Bosch Motronic 4.3 Engine Management Unit

Bosch Motronic 4.3 Engine Management Unit - Part 2
Please read and understand the disclaimer before you go on.
Click here to view disclaimer

Okay, so let's recap. We have opened up the ECU, and established that it uses a Siemens microcontroller. Firmware is stored in an external 64k-bit x 8 FLASH device. I suggest that before proceeding any further you take the time to read through the data sheets for these two devices. In doing this you will understand the architecture of such devices before we begin to modify anything.

So how do we access the Firmware stored on the FLASH device? I will go back slightly and explain that years ago I delved in modifying Nintendo Game boy cartridges as well as having a go at writing small programs for such devices. So how does this relate to the ECU you may ask? Well the Game boy cartridges come as standard with ROM devices fitted. The cartridges were modified by removal of the ROM device and replacement with a FLASH chip. Furthermore these cartridges utilised a simple software selecting, or memory switching, circuit. This meant that several games could be stored on a single FLASH device and be switched between them thereby preventing the need to continually swap cartridges to play different games.

I would highly recommend that you visit the following site and have a read through it. It will give you some great grounding in what is being achieved here.

http://www.ziegler.desaign.de/readplus.htm#4MBit%20home

I would like to stress that this is not the final method that will be deployed. It is merely a way of showing you that a large FLASH device can be used to store several different programs and that they can be accessed by switching between the different memory banks of the FLASH device. For our ECU application, we could theoretically have several different firmware programs stored on a single FLASH device. To thereafter access any one of them would require a simple memory bank switching device. We will not be using the 'MB5' concept explained in the Nintendo pages. This is because it requires software coding to switch between memory banks. This project will use a straight forward hardware select device.

The concept of what is being done is not new. In fact many Ford owners have been 'tweaking' their EEC-IV ECU's for many years. Here is an image of the internals of an EEC-IV ECU;

To the bottom right corner of the image is a chip with a white label thereon. This is the ROM chip containing this ECU's firmware. In the next images you will see that there is an edge connector located adjacent to the ROM chip

The edge connector is the point at which the address, data and control lines for the Rom chip are brought out of the board to a common port. Included on the edge connector is a ROM disable line. When activated, the onboard ROM is disabled and the microcontroller looks for a program device on this port from which to read firmware data. This is the method used by many chip tuners. They modify the maps and blow an EPROM on a purpose made carrier board. This board is then plugged into this edge connector, disabling the onboard Rom. When the ECU is 'booted' up, the microcontroller runs the firmware now stored in the EPROM on the plugged in carrier.

If you wish, I suggest a search of the internet in respect of this method of reprogramming / modifying the ROM firmware. A couple of examples are:

http://acc-electronics.com/cloud/efi/amarch/eec.htm

http://www.tweecer.com/index.html

Okay, so now we have an understanding of how to 'attack' the hardware of ECU's. Let's move on and look at how we can modify these examples to work with the Bosch Motronic 4.3 ECU.

A number of years ago a site appeared on the internet whereby the author went into great detail on how to modify a Margneti Marelli ECU. His project involved the reversing of the firmware. An interesting point to mention is that he actually found that the firmware coding was not bug free. In certain situations the ECU could in fact not work correctly for the given conditions. Again, I would suggest taking a look at his website, and reading through the numerous pages. It was this site that gave me the inspiration to become involved in Engine Management Systems. You may find some of the information very technical, but it is very clear and again will give a good grounding in what is being achieved here.

http://www.sonic.net/~mikebr/efi/ecu_hdwr.html

In the next section I will move onto modifying the Bosch Motronic 4.3 ECU.