Flashing the MK60 with ZCP software

[Bry5on]

Oh man, maybe the move is to disassemble the e60 generation and modify the CAN IDs it transmits to so that it’s compatible with the e46.. I understand that some variants have programmable wheelbase, track, steering ratio, Ackerman, etc.

Just configure an e60 unit and install into an e46.

[karter16]

Yeah I agree it's definitely an MCU and perhaps more relevant for our purposes anyway. But does seem to be more custom than most of the other MCUs found in various modules of our cars. The mask (1L93E) doesn't seem to correspond to any publicly available MCUs.

Perhaps should take another crack at disassembling some of the winkfp files that correspond to the E6x generation MK60s. Presumably they'd use similar microcontrollers and would help narrow things down.

Good idea - so winkfp has binary data for the E6x generation units does it. I agree that it would be pretty likely that the microcontrollers would be of the same family at least.

FWIW my somewhat educated guess is that the TI chip is a TMS470 family variant. Package, pin count, clock speed and ROM size are all appropriate for the era, plus they are identified as being commonly used in Automotive ABS units, etc.

[terra]

Yeah - plus TI's catalogue is absolutely massive. I'm a bit more optimistic about the Motorola chip. I'm pretty confident it is also an MCU so still a good lead to follow.

Yeah I agree it's definitely an MCU and perhaps more relevant for our purposes anyway. But does seem to be more custom than most of the other MCUs found in various modules of our cars. The mask (1L93E) doesn't seem to correspond to any publicly available MCUs.

Perhaps should take another crack at disassembling some of the winkfp files that correspond to the E6x generation MK60s. Presumably they'd use similar microcontrollers and would help narrow things down.

[Bry5on]

Bare PCBA for the record. Guess I never posted these

[karter16]

Yeah - plus TI's catalogue is absolutely massive. I'm a bit more optimistic about the Motorola chip. I'm pretty confident it is also an MCU so still a good lead to follow.

[Bry5on]

Good luck! I dug pretty hard into my Rolodex but came up empty handed.

It was a bit tricky to trace the PCBA so I gave up on that as well, but we could answer the MCU question by following the traces as a last ditch.

[karter16]

Yep I just realized that looking at the photos again.

Could be, though seems a bit convoluted to use two different MCUs altogether for redundancy. My other that is it could be that one handles the ABS / stability control stuff and the other handles the communications with the rest of the car?

That would certainly make more sense than two different chips sharing function, that would be next-level redundancy lol. I'll have a hunt later and see if that info about the TI chip helps narrow down what chipset it could be based on.


Sent from my iPhone using Tapatalk

[terra]

Very interesting! The other chip is certainly a TI chip. Interesting that that link also notes a “2 chip design” for redundancy. Could it possibly be two different MCU types are used to deliver that redundancy?


Sent from my iPhone using Tapatalk

Yep I just realized that looking at the photos again.

Could be, though seems a bit convoluted to use two different MCUs altogether for redundancy. My other that is it could be that one handles the ABS / stability control stuff and the other handles the communications with the rest of the car?

[karter16]

Take with a grain of salt since the MCU is motorola / freescale branded in all examples I've seen, but I came across this document:

https://www.scribd.com/document/3525...xOnPage:0,best Match:false

Very interesting! The other chip is certainly a TI chip. Interesting that that link also notes a “2 chip design” for redundancy. Could it possibly be two different MCU types are used to deliver that redundancy?


Sent from my iPhone using Tapatalk

[terra]

So I came across this document. Perhaps the TI IC is the more significant one for our purposes (but would raise the question as to what the heck the Motorola/Freescale controller is for?)

https://www.scribd.com/document/3525...xOnPage:0,best Match:false

[Bry5on]

Appreciate I’m some years late to this, came across this thread looking for something else and it intrigued me.

I’m pretty certain that the Motorola chip is actually the main controller/processor for the fact that it is the chip that has the crystal attached to it. Looking at 100 pin packages in common use at the time I’m thinking it could be a variant of the MC68HC16 (which would have been an appropriate choice when the MK60 was designed). For example the S2 variant is a possibility as the crystal pins XTAL and EXTAL are pins 36 and 38 which matches what we see the crystal connected to on the board. The bit I'm not sure about is where the ROM is located. Do you have any photos of the other side of the board? That would help with identifying it.

Edit: actually I think the ST 95042U3 chip might be the EEPROM. Would be useful to confirm what pins on the Motorola chip it's connected to.

Re the TI chip I think it’s maybe a custom ASIC for controlling the hardware, it sits on the headers side of the board and some very similar part numbers are labeled on some 3rd party sites as “Teves PCU60”. I’m guessing “PCU” stands for “Pump Control Unit” or something similar.

Good thoughts!! I tossed that MK60 years ago but I’m sure we can get our hands on another

Cracking this code would be absolutely epic. Can you imagine m-track mode being the default and never needing to switch modes? What a luxury! I’ll get my hands on another and chop it open, unless George Hill already has one handy… 👀

[karter16]

I believe it's like most contemporary MCUs in that the rom with the actual code is integral to the MCU. The ST chip just contains the little bit of data that's 'codable' (VIN, NCS config data, and so on)

There were E6x/E9x generation BMWs with WinKFP flashable MK60 variants which might be useful from a research standpoint. But I couldn't even get as far as figuring out what ISA the code corresponds to.

Yeah that would make sense for sure. There's a bunch of standard part Motorola MCUs of the time that have internal rom, but all in 112 or 144 pin packages. (Which may of course be where the custom part comes in). Would be interesting to trace the (presumed) BDM pins and see where they end up. That would be another potential way to help narrow down the chip.


Sent from my iPhone using Tapatalk

[terra]

Appreciate I’m some years late to this, came across this thread looking for something else and it intrigued me.

I’m pretty certain that the Motorola chip is actually the main controller/processor for the fact that it is the chip that has the crystal attached to it. Looking at 100 pin packages in common use at the time I’m thinking it could be a variant of the MC68HC16 (which would have been an appropriate choice when the MK60 was designed). For example the S2 variant is a possibility as the crystal pins XTAL and EXTAL are pins 36 and 38 which matches what we see the crystal connected to on the board. The bit I'm not sure about is where the ROM is located. Do you have any photos of the other side of the board? That would help with identifying it.

Edit: actually I think the ST 95042U3 chip might be the EEPROM. Would be useful to confirm what pins on the Motorola chip it's connected to.

Re the TI chip I think it’s maybe a custom ASIC for controlling the hardware, it sits on the headers side of the board and some very similar part numbers are labeled on some 3rd party sites as “Teves PCU60”. I’m guessing “PCU” stands for “Pump Control Unit” or something similar.

I believe it's like most contemporary MCUs in that the rom with the actual code is integral to the MCU. The ST chip just contains the little bit of data that's 'codable' (VIN, NCS config data, and so on)

There were E6x/E9x generation BMWs with WinKFP flashable MK60 variants which might be useful from a research standpoint. But I couldn't even get as far as figuring out what ISA the code corresponds to.

[karter16]

in the mean time, can anybody ID this Motorola IC?

Appreciate I’m some years late to this, came across this thread looking for something else and it intrigued me.

I’m pretty certain that the Motorola chip is actually the main controller/processor for the fact that it is the chip that has the crystal attached to it. Looking at 100 pin packages in common use at the time I’m thinking it could be a variant of the MC68HC16 (which would have been an appropriate choice when the MK60 was designed). For example the S2 variant is a possibility as the crystal pins XTAL and EXTAL are pins 36 and 38 which matches what we see the crystal connected to on the board. The bit I'm not sure about is where the ROM is located. Do you have any photos of the other side of the board? That would help with identifying it.

Edit: actually I think the ST 95042U3 chip might be the EEPROM. Would be useful to confirm what pins on the Motorola chip it's connected to.

Re the TI chip I think it’s maybe a custom ASIC for controlling the hardware, it sits on the headers side of the board and some very similar part numbers are labeled on some 3rd party sites as “Teves PCU60”. I’m guessing “PCU” stands for “Pump Control Unit” or something similar.

[thegenius46m]

Great info! Would be awesome if you can flash a race ABS onto the non-M MK60. I have an M3 MK60 booster and master I can loan out for testing if you need it.



Not sure the ABS unit can be changed or even flashed for SpecE46. No changes unless it is specifically allowed by the rules.

Yup then that even further reinforces my point haha. But they're actually running the less agressive bauart_mk60 abs parameter and appear to be fine.