This was posted by myself over at BimmerForum’s, but as China’s Firewall is being particularly unpleasant these days about what sites I can and cannot visit, I thought I’d repost it here, so its more accessible for me.

Note – I no longer own a 7 series, so any requests for modded rom’s should probably be accompanied with nice gifts to persuade me to do the work involved 🙂

As I saw people asking about Tuned ROM’s in another post I thought I’d do some research.

Its quite niche – hence the ridiculous pricing people charge for roms – time is money though!

Here’s my research so far. I’m basing it on the E32 735iL 1989/1990, as thats what I own (and can test for).

Googling for E32 735iL gives:

ELECTRONIC CONTROL UNIT, DME MOTRONIC

BOSCH 0261200179
BMW 1730697
*26SA0840*

Vehicle Applicability:
1986-1993
BMW 3′ E30 320i Touring 2.0 95kW/129PS (M20/ 206EE/KA)
BMW 5′ E34 535i 3.4 155kW/211PS (M30/346KB)

BMW 6′ E24 635CSi 3.4 155kW/211PS (M30 B35)
BMW 7′ E32 735i 3.4 155kW/211PS (M30/ 346KB/EC)
BMW 7′ E32 735iL 3.4 155kW/211PS (M30/ 346KB/EC)

ELECTRONIC CONTROL UNIT, DME MOTRONIC

BOSCH 0261200179
BMW 1722611
*26RT2794*

Vehicle Applicability:
1986-1993
BMW 3′ E30 320i Touring 2.0 95kW/129PS (M20/ 206EE/KA)
BMW 5′ E34 535i 3.4 155kW/211PS (M30/346KB)
BMW 6′ E24 635CSi 3.4 155kW/211PS (M30 B35)
BMW 7′ E32 735i 3.4 155kW/211PS (M30/ 346KB/EC)
BMW 7′ E32 735iL 3.4 155kW/211PS (M30/ 346KB/EC)

ETK however says

No.Description Supplement Qty Part Number Price
01AT-Control unit Motronic HARDWARE 1.3 1 12141738168 ENDED
01AT-Control unit Motronic HARDWARE 1.3 1 12141748258 $813.86

Whatever the actual revision used, its pretty clear we have a v1.3 Motronic.

Wiki (

Motronic

) says:

DME / ECU 1.3 Info.

Tuning is set in 2D map.

Motronic 1.3 from 1989: The fault code memory is extended to contain all fault codes that are detected by the EMS.
In vehicles sold in the USA, when the ECU detects that a some faults are present it earths pin 15 and the Check Engine warning lamp on the dash will light. The lamp will stay lit until the fault is no longer present. A warning lamp is not fitted to vehicles sold in other markets. The faults that will turn on the lamp are mainly those concerned with emissions. Other faults are logged by the ECU but the lamp will remain out.

ECU (DME) sensors run off 5v

Download extended info here – http://www.opel-scanner.com/files/DME_1.1_1.3.pdf

DME bootup: (roughly paraphrased)
Interestingly enough I got to learn this properly via the tips and tricks for checking why the car doesn’t start..

Ignition switched on:
ECU earths 85 , 36 which causes relay to close and 30 is connected to 87 starting the fuel pump. (30+87 can be bridged manually under the green relay to test pump). Its opened for +- 1 second.

Next up it reads values from the CAS (Pulse Sensor). If it reads a speed signal (aka is it turning), so fuel pump stays on.

CAS is used to time the pulses (read from each turn of the flywheel), this is checked against the map file for correct speeds (need to use a multiplier for the map values vs the flywheel pins).

The Motronic ECU contains a fuel map with an injector opening time for basic conditions of speed and load. Information is then gathered from engine sensors such as the AFS, CAS, CTS, and TS. As a result of this information, the ECU will look-up the correct injector pulse duration right across the engine rpm, load and temperature range.

The injectors are arranged in two banks with injectors 1 and 3 (4 cylinder) or 1, 3 and 5 (6 cylinder comprising one bank, and injectors 2 and 4 (4 cylinder) or 2, 4 and 6 (6 cylinder) making up the other bank. Each bank is connected to the ECU via an independent ECU pin.

The Motronic 1.1 & 1.3 multi-point injection system pulses the injectors semi-sequentially and once every two engine revolutions. During engine start-up below 600 rpm the ECU pulses all injectors simultaneously. Once 600 rpm has been attained and if the ECU has received a signal from the CID sensor, each injector bank will be pulsed alternatively according to which pair of cylinders are approaching TDC. If a signal is not received from the CID sensor the injectors will remain on simultaneous operation. However, if the CID sensor subsequently sends a signal to the ECU after the engine has commenced running, the ECU will pulse the injectors semi-sequentially after the next deceleration phase – even if the CID sensor then ceases to send a signal.

—

Motronic troubleshooting (aka code readout)

The fault codes for these systems will appear on the check engine light when you turn the ignition key to the On position (but dont start it), then: fully depress the accelerator pedal, then fully release it. Repeat the depress,release cycle 5 times fairly quickly, but not too fast. It should be completed in a few seconds. What you are doing here is clicking the wide open throttle switch then the idle switch each 5 times. This signals the Motronic unit to send the fault codes by flashing the Check Engine light. You should see the light flash once then it will start flashing the 4 digit codes. If there are no faults, you should see the 1444 code (and 2444 if you have a 12 cylinder). The codes appear as a series of flashes for each digit. The flashes indicating one digit are about 1 second apart, the next digit appears after a couple second interval.

Get the codes from: http://www.unofficialbmw.com/repair_faqs/motronic.html

Other notes:

CPU most likely 8051
EEPROM 26C256, so 32KB / (32768 byte) chip. 28 pin.
Can also use a 64KB chip, just ground the relevant pins for which 32kb to use or burn one rom at appropriate location. Useful for running 2 tunes – eg original and second.

Tools available for this eg http://www.moates.net/font-size-12ti….html?cPath=31

Should run from a AT29C256 or similar.

ECU interesting pinouts:

Pin 55 TX
Pin 13 RX
Pin 2/19/24/26/14 GND

File layout (unchecked)

AFR idle: 0x662E (pos 26158)
AFR partial: 0x6662

AFR full: 0x6640

ign idle: 679A
ign partial: 0x67FE
ign full: 0x67CC

Sample bin file here: ftp://anonymous@bmw-wiki.org/ROMs/Mo…y-Motronic.bin

(I’m having issues downloading that from China, so haven’t checked it yet against the alleged layout).

Table calculations:

fuel maps correspond to (value/128 +1)*lambda_1

Bosch-Motronic f(n) = (n-30) x 0.75
some Bosch f(n) = (n-509) x 0.75

Bosch KE-Motronic und Mono-Motronic
f(n) = [(255-n)/6] +1

Motronic info

http://motronic.ws/

Very useful info for looking this up from http://motronic.ws/map201.htm

Maps 20 bytes each

Other thoughts – now we know what pinouts / values are expected in the system, guess just need to see what equipment provides appropriate inputs. eg, replace expensive spares with cheaper/better modern versions.

Most of the differences are usually in the mounting afaik, not the tech.

Motronic pinouts and board details here – http://www.e34.de/tips_tricks/motronic/m1_3.pdf

Lots of people working on this kind of thing with software like tunerpro / xdf (map) files.

*Good* forum for info (although not relevant to the Bosch ECU’s, but concepts / strategies same)
http://www.thirdgen.org/techboard/di…uide-book.html

The motronic 1.3 software in most of the E32’s should be fairly easy to modify – its all been documented well online before, so just a matter of getting a few rom files for specific models, and comparing tables.

Shogun has at least one rom (as he’s burning and selling them according to another post).
I can extract the current one from my DME and make a bin file for comparison.
We also have the rom from ftp://anonymous@bmw-wiki.org/ROMs/Mo…y-Motronic.bin

Should be enough to see where the changes are for the E32 / 8051CPU Motronic 1.3 anyway, so that I can tweak.

Another lucky thing is that I also used to write embedded software on 8051 cpu years ago (although I’ve forgotten it all by now)

Any interest in this from others (I’ll need more rom’s though)?

As my car currently has only 1 key, I thought I’d do a little bit of research into getting another one.
BMW quoted 2000rmb, which although understandable, is a little bit expensive. That doesn’t include the remote functionality in the current key either.

A check of taobao shows that you can buy blanks for slightly less – in the 30rmb range.
Mine is a 3 button remote, rather than a 2 button remote.

Images of both below:

Yes, I realise that these are just keys, and don’t contain the remote stuff either, but as a spare, its all I really need.

There is a fly in this ointment though. All European cars post 94 are mandated to include anti-theft immobilizers, which in BMW’s case involves checking for a transponder, so a key won’t start the car.
BMW calls this system EWS – Electronic Watchdog System.
A datasheet aimed at BMW workshop staff on EWS is here BMW EWS Overview and Worksheet

The infrastructure looks something like this:

I could buy a small board to bypass the EWS (about 130rmb), but I like the idea of having the anti-theft still working.

So, how does the EWS2 do the immobilization in my car?

A little bit of research shows that my current BMW (a 96 E36 import from German) uses BMW’s EWS2 for antitheft. This appears to be based on a motorola chipset ( XC424114CFN ) for the immobilizer side, and its relatively easy to read out or reflash the existing data from the chip if necessary should I need to do so.
eg if I lost all my keys, and needed to start from scratch. There are 3rd party tools galore that go into that eg CarProg, so not much point looking at that for me.

Lets look at the transponder side.
The transponder in my current key is a Philips PCF7930

This comes in a series – PCF7930, PCF7931, and PCF7935, and PCF7936

The main differences between the transponders are as follows:

PCF7930 – can read / write data.
PCF7931 – write once (one time programmable), read data.
PCF7935 – it has 2 area’s of memory general, and shadow memory, and both are read / write.
PCF7936 – it adds a crypto mode to the 7935 functionality.

The PCF7936 is also referred to as a Hitag2.
This is also the transponder current generation of BMW’s are using eg the E90/E92/E94’s

They’re quite simple devices really, a datasheet for them is here – PCF7930 / 31 / 35 Datasheet

They essentially have a few bytes of memory to work with.
32 bytes for control, and 80 bytes for user data.

Physically they’re about half the size of a fingernail and a few mm thick.

They look something like this –

A quick search on taobao shows that a PCF793x sells for between 17-20rmb or so.

So, so far I can get the key for about 30 odd, and the transponder for about 20rmb or so.

I still need to be able to program the transponder though, so whats available for that?

Another quick google shows that there is a common windows tool called anahtar which works with quite a few programmers.

As you can see, it supports quite a few pieces of hardware. Anahtar does need some hardware to talk to the transponder though, so I also need a transponder programmer.

A search for a normal RFID programmer is pretty polluted with car remote programmer spam sites.

That said, the usual result for BMW’s is the AK90 programmer. This is a bit on the expensive side – its around 1500rmb, and I really only need to do this once, so lets look for other options.

Ideally we’re looking for a low frequency rfid programmer.
If possible, I’d like to have something that does other chips too, so something that can cope with the below may be handy at some point, if only so I can steal peoples cars play with it.

RWProg looks interesting, as it has a lot of support for other rfid chips – http://www.bicotech.com/?page=prod_rwprog&lg=en.

Unfortunately a search for that on Taobao shows no results. RFID reader’s on the other hand are dirt cheap, with the cheapest usb ones going for 35rmb or so.

The specs for the PCF793x series don’t actually say what frequencies it runs off unfortunately, so its a little hard to find an appropriate device quickly.

I do note that there appear to be a disproportionate amount of card writers advertised on Taobao which claim to do Mifare, which not co-incidentally is similar enough to what is being used on the metro here in China in most cities for travel cards. I guess that means there probably are lots of fake ones around…

If I check whats usually used for programming the PCF793x series, Philips (NXP) pushes their PCF7991, while Philips doesn’t write what frequency that runs on either, this chinese site says 125khz http://www.docin.com/p-74627587.html

So, its a 125khz programmer.

Unfortunately those are 500bucks on tabao, so I keep looking.

…and Bingo, I can find a BMW key programmer which will do it for 350rmb.
Sounds good.

350 for the transponder reader/writer, 20 odd for the transponder, and 30 odd for a key.
400RMB total, and new copies of the keys will cost about 50rmb each vs the 2000rmb bmw wants.

Its a win!

Next up, what frequency does the remote use, so I can get a replacement for that…

My remote frequency is 433.92Mhz, as I have a Europe car.
I’ll guess it would probably be 315MHz if it was a US, CN or SA built car.

As I’ve had some negative comments about this all being possible, added some photos of the tool I bought to successfully clone my keys.

The box full of goodies.

Box contents

Key Cloning tool

Key Cloning tool side view

Key Cloning tool MCU adaptor side view

Box contents

Cloned keys (original on far left)

Software Side:

Installing hardware drivers
Device is a standard FTDI usb serial chip based product, needs 2 drivers installed, the first for the serial chip, then a second for the device driven by the usb to serial chip.

Installing software

Software running