A Detailed Description For Motronic 4.3 Ecus Used in Volvo 850 T5 (R)
A Detailed Description For Motronic 4.3 Ecus Used in Volvo 850 T5 (R)
A Detailed Description For Motronic 4.3 Ecus Used in Volvo 850 T5 (R)
Software ........................................................................................................................................................................................................................... - 11 -
Schematic ................................................................................................................................................................................................................... - 27 -
Parts information....................................................................................................................................................................................................... - 27 -
Special thanks for getting all this together go out to rkam, T5_Germany, Steve Hayes and others on
ecurproject.com, trionictuning.com and volvospeed.com.
Datasheet documents
http://trionic.mobixs.eu/Motronic/M4.3/80c535.pdf
http://trionic.mobixs.eu/Motronic/M4.3/80c517um.pdf
Please note that very early M4.3 units has EPROMs in stead of flash chips. The correct number for these
are 27C256. The early ECUs that have EPROMs are labelled “TOMAS”.
Once we download the data from the ECU – either with a flash programmer or by hooking up a K-line
interface we can load the file into Motronic Suite (ref: http://trionic.mobixs.eu/Motronic/Motronic.msi)
We can see the most important maps being automatically detected and we can change them to our
likings. Be careful though, you need to know what you are doing. The software can generate a
differences list between two files as well and if we compare a stock file to a tuned file we can see only a
few maps get edited normally.
The software contains a lot of information for which we have to know the conversion factors to use to
be able to translate them into units that we use on a daily basis. This is a shortlist of the most used
factors.
In the software, the identifiers are stored as well about HW revision, SW version, volvo partnumbers etc.
This data is stored in ASCII in the binary file and looks something like this:
In which
0261204134 is the hardware ID
1037358586 is the software ID
9125329 001 is the Volvo partnumber
45/1/M4.3/19/117.50/DAMOS25//2500AE01/040696
In which the latter string is the date of software build.
We convert the binary file into assembly language we need to disassemble the file. We can do that by
running the disassembler in Motronic Suite, by running the disassembler manually or by using a
seperate program like IDAPro to do it for us. A seperate disassembler can be found here in the website.
Once we disassemble the binary file we have an file containing the complete assembly listing in which
we can start to explore and understand the internal workings of M4.3.
Determining the location and type of maps and variables in the M4.3 binaries is quite a hassle. To be
able to detect the available maps we have to do some tricks and make a couple of assumptions in the
algorithm used. This chapter will describe – in detail – what the Motronic Suite software does to fetch
the maplist from the file.
The first two bytes tell us a lot. If the symbol is an axis (support point list) the first byte is the identifier
which tells us the type of data it consist of. In this case, the first byte is 0x38 which translates to coolant
temperature. The second byte is the length of the axis, in this case only two bytes. The Motronic Suite
software assumes (thin ice!) that symbols found that start with a value >= 0x03 and <= 0x99 AND that
have a length < 32 are axis symbols. After validating the symbol the software tries to determine any
trailing axis symbol right after the symol that was just validated. In our example it looks at address
0xE9F5 an again validates this offset to be an axis (using the same method). We find identifier 0x80 and
length 0x80 which would not classify this data as being an axis because the length exceeds 32 bytes.
This procedure is done for all addresses found in the lookup table and the software stores the found axis
in a list containing the addresses and the data for the axis.
Boost map
The boost map has a length of 128 bytes and since there is only one map in the file with this length it is
pretty easy to label this one and the boost map.
Overboost map
The overboost map has a length of 64 bytes and the x axis is of type 0x3B. Since there is only one map
with these properties it is easy to label it as the overboost map.
The reversed code shows this piece of code that uses a pointer to the rpm limiter:
So we search the file for bytes sequence 0x74 0x04 0xB5 0x3E 0x05 0x74 0x86 0xB5 0x3D 0x00. The two
byte in front of this sequence is the pointer to the RPM limiter.
There also seems to be a second RPM limiter in the file that is located 3 bytes further than the first one.
This one is only 1 byte long and should be multiplied by 40 to get a valid RPM value. This second limiter
is also handled and updated by Motronic Suite.
The reversed code shows this piece of code that uses a pointer to the speed limiter:
So we search the file for byte sequence 0xE4 0x93 0x87 0xF0 0xB5 0xF0 0x00 0x92 0x50 0x22 0x75 0xA0.
The two bytes in front of this sequence is the pointer to the vehicle speed limiter.
in which is the ratio between MAF output and MAF reference voltages.
(LOAD)is not just a representation of cylinder filling, but the theoretical Injector Time Open ( )
needed to reach stoich (Lambda= 1) with the current injector setup assuming that the motor has an
efficiencey of 100% (VE), which it has not of course. Hence there are fueling tables which are used as
multiplicative corrections to to reach the actual .
With quantified, Motronic now takes into account the correction factors for the engine and the
current operating conditions by introducing multiplicative factors to correct the THEORETICAL injector
time to the ACTUAL time for injection ( ) needed at that operating condition point. Finally an additive
The final is the injector open time that is applied to the injectors.
Connection diagram
There are two methods of communication that can be used with a M4.3 ECU.
Normal mode communication
Boot mode communication
Normal mode is used for reading data from the ECU while it is in its operational state. Reading live data
and the contents of the flash file are procedures that are carried out in normal mode.
To activate normal mode communication we need to connect a K-line interface to the ECU on pin B5 and
after the wake-up procedure communication can commence at 12700 baud.
To be able to communicate in normal mode, the ECU needs to be aware of the fact that there is a
diagnostics device connected to pin B5. To let the ECU know we need to send a 0x10 byte to the port at
5 baud (!). After a correct wakeup byte on the B5 pin we will receive a response from the ECU at 12700
baud. This response will be 0x55 0xAB 0x02 in which the 0x55 is the acknowledge and the 0xAB and
0x02 are the keywords used to communicate with a M4.3 ECU. After reception of this sequence we need
to send an acknowledge message to the ECU which is the inverted last keyword which will be 0xFD.
After the wakeup procedure, communication with the ECU takes place in the KWP71 protocol. This
protocol is standarized and therefore it will not be discussed within this document.
Boot mode communication is only useful for flashing the ECU with a new firmware version. This is a
special mode which is indicated to the ECU by pulling pin B8 to +12V before the ECU starts (boots). So,
you will need to have the ECU powered down and apply +12V to B8 before the ECU is powered on. The
ECU will now run a special boot loader program which resides in internal ROM and allows us to
reprogram the ECU. After starting in bootmode communication can commence on pin B5 at 9600 baud
with a K-line interface.
Programming sequence
The programming sequence for M4.3 looks like any other ordinary reflash sequence.
Verifying communication
To verify a valid connection between application and ECU a dummy command is issued on the serial
port. Send some valid sequence like 0x3A 0x00 0x00 0x00 0x00 0x00 0x00 0x00
This should result in an ACK returned from the ECU.
The 8-bit sum of the numbers behind 0x3A should always be 0x00, this functions as a checksum.
To erase the flash we need to send command 0x01 with a valid keycode for access to the ECU. The
access code is 0x11 0x22 0x33 0x44 0x55. The final command for erasing the flash is:
0x3A 0x01 0x11 0x22 0x33 0x44 0x55
Since erasing the flash takes some time and the application controlling the ECU should not freeze and
should be able to deliver some feedback to the user the ECU delivers two responses to this message,
one is issued when it starts to erase the flash and one is issued after the erase procedure has finished.
Start erase: 0x02 0x30 0x59 0x30 0x39 0x03 0x62
Finished erase: 0x02 0x30 0x59 0x30 0x35 0x03 0x62
After erasing the flash we have to send the byte sequences to program the flash with new values. This is
actually the new binary file that we are sending to the bootloader so it can program this into the erased
flash. Since we cannot send the entire binary file at once (because of limits to the receive buffer in the
ECU) we have to send small blocks of data at a time and repeat this procedure until all data is processed.
Each command contains up 32 bytes of data to be programmed and the address it should be
programmed at in the flash.
0x3A 0x20 0xaddr1 0xaddr2 0xaddr3 [32 bytes of program] [checksum, 1 byte]
A typical sequence would be (0x indicators are omitted here for easier reading, all data is in hex though)
3A 20 00 00 00 02 7D 44 02 2A DE FF FF FF FF FF 02 2A E6 FF FF FF FF FF 05 17 32 FF FF FF FF FF 02 1D 97 FF FF 0E
command 3A 20
address 00 00 00
data 02 7D 44 02 2A DE FF FF FF FF FF 02 2A E6 FF FF FF FF FF 05 17 32 FF FF FF FF FF 02 1D 97 FF FF
checksum 0E
Please note that the address bytes are structured a bit odd. The file is 0xFFFF bytes long so normally we
would assume that the address in the command would range from 00 00 00 upto 00 FF FF but this is not
the case. We need to have the high order by in addr1 and the low order by in addr2, while we keep
addr3 filled with 0x00. Programming at position 0xCAE0 would yield a command that starts with
3A 20 CA E0 00
After we have send all the data containing the new binary to the ECU we need to make sure that the
ECU understood what we send and if it succeeded in programming the flash chip. This is important
because the timing of the programming sequence is key and there might be disturbances when windows
tries to do silly things.
To verify the operation we send these two commands and we wait for a response from the ECU.
3A0000000000
3A30303030303030314646
If the response is
02 30 59 30 34 03 xx we have a positive indication from the ECU.
If the response is some other command like
02 31 59 30 31 03 xx or
02 31 59 30 38 03 xx we have a negative indication from the ECU and we should retry programming.
This is given for reference only so you can explore the bootrom on you own.
The Motronic 4.3 binary files are not extremely hard to reverse engineer. The 8051 based processor in it
means that there are several freeware disassemblers available to work with. The thoughest part is to
extract all the map and axis information from the file and to automatically determine which map means
what. Currently all maps are extracted and some are named by the software in the extraction process
like the ignition, main fuelling and boost maps.
1. We look through the file for sequence 0x00 0x02 0x05 0x07
2. After that we read 2 bytes at the time as integer 0xED 0x4C = 0xED4C = 60748 which is an axis
address in the file. We do this until the first read byte is smaller than 0xE0.
3. We now have a first list of addresses to process. For each found address we read two bytes at
that particular address in the file. For the given example fo address 0xED4C we would read f.e.:
0x04 0x0C. The first byte is the identifier (which type of data it concerns) and the second byte is
the length of the data for this axis. So, we have identifier 0x04 and length 0x0C. Now we
continue to read 0x0C (=12) bytes from the current location in the file. We read f.e. 0x07 0x0D
0x14 0x1B 0x1F 0x20 0x1C 0x17 0x12 0x0D 0x0A 0x18.
4. Motronic 4.3 has coded axis values, so we need to decode this information to get to the “real”
values that correspond to units we use every day. This decoding is done as follows. We take the
last value in the list (0x18) and calculate the maximum axis value with this formula: (256 –
last_value) * correction factor. The correction factor for axis with ID 0x04 is 1 (ref: correction
factor document), so the maximum value would turn out to be 256 – 0x18 = 256 – 24 = 232.
Next we take the second to last value from the list (0x0A). The real value is again calculated as
follow previous_real_value – (value * correction factor). This results in 232 – (0x0A * 1) = 232 –
10 = 222. The next values are calculated in the same way. The next value is 0x0D which means
222 – (0x0D * 1) = 222 – 12 = 210. We calculate all values in the list like this and we end up with:
a. 256 – 0x18 = 256 – 24 = 232
b. 232 – (0x0A * 1) = 232 – 10 = 222
c. 222 – (0x0D * 1) = 222 – 12 = 210
d. 210 – (0x12 * 1) = 210 – 18 = 192
e. 192 – (0x17 * 1) = 192 – 23 = 169
f. 169 – (0x1C * 1) = 169 – 28 = 141
g. 141 – (0x20 * 1) = 141 – 32 = 109
h. 109 – (0x1F * 1) = 109 – 31 = 78
i. 78 – (0x1B * 1) = 78 – 27 = 51
j. 51 – (0x14 * 1) = 51 – 20 = 31
k. 31 – (0x0D * 1) = 31 – 12 = 19
l. 19 – (0x07 * 1) = 19 – 7 = 12
Our calculated axis now results in: 12 19 31 51 78 109 141 169 192 210 222 232
0.50 0.85 1.20 1.60 2.00 2.50 3.00 3.50 4.00 4.65 5.30 5.95 6.60 7.25 7.90 8.55
The ECU partnumbers and engine code information is important when starting your tune. This appendix
will give you handles on where to start.
Engine code
Schematic
Parts information