Skip to content
BMW DME / Part VIII / 16 BMW Serial EEPROM Architecture (93C86 / ST9…
⌕/
Source
DOC 37 § 16
Contents
The BMW EWS Individual Serial Number (ISN) Architecture and 1 more
Systems covered
`MS42`, `MS43`, `MSS54`, `ME7.2`, `MS45.0`, `MS45.1`, `ME9.2`, `MSD80`, `MSD81`, `MEVD17` … +4 more
Size
0 tables · 2 code/diagrams · ~479 words

The BMW EWS Individual Serial Number (ISN) Architecture

While the engine calibration maps reside in parallel Flash ROM (29F400 / 29F800), critical vehicle identity, immobilizer cryptographic keys, variant coding, and adaptive trim wear parameters reside in non-volatile serial EEPROM:

┌──────────────────────────────────────────────────────────────────────────────────────────────────┐  
│                   BMW DME SERIAL EEPROM HARDWARE CHIP ARCHITECTURE                               │  
├──────────────────────────────────────────────────────────────────────────────────────────────────┤  
│                                                                                                  │  
│   1. Microchip / ST 93C86 (2048 Bytes / 16-bit Microwire SPI):                                   │  
│      • Utilized on: Siemens MS42, MS43, MSS54, and Bosch ME7.2                                   │  
│      • Physical Package: 8-Pin SOIC mounted adjacent to main C167CR microcontroller              │  
│                                                                                                  │  
│   2. STMicroelectronics 95080 / 95160 (1024 / 2048 Bytes / High-Speed SPI):                     │  
│      • Utilized on: Siemens MS45.0, MS45.1, and Bosch ME9.2                                      │  
│                                                                                                  │  
│   3. Embedded Data Flash / Emulated EEPROM in TriCore TC1796 (DFLASH 64 KB):                     │  
│      • Utilized on: Siemens MSD80, MSD81, and Bosch EDC17 / MEVD17                               │  
└──────────────────────────────────────────────────────────────────────────────────────────────────┘

16.1 The BMW EWS Individual Serial Number (ISN) Architecture#

The Elektronische Wegfahrsperre (EWS) anti-theft system validates engine start through cryptographic challenge-response handshakes between the EWS module (or CAS / Car Access System) and the DME:

┌──────────────────────────────────────────────────────────────────────────────────────────────────┐  
│                   BMW ISN IMMOBILIZER GENERATIONAL EVOLUTION                                     │  
├───────────────────────────────────┬───────────────────┬───────────────────┬──────────────────────┤  
│ DME Generation & Model            │ ISN Format        │ EEPROM Offset     │ Security Mechanism   │  
├───────────────────────────────────┼───────────────────┼───────────────────┼──────────────────────┤  
│ Bosch M3.3.1 (E36 325i)           │ 2-Byte Short Hex  │ 0x002C - 0x002D   │ EWS-II Fixed Code    │  
│ Siemens MS41 (E36 328i)           │ 2-Byte Short Hex  │ 0x0034 - 0x0035   │ EWS-II Fixed Code    │  
│ Siemens MS42 (E46 328i)           │ 2-Byte Short Hex  │ 0x00C4 - 0x00C5   │ EWS-3.2 Rolling Code │  
│ Siemens MS43 (E46 330i)           │ 2-Byte Short Hex  │ 0x00C4 - 0x00C5   │ EWS-3.3 Rolling Code │  
│ Siemens MS45.0 / MS45.1           │ 16-Byte Crypt Key │ 0x0280 - 0x028F   │ EWS-3+ / CAS2 Rolling│  
│ Siemens MSS54 / MSS54HP (E46 M3)  │ 2-Byte + Rolling  │ 0x0120 - 0x0121   │ EWS-3.3 Rolling Code │  
│ Siemens MSD80 / MSD81 (N54)       │ 16-Byte / 32-Byte │ TC1796 DFLASH     │ CAS3+ 128-bit AES    │  
│ Bosch MEVD17 / MG1 (N55/B58)      │ 32-Byte Secret Key│ HSM Protected     │ CAS4 / FEM / BDC AES │  
└───────────────────────────────────┴───────────────────┴───────────────────┴──────────────────────┘

16.2 DME "Virginizing" & Synchronization Procedures#

When replacing a damaged DME with a used donor unit, the donor DME rejects startup because its internal rolling code counter differs from the vehicle's EWS module:

  1. Virginizing (Setting Virgin State): In the 93C86 EEPROM (MS42/MS43), the 16 bytes representing the EWS rolling code table (located at 0x00D0 to 0x00DF) are overwritten with 0xFF.
  2. First Key-On Cycle: Upon powering the DME in the vehicle, the DME detects the uninitialized 0xFF state, initiates a pairing handshake with the EWS3 module, reads the vehicle’s master rolling code base, and locks the key into EEPROM permanently.
  3. INPA / Tool32 Synchronization: Running standard EDIABAS job MS430.PRG -> ews3_abgleich re-aligns the seed table across both modules within 3 seconds.