Flashing the MK60 with ZCP software

[terra]

So I came across this document. Perhaps the TI IC is the more significant one for our purposes (but would raise the question as to what the heck the Motorola/Freescale controller is for?)

https://www.scribd.com/document/3525...xOnPage:0,best Match:false

[karter16]

Take with a grain of salt since the MCU is motorola / freescale branded in all examples I've seen, but I came across this document:

https://www.scribd.com/document/3525...xOnPage:0,best Match:false

Very interesting! The other chip is certainly a TI chip. Interesting that that link also notes a “2 chip design” for redundancy. Could it possibly be two different MCU types are used to deliver that redundancy?


Sent from my iPhone using Tapatalk

[terra]

Very interesting! The other chip is certainly a TI chip. Interesting that that link also notes a “2 chip design” for redundancy. Could it possibly be two different MCU types are used to deliver that redundancy?


Sent from my iPhone using Tapatalk

Yep I just realized that looking at the photos again.

Could be, though seems a bit convoluted to use two different MCUs altogether for redundancy. My other that is it could be that one handles the ABS / stability control stuff and the other handles the communications with the rest of the car?

[karter16]

Yep I just realized that looking at the photos again.

Could be, though seems a bit convoluted to use two different MCUs altogether for redundancy. My other that is it could be that one handles the ABS / stability control stuff and the other handles the communications with the rest of the car?

That would certainly make more sense than two different chips sharing function, that would be next-level redundancy lol. I'll have a hunt later and see if that info about the TI chip helps narrow down what chipset it could be based on.


Sent from my iPhone using Tapatalk

[Bry5on]

Good luck! I dug pretty hard into my Rolodex but came up empty handed.

It was a bit tricky to trace the PCBA so I gave up on that as well, but we could answer the MCU question by following the traces as a last ditch.

[karter16]

Yeah - plus TI's catalogue is absolutely massive. I'm a bit more optimistic about the Motorola chip. I'm pretty confident it is also an MCU so still a good lead to follow.

[Bry5on]

Bare PCBA for the record. Guess I never posted these

[terra]

Yeah - plus TI's catalogue is absolutely massive. I'm a bit more optimistic about the Motorola chip. I'm pretty confident it is also an MCU so still a good lead to follow.

Yeah I agree it's definitely an MCU and perhaps more relevant for our purposes anyway. But does seem to be more custom than most of the other MCUs found in various modules of our cars. The mask (1L93E) doesn't seem to correspond to any publicly available MCUs.

Perhaps should take another crack at disassembling some of the winkfp files that correspond to the E6x generation MK60s. Presumably they'd use similar microcontrollers and would help narrow things down.

[karter16]

Yeah I agree it's definitely an MCU and perhaps more relevant for our purposes anyway. But does seem to be more custom than most of the other MCUs found in various modules of our cars. The mask (1L93E) doesn't seem to correspond to any publicly available MCUs.

Perhaps should take another crack at disassembling some of the winkfp files that correspond to the E6x generation MK60s. Presumably they'd use similar microcontrollers and would help narrow things down.

Good idea - so winkfp has binary data for the E6x generation units does it. I agree that it would be pretty likely that the microcontrollers would be of the same family at least.

FWIW my somewhat educated guess is that the TI chip is a TMS470 family variant. Package, pin count, clock speed and ROM size are all appropriate for the era, plus they are identified as being commonly used in Automotive ABS units, etc.

[Bry5on]

Oh man, maybe the move is to disassemble the e60 generation and modify the CAN IDs it transmits to so that it’s compatible with the e46.. I understand that some variants have programmable wheelbase, track, steering ratio, Ackerman, etc.

Just configure an e60 unit and install into an e46.

[karter16]

Oh man, maybe the move is to disassemble the e60 generation and modify the CAN IDs it transmits to so that it's compatible with the e46.. I understand that some variants have programmable wheelbase, track, steering ratio, Ackerman, etc.

Yeah the E5 variant right. That would be the ultimate if it's doable. I think it has a bunch of extra sensors over the E46 version though right


Sent from my iPhone using Tapatalk

[Bry5on]

Yeah the E5 variant right. That would be the ultimate if it's doable. I think it has a bunch of extra sensors over the E46 version though right


Sent from my iPhone using Tapatalk

I think it’s just the integral pressure sensors that replace the e46’s master cylinder sensors. heinzboehmer and I had discussed this before but I’ve forgotten.

[heinzboehmer]

I think it’s just the integral pressure sensors that replace the e46’s master cylinder sensors. heinzboehmer and I had discussed this before but I’ve forgotten.

That sounds about right.

Facelift E85/E86 Z4s came with an MK60 that looks suspiciously similar to an MK60e5, but can communicate with all the (admittedly frankensteined) E46 modules. Might be worth experimenting with getting the Z4 FW working on a regular e5, then go from there.

[terra]

That sounds about right.

Facelift E85/E86 Z4s came with an MK60 that looks suspiciously similar to an MK60e5, but can communicate with all the (admittedly frankensteined) E46 modules. Might be worth experimenting with getting the Z4 FW working on a regular e5, then go from there.

yeah the E85 facelift dsc is an mk60e5 that speaks the “old” cam bus language. It does have some of the more modern features like hill hold and brake drying (the latter depends on an extra can bus message from the cluster to tell the module if the rain sensor sees rain). I actually have one of those that I played with on a bench years ago. That should be feasible to get to work in our cars, though a custom mount would have to be made. Whether or not we can reprogram it beyond the small amount of NCS configurable data is another matter. From what i gather from my notes, i couldn't get any of the kwp2000 commands that would allow for sticking the module in flashing mode to work.

From what I have written down, the E9x M3 module is only secured by 512-bit RSA, so that should be trivial to flash with modified code and data if we figure out anything useful there (assuming we can find the public key to do the factoring on). I don't know how feasible it would make that work fully integrated into our cars (perhaps if the E85 variant of the code is still mostly in there). But for race car purposes, seems like having a K-line or Can-bus reprogrammable module would be useful

Edit:

So chucking a quickly converted DSCM90 0PA into cpu_rec, I get a hit for "mcore" - while that could be a false positive, those microcontrollers look period correct? Example of one https://www.digikey.com/en/products/...CFCPU33/506191

[George Hill]

I believe it's like most contemporary MCUs in that the rom with the actual code is integral to the MCU. The ST chip just contains the little bit of data that's 'codable' (VIN, NCS config data, and so on)

There were E6x/E9x generation BMWs with WinKFP flashable MK60 variants which might be useful from a research standpoint. But I couldn't even get as far as figuring out what ISA the code corresponds to.

Oh man, maybe the move is to disassemble the e60 generation and modify the CAN IDs it transmits to so that it’s compatible with the e46.. I understand that some variants have programmable wheelbase, track, steering ratio, Ackerman, etc.

Just configure an e60 unit and install into an e46.

Of course I just threw away an E60 module 2 weeks ago

Good thoughts!! I tossed that MK60 years ago but I’m sure we can get our hands on another

Cracking this code would be absolutely epic. Can you imagine m-track mode being the default and never needing to switch modes? What a luxury! I’ll get my hands on another and chop it open, unless George Hill already has one handy… 👀

I might have an E46 Non-M module kicking around here. I'll look.