Diagnostics and the K line

From BMWeb Wiki

How the E46-era units talk on the K line, what their answers mean, and what the cables and adapters in between can carry.

The line

The K line is one wire, half duplex. Everything a tester sends comes back to it as an echo before the unit answers, so a cable that does not hear its own echo is not on the line. The usual serial format is 8 data bits, even parity, 1 stop bit.

An echo proves nothing about the car

A USB K-line cable echoes every byte it sends with nothing plugged into it at all, at any rate from 9600 to 312500: the echo is the adapter's own loopback. Echo and no answer means no unit heard you. Check the plug and the key before suspecting a loader state or a baud rate. car

DS2 telegrams

Used by the gearboxes, the cluster and most body modules. A telegram is the unit's address, the total length (address, length and checksum included), the data, and an XOR of every byte before it. car

32 04 00 36                  GS20 (address 0x32), identification (00); 0x32 ^ 0x04 ^ 0x00 = 0x36
32 2E A0 ... B6              its answer; A0 = done

Status	Seen meaning
`A0`	Done
`A2`	Not now, or not for you. The GS20 says it for 10 s after power-up or a wrong key, and when it has no program and is already in its boot loader. The EWS3 (address `0x44`) says it to ISN_LESEN and PASSWORT_LESEN on a paired car, ignition on, and there is no job that unlocks them: it declines by policy. See the immobiliser.
`B0`	Refused. The GS20 says it for a write to a region not erased in this session, and for a programming record written outside the state that allows it.

A positive answer can carry a sub-status after A0: the GS20 answers a write over bytes already programmed with sub-status 3, and the end of a programming whose calibration does not match the program with 0E. emulator

KWP2000 telegrams

Used by the MS45.1 DME. A telegram is B8, the target, the source, a length byte, the data and a checksum. B8 is a fixed format byte, not 0x80 plus a length, so the length is always byte 3. The tester is F1 and the DME 12. car

B8 12 F1 02 1A 89 ..          tester to DME: read the serial number
B8 F1 12 03 7F 31 23 ..       DME to tester: routine not finished yet

A positive answer is the request's service plus 0x40. A negative one is 7F, the service, and a reason:

Reason	Meaning	What to do
`23`	Routine not complete	Ask again. An erase says this for about 10 s.
`78`	Answer pending	Wait. The answer follows on its own.
`22`	Conditions not correct	A real refusal. An erase refuses this way when the supply voltage is too low; an access-timing request with any value but the unit's own limits; a programming log write outside a session that erased and downloaded something.
`52`	Address not served	A memory read (`23`) of an address the unit does not hand out: the MS45.1's external flash, or its programming log past the 14th entry.
`80`	Refused	A real refusal.

Some answers are positive in form and still a refusal. The DME's key answer 71 08 00 means the key was rejected; only 71 08 01 unlocks it. See the MS45.1 session.

Timing

The unit's answer delay and the gap it wants before the next request are set by 83. 83 00 reads the limits, 83 03 sets values and 83 01 returns to the defaults. The MS45.1 accepts exactly its limits and nothing in between: its running program answers after 25 ms and wants about 27 ms of quiet by default, 2 ms and 12 ms at its limits (83 03 04 01 18 14 00); its boot loader wants 12 ms of quiet and gives itself 3 s to answer (83 03 00 78 18 F0 00). A request sent into the gap is silently dropped, not refused. emulator

A memory read of 251 to 254 bytes gets no answer at all from the MS45.1, where 250 is served. Silence is a fourth kind of answer and a tool should time it out, not wait. emulator

Cables and adapters

A K+DCAN USB cable carried the DME's programming session at 115200 and, with the DME's port set higher, up to 250000 cleanly and 312500 for short exchanges. Measurements. car
WiFi adapters need care. One common adapter firmware only does parity between 980 and 25000 baud, and its 115200 mode has no parity. The DME's programming mode is 115200 with even parity, so its answers come back torn. Asking for programming mode at 19200 instead (10 85 02) works, and the DME keeps that rate through erase and write. 38400 and above did not. car
Answer time grows with a slow line. At 19200 a flash block is usually answered in about 200 ms but occasionally in 670 ms, so block timeouts need to follow the negotiated P2max of 3 s, not a guess. car
A fast turnaround needs a fast adapter. With the MS45.1's timing at its limits the tester has 2 ms to answer. An FTDI cable buffers received bytes for 16 ms by default; its latency timer has to be set to 1 ms. emulator
A one-way line looks like a dead unit. At a rate the cable cannot carry back (416667 and up on the K+DCAN cable tried) the DME still hears the request to switch and switches, and its garbled answers never confirm it. Only an ignition cycle brings it back to 9600 unless the unit falls back on its own. car
The transceivers. The MS43's K-line driver is an MC33199-class part rated to 200 kBaud; the MS45.1's could not be identified from the board. The MS45.1 carried 250000 and 312500 on one car, which says more about the margin in the parts than about any guarantee. car

Flashing with BMW's own descriptions

BMW's flash descriptions for the DS2 units (the GS20 and SMG2 among 37) and the scripts that drive them were run offline against the emulated units. Three things in them are easy to get wrong. BMW data emulator

The erase job has no timeout. Every DS2 flash description sets the standard timeout of FLASH_LOESCHEN to 0, which means no limit, not the default. A runtime that reads 0 as unset waits 2 s and gives up on an erase that takes longer; the flashing script then reports that failure as its battery-voltage error (2022), which is the script's own mapping of the job status, not a measurement. car
One log record, after the last file. The factory flasher writes a programming record once, after the last of the files it programs, not after each one. A GS20 given a record after every file refuses the later ones. BMW data
No script checks the battery or the ignition. None of the 522 flashing scripts reads the supply voltage or terminal 15. The checks a factory tool performs before a flash are the tool's, and an erase that the unit refuses for low voltage comes back as the unit's own answer (7F 31 22 from the MS45.1). BMW data