Author Topic: Let's Decode the Motronic 175 ECU (Read 12581 times)

2002maniac · « **Reply #15 on:** June 14, 2006, 09:27:05 PM »

Want me to ask Jim Conforti? He's local.

bmwman91 · « **Reply #16 on:** June 15, 2006, 12:21:51 AM »

Yeah, hunt his ass doen and make him tell us. I PERSONALLY don't give a rat's ass about making & selling chips...that market is waaaaaay oversaturated. I just want a good understanding of how this control system is programmed, so when I do my own control system I might be able to get some good ideas on reliable code & some failsafes. It would also be very nice to see how a pro tunes the fuel & spark maps for performance at various engine speeds.

Alas, he does not answer questions (understandably). He is likely very very tired of being inundated by teenagers asking the same dumb, pointless questions.

2002maniac · « **Reply #17 on:** June 15, 2006, 05:30:41 PM »

Quote from: bmwman91

Alas, he does not answer questions (understandably). He is likely very very tired of being inundated by teenagers asking the same dumb, pointless questions.

he's actually a pretty nice guy and very willing to help in most cases. What questions do you have?

bmwman91 · « **Reply #18 on:** June 15, 2006, 06:54:23 PM »

Hmmm. That is amazing, I would have thought he was a little burned out from everyone asking him to tell them how the Motronic, that he spent years & years working with, works in 5 minutes.

Well, firstly I guess I need to know if the maps are in the same format as all the previous Motronics (input parameter byte, number of 1st axis points bytes (N) , 1st N axis input value bytes, [second axis data if there is any], [3rd axis data...if the 175 uses 3D input maps], and the lookup values [which usually are the '3rd axis']). If it is not, then he can explain the format if he wants, I do not want to trouble him too much.

I guess all I want to know is what the offsets are for the idle spark & fuel maps, part throttle fuel & spark maps (the US version ones, if all the worldwide maps are on the chip in various locations), and the WOT fuel and throttle maps.

And lastly, a small list of what byte values correlate to what inupt parameter (RPM, load, throttle position if used directly in a map, etc). From there, I can figure out the rest.

If he could help me out with this, it would be HUGE. I WILL crack it eventually, but he could save me a fair amount of time by helping me out. I DO have a Conforti chip in my car...a REAL one that I paid for years ago! I haven't tried to dump its data even (not that you can anyway, there is protection built in)! Hehe, so if you could see if he could help out a loyal customer it would be sweet! Thanks!

zerofreez · « **Reply #19 on:** July 17, 2006, 03:12:03 PM »

Quote from: 2002maniac

he's actually a pretty nice guy and very willing to help in most cases. What questions do you have?

Did you get a chance to ask him?

bmwman91 · « **Reply #20 on:** July 19, 2006, 05:14:51 PM »

Yeah you ever hear from JC? Actually, if the above stuff is too much, just ask him if he can tell me what the map offsets are. That's all I need. And no, I am not going to make chips & sell them...as I stated before, that market has already been beaten to death.

johna · « **Reply #21 on:** July 19, 2006, 09:53:55 PM »

Quote

Aparently the Motronic is an adaptive ECU too. This would mean that some of the info in the chip is constantly being re-written (probably in that 32k), with the 4-8k worth of data being constant (baseline ignition/fuel maps or something).

It would also explain why since the chip went in got smoother with each successive tank of 98RON I used.

The Motoronic cannot write to the chip as it is an EPROM (have to use ultraviolet light to erase data first) or PROM type (one time write only). There must be another type of memory chip on board or in the processor itself to store any changable data.

bmwman91 · « **Reply #22 on:** July 20, 2006, 01:13:33 AM »

Yeah there is some static ram on the board somewhere. I guess maybe the MCU checks to see if it has been erased (such as when you unplug the battery). If so, it copies the baseline maps from the EPROM and then modifies them as necessary externally. Makes it hard to compare BIN files when there is only 1...

I have decompiled the data into 8051-compat assembly language, but it has not helped much as I am not an expert programmer. Using some software called WinOLS it is a little easier to look for maps, but still I have not really found anything. They are stored in what any programmer would recognize immediately as stacks. Unfortunately, I find what looks & is laid out exactly like a map, but only half makes sense. The rest is, well, not a part of the map. I am 99% certain that Bosch used the same format for the Maps on all Motronic cars.