BMW DS2 Protocol Frame Structure (MS41, MS42, MS43)
Diagnostics, ECU flashing, and live telemetry across BMW generations operate through four standardized protocols:
┌──────────────────────────────────────────────────────────────────────────────────────────────────┐
│ DIAGNOSTIC PROTOCOL HIERARCHY & BANDWIDTH EVOLUTION │
├──────────────────────────────────────────────────────────────────────────────────────────────────┤
│ │
│ 1. BMW DS2 PROTOCOL (K-Line @ 9600 Baud / MS41, MS42, MS43): │
│ • Point-to-point serial communication over single ISO 9141 K-Line (OBD Pin 7). │
│ • Payload: Diagnostic request packets (Header + Length + Target ID + Command + XOR Checksum)│
│ • Sample Rate Ceiling: Sluggish 4 Hz to 8 Hz polling rate. │
│ │
│ 2. KWP2000 DIAGNOSTICS (K-Line or CAN @ 10,400 to 125,000 Baud / MS45.0, EDC15, EDC16): │
│ • Keyword Protocol 2000 (ISO 14230). Defined in database by if_kwp6.a2l. │
│ • Supports local identifier polling and flash routine downloading. │
│ │
│ 3. CAN CALIBRATION PROTOCOL (CCP v2.1 @ 500 kbps / MS45.1, MSS54, MSD80): │
│ • Master-Slave protocol running directly over PT-CAN bus. Defined by If_ccp4.a2l. │
│ • Synchronous Data Acquisition (DAQ) lists streaming internal RAM variables at 50 Hz! │
│ │
│ 4. UDS OVER CAN & DOIP (ISO 14229 & ISO 13400 / MEVD17, MG1, DME8): │
│ • Unified Diagnostic Services over CAN (500 kbps) and Diagnostic over IP (100 Mbps Ethernet)│
└──────────────────────────────────────────────────────────────────────────────────────────────────┘
20.1 BMW DS2 Protocol Frame Structure (MS41, MS42, MS43)#
BMW DS2 communicates half-duplex at 9600 ext{ baud} (8 ext{ data bits}, 1 ext{ stop bit}, even or no parity) over the single OBD-II pin 7 K-Line: ext{Frame Structure: } [ ext{Target Address}] \quad [ ext{Length}] \quad [ ext{Command}] \quad [ ext{Data Payload}\dots] \quad [ ext{XOR Checksum}]
- Target Address for Engine DME is
0x12. - Checksum is the bitwise exclusive-OR (ext{XOR}) of all bytes preceding the checksum byte.
def build_ds2_packet(target_addr: int, cmd: int, payload: bytes = b"") -> bytes:
length = 3 + len(payload)
packet_body = bytes([target_addr, length, cmd]) + payload
checksum = 0
for byte in packet_body:
checksum ^= byte
return packet_body + bytes([checksum])
# Example: Read ECU Identification (Hardware/Software Number)
packet_ident = build_ds2_packet(0x12, 0x00) # b' '
20.2 CAN Calibration Protocol (CCP v2.1) High-Speed DAQ Streaming#
Cataloged in the DAMOS archives by If_ccp4.a2l, CCP v2.1 provides professional-grade calibration acquisition on MS45.1, MSS54, and MSD80:
- Bus Medium: Operates over standard 500 ext{ kbps} PT-CAN using two 11-bit CAN identifiers:
- Synchronous DAQ Lists: Rather than repeatedly sending memory read requests, the calibration tool sends a one-time configuration defining a Data Acquisition (DAQ) List:
- Data Throughput: Achieves 50 ext{ Hz} to 100 ext{ Hz} refresh rates, capturing transient knock retard events and rapid boost spikes invisible to standard OBD-II scanners.