Motronic 4.4 Overview

[InitialDriveGTR]

DISCLAIMER:

THE MAJORITY OF WHAT I AM PRESENTING IS MY OWN WORK, IT IS CORRECT TO THE BEST OF MY KNOWLEDGE, BUT IF YOU MESS YOUR CAR UP, NOT MY PROBLEM.

Overview:

So over the last two and a half years, I've been working on and off on Motronic 4.4, The engine management system used by the 1998 Volvo S70, V70, and I believe S90 and some of the newer 850's. In this first part, I'd like to summarize some good threads on M4.4.

Links aren't working for some reason

Part I: Overview

So here's some background information on the M4.4 ECU's. The main controller is a Siemens 8051 micro-controller running at 16mHz. There is no listed part number as these controllers were presumably manufactured specifically for these ECU's, but highly resemble those used in the M4.3 systems. This controller interfaces to a Intel AN28F010, a 1mBit flash chip. This is the place where all code and maps pertaining to the EMS (engine management system) are located. It has two 512kBit banks, which are mostly identical.

The Memory:

The two banks are mostly identical for two primary reasons. Speed and efficiency. Bosch, leaving M4.3 for ME7, needed to upgrade the hardware's memory storage. MY1998 came around, and ME7 was not ready for production. So one might say that M4.4 is a cross between M4.3 and ME7, IE volvo's "oh stuff quick, throw something together that works so we can put our new S70's out to market with a 'new' EMS". So anyways, the flash chip has these two banks, and switching between the two banks due to the structure of the microcontroller, is tedious. The microcontroller was not really upgraded from M4.3 to M4.4, and the one used in M4.3 was designed for use with a 27C512, a 512kBit EEPROM, with only one bank. So when M4.4 was implemented, the designers used a GPIO pin to switch between the two banks. Now the memory access structure of the microcontroller's gist is that you basically supply an address (17 bits long) and then the controller can either read or write 8 bits at that address. But the problem the designers faced was that the microcontroller's address bus was only 16 bits wide (note that when I talk about these busses, they are specialized electrical lines on the circuit board that are used ONLY for accessing the flash chip, and thus are faster than using other lines for this task), the 17th bit being the one to switch between the first and second bank in the flash chip. SO anyways, that basically means it takes more time to switch to the other bank and read a byte of data, than it is to have a second copy of that byte of data, in the exact same address on the bank the controller is currently reading from.

Checksums:

So here we are, with this flash chip (the one I just yammered on about) that has a total of 128K bytes. Bosch in their infinite wisdom, decided to use a mundane method for securing their ECU's. This is called a checksum, basically in the case of M4.4, two bytes in each bank that are unique to that software revision. Here is what someone posted in another thread:

Your M4.4 file has two checksums (one for block 0 - file offset 0x0 - 0xFEFF, and another for block 1 - file offset 0x10000 - 0x1FEFF). After you made corrections in those regions (like lambda disabling) - checksums must be recalculated.

Checksum for block 0 is stored at file offset 0xFF00, and for block 1 at file offset 0x1FF00. Ok, checksum procedure is exactly the same for both blocks, its just incrementally adding bytes to 16-bit word. Trivial C code below does the trick just fine:

CODE

volvocrc1=0;

for (i = 0x0; i < 0xFF00; i++ )

volvocrc1+=GetFileByteAtOffset(i);

volvocrc2=0;

for (i = 0x10000; i < 0x1FF00; i++ )

volvocrc2+=GetFileByteAtOffset(i);

So basically, to the people whose eye's are starting to glaze over, start with a empty bucket that is exactly 5 gallons (checksum buffer) , and full bucket of water (the data bank), the full bucket is of an unknown quantity. Now lets say that our friend faultywarrior has a water jug to move the water from one bucket to the other. faultywarrior needs to move all that water into the empty bucket, so he can dump it on his car which just caught fire. So he keeps filling up that empty bucket, and dumping it on his car every five gallons. That bucket that he keeps filling up is the checksum value. Every time he dumps it, that's the equivalent of the checksum becoming full, and the remaining water in faultywarrior's bucket is the overflow. Once he dumps the 5 gallon bucket, that overflow is the first thing to be added in for the next cycle. When faultywarrior runs out of water from the big bucket of unknown quantity, the water remaining in his 5 gallon bucket is the final checksum value. So I hope that helped.

Part II: Software Structure

People need to understand something very important about M4.4. THERE IS NO BOOST MAP. M4.4 does not use a MAP sensor, so how in the hell could there be a boost map. So now that's out of the way, M4.4 does have maps for target power output.

This map here is the target load.

One axis is for RPM, the other is for throttle angle. Now notice how the peak of the map is at 5100 RPM, which is a T5's peak power. Now also notice how the Z axis is unit-less, this value is the target load for the engine, at that RPM, and at that throttle angle. So now the issue is why does this only go to roughly 80%? Why not 100%? Well it's actually really simple. The accessories on your engine use power. Steering pump, alternator, AC etc are that 20% that is always being used. For M4.4, there are multiple target load maps, say one is for with AC on, and another for AC off.

Timing Advance (Z-axis is measured in degrees):

Target Fuel/Air Ratio (Z-axis is lambda value):

Knock Detection:

Idle control:

Here are some examples of idle control, the first is relative to coolant temperature, used when getting the engine up to running temp.

This one is target idle with the AC on:

Part III: Hardware Level

Logging flash use:

Figured I'd get this section sorta started

My bench testing ECU hooked up to my Zeroplus LAP-32128U logic analyzer. The board on the far left is a battery-backed SRAM, with 4 MBits of storage, so I keep four different flashes on that one chip and I can essentially switch between tunes by the press of a button (Basically my version of turbotuner)

Part IV: Modifications

I'd bet this is the section a lot of people probably get stuck at when they try to do this stuff themselves. Disabling checks for system components such as the catalytic converter checks, SAS pump check etc can be risky. There are several ways of disabling things in the ECU, and there is no single sure-fire way to disable things. In this section I'll cover some methods of doing these things.

Now this one is based off "Kir"'s information that is one of the links at the top. This is to disable rear lambda, what you do in the flash file is change the value from zero to the next highest possible value.

So go from this:

To

And rear checks for lambda are disabled. I have not confirmed this one, nor do I take credit for it either.

Glossary:

Byte: "a sequence of 8 bits (enough to represent one character of alphanumeric data) processed as a single unit of information"

Bit: "In communication and information theory, a unit of information equivalent to the result of a choice between only two possible alternatives, such as 1 and 0 in the binary code generally used in digital computers."

Microcontroller: "A microcontroller (also microcomputer, MCU or µC) is a small computer on a single integrated circuit consisting internally of a relatively simple CPU, clock, timers, I/O ports, and memory"

MAP Sensor: Manifold absolute pressure

PS I'm going to keep adding to this as I go, I just don't want to risk losing my work.

[flyfishing3]

Go Ben go

[Keep Calm Chive On]

Ben - when your finished maybe you can summerize all that into like 10-15 words cause its all over my head haha. Next time i take my ECU out im just gunna stare at it goin bleep bloop. might even try to do that "like a good neighbor state farm is there" jingle to my ECU & see if a sammich pops up in my hood. regardless your prolly gunna do something pretty damn sweet with all this i just dont know anything

[ozzimark]

Ben - when your finished maybe you can summerize all that into like 10-15 words cause its all over my head haha.

The ECU does stuff to keep the engine running!

Ben, awesome awesome awesome. I've been waiting for you to dump everything you've found out about ME4.4 for a long time now, I can see this thread being pretty useful

When you say that the microcontroller is basically the same, what is the difference? I recall reading that the ME4.4 can process data more quickly than 4.3, is the CPU actually faster? :lol:

[--Aaron--]

How many buckets of wat? :huh:

[mdlimy]

Win :tup: :tup:

[InitialDriveGTR]

How many buckets of wat?

Did you read it?

[RobT5M]

Ben - when your finished maybe you can summerize all that into like 10-15 words cause its all over my head haha. Next time i take my ECU out im just gunna stare at it goin bleep bloop. might even try to do that "like a good neighbor state farm is there" jingle to my ECU & see if a sammich pops up in my hood. regardless your prolly gunna do something pretty damn sweet with all this i just dont know anything

ECU goes beep beep, Car goes vroom vroom, Foot push gas to floor, ECU goes BEEEP BLOP BEEP!, car goes VROOOOOMMMMMMMMMMMMM.

Get it kurt?

Make sure the sandwhich doesnt appear inside your engine... then car wont go beep beep so much.

Good work mr initial

[fasteddie042]

Hmm, well ME4.3 seems a heck of a lot simpler in comparison to me4.4 . So what is the basic idea behind the operation of ME4.4 How does it calculate load? Have any links for reference?

[InitialDriveGTR]

Load is calculated from air flow, rpm, and throttle position. I have no references. This is mostly all my own research

[fischmama]

Did you do any research on the knock sensor input? Is there a map or similar?

[InitialDriveGTR]

Hope that helps you.

[Keep Calm Chive On]

holy shit... the pictures werent there last time... you have gone well beyond what anyone in my family will ever comprehend in a life time. This is crazy to me but you keep crackin the mystery of M4.4!!!!

okay so i continue to read because this is extremely interesting & i understand all of the stuff minus computer lingo. And yes ill get flamed here cause i usually dont make very comprehensive responses but here it goes although you prolly already know and might have explained the answer.

The 80% load, I have a little code reader / data scanner thing which i can leave on to record data. So when you have the actual ECU out & says 80% does that mean when my code reader says 100% load its really at 80% power load & the other 20% is from accessories? If this is a computer preset to only max out at say 80% would removing the A/C actually do anything to increase beyond 80% if its a set number in the computer itself? I know you said there was different maps for AC on or off but if it were removed all together would it be any better than just turning it off & utilizing the preset map? I understand the whole less rotational mass but i was talking computer wise would it allow it to go beyond what was preset for "A/C off"

Edited the last part.

[InitialDriveGTR]

holy stuff... the pictures werent there last time... you have gone well beyond what anyone in my family will ever comprehend in a life time. This is crazy to me but you keep crackin the mystery of M4.4!!!!

okay so i continue to read because this is extremely interesting & i understand all of the stuff minus computer lingo. And yes ill get flamed here cause i usually dont make very comprehensive responses but here it goes although you prolly already know and might have explained the answer.

The 80% load, I have a little code reader / data scanner thing which i can leave on to record data. So when you have the actual ECU out & says 80% does that mean when my code reader says 100% load its really at 80% power load & the other 20% is from accessories? If this is a computer preset to only max out at say 80% would removing the A/C actually do anything to increase beyond 80% if its a set number in the computer itself? I know you said there was different maps for AC on or off but if it were removed all together would it be any better than just turning it off & utilizing the preset map? I understand the whole less rotational mass but i was talking computer wise would it allow it to go beyond what was preset for "A/C off"

Edited the last part.

See? you can be smart too. Yes, you should get only 80% on your scan tool. And yes, removing A/C would help, but only if you can reprogram the ECU to account for the less restriction in the engines belt systems.

Now when I say there is no boost map, I mean the ECU never actually says "OK, I wanna do 17psi right now!", boost pressure control is actually a byproduct of several other maps, and the map that most directly controls the boost is the TCV pulse width timing.

[flaco]

GREAT info... can you explain why would the ECU want lambda >1 (lean) at high load & high rpm? :ph34r: