Advertising:

Siemens MS41: Difference between revisions

From MS4X Wiki
No edit summary
No edit summary
 
Line 2: Line 2:
* tbd (not flashable)
* tbd (not flashable)
* Intel AM28F200BB (flashable)
* Intel AM28F200BB (flashable)
The most common ones are equipped with the 2megabit Intel AB28F200BB flash memory. This ECU controls the BMW M52 and S52 (US) inline six engine.
The most common ones are equipped with the 2megabit Intel AB28F200BB flash memory.
 
This ECU came in three different subversions and each of them was intented to run a different engine or emissions class:
*'''MS41.0:''' M52
*'''MS41.1:''' M52 OBDII
*'''MS41.2:''' S52 US


When looking at the cryptic item names this might help you: [[Siemens Keyword Translation]]
When looking at the cryptic item names this might help you: [[Siemens Keyword Translation]]
<div style="float:right;">__TOC__</div>
<div style="float:right;">__TOC__</div>
=Memory Layout=
=Memory Layout=
The MS42 can be seperated into three major sections, the bootloader, the program code, and the calibration data.
MS41 can be seperated into three major sections, the bootloader, the program code, and the calibration data.
 
See this table for file locations:
 
{| class="wikitable"
! style="text-align: center; font-weight:bold;" | Start
! style="text-align: center; font-weight:bold;" | End
! style="text-align: center; font-weight:bold;" | Section
! style="text-align: center; font-weight:bold;" | Size
|-
| style="text-align: center; background-color:#fe996b;" | 00000
| style="text-align: center; background-color:#fe996b;" | 07FFF
| style="text-align: center; background-color:#fe996b;" | Bootloader & UIF
| style="text-align: center; background-color:#fe996b;" | 32 kByte
|-
| style="text-align: center; background-color:#fffc9e;" | 8000
| style="text-align: center; background-color:#fffc9e;" | FFFF
| rowspan="3" style="text-align: center; background-color:#fffc9e;" | ?
| rowspan="3" style="text-align: center; background-color:#fffc9e;" | 32kByte
|-
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 10000
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 17FFF
|-
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 30000
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 3FFFF
|-
| style="text-align: center; background-color:#eaecf0; color:#000000;" | 40000
| style="text-align: center; background-color:#eaecf0; color:#000000;" | 47FFF
| style="text-align: center; background-color:#eaecf0; color:#000000;" | Unused Space
| style="text-align: center; background-color:#eaecf0; color:#000000;" | 32 kByte
|-
| style="text-align: center; background-color:#9aff99; color:#000000;" | 20000
| style="text-align: center; background-color:#9aff99; color:#000000;" | 2FFFF
| style="text-align: center; background-color:#9aff99; color:#000000;" | Program Code 1
| style="text-align: center; background-color:#9aff99; color:#000000;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 20000
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 2FFFF
| rowspan="3" style="text-align: center; background-color:#fffc9e;" | Program Code 2
| rowspan="3" style="text-align: center; background-color:#fffc9e;" | 64 kByte
|-
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 60000
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 6FFFF
|-
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 70000
| style="text-align: center; background-color:#fffc9e; color:#000000;" | 7FFFF
|}


'''Bootloader Section'''
'''Bootloader Section'''


The bootloader code section is the most important section of the MS42 and doesnt have to be touched for at least 99% of all use cases.
The bootloader code section is the most important section of the MS41 and doesnt have to be touched for at least 99% of all use cases.


This section is 64 kByte in size and contains the interrupt setups, input and output initializations, as well as immobilizer information and the UIF (user information fields).
This section is 32kB in size and contains the interrupt setups, input and output initializations, as well as immobilizer information and the UIF (user information fields).


The significant difference between the bootloader section and the others is, that it's only one time programmable under normal operation. That means once a byte has been changed from FF to another value, it is not changeable again.
The significant difference between the bootloader section and the others is, that it's only one time programmable under normal operation. That means once a byte has been changed from FF to another value, it is not changeable again.


Unlimited write access to the bootloader section can only be archieved through JMGarage Flasher and is ONLY needed for virginizing the ECU to pair it with a different EWS module or to alter the UIF without increasing the flashcounter.
Unlimited write access to the bootloader section can only be archieved through desoldering the flash chip and putting it in a chipreader and is ONLY needed for unbricking, virginizing the ECU to pair it with a different EWS module or to alter the UIF without increasing the flashcounter.
 
Note: The newest version of immobilizer and checksum delete will not need bootmode flashing.


'''Programm Code Section'''
'''Programm Code Section'''


The program code section is divided into two 192kByte large sections with the calibration data in between.
The program code section is located after the calibration data and is a 128kByte large section. It stores the program code the ECU uses during normal operation.


'''Calibration Data Section'''
'''Calibration Data Section'''


The calibration data section is 32kByte in size and contains all constants and tables.
The calibration data section is 24kByte in size and contains all constants and tables.

Latest revision as of 21:51, 19 March 2023

The Siemens MS41 engine control unit (ECU) uses an Infineon C166 CPU clocked at 20MHz and comes in two different memory versions:

  • tbd (not flashable)
  • Intel AM28F200BB (flashable)

The most common ones are equipped with the 2megabit Intel AB28F200BB flash memory.

This ECU came in three different subversions and each of them was intented to run a different engine or emissions class:

  • MS41.0: M52
  • MS41.1: M52 OBDII
  • MS41.2: S52 US

When looking at the cryptic item names this might help you: Siemens Keyword Translation

Memory Layout

MS41 can be seperated into three major sections, the bootloader, the program code, and the calibration data.

Bootloader Section

The bootloader code section is the most important section of the MS41 and doesnt have to be touched for at least 99% of all use cases.

This section is 32kB in size and contains the interrupt setups, input and output initializations, as well as immobilizer information and the UIF (user information fields).

The significant difference between the bootloader section and the others is, that it's only one time programmable under normal operation. That means once a byte has been changed from FF to another value, it is not changeable again.

Unlimited write access to the bootloader section can only be archieved through desoldering the flash chip and putting it in a chipreader and is ONLY needed for unbricking, virginizing the ECU to pair it with a different EWS module or to alter the UIF without increasing the flashcounter.

Programm Code Section

The program code section is located after the calibration data and is a 128kByte large section. It stores the program code the ECU uses during normal operation.

Calibration Data Section

The calibration data section is 24kByte in size and contains all constants and tables.