Siemens MS41

The Siemens MS41 engine control unit (ECU) uses an Infineon C166 CPU clocked at 20MHz and comes in two different memory versions:

• tbd (not flashable)
• Intel AM28F200BB (flashable)

The most common ones are equipped with the 2megabit Intel AB28F200BB flash memory. This ECU controls the BMW M52 and S52 (US) inline six engine.

When looking at the cryptic item names this might help you: Siemens Keyword Translation

Memory Layout

The MS42 can be seperated into three major sections, the bootloader, the program code, and the calibration data.

See this table for file locations:

Start	End	Section	Size
00000	07FFF	Bootloader & UIF	32 kByte
8000	FFFF	?	32kByte
10000	17FFF
30000	3FFFF
40000	47FFF	Unused Space	32 kByte
20000	2FFFF	Program Code 1	64 kByte
20000	2FFFF	Program Code 2	64 kByte
60000	6FFFF
70000	7FFFF

Bootloader Section

The bootloader code section is the most important section of the MS42 and doesnt have to be touched for at least 99% of all use cases.

This section is 64 kByte in size and contains the interrupt setups, input and output initializations, as well as immobilizer information and the UIF (user information fields).

The significant difference between the bootloader section and the others is, that it's only one time programmable under normal operation. That means once a byte has been changed from FF to another value, it is not changeable again.

Unlimited write access to the bootloader section can only be archieved through JMGarage Flasher and is ONLY needed for virginizing the ECU to pair it with a different EWS module or to alter the UIF without increasing the flashcounter.

Note: The newest version of immobilizer and checksum delete will not need bootmode flashing.

Programm Code Section

The program code section is divided into two 192kByte large sections with the calibration data in between.

Calibration Data Section

The calibration data section is 32kByte in size and contains all constants and tables.