Dual-MCU Task Distribution Architecture
Introduced on the E85 Z4, E83 X3, facelift E46 (including the performance 330i ZHP), and early E60 5-Series, the Siemens MS45 family marked a generational leap in memory capacity, processing throughput, emissions monitoring, and cryptographic security:
┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│ SIEMENS MS45.0 VS. MS45.1 HARDWARE & EMISSIONS DIVISION │
├──────────────────────────────────────────────────────────────────────────────────────────────────┤
│ │
│ [ Siemens DME MS45.0 (European / RoW Market) ] [ Siemens DME MS45.1 (North American Market) ]│
│ • Target Applications: E46 330i Euro, E60 525i • Target Applications: E46 330i ZHP, E85 Z4 │
│ • Firmware Standard: 4560BN02S / 4520D30S • Firmware Standard: 457LO02S / 457LG23P │
│ • Flash Memory: 1024 KB (AMD AM29F800BB Parallel) • Flash Memory: 1024 KB (AMD AM29F800BB) │
│ • Microcontrollers: Dual C167CS @ 33 MHz • Microcontrollers: Dual C167CS @ 33 MHz │
│ • Pre-Cat Oxygen Sensors: 2x Narrowband (0-1V) • Pre-Cat Oxygen Sensors: 2x WIDEBAND LSU 4.2 │
│ • Wide-Open Throttle: Open-Loop Blind Tables • Wide-Open Throttle: CLOSED-LOOP AT ALL LOADS│
│ • Communication: High-Speed PT-CAN (500 kbps) • Communication: High-Speed PT-CAN (500 kbps) │
│ │
│ ★ CRITICAL COMPATIBILITY LAW: MS45.0 and MS45.1 binaries and XDFs are NOT INTERCHANGEABLE! │
│ Flashing an MS45.0 calibration onto an MS45.1 DME permanently corrupts wideband fueling! │
└──────────────────────────────────────────────────────────────────────────────────────────────────┘ 8.1 Dual-MCU Task Distribution Architecture#
Unlike single-core MS42/MS43 units, the MS45 incorporates two synchronous Infineon C167CS microcontrollers on a single high-density multilayer PCB:
- Primary Control MCU: Manages primary real-time operational calculations: cylinder air mass modeling, electronic throttle (EDK) position, auxiliary rotary idle valve (ZWD), Double-VANOS phase angle tracking, ignition dwell and advance, and individual cylinder knock intervention.
- Secondary Monitoring MCU: Operates an autonomous emissions surveillance routine: evaluating cylinder acceleration delta for misfire detection, evaporative emissions leakage (DMTL), catalyst efficiency modeling, secondary air pump mass verification, and plausibility cross-checking of primary MCU throttle blade requests.
8.2 MS45 Memory Layout & Calibration Segmentation#
The flash capacity was doubled from 512 KB to 1024 KB (1,048,576 bytes):
┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│ SIEMENS MS45 LINEAR FLASH MEMORY TOPOGRAPHY (1024 KB) │
├──────────────────────────────────────────────────────────────────────────────────────────────────┤
│ 0x00000 - 0x01FFF (8 KB): Hardware Boot Sector & Interrupt Traps │
│ 0x02000 - 0x0FFFF (56 KB): Operating System ASW Program Area (Part 1) │
│ 0x10000 - 0x1FFFF (64 KB): ASW Program Area (Part 2) + Hardware/Software ID at 0x1F982 │
│ 0x20000 - 0x3FFFF (128 KB): ASW Program Area (Part 3) │
│ 0x40000 - 0x5CBFF (115 KB): CALIBRATION DATA (A2L Mapped Region) ★ BASEOFFSET = 0x40000 │
│ 0x5CC00 - 0x7FFFF (149 KB): Extended Calibration & Vehicle Variant Coding Data │
│ 0x80000 - 0xFFFFF (512 KB): Lower Flash Bank & Auxiliary Diagnostic Code Space │
└──────────────────────────────────────────────────────────────────────────────────────────────────┘ Calibration Offset Rule: For full 1024\text{ KB} binaries, all addresses are absolute (no offset needed). For partial 116\text{ KB} read/write files, subtract 0x40000 from DAMOS addresses to align with partial binary offsets.
8.3 Wideband LSU 4.2 Closed-Loop Fueling (MS45.1 Exclusive)#
On North American MS45.1 units, pre-catalytic oxygen measurement is performed by two Bosch LSU 4.2 planar wideband sensors interfaced to a Bosch CJ125 sensor ASIC:
- Continuous Closed-Loop WOT Operation: Conventional DMEs enter open-loop at high throttle angles, guessing fuel quantity from blind table lookup. The MS45.1 remains in active closed-loop lambda control across the entire load range, including maximum RPM at 100% wide-open throttle!
- Target Lambda Tables: The calibrator tunes desired equivalence ratios directly via
ip_lams_ron_98__n__mafandip_lams_wup__n__maf. If the DME senses \lambda = 0.92 when target is \lambda = 0.85, the closed-loop integrator immediately increases injection pulse width. - CJ125 Interface Dynamics: The CJ125 ASIC provides a constant reference voltage (V_{\text{ref}} = 450\text{ mV}) across the Nernst cell, dynamically driving a bidirectional pumping current (I_p) through the ceramic diffusion gap. Pumping current is linearly converted to lambda: \lambda = 1.0 + \left(k \times I_p\right)
8.4 Cryptographic RSA-1024 Bootloader & Checksums#
The MS45 was the first BMW DME to introduce hardware-enforced RSA-1024 Cryptographic Signatures:
┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│ MS45 CHECKSUM & RSA-1024 SECURITY INFRASTRUCTURE │
├──────────────────────────────────────────────────────────────────────────────────────────────────┤
│ │
│ 1. CRC32 Checksum (Located at 0x40100): │
│ • Calculated across memory range: 0x40200 to 0x5CFFF │
│ • Standard Ethernet Polynomial: 0x04C11DB7, Init: 0xFFFFFFFF, Final XOR: 0x00000000 │
│ • Development Bypass: Set constant `val_mo3_swi_cal_cks` to 0xA5. │
│ │
│ 2. RSA-1024 Digital Signature (Located at 0x40170): │
│ • 128-byte cryptographic signature block signing 0x40000–0x4016F and 0x40200–0x5CFFF. │
│ • The OTP bootloader decrypts the signature using BMW's 1024-bit public key. If the hash │
│ does not match SHA-1 output, the bootloader rejects flashing over CAN and bricks execution.│
│ • Flashing Solution: Calibrators MUST use `MS45 Flasher` (terraphantm) with a 1 ms latency │
│ FTDI FT232RL K+DCAN cable, which automatically re-signs the RSA block upon writing. │
└──────────────────────────────────────────────────────────────────────────────────────────────────┘