Let's Decode the Motronic 175 ECU

[bmwman91]

OK, I dumped the data from the factory EPROM like 2 years ago.  I have been busy, and at the time knew next to nothing about electronic circuitry & components.  That has changed during the past few years of college, and now I want to do something with this stuff.

So, I have a memory dump, but there is 8K of stuff to figure out (well, if I recall correctly, the first 4K is blank).  Anyone here have experience decoding these?  Obviously, I am mostly interested in the fueling & ignition maps (and anything else that relies on the AFM input).  While I AM making an external MAF conversion, I would also like to come up with a chip option so an external 'magic' bos is not needed.  When I get a chance I will try to dig up the files and post them.

[tim_s]

oops, i said i'd give you some offsets ages ago didn't i? keep on bugging me and eventually i'll remember! iirc i had a little look, maps were very easy to find, figuring out what's what is the interesting bit and was where i gave up though as i was going down the MS route anyway. finding the AFM calibration curve would be the real winner, never managed that though. other stuff i remember was our bins are full of diagnostics data, and that i never figured out what to do with checksums. i have quite a few bins for our cars too btw.

[bmwman91]

This is for the Motronic 4.3 used in this guy's Volvo, but it may give some insight into decoding the bin locations.

Page 1: http://www.volvospeed.com/obd2/ecu_intro.htm
Page 2: http://www.volvospeed.com/obd2/ecu_overview.htm
Page 3: http://www.volvospeed.com/obd2/partii.htm

[jbuttenshaw]

alright, i am very very very keen to figure out the ecu, but i have no knowledge to that level, from what i've read around the place it seems that we need to figure the chip, where all the maps etc are, then we can just modify them and stick them back on a chip, plug it in and there you go.  there was a motronic editing program that was freeware for all the porsche dme's and it had an option to manually put in the offsets of the chip, if we can figure these out we could posibly use that program though i don;t know how good it would be, wasn;t jim conforti going to make one? also in searching the net i found he hjad released one ages ago which seems to have disappeared from existance, i asked bmwman about this before.  So there is my two cents, i rekcon we should conentrate on this, its our key to some great modifications at low cost.

[jbuttenshaw]

Bumpedy Bump, we really really need to figure this out.

[tim_s]

hi jbuttenshaw,
what exactly are you after? i gave up on this after deciding it was too much hassle and that MS was a better option.i have a few different bins etc and working out the offsets for maps is dead easy, working out what each map represents is more important, then working out what to do with checksums and how to effectively alter the maps - i didn't get as far as i wanted with this as didnt have a wideband lambda and didnt want to screw around with my timing maps on my daily driver etc.
if you have an eprom burner and once you have the BIN either a bit of patience to find the offsets or any of the motronic s/w out there, even some of the freeware stuff, then you're ready to start figuring this out. if you have any qs fire away here.
fwiw i gave up for a reason. there's plenty of more useful projects imo.

[jbuttenshaw]

well i see this as a cheap option to a new computer and also a very good alternative, can u send me the bin and file with the ofsets in it? all i have is the motronic911 software, i'm not too knowledgeable in aby of this so it has to be pretty simple for me to use it. Thanks alot.

[tim_s]

well i see this as a cheap option to a new computer and also a very good alternative, can u send me the bin and file with the ofsets in it? all i have is the motronic911 software, i'm not too knowledgeable in aby of this so it has to be pretty simple for me to use it. Thanks alot.

yeah i can send you my bins, but they're for my uk car without the lambda lookup tables on it so it won't work on your car. when i added lambda to mine it wouldn't idle etc.
i'm a bit worried that you're looking for a simple way to do this - there is no straightforward or simple way to do it, else everyone would do it!  best thing you can do if you want to get into it is get an eprom burner/reader and d/l your BIN, browse some forums for how to find things, then have a play changing settings using a WB02 and an advance timing light to see what effect your changes have etc. a romulator would be useful so you can make live changes.
i'm not sure if our ecus have checksums, if so ideally you'd like to figure out how to change these to reflect the differences of the maps. either that or it might throw a check light. i dont think ours (uk cars) do.

as for s/w the motronic911 stuff will get you started, but you ought to use some more powerful software - there was some s/w for jap cars iirc that i used, i'll take a look. also if you can get hold of some of the commercial software you'd really be away as there's some great s/w out there. though in all honesty to start with you can use more or less anything, even excel/wordpad to find the number patterns that make up a map etc.

if you need a hand with anything, you know where i am. you can pick up a willem eprom programmer and some eproms really cheap, and that would be a good place to start.

[bmwman91]

Alrighty, I finally got around to DLing the data from the EPROM.  I have a burner/reader here at home...have hat it for over a decade.  I have just been away for quite a while.

I have been doing a bit of reading on decoding the stuff in the EPROMs in Motronics.  So far I have not made any progress finding anything. So, anyone have any ideas on what the offsets are on the various fuel & ignition maps?

Attached are 2 files.  One is the data dumped with addresses & ASCII char's along with the Hex values (although mosy of the ASCII char's were lost for some reason).  The other is just the Hex values.

[bmwman91]

Oh, and I guess anyone who has looked into this knows how the tables are formatted.

- First value at beginning of table is the input value to be used for the 'x-axis'.  Hex values can correlate to RPM, Load, etc.
- The next hex number is the numver if variable inputs (a hex value of 0Ch is 12, 10h is 16.  This is how many RPM/Load/whatever values will be referenced).
- The next N values are the RPM/Load/whatever values, but they will not immediately make sense.
- If it is a 2D table, the 'y-axis' is next, following the same format.
- So, if it is an N by M table, the next N*M vales are the lookup values (for fuel or spark advance).  If just a table of N values in a single row, the next N values will be the fuel/spark values.

My understanding of RPM calculation.  Say there are 16 RPM values in the table header.  The LAST/16th one is the only one you can convert directly to RPM.  You take the hex value, convert to decimal and multiply by 40.  So, if that 16th value is 64h, or 100, the RPM represented is 4000.  The others are calculated as: RPM = (value to the right - current value)*40.  It would also seem that these values 'stack up' as you go.  Like, if you are 4 bins from the 16th value, you would add the current bin, plus the 3 to the right, and subtract the sum from the 16th value.  So, you could see something in the last 4 bins like: 0E 14 0E AF (5200 5700 6500 7000) => [(7000-500-800-500) (7000-500-800) (7000-500) (7000)]

I saw somewhere else that the last value is calculated as (256 - current bin's value)*40.  The other values are treated the same as before.  Who knows which way we go.

Now, I need help with this.  I REALLY need to figure out/be told what the numbers are for RPM and Load.  I have tried looking around at other cars, but every version of motronic uses different values for the inputs variables.  We gatta figure this out!

[bmwman91]

And another interesting note:

Most EPROMS I have seen listed have 4 or 8k of data.  The dump from our chip has nearly 32k!  What gives?  Sure does seem to be lots of nonsense in there.

[tim_s]

an old thread of mine on bimmerforums has shown some interest, from when i was looking at this (before i went megasquirt), so i've linked them here!
http://forums.bimmerforums.com/forum/showthread.php?p=6770727#post6770727

i believe a lot of the stuff in the BIN is diagnostic data, what exactly this means don't ask me, but its what i was told.

[bmwman91]

Found out a little more...

From reading the Siemens datasheet for the Motronic's MCU, there is NO onboard program memory.  I have not checked the pin that (basically) enables instructions to be pulled & executed from an external location, but surely it is grounded, meaning that the MCU not only looks for the fuel/spark maps on the EPROM chip, but it has all the program code in there as well.  My father has a disassembler that may be of use.  So...we might be able to get not only the maps, but the program code as well.  Usefulness?  Who knows, but it sure would be interesting!  At least I have my explanation for the nearly 32k of code on that chip now!

Sidenote:
Custom programming the maps is NOT as easy as just changing the bin values.  There are these things called checksums (they are a redundancy check/safety).  Essentially, you sum up the values of a segment of code, table, whatever, and that sum is stored in another location as a checksum.  When booting, the system will go through a checksum verification routine.  It will add up all the values of whatever sections it is checking, and make sure they equal the checksum value.  If so, all is well, it will begin operation of the main code portion.  If not, it means something was damaged, and will NOT run.  Changing bin values...as I am sure you can now guess...requires us to find and update the checksums as well.

[bmwman91]

Oh, another note:

The MCU is a Siemens SAB-80C535.  Datasheet is here: http://www.ortodoxism.ro/datasheets/infineon/1-d80515.pdf

Only like 300 pages long, a nice brisk read!

[mrjezza]

Aparently the Motronic is an adaptive ECU too.  This would mean that some of the info in the chip is constantly being re-written (probably in that 32k), with the 4-8k worth of data being constant (baseline ignition/fuel maps or something).

It would also explain why since the chip went in got smoother with each successive tank of 98RON I used.