E30 M42 to Motronic 1.7.3 Conversion Project

[nando]

Do you look XDF for M1.7.3? What tables are you going to look for? :)

Tables will not help you in understanding the code, they will only harm you. Schematic and description of variables and bits in memory will help much more. Tables and values is a result of disassemble, not reference point.

actually, they do help - because you can see what they are doing in software, not just what they are. For example, you know that one constant affects another map, or a switch branches between two parameters, etc.

I don't consider it a complete disassembly unless the parameters are all mapped - an XDF isn't going to do that for you (but it can help). It's not about looking for definitions or tables at all. With a fully mapped out IDA project you can do interesting stuff with different software versions.

[Shock(/\)ave]

I've been following your efforts with extreme interest for the past few months. If this project is successful, we could finally have an upgrade path for the S14B23 and S38B35 motors from Motronic 1.0 among others.

Have you any idea what a completed board with components might cost? I have three cars which would benefit greatly from this project.

[Rasp]

had a brief look - nice start! I'm not so familiar with 8051 ASM, but it looks like if we can get IDA to map the data pointer correctly, it would reference all the maps automatically. That would be a big help for disassembly.

Do you look XDF for M1.7.3? What tables are you going to look for? :)

Tables will not help you in understanding the code, they will only harm you. Schematic and description of variables and bits in memory will help much more. Tables and values is a result of disassemble, not reference point.

[nando]

94% done.....

nando, I have made a directory called b91_ida_rev0 under Firmware on the dropbox. It has the IDA project that I started a while back and have not done much else on since working on the schematic.

had a brief look - nice start! I'm not so familiar with 8051 ASM, but it looks like if we can get IDA to map the data pointer correctly, it would reference all the maps automatically. That would be a big help for disassembly.

It's probably some sort of offset - like DPTR = 0x4000 (looking at the code without any knowledge of the data, that looks right?), so:
mov A, #0xA
movc A, @A+DPTR

would be A = 0x400A

Again, not super familiar with 8051 ASM, but that's what i would expect.

[Rasp]

Good news! Waiting for the final schematic.

[bmwman91]

Schematic is 100% translated and matching the PCB layout now. So the worst part is done. Now I am going to go through and try to give the various nets better names than the defaults (N0001, N0327, etc) so that things make more sense. Overall, it is obvious that M1.7.3 is related to M1.7, but the circuits do have a lot of differences.

[bmwman91]

94% done.....

nando, I have made a directory called b91_ida_rev0 under Firmware on the dropbox. It has the IDA project that I started a while back and have not done much else on since working on the schematic.

[nando]

Do you guys have an IDA project for this? I could contribute.

are the ASM files all the code? Looks pretty doable. The whole program looks smaller than the boot code on MSV70. :p

[bmwman91]

61% done.....

[bmwman91]

Layout is done being traced and I have checked it as much as I can for accuracy.

The schematic is now in progress, one connection at a time! I have made 475 out of the total 1184 terminal connections, so I am already 40% done with it. I figure it will take another week or so to finish, and then I can upload a copy to review for accuracy. I will also put up the ECAD files, although it will require anyone who is interested to install DesignSpark PCB and configure all the library paths for the project.

[bmwman91]

Nice! Sounds like some good progress. So much code...the PCB feels like the easy part to me. I am ~75% done tracing the layout, and then I can start building it into a schematic.

[Rasp]

Update RAM variables (mainly flags) and asm source code (few changes in clean, right disable EWS, previously implementation is worked, but) in Dropbox

[bmwman91]

Still working on filling in the layout. Making good progress, but it is a slightly slow process.

I also had some time after-hours at work to break open a few chips and look at their dies. Some did not survive since my method is "quick and dirty" but I think I have learned a couple of new techniques if I do it again in the future. Pics of the ones that did survive are in the Dropbox under Photos > Chip Dies. Most of them are MUCH simpler than the S702 chip that I took apart in the M1.7 thread. Except S700...there is a lot going on there, but since we have a datasheet, the images are only for fun.

[Rasp]

I am not sure BMW made a 4-wire harness for the M43 when there are only 2 "real" output channels lol...maybe it was less expensive to run the extra wire than to make additional junctions by the injectors.

4 thin wires are much cheaper than 2 thick wires, and as I know need much smaller cross-section. And of course dont forgot about M44, maybe its cheaper use same injector harness instead of difference for both.

Do you know what the resistance of the M43 injectors is? The M42's are ~15 Ohms.

15.9 Ohms as in M42, M40, M M20, M30, M50, M52 :)

[bmwman91]

Making progress. Tracing out the layout is moving along, and I think I am ~20% done. I also found an error in the official wiring diagram lol. The terminals for the cam position sensor are wrong...they are switched. The one labeled as being the cam sensor ground is actually the signal, and the other one is ground (so labels on pins 16 & 44 are switched). So actually, the wiring is the same as the E30 M1.7, and all of the E36 diagrams are mixed up (I have seen this error in E36 M1.7.2 diagrams too).

As for the 4 injector outputs, they are actually tied together on the PCB, so there is no issue with me continuing to use the existing 2-wire harness. I am not sure why BMW made a 4-wire harness for the M43 when there are only 2 "real" output channels lol...maybe it was less expensive to run the extra wire than to make additional junctions by the injectors. Also, the traces that run between the driver chip and output pins are a lot smaller than the ones in M1.7 (higher resistance). Do you know what the resistance of the M43 injectors is? The M42's are ~15 Ohms.

I am sure that I will discover more things as I go.