Hello and welcome to my Bosch Motronic page! Like many people I have found that owning a fuel injected motor vehicle can be very frustrating at times, especially when planning to modify the engine in an effort to increase performance. Engine Management Units are designed and programmed to provide the best performance whilst taking fuel economy and reliability into account. Many people see ECU's as an 'Oracle', a device of great mystery and which can only be understood by the manufacturer. To other's, such as myself, I see them as nothing more than Single Board Computers which are programmed to perform a specific function, in this instance to control the fuel delivery and ignition timing of an automotive engine.
In an ideal world it would be a straight forward process of researching and understanding all available data for the various components, reversing the system architecture, and then designing and building the tools to access the components so as to re-program them. However, and I suppose taking into account the need for the likes of Bosch to retain commercial viability, the manufacturers of ECU's utilise several 'trick' features to make the process almost impossible, if not very hard.
I have spent some time researching the Bosch Motronic 4.3 ECU. Why you may ask? Well my present car is a Volvo 855 T5 and in the quest for improving performance I decided to look at the feasibility of extracting and modifying the firmware. The following information will hopeful be of help, if not use, to others. Please bare in mind that this type of ECU is fitted to other makes & models of motor vehicle so the principles can be transposed with a little bit of work.
Overview of Bosch Motronic hardware
Getting inside
To assist in the explanation of what I have done, I took a number of digital images. This is because I am a great believer in the concept that 'a picture speaks a thousand words'. So firstly, lets look at some images showing the Bosch ECU once it has been removed from the vehicle, and continuing through to the removal of the casing etc;
This is the ECU once it has been removed from the vehicle. You can clearly see that there is a Bosch label which identifies the variant number of the ECU. The ECU casing has a lever attached to it and this is so that the ECU can be locked in place when inserted back into the vehicle. You may find, depending on the make & model of the vehicle to which the ECU is fitted, that some other securing method is employed.
This image shows the under side of the ECU casing. I have marked the image to identify the cover locking tabs. To remove the cover simple swing the ECU locking lever around and out of the way. Then bend the four tabs back and lift off the ECU cover.
This is what you will find within. Quite a complex looking layout. The printed circuit board is tri-layer in design, uses surface mount components and looks very intimidating. This is where the fun starts. You will see that I have identified the Microcontroller and FLASH memory chips located on the board. In essence these are the only components that I am interested in respect of modifying the firmware.
Siemens Microcontroller
If you have got this far, then take a minute to look carefully at the Siemens microcontroller. You will see that there are embosed letters & numbers on the chip surface. There is also a reference to Bosch as well. These numbers, which identify the component, are in-house only numbers between Siemens and Bosch. This is the first attempt to stop anyone identifying the component. After much investigation I have identified this component as being a Siemens SAB 80C537 8-bit CMOS Single-Chip Microcontroller.
The SAB 80C537 is one of Siemens high-ended members of the Siemens SAB 8051 family of microcontrollers. It is based on the SAB 8051 architecture, but with the addition of expanded arithmetic capabilities, 'fail-safe' characteristics, analog signal processing and timer capabilities. For those interested the features of this microcontroller are;
12 Mhz and 16 Mhz operating frequency
256 x 8 on-chip RAM
64 Kbyte external data and program memory addressing
4 x 16-bit timer/counters
Powerful 16-bit compare/capture unit with 21 x PWM outputs
Versatile "fail-safe" provisions
8-bit A/D converter with 12 multiplexed inputs
Two full duplex serial interfaces
Nine ports: 56 I/O lines, 12 input lines
FLASH Memory chip
This chip is designated the AM28F512. It is a 512K-bit (64K x 8) CMOS FLASH Memory chip. It is ideally situated for applications requiring in-system or after sales firmware updates. This device is designed to endure over 100,000 program/erase cycles and has a data retention of 10 years. It is available in a 32 pin DIP package as shown in this application.
