BMW I/K-Bus Protocol

BMW I-Bus (Instrumentation Bus) and K-Bus (Body Bus) are proprietary single-wire, half-duplex communication buses used across BMW models from the late 1980s through the mid-2000s. Both use the same protocol at the data link layer — the difference is which modules are connected to which bus.

Message Format

Every message on the bus follows this structure:

Byte 0:  Source address        (which module sent this)
Byte 1:  Length                (count of remaining bytes: dest + data + checksum)
Byte 2:  Destination address   (target module, 0xBF = broadcast)
Byte 3:  Command type
Byte 4+: Data field(s)
Last:    Checksum              (XOR of all preceding bytes)

Example Message Breakdown

50 04 68 32 11 1F

Byte	Value	Meaning
0	0x50	Source: MFL (Multi-Function steering wheel)
1	0x04	Length: 4 bytes follow (dest + command + data + checksum)
2	0x68	Destination: RAD (Radio)
3	0x32	Command: volume control
4	0x11	Data: volume up
5	0x1F	Checksum: XOR of all preceding bytes

Checksum Calculation

XOR all bytes from source through the last data byte. The result must equal the final byte of the message.

0x50 ^ 0x04 ^ 0x68 ^ 0x32 ^ 0x11 = 0x1F

Length Field

The length byte counts the remaining bytes after itself: destination (1) + data (variable) + checksum (1). A minimum valid length is 0x03 (destination + one command byte + checksum). Maximum length is 0x24 (36 data bytes + overhead), giving a maximum raw message size of approximately 40 bytes.

UART Configuration

• Baud rate: 9600
• Framing: 8E1 (8 data bits, even parity, 1 stop bit)
• Bit time: 104.17 microseconds

Module Address Map

Address	ID	Module
0x00	GM5	Body control module
0x18	CDC	CD Changer
0x3F	DIA	Diagnostic computer
0x44	EWS	Immobilizer
0x50	MFL	Steering wheel controls
0x5B	IHKA	Climate control
0x68	RAD	Radio
0x6A	DSP	Digital Sound Processor
0x80	IKE	Instrument cluster
0xB0	SES	Speed-dependent volume
0xBF	ALL	Broadcast (all modules listen)
0xC8	TEL	Telephone
0xD0	LCM	Light Control Module
0xE7	ANZV	Display (phone status)
0xE8	RLS	Rain/Light Sensor
0xFF	LOC	Local (post-reset broadcast)

Address 0xBF is the broadcast address — all modules on the bus process messages sent to this destination. Address 0xFF is used by modules sending their first message after a power-on reset.

Bus Contention Protocol

BMW I/K-Bus is multi-master. Any module can transmit at any time, which means collisions are possible. The protocol uses a listen-before-talk strategy:

1. Monitor bus for activity — detect voltage transitions on the bus line (via TH3122 SEN/STA pin, or by monitoring the RX line with an optocoupler)
2. Wait for 1.5ms of bus silence — no transitions detected for at least 1500 microseconds
3. Begin transmitting — send the complete message
4. Maintain 10ms minimum gap between your own consecutive packets
5. Back off on collision — if bus activity is detected during your transmission, stop and retry after the next idle period

The 1.5ms idle window is long enough to distinguish between inter-byte gaps within a message (which are shorter) and actual end-of-message silence. At 9600 baud, the gap between bytes within a message is typically under 1ms.

Idle Detection on ESP32

Without the TH3122 transceiver IC (which provides a dedicated SEN/STA pin for bus activity), idle detection is done in software:

• A GPIO interrupt (CHANGE trigger) on the UART RX pin fires on every bus transition
• An esp_timer periodic callback runs every 250 microseconds
• The callback compares the current time against the last RX transition timestamp
• If the difference exceeds 1500 microseconds, the bus is considered idle

Worst-case detection latency is 1750 microseconds (idle timeout + timer period), well within the ~10ms inter-packet budget on a busy bus.

Bus Characteristics

Parameter	Value
Signaling	Single-wire, open-collector/drain
Idle state	HIGH (~12V on vehicle bus)
Active state	LOW (module pulling bus toward ground)
Bus access	Multi-master, listen-before-talk
Baud rate	9600
Framing	8E1 (even parity)
Checksum	XOR of all bytes
Max message	~40 bytes (source + length + 36 data + checksum)
Idle detect	1.5ms silence before transmitting
Packet gap	10ms minimum between own transmissions

Supported BMW Models

Chassis	Series	Years	I-Bus	K-Bus
E31	8 Series	1989-1999	Yes	—
E38	7 Series	1999-2001	Yes	Yes
E39	5 Series	1995-2004	Yes	Yes
E46	3 Series	1997-2006	—	Yes
E52	Z8	2000-2003	—	Yes
E53	X5	1999-2006	Yes	Yes
E83	X3	2003-2010	—	Yes
E85	Z4	2002-2008	—	Yes
E87	1 Series	2004-2013	—	Yes

I-Bus vs K-Bus

Both buses use the same protocol. The difference is which modules are connected:

• I-Bus connects infotainment modules: radio, CD changer, navigation, telephone, DSP. Found on higher-end models (E38, E39, E53).
• K-Bus connects body control modules: light control, instrument cluster, climate control, door locks, windows. Found on all listed models.

Some models (E38, E39, E53) have both buses. The GM5 body control module bridges messages between them when needed.

K-Bus Connection Points (E46)

CD Changer Connector

Located in the trunk, driver’s side. Connector designation X18180.

Pin	Wire Color	Signal
—	White/Red with Yellow dots	K-Bus
—	Brown	Ground
—	Red/Green	12V

K-Bus Junction Block

Located above the fuse box.

Pin	Wire Color	Signal
—	White/Red with Yellow dots	K-Bus

Use a separate 12V and GND source when connecting at the junction block.

Safety Considerations

The I/K-Bus has no authentication mechanism. Any properly formatted message with a valid checksum will be accepted and acted upon by the target module. This includes messages that control:

• Exterior and interior lighting
• Door locks and windows
• Wipers
• Instrument cluster displays

Always sniff bus traffic (RX only) before attempting any TX operations. Test with ignition OFF or key position 1 (accessories only) first. The optocoupler isolation protects the ESP32 from the car’s electrical system and the car from faults on the ESP32 side.