toddk911

Interesting. Will make sense to those in here that burn chips, and high end tuning.

"This is some information about the analysis process of some Motronic code from a BMW copied and pasted from this site. click It may or may not give us somewhere to start:

Here's how I disassembled Motronic ...

Using an 8051 disasm. pgm. (DIS8051 ver F.)
I got source code ...

Now which is data and which is code ?? hmm..

Well in the 8051, the way to move DATA out of CODE address space is the

movc a,@a+dptr instruction ...

The dptr is loaded by

mov dptr,#HHLL which assembles to hex 90 HH LL

Using a REAL kludgy code scanner I recorded ALL incidents of 90 and then
saved the next two bytes as addresses to the start of a MAP

Using the disassembler tag file, I tagged the region (approx.) from
0x4000 - 0x4fff as DB (MAPs) ...

With a little inside info, I found out that the EPROM is executed from
0x2000 up, the 0x0000-0x1fff region is ROM onboard the 80515

Adjusting the tag file and disasm'ing showed a bunch of "unresolved
address references in the region of "0x5000 - 0x6600" ...

After some thought, I had it figured out, ..

0x0000 - 0x1fff (Main internal code .. I need a friend at BOSCH!)
0x2000 - 0x3fff (Engine specific subroutines / interrupt service code)
0x4000 - 0x4fff (Data MAPs used by the EPROM subroutines)
0x5000 - 0x65ff (THIS IS THE GOOD STUFF!!!)
0x6600 - 0x7fff (More Engine specific subroutines working with 0x2000-3fff)

The MAIN MAPS in the region 0x5000 - 65ff are only refernced by ROM code
contained in the 80515 .. Now either a REAL cracking effort, or some
friends at BOSCH are needed to get the std 8k of ROM code and also the
code contained in the support chip (Yes, it seems Motronic has TWO ROMs
just to make life a little more difficult!)

Such is the current state of Motronic ... when I get back from vacation,
hopefully my SIEMENS 80535/515 databooks will be in and I can complete
my schematics of the Motronic circuitry ... then whith a little more work,
I'll have it all figured out ... (Yeah, right)


Oh, BTW, you might be surprized at how Motronic handles the spark timing
and dwell .. since it gets two signals, reference (1 pulse per 360deg) and
speed (N pulses per 360deg) .. It has a custom chip to run an angle counter
and comparator to fire coil ...

I'm going to simulate this using some std hardware: .. run the speed
signal thru a PLL (with div. by 3 in the feedback) setup to provide a
3x freq... count this in a counter, while comparing it to some latched
values (dwell and spark) in 8-bit identity comparators.. the comps output
to a flip-flop which thru an ignitor fires the coil ... a third comparator
will provide the reset signal to the counter ... all the CPU will need do
is look at inputs, go to a MAP or three and output two values to the
latched comparator registers .. the hardware does the timing for me


Oh well ... time to get ready for the vacation ...

Bitte,

Jim Conforti
(87 325is / 92 325i)

Finally, some relevant information I have compiled from Rennlist over the years. Pretty much all of this is quoting or paraphrasing TT, who has done this all already:

"The upper 4kB of ROM contains the constants and maps along with a jump table that allows manufacturers to change certain operations in the 24-pin DMEs even though the internal 4kB ROM in the micro is untouchable"

"Air temperature is involved in many of the DME's maps. Corrections are 0%-+12.5%."

"Altitude subtracts 6% fuel or does nothing"

"Load in Motronic = BPW (Base Pulse Width)/50 or 25 (unknown which) giving an answer in usecs to keep it an 8 bit number"

"Acceleration enrichment, start enrichment, etc, can increase BPW by a factor of 1.5 to 3 for short durations"

"The air temperature sensor is used for temp based ignition retard, warm start enrichment (9% more fuel @ 0 degrees F linear to 0% @ 60 degrees F), idel control valve duty cycle, and VAF volume to mass conversion (which is a feature removed when using a MAP kit conversion, meaning I can figure out where this is easily)"

"The tables editable in Motronic 911 are enrichment tables that have nothing to do with BPW calculations."


"The processor tics ever 2 us"

"Lower limit for BPW in an 89 951 is .85 upper is 11 milliseconds."

"132 teeth on the flywheel, ref sensor detects a stud 21 degrees before TDC"

"There is an unused row in the chips for the VAF reading 5 volts, but the VAF is physically limited to reading about 4.6-4.8v"

"Motronic uses the same flag and counter cut fuel for overboost and for the rev limiter."

"For the 951, 1 atm map is approximately a load value of 110. The relationship between map and load is linear below 1 atm and non-linear while under boost" (because turbo heats up air so much?)

"I could remove all 3 enrichment maps, insert a constant multiplier, and the car would run 14.5 afr at all times" I will check this tonight

"Closed loop starts @ a minimum engine temp of 66 degrees F. Open loop = klr says WOT, RPM>5680, or boost >1bar absolute (load >110)"

"87 951 stock boost curve that the dme looks at to determine overboost

psi rpm

0 1500

10-11 3-5000

7-8 6240

pressure must stay over this limit for a certain time before overboost will be detected"



"5 bytes in the eprom define flywheel teeth and position of the reference sensor"

"One notch of change in the VAF spring correlates to 2% change in fuel mixture, so if you have 20% larger injectors you could tighten the spring by 10 notches" (not a good strategy, I am just putting it up for the 2% number)

"The BMW E30 M3 uses the same DME as the 951."

"The resolution of rpm in the 951 is 40 because 40*byte=rev"

"(decimal value*.682)-14=ignition degree" (not sure about specifics here)

"

" Obviously, you cannot have a trigger right at TDC because you'll never be able to fire a spark before TDC. So the reference-sensor trigger is actually at 58.6-degrees BTDC"
Doesn't matter where the ref mark is when the teeth count is available. Motronic uses the ref mark at 50-60 degree BTDC on cyl 1 because it also starts the fuel injector batch fire at that time. Ignition table values are stored in 1/4 tooth increments and this affects calculated values when all the different ignition map values are added. But when converted to values used in the counting process, the accuracy drops to the half tooth value.

" After exactly 57 ticks goes by, it knows the crank is at 19.8-degrees BTDC and it fires the spark. Of course, it needs to fire another spark 180-degrees after this for the next piston, so it counts 264 ticks and fires off another spark at 19.8-degrees before BDC. "

Actually Motronic cheats. It only counts whole teeth to get to a specific spot on the flywheel, then if the timing is at a half tooth mark, it polls for the half tooth transition before firing the coil otherwise it fires immediately for the whole tooth. So on the 951, Motronic counts 66 whole teeth transitions (180 degrees) to get around to the coil charge/discharge cycle for cylinders 2 & 3. If you notice, the 911 uses 129 teeth because there are 3 firing events per rev (43 teeth/120 degrees) and BMW uses 114 teeth which allows them to use the same flywheel setup on both 4 and 6 cylinder engines (57 teeth/180 degrees and 38 teeth/120 degrees).

"Somewhere on the Motronic DME board, there's a circuit that converts the sine-wave output of the speed-sensor into a square-wave. This might hold the solution to the Link adaptor board. I think I've got a schematic for a 911 Motronic DME somewwhere, but it should be similar if not identical...
"

Yep. It's in chip S100 on the top board. That's the only chip I haven't been able to cross reference to a commercially available part. If you have the part number, I already have the rest of the circuit. If not, if you can extract the chip off a bad board you have, I have coworkers that could delaminate the thing to find out what it is."

http://users.wpi.edu/~mark944/nestedpages/pros.htm

http://users.wpi.edu/~mark944/

http://yarchive.net/car/engine_control.html

DanG

Todd, you should join up and post that info here...

http://www.darklightning.com/motronic/index.php

toddk911

That looks like the same place I got that Mark944 website.

Rip It

Are u able to interface with the "motronic" and say store real time data, deciper it into info that would tell u everything going on with the available sensors ?