M3C siemens contitech ECU flash/remapped on Monster 1100 / Scrambler / KTM300 tpi

A DIY, way to R/W flash memory ECU M3C of a Ducati Monster 1100, througth background debug connection interface (BDM).
BDG signal is inside ecu, therefore is necessary open ECU.

This method permit to modify original map table, or upload a ready-made Ducati performance bin file.

Here’s what you need:
– BDM Freescale s12 interface  (If it is not available. . Maybe this one is compatible)
– Laptop Windows 7, 32 bit
– Codewarrior HC12 v5.1 special edition
– Converter
– Srecordizer.exe
– Winols test version
– Map M1100_ABS_A2IU1NIL_00601000_NoO2NoFlapTune

The engine of m3c ecu is a powerful Freescale MC9S12XS256 microcontroller of which the affected memory range in hexadecimal start at 780000 and finish at 7FFFFF of global memory.
This range contains the full flash memory and can be replaced by an external file.bin.

In the real as you can see in the left of the image,  we can read and write only an area at time, precisely  Block_1S and Block_0.
In case you want write a DP file, only half of the file.bin is needed and precisely the half about Block_0, (Block_1S inside file.bin is identical of original).
In case you want edit original map table, i finded it in Block_1S and Block_0 remains original.

Wiring and reading & saving:

For download Block_1S and Block_0 as SX file open hiwave.exe located in /program files/freescale/cws12v5.1/prog/hiwave.exe and in the section “command” write:
– SAVE 0x0780000’G..0x079FFFF’G block_1s.sx              (For Block_1S 312kb)
– SAVE 0x07E0000’G..0x07FFFFF’G block_0.sx               (For Block_0 312kb)
If you copy and paste this line please pay attention at ‘ Near G, probably you need to rewrite it manually.
Do the above with Ecu connected at motorbike, ignition key in “ON” position (engine OFF) and click on “Reset”  in the command bar of CW.

At now, is necessary converter to convert SX just made in to a S19 file.

Block_1S.sx —-> Block_1S.s19 (304kb):

Block_0.sx —-> Block_0.s19 (242kb):

Winols to find map inside Block_1S.S19
Map table area start from address E1B000 to E1B07F:

There is other tables in this file, but i dont know how it useful.
Anyway, i’ve tryed to increase +1, +2, +3 value of all data in the range above with Srecordizer.exe.

Srecordizer.exe
Srecordizer is a simple hex editor, but it auto adjust last bit of checksum in each line.
Example of already edited of +2 value in map table area from E1B000 to E1B07F.

One time Write preparation

To write Flash is needed again “Hiwave.exe”, but to avoid brick ecu you need to disable the ability to run software protection.
Specifically, the protection is enabled by the 1 bit state inside the flash, which can be written non-intrinsically from the write tool.
To do this, you must create a file named “Preload.cmd” in the root where “Hiwave.exe” resides, containing:

// Before loading the commands written below will be executed
// The following commands must be enabled to load in flash with the ICD12
// initialize the flash mechanism
FLASH NOUNSECURE

A prove of correct loading of preload.cmd is visible when you start Hiwave.exe.

Write Flash Memory

Important  . . first do above Write protection paragraph.
In “Hiwave.exe” open TBDML HCS12 curtain and select Flash…

For write first Erase flash memory and then button “Load…” will activate and permit load S19 file.
Obviously depending which S19 about Ducati performance map or original edited map table you wonna load:
– Ducati Performance S19 file go writed in PFLASH 00F88000 – 00FFBFFF (Block_0)
– Original edited S19 file go writed in PFLASH 00E08000 – 00E7BFFF (Block_1S)
Never delete other part of Flash memory 🙂

How to convert  DP BIN  into DP S19 file

To convert a BIN file into a S19 file ready to flash with this method first download Splitfile and use it in this way:

In the folder parts there is 2 splitted file of each one wheigs 128kb.
Rename they in this way:
– part.0 —-> Block_1S.bin
– part.1 —-> Block_0.bin

Now recover BIN2SREC and do:
bin2srec.exe -s -o 780000 Block_1S.bin > Block_1S.sx
bin2srec.exe -s -o 7E0000 Block_0.bin > Block_0.sx
Use the usual Converter to convert addressing of SX file into S19:

With my DP file “M1100_ABS_A2IU1NIL_00601000_NoO2NoFlapTune.bin” the S19 become:
– Block_1S.S19 —-> 304 Kb
– Block_0.S19 —-> 237 kb
Now you can write as above, your Block_0.S19 in your ECU…  remeber with DP map is not needed write Block_1S.S19 because it is identically at original.

Have a good luck enjoy, donate at end page 🙂 !

Appendix standalone ecu wiring: