Siemens MS41

The Siemens MS41 engine control unit (ECU) uses an Infineon C166 CPU clocked at 20MHz and comes in two different memory versions:

• tbd (not flashable)
• Intel AM28F200BB (flashable)

The most common ones are equipped with the 2megabit Intel AB28F200BB flash memory.

This ECU came in three different subversions and each of them was intented to run a different engine or emissions class:

• MS41.0: M52
• MS41.1: M52 OBDII
• MS41.2: S52 US

When looking at the cryptic item names this might help you: Siemens Keyword Translation

Memory Layout

MS41 can be seperated into three major sections, the bootloader, the program code, and the calibration data.

Bootloader Section

The bootloader code section is the most important section of the MS41 and doesnt have to be touched for at least 99% of all use cases.

This section is 32kB in size and contains the interrupt setups, input and output initializations, as well as immobilizer information and the UIF (user information fields).

The significant difference between the bootloader section and the others is, that it's only one time programmable under normal operation. That means once a byte has been changed from FF to another value, it is not changeable again.

Unlimited write access to the bootloader section can only be archieved through desoldering the flash chip and putting it in a chipreader and is ONLY needed for unbricking, virginizing the ECU to pair it with a different EWS module or to alter the UIF without increasing the flashcounter.

Programm Code Section

The program code section is located after the calibration data and is a 128kByte large section. It stores the program code the ECU uses during normal operation.

Calibration Data Section

The calibration data section is 24kByte in size and contains all constants and tables.