After working out the serial port pinout on my MoTeC M48 (see MoTeC PCI Cable for $20), I was left with one unidentified pin. As the same DB9 is used with both a PCI cable and a SUU, I suspect this extra pin is how the ECU distinguishes between the two. My M48 is already running the latest firmware so figuring out how to emulate an SUU isn’t a critical but not knowing how it works bothers me.
After trying a few things (tie pin to +5V, tie to GND), I decided I needed to open up the case and figure out where pin 12 on the ECU connector goes.
Based on the sharp, 90° bends in the traces, the whole board was definitely autorouted. Unfortunately, the autorouter decided to route traces underneath chips which makes tracing them out much harder. Also, the whole board is covered with conformal coating. On the upside, a large number of components are used to protect the inputs and output from out-of-spec voltages which makes sense as incorrect wiring is bound to be a common problem in the field.
Zooming in on the main processor, I find a Motorola MC68332ACFC16 (datasheet) which is a nifty 68k variant with peripherals geared toward generating time-synchronized I/O.
Next to the main processor are a pair of Altera MAX 7000 PLDs (EPM7032LC44 datasheet). I didn’t research enough to determine if these PLDs are used with the main processor’s time processor functions or with its expansion bus.
After a few false starts, I determined that pin 12, our extra serial pin, passes through protection circuitry before ending up at a GPIO on port E of the main processor. There seems to be no alternate functions on that pin that make sense so next up will be reverse engineering the firmware. Thankfully, MoTeC provides a full, unencrypted firmware as part of the M48 software on their website. Time to buy a license for IDA.
After getting the MoTeC M48 EMP software installed in Dosbox as described previously, I naively assumed the M48 just connected with normal RS232 serial. I mean, there’s a DB9 hanging under the dash and the EMP software is looking for a serial port. Of course it couldn’t be that simple.
It seems that MoTeC decided to save a dollar in the M48 by not including RS232 level shifters. Instead, it has 5V TTL serial on non-standard pins. MoTeC helpfully offers cables, called PCI and CIM, to bridge the gap from an RS232 serial port to the ECU. The downside? These cables are practically unobtainium (or at least cost $220 for one). Knowing that it’s just TTL serial, why is this cable so expensive? Can’t I just make one?
MoTeC offers a wiring diagram for the M48 but it doesn’t tell you what signals are on the DB9 pins. At least they were clear that pin 6 is ground. After some time with a voltmeter and oscilloscope, I figured out the following pinout:
So, what’s inside that $220 cable? Probably a MAX232. A simpler, modern alternative is a FTDI 5V cable from Sparkfun for $20. Either make a connector to adapt to DB9 or wire directly into the ECU connector pins.
Now the M48 EMP software running in Dosbox is talking to the ECU over the FTDI cable. I’ve successfully downloaded the current tune and some log data. I even discovered that the air temperature sensor was showing a fault and was able to clear it by reseating the connector on the sensor.
Next up is inventorying the sensors and actuators installed and finding their datasheets. The goal is to get a good understanding of the tune that is currently loaded and get ready for logging data during dyno runs. That probably means building a board that can capture the telemetry the ECU spews out the serial port during normal operation. Then I’ll start digging into the protocol used by EMP to configure the ECU.
A few month ago, a coworker decided to buy a built drag racing car and was looking for someone to help crew. I emphatically offered my services and we started working out what exactly he had bought.
The car started as a stock 1996 Ford Mustang Cobra with a 4.6L V8 engine (in Mystic, no less). The engine has been rebuilt with a supercharger and nitrous. The drivetrain has been completely replaced. Yet, it still has power windows, doors, and steering. The story from the seller was that the original owner had some outrageous tuning that needed the nitrous for cooling, not power. The seller, the 2nd owner, had had a professional tuner redo the tuning from scratch to get something that would work as a daily driver, an 800HP daily driver. It’s an interesting beast to say the least.
I started looking into the ECU to figure out what we had to work with. It’s a MoTeC M48 which is a well-respected ECU from the 90s. MoTeC still has the manual and software available for download but that’s where this story starts to get annoying. The M48 software is a DOS-only application that talks to the ECU over serial. Most of the applications will work under Windows 7 but not all. I couldn’t get it to work with Windows 10 at all. After a bit of research, others had had luck with Dosbox.
I use a MacBook Air so I tried Boxer which is just a nice UI over Dosbox. Installing the MoTeC software is…odd. The download from MoTeC is a Windows installer that dumps a DOS-based installer into C:\Motec. The DOS-based installer is built around floppy images and is generally quirky. I was able to successfully get everything installed in a Windows Vista VM I had handy and then copy C:\Motec into a Dosbox disk image. If you are looking to use MoTeC M48 EMP on a Mac and want to save a bunch of time, email me.
One last note about using Boxer: the Boxer UI doesn’t expose any settings for serial ports. Do not despair; Boxer’s Dosbox core has all the serial port support included. You just need to add the following to the DOSBox Preference.conf stored inside the Boxer disk image bundle (right-click on the disk image in Finder and click Show Package Contents):