[glamprecht]

On the E46 many functions actually work through the ZKE. The ZKE actually contained all the transistors that switched the motors, etc so many functions did not appear on CAN.

Another important note is that THE MESSAGE in CAN contains an ID. It actually does not have anything to do with the origin or destination of the message. Any control unit can place any message on the bus. So there is for example a speed message with ID ABC from the speed sensor. If the speed sensor would fail, a limp mode could possibly use the ABS sensor to put the same speed message on the bus.

I am sure you know this but for the sake of other readers let me elaborate.

In CAN there are MASKS setup in the control units. And only messages complying with those masks are handled by the CAN controller. So the unit will physically not know of any other messages. The MASK represent the TYPE/OR CLASS of message that it is interested in. It is possible to implement CAN messages in such a way that all messages between control unit 1 and 2 contain the same ID. So 2 units can happily communicate with each other using only one ID.

Coincidently it may happen or be decided that all messages from the ECU are put on the bus with the same ID

This is quite important as bus arbitration lets the lower IDs take priority over higher ID's. The nice thing here is that lower ID MESSAGES are more important regardless of which control unit post the message on the bus.

This is where CAN is completely different to USB & Ethernet.

I am going to attempt to get some documented message ID's, otherwise we will have to figure out what address means what message. If you want to do that is to try and explain ALL ID's. In other word isolate one ID and then play with everything in the car and see which devices trigger that message to appear on the bus. Then take the next ID and repeat the process.