Modifying Motronic 2.3.2 ECU hardware and software.

[-ice-]

Hi,

A question concerning the AFM: The RS2 has a different R201 Resistor which is part of a voltage devider in front of the u/f conversion. In my calculation the output frequency is higher with R201 for a constant aiflow at th MAF.

Thats exactly the other way i expected it. The ADU has more airflow, so i thought they would use the resistor devider the keep the numeric value of the airflow small even at high airflow-rates.

Can anybody tell the logic behind this?


Bye

[prj]

Hey Acki, nice to hear from you

The most interessting part at the moment is IE_1, where Airflow counter value comes in (RAM_42/43). Then some calculation is made with some constants of the constants block and injector pulsewidth comes out (RAM_5e/f). These are also the constants which vary alot between aan and adu bins.

For me it's difficult to see the math behind it.

I don't see what's difficult. 16 bit load x 16 bit enrichment = pulsewidth.
To understand math it is good to define all the simpler routines, like SHIFTLEFT, SHIFTRIGHT, MULT8x16, MULT16x16, DIV16x8 etc.

when 16 bit dptr adress is used to make an movx access, thats what i think is the communication with the fuel prozessor

No, DPTR has nothing to do with it. You can access xram either by moving the high byte to P2 and then the low byte to R0 for example, or you can move the entire thing to DPTR. It makes no difference which way you do it from the end result perspective..

[Acki]

I have found some similar stuff in the Bosch yahoo group.
But it's more or less guessing.
I have to make a desktop ECU to play with some kind of data logging to see a little bit what happens.

[-ice-]

Hey Acki, nice to hear from you

The most interessting part at the moment is IE_1, where Airflow counter value comes in (RAM_42/43). Then some calculation is made with some constants of the constants block and injector pulsewidth comes out (RAM_5e/f). These are also the constants which vary alot between aan and adu bins.

For me it's difficult to see the math behind it.

prj: ok, i assume this io-extender uses the upper adress lines, which aren't used by x-ram. Sure is, that it contains the adresslatch for the lower adressbits (ALE Pulse from 80c535)

when 16 bit dptr adress is used to make an movx access, thats what i think is the communication with the fuel prozessor

Regards

[Acki]

Nice progress here!
I have "only" a V8 but I'm not motivated to open IDA over x-mas

From my side, when I work - lets say 4-6 weeks - on the assembler code I didn't get big progress at the end, a break helps me a lot because I have the chance to get a new view after looking the code again

[prj]

It does not work the way you think it does.

S702 is an IO extender memory mapped to upper XRAM addresses of S700.
Pulsewidth is copied from S700 to S702, and S702 outputs it to P0 of S750, from which P1.0-P1.4 are TI1-TI5.

You really need to understand the S702 chip to get anywhere There are tons of unused inputs, PWM outputs and other funky stuff on it.

[-ice-]

Maybe the pulsewidths are transferred digitally to the fuel processor. I only measured two io-ports which are directly connected to the 80c535. And they seem to be inputs!

And yes it is boring, when i'm talking with myself.


Regards

[-ice-]

Not a good day today All I wrote was wrong

but i think i have some new findings..

The ICs that look like voltage regulators are in fact drivers. The five injector outputs are connected to one of them.

This mysterious fuel processor is the DIL 40 Intel Chip, not the 68 pin plcc chip that looks like the 80c535.

PRJ, can you please tell me which pin of DIL 40 Chip is the pulse input? I really can't find anything about it.

Regards

[-ice-]

The cc02 P1.2 output goes to the voltage regulator looking IC on the boost board not to the other fuel processor. So my assumption might be wrong.

Bye

[-ice-]

Ok, thanks for the information. I guess it's the other "30240" 8051 looking IC. I have never seen any datasheets for it.

Bye

[prj]

Hi,

I was looking for the part, where the actual pulsewidth for the injectors is generated. I suggest it uses the counter module to generate the pulse. Could find some interessting code in IEX5 where it writes CC02 high / low byte. But that would only be one output, how does it select the different injectors then? I basicly think it's sequential, so i won't find five pwms for the injectors running parallel.

Regards

There is a separate 8051 MCU on the top board that does all the sequential injection stuff.
The main fuel-ign MCU only outputs the pulse to it, and the dedicated 8051 does the rest.

[-ice-]

Hi,

I was looking for the part, where the actual pulsewidth for the injectors is generated. I suggest it uses the counter module to generate the pulse. Could find some interessting code in IEX5 where it writes CC02 high / low byte. But that would only be one output, how does it select the different injectors then? I basicly think it's sequential, so i won't find five pwms for the injectors running parallel.

Regards

[prj]

I was not looking for it, but the Grundanpassungskonstante fgat0 just seems to be a hardcoded byte in the fueling-calculation procedures. Just a multiplier.

ByeBye

Touché.

[-ice-]

I was not looking for it, but the Grundanpassungskonstante fgat0 just seems to be a hardcoded byte in the fueling-calculation procedures. Just a multiplier.

ByeBye

[-ice-]

prj, you should write a book about motronic 2.3.2

I could confirm the barometric sensor with an obd group (same xram address is recalled there)

Next point concerning the fueling (map read) procedure.

The first map read there is 4x1 with rpm axis. It's usually flat for a wide rpm range. I thing this might have to do with fueling when throttle is closed. Or am i completely wrong?

Regards