"Chipping" a CIS ECU - PeachParts Mercedes-Benz Forum

duxthe1 · #1 09-13-2019, 08:52 PM

I know anybody that clicked on this likely did so to tell me that it isn't a thing and that I'm an idiot. Certainly the former is true, and the latter is debatable.

Regardless, in the pursuit of better management for my modded 104.980, it is an endeavor I've decided to take up. Sure, I could go standalone and save an enormous amount of effort, but I've already done that with the turbo wagon. And... if I don't, who will?

It began as a project to build a piggyback EHA interceptor module. The first step of that project led me to build an Arduino based module that reads various engine parameters so that I could monitor what was happening so that I could be better informed about how to change it to my desires. I set it up with a nifty LCD screen with which I currently monitor the EHA current, air flow potentiometer voltage as well as display the rate of change of the air flow signal and rate of change of RPM. In standalone world, we'd call those two variables MAFDOT and RPMDOT, respectively. After kicking around how I'd generate positive and negative control currents for the EHA, I drew out the relevant circuitry in a CIS module, and well, its convoluted AF. Then the gears got turning... what about running the CIS module with my own microcontroller? That idea only lasted briefly until the revelation was... simply use the microcontroller already there and just make it do what I want.

The module I'm targeting is the later version which is a single board. A lot of what I'm doing will also apply to the earlier black box controllers as the later versions use the same microprocessor with a smaller EPROM

Here's what I know:

The microcontroller running the board is a variant of the INTEL 8051 built by Seimens known as the 80535. It has more features / ability than the 8051 but has similar architecture and the same instruction set.

The 80535 has no internal ROM memory. Its programming resides completely on an external EPROM. This is the chink in the CIS module's armor.

The EPROM is a 28 pin DIP package and is soldered directly to the circuit board. A good iron, chipquick, and desoldering braid can get it off, but it is not easy work.

The modules for different models are all the same excepting the programming on the EPROM. Each EPROM has a Bosch part number on the sticker covering its UV erase window.

So far I've removed the EPROM from a 1990 300TE's module. I have an EPROM reader / writer and have downloaded the programming from it. The EPROM is a 32 kilobyte part and the program is just shy of 20 kilobytes. Now the hard part is turning 20 kb of hexadecimal gibberish into useful info in regards to tuning. The first step is finding a disassembler to convert the hex back into assembler.

That's where I'm at. Google would have you believe its easy to find and download a disassembler, not so. I'll keep posting here as I make progress. Here's some pics of the EPROM getting a socket to make it a removable part.