view and edit motronic maps!

It's not "unhackable".

It's just that you need...

1) A good SMT rework station to remove a PLCC package and then either socket or resolder it later - and...

2) One of the very few "burners" that support the CC460 - all of which that I know about cost at least $1000 and usually more.

And yes, the same chip is used in BMW M5.2 and some Porsche M5.2 - but like the ubiquitous Intel 28F200BX-B used in tons of BMW's it is NLA as a "new part". Does Bosch likely have a stash of them to repair ecus as remans? Sure. I can't get my hands on one.

For those who want to play around, here is an image read from an F355's CC460
View attachment F355.zip

 

Ernie,

If you want to spend the money for an emulator - sure you can tune "actively".

I generally don't recommend it because one single mistake can mean a lot of $$$$$$$$$

 

Sounds like you have spent some time thinking about this Jim.. What progress have you made on the M5.2? What were your conclusions in terms of tuning the 355?
------------------

 

My conclusion is that I need to buy a working (preferably junkyard) F355 M5.2 ecu

Jim

 

Perhaps all the 355 owners can chip in a few bucks each and buy an new one for you to get into?

 

If someone knows of any junkyard ecus..

355 M5.2,

F360

F430

550M

575M

etc.

Just tell me where they are, and I'll be happy to write the checks.

 

we all need to help Jim get onto this...

 

All this talk of trying to edit the 5.2 Motronic maps is great and we clearly have some people on here who have some detailed knowledge of these systems. The main question though is why would you want to? This is an ECU for the highest specific bhp road car in the world at the time. You can be sure that Ferrari knew what they were doing - that is why we all pay so much money for these cars. So why do any of us know more than Ferrari about the best mapping for a 355 engine that has likely spent hundreds of hours on a dyno in Maranello being mapped?

 

I tune cars for a living and can say that many oem tunes are rather conservative, often to meet emissions regulations.

I don't know what could be gained by tuning a 355 but if I had access to the tools I would certainly think it's worth a try. It would especially be worth correcting the calibrations on cars that have had exhaust/intake/engine work.

 

I think I'll weigh in here.

Ferrari tuned the car for a specific fuel - which is at least ONE grade less than the grade
that the manual REQUIRES.

I've been tuning for 17+ years now exclusively.

You won't find many OEM calibrators that have worked in the field for that long.

There are ALWAYS gains to be had in tuning a car.

For better fuels

For different parts.

etc.

Jim Conforti

 

There is no question tuning can improve especially on specific cars vs. mail order tunes. I hope one of you pros....JIM...will one day start dealing with the motronic 5.2. There are so many things we could pay you for. For a few examples:

deleting the can interface of suspension ecu to main ecu,

deleting the alarm at the main ecu

modifying traction control for "off-road" purposes

tune for different exhausts and intakes

tune for different fuels

economy and performance tunes

 

Do you have to remove the chip?
Can't you fashion a harness to attach to all the leads or will adjacent SMT resistors prevent reading?

Thanks for the cool info so far!

 

FBB,

I have every intention of doing so - but first, I have to get an M5.2 ecu.

A working Ferrari one

For "destructive disassembly"

So when someone has a lead on one - let me know.

Jim

 

If I find one I'll let you know. I gotta couple of mechanic friends who can keep an eye open.

 

I guess I should explain WHY I need WHAT I need.

OK, with M5.2 - no one (who is talking) has seen the code that is INSIDE the processor.

There is code INSIDE the rom of the processor as well as there is code in the flash memory
of the CC460.

So - what needs to be done is this:

1) Remove CC460 using hot air station - socket ECU - make sure ECU still works

2) Read CC460

3) Reprogram CC460 to dump contents of internal ROM out to serial port.

4) Disassemble everything.

The problem being that "current wisdom" is that the CC460 CANNOT be read out serially.

We need to fix that if you're going to be able to read out your code serially and then modify it before writing it back serially.

Jim

 

To add to what FFB states.. I am confident that a further spin off from Jims 5.2 project is an affordable diagnostic tool for our cars' EOBD, similar to the SD2-3!

And that IS something worth investing in IMO..

------------------------

That said, I am willing to donate to the project so Jim can buy a new motronic 5.2 if he has too.

Others willing to help can post or PM me. J

 

Guys, NO ONE needs to "donate" - trust me - I'm happy to spend MY money on this.

My problem is finding an ECU.

They are sometimes available on EBay, but since I don't have an F355, I wouldn't know if
the ECU worked.

Just a series of "issues" (not financial) that I need to work out. (with your help!)

Jim

 

Hi Jim
don't you have experience with the 5.2 installed on some BMW? Can the code be really different or only the mapping of the engine?
If it can be of any help I have available one of the 5.2s from a 750/850. Let me know if you want it.
Image Unavailable, Please Login

 

The code is completely different.

Have you ever opened that M5.2 unit up?

 

OK, I thought the core of the code could have been the same.

I bought the 2 ECUs from the same car. I have opened the other one and took the connector to build a 88 pins break-out box, and keep it for some spare parts, just in case. I never opened the one on the picture.

 

There is (perhaps) a different route to take.

If someone has access to a logic analyser, one could set up to readout all of the pins on the ROMs for every cycle over a moderate period of time. This would work just splendid if the car was being run on a dyno while the LA was capturing the data.

Over in CPU land where I spent 30 years working, we could get logic analysers with more than 100 inputs and more than 1milliion state recordings for those 100 inputs.

With this kind of data, one can essentially red the input address pattern, and the output data from the rom. It might take a while to sort out what is what, but the process is straightforward, no desoldering required. If the ROM has a normal pinout, there will even be connectors that can just plug onto the ROMs while it remains soldered to the ECU board.

So, does anyone have access to one of these things? DOes anyone here work in the semiconductor industry debugging silicon parts prior to them being worthy of being shipped to customers?

 

The reason I asked you if you had opened it up, is that most V12 M5.2 units..

DID NOT use the CC460 "flash-memory" based port expander.

They used the Intel 87BC6QG, which is the "otp-eprom" version of the port expander.

Hence they are not reflashable.

So, on the open one, do you see a "CC460" or an "87BC6QG"?

 

Yes, Mitch...

I have a top of the line, ridiculously overpriced unit collecting dust in my basement

(completely serious here - I do this stuff for a living - as well as for fun)

The problem is that the ROM we want the contents of is INTERNAL to the processor.

Assuming they haven't fully read protected the ROM, (unlikely) we can change the code
in the external device (CC460) and that code will dump the IROM out.

Jim

 

If you are still looking for a ECU unite there is one fore sale in the ebay.co.uk
http://cgi.ebay.co.uk/ws/eBayISAPI.dll?ViewItem&item=260571277119&ssPageName=ADME:B:SS:GB:1123
Not sure it is the correct version but it has Bosch nr: 0261 204 186.

 

You are absolutely right. There is no CC460 inside, but intel chips. However, I cannot see the exact marking you mention.