CAN bus Message data

Hi all, I'm looking for information on the CAN traffic for a 2002 996.2 C2. I've found some info online and I've decoded (part of) some messages by sniffing the bus and reverse-engineering but I'm still missing some info. If anyone is interested, I can post what I have so far. The goal is to ditch the ECU and Tiptronic modules and replace them with my own controller. I'm particularly interested in the data coming from the ABS/PSM (torque reduction request) and I'm also missing some ECU message(s) that result in a faultcode in the ABS/PSM unit. Does anybody have a logfile of the raw CAN data with running engine? (My car has no engine/gearbox) Any help is appreciated.

I've got a maxxecu mini on its way to hook up (to listen to CAN) and can use that to get you some raw CAN data when it turns up. What are you looking to replace the DME with? Can't help with tip as I'm manual. I'm only looking to pick up CLT/IAT/TPS/Speed/oil temp for the maxxecu to use (I'm going to look probably at using it in a sort of hybrid/piggyback role), I might have to use OBD2 CAN to pick up IAT I think as am not sure it's broadcast. Not a biggy either way for me and I can always plumb in some analog sensors if needed, just from a packaging and wiring point of view this would be neat. I'd be interested in what you've done so far and what your plans are...

Mastercorn has posted the canbus data information in the past of which below is a copy and paste I took. I'm in the process of fitting a cancheck display Can bus Address 0x4E0 Oil temp, start bit 40, length 8, intel byte order, unsigned, factor 0.75, offset -48 (-48 to 142.5 degrees C) Address 0x298 Intel air temp, start bit 8, length 8, intel, unsigned, factor 0.75, offset -48 Address 0x520 Oil pressure, start bit 32, length 8, Motorola unsigned, factor 0.04, bar Ambient temperature, start bit 24, length 8, intel unsigned, factor 0.5, offset -40 Address 0x280 Throttle position, start bit 40, length 8, intel, unsigned, factor 0.390625 Engine speed, start bit 16, length 16, intel, unsigned, factor 0.25, RPM Address 0x289 Coolant temp, start bit 8, length 8, intel, unsigned, factor 0.75, offset -48 Address 0xC0 Steering angle, start bit 4, length 12, Intel byte order, signed, factor 0.390625 Address 0x2A8 Wheel speeds, all length 15, intel, unsigned, factor 0.01, km/h FL start bit 1 FR start bit 17 RL start bit 33 RR start bit 49 Address 0x1A0 ABD intervention, start bit 3, length 1, intel TCS intervention, start bit 0, length 1, intel TCS intervention (fast), start bit 40, length 8, Motorola unsigned, factor 0.39, % TCS intervention (slow), start bit 32, length 8, Motorola unsigned, factor 0.39, % ABS intervention, start bit 2, length 1, intel.

I'll get on to your PM and put more data up here for others, hopefully tomorrow. MC

Nice project! Following

Thanks appreciate it, this thread was quite timely!

Thank you for your fast responses. The info from @Damo996 helped fill in some gaps in my spreadsheet. I'm especially chuffed about the 0x1A0 message. That's one of the things I was looking for. Do you have any idea how the standard DME reacts to the 'intervention' signals? I would imagine an "ABS intervention" would result in a complete 'minimal torque state' or 'close throttle'. Not so sure what "ABD" and "TCS" is and how the DME should react to those interventions though (TCS=TractionControlSystem? , ABD=StabilityControl?). My best guess is that the "fast" and "slow" values command a decrease in torque by the given percentage but how 'fast' or 'slow' this should happen is unclear. So far I haven't been able to get the RPM dial in the instrument cluster to move by sending an RPM signal in msg 0x280. It would be nice if I could figure that out. I know that the fuel level indicator works in a peculiar way, so I think hacking into the PCB and taking over control of the steppermotor will be required to get that one to work. As for the plans... The car was bought without engine/gearbox. Those will get replaced with two electric units. The DME and Tip unit are still in the car for now, but they will most likely be removed. A VCU (Vehicle Control Unit) will be wired into the CAN bus to interact with both the existing vehicle units and the added units (bms, charger, inverters, DC-DC converter, pumps etc.). For now, a National Instruments cRIO embedded controller will be used for that. I'm having trouble attaching my spreadsheet file. I'll try to post in a separate post. PJ.

Attempts to attach a csv or txt file were unsuccessful (not allowed). Here's what I have so far: (Updated 15-05-2023) [0x1A0] - "ABS_1" (from ABS-PSM) -- "ABD intervention" , startbit: 3 , Type: Boolean, Factor: 1 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "ABS intervention" , startbit: 2 , Type: Boolean, Factor: 1 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "ABS lamp" , startbit: 8 , Type: Boolean, Factor: , Offset: [0x1A0] - "ABS_1" (from ABS-PSM) -- "ASR ***** control" , startbit: 5 , Type: Boolean, Factor: 1 , Offset: 0 00= not required, 01= shiftmap, 10=downshift, 11= switching prohibition [0x1A0] - "ABS_1" (from ABS-PSM) -- "Brake switch i" , startbit: 12 , Type: Boolean, Factor: 1 , Offset: 0 Inverted? [0x1A0] - "ABS_1" (from ABS-PSM) -- "Brake switch" , startbit: 11 , Type: Boolean, Factor: 1 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "Brake warning light" , startbit: 10 , Type: Boolean, Factor: , Offset: [0x1A0] - "ABS_1" (from ABS-PSM) -- "FDR Lamp" , startbit: 7 , Type: Boolean, Factor: 1 , Offset: 0 "FDR"? [0x1A0] - "ABS_1" (from ABS-PSM) -- "FDR intervention" , startbit: 4 , Type: Boolean, Factor: 1 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "FDR lamp2" , startbit: 9 , Type: Boolean, Factor: , Offset: [0x1A0] - "ABS_1" (from ABS-PSM) -- "Handbrake switch" , startbit: 15 , Type: Boolean, Factor: 1 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "Intervention torque" , startbit: 48 , Type: U8, Factor: 0.39 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "Lateral G-force" , startbit: 48 , Type: U8, Factor: 0.01 , Offset: -1.27 Only with FDR [0x1A0] - "ABS_1" (from ABS-PSM) -- "MSR Request" , startbit: 1 , Type: Boolean, Factor: 1 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "PSM button lamp" , startbit: 16 , Type: Boolean, Factor: 1 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "Rough road suppression status" , startbit: 14 , Type: Boolean, Factor: 1 , Offset: 0 1=bit5 valid (bit5 in Byte 1 =bit no 13) [0x1A0] - "ABS_1" (from ABS-PSM) -- "Rough road suppression" , startbit: 13 , Type: Boolean, Factor: 1 , Offset: 0 1=blanking [0x1A0] - "ABS_1" (from ABS-PSM) -- "TCS intervention (ASR request)" , startbit: 0 , Type: Boolean, Factor: 1 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "TCS_Intervention_Fast" , startbit: 40 , Type: U8, Factor: 0.39 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "TCS_Intervention_Slow" , startbit: 32 , Type: U8, Factor: 0.39 , Offset: 0 [0x1A0] - "ABS_1" (from ABS-PSM) -- "Vehicle ref speed" , startbit: 17 , Type: U16, Factor: 0.01 , Offset: 0 Reference speed refers to a fixed tire circumference of 1.938m for ASR5.3 and 2.00m for FDR5.3/5.7 and ASR5.7 [0x280] - "Engine_1" (from MFI_DI (ECU)) -- "PedalPosition1" , startbit: 32 , Type: U8, Factor: 1 , Offset: [0x280] - "Engine_1" (from MFI_DI (ECU)) -- "PedalPosition2" , startbit: 56 , Type: U8, Factor: 1 , Offset: [0x280] - "Engine_1" (from MFI_DI (ECU)) -- "RPM" , startbit: 16 , Type: U16, Factor: 0.25 , Offset: 0 [0x280] - "Engine_1" (from MFI_DI (ECU)) -- "ThrottlePosition" , startbit: 40 , Type: U8, Factor: 0.390625 , Offset: 0 [0x289] - "EngineTemp" (from MFI_DI (ECU)) -- "Coolant Level Switch" , startbit: 16 , Type: Boolean, Factor: 1 , Offset: 0 [0x289] - "EngineTemp" (from MFI_DI (ECU)) -- "CoolantTemp" , startbit: 8 , Type: U8, Factor: 0.75 , Offset: -48 [0x289] - "EngineTemp" (from MFI_DI (ECU)) -- "Tempomat_Active" , startbit: 22 , Type: Boolean, Factor: 1 , Offset: 0 [0x298] - "Engine_2" (from MFI_DI (ECU)) -- "BarometricPressure" , startbit: 40 , Type: U8, Factor: 5 , Offset: 0 Turbo? Unsure. [0x298] - "Engine_2" (from MFI_DI (ECU)) -- "InletAirTemp" , startbit: 8 , Type: U8, Factor: 0.75 , Offset: -48 [0x298] - "Engine_2" (from MFI_DI (ECU)) -- "Speed" , startbit: 56 , Type: U8, Factor: ? , Offset: 0 Turbo? Unsure. [0x298] - "Engine_2" (from MFI_DI (ECU)) -- "ThrottlePosition1" , startbit: 16 , Type: U8, Factor: 0.390625 , Offset: 0 Turbo? Unsure. [0x298] - "Engine_2" (from MFI_DI (ECU)) -- "ThrottlePosition2" , startbit: 32 , Type: U8, Factor: 0.390625 , Offset: 0 Turbo? Unsure. [0x2A8] - "Vehicle_Speed" (from ABS-PSM) -- "WheelSpeed_LF" , startbit: 0 , Type: U16, Factor: 5.2184440687165E-03 , Offset: -1.63380090592189 [0x2A8] - "Vehicle_Speed" (from ABS-PSM) -- "WheelSpeed_LR" , startbit: 32 , Type: U16, Factor: 5.2184440687165E-03 , Offset: -1.63380090592189 [0x2A8] - "Vehicle_Speed" (from ABS-PSM) -- "WheelSpeed_RF" , startbit: 16 , Type: U16, Factor: 5.2184440687165E-03 , Offset: -1.63380090592189 [0x2A8] - "Vehicle_Speed" (from ABS-PSM) -- "WheelSpeed_RR" , startbit: 48 , Type: U16, Factor: 5.2184440687165E-03 , Offset: -1.63380090592189 [0x440] - "AT_Line1" (from Tiptronic (TCU)) -- "PRND Pos" , startbit: 16 , Type: U8, Factor: 1 , Offset: 0 P=128 , R=119 , N=96 , D=81, M=225 [0x4A1] - "ABS_2" (from ABS-PSM) -- "ACC related error" , startbit: 12 , Type: Boolean, Factor: 1 , Offset: 0 1= error [0x4A1] - "ABS_2" (from ABS-PSM) -- "Acceleration" , startbit: 16 , Type: U9, Factor: 0.3125 , Offset: 0 [0x4A1] - "ABS_2" (from ABS-PSM) -- "Brake_normal / Brake_offset" , startbit: 32 , Type: U8, Factor: 0.1 , Offset: 0 depends on Byte3, bits 6-7 [0x4A1] - "ABS_2" (from ABS-PSM) -- "Driver Braking" , startbit: 14 , Type: Boolean, Factor: 1 , Offset: 0 1= braking [0x4A1] - "ABS_2" (from ABS-PSM) -- "Error driver brake detection" , startbit: 25 , Type: Boolean, Factor: 1 , Offset: 0 1=error [0x4A1] - "ABS_2" (from ABS-PSM) -- "Multiplex code for Byte 4" , startbit: 30 , Type: U2, Factor: 0 , Offset: 1 00=Brake_normal, 01=Brake_offset [0x4A1] - "ABS_2" (from ABS-PSM) -- "No actively built up brake pressure" , startbit: 10 , Type: Boolean, Factor: 1 , Offset: 0 1= 'no pressure' [0x4A1] - "ABS_2" (from ABS-PSM) -- "Receipt for ACC message" , startbit: 13 , Type: Boolean, Factor: 1 , Offset: 0 1= message implausible [0x4A1] - "ABS_2" (from ABS-PSM) -- "Regulator error in the FDR system" , startbit: 15 , Type: Boolean, Factor: 1 , Offset: 0 1= error [0x4A1] - "ABS_2" (from ABS-PSM) -- "Yaw rate sign" , startbit: 0 , Type: Bit, Factor: 1 , Offset: 0 [0x4A1] - "ABS_2" (from ABS-PSM) -- "Yaw rate" , startbit: 1 , Type: U9, Factor: 0.0021326 , Offset: 0 [0x4E0] - "EngineStat" (from MFI_DI (ECU)) -- "BoostPressure" , startbit: 32 , Type: U8, Factor: 10 , Offset: 0 Turbo? Unsure. [0x4E0] - "EngineStat" (from MFI_DI (ECU)) -- "CheckEngineLight" , startbit: 0 , Type: Boolean, Factor: 1 , Offset: 0 also bit1 [0x4E0] - "EngineStat" (from MFI_DI (ECU)) -- "Fan_error" , startbit: 4 , Type: Boolean, Factor: 1 , Offset: 0 Triggers msg on cluster [0x4E0] - "EngineStat" (from MFI_DI (ECU)) -- "FuelUsed" , startbit: 16 , Type: U16, Factor: 10 , Offset: 0 Scaling? [0x4E0] - "EngineStat" (from MFI_DI (ECU)) -- "OilTemp" , startbit: 40 , Type: U8, Factor: 0.75 , Offset: -48 [0x4E0] - "EngineStat" (from MFI_DI (ECU)) -- "Reduced_Power" , startbit: 3 , Type: Boolean, Factor: 1 , Offset: 0 Triggers msg on cluster [0x4F8] - "" (from MFI_DI (ECU)) -- "???" , startbit: , Type: , Factor: , Offset: [0x510] - "InstrCluster_1" (from Instr. Cluster) -- "Indicator_Left" , startbit: 20 , Type: Boolean, Factor: 1 , Offset: 0 [0x510] - "InstrCluster_1" (from Instr. Cluster) -- "Indicator_Right" , startbit: 21 , Type: Boolean, Factor: 1 , Offset: 0 [0x510] - "InstrCluster_1" (from Instr. Cluster) -- "SteeringwheelButton_Dwn" , startbit: 49 , Type: Boolean, Factor: 1 , Offset: 0 [0x510] - "InstrCluster_1" (from Instr. Cluster) -- "SteeringwheelButton_Up" , startbit: 48 , Type: Boolean, Factor: 1 , Offset: 0 [0x510] - "InstrCluster_1" (from Instr. Cluster) -- "Tempomat_Button" , startbit: 23 , Type: Boolean, Factor: 1 , Offset: 0 also bit22 [0x510] - "InstrCluster_1" (from Instr. Cluster) -- "VehicleSpeed" , startbit: 0 , Type: U16, Factor: 0.250264 , Offset: -4100.17 [0x520] - "InstrCluster_2" (from Instr. Cluster) -- "AmbientTemp" , startbit: 24 , Type: U8, Factor: 0.5 , Offset: -40 [0x520] - "InstrCluster_2" (from Instr. Cluster) -- "Counter?" , startbit: 40 , Type: U8, Factor: 1 , Offset: 0 [0x520] - "InstrCluster_2" (from Instr. Cluster) -- "LightDimmer" , startbit: 8 , Type: U8, Factor: 1 , Offset: 0 [0x520] - "InstrCluster_2" (from Instr. Cluster) -- "OilPressure" , startbit: 32 , Type: U8, Factor: 0.04 , Offset: [0x560] - "InstrCluster_3" (from Instr. Cluster) -- "???" , startbit: , Type: , Factor: , Offset: [0x7A0] - "Engine_3" (from MFI_DI (ECU)) -- "???" , startbit: , Type: , Factor: , Offset: [0xC0] - "SWA" (from Steering Angle sensor) -- "Steering Angle" , startbit: 0 , Type: I16, Factor: 0.0773 , Offset: -1.1668 Some signals are untested/uncertain and not all the scalings are correct.

I've been asked specifically for these, but probably repeated above. byte numbering 0-7 Coolant temp 0x289 start bit 8, length 8, intel factor 0.75 offset -48 Throttle position 0x280 start bit 40, length 8, intel factor 0.290625 RPM 0x280 start bit 16 length 16, intel, factor 0.25 Intake temperature 0x298, start bit 8, length 8, intel, factor 0.75 offset -48 ambient pressure 0x298, start bit 40, length 8, factor 0.05 MC

The module listed as ASR, which I believe is the traction control, transmits the following IDs. 0x1A0 TCS, ABS, ABD intervention, TCS intervention slow and fast, operating torque 0x2A8 FL,FR,RL,RR wheel speeds, 15 bits each 0x4A0 yaw rate sign and yaw rate, braking and error flags, byte 4 is multiplexed braking data, MC

Thanks for that @MisterCorn ! Do you have more info you could share about bit positions for the 0x4A0 message? What should I expect from "Operating torque' (from ABS/PSM in 0x1A0)? Could you share the bit positions for that one as well? PJ

Here is a bit more to get stuck in to. No point asking me what any of the descriptions mean, they are translated from German and your guess is probably as good as mine on some of them... 0x4A0 Byte 0 bit 0 yaw rate sign, 0 = positive, 1 = negative Bit 1, start of 9 bit yaw rate, range 0-510, 0.0021326 rad/s/bit Byte 1 bit 2 no actively built up brake pressure, 1=no pressure bit 3 reserved bit 4 ACC related error occured 1=errror occured bit 5 Receipt for ACC message 1=message implausible bit 6 Driver braking 1=braking bit 7 Regulator error in the FDR system, 1=error Byte 2 to 3 bit 0 9 bit acceleration, values 0-1022 for -15.97 to 15.97 m/s^2 Byte 3 bit 2 Error driver brake detection 1=error bits 3-5 reserved bits 6-7 multiplex code for byte 4 Byte 4 multiplex 00 Brake normal 0-255, 0 - 25.5 m/s^2 multiplex 01 Brake offset 0-255 0-25.5 m/s^2 multiplex 10 and 11 reserved Bytes 5-7 Reserved 0x1A0 byte 0 is status bit 0 ASR request bit 1 MSR request bit 2 ABS active bit 3 ABD active bit 4 FDR active bits 5-6 ASR ***** control 00 not required 01 shiftmap 10 downshift 11 switching prohibition bit 7 FDR lamp byte 1 is status bit 0 ABS lamp bit 1 FDR lamp bit 2 brake warnign light bit 3 brake light switch bit 4 brake light switch, comment to say inverted?? bit 5 rough road suppression 1=blanking bit 6 rough road suppression status, 1=bit 5 valid bit 7 parking brake byte 2 bit 0 lamp on PSM button bits 1-7 vehicle ref speed low data 0.01km/h/bit byte 3 ref speed high data, 1.28 km/h/bit NOTE Reference speed refers to a fixed tire circumference of 1.938m for ASR5.3 and 2.00m for FDR5.3/5.7 and ASR5.7 Bytes 4,5,6 are TCS intervention torque slow,fast, intervention torque 0-99.6%, 0-254, resolution 0.39% Byte 7 is lateral g force, 0-254, -1.27 to 1.27g, only with FDR, otherwise 0xFF MC

Thanks again, MC! I might be able to help if you need anything translated from German (I know a little myself and I have some German contacts). Ar you sure about the 0x4A0 address? I didn't see that message on the car but I do get a 0x4A 1 message from the ABS/PSM unit... I'll update the list on monday and edit my earlier post. Have a nice weekend. PJ

Does anyone have an update spreadsheet\DBC on 996 canbus data? Currently messing around with this too..

Quotes source post: 2718543

This is an old post, but I have been working on the 996 for my 2001 C4 Cab. I've made a little progress and fixed a few errors. However, this one is in MPH not KPH. With the help of @MisterCorn , I've added some info to the Tiptronic section but am still trying to figure out a few things, like turbine, temp, and torqe converter. I did add limp mode, selected gear, shifter position, and (maybe) shift status and torque retard. One fix was making the ABS_3 ID appear in SavvyCan Signal Viewer. It was mislabeled, at least for that purpose.

Quotes source post: 2825155

Thank you for posting this. I've been digging through this compiling everyone's info on the CAN bus and pushing updates to my AIM SOLO 2 and i'm getting close to having really good data! I'll post updates when i get it finalized!

Quotes source post: 2825404

If you have any additional insight into the Tiptronic portion, is love to see it!

Since I'm working with a 996 Turbo manual, I’m currently excluding Tiptronic references from my testing. I’ll report back with my findings once I’ve made more progress. I plan to confirm the steering angle gain and offset this evening to corroborate all the data points; the current readings are a bit light on degrees, so I'll be fine-tuning that. Additionally, I’ve successfully pulled both oil pressure and ambient temperature data from ID 0x520, which seems to address the concerns others have raised about that bus.

I adjusted the SWA in my version to be 450 degrees in each direction. I'm not sure if that's 100% accurate but way closer than before.

Quotes source post: 2825430

About 1,073° total steering wheel rotation, or roughly ±536° from center. That comes from the factory spec of 2.98 steering wheel turns lock to lock with a 16.9:1 steering ratio. The Turbo shares the rack with the C4S, so it carries the same numbers — turning circle is fractionally larger due to the wider front track, but wheel turns are the same.

As I looked at it a few minutes ago, I'd have guessed 1080. So, 1073 sounds right.