Status_convertible_top_manual_convertible 0x27E · Status_convertible_top_convertible 0x27F · Status_central_locking_convertible_top 0x282 · Control_security_vehicle_2 0x284 · Control_remote_start_safety_vehicle 0x286 · Electrochromic_control 0x28C · Pushbutton_vertical_dynamics 0x28D · Operation_pushbutton_sport 0x290 · Control_response_hydrogen_vehicle 0x292 · Control_high_beam_assistant 0x29E · Central_locking_control_for_security_vehicle 0x29F · Remote_control_FondCommander 0x2A0 · Central_locking_control 0x2A2 · Operation_of_climate_stand_functions 0x2A4 · Operation_personalization 0x2A6 · WiperSwitch 0x2B2 · WheelPressure_KCAN 0x2B3 · AccelerationData 0x2B4 · DWA_Alarm 0x2B6 · Control_horn_DWA 0x2B8 · Operation_onboard_computer 0x2B9 · Operation_RSE 0x2BA · Stopwatch 0x2BD · Request_switching_display 0x2BE · Switch_status_display 0x2BF · Water_valve_control 0x2C0 · LCD_lighting 0x2C2 · Temperatur_Ist_Fond 0x2C7 · Display_Kombination_extended 0x2CA · Outside_temperature 0x2CC · Control_monitor_rear 0x2CE · Control_monitor 0x2CF · Status_of_auxiliary_water_pump 0x2D0 · Status_Sensor_AUC 0x2D1 · Status_fitting_window_V 0x2D2 · Status_pressure_refrigeration_circuit 0x2D3 · Status_stratification_rear 0x2D5 · Status_heating_rear_window 0x2D6 · Status_valve_air_conditioning_compressor 0x2DA · Status_tailgate_lift 0x2DE · Switch_control_display 0x2E2 · Status_setting_video_night_vision 0x2E3 · Status_setting_video_rear_view_camera 0x2E4 · Status_trailer 0x2E6 · Status_of_air_distribution_FA 0x2EA · Status_air_distribution_BF 0x2EE · Status_climate_additional_programs 0x2F0 · Status_air_condition_functions 0x2F1 · Status_driver_detection 0x2F3 · Display_switching_instruction 0x2F4 · Air_conditioning_control_SH_ZH_auxiliary_water_pump 0x2F6 · LightControl 0x2F7 · Units 0x2F8 · Time_Date 0x2FA · OccupancySeatBeltContact 0x2FC · TrunkStatus 0x300 · Status_RSE 0x304 · Status_Gang 0x305 · Operation_button_convertible_top 0x306 · Vehicle_tilt 0x307 · Operation_button_flap_convertible_top 0x308 · Status_MSA 0x310 · AmbientTemperature_RelativeTime 0x311 · Refill_quantity 0x312 · Service_Call_Teleservice 0x313 · Status_Service_Call_Teleservice 0x314 · Status_driving_light 0x315 · Vehicle_mode 0x316 · OperationPushButtonDTC 0x317 · Operation_button_parking_aids 0x318 · Status_antennas_Passive_Access 0x319 · Operation_push_button_RDC 0x31A · Operation_button_HDC 0x31B · Operation_of_tailgate_interior_button 0x31C · Status_tire_pressure 0x31D · TirePressureStatus 0x321 · Operation_button_camera_BF 0x322 · Damper_current 0x326 · Status_damper_program 0x328 · Relativzeit 0x32A · Control_ALC 0x32D · Display_HDC 0x32E · Status_climate_internal_control_info 0x330 · Range_Mileage 0x331 · Programming_of_step_cruise_control 0x332 · Driver_display_speed_range 0x335 · ElectricFuelPumpStatus 0x336 · Display_check_control_message_role 0x337 · StatusFuelControl 0x338 · Control_display_check_control_message 0x339 · Status_display_climate 0x33A · Status_Monitor_Front 0x33C · Status_Monitor_Fond_1 0x33E · Status_Monitor_Fond_2 0x348 · NavGraph_Alignment_348 0x349 · Raw_data_level_tank 0x34A · GPS_34A 0x34B · Status_seat_back_lock_FA 0x34C · NavGraph_GPS2_34C 0x34D · Status_seat_back_lock_BF 0x34E · Navi_sys_info 0x34F · Status_contact_handbrake 0x35A · Appointment_Condition_Based_Service 0x35C · Status_onboard_computer 0x35E · Onboard_computer_data_trip_data 0x360 · Data_onboard_computer_start_of_journey 0x362 · Data_onboard_computer_average_values 0x364 · Data_onboard_computer_arrival 0x365 · Status_terminal_request 0x366 · Display_Kombination_external_display 0x367 · Control_display_of_demand_oriented_service 0x36D · Setting_the_driving_dynamics_switch 0x374 · WheelToleranceAdjustment 0x376 · Status_wear_lamella 0x37D · Status_DKG 0x37E · Temperatur_Bremse 0x37F · Range_of_diesel_exhaust_gas_additive 0x380 · chassis_number 0x381 · EngineOilLevel 0x382 · Electronic_engine_oil_dipstick_M 0x383 · Motor_data_2 0x388 · Vehicle_type 0x38B · Status_battery 0x38E · Start_speed 0x392 · Status_System_AFS 0x394 · RDA_request_data_storage 0x395 · Coding_power_management 0x398 · Operation_chassis 0x399 · Status_MDrive 0x39E · Operation_time_date 0x3A0 · Vehicle_state 0x3A3 · Request_Remote_Services 0x3A9 · Status_motor_control_CKM 0x3AB · Status_Shiftlights_CKM 0x3AC · RunOnTimeTerminal30 0x3B0 · Status_gear_reverse 0x3B1 · TransmissionData3 0x3B3 · PowerManagmentConsumptionControl 0x3B4 · PowerBatteryVoltage 0x3B5 · Status_water_valve 0x3B6 · Position_window_lifter_FAT 0x3B7 · Position_window_lifter_FATH 0x3B8 · Position_window_regulator_BFT 0x3B9 · Position_window_regulator_BFTH 0x3BA · Position_SHD 0x3BC · Position_window_lifter_security_vehicle 0x3BD · Status_consumer_shutdown 0x3BE · PowerRunningTime 0x3BF · Position_window_rear_window 0x3C0 · Configuration_FAS 0x3C1 · Configuration_BFS 0x3C4 · Status_EDCK_CKM 0x3C7 · Access_radio 0x3C8 · Operation_push_button_radio 0x3CC · NavGraph_3CC 0x3CE · Radio_audio_control_interface_display 0x3CF · Acknowledgment_access_radio_audio_control_interface 0x3D3 · Status_solar_sensor 0x3D4 · Configuration_of_central_locking_CKM 0x3D5 · Status_central_locking_CKM 0x3D6 · Configuration_DWA_CKM 0x3D7 · Status_DWA_CKM 0x3D8 · Configuration_RLS_CKM 0x3D9 · Status_RLS_CKM 0x3DA · Configuration_of_memory_positions_CKM 0x3DB · Status_memory_positions_CKM 0x3DC · Configuration_light_CKM 0x3DD · Status_light_CKM 0x3DE · Configuration_Climate_CKM 0x3DF · Status_Klima_CKM 0x3E2 · Configuration_of_tailgate_CKM 0x3E3 · Status_tailgate_CKM 0x3E4 · Configuration_rear_view_camera_CKM 0x3EF · EngineOBD_data 0x3F1 · LightExtStatus_CKM_3F1 0x3F7 · NavGraph_3F7 0x413 · FRM_LampStatus_413 0x415 · FRM_LampStatus_415 0x480 · NetworkMgmt_KGM_480 0x481 · NetworkMgmt_ACSM_481 0x492 · NetworkMgmt_DME_492 0x497 · NetworkMgmt_EKP_497 0x498 · NetworkMgmt_EGS_498 0x4A9 · NetworkMgmt_DSC_4A9 0x4C0 · NetworkMgmt_CAS_4C0 0x4D6 · NetworkManagment_4D6 0x4DE · NetworkMgmt_GWS_4DE 0x4E0 · NetworkMgmt_Kombi_4E0 0x4E2 · NetworkMgmt_CCC_4E2 0x4E7 · NetworkMgmt_ZBE_4E7 0x4F2 · NetworkMgmt_KBM_4F2 0x4F3 · NetworkMgmt_CID_4F3 0x4F8 · NetworkMgmt_IHKA_4F8 0x580 · Services_KGM_580 0x581 · Services_ACSM_581 0x592 · Services_DME_592 0x598 · Services_EGS_598 0x5A9 · Services_DSC_5A9 0x5C0 · Services_CAS_5C0 0x5D6 · Services_5D6 0x5E0 · Services_Kombi_5E0 0x5E2 · ZBE_Button_5E2 0x5E7 · Services_ZBE_5E7 0x5F2 · Services_KBM_5F2 0x5F8 · Services_IHKA_5F8 0x608 · PTCAN_RESP_608_DME 0x60C · PTCAN_RESP_60C_EGS 0x612 · DIAG_RESP_612 0x61A · PTCAN_RESP_61A_DSC 0x629 · Unknown_629 0x63C · DIAG_RESP_63C_IHKA 0x640 · DIAG_RESP_640_CAS 0x656 · DIAG_RESP_656_JBBF 0x658 · DIAG_RESP_658_LM 0x660 · DIAG_RESP_660 0x668 · DIAG_RESP_668_SZL 0x672 · DIAG_RESP_672_FRM3 0x68C · DIAG_RESP_68C_PDC 0x6F1 · DIAG_REQ_6F1 0x7C3 · Keyfob_7C3 0x7DF · OBD2_FUNC_REQ_7DF 0x7E0 · OBD2_PHYS_REQ_7E0_DME 0x7E1 · OBD2_PHYS_REQ_7E1_EGS 0x7E8 · OBD2_RESP_7E8_DME 0x7E9 · OBD2_RESP_7E9_EGS

0x080 · SYNC

Decimal ID: 128 · Transmitter: XXX

DLC 5 3 signals

??????????

Byte layout

—

State1

State2, Counter_128

—

Signal	Position	Format	Scale / Formula	Range	Receivers
State1	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
State2	B3[3:0] lo-nibble DBC: 24\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Vector__XXX
Counter_128	B3[7:4] hi-nibble DBC: 28\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Vector__XXX

0x085 · Synchronization_SC_VDA

Decimal ID: 133 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0A8 · EngineAndBrake

Decimal ID: 168 · Transmitter: DME

DLC 8 17 signals

0x0A8 (DME): Engine torque, brake and clutch status. TORQ_AVL (B2 signed, repeated in B4) is torque demand: ~0x02 at idle, +0x2E (~47) heavy acceleration, 0xFA–0xFD (~−3 to −6) during engine braking/overrun fuel cut. HIL-confirmed in 5min_run_for_testing.log 2026-03-26: highest values (0x27–0x2F) during sustained acceleration in 6th gear.

4F51045004F10F02

Byte layout

Checksum_0xa8

Counter_0xa8, TORQ_AVL

TORQ_AVL

ST_TORQ_AVL, TORQ_AVL_DMEE

TORQ_AVL_DMEE

ST_SW_CLT, ST_RTIR, ST_DMEA_SWO, RCPT_ACC_SWO_SYS_DME

ST_RCPT_ENG_ACC, ST_RCPT_ENG_ARS, ST_RCPT_ENG_DSC, ST_RCPT_ENG_EGS

ST_OBD_CTFN_GRB, BrakePressed, BrakeActive, BrakeStatusInvalid

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xa8	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
Counter_0xa8 Counter TORQ_1	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	EGS,DSC
TORQ_AVL Actual engine torque without inertia - combustion torque	B1..B2 (12b LE, 2 bytes) DBC: 12\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[-1024 .. 1023.5]`	EGS,DSC
ST_TORQ_AVL 0x00 (0) = intervention request executed 0x01 (1) = intervention ignition request not executed 0x02 (2) = intervention injection request not executed 0x03 (3) = intervention ignition and injection request not executed 0x0F (15) = signal invalid	B3+ (4b BE) DBC: 27\|4	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	EGS,DSC
TORQ_AVL_DMEE Theoretical engine torque - without inertia and without shifting interventions	B3..B4 (12b LE, 2 bytes) DBC: 28\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[-1024 .. 1023.5]`	EGS,DSC
ST_SW_CLT clutch switch status	B5+ (2b BE) DBC: 41\|2	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DSC
ST_RTIR	B5+ (2b BE) DBC: 43\|2	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DSC
ST_DMEA_SWO status DME/ACC motronic switch-off	B5[5:4] DBC: 44\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
RCPT_ACC_SWO_SYS_DME receipt_ACC_switch-off_system_DME	B5+ (2b BE) DBC: 47\|2	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DSC
ST_RCPT_ENG_ACC 0x00 (0) = status okay 0x01 (1) = plausibility/activity error 0x02 (2) = timeout error	B6[1:0] DBC: 48\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
ST_RCPT_ENG_ARS 0x00 (0) = status okay 0x01 (1) = plausibility/activity error 0x02 (2) = timeout error	B6[3:2] DBC: 50\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
ST_RCPT_ENG_DSC 0x00 (0) = status okay 0x01 (1) = plausibility/activity error 0x02 (2) = timeout error	B6[5:4] DBC: 52\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
ST_RCPT_ENG_EGS 0x00 (0) = status okay 0x01 (1) = plausibility/activity error 0x02 (2) = timeout error	B6[7:6] DBC: 54\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
ST_OBD_CTFN_GRB	B7+ (5b BE) DBC: 60\|5	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 31]`	EGS,DSC
BrakePressed Brake when driver presses the brake or hill hold	B7+ (1b BE) DBC: 61\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	EGS,DSC
BrakeActive	B7+ (1b BE) DBC: 62\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	EGS,DSC
BrakeStatusInvalid	B7 bit7 DBC: 63\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	EGS,DSC

0x0A9 · Torque2

Decimal ID: 169 · Transmitter: DME

DLC 8 8 signals

3B19988F1798FF11

Byte layout

Checksum_0xa9

Counter_0xa9, ST_SW_LEV_RPM, ST_INFS

TORQ_AVL_MIN

TORQ_AVL_MIN, TORQ_AVL_MAX

TORQ_AVL_MAX

TORQ_AVL_SPAR_NEG

TORQ_AVL_SPAR_NEG, TORQ_AVL_SPAR_POS

TORQ_AVL_SPAR_POS

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xa9	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
Counter_0xa9	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
ST_SW_LEV_RPM	B1[5:4] DBC: 12\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
ST_INFS	B1[7:6] DBC: 14\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DSC
TORQ_AVL_MIN	B2..B3 (12b LE, 2 bytes) DBC: 16\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[-1023.5 .. 1023.5]`	EGS,DSC
TORQ_AVL_MAX	B3..B4 (12b LE, 2 bytes) DBC: 28\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[-1023.5 .. 1023.5]`	EGS,DSC
TORQ_AVL_SPAR_NEG	B5..B6 (12b LE, 2 bytes) DBC: 40\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[-1023.5 .. 1023.5]`	EGS,DSC
TORQ_AVL_SPAR_POS	B6..B7 (12b LE, 2 bytes) DBC: 52\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[-1023.5 .. 1023.5]`	EGS,DSC

0x0AA · AccPedal

Decimal ID: 170 · Transmitter: DME

DLC 8 9 signals

0x0AA (DME): Throttle / accelerator pedal data

86500400000C8000

Byte layout

Checksum_0xaa

Counter_0xaa

AcceleratorPedalPercentage

EngineSpeed

ThrottlelActive, AcceleratorPedalPressed, KickDownPressed, CruisePedalActive, CruisePedalInactive

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xaa	B0 (full byte) DBC: 0\|8	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 65535]`	EGS,DSC,ACC
Counter_0xaa	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	EGS,DSC,ACC
AcceleratorPedalPercentage ToDo Factor to be adjusted	B2..B3 (16b LE, 2 bytes) DBC: 16\|16	Intel (little-endian) Unsigned	raw × 0.04 Factor `0.04` Offset `0`	`[0 .. 100]`	EGS,DSC,ACC
EngineSpeed	B4..B5 (16b LE, 2 bytes) DBC: 32\|16	Intel (little-endian) Unsigned Unit: rpm	raw × 0.25 = rpm Factor `0.25` Offset `0`	`[0 .. 8000]`	EGS,DSC,ACC
ThrottlelActive Active in cruise control when engine braking	B6+ (1b BE) DBC: 50\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	EGS,DSC,ACC
AcceleratorPedalPressed Active only when driver actually presses the pedal	B6+ (1b BE) DBC: 52\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 7]`	EGS,DSC,ACC
KickDownPressed	B6+ (1b BE) DBC: 53\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DSC,ACC
CruisePedalActive	B6+ (1b BE) DBC: 54\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	EGS,DSC,ACC
CruisePedalInactive	B6+ (1b BE) DBC: 55\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	EGS,DSC,ACC

0x0AC · WheelTorqueDrivetrain2

Decimal ID: 172 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0AD · Delay_request_ACC

Decimal ID: 173 · Transmitter: LDM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0B1 · Torque_request_steering

Decimal ID: 177 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0B3 · Control_steering_assist

Decimal ID: 179 · Transmitter: AFS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0B4 · WheelTorqueDriveTrain1

Decimal ID: 180 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0B5 · Torque_request_EGS

Decimal ID: 181 · Transmitter: EGS

DLC 8 10 signals

????????????????

Byte layout

Checksum_0xb5

Counter_0xb5, TORQ_TAR_EGS

TORQ_TAR_EGS

TORQ_TAR_ADJR_POS_EGS

TORQ_TAR_ADJR_POS_EGS, ST_OTMP_GRB

ST_OBD_GRB, ST_OBD_ERR_GRB, ST_LIM_STORQ

TORQ_DRAW_GRB

TEMP_GRB

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xb5	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DME
Counter_0xb5	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	DME
TORQ_TAR_EGS torque target (fast)	B1..B2 (12b LE, 2 bytes) DBC: 12\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[1024 .. 1023.5]`	DME
TORQ_TAR_ADJR_POS_EGS	B3..B4 (12b LE, 2 bytes) DBC: 24\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[1024 .. 1023.5]`	DME
ST_OTMP_GRB overtemperature gearbox status 0x00 (0) = no request 0x01 (1) = cooling request, stage1 0x02 (2) = cooling request, stage1 0x03 (3) = signal invalid	B4[7:6] DBC: 38\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME
ST_OBD_GRB status OBD_error gearbox 0x00 (0) = STATE_ETCU_OBD = MIL_OFF 0x02 (2) = STATE_ETCU_OBD = MIL_OFF 0x04 (4) = STATE_ETCU_OBD = MIL_ON 0x06 (6) = STATE_ETCU_OBD = MIL_ON 0x08 (8) = STATE_ETCU_OBD = MIL_FLL 0x0A (10) = STATE_ETCU_OBD = MIL_FLL 0x0C (12) = STATE_ETCU_OBD = IDLE 0x0E (14) = STATE_ETCU_OBD = INI_VALUE 0x0F (15) = signal invalid	B5[3:0] lo-nibble DBC: 40\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DME
ST_OBD_ERR_GRB 0x00 (0) = NO_OBD_ERROR 0x01 (1) = OBD_ERROR 0x02 (2) = signal invalid	B5[5:4] DBC: 44\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME
ST_LIM_STORQ starting torque limitation status 0x00 (0) = NO_INTERVENTION 0x01 (1) = INTERVENTION	B5[7:6] DBC: 46\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME
TORQ_DRAW_GRB Torque converter - looks like fluid path torque before multiplication 0xFF (255) = signal invalid	B6 (full byte) DBC: 48\|8	Intel (little-endian) Unsigned Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[0 .. 255]`	DME
TEMP_GRB Gearbox/ATF oil temperature. Encoding: phys = raw - 40 (C). Unsigned 0-255, range -40 to +215C. ZF 6HP19 normal operating range 60-90C, alarm >130C. Matches OBD2 PID 0x6C (ATF temp) standard. Source: Raiso77 (confirmed on GM gearbox via OBD2, 2026-03-31). Previously wrong in DBC as signed @1- offset +40 — corrected to unsigned @1+ offset -40. Not confirmed on ZF 6HP19 from our HIL (0x0B5 absent from all bench logs — EGS→DME message, no EGS simulation on bench).	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned Unit: degC	raw − 40 = degC Factor `1` Offset `-40`	`[-40 .. 215]`	DME

0x0B6 · Torque_request_DSC

Decimal ID: 182 · Transmitter: DSC

DLC 5 5 signals

Tranction control and dynamic cruise control torque requests (DynamicCruiseControlTorqueDemand)

??????????

Byte layout

Checksum_0xb6

Counter_0xb6, TORQ_TAR_DSC

TORQ_TAR_DSC

TORQ_TAR_ADJR_POS_DSC

TORQ_TAR_ADJR_POS_DSC, ST_TORQ_TAR_DSC

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xb6	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME
Counter_0xb6	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	DME
TORQ_TAR_DSC torque target (fast)	B1..B2 (12b LE, 2 bytes) DBC: 12\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[1024 .. 1023.5]`	DME
TORQ_TAR_ADJR_POS_DSC torque target (slow)	B3..B4 (12b LE, 2 bytes) DBC: 24\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[1024 .. 1023.5]`	DME
ST_TORQ_TAR_DSC 0x00 (0) = no intervention 0x01 (1) = ASR intervention - increase torque 0x02 (2) = MSR intervention - decrease torque 0x03 (3) = signal invalid	B4[5:4] DBC: 36\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME

0x0B7 · Torque_request_ACC

Decimal ID: 183 · Transmitter: LDM

DLC 6 8 signals

ACC or LDM - active cruise control torque request

????????????

Byte layout

Checksum_0xb7

Counter_0xb7, TORQ_TAR_ACC

TORQ_TAR_ACC

TORQ_TAR_ADJR_POS_DSC

TORQ_TAR_ADJR_POS_DSC, ST_TORQ_TAR_ACC, RQ_PREV_INFS_ACC

ST_ACC_SWO_SYS_DME, ST_ACC_MOD_DME

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xb7	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME
Counter_0xb7	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	DME
TORQ_TAR_ACC torque target (fast)	B1..B2 (12b LE, 2 bytes) DBC: 12\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[1024 .. 1023.5]`	DME
TORQ_TAR_ADJR_POS_DSC torque target (slow)	B3..B4 (12b LE, 2 bytes) DBC: 24\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[1024 .. 1023.5]`	DME
ST_TORQ_TAR_ACC 0x00 (0) = no intervention 0x01 (1) = increase torque 0x02 (2) = signal invalid 0x03 (3) = signal invalid	B4[5:4] DBC: 36\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME
RQ_PREV_INFS_ACC 0x00 (0) = no request 0x01 (1) = request over-run-fuel-shutoff inhibition 0x03 (3) = signal invalid	B4[7:6] DBC: 38\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME
ST_ACC_SWO_SYS_DME 0x01 (1) = system off 0x02 (2) = system ok 0x03 (3) = signal invalid	B5[1:0] DBC: 40\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME
ST_ACC_MOD_DME 0x00 (0) = passive 0x01 (1) = standby 0x02 (2) = normal 0x04 (4) = brake active 0x05 (5) = driver has stepped over 0x07 (7) = signal invalid	B5[4:2] DBC: 42\|3	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 7]`	DME

0x0B8 · Torque_request_DCT

Decimal ID: 184 · Transmitter: DKG

DLC 8 5 signals

0x0B8 (DKG): DCT torque request

????????????????

Byte layout

Checksum_0xb8

Counter_0xb8, TORQ_TAR_DKG

TORQ_TAR_DKG

TORQ_TAR_ADJR_POS_DKG

TORQ_TAR_ADJR_POS_DKG, TORQ_CLT_DKG

TORQ_CLT_DKG

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xb8	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME
Counter_0xb8	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	DME
TORQ_TAR_DKG torque target (fast)	B1..B2 (12b LE, 2 bytes) DBC: 12\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[-1024 .. 1023.5]`	DME
TORQ_TAR_ADJR_POS_DKG torque target (slow)	B3..B4 (12b LE, 2 bytes) DBC: 24\|12	Intel (little-endian) Signed Unit: Nm	raw × 0.5 = Nm Factor `0.5` Offset `0`	`[-1024 .. 1023.5]`	DME
TORQ_CLT_DKG	B4..B5 (12b LE, 2 bytes) DBC: 36\|12	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 0]`	DME

0x0B9 · Torque_request_AFS

Decimal ID: 185 · Transmitter: AFS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0BA · TransmissionData

Decimal ID: 186 · Transmitter: EGS

DLC 8 6 signals

????????????????

Byte layout

GearTar, Shifting

GearRatio

—

OutputShaftSpeed

Checksum_0xba

Counter_0xba

—

Signal	Position	Format	Scale / Formula	Range	Receivers
GearTar	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw − 4 Factor `1` Offset `-4`	`[0 .. 0]`	DME,DSC
Shifting	B0 bit4 DBC: 4\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	DME,DSC
GearRatio	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw × 0.05 Factor `0.05` Offset `0`	`[0 .. 255]`	DME,DSC
OutputShaftSpeed	B3..B4 (16b LE, 2 bytes) DBC: 24\|16	Intel (little-endian) Signed Unit: rpm	raw × 0.125 = rpm Factor `0.125` Offset `0`	`[0 .. 0]`	DME,DSC
Checksum_0xba	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,DSC
Counter_0xba	B6[3:0] lo-nibble DBC: 48\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	DME,DSC

0x0BB · Target_torque_request

Decimal ID: 187 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0BC · Status_target_torque_conversion

Decimal ID: 188 · Transmitter: VGSG

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0BD · Torque_request_SSG

Decimal ID: 189 · Transmitter: SMG

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0BE · Alive_Counter

Decimal ID: 190 · Transmitter: ARS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0BF · RequestedWheelTorqueDriveTrain

Decimal ID: 191 · Transmitter: DSC_LDM

DLC 5 8 signals

Sent by DSC or LDM (ACC option)

??????????

Byte layout

Checksum_0xbf

Counter_0xbf, STATE_DI_PUC, STATE_SP_DYN_WHEEL

WMOM_PT_TAR

ST_DRASY_PT, WMOM_PT_ENBL, RQ_GSI_CLCTR_LN

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xbf	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME
Counter_0xbf	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 15]`	DME
STATE_DI_PUC FOLDYN_WMOM_PT_TAR: request_prevention_inertia-fuel-shutof 0x00 (0) = allow fuel-shutoff 0x01 (1) = inhibit fuel-shutoff	B1 bit4 DBC: 12\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	XXX
STATE_SP_DYN_WHEEL state follow dynamic from FOLDYN_WMOM_PT_TAR 0x00 (0) = no request 0x04 (4) = follow torque request 0x05 (5) = fast torque adjustment 0x06 (6) = fast torque adjustment 0x07 (7) = invalid	B1[7:5] DBC: 13\|3	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 7]`	XXX
WMOM_PT_TAR Wheel torque request 0xFFFF (65535) = off	B2..B3 (16b LE, 2 bytes) DBC: 16\|16	Intel (little-endian) Unsigned Unit: Nm	raw − 32000 = Nm Factor `1` Offset `-32000`	`[-32000 .. 32000]`	DME
ST_DRASY_PT powertrain driver assistance system status 0x00 (0) = no request 0x01 (1) = comfort 0x03 (3) = aggressive 0x04 (4) = driver kicks-in 0x0F (15) = error	B4[3:0] lo-nibble DBC: 32\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DME
WMOM_PT_ENBL wheel torque request enabled 0x00 (0) = no request 0x01 (1) = request torque intervention 0x03 (3) = signal invalid	B4[5:4] DBC: 36\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME
RQ_GSI_CLCTR_LN request gear shift indicator 0x00 (0) = no request 0x01 (1) = request gear shift indicator 0x03 (3) = unavailable	B4[7:6] DBC: 38\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME

0x0C0 · Alive_Central_Gateway

Decimal ID: 192 · Transmitter: Gate1

DLC 8 0 signals

F3FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0C1 · Alive_counter_telephone

Decimal ID: 193 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0C4 · SteeringWheelAngle

Decimal ID: 196 · Transmitter: DSC

DLC 7 2 signals

0x0C4 (SZL): Steering wheel angle

88FFFC0000FFF1

Byte layout

SteeringPosition

—

SteeringSpeed

—

Signal	Position	Format	Scale / Formula	Range	Receivers
SteeringPosition Steering wheel position in degrees	B0..B1 (16b LE, 2 bytes) DBC: 0\|16	Intel (little-endian) Signed Unit: deg	raw × 0.04395 = deg Factor `0.04395` Offset `0`	`[-600 .. 600]`	EPS,DME,ACC
SteeringSpeed Steering wheel rotational rate (deg/s)	B3..B4 (16b LE, 2 bytes) DBC: 24\|16	Intel (little-endian) Signed Unit: deg/s	raw × 0.04395 = deg/s Factor `0.04395` Offset `0`	`[0 .. 0]`	EPS,DME,ACC

0x0C8 · SteeringWheelAngle_slow

Decimal ID: 200 · Transmitter: SZL

DLC 6 3 signals

0x0C8 (SZL): Steering wheel angle slow rate

88FF700000BC

Byte layout

SteeringPosition

Counter_0xc8

SteeringSpeed

—

Signal	Position	Format	Scale / Formula	Range	Receivers
SteeringPosition Steering wheel position in degrees	B0..B1 (16b LE, 2 bytes) DBC: 0\|16	Intel (little-endian) Signed Unit: deg	raw × 0.04395 = deg Factor `0.04395` Offset `0`	`[-600 .. 600]`	DSC,EPS,ACC
Counter_0xc8	B2[7:4] hi-nibble DBC: 20\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DSC,EPS,ACC
SteeringSpeed Steering wheel rotational rate (deg/s)	B3..B4 (16b LE, 2 bytes) DBC: 24\|16	Intel (little-endian) Signed Unit: deg/s	raw × 0.04395 = deg/s Factor `0.04395` Offset `0`	`[-65535 .. 65535]`	DSC,EPS,ACC

0x0C9 · SteeringWheelAngle_DSC

Decimal ID: 201 · Transmitter: SZL

DLC 8 3 signals

????????????????

Byte layout

SteeringPosition

Counter_0xc9

SteeringPositionComplementLow

—

Signal	Position	Format	Scale / Formula	Range	Receivers
SteeringPosition	B0..B1 (16b LE, 2 bytes) DBC: 0\|16	Intel (little-endian) Signed Unit: deg	raw × 0.04395 = deg Factor `0.04395` Offset `0`	`[-600 .. 600]`	DSC
Counter_0xc9	B2[7:4] hi-nibble DBC: 20\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DSC
SteeringPositionComplementLow	B3..B4 (11b LE, 2 bytes) DBC: 24\|11	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 1]`	DSC

0x0CD · Accelerometer2

Decimal ID: 205 · Transmitter: XXX

DLC 8 4 signals

????????????????

Byte layout

YawRate

Checksum_0xcd

LateralAcceleration

Counter_0xcd

—

Signal	Position	Format	Scale / Formula	Range	Receivers
YawRate	B0..B1 (16b LE, 2 bytes) DBC: 0\|16	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 0]`	DSC,ACSM
Checksum_0xcd	B2..B3 (16b LE, 2 bytes) DBC: 16\|16	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 65535]`	DSC,ACSM
LateralAcceleration	B4..B5 (16b LE, 2 bytes) DBC: 32\|16	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 0]`	DSC,ACSM
Counter_0xcd	B6[7:4] hi-nibble DBC: 52\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DSC,ACSM

0x0CE · WheelSpeeds

Decimal ID: 206 · Transmitter: DSC

DLC 8 4 signals

0x0CE (DSC): Wheel speed pulse counters — 4 wheels, 16-bit little-endian pairs: FL=B1:B0, FR=B3:B2, RL=B5:B4, RR=B7:B6. IMPORTANT: these are ABS ring pulse COUNTS per 100ms frame, NOT direct km/h. Frame is all-zeros when engine is off. At idle standstill (engine running): ~334–342 counts (vibration noise floor). At peak observed speed (~55–60 km/h city): ~903–913 counts. Rough formula: (raw_16LE − 338) × 0.1 ≈ km/h — offset and scale need one confirmed km/h calibration point to pin exactly. DBC signal factor 0.0625 is UNCONFIRMED — do not use until validated. Was all-zeros in all previous static/idle HIL logs; first confirmed active in 5min_run_for_testing.log 2026-03-26.

0000000000000000

Byte layout

Wheel_FL

Wheel_FR

Wheel_RL

Wheel_RR

Signal	Position	Format	Scale / Formula	Range	Receivers
Wheel_FL	B0..B1 (16b LE, 2 bytes) DBC: 0\|16	Intel (little-endian) Signed Unit: km/h	raw × 0.0625 = km/h Factor `0.0625` Offset `0`	`[0 .. 0]`	DME,EGS,Kombi,ACC
Wheel_FR	B2..B3 (16b LE, 2 bytes) DBC: 16\|16	Intel (little-endian) Signed Unit: km/h	raw × 0.0625 = km/h Factor `0.0625` Offset `0`	`[0 .. 0]`	DME,EGS,Kombi,ACC
Wheel_RL	B4..B5 (16b LE, 2 bytes) DBC: 32\|16	Intel (little-endian) Signed Unit: km/h	raw × 0.0625 = km/h Factor `0.0625` Offset `0`	`[0 .. 0]`	DME,EGS,Kombi,ACC
Wheel_RR	B6..B7 (16b LE, 2 bytes) DBC: 48\|16	Intel (little-endian) Signed Unit: km/h	raw × 0.0625 = km/h Factor `0.0625` Offset `0`	`[0 .. 0]`	DME,EGS,Kombi,ACC

0x0D1 · Accelerometer1

Decimal ID: 209 · Transmitter: XXX

DLC 8 5 signals

0x0D1 (DME): Accelerometer data

????????????????

Byte layout

YawRate

Unknown

PitchRate

Counter_0xd1

Checksum_0xd1

Signal	Position	Format	Scale / Formula	Range	Receivers
YawRate	B0..B1 (16b LE, 2 bytes) DBC: 0\|16	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 0]`	DSC,ACSM
Unknown	B2..B3 (16b LE, 2 bytes) DBC: 16\|16	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 65535]`	DSC,ACSM
PitchRate	B4..B5 (16b LE, 2 bytes) DBC: 32\|16	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 65535]`	DSC,ACSM
Counter_0xd1	B6[7:4] hi-nibble DBC: 52\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DSC,ACSM
Checksum_0xd1	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DSC,ACSM

0x0D4 · Unknown_d4

Decimal ID: 212 · Transmitter: XXX

DLC 8 3 signals

????????????????

Byte layout

—

State1

Counter_0xd4

Checksum_0xd4

Signal	Position	Format	Scale / Formula	Range	Receivers
State1	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
Counter_0xd4	B6[7:4] hi-nibble DBC: 52\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Vector__XXX
Checksum_0xd4	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX

0x0D5 · Request_wheel_torque_brake

Decimal ID: 213 · Transmitter: LDM

DLC 8 2 signals

????????????????

Byte layout

Checksum_0xd5

Counter_0xd5

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0xd5	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DSC
Counter_0xd5	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 15]`	DSC

0x0D7 · Alive_Counter_Security

Decimal ID: 215 · Transmitter: ACSM

DLC 8 0 signals

0x0D7 (ACSM): Alive counter security

44FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0D8 · CLU1_VDA

Decimal ID: 216 · Transmitter: VDA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0E1 · Wheel_torque_brake

Decimal ID: 225 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0E2 · Status_central_locking_BFT

Decimal ID: 226 · Transmitter: Gate1

DLC 8 2 signals

0x0E2 (Gate1): Door status — FR (Beifahrertür vorne, BFT, passenger front-right). B3=DoorOpenState: 0xFC=closed, 0xFD=open. B0=LockState: 0x81=unlocked, 0x82=locked, 0x83=armed (increments on ignition/session transition). B1=0xFF constant. B2=0xE7 constant. B4-B7=0xFF constant. B3=0xFD CONFIRMED: HIL-3 2026-03-24 at t=2748881ms (FR door opened second in FL→FR→RL→RR sequential 4-door test, held ~10s, event-driven burst of 6 groups). Door ID mapping confirmed by sequential hold test: FL=0x0EA, FR=0x0E2, RL=0x0EE, RR=0x0E6. Source: HIL session 2026-03-24 (10minutes_run_Wheel_doors_tests.log)

82FFE7FCFFFFFFFF

Byte layout

DoorLockStatus_BFT

—

DoorOpenStatus_BFT

—

Signal	Position	Format	Scale / Formula	Range	Receivers
DoorLockStatus_BFT 0x81 (129) = Unlocked 0x82 (130) = Locked 0x83 (131) = Locked_Alarm	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi
DoorOpenStatus_BFT 0xFC (252) = Closed 0xFD (253) = Open	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi

0x0E3 · CLU2_VDA

Decimal ID: 227 · Transmitter: VDA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0E6 · Status_central_locking_BFTH

Decimal ID: 230 · Transmitter: Gate1

DLC 8 2 signals

0x0E6 (Gate1): Door status — RR (Beifahrertür hinten, BFTH, passenger rear-right). Same byte layout as 0x0E2/0x0EA/0x0EE: B0=LockState (0x81=unlocked, 0x82=locked, 0x83=armed), B3=DoorOpenState (0xFC=closed, 0xFD=open), B1=0xFF, B2=0xE7 constant. B3=0xFD CONFIRMED: HIL-3 2026-03-24 at t=2778797ms (RR door opened fourth in FL→FR→RL→RR sequential 4-door test, held ~10s, event-driven burst of 2 groups). Door ID mapping confirmed by sequential hold test: FL=0x0EA, FR=0x0E2, RL=0x0EE, RR=0x0E6. Source: HIL session 2026-03-24 (10minutes_run_Wheel_doors_tests.log)

82FFE7FCFFFFFFFF

Byte layout

DoorLockStatus_BFTH

—

DoorOpenStatus_BFTH

—

Signal	Position	Format	Scale / Formula	Range	Receivers
DoorLockStatus_BFTH 0x81 (129) = Unlocked 0x82 (130) = Locked 0x83 (131) = Locked_Alarm	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi
DoorOpenStatus_BFTH 0xFC (252) = Closed 0xFD (253) = Open	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi

0x0EA · Status_central_locking_FAT

Decimal ID: 234 · Transmitter: Gate1

DLC 8 2 signals

0x0EA (Gate1): Door status — FL driver front (Fahrertür vorne, FAT). B0=LockState: 0x81=unlocked, 0x82=locked, 0x83=armed. B3=DoorOpenState: 0xFC=closed, 0xFD=open. B1=0xFF, B2=0xE7 constant. B3=0xFD CONFIRMED twice: (1) HIL 2026-03-23: B3=0xFD when driver entered car. (2) keyless-restart log 2026-03-24: B3=0xFD at t+26.4s when driver exited running keyless car (held ~5s, then 0xFC). Simultaneously with 0x130 B0 transition to 0x05 (security-alert state). This is the driver door — highest event density, most reliable for door-open detection. B0 lock state changes in real-time: 0x81→0x82 at keyfob lock (simultaneous with 0x2A0 command frame). Source: HIL 2026-03-23 + keyless-restart 2026-03-24

82FFE7FCFFFFFFFF

Byte layout

DoorLockStatus_FAT

—

DoorOpenStatus_FAT

—

Signal	Position	Format	Scale / Formula	Range	Receivers
DoorLockStatus_FAT 0x81 (129) = Unlocked 0x82 (130) = Locked 0x83 (131) = Locked_Alarm	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi
DoorOpenStatus_FAT 0xFC (252) = Closed 0xFD (253) = Open	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi

0x0EE · Central_locking_status_FATH

Decimal ID: 238 · Transmitter: Gate1

DLC 8 2 signals

0x0EE (Gate1): Door status — RL driver rear (Fahrertür hinten, FATH). Same byte layout as 0x0E2/0x0E6/0x0EA: B0=LockState (0x81=unlocked, 0x82=locked, 0x83=armed), B3=DoorOpenState (0xFC=closed, 0xFD=open). B3=0xFD CONFIRMED: captured at t=2765496ms in 10minutes_run_Wheel_doors_tests.log 2026-03-24 (door held open ~10s, B0=0x81 unlocked). This is the only door frame with open state directly captured in HIL logs to date — confirms the 0xFC/0xFD decode is correct. B1=0xFF, B2=0xE7 constant. Source: HIL 2026-03-23 + HIL doors log 2026-03-24

82FFE7FCFFFFFFFF

Byte layout

DoorLockStatus_FATH

—

DoorOpenStatus_FATH

—

Signal	Position	Format	Scale / Formula	Range	Receivers
DoorLockStatus_FATH 0x81 (129) = Unlocked 0x82 (130) = Locked 0x83 (131) = Locked_Alarm	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi
DoorOpenStatus_FATH 0xFC (252) = Closed 0xFD (253) = Open	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi

0x0F2 · Status_central_locking_HK

Decimal ID: 242 · Transmitter: Gate1

DLC 8 3 signals

0x0F2 (Gate1): Central locking status HK (boot/trunk area)

F2FF87C0FFFFFFFF

Byte layout

BootLockStatus

—

BootReleaseButton

BootOpenStatus

—

Signal	Position	Format	Scale / Formula	Range	Receivers
BootLockStatus 0xF1 (241) = Unlocked 0xF2 (242) = Locked 0xF3 (243) = Locked_Alarm	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi
BootReleaseButton 0x87 (135) = NotPressed 0x88 (136) = Pressed	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi
BootOpenStatus 0xC0 (192) = Closed 0xC1 (193) = Open	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CAS,Kombi

0x0F4 · CLU3_VDA

Decimal ID: 244 · Transmitter: VDA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0F6 · MirrorControl_0F6

Decimal ID: 246 · Transmitter: KGM

DLC 2 0 signals

0x0F6: Exterior mirror control / mirror position status. Sender: KGM (Body Gateway Module, node 0x00). 2-byte, static 0xF3 0xF3 in t1.log (idle/no-command state). Follows the body-module door-status +4 sequence: 0x0E2 BFT (passenger front door), 0x0E6 BFH (passenger rear door), 0x0EA FAT (driver front door), 0x0EE FAH (driver rear door), 0x0F2 HK (boot/tailgate), 0x0F6 mirrors. Source: MorGuux BMW E90 K-CAN gist. ** IMPORTANT: Mirror motor control on E90 goes via LIN bus (FRM Footwell Module -> LIN -> mirror motor actuators). The joystick input on K-CAN may trigger an FRM frame, but the actual mirror movement commands are LIN-bus-only and will NOT appear in a K-CAN capture. 0x0F6 = 0 frames confirmed in 10-min real drive log (10minutes_run.log) even though mirror adjustments were physically performed. K-CAN only sees 0xF3 0xF3 (idle/no-command state) periodically. To capture mirror commands: tap LIN bus at FRM connector, or read mirror position via UDS (0x7C3 FRM diagnostic frames observed at ts=76575-78642ms before vehicle movement may be position readout). **

F3F3

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0F7 · lateral_dynamics_ARS_VDM

Decimal ID: 247 · Transmitter: ARS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0F9 · Vertical_dynamics_VDM_ARS

Decimal ID: 249 · Transmitter: VDM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0FA · Control_window_lifter_FAT

Decimal ID: 250 · Transmitter: FRMFA

DLC 3 12 signals

0x0FA (FRMFA — Footwell Module): All 4 window command frame. 3 bytes: B0=front commands, B1=rear commands, B2=0xFF constant. Idle: 80 00 FF. B0/B1 bit map (base 0x80): bit0=DrvClose(hold), bit1=DrvAutoClose(one-touch), bit2=DrvOpen(hold), bit3=PasClose(hold), bit4=PasAutoClose(one-touch), bit5=PasOpen(hold). Confirmed from Windows_cycle.log + injection tests 2026-04-06: front-both-autoclose=A4 00 FF, rear-both-autoclose=80 24 FF. INJECTION NOTE: sending B0+B1 combined (A4 24 FF) closes only rear — likely B0 rejected by FRM when B1 non-zero (FRM owns B0, JBE owns B1). Workaround: inject A4 00 FF then 80 24 FF sequentially (~500ms each). PARTIAL CONFIRM 2026-04-07: front driver autoclose (bit1 in B0) does NOT work via injection — front passenger and both rears confirmed. Front driver close mechanism unclear.

C000FF

Byte layout

FrontDrvClose, FrontDrvAutoClose, FrontDrvOpen, FrontPasClose, FrontPasAutoClose, FrontPasOpen

RearDrvClose, RearDrvAutoClose, RearDrvOpen, RearPasClose, RearPasAutoClose, RearPasOpen

—

Signal	Position	Format	Scale / Formula	Range	Receivers
FrontDrvClose	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
FrontDrvAutoClose	B0 bit1 DBC: 1\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
FrontDrvOpen	B0 bit2 DBC: 2\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
FrontPasClose	B0 bit3 DBC: 3\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
FrontPasAutoClose	B0 bit4 DBC: 4\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
FrontPasOpen	B0 bit5 DBC: 5\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
RearDrvClose	B1 bit0 DBC: 8\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
RearDrvAutoClose	B1 bit1 DBC: 9\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
RearDrvOpen	B1 bit2 DBC: 10\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
RearPasClose	B1 bit3 DBC: 11\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
RearPasAutoClose	B1 bit4 DBC: 12\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1
RearPasOpen	B1 bit5 DBC: 13\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1

0x0FB · Control_window_lifter_BFT

Decimal ID: 251 · Transmitter: Gate1

DLC 8 0 signals

0x0FB (Gate1): Window lifter control front-right

E7FFFF??????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0FC · Control_window_lifter_FATH

Decimal ID: 252 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0FD · Control_window_lifter_BFTH

Decimal ID: 253 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x0FE · Voltage_level_sensors

Decimal ID: 254 · Transmitter: VDM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x118 · Exchange_AFS_DSC

Decimal ID: 280 · Transmitter: AFS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x11E · Control_interventions_DSC_AFS

Decimal ID: 286 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x120 · Status_partial_setpoints_AFS_DSC_2

Decimal ID: 288 · Transmitter: AFS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x12A · Sensor_data_ROSE

Decimal ID: 298 · Transmitter: ASCM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x12C · input_data_ROSE

Decimal ID: 300 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x130 · TerminalStatus

Decimal ID: 304 · Transmitter: CAS

DLC 5 10 signals

0x130 (CAS — Car Access System): Ignition/key/terminal status frame at ~10 Hz. Confirmed decode (HIL keyfobless_restart_lock.log 2026-03-24): B0=IgnitionMode: 0x45=KL15_RUN (normal running), 0x55=CRANKING/starting (engineStarting), 0x41=ACCESSORY (KL15 on, engine off), 0x40=transitional/shutdown (ignition winding down, keeps previous state in decoder), 0x05=SECURITY_ALERT (engine running without authorised key — persists when car is locked externally with engine on). B1 encodes key presence and door/security context: 0x40=key_present_normal (bit6=1), 0x1A=key_absent_door_closed, 0x0D=key_absent_door_open_or_security_event. B2/B3=variable (clutch nibble in B2 hi-nibble: 0xA=unknown, decodes unchanged). KEYLESS RESTART CONFIRMED: B0=0x55 + B1=0x1A observed when engine cranks without physical key — CAS allows restart within security window after key removal. CRANK TIMING (N47D20O1): B0=0x55 fires → 0x21A engine_running bit in 13ms → RPM measurable in 264ms → B0 settles to 0x45 in ~800ms total. LOCKED-RUNNING STATE: after driver exits and keyfob-locks running car, B0 stays at 0x05, B1=0x0D indefinitely — distinct from all normal run states. Source: HIL sessions 2026-03-23 + keyless-restart 2026-03-24

4540218FF2

Byte layout

ST_KL_R, ST_KL_15, ST_KL_50, ST_KEY_VLD

NO_KEY

IgnitionOff, AccOn

ST_KL15_HW

Counter_0x130, Checksum_0x130

Signal	Position	Format	Scale / Formula	Range	Receivers
ST_KL_R	B0+ (2b BE) DBC: 1\|2	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
ST_KL_15	B0+ (2b BE) DBC: 3\|2	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
ST_KL_50	B0+ (2b BE) DBC: 5\|2	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
ST_KEY_VLD	B0+ (2b BE) DBC: 7\|2	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
NO_KEY	B1+ (4b BE) DBC: 11\|4	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
IgnitionOff Active when engine off (KL15 de-energised)	B2 bit6 DBC: 22\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
AccOn	B2 bit7 DBC: 23\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
ST_KL15_HW	B3+ (2b BE) DBC: 31\|2	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
Counter_0x130	B4[3:0] lo-nibble DBC: 32\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DME,EGS,FRMFA,Kombi,CIC,IHKA
Checksum_0x130	B4[7:4] hi-nibble DBC: 36\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,FRMFA,Kombi,CIC,IHKA

0x135 · CrashDisconnectControl

Decimal ID: 309 · Transmitter: ACSM

DLC 8 0 signals

0x135 (ACSM): Crash disconnect control

F5FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x140 · Unknown140

Decimal ID: 320 · Transmitter: XXX

DLC 2 1 signals

????

Byte layout

State

—

Signal	Position	Format	Scale / Formula	Range	Receivers
State	B0 (full byte, BE) DBC: 7\|8	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX

0x150 · Request_1_ACC

Decimal ID: 336 · Transmitter: LDM

DLC 8 2 signals

????????????????

Byte layout

Checksum_0x150

Counter_0x150

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0x150	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	ACC
Counter_0x150	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 15]`	ACC

0x153 · Request_2_ACC

Decimal ID: 339 · Transmitter: LDM

DLC 8 2 signals

????????????????

Byte layout

Checksum_0x153

Counter_0x153

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0x153	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	ACC
Counter_0x153	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 15]`	ACC

0x159 · Object_data_ACC

Decimal ID: 345 · Transmitter: ACC

DLC 8 2 signals

????????????????

Byte layout

Checksum_0x159

Counter_0x159

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0x159	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	LDM
Counter_0x159	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 15]`	LDM

0x15C · Status_ACC

Decimal ID: 348 · Transmitter: ACC

DLC 8 2 signals

????????????????

Byte layout

Checksum_0x15c

Counter_0x15c

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0x15c	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	LDM
Counter_0x15c	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 15]`	LDM

0x15F · Requirement_angle_FFP

Decimal ID: 351 · Transmitter: LDM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x165 · CLU_Status_VDA

Decimal ID: 357 · Transmitter: VDA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x172 · Acknowledgment_request_Kombination

Decimal ID: 370 · Transmitter: CCC

DLC 8 2 signals

0x172 (CCC): Acknowledgment/fault-count notification. FAULT-ONLY — absent in normal startup. Companion to 0x338 (same counter and fault-count structure, both appear at +13s). DLC=5. Initialises as FF FF FF 0F F1, then transitions to: B0=rolling counter (bit 0 toggles: 0x78/0x79). B2=active fault count (0x02→0x01 as per 0x338). B3=0x60. B4=0xF0. Source: HIL 2026-05-03 low-beam fault log.

????????????????

Byte layout

CCM_Counter

—

ActiveFaultCount

—

Signal	Position	Format	Scale / Formula	Range	Receivers
CCM_Counter	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC
ActiveFaultCount	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC

0x175 · Display_motor_data

Decimal ID: 373 · Transmitter: DME

DLC 3 1 signals

0x175 (DME): Engine RPM. B0=rolling counter (0x00–0x0E, 15-step). B2=RPM_HIGH byte: formula B2 × 40 = RPM (resolution ±40 RPM). Full 16-bit (B2<<8|B1) encodes finer precision. HIL calibration points from 5min_run_for_testing.log 2026-03-26: B2=0x15(21)→~840 RPM (N47 diesel idle), B2=0x18(24)→~960 RPM (light cruise), B2=0x2A(42)→~1680 RPM (acceleration), B2=0x38(56)→~2240 RPM (hard acceleration peak), B2=0x0C(12)→~480 RPM (overrun/fuel-cut). Existing DBC signals (CruiseControlSetpointSpeed etc.) are from loopybunny — RPM signal not previously mapped. Source: HIL 2026-03-26.

03000C

Byte layout

Counter_0x175

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Counter_0x175	B0+ (4b BE) DBC: 3\|4	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Kombi,CIC

0x190 · display_ACC

Decimal ID: 400 · Transmitter: LDM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x192 · GearSelectorSwitch_1

Decimal ID: 402 · Transmitter: SZL_LWS

DLC 4 1 signals

0x192: Gear selector / transmission selector switch operation. Sender: SZL_LWS (Schaltzentrum Lenkrad / Lenkwinkelsensor — Steering Column Switch Centre with integrated Steering Angle Sensor, node 0x02). Also referred to as GearSelectorSwitch_1 in some DBC files. This is the tiptronic/gear-lever operation message from the column stalk. Source: MorGuux E90 K-CAN gist (entry: 402,0x192,Transmission Selector Switch Operation [16],SZL_LWS)

F3FF????

Byte layout

—

Counter_0x192

Signal	Position	Format	Scale / Formula	Range	Receivers
Counter_0x192	B3[3:0] lo-nibble DBC: 24\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	EGS,DME

0x193 · DynamicCruiseControlStatus

Decimal ID: 403 · Transmitter: DSC

DLC 8 4 signals

0x193 (DSC): Dynamic cruise control status

????????????????

Byte layout

Counter_0x193

CruiseControlSetpointSpeed

—

CruiseActive

CruiseSpeedChangeRequest

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Counter_0x193	B0 (full byte, BE) DBC: 7\|8	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	ACC,Kombi
CruiseControlSetpointSpeed Speed target - unit depends on locale	B1 (full byte, BE) DBC: 15\|8	Motorola (big-endian) Unsigned Unit: km/h	raw − 2 = km/h Factor `1` Offset `-2`	`[0 .. 253]`	ACC,Kombi
CruiseActive	B5+ (1b BE) DBC: 43\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,Kombi
CruiseSpeedChangeRequest	B6+ (1b BE) DBC: 48\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,Kombi

0x194 · CruiseControlStalk

Decimal ID: 404 · Transmitter: SZL

DLC 4 11 signals

????????

Byte layout

Checksum_0x194

Counter_0x194, requests_0xF

plus1, plus5, minus1, minus5, cancel, resume, cancel_lever_up

setMe_0xFC

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0x194	B0 (full byte, BE) DBC: 7\|8	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	ACC,DME,Kombi
Counter_0x194 Message is sent at higher rate when cruise stalk is pressed	B1+ (4b BE) DBC: 11\|4	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	ACC,DME,Kombi
requests_0xF	B1+ (4b BE) DBC: 15\|4	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	ACC,DME,Kombi
plus1 Appears when +1mph/kph stalk is depressed	B2+ (1b BE) DBC: 16\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,DME,Kombi
plus5	B2+ (1b BE) DBC: 17\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,DME,Kombi
minus1 Appears when -1mph/kph stalk is depressed	B2+ (1b BE) DBC: 18\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,DME,Kombi
minus5	B2+ (1b BE) DBC: 19\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,DME,Kombi
cancel Appears when cancel stalk (up or down) is depressed	B2+ (1b BE) DBC: 20\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,DME,Kombi
resume It appears when resume stalk button is depressed	B2+ (1b BE) DBC: 22\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,DME,Kombi
cancel_lever_up Appears when cancel stalk (up) is depressed	B2+ (1b BE) DBC: 23\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	ACC,DME,Kombi
setMe_0xFC	B3 (full byte, BE) DBC: 31\|8	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[255 .. 255]`	ACC,DME,Kombi

0x195 · Operation_push_button_MSA

Decimal ID: 405 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x198 · GearSelectorSwitch

Decimal ID: 408 · Transmitter: GWS

DLC 5 15 signals

??????????

Byte layout

Counter_0x198, m3ShifterPosition

m3ShifterPositionXOR1111, ShifterPosition

ShifterPositionXOR1111, param1, param1XOR11

ParkButtonFirst, ParkButtonSecond, SideButton, SideButtonXOR11

param5, SportButtonPressed, M3_button, always11

Signal	Position	Format	Scale / Formula	Range	Receivers
Counter_0x198	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	EGS,DME,Kombi
m3ShifterPosition	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	EGS,DME,Kombi
m3ShifterPositionXOR1111	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	EGS,DME,Kombi
ShifterPosition 0001 = N\|R, 0010 = R, 0011 = N\|D, 0100 = D, 0101 = -1, 0110 = +1, 0111 = ManualMode, 1000 = inBetween, 0x01 (1) = D 0x02 (2) = S 0x03 (3) = N 0x04 (4) = R 0x05 (5) = P	B1[7:4] hi-nibble DBC: 12\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	EGS,DME,Kombi
ShifterPositionXOR1111	B2[3:0] lo-nibble DBC: 16\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	EGS,DME,Kombi
param1 can not be 0x03. Always 0 in 135i.	B2[5:4] DBC: 20\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi
param1XOR11	B2[7:6] DBC: 22\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi
ParkButtonFirst 0x1 = pressed	B3[1:0] DBC: 24\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi
ParkButtonSecond Redundant buton. 0x1 = pressed;	B3[3:2] DBC: 26\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi
SideButton 0x1 = pressed;	B3[5:4] DBC: 28\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi
SideButtonXOR11 Complement value	B3[7:6] DBC: 30\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi
param5 Always 0 in 135i.	B4[1:0] DBC: 32\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi
SportButtonPressed 0x1 = pressed;	B4[3:2] DBC: 34\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	EGS,DME,Kombi
M3_button M3 POWER (?)	B4[5:4] DBC: 36\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi
always11	B4[7:6] DBC: 38\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	EGS,DME,Kombi

0x19E · StatusDSC_KCAN

Decimal ID: 414 · Transmitter: DSC

DLC 8 6 signals

0x19E (DSC): DSC status K-CAN

00E06FFCFE00003C

Byte layout

—

DSC_full_off, DTC_on

Counter_0x19e

—

BrakeStates

BrakePressure

Checksum_0x19e

Signal	Position	Format	Scale / Formula	Range	Receivers
DSC_full_off 0x4 enabling, 0xA enabled. TBD	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,CIC
DTC_on	B1 bit4 DBC: 12\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,CIC
Counter_0x19e	B2[7:4] hi-nibble DBC: 20\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Kombi,CIC
BrakeStates	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC
BrakePressure	B6 (full byte) DBC: 48\|8	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 0]`	Kombi,CIC
Checksum_0x19e	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC

0x1A0 · Speed

Decimal ID: 416 · Transmitter: DSC

DLC 8 8 signals

008000B0FF00C033

Byte layout

VehicleSpeed

VehicleSpeed, MovingForward, MovingReverse

LongAcc

LongAcc, LatlAcc

LatlAcc

YawRate

YawRate, Counter_0x1a0

Checksum_0x1a0

Signal	Position	Format	Scale / Formula	Range	Receivers
VehicleSpeed	B0..B1 (12b LE, 2 bytes) DBC: 0\|12	Intel (little-endian) Signed Unit: km/h	raw × 0.103 = km/h Factor `0.103` Offset `0`	`[0 .. 0]`	Kombi,CIC,IHKA,ACC
MovingForward	B1 bit4 DBC: 12\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,CIC,IHKA,ACC
MovingReverse	B1 bit5 DBC: 13\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,CIC,IHKA,ACC
LongAcc Longitudinal acceleration	B2..B3 (12b LE, 2 bytes) DBC: 16\|12	Intel (little-endian) Signed Unit: m/s^2	raw × 0.025 = m/s^2 Factor `0.025` Offset `0`	`[0 .. 0]`	Kombi,CIC,IHKA,ACC
LatlAcc Lateral acceleration	B3..B4 (12b LE, 2 bytes) DBC: 28\|12	Intel (little-endian) Signed Unit: m/s^2	raw × 0.025 = m/s^2 Factor `0.025` Offset `0`	`[0 .. 0]`	Kombi,CIC,IHKA,ACC
YawRate	B5..B6 (12b LE, 2 bytes) DBC: 40\|12	Intel (little-endian) Signed Unit: deg/s	raw × 0.05 = deg/s Factor `0.05` Offset `0`	`[0 .. 0]`	Kombi,CIC,IHKA,ACC
Counter_0x1a0	B6[7:4] hi-nibble DBC: 52\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	Kombi,CIC,IHKA,ACC
Checksum_0x1a0	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC,IHKA,ACC

0x1A1 · SpeedKombi_1A1

Decimal ID: 417 · Transmitter: XXX

DLC 5 1 signals

0x1A1 (XXX): Speed as used by instrument cluster. 5 bytes. Bytes 2-3 big-endian: ((B2*256)+B3)/100 = MPH. Source: loopybunny.co.uk/CarPC

??????????

Byte layout

—

SpeedKmh_1A1

—

Signal	Position	Format	Scale / Formula	Range	Receivers
SpeedKmh_1A1	B2..B3 (16b BE) DBC: 23\|16	Motorola (big-endian) Unsigned Unit: km/h	raw × 0.0160934 = km/h Factor `0.0160934` Offset `0`	`[0 .. 1054.4]`	Kombi,CIC

0x1A2 · TransimissionData2

Decimal ID: 418 · Transmitter: EGS

DLC 8 3 signals

0x1A2 (EGS): Transmission data 2

????????????????

Byte layout

—

Counter_0x1a2

—

ManualMode

Checksum_0x1a2

Signal	Position	Format	Scale / Formula	Range	Receivers
Counter_0x1a2	B3[7:4] hi-nibble DBC: 28\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	DME,Kombi
ManualMode	B6+ (1b BE) DBC: 50\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	DME,Kombi
Checksum_0x1a2	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,Kombi

0x1A3 · Raw_data_longitudinal_acceleration

Decimal ID: 419 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1A6 · DistanceRoute

Decimal ID: 422 · Transmitter: DSC

DLC 8 4 signals

0x1A6 (DSC): Speed pulse counters for instrument cluster and time counter. SpeedCounter1/2/3 are duplicated speed pulse counters; TimeCounter increments by 100 every 50ms. Source: loopybunny.co.uk/CarPC

00000000000040F0

Byte layout

SpeedCounter1

SpeedCounter2

SpeedCounter3

TimeCounter

Signal	Position	Format	Scale / Formula	Range	Receivers
SpeedCounter1	B0..B1 (16b LE, 2 bytes) DBC: 0\|16	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 65535]`	Kombi
SpeedCounter2	B2..B3 (16b LE, 2 bytes) DBC: 16\|16	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 65535]`	Kombi
SpeedCounter3	B4..B5 (16b LE, 2 bytes) DBC: 32\|16	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 65535]`	Kombi
TimeCounter	B6..B7 (16b LE, 2 bytes) DBC: 48\|16	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 65535]`	Kombi

0x1A7 · actuation_request_EMF

Decimal ID: 423 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1AA · Effect_ErgoCommander

Decimal ID: 426 · Transmitter: CCC

DLC 8 0 signals

FE03000000000000

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1AC · Status_ARS_module

Decimal ID: 428 · Transmitter: ARS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1B4 · InstrumentClusterStatus_KOMBI

Decimal ID: 436 · Transmitter: CCC

DLC 8 1 signals

0x1B4 (CCC): Instrument cluster status — handbrake

00C0E2F40030FC84

Byte layout

—

HandbrakeActive

—

Signal	Position	Format	Scale / Formula	Range	Receivers
HandbrakeActive	B5 bit1 DBC: 41\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi

0x1B5 · HeatFlow_LoadTorqueClimate

Decimal ID: 437 · Transmitter: IHKA

DLC 7 0 signals

0x1B5 (IHKA — Automatic Climate Control): Heat flow climate

C8FF0F000AFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1B6 · HeatFlowEngine

Decimal ID: 438 · Transmitter: DME

DLC 7 0 signals

0x1B6 (DME): Heat flow engine

FFFF3C001BA000

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1B8 · Operation_ErgoCommander

Decimal ID: 440 · Transmitter: ZBE

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1C2 · Distance_message_PDC

Decimal ID: 450 · Transmitter: PDC

DLC 8 8 signals

0x1C2 (PDC): Front and rear PDC sensor distances. RL/FL is furthest left, RR/FR is furthest right. Mid = inner sensors.

????????????????

Byte layout

PdcSensorRearLeft

PdcSensorRearLeftMid

PdcSensorRearRightMid

PdcSensorRearRight

PdcSensorFrontLeft

PdcSensorFrontLeftMid

PdcSensorFrontRightMid

PdcSensorFrontRight

Signal	Position	Format	Scale / Formula	Range	Receivers
PdcSensorRearLeft	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned Unit: cm	raw (cm) Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi
PdcSensorRearLeftMid	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned Unit: cm	raw (cm) Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi
PdcSensorRearRightMid	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned Unit: cm	raw (cm) Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi
PdcSensorRearRight	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned Unit: cm	raw (cm) Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi
PdcSensorFrontLeft	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned Unit: cm	raw (cm) Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi
PdcSensorFrontLeftMid	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned Unit: cm	raw (cm) Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi
PdcSensorFrontRightMid	B6 (full byte) DBC: 48\|8	Intel (little-endian) Unsigned Unit: cm	raw (cm) Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi
PdcSensorFrontRight	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned Unit: cm	raw (cm) Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi

0x1C3 · Distance_message_2_PDC

Decimal ID: 451 · Transmitter: PDC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1C6 · Acoustic_message_PDC

Decimal ID: 454 · Transmitter: PDC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1D0 · EngineData

Decimal ID: 464 · Transmitter: DME

DLC 8 5 signals

0x1D0 (DME): Engine data — coolant temp, oil temp (petrol/some diesel), idle target RPM. TEMP_EOI (B1) returns 0xFF on N47 diesel (signal not available — N47 does not expose oil temp via K-CAN gateway; OBD-II PID 0x5C or PT-CAN required). TEMP_EOI is valid on petrol engines (N43, N52, N54, etc.) using same raw-48=C formula as TEMP_ENG.

8BFF6AC800000D9C

Byte layout

—

Counter_0x1d0, ST_ENG_RUN, ST_SW_WAUP

AIP_ENG

—

CTR_SLCK

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Counter_0x1d0	B2[3:0] lo-nibble DBC: 16\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	Kombi,CIC
ST_ENG_RUN 0x03 (3) = signal invalid 0x02 (2) = engine running 0x01 (1) = engine starting 0x00 (0) = engine off	B2[5:4] DBC: 20\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	Kombi,CIC
ST_SW_WAUP 0x03 (3) = signal invalid 0x02 (2) = EGS forced switching active 0x01 (1) = engine warm 0x00 (0) = warming up	B2[7:6] DBC: 22\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	Kombi,CIC
AIP_ENG	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned Unit: hPa	raw × 2 + 598 = hPa Factor `2` Offset `598`	`[600 .. 1106]`	Kombi,CIC
CTR_SLCK 0x03 (3) = signal invalid 0x02 (2) = requirement Shiftlock 0x01 (1) = no requirement Shiftlock 0x00 (0) = not allowed	B6[1:0] DBC: 48\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	Kombi,CIC

0x1D2 · TransmissionDataDisplay

Decimal ID: 466 · Transmitter: EGS

DLC 6 7 signals

0x1D2 (EGS): Transmission display data. ShiftLeverPosition HIL-validated: 1=P, 2=R, 4=N, 8=D. ShiftLeverMode (B4 bits 0-1): 0=Drive/Normal (B4=0xF0), 2=Sport/Manual (B4=0xF2). GearAct (B1 high nibble, bits 12-15) CONFIRMED HIL 2026-03-29: raw 5=1st, 6=2nd, 7=3rd, 8=4th, 9=5th, A=6th (formula raw-4=gear). Raw 0 = signal not populated (Drive mode only). GearAct ONLY active in Sport/Manual mode (B4=0xF2). Represents COMMANDED/REQUESTED gear (leads 0x304 by ~100-200ms; in standing m1-m6 test GearAct reached 6 while 0x304 stayed at C6 due to EGS protection). 0x304 Status_Gang = ENGAGED gear. Source: gearbox_modes, mlog1, mlog2, m1-m6_shift.log, city run 2026-03-27 HIL captures; GearAct confirmed 2026-03-29. --- Raiso77 notes (unconfirmed, 2026-03-31): B1/GearAct only populated on XHP or Alpina gearbox firmware; standard GM software does not use B1 in Drive mode (sends 0x0C = raw 0 = not populated) — consistent with our HIL observations. B5 (xFF signal): M3 DCT-specific mode byte only; always 0xFF on ZF 6HP19 — CONFIRMED in all HIL logs. B2: always 0xFF on ZF 6HP19; M3 DCT sends 0x9F — CONFIRMED (our logs: B2 always FF). B5 DCT values (Raiso77, M3 DCT only): 0x52=Drive(?), 0x51-0x55=shifted gears, 0x55=high gear; not applicable to ZF 6HP19.

780CFF0CF0FF

Byte layout

ShiftLeverPosition, ShiftLeverPositionXOR

GearAct

—

SportButtonState, Counter_0x1d2

ShiftLeverMode

xFF

Signal	Position	Format	Scale / Formula	Range	Receivers
ShiftLeverPosition 0x00 (0) = Off 0x01 (1) = P 0x02 (2) = R 0x04 (4) = N 0x08 (8) = D	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 8]`	Kombi,CIC
ShiftLeverPositionXOR	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	Kombi,CIC
GearAct EGS commanded/requested gear. Only valid in Sport/Manual mode (ShiftLeverMode=2, B4=0xF2). Raw 5-10 = gears 1-6 (formula raw-4). Raw 0 = not available (Drive mode). All 6 gears confirmed HIL 2026-03-29. Raiso77: standard GM firmware (ZF 6HP19) only uses B1 in Manual/Tip mode; XHP/Alpina firmware may populate in all modes (unconfirmed on our bench — bench runs stock GM firmware).	B1[7:4] hi-nibble DBC: 12\|4	Intel (little-endian) Unsigned	raw − 4 Factor `1` Offset `-4`	`[0 .. 15]`	Kombi,CIC
SportButtonState Only selected powertrains. Makes throttle, overboost, suspension, steering, shiftpoints more aggressive. NOTE: on N47 diesel E90 without a physical Sport/S button this bit is structurally always 1 — B3 low nibble is permanently 0xC (bits 2-3 always set). Either EGS hardcodes sport-shift profile as default for this powertrain, or bits 2-3 are XOR/framing bits misidentified as a signal. Not meaningful as a toggle on no-sport-button variants. Confirmed across all HIL logs 2026-03-29: bit2=1 in every frame. 0x00 (0) = Inactive 0x01 (1) = Active	B3 bit2 DBC: 26\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,CIC
Counter_0x1d2	B3[7:4] hi-nibble DBC: 28\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	Kombi,CIC
ShiftLeverMode Gear selector mode. 0=Drive/Normal (B4=0xF0), 2=Sport/Manual (B4=0xF2). Dashboard shows D1-D6 in Normal, S1-S6 in Sport, M1-M6 in Manual. Confirmed HIL 2026-03-29. 0x00 (0) = Normal 0x01 (1) = Sport 0x02 (2) = Manual	B4[1:0] DBC: 32\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	Kombi,CIC
xFF B5 — M3 DCT-specific mode byte (Raiso77, 2026-03-31). Always 0xFF on ZF 6HP19 non-DCT — confirmed across all HIL logs. On M3 DCT: 0x52=Drive(?), 0x51-0x55=gear positions, 0x55=high. Not applicable to E90 ZF 6HP19.	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC

0x1D6 · SteeringButtons

Decimal ID: 470 · Transmitter: SZL

DLC 2 6 signals

0x1D6 (SZL): Steering wheel MFL buttons

C00C

Byte layout

Telephone, Volume_DOWN, Volume_UP, Previous_down, Next_up

VoiceControl

Signal	Position	Format	Scale / Formula	Range	Receivers
Telephone	B0+ (1b BE) DBC: 0\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi
Volume_DOWN	B0+ (1b BE) DBC: 2\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi
Volume_UP	B0+ (1b BE) DBC: 3\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi
Previous_down	B0+ (1b BE) DBC: 4\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi
Next_up	B0+ (1b BE) DBC: 5\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi
VoiceControl	B1+ (1b BE) DBC: 8\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi

0x1D8 · Operation_air_conditioning_air_distribution_FA

Decimal ID: 472 · Transmitter: CCC

DLC 8 0 signals

0x1D8 (CCC): AC air distribution front

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1D9 · Operation_pushbutton_MDrive

Decimal ID: 473 · Transmitter: SZL

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1DA · Climate_control_remote_control

Decimal ID: 474 · Transmitter: CAS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1DC · Operation_stratification_seat_heating

Decimal ID: 476 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1DE · Air_conditioning_controls_rear

Decimal ID: 478 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1E0 · Operation_air_conditioning_air_distribution_BF

Decimal ID: 480 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1E1 · DoorStatus_Counter_1E1

Decimal ID: 481 · Transmitter: XXX

DLC 6 6 signals

0x1E1 (XXX): Counter and Door Status, sent every 200ms. Bytes 0-1 rolling counter (211-225 normal, 36-50/240-254 engine starting). Byte 2 door open bitmask: b0=driver, b2=passenger, b4=rear driver, b6=rear passenger. Bytes 3-5 padding 0xFF. Source: loopybunny.co.uk/CarPC

E0F400FFFFFF

Byte layout

Counter_1E1_Lo

Counter_1E1_Hi

DriverDoorOpen_1E1, PassengerDoorOpen_1E1, RearDriverDoorOpen_1E1, RearPassengerDoorOpen_1E1

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Counter_1E1_Lo	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,CIC,Kombi
Counter_1E1_Hi	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,CIC,Kombi
DriverDoorOpen_1E1	B2 bit0 DBC: 16\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,CIC,Kombi
PassengerDoorOpen_1E1	B2 bit2 DBC: 18\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,CIC,Kombi
RearDriverDoorOpen_1E1	B2 bit4 DBC: 20\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,CIC,Kombi
RearPassengerDoorOpen_1E1	B2 bit6 DBC: 22\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,CIC,Kombi

0x1E2 · Operation_air_conditioning_front

Decimal ID: 482 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1E3 · Operation_pushbutton_interior_lighting

Decimal ID: 483 · Transmitter: FZD

DLC 8 0 signals

0x1E3 (FZD): Interior light push-button

F1FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1E7 · Operation_seat_heating_seat_climate_FA

Decimal ID: 487 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1E8 · Operation_seat_heating_seat_climate_BF

Decimal ID: 488 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1EA · Steering_column_adjustment_control

Decimal ID: 490 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1EB · Operation_active_seat_FA

Decimal ID: 491 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1EC · Operation_active_seat_BF

Decimal ID: 492 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1ED · Operation_backrest_adjust_FA

Decimal ID: 493 · Transmitter: SZM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1EE · Steering_column_switch_operation

Decimal ID: 494 · Transmitter: FRMFA

DLC 8 1 signals

0x1EE (FRM — Footwell Module): Indicator / turn signal stalk position. Byte 0: 0=off, 1=up1st, 2=up2nd, 4=down1st, 8=down2nd, 16=full beam, 32=flash. Byte 1=0xFF. Source: loopybunny.co.uk/CarPC

00FF????????????

Byte layout

IndicatorStalkPos

—

Signal	Position	Format	Scale / Formula	Range	Receivers
IndicatorStalkPos 0x00 (0) = off 0x01 (1) = up1st 0x02 (2) = up2nd 0x04 (4) = down1st 0x08 (8) = down2nd 0x10 (16) = full_beam 0x20 (32) = flash	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC

0x1EF · Operation_backrest_adjust_BF

Decimal ID: 495 · Transmitter: SZM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1F2 · Operation_seat_memory_BF

Decimal ID: 498 · Transmitter: SZM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1F3 · Operation_seat_memory_FA

Decimal ID: 499 · Transmitter: SZM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1F6 · TurnSignals

Decimal ID: 502 · Transmitter: FRMFA

DLC 2 5 signals

0x1F6 (FRM — Footwell Module): Turn signal switch

A1F1

Byte layout

HoldActivated, LeftTurn, RightTurn

TurnSignalActive, TurnSignalIdle

Signal	Position	Format	Scale / Formula	Range	Receivers
HoldActivated Spikes down if blinker cleared with timeout or turn. Stays off if blinker cleared with stalk	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,FRMFA
LeftTurn Indicates left blinker or when steering returning left clears right blinker	B0 bit4 DBC: 4\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,FRMFA
RightTurn Indicates right blinker or when steering returning right clears left blinker	B0+ (1b BE) DBC: 5\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,FRMFA
TurnSignalActive Turn signal on or transitioning	B1+ (1b BE) DBC: 8\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,FRMFA
TurnSignalIdle Turn signal off	B1+ (1b BE) DBC: 9\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,FRMFA

0x1F8 · Operation_SHD_MDS

Decimal ID: 504 · Transmitter: FZD

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1FB · Status_EPS

Decimal ID: 507 · Transmitter: EPS

DLC 8 0 signals

F9FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1FC · Status_AFS

Decimal ID: 508 · Transmitter: AFS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1FD · Status_request_EMF_KCAN

Decimal ID: 509 · Transmitter: EMF

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x1FE · Crash

Decimal ID: 510 · Transmitter: ACSM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x200 · CruiseControlStatus

Decimal ID: 512 · Transmitter: DME

DLC 8 3 signals

2C91FCFFFFFFFFFF

Byte layout

CruiseControlSetpointSpeed

CruiseControlInactiveFlag, CruiseCoontrolActiveFlag

—

Signal	Position	Format	Scale / Formula	Range	Receivers
CruiseControlSetpointSpeed	B0 (full byte, BE) DBC: 7\|8	Motorola (big-endian) Unsigned Unit: km/h	raw × 0.402335 = km/h Factor `0.402335` Offset `0`	`[0 .. 0]`	Kombi,CIC,ACC
CruiseControlInactiveFlag	B1+ (1b BE) DBC: 12\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,CIC,ACC
CruiseCoontrolActiveFlag	B1+ (1b BE) DBC: 13\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,CIC,ACC

0x201 · Status_EMF_KCAN

Decimal ID: 513 · Transmitter: EMF

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x202 · Dimming

Decimal ID: 514 · Transmitter: FRMFA

DLC 2 0 signals

0x202 (FRM — Footwell Module): Dimming status

7EFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x205 · Acoustic_request_Kombi

Decimal ID: 517 · Transmitter: Kombi

DLC 8 1 signals

0x205 (Kombi): Acoustic gong request. FAULT-ONLY — absent in normal startup. Fires at +13s coinciding with 0x338/0x172 fault notification. B0 bit 0 (GongCounter) toggles 0xF1→0xF0 across 3 rapid frames — event-driven toggle rather than a periodic heartbeat. Correlates with the audible warning gong on low-beam fault detection. Source: HIL 2026-05-03 low-beam fault log.

????????????????

Byte layout

GongCounter

—

Signal	Position	Format	Scale / Formula	Range	Receivers
GongCounter	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi

0x206 · Control_Display_Shiftlights

Decimal ID: 518 · Transmitter: DME

DLC 8 0 signals

0000000000000000

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x20B · Memory_adjustment

Decimal ID: 523 · Transmitter: SM_FA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x20C · Steering_column_control

Decimal ID: 524 · Transmitter: SM_FA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x20D · Position_steering_column

Decimal ID: 525 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x210 · Operation_HUD

Decimal ID: 528 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x211 · Status_HUD

Decimal ID: 529 · Transmitter: HUD

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x212 · Height_levels_air_spring

Decimal ID: 530 · Transmitter: EHC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x21A · LampStatus

Decimal ID: 538 · Transmitter: FRMFA

DLC 8 2 signals

0x21A (FRM — Footwell Module): Lighting and engine-running status. CORRECTION (keyless-restart log 2026-03-24): B0 bit7 is NOT KL15_Active — it is BRAKE_LIGHTS (brake pedal pressed). Evidence: bit7 clears to 0 immediately after start while engine is still running and KL15 is active (driver lifts foot off brake). The earlier correlation with ignition events was because diesel start requires brake pedal held, so brake-on and KL15-on events coincide. B0 bit0: reflects engine running state (1=engine running) but also correlates with dipped-beam (see full lighting decode). B0 bit2=SideLights. Confirmed B0 patterns: 0x04=sidelights_only (engine off, no brake), 0x84=brake+sidelights (brake pressed, engine off — restart prep), 0x85=brake+sidelights+engine_flag (cranking/just_started), 0x05=sidelights+engine_running_no_brake (normal driving), 0x05=also seen post-lock with engine on. B1=0x12 constant when KL15 active (from HIL-2). B2=0xF7 constant. [PARTIAL] Loopybunny exterior light decode (unconfirmed for this car): B0 lo-nibble: 0=all off, 4=sidelights/auto, 5=dip, 7=main. B1: 0=off, 1=reverse/tail, 16=interior, 18=interior+exterior. Source: loopybunny.co.uk/CarPC + HIL 2026-03-23 + keyless-restart 2026-03-24

0512F7??????????

Byte layout

LightsByte0

LightsByte1

—

Signal	Position	Format	Scale / Formula	Range	Receivers
LightsByte0 0x00 (0) = all_off 0x04 (4) = sidelights 0x05 (5) = dip 0x07 (7) = main 0x27 (39) = fog	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC
LightsByte1 0x00 (0) = all_off 0x01 (1) = reverse_tail 0x10 (16) = interior 0x12 (18) = interior_exterior	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC

0x21C · Operation_NightVision

Decimal ID: 540 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x21E · Status_NightVision

Decimal ID: 542 · Transmitter: NVC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x224 · Operation_push_button_NSW

Decimal ID: 548 · Transmitter: FRMFA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x226 · RainSensorWiperSpeed

Decimal ID: 550 · Transmitter: FZD

DLC 5 2 signals

0x226 (FZD): Rain sensor and automatic wiper speed. B0=WiperActivity (0x00=off, 0x55=interval/active wiper mode set by rain sensor). B1=0xFE constant. B2=0xFF constant. B3=RainIntensity (0x00=no rain, 0x4F=rain detected — rises before wiper activates). B4=0xF3 constant. Source: 5ninutes_Full_Run_Cycle.log HIL capture (5 state changes observed with AUTO wiper in rain)

00FEFF4FF3

Byte layout

WiperActivity

—

RainIntensity

—

Signal	Position	Format	Scale / Formula	Range	Receivers
WiperActivity	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	FRMFA,Kombi
RainIntensity	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	FRMFA,Kombi

0x228 · Operation_special_function

Decimal ID: 552 · Transmitter: CCC

DLC 8 0 signals

0000????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x22A · Status_BFS

Decimal ID: 554 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x22C · Operation_push_button_NSL

Decimal ID: 556 · Transmitter: FRMFA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x232 · Status_FAS

Decimal ID: 562 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x236 · Status_FASH

Decimal ID: 566 · Transmitter: XXX

DLC 7 0 signals

??????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x23A · Status_radio_key

Decimal ID: 570 · Transmitter: CAS

DLC 8 2 signals

0x23A (CAS or CIC gateway): Keyfob/CIC interaction state. B3=0x60 constant. B1 state: 0x30=idle/home, 0x33=active menu/CIC interaction ongoing. B2 countdown: 0x04→0x01→0x00 during startup init; 0x00 during normal operation. HIL-3 2026-03-24: B1 transitions 0x30→0x33 within 5ms of MENU hard button release (t=2365334ms), confirming B1=0x33 marks CIC menu mode active. Also B2 runs 0x04→0x00 countdown at both session start AND session end (shutdown). Loopybunny source labels B2 as keyfob button command (0x04=lock, 0x01=unlock) — this appears incorrect for CIC-equipped E90 LCI; in our data B2 is an init/deinit counter, not a keyfob command. Source: loopybunny.co.uk/CarPC (partial); HIL-3 2026-03-24 (override)

00300060????????

Byte layout

—

KeyfobAction

KeyfobButton

—

Signal	Position	Format	Scale / Formula	Range	Receivers
KeyfobAction	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC,RAD1
KeyfobButton 0x00 (0) = none 0x01 (1) = unlock 0x04 (4) = lock 0x10 (16) = boot_unlock	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC,RAD1

0x23B · Status_climate_front_extended

Decimal ID: 571 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x23D · Request_display_climate

Decimal ID: 573 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x23E · Status_Klima_Fond

Decimal ID: 574 · Transmitter: FKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x242 · ClimateFrontStatus

Decimal ID: 578 · Transmitter: IHKA

DLC 8 4 signals

0x242 (IHKA — Automatic Climate Control): Climate front status. B0 encodes recirc and special mode flags: bit0=always set, bit2=MaxACMode (0x05), bit4=RecircAuto (0x11), bit5=RecircManual (0x21). B1=0xF1 (0xF5 observed during defrost). B2 bit0=AC_Compressor_578 flag (0xFD=on, 0xFC=off). B3-B4=0xFF constant. Source: clima_modes_bottom_up.log HIL capture

01F1FDFFFF??????

Byte layout

MaxACMode, RecircAuto, RecircManual

—

AC_Compressor_578

—

Signal	Position	Format	Scale / Formula	Range	Receivers
MaxACMode 0x00 (0) = off 0x01 (1) = on	B0 bit2 DBC: 2\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi
RecircAuto 0x00 (0) = off 0x01 (1) = on	B0 bit4 DBC: 4\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi
RecircManual 0x00 (0) = off 0x01 (1) = on	B0 bit5 DBC: 5\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi
AC_Compressor_578 0x00 (0) = off 0x01 (1) = on	B2 bit0 DBC: 16\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC,Kombi

0x246 · Status_air_conditioning_front_control_unit

Decimal ID: 582 · Transmitter: IHKA

DLC 8 1 signals

0x246 (IHKA — Automatic Climate Control): Climate setpoint and AC status. B0=0x3F constant (purpose unknown). B1=0xF3 constant (purpose unknown). B2=TEMPERATURE SETPOINT (DBC signal ClimaTempSetpoint is CORRECT): formula raw*0.5+2.5 degC, range 0x1B-0x33 (16.0-28.0 degC). Validated at three setpoints in dedicated HIL capture 10minutes_run_temp_24_16_28_24.log 2026-03-24: 0x2B=24.0C, 0x1B=16.0C, 0x33=28.0C — all confirmed. Values 0x00=LO, 0x01-0x1A=below scale, 0x34+=HI (observed up to 0x3A when dial turned past maximum). B2=0x00 with AC-off seen at start/end of session (LO/AC-off state). NOTE: previous CM_ (HIL 2026-03-23) incorrectly identified B2 as a rolling counter — that analysis was from sessions with static setpoint and the apparent increment was coincidental. The original DBC signal name ClimaTempSetpoint was correct all along. B3=AC_Compressor flag: 0xFC=off, 0xFD=on (HIL-confirmed across multiple sessions). Source: 10minutes_run.log 2026-03-22 + HIL 2026-03-23 + HIL temp log 2026-03-24

3FF364FDFF??????

Byte layout

—

ClimaTempSetpoint

—

Signal	Position	Format	Scale / Formula	Range	Receivers
ClimaTempSetpoint	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned Unit: degC	raw × 0.5 + 2.5 = degC Factor `0.5` Offset `2.5`	`[0 .. 73]`	CIC

0x248 · Status_rear_view_camera

Decimal ID: 584 · Transmitter: RFK

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x249 · Control_rear_view_camera

Decimal ID: 585 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x24A · Status_PDC

Decimal ID: 586 · Transmitter: PDC

DLC 8 1 signals

0x24A (PDC): Reverse gear status from FRM. Byte 0: 5=in reverse, 6=not in reverse; 2s period. Source: loopybunny.co.uk/CarPC

????????????????

Byte layout

ReverseGear_24A

—

Signal	Position	Format	Scale / Formula	Range	Receivers
ReverseGear_24A Byte 0: 5=in reverse, 6=not in reverse 0x05 (5) = in_reverse 0x06 (6) = not_in_reverse	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi

0x24B · Status_door_sensors

Decimal ID: 587 · Transmitter: FRMFA

DLC 8 0 signals

00F8????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x252 · Wiper_status

Decimal ID: 594 · Transmitter: Gate1

DLC 8 1 signals

0x252 (Gate1): Wiper status. Byte 0: 0xCE=down/parked, 0xCD=going up. Source: loopybunny.co.uk/CarPC

CDFF????????????

Byte layout

WiperStatus

—

Signal	Position	Format	Scale / Formula	Range	Receivers
WiperStatus 0xCE (206) = parked 0xCD (205) = going_up	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC

0x256 · Challenge_Passive_Access

Decimal ID: 598 · Transmitter: CAS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x258 · Status_Transmission_Passive_Access

Decimal ID: 600 · Transmitter: PGS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x25C · Operation_of_climate_additional_programs

Decimal ID: 604 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x264 · iDrive_Rotary_264

Decimal ID: 612 · Transmitter: ZBE

DLC 6 3 signals

0x264 (ZBE — iDrive Controller): iDrive knob rotary encoder per-detent frame. B0=0xE1, B1=0xFD, B5=0x1E constants. B2=ByteCounter: shared incrementing frame-sequence counter (same counter as 0x267 B2 — both IDs share one global counter in firmware). B3=RotaryAbsoluteLow: low byte of 16-bit absolute encoder counter. B4=RotaryAbsoluteHigh: high byte of 16-bit encoder counter. Counter encoding: (B4<<8 | B3) as unsigned 16-bit. Initial/boot value [B3=0x00, B4=0x7F] = 0x7F00 = 32512 (mid-range). CW rotation = counter increments (B3++; if B3 overflows 0xFF→0x00, B4++). CCW rotation = counter decrements (B3--; if B3 underflows 0x00→0xFF, B4--). One physical detent = ±1 on counter. Event-driven: transmits only while knob is being turned; absent when knob is still. HIL-3 2026-03-24 confirmed: 'wobble' sequence B3=0xFE→0xFD (one CCW click) →0xFE (one CW click) observed; rollover 0xFF→0x00 with B4 0x7F→0x80 carry confirmed. Only appears when CIC menu is active (0x5E7 B4=0x01). Source: idCanSend.txt firmware (idrive_backup, deep-tested); HIL-3 2026-03-24

E1FDFA00801E

Byte layout

—

ByteCounter_264

RotaryAbsoluteLow_264

RotaryAbsoluteHigh_264

—

Signal	Position	Format	Scale / Formula	Range	Receivers
ByteCounter_264	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC
RotaryAbsoluteLow_264	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC
RotaryAbsoluteHigh_264	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC

0x267 · iDrive_Buttons_267

Decimal ID: 615 · Transmitter: ZBE

DLC 6 4 signals

0x267 (ZBE — iDrive Controller): iDrive button/joystick event frame. B0=0xE1, B1=0xFD constants. B2=ByteCounter: shared sequence counter (same as 0x264 B2). B3=action byte: high nibble=joystick direction (0=none,1=up,2=right,4=down,8=left), low nibble=press state (0x1=pressed/short,0x2=long-press,0x0=released). B4=area context: 0xC0=panel hard buttons, 0xDE=knob center press, 0xDD=joystick. B5=button ID: for B4=0xC0 panel buttons bitmask: 0x01=Menu/Mode, 0x02=Back, 0x04=Option, 0x08=Radio, 0x10=CD/Media, 0x20=NAV, 0x40=Tel; for B4=0xDE knob-center: B5=0x01; for B4=0xDD joystick: B5=0x00 (direction in B3 high nibble). Protocol: press sends B3=0x01 frame then after hold B3=0x00 release frame; B2 increments between press and release. Long-press of knob-center (B4=DE, B5=0x01, B3=0x02): native BMW CIC behaviour. Long-press of Menu/Mode (B4=C0, B5=0x01, B3=0x02, 3s hold): NOT native BMW behaviour — this is a custom firmware trick in idCanSend.txt (TBit=15) used to switch video output to aftermarket MMI instead of CIC; observed in HIL-3 at t=2889271ms. HIL-3 2026-03-24 confirmed: Back(C0/02), NAV(C0/20), JoyPress/enter(DE/01), Menu/Mode(C0/01), Menu long-press (C0/01 B3=0x02 = MMI video switch, non-BMW). Source: idCanSend.txt firmware (idrive_backup, deep-tested); loopybunny.co.uk/CarPC (structure); HIL-3 2026-03-24 (bitmask values)

E1FD4800C001

Byte layout

—

ButtonCounter_267

ButtonDirection_267

ButtonArea_267

ButtonSelect_267

Signal	Position	Format	Scale / Formula	Range	Receivers
ButtonCounter_267	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC
ButtonDirection_267	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC
ButtonArea_267 0xDE (222) = Direction_Or_Menu 0xDD (221) = Joystick_Direction 0xC0 (192) = MultiButton	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC
ButtonSelect_267 0x00 (0) = Direction 0x01 (1) = Menu 0x02 (2) = Back 0x04 (4) = Option 0x08 (8) = Radio 0x10 (16) = CD 0x20 (32) = Nav 0x40 (64) = Tel	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC

0x26B · Operation_blinds_BF

Decimal ID: 619 · Transmitter: KGM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x26C · Operation_blinds_FA

Decimal ID: 620 · Transmitter: KGM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x26D · Operation_blinds_MK

Decimal ID: 621 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x26E · Control_FH_SHD_central_comfort

Decimal ID: 622 · Transmitter: CAS

DLC 8 0 signals

0x26E (ZBE — iDrive controller): ZBE mode-state heartbeat, 2-second periodic. NOT the rotary encoder (encoder is 0x264). B3=0x00, B5-B7=0xFF constants. B2 mode flag: 0x3F=home/idle (bit6=0), 0x7F=CIC menu active (bit6=1 — transition observed at t=2375221ms during menu session). B1: 0x00=pre-menu idle, 0x40=menu interaction acknowledged (~22s after menu entry). B0: 0x00=idle, 0x40=extended/sustained menu state. Loopybunny source mislabels this as 'RotaryAbsolute per-notch counter' — incorrect for E90 LCI CIC; B2 is a 2-state flag, not a counter. Source: HIL-3 2026-03-24 (override)

40407F00FFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x273 · CIC_Status_for_Idrive

Decimal ID: 627 · Transmitter: CCC

DLC 8 0 signals

0x273 (CCC — Car Communication Computer / CIC): CIC state event counter. B1=0xE1, B2=0x00, B3=0xF0, B4=0xFF, B5=0x7F, B6=0xDE constant. B7 = global event counter, increments by 1 on each significant CIC menu state transition (enter submenu, back-to-menu, mode change). NOT a per-knob-detent counter — too infrequent (~11 events over 9.8 min). B0 flag byte: 0x1D=normal CIC interaction, 0x5D=rapid/held interaction (bit6 set, observed during 78-92ms rapid button burst at t=2857995-2858165ms). HIL-3 2026-03-24: first 4 counter events at t=2365659-2375390ms coincide exactly with CIC menu navigation session (3 events ~250-750ms apart = scrolling through items; 4th event after 8.7s gap = returned from submenu). Counter range 0x01-0x0C observed in 9.8 min log. ID already referenced by CM_ BO_ 631 (0x277 = reply frame). Source: HIL-3 2026-03-24 (10minutes_run_Wheel_doors_tests.log)

1DE100F0FF7FDE01

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x277 · Idrive_Emu_Response_277

Decimal ID: 631 · Transmitter: XXX

DLC 4 1 signals

0x277 (ZBE — iDrive controller reply to CCC 0x273): CIC screen/state acknowledgement frame. B0=0xE1, B1=0x9D (may encode active screen/context — constant at 0x9D throughout HIL-3 main-menu session), B3=0xFF constants. B2 = event counter echo: mirrors B7 of the triggering 0x273 frame (same value, confirms handshake). Sends 1-3 frames per 0x273 event at ~160ms intervals. First 0x277 frame arrives at the same millisecond as the 0x273 event. HIL-3 2026-03-24: B2 range 0x01-0x0C, skips values that arrived too close together (0x07 skipped when two 0x273 events fired 92ms apart). B1=0x9D may change per screen context — all observations in this log are within the same menu session so a different B1 value would indicate a different CIC screen. Source: loopybunny.co.uk/CarPC (extended); HIL-3 2026-03-24

E19D03FF

Byte layout

—

ScreenNumberAck

Signal	Position	Format	Scale / Formula	Range	Receivers
ScreenNumberAck	B3[4:0] DBC: 24\|5	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 31]`	CIC

0x278 · CIC_278

Decimal ID: 632 · Transmitter: CIC

DLC 8 0 signals

0x278 (CIC): Unknown CIC/NavGraph group message. DLC 8. B0: 7-bit rolling counter (0x0A-0x7E, 117 steps, shared with 0x3CC/0x3F7 — all three counters step in lockstep). B2: 12-step cycle counter (0x00-0x0B). B6: 6 observed values (0x1E=30, 0x29=41, 0x2E=46, 0x32=50, 0x3A=58, 0x3B=59) — temperature in degC (coolant or ambient as reported by CIC). B0/B1 vary proportionally (often within 1 unit of each other, occasionally diverge — may be paired sensor readings). Sender is CIC (iDrive CCC/NBT — same ID-space as 0x273 CIC_Status, 0x277 Idrive_Emu_Response, 0x27A NavGraph_Sync). Source: HIL intensive driving logs 2026-03-29

0A15010F00142EE6

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x27A · NavGraph_Sync_27A

Decimal ID: 634 · Transmitter: CCC_GW

DLC 4 0 signals

0x27A: Navigation Graph Sync. Sender: CCC_GW (iDrive CCC Gateway). DLC 4. Source: rusefi.com BMW E65 Tool32 K-CAN table

04000000

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x27B · Status_Shiftlights

Decimal ID: 635 · Transmitter: Kombi

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x27D · Status_convertible_top_manual_convertible

Decimal ID: 637 · Transmitter: CAS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x27E · Status_convertible_top_convertible

Decimal ID: 638 · Transmitter: CTM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x27F · Status_central_locking_convertible_top

Decimal ID: 639 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x282 · Control_security_vehicle_2

Decimal ID: 642 · Transmitter: XXX

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x284 · Control_remote_start_safety_vehicle

Decimal ID: 644 · Transmitter: CAS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x286 · Electrochromic_control

Decimal ID: 646 · Transmitter: FZD

DLC 8 0 signals

00FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x28C · Pushbutton_vertical_dynamics

Decimal ID: 652 · Transmitter: GWS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x28D · Operation_pushbutton_sport

Decimal ID: 653 · Transmitter: GWS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x290 · Control_response_hydrogen_vehicle

Decimal ID: 656 · Transmitter: XXX

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x292 · Control_high_beam_assistant

Decimal ID: 658 · Transmitter: FLA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x29E · Central_locking_control_for_security_vehicle

Decimal ID: 670 · Transmitter: XXX

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x29F · Remote_control_FondCommander

Decimal ID: 671 · Transmitter: CAS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2A0 · Central_locking_control

Decimal ID: 672 · Transmitter: CAS

DLC 8 8 signals

0x2A0 (CAS): Central locking control. Three frame types on same ID. (1) HEARTBEAT (~5s periodic): B0=B1=B2=0x88. B3=0x01 static. B4=rolling counter (increments by 2 per cycle, CAS auto-increments correctly regardless of injected commands). B5/B6/B7=current lock state (see below). Sending 88 88 88 wakes bus ~20s but triggers no action. (2) COMMAND BURST (3 rapid frames on keyfob/button press): B0=B1=command byte, B2=modifier. Command bytes: 0x11=unlock, 0x22=lock. B2=0x80 identifies trunk command (pattern: xx xx 80; B0=B1=0x88 for trunk burst). B3=central lock panic-disable: 0x00=enabled(normal), 0x04=disabled(panic lockout). NOTE: 10x rapid toggle triggers ~1min lockout of both cabin button and keyfob. (3) TRUNK: identified by B2=0x80. B5/B6/B7 lock state encoding (CONFIRMED HIL 2026-04-08): 0x40 0x06 0x00=unlocked by keyfob (simple), 0x44 0x05 0x04=locked by keyfob (simple), 0x84 0x02 0x00=comfort open by keyfob (windows opened), 0x84 0x02 0x04=comfort close by keyfob (windows closed), 0x40 0x0B 0x00=interior button unlock, 0x43 0x0B 0x03=interior button lock, 0x?? 0x0B 0xx=interior button (general pattern: B6=0x0B). Trunk lock state: B5=0x80. Interior cabin button and trunk button are NOT on K-CAN — CAS blocks K-CAN button signals after real keyfob lock. Sleep state (post ignition-off): B5/B6/B7=44 05 04. Per-door status NOT in this frame — see 0x0E2/0x0E6/0x0EA/0x0EE. Source: HIL 2026-03-22/23/24/2026-04-07/08.

8888880106431B03

Byte layout

LockCmd_B0

LockCmd_B1

LockCmd_B2

LockState_B3

LockState_B4

LockState_B5

LockState_B6

LockState_B7

Signal	Position	Format	Scale / Formula	Range	Receivers
LockCmd_B0 Primary command byte. HEARTBEAT: 0x88. COMMAND BURST: 0x11=unlock, 0x22=lock, 0x88=trunk burst. Always identical to LockCmd_B1. 0x11 (17) = Unlock 0x22 (34) = Lock 0x88 (136) = TrunkOpen	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,FRMFA
LockCmd_B1 Mirror of LockCmd_B0 in all frame types. 0x11 (17) = Unlock_mirror 0x22 (34) = Lock_mirror 0x88 (136) = TrunkOpen_mirror	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,FRMFA
LockCmd_B2 Command modifier / frame type discriminator. HEARTBEAT: 0x88. TRUNK COMMAND: 0x80 — B2=0x80 is the definitive trunk identifier (pattern xx xx 80). Other command modifier values not yet confirmed. 0x18 (24) = Unlock_0x18 0x28 (40) = Lock_0x28 0x80 (128) = TrunkOpen_0x80	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,FRMFA
LockState_B3 Central lock panic-disable flag. HEARTBEAT: 0x01 static. COMMAND BURST: 0x00=lock enabled (normal), 0x04=lock disabled by panic (10x rapid toggle triggers ~1 min lockout of keyfob and cabin button).	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,FRMFA
LockState_B4 Rolling heartbeat counter (CONFIRMED HIL 2026-04-08). Increments by 2 per cycle. CAS auto-increments correctly regardless of injected commands. NOT a lock state byte.	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,FRMFA
LockState_B5 Lock action byte (CONFIRMED HIL 2026-04-08). 0x40=keyfob simple unlock OR interior button unlock, 0x43=interior button lock, 0x44=keyfob simple lock, 0x84=keyfob comfort (both open and close), 0x80=trunk state. Sleep state (post ignition-off): 0x44.	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,FRMFA
LockState_B6 Lock source/detail byte (CONFIRMED HIL 2026-04-08). 0x06=keyfob simple unlock, 0x05=keyfob simple lock, 0x02=keyfob comfort (both open and close), 0x0B=interior cabin button (both lock and unlock). Sleep state: 0x05.	B6 (full byte) DBC: 48\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,FRMFA
LockState_B7 Lock result byte (CONFIRMED HIL 2026-04-08). 0x00=unlocked (keyfob or interior button), 0x03=interior button lock, 0x04=keyfob lock. Sleep state: 0x04.	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,FRMFA

0x2A2 · Operation_of_climate_stand_functions

Decimal ID: 674 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2A4 · Operation_personalization

Decimal ID: 676 · Transmitter: Kombi

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2A6 · WiperSwitch

Decimal ID: 678 · Transmitter: SZL

DLC 2 2 signals

0x2A6 (SZL): Wiper mode switch from steering column. WiperSpeedMode nibble: 0=off, 1=interval_1, 2=interval_2, 3=slow. WiperAutoActive bit4: 0=off, 1=AUTO. B1=0xF9 constant. Source: wipers.log HIL capture

00FA

Byte layout

WiperSpeedMode, WiperAutoActive

—

Signal	Position	Format	Scale / Formula	Range	Receivers
WiperSpeedMode 0x00 (0) = off 0x01 (1) = interval_1 0x02 (2) = interval_2 0x03 (3) = slow	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	FRMFA,Kombi
WiperAutoActive 0x00 (0) = off 0x01 (1) = auto	B0 bit4 DBC: 4\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	FRMFA,Kombi

0x2B2 · WheelPressure_KCAN

Decimal ID: 690 · Transmitter: DSC

DLC 8 0 signals

0x2B2 (DSC): Wheel pressure (TPMS)

0000000000000004

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2B3 · AccelerationData

Decimal ID: 691 · Transmitter: DSC

DLC 5 3 signals

0x2B3 (DSC): Acceleration data

??????????

Byte layout

Checksum_0x2b3

Counter_0x2b3, Deceleration

Deceleration

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0x2b3	B0 (full byte, BE) DBC: 7\|8	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	ACSM,DME
Counter_0x2b3	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	ACSM,DME
Deceleration Filtered deceleration. Opposite to AccY signal	B1..B2 (8b LE, 2 bytes) DBC: 12\|8	Intel (little-endian) Signed	raw value Factor `1` Offset `0`	`[0 .. 255]`	ACSM,DME

0x2B4 · DWA_Alarm

Decimal ID: 692 · Transmitter: DWA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2B6 · Control_horn_DWA

Decimal ID: 694 · Transmitter: DWA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2B8 · Operation_onboard_computer

Decimal ID: 696 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2B9 · Operation_RSE

Decimal ID: 697 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2BA · Stopwatch

Decimal ID: 698 · Transmitter: Kombi

DLC 8 0 signals

0000000010??????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2BD · Request_switching_display

Decimal ID: 701 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2BE · Switch_status_display

Decimal ID: 702 · Transmitter: VSW

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2BF · Water_valve_control

Decimal ID: 703 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2C0 · LCD_lighting

Decimal ID: 704 · Transmitter: Kombi

DLC 3 0 signals

0x2C0 (Kombi): LCD lighting / rear window heater status. B0 lo-nibble: 0x1F=normal, 0x3F=at startup (settling). B1: 0x00=normal, 0x81=rear-window-heater-active [HYPOTHESIS — HIL 2026-03-23: B1 changed 0x00→0x81 at t=327s during rear window heater test, stayed 0x81 until ignition-off — single session, needs confirmation with explicit on/off cycle]. B2=0x01 constant. Source: HIL 2026-03-23

1F8101

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2C2 · Temperatur_Ist_Fond

Decimal ID: 706 · Transmitter: FKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2C7 · Display_Kombination_extended

Decimal ID: 711 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2CA · Outside_temperature

Decimal ID: 714 · Transmitter: Kombi

DLC 8 1 signals

0x2CA (Kombi): Outside ambient temperature. Byte 0: (value-80)/2 = degC; byte 1=0xFF. Source: loopybunny.co.uk/CarPC

6BFF????????????

Byte layout

OutsideTemp

—

Signal	Position	Format	Scale / Formula	Range	Receivers
OutsideTemp Byte 0: (raw-80)/2 = degC. Encoded as (degC*2)+80. DBC uses factor=0.5, offset=-40.	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned Unit: degC	raw × 0.5 − 40 = degC Factor `0.5` Offset `-40`	`[-40 .. 87.5]`	CIC,IHKA

0x2CC · Control_monitor_rear

Decimal ID: 716 · Transmitter: RSE

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2CE · Control_monitor

Decimal ID: 718 · Transmitter: CCC

DLC 8 0 signals

8080C1??????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2CF · Status_of_auxiliary_water_pump

Decimal ID: 719 · Transmitter: Gate1

DLC 8 0 signals

F8FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2D0 · Status_Sensor_AUC

Decimal ID: 720 · Transmitter: Gate1

DLC 8 0 signals

02FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2D1 · Status_fitting_window_V

Decimal ID: 721 · Transmitter: FZD

DLC 8 0 signals

0x2D1 (FZD — Roof Functions Centre): Attributed to FZD (Dachfunktionszentrum — overhead console module). B0: slowly-varying temperature-like signal, range 0x83-0x9E (131-158 raw) in intensive driving session. Formula raw-48=degC gives 83-110 degC range, consistent with solar/IR-heated interior surface (headliner area) or FZD-mounted temperature sensor. At drive start: 0x9E=110C declining to 0x83=83C over ~110s, then stabilising ~83-87C (ambient cabin normalisation). N.B.: formula raw-48 is the same as DME TEMP_ENG/TEMP_EOI — possibly shared ECU convention. DBC name 'Status_fitting_window_V' (Verglasung) may refer to glazing/glass temperature rather than mechanical window status. B1=0xF8 fixed (0xF8 = common 'data valid' marker in K-CAN). No signals currently defined in DBC — signal decode unconfirmed, requires dedicated HIL session. Source: HIL intensive driving 2026-03-29

86F8????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2D2 · Status_pressure_refrigeration_circuit

Decimal ID: 722 · Transmitter: Gate1

DLC 8 0 signals

14FFFF??????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2D3 · Status_stratification_rear

Decimal ID: 723 · Transmitter: Gate1

DLC 8 0 signals

36F8FFFF????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2D5 · Status_heating_rear_window

Decimal ID: 725 · Transmitter: Gate1

DLC 8 1 signals

0x2D5 (Gate1): Rear window heater status. B0 bit0=RearWindowHeater (0xFC=off, 0xFD=on). Source: clima_modes_bottom_up.log HIL capture (ON at t=40.87s, OFF at t=43.87s)

FCFF????????????

Byte layout

RearWindowHeater

—

Signal	Position	Format	Scale / Formula	Range	Receivers
RearWindowHeater 0x00 (0) = off 0x01 (1) = on	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Kombi,CIC

0x2D6 · Status_valve_air_conditioning_compressor

Decimal ID: 726 · Transmitter: Gate1

DLC 8 1 signals

0x2D6 (Gate1): AC compressor valve status. Byte 1: 252=off, 253=on. Source: loopybunny.co.uk/CarPC

FFFDFF??????????

Byte layout

—

ACStatus

—

Signal	Position	Format	Scale / Formula	Range	Receivers
ACStatus 0xFC (252) = off 0xFD (253) = on	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	IHKA

0x2DA · Status_tailgate_lift

Decimal ID: 730 · Transmitter: HKL

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2DE · Switch_control_display

Decimal ID: 734 · Transmitter: VSW

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2E2 · Status_setting_video_night_vision

Decimal ID: 738 · Transmitter: NVC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2E3 · Status_setting_video_rear_view_camera

Decimal ID: 739 · Transmitter: RFK

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2E4 · Status_trailer

Decimal ID: 740 · Transmitter: AHM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2E6 · Status_of_air_distribution_FA

Decimal ID: 742 · Transmitter: IHKA

DLC 8 2 signals

0x2E6 (IHKA — Automatic Climate Control): Climate air distribution — driver side (FA = Fahrerseite). B7=ClimateTemp actual driver zone output (raw/2 degC, e.g. 0x20=16C, 0x38=28C). B5=FanSpeed 1-7 (AUTO=0 not observed, min seen=1). B0/B1/B2=air distribution percentages for 3 vents: observed patterns: 0x28/0x32/0x64=default mix, 0x3C/0x64/0x00=floor-dominant, 0x2D/0x00/0x64=center-face, 0x00/0x3C/0x64=window mode, 0x64/0x00/0x00+B5=7=defrost, 0x00/0x64/0x00+B5=7=MAX AC. B3=0x29 constant. B6 bit6 set in MAX AC mode (0x7F vs 0x3F). Confirmed independent from passenger zone (0x2EA): driver stays fixed when only passenger zone adjusted. Source: clima_temp_fan.log + clima_modes_bottom_up.log HIL captures

0064640020047F30

Byte layout

—

FanSpeed

—

ClimateTemp

Signal	Position	Format	Scale / Formula	Range	Receivers
ClimateTemp	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned Unit: degC	raw × 0.5 = degC Factor `0.5` Offset `0`	`[0 .. 127.5]`	CIC
FanSpeed	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 7]`	CIC

0x2EA · Status_air_distribution_BF

Decimal ID: 746 · Transmitter: IHKA

DLC 8 1 signals

0x2EA (IHKA — Automatic Climate Control): Climate air distribution — passenger side (BF = Beifahrerseite). B7=ClimateTempPassenger actual passenger zone output (raw/2 degC, same scale as 0x2E6). Confirmed independent from driver zone: rises separately when only left/passenger knob is adjusted. Source: clima_temp_fan.log HIL capture

FFFFFFFFFFFFFF30

Byte layout

—

ClimateTempPassenger

Signal	Position	Format	Scale / Formula	Range	Receivers
ClimateTempPassenger	B7 (full byte) DBC: 56\|8	Intel (little-endian) Unsigned Unit: degC	raw × 0.5 = degC Factor `0.5` Offset `0`	`[0 .. 127.5]`	CIC

0x2EE · Status_climate_additional_programs

Decimal ID: 750 · Transmitter: IHKA

DLC 8 0 signals

FCFF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2F0 · Status_air_condition_functions

Decimal ID: 752 · Transmitter: IHKA

DLC 8 0 signals

0x2F0: [HYPOTHESIS — UNVERIFIED] Original DBC: Status_air_condition_functions, sender IHKA, 8 bytes. CONFLICT: 10minutes_run.log shows DLC=2, payload always F7 FC (100% static across 195 frames, period ~2000 ms, no variation during or after mirror adjustments). DBC DLC claim of 8 bytes does not match observed DLC=2. Copilot hypothesis: Mirror Status from TSG (door module) to FRM3 — bit0=MirrorMoveActive, bits1-2=MirrorMoveDirection, bit3=MirrorSelect, bit4=MirrorHeaterStatus, bit5=MirrorFault. This hypothesis is NOT supported by the drive log: payload never changes from F7 FC even when mirrors were physically adjusted. Static heartbeat behaviour is inconsistent with a movement-status frame. True identity unknown — needs HIL capture with known sender isolation.

F7FC????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2F1 · Status_driver_detection

Decimal ID: 753 · Transmitter: MRSZ

DLC 3 0 signals

0x2F1: [HYPOTHESIS — UNVERIFIED] Original DBC: Status_driver_detection, sender MRSZ (occupant detection / airbag), 3 bytes — DLC matches observed DLC=3. 10minutes_run.log: 412 frames, period ~1000 ms. B0 and B1 are rolling counters (incrementing mod 256, loosely correlated). B2 alternates FC/FD. Rolling counter pattern is consistent with a periodic MRSZ heartbeat — NOT consistent with Copilot hypothesis of Mirror Command (button press bits from TSG). Copilot hypothesis claims bit0=AdjustUp, bit1=AdjustDown, bit2=AdjustLeft, bit3=AdjustRight, bit4=SelectLeft, bit5=SelectRight — payload structure (counter + counter + status nibble) does not match button-press bitmask semantics. Most likely this is genuine MRSZ occupant detection status. Needs HIL confirmation.

E4FBFD

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2F3 · Display_switching_instruction

Decimal ID: 755 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2F4 · Air_conditioning_control_SH_ZH_auxiliary_water_pump

Decimal ID: 756 · Transmitter: IHKA

DLC 8 0 signals

CFFFFFFF????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2F6 · LightControl

Decimal ID: 758 · Transmitter: FRMFA

DLC 2 1 signals

0x2F6 (FRM — Footwell Module): FZD interior ceiling light aggregate state. B0=FZD_InteriorState: 0x00=all_off, 0x01=courtesy_fade (single lamp, door just closed), 0x44=rear_on, 0x54=front_rear_on, 0x55=all_on_entry (door open / car entry). B1: 0xF5=initial/entry, 0xF0=running. Individual lamp bits unresolved. Source: FZD_Lights_right_to_Left_front_back.log + 5ninutes_Full_Run_Cycle.log HIL capture

00F5

Byte layout

FZD_InteriorState

—

Signal	Position	Format	Scale / Formula	Range	Receivers
FZD_InteriorState 0x00 (0) = all_off 0x01 (1) = courtesy_fade 0x44 (68) = rear_on 0x54 (84) = front_rear_on 0x55 (85) = all_on_entry	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1,Kombi

0x2F7 · Units

Decimal ID: 759 · Transmitter: Kombi

DLC 8 0 signals

0ED979F9????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x2F8 · Time_Date

Decimal ID: 760 · Transmitter: Kombi

DLC 8 6 signals

0x2F8 (Kombi): System date and time

0F20001B3FEA07FD

Byte layout

TimeH

TimeM

TimeS

DateD

DateM

DateY

—

Signal	Position	Format	Scale / Formula	Range	Receivers
TimeH	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 23]`	CIC,CAS
TimeM	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 59]`	CIC,CAS
TimeS	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 59]`	CIC,CAS
DateD	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 31]`	CIC,CAS
DateM Top 4 bits only, lower nibble is always 0xF. eg: Jan=0x1F, May=0x5F, Dec=0xCF	B4[7:4] hi-nibble DBC: 36\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 12]`	CIC,CAS
DateY	B5..B6 (16b LE, 2 bytes) DBC: 40\|16	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 2500]`	CIC,CAS

0x2FA · OccupancySeatBeltContact

Decimal ID: 762 · Transmitter: ACSM

DLC 5 2 signals

0x2FA (ACSM): Seat belt and occupancy status. B0=driver status byte, B1=passenger status byte. CONFIRMED payloads 2026-04-07: FC=unlatched/unoccupied, FD=occupied. B1: 90=passenger unlatched, 91=passenger latched. Full confirmed states: FC 90=all belts unlatched, FD 91=both latched (driver+passenger). B2-B4=0xFF (unused/constant). Event-triggered, ~5s periodic during KL15-on. Source: HIL 2026-03-23 + confirmed 2026-04-07.

FD90FFFFFF

Byte layout

BeltDriver

BeltPassenger

—

Signal	Position	Format	Scale / Formula	Range	Receivers
BeltDriver	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,DME
BeltPassenger	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,DME

0x2FC · TrunkStatus

Decimal ID: 764 · Transmitter: CAS

DLC 8 6 signals

0x2FC (CAS): Lock/latch status — unusual behaviour observed 2026-04-07. Always shows driver door correctly. Passenger front (FR): responds to central lock but not reliably. Rear doors: respond to central lock command but NOT to manual individual door open/close — only update on central lock operation. Behaviour suggests this frame tracks LATCH state (locked/unlocked by CAS) rather than physical door open/close. Physical door open status is in 0x0E2/0x0E6/0x0EA/0x0EE. Byte 0 bitmask (loopybunny): b0=driver, b2=passenger, b4=rear-driver, b6=rear-passenger. Byte 2 bitmask: b0=boot, b2=bonnet. Signal decode unconfirmed — needs dedicated per-door latch test. Source: loopybunny.co.uk/CarPC + HIL observation 2026-04-07.

82000CFFFFFFFF??

Byte layout

DriverDoorOpen, PassengerDoorOpen, RearDriverDoorOpen, RearPassengerDoorOpen

—

BootOpen, BonnetOpen

—

Signal	Position	Format	Scale / Formula	Range	Receivers
DriverDoorOpen 0x00 (0) = closed 0x01 (1) = open	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,Kombi
PassengerDoorOpen 0x00 (0) = closed 0x01 (1) = open	B0 bit2 DBC: 2\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,Kombi
RearDriverDoorOpen 0x00 (0) = closed 0x01 (1) = open	B0 bit4 DBC: 4\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,Kombi
RearPassengerDoorOpen 0x00 (0) = closed 0x01 (1) = open	B0 bit6 DBC: 6\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,Kombi
BootOpen 0x00 (0) = closed 0x01 (1) = open	B2 bit0 DBC: 16\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,Kombi
BonnetOpen 0x00 (0) = closed 0x01 (1) = open	B2 bit2 DBC: 18\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Gate1,Kombi

0x300 · Status_RSE

Decimal ID: 768 · Transmitter: RSE

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x304 · Status_Gang

Decimal ID: 772 · Transmitter: EGS

DLC 8 1 signals

0x304 (EGS): Current drive gear / selector state. B0=GearDisplay. ZF6HP19 6-speed automatic. Selector states (confirmed): 0xE3=Park, 0xC2=Reverse, 0xD1=Neutral, 0xC3=P->R transient (~320ms), 0xE1=R->P transient (1 frame, seen between C1 and E3 during R->Park at 0 km/h). B1=0xFF constant. Drive gear encoding CONFIRMED by speed-correlation HIL 2026-03-28 (mlog1, mlog2 = manual/Sport mode; dlog1 = Drive mode — encoding identical in both): 0xC5=1st (0 km/h creep), 0xC6=2nd (0-36 km/h), 0xC7=3rd (0-66 km/h), 0xC8=4th (10-78 km/h), 0xC9=5th (47-56 km/h), 0xCA=6th (72.9-94.8 km/h, avg 83.7 km/h, CONFIRMED 2026-03-29 idrive-can-capture-20260329-143516.log). 0xC1=1st in sport/stall state (always 0 km/h, appears at stops and parking; may indicate TC stall or manual 1st selection — distinct from C5 but same physical gear). Encoding is the same in automatic Drive mode and manual Sport/M mode — no difference observed. Paddle shifts are non-CAN (EGS-direct hardwired). Standing manual shift test (m1-m6_shift.log 2026-03-29): EGS only permits C5(M1) and C6(M2) from standstill — M3-M6 silently rejected (transmission protection). Source: mlog1/mlog2/dlog1 2026-03-28 + city_run 2026-03-27 + driving/shift logs 2026-03-29 HIL captures.

E3FF????????????

Byte layout

GearDisplay

—

Signal	Position	Format	Scale / Formula	Range	Receivers
GearDisplay 0xC1 (193) = Gear1_Sport 0xC2 (194) = Reverse 0xC3 (195) = PR_Transient 0xC5 (197) = Gear1 0xC6 (198) = Gear2 0xC7 (199) = Gear3 0xC8 (200) = Gear4 0xC9 (201) = Gear5 0xCA (202) = Gear6 0xD1 (209) = Neutral 0xE1 (225) = RP_Transient 0xE3 (227) = Park	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi,CIC

0x305 · Operation_button_convertible_top

Decimal ID: 773 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x306 · Vehicle_tilt

Decimal ID: 774 · Transmitter: FRMFA

DLC 8 0 signals

00F0????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x307 · Operation_button_flap_convertible_top

Decimal ID: 775 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x308 · Status_MSA

Decimal ID: 776 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x310 · AmbientTemperature_RelativeTime

Decimal ID: 784 · Transmitter: Kombi

DLC 8 0 signals

0x310 (Kombi): Ambient temperature and relative time

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x311 · Refill_quantity

Decimal ID: 785 · Transmitter: Kombi

DLC 8 0 signals

00F0????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x312 · Service_Call_Teleservice

Decimal ID: 786 · Transmitter: Kombi

DLC 8 0 signals

F8FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x313 · Status_Service_Call_Teleservice

Decimal ID: 787 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x314 · Status_driving_light

Decimal ID: 788 · Transmitter: FZD

DLC 8 0 signals

1100FF??????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x315 · Vehicle_mode

Decimal ID: 789 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x316 · OperationPushButtonDTC

Decimal ID: 790 · Transmitter: Gate1

DLC 2 2 signals

0x316 (Gate1): DTC push-button. NOTE: single frame FC FF appears only at +74ms in lamp-fault startup logs and is absent in normal startup — may carry an early FRM/body status bit that differs when a lamp fault is present at ignition-on. Source: HIL 2026-05-03 low-beam fault comparison.

FDFF

Byte layout

DTC_pressed, setMe_0x3FFF

setMe_0x3FFF

Signal	Position	Format	Scale / Formula	Range	Receivers
DTC_pressed Traction control off. Message transmitted when pressed. Few presses may be required followed by off.	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	DSC
setMe_0x3FFF All ones	B0..B1 (14b LE, 2 bytes) DBC: 2\|14	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 63]`	DSC

0x317 · Operation_button_parking_aids

Decimal ID: 791 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x318 · Status_antennas_Passive_Access

Decimal ID: 792 · Transmitter: PGS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x319 · Operation_push_button_RDC

Decimal ID: 793 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x31A · Operation_button_HDC

Decimal ID: 794 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x31B · Operation_of_tailgate_interior_button

Decimal ID: 795 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x31C · Status_tire_pressure

Decimal ID: 796 · Transmitter: RDC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x31D · TirePressureStatus

Decimal ID: 797 · Transmitter: DSC

DLC 2 0 signals

0x31D (DSC): Tire pressure status

00FE

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x321 · Operation_button_camera_BF

Decimal ID: 801 · Transmitter: IHKA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x322 · Damper_current

Decimal ID: 802 · Transmitter: EDCK

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x326 · Status_damper_program

Decimal ID: 806 · Transmitter: VDM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x328 · Relativzeit

Decimal ID: 808 · Transmitter: Kombi

DLC 8 0 signals

AFEC10006E25????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x32A · Control_ALC

Decimal ID: 810 · Transmitter: LM

DLC 2 0 signals

????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x32D · Display_HDC

Decimal ID: 813 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x32E · Status_climate_internal_control_info

Decimal ID: 814 · Transmitter: IHKA

DLC 8 3 signals

0x32E (IHKA — Automatic Climate Control): Climate internal control info. B0=LightSensor (dash dimming, 0-16). B3=IRTempSensor (interior cabin IR temp, formula raw*0.1+6=degC): HIL-observed 15.0C at cold start (14C ambient) rising to 16.5C after 10 min, 21.0C with cabin warmed by heater — physically consistent, best available interior temp signal on K-CAN. Formula and byte confirmed from loopybunny source + HIL 2026-03-24 cross-validation. B4=SolarSensor (0-255, raw lux proxy). NOTE: prior CM_ incorrectly cited this as 0x328 — correct hex ID is 0x32E. Source: loopybunny.co.uk/CarPC + HIL 2026-03-24

00FF8FA454644543

Byte layout

LightSensor

—

IRTempSensor

SolarSensor

—

Signal	Position	Format	Scale / Formula	Range	Receivers
LightSensor	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 16]`	CIC
IRTempSensor	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned Unit: degC	raw × 0.1 + 6 = degC Factor `0.1` Offset `6`	`[0 .. 31.5]`	CIC
SolarSensor	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC

0x330 · Range_Mileage

Decimal ID: 816 · Transmitter: Kombi

DLC 8 0 signals

0x330 (Kombi): Range / mileage (odometer)

CD3B0420003B2C12

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x331 · Programming_of_step_cruise_control

Decimal ID: 817 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x332 · Driver_display_speed_range

Decimal ID: 818 · Transmitter: DME

DLC 2 0 signals

????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x335 · ElectricFuelPumpStatus

Decimal ID: 821 · Transmitter: EKP

DLC 8 0 signals

0x335 (EKP): Electric fuel pump status

0048582C3391AA42

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x336 · Display_check_control_message_role

Decimal ID: 822 · Transmitter: Kombi

DLC 8 0 signals

000000FEFFFEFF??

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x337 · StatusFuelControl

Decimal ID: 823 · Transmitter: DME

DLC 2 0 signals

0x337 (DME): Fuel control status

????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x338 · Control_display_check_control_message

Decimal ID: 824 · Transmitter: Kombi

DLC 8 2 signals

0x338 (Kombi): Check Control Message active fault notification. FAULT-ONLY — absent in normal startup, appears only when a lamp fault is detected. ~3 s period. B0: rolling counter (bit 0 toggles: 0x78/0x79). B2: active fault count (0x02=two faults e.g. left+right low beam, decrements to 0x01 as faults are acknowledged). B3=0xF0. B5-B7=0xFE (padding/unused). Timing: first frame at +13s, continues while fault active. Companion to 0x172 (same counter/fault-count structure). Source: HIL 2026-05-03 low-beam fault log.

8D0120F000FEFEFE

Byte layout

CCM_Counter

—

ActiveFaultCount

—

Signal	Position	Format	Scale / Formula	Range	Receivers
CCM_Counter	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	CIC
ActiveFaultCount	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC

0x339 · Status_display_climate

Decimal ID: 825 · Transmitter: CCC

DLC 8 0 signals

CF00????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x33A · Status_Monitor_Front

Decimal ID: 826 · Transmitter: CID

DLC 8 0 signals

108D810248??????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x33C · Status_Monitor_Fond_1

Decimal ID: 828 · Transmitter: CID

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x33E · Status_Monitor_Fond_2

Decimal ID: 830 · Transmitter: CID

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x348 · NavGraph_Alignment_348

Decimal ID: 840 · Transmitter: CCC_GW

DLC 4 0 signals

0x348: Navigation Graph Alignment. Sender: CCC_GW (iDrive CCC Gateway). DLC 4. Source: rusefi.com BMW E65 Tool32 K-CAN table

FEFEFEFE

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x349 · Raw_data_level_tank

Decimal ID: 841 · Transmitter: Gate1

DLC 8 2 signals

0x349 (Gate1): Raw fuel level sensor data (left and right tank floats)

FE017E1600??????

Byte layout

FuelSensorLeft

FuelSensorRight

—

Signal	Position	Format	Scale / Formula	Range	Receivers
FuelSensorLeft	B0..B1 (16b LE, 2 bytes) DBC: 0\|16	Intel (little-endian) Unsigned Unit: L	raw × 0.006249 = L Factor `0.006249` Offset `0`	`[0 .. 62.5]`	Kombi
FuelSensorRight	B2..B3 (16b LE, 2 bytes) DBC: 16\|16	Intel (little-endian) Unsigned Unit: L	raw × 0.006249 = L Factor `0.006249` Offset `0`	`[0 .. 62.5]`	Kombi

0x34A · GPS_34A

Decimal ID: 842 · Transmitter: CCC

DLC 8 2 signals

0x34A (CCC/MK4 nav): GPS Latitude (B0-B3) and Longitude (B4-B7). Both 32-bit signed Intel LE. Scale factor 1/2^23 * (180/pi) = ~8.382e-8 deg/LSB (BMW CCC/MK4 standard radian-based encoding). Confirmed format from CCC/MK4 documentation. Source: confirmed BMW CCC/MK4 format 2026-04-07.

7E96D8151D6D381A

Byte layout

Latitude

Longitude

Signal	Position	Format	Scale / Formula	Range	Receivers
Latitude 32-bit signed raw. Decode: value / 11930464.71 = decimal degrees	B0..B3 (32b LE, 4 bytes) DBC: 0\|32	Intel (little-endian) Signed Unit: deg	raw × 8.38190317e-08 = deg Factor `8.38190317e-08` Offset `0`	`[-90 .. 90]`	CIC,Kombi
Longitude 32-bit signed raw. Decode: value / 11930464.71 - 360 = decimal degrees	B4..B7 (32b LE, 4 bytes) DBC: 32\|32	Intel (little-endian) Signed Unit: deg	raw × 8.38190317e-08 = deg Factor `8.38190317e-08` Offset `0`	`[-180 .. 180]`	CIC,Kombi

0x34B · Status_seat_back_lock_FA

Decimal ID: 843 · Transmitter: SM_FA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x34C · NavGraph_GPS2_34C

Decimal ID: 844 · Transmitter: CCC_GW

DLC 5 0 signals

0x34C: Navigation GPS 2. Sender: CCC_GW. DLC 5. Source: rusefi.com BMW E65 Tool32 K-CAN table

FF000000AD

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x34D · Status_seat_back_lock_BF

Decimal ID: 845 · Transmitter: SM_BF

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x34E · Navi_sys_info

Decimal ID: 846 · Transmitter: CCC

DLC 8 0 signals

6A86040360075254

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x34F · Status_contact_handbrake

Decimal ID: 847 · Transmitter: Gate1

DLC 2 2 signals

0x34F (Gate1): Handbrake lever contact. B0 bit0=Handbrake_pushed_down (1=lever down/released), B0 bit1=Handbrake_pulled_up (1=lever up/engaged). Exactly one bit active at a time. 0xFE=engaged, 0xFD=released. Validated across all HIL sessions: stationary sessions=0xFE, driving sessions=0xFD. Source: 5ninutes_Full_Run_Cycle.log HIL capture

FDFF

Byte layout

Handbrake_pushed_down, Handbrake_pulled_up

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Handbrake_pushed_down 0x00 (0) = lever_up 0x01 (1) = lever_down	B0 bit0 DBC: 0\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	DSC,Kombi
Handbrake_pulled_up 0x00 (0) = lever_down 0x01 (1) = lever_up	B0 bit1 DBC: 1\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	DSC,Kombi

0x35A · Appointment_Condition_Based_Service

Decimal ID: 858 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x35C · Status_onboard_computer

Decimal ID: 860 · Transmitter: Kombi

DLC 8 0 signals

DFF0FFB4????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x35E · Onboard_computer_data_trip_data

Decimal ID: 862 · Transmitter: Kombi

DLC 8 0 signals

0DF0159300F1D8FF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x360 · Data_onboard_computer_start_of_journey

Decimal ID: 864 · Transmitter: Kombi

DLC 8 0 signals

FDFDFFFDDFFDFF??

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x362 · Data_onboard_computer_average_values

Decimal ID: 866 · Transmitter: Kombi

DLC 8 0 signals

93D00998A008E5??

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x364 · Data_onboard_computer_arrival

Decimal ID: 868 · Transmitter: Kombi

DLC 8 0 signals

FDFDFFFDDFFDFF??

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x365 · Status_terminal_request

Decimal ID: 869 · Transmitter: CAS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x366 · Display_Kombination_external_display

Decimal ID: 870 · Transmitter: Kombi

DLC 8 2 signals

0x366 (Kombi): External temperature and remaining fuel range. B0=ExternalTemp unsigned (factor=0.5, offset=-41 degC): formula raw*0.5-41. Validated: raw 0x6B=107 → 12.5C confirmed against dashboard at 12.5C ambient. B1-B2=FuelRange (miles). Source: STATIC-01 validation 2026-03-21

6B7012FC????????

Byte layout

ExternalTemp

RemainingRange

—

Signal	Position	Format	Scale / Formula	Range	Receivers
ExternalTemp	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned Unit: degC	raw × 0.5 − 41 = degC Factor `0.5` Offset `-41`	`[-40 .. 87.5]`	CIC
RemainingRange	B1..B2 (16b LE, 2 bytes) DBC: 8\|16	Intel (little-endian) Unsigned Unit: km	raw × 0.100584 = km Factor `0.100584` Offset `0`	`[0 .. 6596]`	CIC

0x367 · Control_display_of_demand_oriented_service

Decimal ID: 871 · Transmitter: Kombi

DLC 8 0 signals

170300801BF8D0??

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x36D · Setting_the_driving_dynamics_switch

Decimal ID: 877 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x374 · WheelToleranceAdjustment

Decimal ID: 884 · Transmitter: DSC

DLC 5 0 signals

0x374 (DSC): Wheel tolerance adjustment

??????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x376 · Status_wear_lamella

Decimal ID: 886 · Transmitter: VGSG

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x37D · Status_DKG

Decimal ID: 893 · Transmitter: DKG

DLC 2 0 signals

????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x37E · Temperatur_Bremse

Decimal ID: 894 · Transmitter: DSC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x37F · Range_of_diesel_exhaust_gas_additive

Decimal ID: 895 · Transmitter: DDE1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x380 · chassis_number

Decimal ID: 896 · Transmitter: CAS

DLC 8 7 signals

0x380 (CAS): Chassis / VIN number — bytes 0-6 are ASCII characters of VIN digits. Source: loopybunny.co.uk/CarPC

45373235343237??

Byte layout

VIN_Byte0

VIN_Byte1

VIN_Byte2

VIN_Byte3

VIN_Byte4

VIN_Byte5

VIN_Byte6

—

Signal	Position	Format	Scale / Formula	Range	Receivers
VIN_Byte0	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,CIC,Kombi
VIN_Byte1	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,CIC,Kombi
VIN_Byte2	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,CIC,Kombi
VIN_Byte3	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,CIC,Kombi
VIN_Byte4	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,CIC,Kombi
VIN_Byte5	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,CIC,Kombi
VIN_Byte6	B6 (full byte) DBC: 48\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME,EGS,CIC,Kombi

0x381 · EngineOilLevel

Decimal ID: 897 · Transmitter: DME

DLC 2 2 signals

0x381 (DDE/DME→CIC/Kombi): Engine oil level response. Byte0=measurement state (sent on CIC request), Byte1=general status. Source: Raiso77. Not observed in HIL logs — message only transmitted when CIC requests oil level check.

????

Byte layout

OilLevel_MeasState

OilLevel_Status

Signal	Position	Format	Scale / Formula	Range	Receivers
OilLevel_MeasState Oil level measurement state / value code (Byte0). Response to CIC oil-level request. 0x12 (18) = Level below MIN 0x25 (37) = Level at MIN 0x38 (56) = Level between MIN and OK 0x53 (83) = Level OK 0x69 (105) = Level between OK and MAX 0x85 (133) = Level at MAX 0x95 (149) = Overcrowded / overfilled 0x78 (120) = No measurement possible 0x79 (121) = Measurement in progress 0x7A (122) = Oil level check OK 0x7B (123) = Measurement OK 0x7C (124) = Ignition OFF, no measurement possible 0x7D (125) = Oil level OK, precise measurement in progress 0x7E (126) = Oil level OK 0x7F (127) = Measurement in progress (alt) 0x80 (128) = Accurate measurement in progress (~1 min) 0xFF (255) = Signal invalid	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi
OilLevel_Status Oil level general status (Byte1). 0xF0 (240) = All OK 0xF1 (241) = Overfilled 0xF2 (242) = Refill 1.0 L 0xF4 (244) = Service required 0xFF (255) = Signal invalid	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	CIC,Kombi

0x382 · Electronic_engine_oil_dipstick_M

Decimal ID: 898 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x383 · Motor_data_2

Decimal ID: 899 · Transmitter: DME

DLC 4 0 signals

????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x388 · Vehicle_type

Decimal ID: 904 · Transmitter: CAS

DLC 8 0 signals

08016416E20114??

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x38B · Status_battery

Decimal ID: 907 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x38E · Start_speed

Decimal ID: 910 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x392 · Status_System_AFS

Decimal ID: 914 · Transmitter: AFS

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x394 · RDA_request_data_storage

Decimal ID: 916 · Transmitter: Kombi

DLC 8 0 signals

4400FFFFFFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x395 · Coding_power_management

Decimal ID: 917 · Transmitter: CAS

DLC 8 0 signals

03085064FF??????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x398 · Operation_chassis

Decimal ID: 920 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x399 · Status_MDrive

Decimal ID: 921 · Transmitter: DME

DLC 6 0 signals

????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x39E · Operation_time_date

Decimal ID: 926 · Transmitter: CCC

DLC 8 0 signals

0B10000D1FDF07F2

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3A0 · Vehicle_state

Decimal ID: 928 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3A3 · Request_Remote_Services

Decimal ID: 931 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3A9 · Status_motor_control_CKM

Decimal ID: 937 · Transmitter: DME

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3AB · Status_Shiftlights_CKM

Decimal ID: 939 · Transmitter: Kombi

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3AC · RunOnTimeTerminal30

Decimal ID: 940 · Transmitter: Gate1

DLC 2 0 signals

0x3AC (Gate1): Terminal 30 run-on time

FECF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3B0 · Status_gear_reverse

Decimal ID: 944 · Transmitter: FRMFA

DLC 8 1 signals

0x3B0 (FRM — Footwell Module): Reverse gear status. Byte 1: 0xFD=not in reverse, 0xFE=in reverse. Source: loopybunny.co.uk/CarPC

FDFF????????????

Byte layout

—

ReverseGear_3B0

—

Signal	Position	Format	Scale / Formula	Range	Receivers
ReverseGear_3B0 Byte 1: 0xFD=not in reverse, 0xFE=in reverse 0xFD (253) = not_in_reverse 0xFE (254) = in_reverse	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	PDC,CIC

0x3B1 · TransmissionData3

Decimal ID: 945 · Transmitter: DKG

DLC 6 2 signals

0x3B1 (DKG): Transmission data 3

????????????

Byte layout

Checksum_0x3b1

Counter_0x3b1

—

Signal	Position	Format	Scale / Formula	Range	Receivers
Checksum_0x3b1	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 19]`	DME,Kombi,DSC
Counter_0x3b1	B1[3:0] lo-nibble DBC: 8\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 14]`	DME,Kombi,DSC

0x3B3 · PowerManagmentConsumptionControl

Decimal ID: 947 · Transmitter: DME

DLC 6 0 signals

0x3B3 (DME): Power management consumption control

11C800000000

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3B4 · PowerBatteryVoltage

Decimal ID: 948 · Transmitter: DME

DLC 8 1 signals

0x3B4 (DME): Power battery voltage

CBF300FCFFFFFFFF

Byte layout

BatteryVoltage

—

Signal	Position	Format	Scale / Formula	Range	Receivers
BatteryVoltage	B0..B1 (12b LE, 2 bytes) DBC: 0\|12	Intel (little-endian) Unsigned Unit: V	raw × 0.015 = V Factor `0.015` Offset `0`	`[0 .. 65535]`	Kombi,CIC

0x3B5 · Status_water_valve

Decimal ID: 949 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3B6 · Position_window_lifter_FAT

Decimal ID: 950 · Transmitter: FRMFA

DLC 8 3 signals

0x3B6 (FRM — Footwell Module): FL (driver front) Window position feedback. WindowPosition(B0): 0=closed to 87=fully open. WindowMovement(B1): 0xFC=closed, 0xFD=moving, 0xFE=open. WindowMotionFlags(B2): motion state bits. HIL-validated from Windows_cycle.log

00FDE0??????????

Byte layout

WindowPosition

WindowMovement

WindowMotionFlags

—

Signal	Position	Format	Scale / Formula	Range	Receivers
WindowPosition	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 87]`	Kombi
WindowMovement 0xFC (252) = closed 0xFD (253) = moving 0xFE (254) = open	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi
WindowMotionFlags	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi

0x3B7 · Position_window_lifter_FATH

Decimal ID: 951 · Transmitter: Gate1

DLC 8 3 signals

0x3B7 (Gate1): RL (driver rear) Window position feedback. WindowPosition(B0): 0=closed to 87=fully open. WindowMovement(B1): 0xFC=closed, 0xFD=moving, 0xFE=open. WindowMotionFlags(B2): motion state bits. HIL-validated from Windows_cycle.log (limited data captured)

00F0F8??????????

Byte layout

WindowPosition

WindowMovement

WindowMotionFlags

—

Signal	Position	Format	Scale / Formula	Range	Receivers
WindowPosition	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 87]`	Kombi
WindowMovement 0xFC (252) = closed 0xFD (253) = moving 0xFE (254) = open	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi
WindowMotionFlags	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Kombi

0x3B8 · Position_window_regulator_BFT

Decimal ID: 952 · Transmitter: FRMFA

DLC 8 3 signals

0x3B8 (FRM — Footwell Module): FR (passenger front) Window position feedback. WindowPosition(B0): 0=closed to 87=fully open. WindowMovement(B1): 0xFC=closed, 0xFD=moving, 0xFE=open. WindowMotionFlags(B2): motion state bits. HIL-validated from Windows_cycle.log

00FCE0??????????

Byte layout

WindowPosition

WindowMovement

WindowMotionFlags

—

Signal	Position	Format	Scale / Formula	Range	Receivers
WindowPosition	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 87]`	Gate1
WindowMovement 0xFC (252) = closed 0xFD (253) = moving 0xFE (254) = open	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1
WindowMotionFlags	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1

0x3B9 · Position_window_regulator_BFTH

Decimal ID: 953 · Transmitter: Gate1

DLC 8 3 signals

0x3B9 (Gate1): RR (passenger rear) Window position feedback. WindowPosition(B0): 0=closed to 87=fully open. WindowMovement(B1): 0xFC=closed, 0xFD=moving, 0xFE=open. WindowMotionFlags(B2): motion state bits. HIL-validated from Windows_cycle.log (no data on this HIL setup)

00F0F8??????????

Byte layout

WindowPosition

WindowMovement

WindowMotionFlags

—

Signal	Position	Format	Scale / Formula	Range	Receivers
WindowPosition	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 87]`	Gate1
WindowMovement 0xFC (252) = closed 0xFD (253) = moving 0xFE (254) = open	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1
WindowMotionFlags	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Gate1

0x3BA · Position_SHD

Decimal ID: 954 · Transmitter: FZD

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3BC · Position_window_lifter_security_vehicle

Decimal ID: 956 · Transmitter: XXX

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3BD · Status_consumer_shutdown

Decimal ID: 957 · Transmitter: FRMFA

DLC 8 0 signals

FDFF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3BE · PowerRunningTime

Decimal ID: 958 · Transmitter: CAS

DLC 2 0 signals

0x3BE (CAS): Power running time

FEFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3BF · Position_window_rear_window

Decimal ID: 959 · Transmitter: CTM

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3C0 · Configuration_FAS

Decimal ID: 960 · Transmitter: SM_FA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3C1 · Configuration_BFS

Decimal ID: 961 · Transmitter: SM_BF

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3C4 · Status_EDCK_CKM

Decimal ID: 964 · Transmitter: Gate1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3C7 · Access_radio

Decimal ID: 967 · Transmitter: RAD1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3C8 · Operation_push_button_radio

Decimal ID: 968 · Transmitter: RAD1

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3CC · NavGraph_3CC

Decimal ID: 972 · Transmitter: CCC_GW

DLC 7 0 signals

0x3CC (CCC_GW): NavGraph group dormant message. DLC 7. B0: rolling counter shared with 0x278/0x3F7 (7-bit, 0x0A-0x7E). B1=0xF6, B2-B4=0xFE fixed (data not available). B5: varies 0x00-0xFF (purpose unknown). B6: 3 states (0xF0, 0xF7, 0xFF — likely status flags). Consistently present in all driving sessions. Source: HIL 2026-03-29

0AF6FEFEFEFFF7

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3CE · Radio_audio_control_interface_display

Decimal ID: 974 · Transmitter: ACI

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3CF · Acknowledgment_access_radio_audio_control_interface

Decimal ID: 975 · Transmitter: ACI

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3D3 · Status_solar_sensor

Decimal ID: 979 · Transmitter: FZD

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3D4 · Configuration_of_central_locking_CKM

Decimal ID: 980 · Transmitter: Kombi

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3D5 · Status_central_locking_CKM

Decimal ID: 981 · Transmitter: CAS

DLC 8 0 signals

69FF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3D6 · Configuration_DWA_CKM

Decimal ID: 982 · Transmitter: Kombi

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3D7 · Status_DWA_CKM

Decimal ID: 983 · Transmitter: FZD

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3D8 · Configuration_RLS_CKM

Decimal ID: 984 · Transmitter: Kombi

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3D9 · Status_RLS_CKM

Decimal ID: 985 · Transmitter: FZD

DLC 8 0 signals

FAFF????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3DA · Configuration_of_memory_positions_CKM

Decimal ID: 986 · Transmitter: Kombi

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3DB · Status_memory_positions_CKM

Decimal ID: 987 · Transmitter: SM_FA

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3DC · Configuration_light_CKM

Decimal ID: 988 · Transmitter: Kombi

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3DD · Status_light_CKM

Decimal ID: 989 · Transmitter: FRMFA

DLC 8 0 signals

AA32FE??????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3DE · Configuration_Climate_CKM

Decimal ID: 990 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3DF · Status_Klima_CKM

Decimal ID: 991 · Transmitter: IHKA

DLC 8 0 signals

AFFFFF??????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3E2 · Configuration_of_tailgate_CKM

Decimal ID: 994 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3E3 · Status_tailgate_CKM

Decimal ID: 995 · Transmitter: HKL

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3E4 · Configuration_rear_view_camera_CKM

Decimal ID: 996 · Transmitter: CCC

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3EF · EngineOBD_data

Decimal ID: 1007 · Transmitter: DME

DLC 3 0 signals

0x3EF (DME): Engine OBD data

??????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3F1 · LightExtStatus_CKM_3F1

Decimal ID: 1009 · Transmitter: LM

DLC 1 0 signals

0x3F1: Extended Lighting Personalisation Status (CKM — Comfort Coding Module data). Sender: LM/FRM (Light Module / Footwell Module, node 0x70). Paired with 0x3F0 (Extended Lighting Personalisation Configuration from CCC_GW). Appears once at startup — FRM broadcasts current extended-lighting personalisation state. Source: MorGuux BMW E90 K-CAN gist (entry: 1009,0x3F1,Status Light Extended CKM [1],112,0x70,LM)

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x3F7 · NavGraph_3F7

Decimal ID: 1015 · Transmitter: CCC_GW

DLC 8 0 signals

0x3F7 (CCC_GW): NavGraph group dormant message. DLC 8. B0: rolling counter shared with 0x278/0x3CC. B1: 3 states (0xE2, 0xE6, 0xEE). B3: 2 states (0x7F, 0xFF). B4: 2 states (0x15, 0xFF). Most bytes fixed 0xFF/0xFE. Mostly inactive — likely GPS or nav sub-message dormant when no active navigation. Source: HIL 2026-03-29

0DEEFFFFFFFEFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x413 · FRM_LampStatus_413

Decimal ID: 1043 · Transmitter: FRM

DLC 8 0 signals

0x413 (FRM — Footwell Module): Lamp status broadcast, ~1 s period. Normal startup: valid from +326ms, stable 49 8E 97 86 62 77 E9 87 throughout ignition-on cycle. Fault startup: FF FF FF FF FF FF FF FF from +5.5s (lamp check incomplete / bulb missing), resolves to normal value only after ~25s once FRM completes fault detection. FF FF pattern is a reliable indicator that FRM has not yet confirmed lamp integrity. Byte layout not yet decoded at bit level. Source: HIL 2026-03-20 (driving), HIL 2026-05-03 (low-beam fault comparison).

498E97860177E987

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x415 · FRM_LampStatus_415

Decimal ID: 1045 · Transmitter: FRM

DLC 7 1 signals

0x415 (FRM — Footwell Module): Lamp status broadcast companion to 0x413, ~1 s period, DLC=7. Normal startup: B0=0x41 for first 2 frames (init step), then locks to 0x42 E7 81 32 F0 00 80 (B0 bits[1:0] increment once at startup, not a rolling counter). Fault startup: FF FF FF FF FF FF FF from +5.5s, resolves at +25s same as 0x413. B0 InitCounter (bits [1:0]): 0x01=initialising, 0x02=ready. Source: HIL 2026-03-20 (driving), HIL 2026-05-03 (low-beam fault comparison).

47E780B6F10080

Byte layout

InitCounter

—

Signal	Position	Format	Scale / Formula	Range	Receivers
InitCounter	B0[1:0] DBC: 0\|2	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	Kombi,CIC

0x480 · NetworkMgmt_KGM_480

Decimal ID: 1152 · Transmitter: KGM

DLC 0 0 signals

Signal	Position	Format	Scale / Formula	Range	Receivers

0x481 · NetworkMgmt_ACSM_481

Decimal ID: 1153 · Transmitter: ACSM

DLC 0 0 signals

0x481: BMW K-CAN Network Management alive frame — ACSM (Airbag Control Module, node 0x01). Source: MorGuux E90 K-CAN gist

Signal	Position	Format	Scale / Formula	Range	Receivers

0x492 · NetworkMgmt_DME_492

Decimal ID: 1170 · Transmitter: DME1

DLC 0 0 signals

Signal	Position	Format	Scale / Formula	Range	Receivers

0x497 · NetworkMgmt_EKP_497

Decimal ID: 1175 · Transmitter: EKP

DLC 0 0 signals

Signal	Position	Format	Scale / Formula	Range	Receivers

0x498 · NetworkMgmt_EGS_498

Decimal ID: 1176 · Transmitter: EGS_MECH

DLC 0 0 signals

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4A9 · NetworkMgmt_DSC_4A9

Decimal ID: 1193 · Transmitter: DXC_RB

DLC 0 0 signals

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4C0 · NetworkMgmt_CAS_4C0

Decimal ID: 1216 · Transmitter: CAS

DLC 0 0 signals

0x4C0 (XXX): BMW K-CAN Network Management alive message (52 frames); seen in t1.log

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4D6 · NetworkManagment_4D6

Decimal ID: 1238 · Transmitter: XXX

DLC 8 0 signals

0x4D6 (XXX): BMW K-CAN Network Management alive message (53 frames); seen in t1.log

6042FF01FFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4DE · NetworkMgmt_GWS_4DE

Decimal ID: 1246 · Transmitter: GWS

DLC 0 1 signals

Signal	Position	Format	Scale / Formula	Range	Receivers
IgnOff	B1+ (1b BE) DBC: 12\|1	Motorola (big-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 3]`	Diagnosetool_K_CAN_System

0x4E0 · NetworkMgmt_Kombi_4E0

Decimal ID: 1248 · Transmitter: Kombi

DLC 0 0 signals

0x4E0: BMW K-CAN Network Management alive frame — Kombi (instrument cluster, node 0x60). Source: MorGuux E90 K-CAN gist

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4E2 · NetworkMgmt_CCC_4E2

Decimal ID: 1250 · Transmitter: CCC_GW

DLC 0 0 signals

0x4E2: BMW K-CAN Network Management alive frame — CCC_GW/M_ASK (iDrive CCC gateway, node 0x62). Source: MorGuux E90 K-CAN gist

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4E7 · NetworkMgmt_ZBE_4E7

Decimal ID: 1255 · Transmitter: ZBE

DLC 0 0 signals

0x4E7 (XXX): BMW K-CAN Network Management alive message (55 frames); seen in t1.log

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4F2 · NetworkMgmt_KBM_4F2

Decimal ID: 1266 · Transmitter: KBM

DLC 0 0 signals

0x4F2 (XXX): BMW K-CAN Network Management alive message (56 frames); seen in t1.log

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4F3 · NetworkMgmt_CID_4F3

Decimal ID: 1267 · Transmitter: CID_C

DLC 0 0 signals

0x4F3 (XXX): BMW K-CAN Network Management alive message (56 frames); seen in t1.log

Signal	Position	Format	Scale / Formula	Range	Receivers

0x4F8 · NetworkMgmt_IHKA_4F8

Decimal ID: 1272 · Transmitter: IHKA

DLC 0 0 signals

0x4F8 (XXX): BMW K-CAN Network Management alive message (51 frames); seen in t1.log

Signal	Position	Format	Scale / Formula	Range	Receivers

0x580 · Services_KGM_580

Decimal ID: 1408 · Transmitter: KGM

DLC 8 0 signals

6E050000FFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x581 · Services_ACSM_581

Decimal ID: 1409 · Transmitter: ACSM

DLC 8 1 signals

0x581: BMW K-CAN Services frame — ACSM (Airbag Control Module, node 0x01). Also carries seatbelt indicator: byte 3 bit 0 = 0x28=light off, 0x29=light on. Source: loopybunny.co.uk/CarPC, MorGuux E90 K-CAN gist

404D0029FFFFFFFF

Byte layout

—

SeatbeltLightOn

—

Signal	Position	Format	Scale / Formula	Range	Receivers
SeatbeltLightOn 0x00 (0) = Off 0x01 (1) = On	B3 bit0 DBC: 24\|1	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 1]`	Diagnosetool_K_CAN_System

0x592 · Services_DME_592

Decimal ID: 1426 · Transmitter: DME1

DLC 8 0 signals

800100101BF818FF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x598 · Services_EGS_598

Decimal ID: 1432 · Transmitter: EGS_MECH

DLC 8 0 signals

40FA0014FFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x5A9 · Services_DSC_5A9

Decimal ID: 1449 · Transmitter: DXC_RB

DLC 8 0 signals

3002003000F100FF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x5C0 · Services_CAS_5C0

Decimal ID: 1472 · Transmitter: CAS

DLC 8 0 signals

0x5C0: BMW K-CAN Services frame — CAS (Car Access System, node 0x40). Source: MorGuux E90 K-CAN gist

040032FFFFFFF0FF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x5D6 · Services_5D6

Decimal ID: 1494 · Transmitter: XXX

DLC 8 0 signals

0x5D6 (XXX): BMW K-CAN Services range message, rare (2 frames); seen in t1.log

6E010000FFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x5E0 · Services_Kombi_5E0

Decimal ID: 1504 · Transmitter: Kombi

DLC 8 0 signals

11FFFF02FFFFFCFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x5E2 · ZBE_Button_5E2

Decimal ID: 1506 · Transmitter: ZBE

DLC 8 0 signals

0x5E2 (ZBE — iDrive controller): Dual-role frame. (1) BUTTON EVENT (normal operation): B0=0x01, B1=0x03=pressed/0x02=released, B2=variable, B3-B7=0xFF. Event-driven on state change, two frames 10ms apart per press (debounce). Most likely MENU/NAV/TEL hard button. (2) FAULT NOTIFICATION (lamp fault only): B0=0x01, B1 alternates 0x02/0x03 (channel), B2=varying message code (CIC text message ID), B3-B7=0xFF. Appears at +9.7s in fault startup — 2 rapid frames (10ms) for left and right low beam separately, then further frames at ~500ms intervals as CIC renders messages. Absent in normal startup. The B1=0x02/0x03 alternation in fault context likely encodes different CIC display channels rather than button state. Source: HIL-3 2026-03-24 (button), HIL 2026-05-03 (low-beam fault).

010367FFFFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x5E7 · Services_ZBE_5E7

Decimal ID: 1511 · Transmitter: ZBE

DLC 8 0 signals

0x5E7 (ZBE — iDrive controller): ZBE operational state heartbeat, 2-second period. B0=0x99, B1=0xE1, B2=0xFE constant. B3 = rolling counter (increments +1 per 2s transmission). B4 = CIC/menu state flag: 0x06=home/idle screen (no active menu interaction), 0x01=CIC menu active (changed from 0x06 to 0x01 at t=2366232ms, ~4s after MENU hard button press). B5-B7=0xFF constant. HIL-3 2026-03-24: B4 remained 0x01 for the rest of the log after menu was entered (never returned to 0x06 within 9.8 min log). Source: HIL-3 2026-03-24 (10minutes_run_Wheel_doors_tests.log)

99E1FE0801FFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x5F2 · Services_KBM_5F2

Decimal ID: 1522 · Transmitter: KBM

DLC 8 0 signals

6E190001FFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x5F8 · Services_IHKA_5F8

Decimal ID: 1528 · Transmitter: IHKA

DLC 8 0 signals

0x5F8 (XXX): BMW K-CAN Services range message (11 frames); seen in t1.log

6E0A0000FFFFFFFF

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x608 · PTCAN_RESP_608_DME

Decimal ID: 1544 · Transmitter: DME

DLC 8 4 signals

0x608 [PT-CAN via ZGW — NOT direct K-CAN] DME UDS diagnostic response. PT-CAN 500 kbit/s. Physical request ID = 0x600, response = 0x608. Reachable from K-CAN tester (0x6F1) only via ZGW gateway bridge — ZGW forwards the request to PT-CAN and relays response back. Direct PT-CAN access requires dedicated MCP2515 at 500 kbit/s. Standard OBD2 Mode 01 PIDs answered on 0x7E8 via functional address 0x7DF. Source: BMW ISTA, obd2-diagnostic-architecture.md

????????????????

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Diagnosetool_PT_CAN
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Diagnosetool_PT_CAN
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Diagnosetool_PT_CAN
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	Diagnosetool_PT_CAN

0x60C · PTCAN_RESP_60C_EGS

Decimal ID: 1548 · Transmitter: EGS

DLC 8 4 signals

0x60C [PT-CAN via ZGW — NOT direct K-CAN] EGS (ZF 6HP19 TCM) UDS diagnostic response. PT-CAN 500 kbit/s. Physical request ID = 0x604, response = 0x60C. Reachable from K-CAN only via ZGW. Holds gearbox adaptation data, clutch friction values, ATF temperature calibration. SecurityAccess (0x27) required for adaptation reset. OBD2 ATF temp PID 0x6C answered on 0x7E9. Source: obd2-diagnostic-architecture.md

????????????????

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Diagnosetool_PT_CAN
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Diagnosetool_PT_CAN
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Diagnosetool_PT_CAN
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	Diagnosetool_PT_CAN

0x612 · DIAG_RESP_612

Decimal ID: 1554 · Transmitter: DME

DLC 8 4 signals

0x612 (DME → DIA): UDS diagnostic response from DME/ECM (Digital Motor Electronics, N47D20O1 engine ECU) on K-CAN. Physical addressing: request sent to 0x6F1 (DIA tester), response from 0x612. ISO-TP transport: PCI byte in B0 (high nibble = frame type: 0=SF, 1=FF, 2=CF, 3=FC; low nibble = DL for SF or length-high for FF). UDS positive response = request service ID + 0x40 (e.g., 0x50 for 0x10 session control, 0x62 for 0x22 ReadDID). Negative response: service ID = 0x7F, B1 = requested service, B2 = NRC. Also used by DSC (0x612) on K-CAN — context depends on diagnostic session. Source: ISO 14229-1 UDS, BMW ISTA diagnostic trace, architecture doc obd2-diagnostic-architecture.md

E1FDFA00801E????

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI 0x00 (0) = SingleFrame 0x01 (1) = FirstFrame 0x02 (2) = ConsecutiveFrame 0x03 (3) = FlowControl_CTS 0x04 (4) = FlowControl_Wait 0x05 (5) = FlowControl_Overflow	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x61A · PTCAN_RESP_61A_DSC

Decimal ID: 1562 · Transmitter: DSC

DLC 8 4 signals

0x61A [PT-CAN via ZGW — NOT direct K-CAN] DSC (ABS/Dynamic Stability Control, ATE MK60E5) UDS diagnostic response. PT-CAN 500 kbit/s. Physical request ID = 0x612, response = 0x61A. Reachable from K-CAN only via ZGW. Holds wheel speed sensor calibration, yaw sensor offset, ABS valve test routines (RoutineControl 0x31), bleeding routine. Source: obd2-diagnostic-architecture.md

????????????????

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Diagnosetool_PT_CAN
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Diagnosetool_PT_CAN
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Diagnosetool_PT_CAN
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	Diagnosetool_PT_CAN

0x629 · Unknown_629

Decimal ID: 1577 · Transmitter: XXX

DLC 8 0 signals

????????????????

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x63C · DIAG_RESP_63C_IHKA

Decimal ID: 1596 · Transmitter: IHKA

DLC 8 4 signals

0x63C (IHKA → DIA): UDS diagnostic response from IHKA (Integrated Heating/Klimaanlage — automatic climate control) on K-CAN. Physical IHKA request ID = 0x63C, response (legacy) or 0x644 (alternate — confirm). IHKA controls AC compressor relay, evaporator blower, all temperature zone actuators. Source: obd2-diagnostic-architecture.md

????????????????

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x640 · DIAG_RESP_640_CAS

Decimal ID: 1600 · Transmitter: CAS

DLC 8 4 signals

0x640 (CAS → DIA): UDS diagnostic response from CAS (Car Access System / Carstarter) on K-CAN. Node 0x40 CONFIRMED from Carista HIL capture (31 response frames on 0x640). Tester request: 0x6F1 → target byte 0x40. CAS holds immobiliser data, comfort access, key learning. Programming session (0x10 0x03) required for key coding — use with extreme caution. NOTE: previous agent brief incorrectly placed CAS at 0x650 (node 0x50 = unknown, possibly CCC_GW/M-ASK area, NOT CAS).

F0300002FFFFFFFF

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x656 · DIAG_RESP_656_JBBF

Decimal ID: 1622 · Transmitter: Gate1

DLC 8 4 signals

0x656 (JBBF → DIA): UDS diagnostic response from JBBF/JBE (Junction Box Body Front / Junctions Box Elektronik) on K-CAN. Node 0x56 CONFIRMED from Carista HIL capture (11 response frames on 0x656, DID 0x3000 responded, 0x2E write session active). JBBF acts as K-CAN/PT-CAN gateway (ZGW function) on E90. Controls: central locking relay logic, window rear pair, heated seats, horn, footwell lighting. NCS Expert module name: JBBFE/JBBFR3. EDIABAS driver: jbbf3.prg. Node identity confirmed by user 2026-04-08. Extended session required for coding.

F0037F1878000000

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x658 · DIAG_RESP_658_LM

Decimal ID: 1624 · Transmitter: AFS

DLC 8 4 signals

0x658 (LM → DIA): UDS diagnostic response from LM (Light Module — E8x adaptive light unit, Lichtmodul) on K-CAN. Physical LM request ID = 0x654, response = 0x658. Controls bi-xenon swivel actuators, cornering light logic. Coding allows enabling/disabling adaptive light, DRL configuration. Source: obd2-diagnostic-architecture.md

????????????????

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x660 · DIAG_RESP_660

Decimal ID: 1632 · Transmitter: Kombi

DLC 8 4 signals

0x660 (Kombi → DIA): UDS diagnostic response from Kombi (instrument cluster). Physical addressing: tester sends to 0x6F9 (Kombi request ID), Kombi responds on 0x660. ISO-TP single-frame (SF) typical for standard DID reads (VIN, SW version). Extended session required for coding access (0x10 0x02). TesterPresent (0x3E 0x00) must be sent every 2s to maintain extended session. Source: BMW ISTA, obd2-diagnostic-architecture.md

F021000000000000

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI 0x00 (0) = SingleFrame 0x01 (1) = FirstFrame 0x02 (2) = ConsecutiveFrame 0x03 (3) = FlowControl_CTS 0x04 (4) = FlowControl_Wait 0x05 (5) = FlowControl_Overflow	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x668 · DIAG_RESP_668_SZL

Decimal ID: 1640 · Transmitter: SZL

DLC 8 4 signals

0x668 (SZL → DIA): UDS diagnostic response from SZL (Steering Column Switch Centre / Schaltzentrum Lenkrad) on K-CAN. Physical SZL request ID = 0x660, response = 0x668. Also contains LWS (Lenkwinkelsensor — steering angle sensor). SZL coding covers MFL button assignment and cruise control stalk function. Steering angle sensor initialisation accessible via RoutineControl. Source: obd2-diagnostic-architecture.md

????????????????

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x672 · DIAG_RESP_672_FRM3

Decimal ID: 1650 · Transmitter: FRM

DLC 8 4 signals

0x672 (FRM3 → DIA): UDS diagnostic response from FRM3 (Footwell Module / Fussraummodul, revision C32) on K-CAN. CONFIRMED from Carista HIL capture: tester sends on 0x6F1 with B0=0x72 (FRM node address), FRM3 responds on CAN ID 0x672 with B0=0xF1. Address formula: response_ID = 0x600 | node_byte = 0x600 | 0x72 = 0x672. Physical request address: 0x6F1 with target byte 0x72 in B0. No security access required for DID 0x3400 (coding block) in default session. FRM controls: window lifters (all 4), exterior mirrors, footwell lighting, welcome light, rain/light sensor input, interior light relay. Key DIDs: 0x3400=lamp monitoring coding block (16 bytes), 0xF190=VIN, 0xF187=spare part number, 0xF189=SW version. Source: Carista HIL capture 2026-04-08, frm3_lamp_check_disable.md

F1210000FFFFFFFF

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x68C · DIAG_RESP_68C_PDC

Decimal ID: 1676 · Transmitter: PDC

DLC 8 4 signals

0x68C (PDC → DIA): UDS diagnostic response from PDC (Park Distance Control) on K-CAN. Physical PDC request ID = 0x68C, response = 0x694. Hmm — confirm exact address pair from trace. PDC holds sensor distance calibration. Activation/deactivation of PDC feature via coding. Source: obd2-diagnostic-architecture.md. NOTE: request ID 0x68C confirmed in module registry; response ID 0x694 = decimal 1684 — add BO_ 1684 DIAG_RESP_694_PDC if trace confirms.

????????????????

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	DIA,Diagnosetool_K_CAN_System
UDS_ServiceId	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA,Diagnosetool_K_CAN_System
UDS_Payload	B2..B7 (48b LE, 6 bytes) DBC: 16\|48	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	DIA,Diagnosetool_K_CAN_System

0x6F1 · DIAG_REQ_6F1

Decimal ID: 1777 · Transmitter: DIA

DLC 8 5 signals

0x6F1 (DIA → module): UDS diagnostic request from tester (our Pico 2W IDRIVE_NEW firmware acting as diagnostic tool). This is the ISO 15765-2 / ISO 14229 tester address on BMW K-CAN. All module requests are sent from this address. For functional/broadcast addressing (default session open on all modules simultaneously), BMW uses 0x6F1 with functional target. For physical addressing, tester sends to module-specific request ID (e.g., 0x640 for FRM) but own source address remains 0x6F1. Frame format: B0 PCI, B1 UDS service ID [B2 sub-function or DID-hi, B3 DID-lo, B4-B7 data]. Source: BMW E9x diagnostic trace, ISO 14229-1

72300002FFFFFFFF

Byte layout

ISOTP_PCI, ISOTP_DL

UDS_ServiceId

UDS_SubFunction

UDS_Payload

Signal	Position	Format	Scale / Formula	Range	Receivers
ISOTP_PCI 0x00 (0) = SingleFrame 0x01 (1) = FirstFrame 0x02 (2) = ConsecutiveFrame 0x03 (3) = FlowControl_CTS 0x04 (4) = FlowControl_Wait 0x05 (5) = FlowControl_Overflow	B0[7:4] hi-nibble DBC: 4\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Vector__XXX
ISOTP_DL	B0[3:0] lo-nibble DBC: 0\|4	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 15]`	Vector__XXX
UDS_ServiceId 0x10 (16) = DiagnosticSessionControl_0x10 0x11 (17) = ECUReset_0x11 0x14 (20) = ClearDTC_0x14 0x19 (25) = ReadDTCInfo_0x19 0x22 (34) = ReadDataByIdentifier_0x22 0x23 (35) = ReadMemByAddress_0x23 0x27 (39) = SecurityAccess_0x27 0x28 (40) = CommunicationControl_0x28 0x2E (46) = WriteDataByIdentifier_0x2E 0x31 (49) = RoutineControl_0x31 0x34 (52) = RequestDownload_0x34 0x36 (54) = TransferData_0x36 0x37 (55) = RequestTransferExit_0x37 0x3E (62) = TesterPresent_0x3E 0x7F (127) = NegativeResponse_0x7F 0x85 (133) = ControlDTCSetting_0x85	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
UDS_SubFunction 0x01 (1) = DefaultSession 0x02 (2) = ExtendedDiagnosticSession 0x03 (3) = ProgrammingSession	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
UDS_Payload	B3..B7 (40b LE, 5 bytes) DBC: 24\|40	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 0]`	Vector__XXX

0x7C3 · Keyfob_7C3

Decimal ID: 1987 · Transmitter: XXX

DLC 8 0 signals

0x7C3: CAS Application Message 2. Sender: CAS (Car Access System) / end-of-line calibration tool. Trace DLC=8 (E65 table says DLC=3, loopybunny says DLC=8 — 8 retained from trace). Keyfob security, comfort and CBS (Condition Based Service) data; byte 0 always 0xE2 in t1.log. Sources: loopybunny.co.uk/CarPC, rusefi.com BMW E65 Tool32 K-CAN table

E240000000000000

Byte layout

—

Signal	Position	Format	Scale / Formula	Range	Receivers

0x7DF · OBD2_FUNC_REQ_7DF

Decimal ID: 2015 · Transmitter: DIA

DLC 8 6 signals

0x7DF [OBD2 via ZGW — NOT direct K-CAN] Functional broadcast request to all OBD2-compliant ECUs. Standard ISO 15031 / SAE J1979. All OBD2-compliant ECUs respond. On BMW E9x PT-CAN: DME responds on 0x7E8, EGS on 0x7E9. Accessible from K-CAN via ZGW gateway — ZGW forwards standard OBD2 Mode 01/03/04/09 requests to PT-CAN. NOT suitable for BMW-proprietary UDS (Mode 0x22/0x2E/0x27/0x31) — use physical addressing (0x6F1 → 0x600 etc.) for extended diagnostics. Frame format: B0=0x02 (2 bytes follow), B1=Mode (0x01=current data, 0x03=stored DTCs, 0x04=clear DTCs, 0x09=vehicle info), B2=PID/InfoType, B3-B7=0x00 padding. Source: SAE J1979, ISO 15031-5

????????????????

Byte layout

OBD2_Mode

OBD2_PID

OBD2_DataA

OBD2_DataB

OBD2_DataC

OBD2_DataD

—

Signal	Position	Format	Scale / Formula	Range	Receivers
OBD2_Mode 0x01 (1) = Mode01_CurrentData 0x02 (2) = Mode02_FreezeFrame 0x03 (3) = Mode03_StoredDTCs 0x04 (4) = Mode04_ClearDTCs 0x05 (5) = Mode05_O2MonitorResults 0x06 (6) = Mode06_OnboardMonitor 0x07 (7) = Mode07_PendingDTCs 0x09 (9) = Mode09_VehicleInfo	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
OBD2_PID	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
OBD2_DataA	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
OBD2_DataB	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
OBD2_DataC	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX
OBD2_DataD	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	Vector__XXX

0x7E0 · OBD2_PHYS_REQ_7E0_DME

Decimal ID: 2016 · Transmitter: DIA

DLC 8 4 signals

0x7E0 [OBD2 via ZGW — NOT direct K-CAN] Physical OBD2 request to DME/ECM. Used when targeting only the engine ECU (not broadcast). Response on 0x7E8. Physical addressing bypasses ZGW arbitration — may not be accessible from K-CAN without dedicated PT-CAN connection. Source: ISO 15031-5

????????????????

Byte layout

OBD2_Mode

OBD2_PID

OBD2_DataA

OBD2_DataB

—

Signal	Position	Format	Scale / Formula	Range	Receivers
OBD2_Mode	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME
OBD2_PID	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME
OBD2_DataA	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME
OBD2_DataB	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DME

0x7E1 · OBD2_PHYS_REQ_7E1_EGS

Decimal ID: 2017 · Transmitter: DIA

DLC 8 4 signals

0x7E1 [OBD2 via ZGW — NOT direct K-CAN] Physical OBD2 request to EGS/TCM (gearbox). Response on 0x7E9. OBD2 Mode 01 PID 0x6C = ATF temperature (gearbox oil temp). Source: ISO 15031-5

????????????????

Byte layout

OBD2_Mode

OBD2_PID

OBD2_DataA

OBD2_DataB

—

Signal	Position	Format	Scale / Formula	Range	Receivers
OBD2_Mode	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	EGS
OBD2_PID	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	EGS
OBD2_DataA	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	EGS
OBD2_DataB	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	EGS

0x7E8 · OBD2_RESP_7E8_DME

Decimal ID: 2024 · Transmitter: DME

DLC 8 7 signals

0x7E8 [OBD2 via ZGW — NOT direct K-CAN] Standard OBD2 response from DME (engine ECU). Frame format: B0=number of additional bytes (0x03-0x06 typical), B1=Mode+0x40 (e.g. 0x41 for Mode 01 current data), B2=PID, B3=DataA, B4=DataB, B5=DataC, B6=DataD. Key Mode 01 PIDs on N47D20O1: 0x04=engine load%, 0x05=coolant temp (A-40 degC), 0x0B=intake MAP kPa, 0x0C=RPM ((256A+B)/4), 0x0D=speed km/h, 0x0F=intake air temp (A-40 degC), 0x11=throttle position A/2.55%, 0x2F=fuel level A/2.55%, 0x33=barometric pressure A kPa, 0x42=control module voltage (256A+B)/1000 V, 0x46=ambient air temp (A-40 degC). Source: SAE J1979, ISO 15031-5

????????????????

Byte layout

OBD2_ByteCount

OBD2_ModeResp

OBD2_PID

OBD2_DataA

OBD2_DataB

OBD2_DataC

OBD2_DataD

—

Signal	Position	Format	Scale / Formula	Range	Receivers
OBD2_ByteCount	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 7]`	DIA
OBD2_ModeResp 0x41 (65) = Mode01_Response_0x41 0x42 (66) = Mode02_Response_0x42 0x43 (67) = Mode03_Response_0x43 0x46 (70) = Mode06_Response_0x46 0x47 (71) = Mode07_Response_0x47 0x49 (73) = Mode09_Response_0x49	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_PID	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_DataA	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_DataB	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_DataC	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_DataD	B6 (full byte) DBC: 48\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA

0x7E9 · OBD2_RESP_7E9_EGS

Decimal ID: 2025 · Transmitter: EGS

DLC 8 7 signals

0x7E9 [OBD2 via ZGW — NOT direct K-CAN] Standard OBD2 response from EGS (ZF 6HP19 gearbox TCM). Frame format same as 0x7E8. EGS-specific PID: 0x6C=ATF oil temperature (ZF 6HP19 confirmation PENDING — community data suggests same A-40 degC formula as DME coolant). Also responds to Mode 09 InfoType 0x02 (VIN) for EGS identity. Source: SAE J1979; ZF 6HP19 OBD2 data not confirmed on this vehicle — mark decoded values as UNVERIFIED until HIL validation.

????????????????

Byte layout

OBD2_ByteCount

OBD2_ModeResp

OBD2_PID

OBD2_DataA

OBD2_DataB

OBD2_DataC

OBD2_DataD

—

Signal	Position	Format	Scale / Formula	Range	Receivers
OBD2_ByteCount	B0 (full byte) DBC: 0\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 7]`	DIA
OBD2_ModeResp	B1 (full byte) DBC: 8\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_PID	B2 (full byte) DBC: 16\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_DataA	B3 (full byte) DBC: 24\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_DataB	B4 (full byte) DBC: 32\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_DataC	B5 (full byte) DBC: 40\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA
OBD2_DataD	B6 (full byte) DBC: 48\|8	Intel (little-endian) Unsigned	raw value Factor `1` Offset `0`	`[0 .. 255]`	DIA