M42club.com - Home of the BMW E30/E36 318i/iS
DISCUSSION => Engine management => Topic started by: bmwman91 on April 07, 2006, 12:29:54 PM
-
OK, I dumped the data from the factory EPROM like 2 years ago. I have been busy, and at the time knew next to nothing about electronic circuitry & components. That has changed during the past few years of college, and now I want to do something with this stuff.
So, I have a memory dump, but there is 8K of stuff to figure out (well, if I recall correctly, the first 4K is blank). Anyone here have experience decoding these? Obviously, I am mostly interested in the fueling & ignition maps (and anything else that relies on the AFM input). While I AM making an external MAF conversion, I would also like to come up with a chip option so an external 'magic' bos is not needed. When I get a chance I will try to dig up the files and post them.
-
oops, i said i'd give you some offsets ages ago didn't i? keep on bugging me and eventually i'll remember! iirc i had a little look, maps were very easy to find, figuring out what's what is the interesting bit and was where i gave up though as i was going down the MS route anyway. finding the AFM calibration curve would be the real winner, never managed that though. other stuff i remember was our bins are full of diagnostics data, and that i never figured out what to do with checksums. i have quite a few bins for our cars too btw.
-
This is for the Motronic 4.3 used in this guy's Volvo, but it may give some insight into decoding the bin locations.
Page 1: http://www.volvospeed.com/obd2/ecu_intro.htm
Page 2: http://www.volvospeed.com/obd2/ecu_overview.htm
Page 3: http://www.volvospeed.com/obd2/partii.htm
-
alright, i am very very very keen to figure out the ecu, but i have no knowledge to that level, from what i've read around the place it seems that we need to figure the chip, where all the maps etc are, then we can just modify them and stick them back on a chip, plug it in and there you go. there was a motronic editing program that was freeware for all the porsche dme's and it had an option to manually put in the offsets of the chip, if we can figure these out we could posibly use that program though i don;t know how good it would be, wasn;t jim conforti going to make one? also in searching the net i found he hjad released one ages ago which seems to have disappeared from existance, i asked bmwman about this before. So there is my two cents, i rekcon we should conentrate on this, its our key to some great modifications at low cost.
-
Bumpedy Bump, we really really need to figure this out.
-
hi jbuttenshaw,
what exactly are you after? i gave up on this after deciding it was too much hassle and that MS was a better option.i have a few different bins etc and working out the offsets for maps is dead easy, working out what each map represents is more important, then working out what to do with checksums and how to effectively alter the maps - i didn't get as far as i wanted with this as didnt have a wideband lambda and didnt want to screw around with my timing maps on my daily driver etc.
if you have an eprom burner and once you have the BIN either a bit of patience to find the offsets or any of the motronic s/w out there, even some of the freeware stuff, then you're ready to start figuring this out. if you have any qs fire away here.
fwiw i gave up for a reason. there's plenty of more useful projects imo.
-
well i see this as a cheap option to a new computer and also a very good alternative, can u send me the bin and file with the ofsets in it? all i have is the motronic911 software, i'm not too knowledgeable in aby of this so it has to be pretty simple for me to use it. Thanks alot.
-
well i see this as a cheap option to a new computer and also a very good alternative, can u send me the bin and file with the ofsets in it? all i have is the motronic911 software, i'm not too knowledgeable in aby of this so it has to be pretty simple for me to use it. Thanks alot.
yeah i can send you my bins, but they're for my uk car without the lambda lookup tables on it so it won't work on your car. when i added lambda to mine it wouldn't idle etc.
i'm a bit worried that you're looking for a simple way to do this - there is no straightforward or simple way to do it, else everyone would do it! best thing you can do if you want to get into it is get an eprom burner/reader and d/l your BIN, browse some forums for how to find things, then have a play changing settings using a WB02 and an advance timing light to see what effect your changes have etc. a romulator would be useful so you can make live changes.
i'm not sure if our ecus have checksums, if so ideally you'd like to figure out how to change these to reflect the differences of the maps. either that or it might throw a check light. i dont think ours (uk cars) do.
as for s/w the motronic911 stuff will get you started, but you ought to use some more powerful software - there was some s/w for jap cars iirc that i used, i'll take a look. also if you can get hold of some of the commercial software you'd really be away as there's some great s/w out there. though in all honesty to start with you can use more or less anything, even excel/wordpad to find the number patterns that make up a map etc.
if you need a hand with anything, you know where i am. you can pick up a willem eprom programmer and some eproms really cheap, and that would be a good place to start.
-
Alrighty, I finally got around to DLing the data from the EPROM. I have a burner/reader here at home...have hat it for over a decade. I have just been away for quite a while.
I have been doing a bit of reading on decoding the stuff in the EPROMs in Motronics. So far I have not made any progress finding anything. So, anyone have any ideas on what the offsets are on the various fuel & ignition maps?
Attached are 2 files. One is the data dumped with addresses & ASCII char's along with the Hex values (although mosy of the ASCII char's were lost for some reason). The other is just the Hex values.
-
Oh, and I guess anyone who has looked into this knows how the tables are formatted.
- First value at beginning of table is the input value to be used for the 'x-axis'. Hex values can correlate to RPM, Load, etc.
- The next hex number is the numver if variable inputs (a hex value of 0Ch is 12, 10h is 16. This is how many RPM/Load/whatever values will be referenced).
- The next N values are the RPM/Load/whatever values, but they will not immediately make sense.
- If it is a 2D table, the 'y-axis' is next, following the same format.
- So, if it is an N by M table, the next N*M vales are the lookup values (for fuel or spark advance). If just a table of N values in a single row, the next N values will be the fuel/spark values.
My understanding of RPM calculation. Say there are 16 RPM values in the table header. The LAST/16th one is the only one you can convert directly to RPM. You take the hex value, convert to decimal and multiply by 40. So, if that 16th value is 64h, or 100, the RPM represented is 4000. The others are calculated as: RPM = (value to the right - current value)*40. It would also seem that these values 'stack up' as you go. Like, if you are 4 bins from the 16th value, you would add the current bin, plus the 3 to the right, and subtract the sum from the 16th value. So, you could see something in the last 4 bins like: 0E 14 0E AF (5200 5700 6500 7000) => [(7000-500-800-500) (7000-500-800) (7000-500) (7000)]
I saw somewhere else that the last value is calculated as (256 - current bin's value)*40. The other values are treated the same as before. Who knows which way we go.
Now, I need help with this. I REALLY need to figure out/be told what the numbers are for RPM and Load. I have tried looking around at other cars, but every version of motronic uses different values for the inputs variables. We gatta figure this out!
-
And another interesting note:
Most EPROMS I have seen listed have 4 or 8k of data. The dump from our chip has nearly 32k! What gives? Sure does seem to be lots of nonsense in there.
-
an old thread of mine on bimmerforums has shown some interest, from when i was looking at this (before i went megasquirt), so i've linked them here!
http://forums.bimmerforums.com/forum/showthread.php?p=6770727#post6770727
i believe a lot of the stuff in the BIN is diagnostic data, what exactly this means don't ask me, but its what i was told.
-
Found out a little more...
From reading the Siemens datasheet for the Motronic's MCU, there is NO onboard program memory. I have not checked the pin that (basically) enables instructions to be pulled & executed from an external location, but surely it is grounded, meaning that the MCU not only looks for the fuel/spark maps on the EPROM chip, but it has all the program code in there as well. My father has a disassembler that may be of use. So...we might be able to get not only the maps, but the program code as well. Usefulness? Who knows, but it sure would be interesting! At least I have my explanation for the nearly 32k of code on that chip now!
Sidenote:
Custom programming the maps is NOT as easy as just changing the bin values. There are these things called checksums (they are a redundancy check/safety). Essentially, you sum up the values of a segment of code, table, whatever, and that sum is stored in another location as a checksum. When booting, the system will go through a checksum verification routine. It will add up all the values of whatever sections it is checking, and make sure they equal the checksum value. If so, all is well, it will begin operation of the main code portion. If not, it means something was damaged, and will NOT run. Changing bin values...as I am sure you can now guess...requires us to find and update the checksums as well.
-
Oh, another note:
The MCU is a Siemens SAB-80C535. Datasheet is here: http://www.ortodoxism.ro/datasheets/infineon/1-d80515.pdf
Only like 300 pages long, a nice brisk read!
-
Aparently the Motronic is an adaptive ECU too. This would mean that some of the info in the chip is constantly being re-written (probably in that 32k), with the 4-8k worth of data being constant (baseline ignition/fuel maps or something).
It would also explain why since the chip went in got smoother with each successive tank of 98RON I used.
-
Want me to ask Jim Conforti? He's local.
-
Yeah, hunt his ass doen and make him tell us. I PERSONALLY don't give a rat's ass about making & selling chips...that market is waaaaaay oversaturated. I just want a good understanding of how this control system is programmed, so when I do my own control system I might be able to get some good ideas on reliable code & some failsafes. It would also be very nice to see how a pro tunes the fuel & spark maps for performance at various engine speeds.
Alas, he does not answer questions (understandably). He is likely very very tired of being inundated by teenagers asking the same dumb, pointless questions.
-
Alas, he does not answer questions (understandably). He is likely very very tired of being inundated by teenagers asking the same dumb, pointless questions.
he's actually a pretty nice guy and very willing to help in most cases. What questions do you have?
-
Hmmm. That is amazing, I would have thought he was a little burned out from everyone asking him to tell them how the Motronic, that he spent years & years working with, works in 5 minutes.
Well, firstly I guess I need to know if the maps are in the same format as all the previous Motronics (input parameter byte, number of 1st axis points bytes (N) , 1st N axis input value bytes, [second axis data if there is any], [3rd axis data...if the 175 uses 3D input maps], and the lookup values [which usually are the '3rd axis']). If it is not, then he can explain the format if he wants, I do not want to trouble him too much.
I guess all I want to know is what the offsets are for the idle spark & fuel maps, part throttle fuel & spark maps (the US version ones, if all the worldwide maps are on the chip in various locations), and the WOT fuel and throttle maps.
And lastly, a small list of what byte values correlate to what inupt parameter (RPM, load, throttle position if used directly in a map, etc). From there, I can figure out the rest.
If he could help me out with this, it would be HUGE. I WILL crack it eventually, but he could save me a fair amount of time by helping me out. I DO have a Conforti chip in my car...a REAL one that I paid for years ago! I haven't tried to dump its data even (not that you can anyway, there is protection built in)! Hehe, so if you could see if he could help out a loyal customer it would be sweet! Thanks!
-
he's actually a pretty nice guy and very willing to help in most cases. What questions do you have?
Did you get a chance to ask him?
-
Yeah you ever hear from JC? Actually, if the above stuff is too much, just ask him if he can tell me what the map offsets are. That's all I need. And no, I am not going to make chips & sell them...as I stated before, that market has already been beaten to death.
-
Aparently the Motronic is an adaptive ECU too. This would mean that some of the info in the chip is constantly being re-written (probably in that 32k), with the 4-8k worth of data being constant (baseline ignition/fuel maps or something).
It would also explain why since the chip went in got smoother with each successive tank of 98RON I used.
The Motoronic cannot write to the chip as it is an EPROM (have to use ultraviolet light to erase data first) or PROM type (one time write only). There must be another type of memory chip on board or in the processor itself to store any changable data.
-
Yeah there is some static ram on the board somewhere. I guess maybe the MCU checks to see if it has been erased (such as when you unplug the battery). If so, it copies the baseline maps from the EPROM and then modifies them as necessary externally. Makes it hard to compare BIN files when there is only 1...
I have decompiled the data into 8051-compat assembly language, but it has not helped much as I am not an expert programmer. Using some software called WinOLS it is a little easier to look for maps, but still I have not really found anything. They are stored in what any programmer would recognize immediately as stacks. Unfortunately, I find what looks & is laid out exactly like a map, but only half makes sense. The rest is, well, not a part of the map. I am 99% certain that Bosch used the same format for the Maps on all Motronic cars.