Parts Catalog Accessories Catalog How To Articles Tech Forums
Call Pelican Parts at 888-280-7799
Shopping Cart Cart | Project List | Order Status | Help



Go Back   PeachParts Mercedes-Benz Forum > Mercedes-Benz Tech Information and Support > Mercedes-Benz Performance Paddock

Reply
 
LinkBack Thread Tools Display Modes
  #1  
Old 09-13-2019, 09:52 PM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
"Chipping" a CIS ECU

I know anybody that clicked on this likely did so to tell me that it isn't a thing and that I'm an idiot. Certainly the former is true, and the latter is debatable.
Regardless, in the pursuit of better management for my modded 104.980, it is an endeavor I've decided to take up. Sure, I could go standalone and save an enormous amount of effort, but I've already done that with the turbo wagon. And... if I don't, who will?

It began as a project to build a piggyback EHA interceptor module. The first step of that project led me to build an Arduino based module that reads various engine parameters so that I could monitor what was happening so that I could be better informed about how to change it to my desires. I set it up with a nifty LCD screen with which I currently monitor the EHA current, air flow potentiometer voltage as well as display the rate of change of the air flow signal and rate of change of RPM. In standalone world, we'd call those two variables MAFDOT and RPMDOT, respectively. After kicking around how I'd generate positive and negative control currents for the EHA, I drew out the relevant circuitry in a CIS module, and well, its convoluted AF. Then the gears got turning... what about running the CIS module with my own microcontroller? That idea only lasted briefly until the revelation was... simply use the microcontroller already there and just make it do what I want.

The module I'm targeting is the later version which is a single board. A lot of what I'm doing will also apply to the earlier black box controllers as the later versions use the same microprocessor with a smaller EPROM

Here's what I know:

The microcontroller running the board is a variant of the INTEL 8051 built by Seimens known as the 80535. It has more features / ability than the 8051 but has similar architecture and the same instruction set.

The 80535 has no internal ROM memory. Its programming resides completely on an external EPROM. This is the chink in the CIS module's armor.

The EPROM is a 28 pin DIP package and is soldered directly to the circuit board. A good iron, chipquick, and desoldering braid can get it off, but it is not easy work.

The modules for different models are all the same excepting the programming on the EPROM. Each EPROM has a Bosch part number on the sticker covering its UV erase window.


So far I've removed the EPROM from a 1990 300TE's module. I have an EPROM reader / writer and have downloaded the programming from it. The EPROM is a 32 kilobyte part and the program is just shy of 20 kilobytes. Now the hard part is turning 20 kb of hexadecimal gibberish into useful info in regards to tuning. The first step is finding a disassembler to convert the hex back into assembler.

That's where I'm at. Google would have you believe its easy to find and download a disassembler, not so. I'll keep posting here as I make progress. Here's some pics of the EPROM getting a socket to make it a removable part.

Attached Thumbnails
"Chipping" a CIS ECU-eprom-removed.jpg   "Chipping" a CIS ECU-eprom-socket-installed.jpg   "Chipping" a CIS ECU-eprom-socket.jpg  
__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff
Reply With Quote
  #2  
Old 09-14-2019, 04:55 AM
okyoureabeast's Avatar
Rogue T Tolerant
 
Join Date: Jul 2009
Location: North America
Posts: 1,660
I love hacks, but if you're after improvement , why not do a megasquirt upgrade?

You'd get the benefits of a fuel rail and pulse injection vs constant injection which is much more ineffecient.
__________________
-Typos courtesy of my mobile phone.
Reply With Quote
  #3  
Old 09-14-2019, 10:30 AM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
Been there, done that. I've got MS2-E on my turbo'd wagon and I love it. If you're gonna boost any of these engines, its absolutely the way to go. On my '90 300 CE I've decided to keep it naturally aspirated so the CIS, in theory, is completely capable of meeting its fueling demands. If, big if, I pull this off, it can positively impact the whole of the classic MB community.

This type of hacking, has 3 stages. Stage 1 is finding a better performing module and simply copying its program. This alone has good potential for me since my monitoring has shown that my California version has no WOT enrichment. It stays in closed loop with the full load contact closed all the way to redline. No Bueno. The hard part is actually sourcing better performing ECUs. If you look around online you'll find that old skool Porsce and VW guys with CIS already got this much figured out for their platforms.

Stage 2 is modifying existing programming. This is where I'd like to get to. It is also monumentally difficult for someone not from a programming background. Not impossible, but very, very difficult. The upside to pulling this off is equally rewarding. Aside from altering fueling, the potential exists to change the data communicated with the EZL, turn off things like EGR, and alter the idle speed. Everyone knows these engines tend to overheat, and at hot low idle speed it doesn't matter how much air you move though the radiator, the water pump isn't moving enough coolant to keep the temps down. I'd love to bump the hot engine idle speed target up about 150-200 RPM.

Stage 3 is writing my own new code. Of the approx. 20 kilo bytes in the existing program, at least 1/2 to 3/4 has to be bloat. An early black box ROM dump is only 5KB in size and even that could be whittled down since the CIS only has to do a few things. Control idle speed, control EHA, serial communicate with the EZL. Cold start injector would be nice as well as evap solenoid control but not absolutely necessary. This scratch built code of course would *ahem* be only for off road use. This is likely easier than stage 2 since it really only involves learning how to code for the 80535, and not also deciphering a bunch of code targeted at the 80535. Down side of course is not having the development Bosch / MB put into this module to begin with.
__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff
Reply With Quote
  #4  
Old 09-14-2019, 11:03 AM
Registered User
 
Join Date: Jan 2012
Posts: 7,489
There was a guy that offered a fix it chip for an emission problem on a LH system. Not sure if there is any CIS info on his site or not. The guys site is https://www.k6jrf.com/MB_S500.html

Care to post the .bin file you extracted? There are online bin to hex converters that can let us look at the file. hex-works.com http://en.webhex.net/

Since this is a pretty basic system, you might be able to look for values that are similar, call this a table then change values some % and look for results. Having a bench setup to run the computer would be beneficial as you can turn dials to mimic inputs and look at the results rather than driving a car and having varying inputs.
Reply With Quote
  #5  
Old 09-14-2019, 05:57 PM
whipplem104's Avatar
Registered User
 
Join Date: Oct 2008
Location: seattle
Posts: 1,175
Just get a Franken CIS. They are not very expensive and seem really well sorted. I know you just want to do it yourself but it actually looks really nice.
Reply With Quote
  #6  
Old 09-14-2019, 05:58 PM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
Pulling a harness from the junkyard to use to build a test bench is high on the to-do list. One of the most pressing tasks is to map the microcontrollers inputs and outputs to their respective inputs and outputs on the module. Once I can assign register addresses to their respective functions, it will go a long way towards understanding what the code is doing.

I'm not too sure about this but I don't think there is going to be traditional lookup tables like EFI modules. The basic mapping in CIS is handled mechanically and the CIS module only serves as a fine trim to the basic injection.

The CIS provides transient enrichment up to 60 degrees C. I've noticed up to ~+20 mA EHA current when it is active. I'd like to find the function responsible for this and eliminate the 60C cutoff. This alone could make a noticeable improvement in throttle response.

I've attached 2 zipped bin files. They are named according to the bosch number on the EPROM. The 464 is from a random late black box CIS controller and the 973 is from a 90-91 300TE 4-M.

Just FYI, I'm actively looking for 300SL and '90+ 300CE federal CIS modules. Not looking to spend much, and/or would convert to socketed EPROM in exchange.
Attached Files
File Type: zip 2 287 356 464.zip (5.8 KB, 12 views)
File Type: zip 2 287 356 973.zip (13.4 KB, 9 views)
__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff
Reply With Quote
  #7  
Old 09-14-2019, 09:51 PM
Registered User
 
Join Date: Jan 2012
Posts: 7,489
I've poked around and found.

464

1700 to 17F0 ALL FF ( NO DATA , looks like tables below )

1900 20 20 20 20 1C 1C 1C 1C 1C 1C 14 14 12 12 10 10

1FF0 looks like an incomplete read should go to 7FD0 like the bin below




973

1700 to 17F0 ALL FF ( NO DATA looks like tables below )

1900 20 20 20 20 1C 1C 1C 1C 1C 1C 14 14 12 12 10 10

4120 to 4150 looks like lots of similar data / increasing and decreasing.



7FC0 0 280 800 449 01 / 6 ( I've put 0 280 800 449 01 in a Bosch PN spacing format )

7FD0 302038.28 386 I'm not sure what this is
Reply With Quote
  #8  
Old 09-15-2019, 12:27 AM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
Quote:
Originally Posted by whipplem104 View Post
Just get a Franken CIS. They are not very expensive and seem really well sorted. I know you just want to do it yourself but it actually looks really nice.
If I was going to do the standalone route, I'd go with an MS3. Going standalone and keeping CIS.... I just don't think I could bring myself to do it. While tuning the CIS module is definitely the long way around, what I learn along the way will be even more valuable than the tuned module.
__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff
Reply With Quote
  #9  
Old 09-15-2019, 12:37 AM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
Quote:
Originally Posted by 97 SL320 View Post

7FC0 0 280 800 449 01 / 6 ( I've put 0 280 800 449 01 in a Bosch PN spacing format )

7FD0 302038.28 386 I'm not sure what this is
I noticed the bosch number too. Odd thing is that it isn't the module's part# or the EPROM's part#, nor any of the bosch numbers silkscreened on the circuit board.

I've played around disassembling a bit of the code manually. I found about 30 instructions that form a loop that exits with a CJNE (compare jump if not equal) command. Without having any of the registers mapped to the module, I haven't clue yet what any of it does.

Quote:
Originally Posted by 97 SL320 View Post


1FF0 looks like an incomplete read should go to 7FD0 like the bin below

The 454 EPROM is only 8kb, where the later 793 is a 32kb chip.
__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff

Last edited by duxthe1; 09-15-2019 at 01:08 AM.
Reply With Quote
  #10  
Old 09-17-2019, 01:37 AM
Registered User
 
Join Date: Aug 2013
Location: Los Angeles
Posts: 27
Following!
__________________
w201 + m103.983 swap
Reply With Quote
  #11  
Old 09-20-2019, 11:01 PM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
Over the past week a small bit of progress was made.

I found a disassembler tool to convert the hex instructions back into assembler using the 8051 instruction set. Given that the bosch part number appears a the end of the program if converted into ascii, the endian-ness is fairly certain to be correct.

While the disassembler is VERY helpful, it only does so much. Making sense of the assembler instructions is still a daunting task. I have translated and commented the first block of code that initializes several of the port registers. I still don't have the port registers mapped to functions of the module hardware yet. Excepting, that I do have 3 inputs traced to their analog input pins of the microcontroller. AN2 is intake air temp, AN4 is the airflow potentiometer voltage, and AN5 is engine coolant temp.

Given that a start to finish interpretation of the program would be a fools errand, I've begun trying to identify certain functions within the code. So far I have divined the locations in the code where analog to digital conversions occur. Another utility, separate from the disassembler, has a very easy search feature that I can use to look for an ADC register value. In this instance D8h is the register defining (among other things) which of the 8 analog to digital channels to sample, so a search for D8 turns up a bunch of hits. My understanding of the assembler instructions is good enough to tell which hits are actual ADC reads and which are simply portions of code randomly using the value D8h (216 decimal). I have noted that all 8 channels are used as there are instructions for reading all 8 of them.

While I have learned where all the ADC reads occur, I have yet to decipher where the values are being stored in memory. ADC reads takes 13 cycles to complete and in the mean time the code jumps to another location that contains another bunch of conditional jumps. I haven't been able to spend the time yet work through them to determine where the ADC values are being stored. Once I do, I'll be able to search for references to those locations and hopefully begin making sense of the code related to them.
__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff
Reply With Quote
  #12  
Old 09-20-2019, 11:51 PM
Registered User
 
Join Date: Jan 2012
Posts: 7,489
Quote:
Originally Posted by duxthe1 View Post

The 454 EPROM is only 8kb, where the later 793 is a 32kb chip.
Given these computers are driving the same system, I would not expect there to be that much of a difference in actual program length. Have you done a file compare to see if there is any coding overlap?

Have have you tried to read the 454 EPROM as a 32 chip and do the chips have standard markings of are they marked with Bosch numbers ? As long as the pin out is the same, you should just get FF FF FF or 00 00 00 in all the tail end fields if you try to read more data from a smaller chip.
Reply With Quote
  #13  
Old 09-21-2019, 02:07 AM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
Most ICs on these boards only have a bosch number, several of which I have not been able to cross reference.

I really haven't done anything with the 454's program. My coupe uses the later single board module and that is where I'm focusing my efforts. I'm very keen on getting my hands on other versions of the single board module to do comparisons. There is significant peripheral hardware differences between the early black boxes and the later single board modules as well as an increase in pinouts and functions. So much so that I can't really see the value of decoding one in an effort to understand the other, especially this early in the process. Much, much further down this path, maybe
__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff
Reply With Quote
  #14  
Old 09-28-2019, 12:22 AM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
Another week passed and more progress made. I found a decent 8051 emulator that can step through the code instruction by instruction and watch some of what's happening. Its helped me figure out a few things, like where the analog reads are being stored in RAM. The emulator is also very helpful with figuring out where jumps go. A lot of assembler commands jump around inside the program and figuring the address jumped to is a rather convoluted process. The emulator works out the jumps no problem. Major hair pulling saved there.

The emulator isn't very interactive but I've figured out how to test conditional jumps (ie jump if bit set) by deleting the instruction and rewriting its inverse. (jump if bit not set). This helped figure out the analog reads. Turns out the jump if bit set instruction in question jumps to itself, literally waiting for the read to finish (clearing the busy bit) before continuing with the program. As simple as that seems, it wasn't immediately obvious. With that figured out the remaining two instructions do an indirect addressing of the register that stores the value of the analog read.

The other progress this week was pulling the microcontroller off the circuit board and beginning mapping the pins to the CIS functions. I've located the pins controlling the EHA and the idle valve. Several pins remains unmapped but those two are the big ones. I also figured out how to actually power up the module. Battery power, switched power, and ground are obvious, but there is also a signal ground, that if not connected to main ground will not allow the module to power on. That took a bit to figure out.

All in all, progress grinds slowly forward.
__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff
Reply With Quote
  #15  
Old 10-04-2019, 09:27 PM
Registered User
 
Join Date: Oct 2004
Posts: 3,413
Another weekly progress report...

I've dug though some old wiring and realized I had a 55 pin CIS module harness with about 20" of wiring with the connector. With the harness connected, a bit of time spent trying to match functions to microcontroller pins, though not a lot of progress there. I did solder a 10 ohm resistor across the EHA wires to make a current measurement easy.

Perusing WIS on CIS and EZL functions I came across the info about the CIS trim resistor. We didn't get the CIS trim resistor here in the States, but select modules worldwide had the potential to change enrichment maps based on a selected resistance. My US harness isn't even populated for the contacts that the resistor connects to. I did however find that the trim resistor pin goes to the microcontroller's analog input pin 3. The interesting thing is that all 8 analog channels get read so in theory it may be possible to select one of the alternate maps, either with hardware or software.

Lastly I did a bit of poking around on another "973" module and determined that the EHA's microcontroller pin uses a pulsewidth to control the circuitry. 1kHz on the pin equates to 20mA EHA current. I recall somewhere in WIS mentioning that the CIS "switches polarity" of the EHA current referencing decel fuel cut. I think it may have been literal and there is likely a microcontroller pin that actually signals a switch to negative current on the EHA.

Lastly I drew out all of the special function registers that are initialized and populated them with the initial values as well as their functions.

It doesn't feel like a lot of progress this week but a fair amount of time was spent reading about and studying 8051 programming. A bit better familiarity with the microcontroller should help me understand what the software is actually doing. I've ordered one of the best books on the subject, but don't expect it until later next week.

__________________
90 300TE 4-M

Turbo 103, T3/T04E 50 trim
T04B cover .60 AR
Stage 3 turbine .63 AR
A2W I/C, 40 LB/HR
MS2E, 60-2 Direct Coil Control
3" Exh, AEM W/B O2
Underdrive Alt. and P/S Pulleys,
Vented Rear Discs, .034 Booster.
3.07 diffs 1st Gear Start

90 300CE 104.980
Milled & ported head, 10.3:1 compression
197 intake cam w/20 advancer
4 ignition advance
PCS TCM2000, built 722.6
600W networked suction fan
Sportline sway bars
V8 rear subframe, Quaife ATB 3.06 diff
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On
Trackbacks are On
Pingbacks are On
Refbacks are On




All times are GMT -4. The time now is 12:40 AM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2019, vBulletin Solutions, Inc.
Search Engine Optimization by vBSEO 3.6.0
Copyright 2018 Pelican Parts, LLC - Posts may be archived for display on the Peach Parts or Pelican Parts Website -    DMCA Registered Agent Contact Page