993 Fuel map questions--many!!

[mmasse]

I am starting to play with my DME ('97 993 Euro Vario Engine). I am doing this just for fun. I would like to learn as much as possible about how the EFI works and eventually be able to do some changes in the programing myself. I know this is a very complicated issue...which makes it more fun!!

So far I did some (a lot) of research on the Net (including this forum), bought some books, some of which I still have to read, but I am feeling that I am learning a lot.

I was able to get some info from a couple of Performance chips that I have for my 993, and tomorrow I plan to read the stock Eprom, to see the difference.

Using some of the demo versions of the tuning softwares, I was able to identify some of the Fuel and Timing maps on the "sea of data" coming from the EPROM. Please see graphs below.

My questions in this opportunity are:

-how can I get the units for the different axis on the graphs?

-how can I conver the hexadecimal (or decimal) info coming from the EPROM in actual Fuel Trim value (lambda) data? Is there a specific formula for this? I tried to play with some formulas, but it seems that the relationship is not linear.

I would appreciate any help on this quest for knowledge. So far it has been great fun!!

Any comments on the differences between this two performance chip maps are very welcome.

Thanks in advance,

[ischmitz]

Did you notice that there are at least 4 to 6 different maps for fuel and timing plus several maps for WOT and idle in a given chip dump. They get selected based on the region coding. Some performance chips simply have identical maps in all locations while other have the pointers modified to overide the region coding.

[mmasse]

Yes I notice that there were several copies of the same map, at least in one of the chips. ..and i wonder what was the reason for that...now I understand.

I also know about the WOT maps, but I am having troubles identifying those. any tips on this?

Any idea how to convert to actual lambda values?

Also it would be interesting to know where the rev limiter info is located. I wonder if it has been changed. I saw a post from Steve W. explaining where this info is stored on the 84-89 Carreras, but no idea about the location on my 993 Eprom.

Thanks

Mario

[mmasse]

Ok, today I read the info on my Stock EPROm in order to be able to compare with my two Performance Chips: Cyntex and C-Tune.

My first BIG surprise: The Cyntex chip is IDENTICAL to the Stock chip. No changes whatsoever!!! I felt really pissed off about this. It seems that they were just copying the Stock EPROM and reselling as Performance Chip!!! They didn't even change one bit of info. This seems not only unethical but kind of stupid to me!. See pic below of the two compared chips.


I will keep going with my research. I will greatly appreciate any input on my question about. any of the experts on this: Steve, Chris B, maybe?

[mmasse]

Ok, some more research and I am already able to answer some of my own questions.

- to convert fuel map decimal info on the EPROM to actual trim (lambda) values you do: data on EPROM/128= lambda value

-to convert the timing values you do the following: (data on EPROM - 20)* 0.698= timing value in degrees

I also beilieve to have identified the WOT and IDLE maps, but still I missing some info:

- how to find the actual units for the axis on the maps (RPM, load,etc).

-Can anyone point me to where the rev limiter info is located on the '97 993 EURO Vario (OBDI)?

Thanks

[jevvy]

Hey Mario

Sounds like you are making progress, I recent asked this question over on Impact Bumpers and got some useful responses:

http://www.impactbumpers.com/forum/index.php?showtopic=3125&hl=DIY+mapping

What emulator and chip reader are you using?

Please keep us posted with your progress.

[mmasse]

Hi jevvy,

Thanks for the reference I checked the post and has very good info.

I am still on the theory part so I have go into the emulation. I got a Willem EPROM reader which allowed me to get the info from my chips.

I have already identify the A/F and timing maps, but from what I was reading it seem that I also have to change the injectors width data. I have still no idea where this info is stored in the EPROM. any help on this will be very helpful!!!

I will keep posting my progress.

Thanks

[spuggy]

Hey Mario,

I think that, unless you can find someone to tell you the location of the information you want/need, you may need to do it the hard way.

(It'll be contained in Bosch-proprietary documents and programming specs/assembler listings of course, but you don't have those...)

The hard way is to disassemble/decompile the machine code on the chip, and work out how it's using the tables you've already found, and the locations of the info you want.

Here's something that some guy in Sweden has already put together (older Motronic though):

http://www.ludd.luth.se/~rotax/motronic/motronic.html

There's much information on reverse engineering generally and many tools available. There's no substitute for a knowledge of machine code, assemblers, compilers and embedded systems in this context, though.

Many people have certainly done something similar in order to understand the original code and thus modify the maps, unfortunately for you, many of them may regard this information as a proprietary secret gained in the course of persuing their business and probably don't want to share the information.

Another reason they may not be keen to talk about it is that reverse-engineering the PROM in this way is apparently covered by the Digital Millenium Copyright Act (DMCA), and may be illegal if performed in the US now.

Don't take this as legal advice, I am not a lawyer (although I can read plain English perfectly well, I'm old enough to know that this has nothing to do with interpreting law).

This may not be illegal where you live - this right is specifically protected in the EU, for example.

[RallyJon]

Interesting info, Mario.

About Cyntex, is it possible they are using the factory maps, but a different map than the stock, U.S. spec map?

Cyntex is one of the few shops in the U.S. that does live remaps of 993 chips. There is a fair amount to before and after dyno data from them. Not sure how that jives with your findings, but something doesn't sound quite right.

[ischmitz]

A couple of handy tools are:

IDA - Interactive Disassembler
This program is a very powerful disassembler for multiple platforms that will disect your machine code and try to generate readable assembler code. It requires some knowledge of 8052 architecture, machine language and assembler. Once you get the hang of it it really cracks down and does an awesome job.

8052 Simulator
Nice freeware to simulate the 8052 CPU. I have been able to run the 964 code of the EPROM on this simulator. While this is very neat it still requires some more detailed information to map the processor inputs and outputs to specific functions. You need hardware diagrams to tie it all together. Fun to play with and nice to better understand how 8052 assembler language works. It has a very rudimentary disassembler built in and you can step through the code.

Carrera Motronic Analyzer and Tuner v1.0
This was written a while back for the Carrera Motronic and has some neat features to locate and identify fuel and timing maps [idle, WOT, 2D). It even plots them. You can customize some par files to make it understand the 964 and later chips. I don't know if it ever got developed any further. Some of the information out there for the older Motronic still apply to the 964 and 993. However, the newer version 5.1 is much more complex compared to the version 3.

It seems that code for the 964 runs on more than one CPU. The EPROM that you read out contains the maps and some part of the Bosch Motronic code. But once you crunch it with the disassembler it becomes obvious that there most be more code elsewhere. And inside the Motronic there are I believe three chips (one EPROM and two 8052 CPU derivatives) with quartz windows or Bosch stickers. These CPU's have their own EPROM or PROM. So there seems to be code on one or both chips. To really understand you need to read out those chips as well, figure where in the address space each of the three chips are mapped, and where the memory is mapped. So I would guess you almost need to sacrifice one Motronic to create that information. For this you really need special tools such as logic analyzers and such.

I am sure that some tuners have done all this but are very reluctant to give it up since it is their "IP" and justification to charge a lot of money for their products. I doubt that this info is easy to come by. But you never know, it does not hurt to ask. Often times you see contributions from Russia and other eastern European countries on these subject. This seems to be a hotbed for reverse-engineering engine management systems.

If you get lucky and get ahold of old Bosch documents you might find all this in there. Let us know what you come up with and have fun. One can spend a lot of time on this, ask me how I know.....

I wouldn't be too concerned about the legal aspects unless you plan to launch a big commercial offensive on reverse-engineered products. As long as you do this for your own purpose it should be O.K. Have fun,

Ingo

[francesc0]

[QUOTE=mmasse;3348274]Ok, today I read the info on my Stock EPROm in order to be able to compare with my two Performance Chips: Cyntex and C-Tune.

My first BIG surprise: The Cyntex chip is IDENTICAL to the Stock chip. No changes whatsoever!!! I felt really pissed off about this. It seems that they were just copying the Stock EPROM and reselling as Performance Chip!!! They didn't even change one bit of info. This seems not only unethical but kind of stupid to me!. See pic below of the two compared chips.


I will keep going with my research. I will greatly appreciate any input on my question about. any of the experts on this: Steve, Chris B, maybe?



I found the same here in Italy. Some tuners resell the stock chip as it was modified (among this a really famous italian BMW tuner). In same cases they resell the entire ECU saying it is modified. The eprom market is full of cheaters.

If it can help you you should see this link http://apavlov.club.fr/motronic/ml31/ml31.html

[Lorenfb]

"It seems that they were just copying the Stock EPROM and reselling as Performance Chip!!! They didn't even change one bit of info."

So what's new and where have you been??????

The easiest performance upgrade sell of them all with a ZERO cost!