Reverse Engineering

The BMW MS41 family of ECUs use a Siemens 80C166 Processor - SAB80C166W-M-T3 (datasheet)

(User Manual)

The Siemens 80C166 was designed as a very low-cost embedded 8/16-bit load-store processor, with RAM (1 to 2K) kept on-chip for lower cost. This leads to some unusual versions of normal RISC features.

The 80C166 has sixteen 16 bit registers, with the lower eight usable as sixteen 8 bit registers, which are stored in overlapping windows (like in the SPARC) in the on-chip RAM (or register bank), pointed to by the Context Pointer (CP) (similar to the SP in the AMD 29K). Unlike the SPARC, register windows can overlap by a variable amount (controlled by the CP), and the there are no spills or fills because the registers are considered part of the RAM address space (like in the TMS 9900), and could even extend to off chip RAM. This eliminates wasted registers of SPARC style windows.

Address space (18 to 24 bits) is segmented (64K code segments with a separate code segment register, 16K data segments with upper two bits of 16 bit address selecting one of four data segment registers).

The 80C166 has 32 bit instructions, while it's a 16 bit processor (compared to the Hitachi SH, which is a 32 bit CPU with 16 bit instructions). It uses a four stage pipeline, with a limited (one instruction) branch cache

Comments