![inpa bmw code 78 m60 inpa bmw code 78 m60](https://www.cnautotool.com/images/201205/goods_img/1713_P_1338271472147.jpg)
I think one of the key things we need to do is to be sure what is connected to each pin of the MCU so we can work out what it is expecting to sense with each piece of read code. This one is going to become a bench test ECU if I can map out the pins without scrapping it using a logic analyzer as you suggest.
![inpa bmw code 78 m60 inpa bmw code 78 m60](https://i.ytimg.com/vi/c1mq6Fllp9k/maxresdefault.jpg)
I might have to get my hands on a logic analyzer as well, seems they are no so bad price wise now but I will have to do some research to avoid buying ebay junk. I will add the BIN to the folder with the others once I rip it. I just got hold of a 484 V8 M3.3 ecu, not sure if it is a 3l or 4l ecu but it was super cheap as it is an EWS version of the V8 404 and people here dont seem to understand they are all the same bar the software.
![inpa bmw code 78 m60 inpa bmw code 78 m60](http://www.toyking.com.tw/image/toy/bandai/2018/07/225756.jpg)
So i can see the sequence of reading rom and reading/writing ram. I bought a cheap 32ch logic analyzer, so i can hook it on address bus, data bus and chip control lines. If there is something multiplexed inputs/outputs, i can try to trace them also. I can trace more, it's such easy with 2ch oscilloscope. If i remember, some of inputs and outputs are multiplexed. If there is no signal from any cylinders, secondary current monitoring fault code appears, and secondary current monitoring is disabled. Ecu is "listening" this pin after every ignition event, and if there is no "snap", it will shut fuelling off from this cylinder and relevant fault code appears. That "spark detected" is used for diagnostics and limp mode. Some CPU pin data from my notes: (413 ecu)ĩ = P0.7 AHC7 = Signal from knock sensor controller IC: knock signal level?ġ1 = P0.4 ACH4 = Other signal from knock sensor controller IC: reference level?Ģ4 = HSI.0 = Ignition: Spark detected (secondary shunt resistor signal) Its a shame as silver label 413 ECUs used to be dirt cheap but they seem to have all gone. I did manage to map out some of the registers as you will see on the IDB, the table headers on this ECU (I think) are actually the register addresses used so I am going to take a look at that ROM 5081 with the registers in mind and see if it makes anything clearer.Įdit - Did we decide the V8 404 (M3.3) is the same as the 413 but lacking some features?ĭidnt someone run a 404 BIN on a 413 ECU ok?Īre the M3.1 ECUs (402/403/405) 8051 processors or 80196?īoth of these are much more common here and easier/cheaper to get. I might try to get hold of a 413 to take even higher res photos and strip like has been done in that M1.7 thread over on R3v, I started trying to map out the pin inputs on the processor a while ago but stopped when I found I would have to destroy the board to get the internal traces.Ĥ13 ECUs here are over £140 at the moment which is a bit expensive to kill for science and I have had no luck finding a defective one to cut up Worked out something else as well, it looks like ROM 5081 is the beginning of the main program loop. the master table showing all the other tables in the ECU.
![inpa bmw code 78 m60 inpa bmw code 78 m60](http://blog.obdii365.com/wp-content/uploads/2017/02/reset-bmw-transmission-inpa-1.png)
Secondly, ROM:33C2 instantly adds Register 1A to what I have showing as the ID location for the table of tables, i.e. Now some immediately interesting things there, ROM:5358 is using the location of what I have flagged as the "diagnostic ID", seems it is used a few times following that long call to what you have indicated as the rom loading the tables ROM:33DF jnc ROM_33EE Jump if carry flag is clear ROM:33DC addb INTMEM_50+1, Add bytes (2 operands) ROM:33D6 add INTMEM_4E, INTMEM_52, ZERO_REG Zero register ROM:33D3 add INTMEM_4C, INTMEM_52 Add words (2 operands) ROM:33D0 ldbze INTMEM_52, Load byte zero-extended ROM:33CB ldb INTMEM_50+1, Load byte ROM:33C8 ldbze INTMEM_50, + Load byte zero-extended ROM:33C5 ld INTMEM_4C, Load word ROM:33C2 add INTMEM_1A, Table_Tables_ID Add words (2 operands) ROM:5370 andb INTMEM_26, #-2 '¦' Logical AND bytes (2 operands) ROM:5369 ldbze INTMEM_54, 0Ah Load byte zero-extended ROM:5366 jbc INTMEM_26, 0, ROM_53BC Jump if bit is clear ROM:5364 jnh ROM_5384 Jump if not higher (unsigned) ROM:535F cmpb INTMEM_48+1, 151h Compare bytes ROM:535D jc ROM_5375 Jump if carry flag is set ROM:5358 cmpb INTMEM_48+1, 150h Compare bytes ROM:534C ldb INTMEM_26+1, INTMEM_1451 Load byte Code: Select all ROM:5349 stb INTMEM_48+1, INTMEM_D3 Store byte