GS20 automatic gearbox

Memory

A 512 KB read is the boot block at 0x080000, the calibration at 0x090000 and the program at 0x0A0000. The flash is an Am29F400BB on an 8-bit bus. firmware

• The first 48 KB of the flash also appear at 0x000000. That is where the trap vectors are, so every interrupt enters the boot block first. The 1 ms tick and the K-line interrupts stay in the boot block whichever of boot block and program is running; the rest go to stubs in the program.
• Address bit 20 is ignored: the program sends its flash commands at 0x18xxxx, a byte at a time.
• The calibration carries a CRC-16, stored at 0x09000D.

Identification

A DS2 identification 32 04 00 36 is answered like this. A real module with the same software answered the same bytes on the bench except its production date and serial number. car emulator

32 2E A0 "7552700" "29" "001060" "3905" "0000000000" "90" "10001399364" B6

With the program region erased, the boot block answers the same telegram with the program's fields reading FF.

Releases

The boot block, K line and flash are the same for every release. Each of the thirteen programs in SP-Daten starts on the same boot block, with a calibration the boot block accepts for it, and runs without a fault. emulator

Of the 219 calibrations, the boot block takes between one and 48 with each program.

The programming session

Compared against the wire log of a real calibration write: the emulated module answers with the same bytes. car emulator

• No unlock for 10 s after power-up, and for 10 s after a wrong key. The answer while it waits is A2.
• The program answers the session open and hands over to the boot block at the first flash command. A module with no program is in its boot loader already and answers the open with A2.
• A write to a region not erased in this session is refused with B0, even if it is blank. A write over bytes already programmed is answered with sub-status 3.
• A blank program region gives validity code 0x0B, the flash status sub-code a flasher sees for it.
• The pace is the module's: it wants 25 ms of quiet before it takes a telegram. A calibration write is about 44 s of the module's time and a program write about 175 s, at 80 ms a chunk.
• The finish checks the pair. The end-of-programming command (07 0F) compares the calibration's ID blocks with the installed program's. A mismatch is answered with sub-status 0E and the module stays in programming state 3, so a calibration written onto a program it was not released for never completes.
• The programming record has its own window. The record area is 0x08F000-0x08FFFF, 46-byte records written in turn (0x08F000, 0x08F02E, 0x08F05C, ...), read first and written after the data. It can only be written in programming state 1; in any other state the write is refused with B0. The factory flasher writes one record after the last file. BMW data

Why a bad program boot-loops

The boot block checks a program's three ID blocks, not its code. A program with good IDs and broken code is started, crashes, is reset by the trap handler and started again, about every 70 ms, and never answers on the K line. emulator

The boot loader's own loop, which is what takes a new program over the K line, only runs when the IDs do not match. Writing such a program goes through without complaint, because the session is served by the boot block and routines in RAM. It is the power cycle afterwards that bricks it.

The K-line driver

The boot block's driver reads the RxD pin as well as the UART. While the pin is low it holds a 300 ms quiet timer and takes no telegram. It has both the 5-baud wake-up and KWP2000 built in. firmware

See also

• Siemens MS45.1 DME - The engine computer of the 2003-on E46 six-cylinders
• Diagnostics and the K line - How the E46-era units talk on the K line, what their answers mean, and what the cables and adapters in between can carry