Results 1 to 5 of 5

Thread: E32 ECU/DME hacking.

  1. #1
    Join Date
    Aug 2010
    Shanghai, China
    My Cars
    1996 328i Convertible

    E32 ECU/DME hacking.

    As I saw people asking about Tuned ROM's in another post I thought I'd do some research.

    Its quite niche - hence the ridiculous pricing people charge for roms - time is money though!

    Here's my research so far. I'm basing it on the E32 735iL 1989/1990, as thats what I own (and can test for).

    Googling for E32 735iL gives:


    BOSCH 0261200179
    BMW 1730697

    Vehicle Applicability:
    BMW 3' E30 320i Touring 2.0 95kW/129PS (M20/ 206EE/KA)
    BMW 5' E34 535i 3.4 155kW/211PS (M30/346KB)
    BMW 6' E24 635CSi 3.4 155kW/211PS (M30 B35)
    BMW 7' E32 735i 3.4 155kW/211PS (M30/ 346KB/EC)
    BMW 7' E32 735iL 3.4 155kW/211PS (M30/ 346KB/EC)


    BOSCH 0261200179
    BMW 1722611

    Vehicle Applicability:
    BMW 3' E30 320i Touring 2.0 95kW/129PS (M20/ 206EE/KA)
    BMW 5' E34 535i 3.4 155kW/211PS (M30/346KB)
    BMW 6' E24 635CSi 3.4 155kW/211PS (M30 B35)
    BMW 7' E32 735i 3.4 155kW/211PS (M30/ 346KB/EC)
    BMW 7' E32 735iL 3.4 155kW/211PS (M30/ 346KB/EC)

    ETK however says

    No.Description Supplement Qty Part Number Price
    01AT-Control unit Motronic HARDWARE 1.3 1 12141738168 ENDED
    01AT-Control unit Motronic HARDWARE 1.3 1 12141748258 $813.86

    Whatever the actual revision used, its pretty clear we have a v1.3 Motronic.

    Wiki ([ame][/ame]) says:
    The Motronic 1.1 System was used by BMW from 1987. This was then superseded in 1988 by the Motronic 1.3 system[6] that was also used by PSA on some XU9J-series engines (which previously used Motronic 4.1).[5]
    The Motronic 1.1 and 1.3 systems are largely similar, the main improvement being the increased diagnostic capabilities of Motronic 1.3. The 1.3 ECU can store many more detailed fault codes than 1.1, and has a permanent 12-volt feed from the vehicle's battery which allows it to log intermittent faults in memory across several trips. Motronic 1.1 can only advise of a few currently-occurring faults.[6]
    The systems include a knock sensor for ignition timing adjustment and the option for a lambda sensor, enabling their use with catalytic converter-equipped vehicles.[5]
    The ECUs have 2 injection outputs, and the injectors are arranged in 2 "banks" which fire once every two engine revolutions. In an example 4-cylinder engine, one output controls the injectors for cylinders 1 and 3, and the other controls 2 and 4. The system uses a "cylinder ID" sensor mounted to the cam-shaft to detect which cylinders are approaching the top of their stroke, therefore which injector bank should be fired. During start-up (below 600 RPM), or if there is no signal from the cylinder ID sensor, all injectors are fired simultaneously once per engine revolution.[6]

    DME / ECU 1.3 Info.

    Tuning is set in 2D map.

    Motronic 1.3 from 1989: The fault code memory is extended to contain all fault codes that are detected by the EMS.
    In vehicles sold in the USA, when the ECU detects that a some faults are present it earths pin 15 and the Check Engine warning lamp on the dash will light. The lamp will stay lit until the fault is no longer present. A warning lamp is not fitted to vehicles sold in other markets. The faults that will turn on the lamp are mainly those concerned with emissions. Other faults are logged by the ECU but the lamp will remain out.

    ECU (DME) sensors run off 5v

    Download extended info here -

    DME bootup: (roughly paraphrased)
    Interestingly enough I got to learn this properly via the tips and tricks for checking why the car doesn't start..

    Ignition switched on:
    ECU earths 85 , 36 which causes relay to close and 30 is connected to 87 starting the fuel pump. (30+87 can be bridged manually under the green relay to test pump). Its opened for +- 1 second.

    Next up it reads values from the CAS (Pulse Sensor). If it reads a speed signal (aka is it turning), so fuel pump stays on.

    CAS is used to time the pulses (read from each turn of the flywheel), this is checked against the map file for correct speeds (need to use a multiplier for the map values vs the flywheel pins).

    The Motronic ECU contains a fuel map with an injector opening time for basic conditions of speed and load. Information is then gathered from engine sensors such as the AFS, CAS, CTS, and TS. As a result of this information, the ECU will look-up the correct injector pulse duration right across the engine rpm, load and temperature range.

    The injectors are arranged in two banks with injectors 1 and 3 (4 cylinder) or 1, 3 and 5 (6 cylinder comprising one bank, and injectors 2 and 4 (4 cylinder) or 2, 4 and 6 (6 cylinder) making up the other bank. Each bank is connected to the ECU via an independent ECU pin.

    The Motronic 1.1 & 1.3 multi-point injection system pulses the injectors semi-sequentially and once every two engine revolutions. During engine start-up below 600 rpm the ECU pulses all injectors simultaneously. Once 600 rpm has been attained and if the ECU has received a signal from the CID sensor, each injector bank will be pulsed alternatively according to which pair of cylinders are approaching TDC. If a signal is not received from the CID sensor the injectors will remain on simultaneous operation. However, if the CID sensor subsequently sends a signal to the ECU after the engine has commenced running, the ECU will pulse the injectors semi-sequentially after the next deceleration phase - even if the CID sensor then ceases to send a signal.


    Motronic troubleshooting (aka code readout)

    The fault codes for these systems will appear on the check engine light when you turn the ignition key to the On position (but dont start it), then: fully depress the accelerator pedal, then fully release it. Repeat the depress,release cycle 5 times fairly quickly, but not too fast. It should be completed in a few seconds. What you are doing here is clicking the wide open throttle switch then the idle switch each 5 times. This signals the Motronic unit to send the fault codes by flashing the Check Engine light. You should see the light flash once then it will start flashing the 4 digit codes. If there are no faults, you should see the 1444 code (and 2444 if you have a 12 cylinder). The codes appear as a series of flashes for each digit. The flashes indicating one digit are about 1 second apart, the next digit appears after a couple second interval.

    Get the codes from:

    Other notes:

    CPU most likely 8051
    EEPROM 26C256, so 32KB / (32768 byte) chip. 28 pin.
    Can also use a 64KB chip, just ground the relevant pins for which 32kb to use or burn one rom at appropriate location. Useful for running 2 tunes - eg original and second.

    Tools available for this eg

    Should run from a AT29C256 or similar.

    ECU interesting pinouts:

    Pin 55 TX
    Pin 13 RX
    Pin 2/19/24/26/14 GND

    File layout (unchecked)

    AFR idle: 0x662E (pos 26158)
    AFR partial: 0x6662
    AFR full: 0x6640

    ign idle: 679A
    ign partial: 0x67FE
    ign full: 0x67CC

    Sample bin file here:

    (I'm having issues downloading that from China, so haven't checked it yet against the alleged layout).

    Table calculations:

    fuel maps correspond to (value/128 +1)*lambda_1

    Bosch-Motronic f(n) = (n-30) x 0.75
    some Bosch f(n) = (n-509) x 0.75

    Bosch KE-Motronic und Mono-Motronic
    f(n) = [(255-n)/6] +1

    Motronic info

    Very useful info for looking this up from

    Maps 20 bytes each

    Other thoughts - now we know what pinouts / values are expected in the system, guess just need to see what equipment provides appropriate inputs. eg, replace expensive spares with cheaper/better modern versions.

    Most of the differences are usually in the mounting afaik, not the tech.

    Motronic pinouts and board details here -

    Lots of people working on this kind of thing with software like tunerpro / xdf (map) files.

    *Good* forum for info (although not relevant to the Bosch ECU's, but concepts / strategies same)

    The motronic 1.3 software in most of the E32's should be fairly easy to modify - its all been documented well online before, so just a matter of getting a few rom files for specific models, and comparing tables.

    Shogun has at least one rom (as he's burning and selling them according to another post).
    I can extract the current one from my DME and make a bin file for comparison.
    We also have the rom from

    Should be enough to see where the changes are for the E32 / 8051CPU Motronic 1.3 anyway, so that I can tweak.

    Another lucky thing is that I also used to write embedded software on 8051 cpu years ago (although I've forgotten it all by now)

    Any interest in this from others (I'll need more rom's though)?

  2. #2
    Join Date
    Apr 2010
    My Cars
    2010 E60, E34, E46
    Anyone have any proms or downloadable data for a E34 1992 535i
    DME 0261200179

    Stock or performance ones?

  3. #3
    Join Date
    Aug 2008
    My Cars
    8/88 750iL
    Yep, I have M70 and M30 roms:

    M60 roms (both 404 and 464):

    They're all stock though. I've been meaning to buy myself an eprom programmer and rip my Dinan one, and rip a few others and upload
    Last edited by paulmer; 12-09-2010 at 01:51 AM.

    1989 BMW 750iL (prod 08/88) (vin: 2768675)
    Gone but not forgotten: 1994 BMW 740iL (prod 10/11/1993) (vin: *DE89667) 6spd swap, 2001 BMW 740i Sport

  4. #4
    Join Date
    Jan 2011
    Raleigh NC
    My Cars
    2004 745li
    I have an eprom programmer and would gladly rip the chips for you if you want. I would be interested in the M30 chip info.

  5. #5
    Join Date
    Aug 2010
    Shanghai, China
    My Cars
    1996 328i Convertible
    Unfortunately I sold the 7 for a 3 series, so don't have that car anymore.

    Given the lookup tables are fairly basic, shouldn't be too much work to check the values though. I was looking for a stock rom, a modded rom, and another rom to check what values people were using. One of the links above was to a Porsche site which has the lookup tables. If you have dumped the rom, it had the offsets or byte values to look for, and you can easily work it out from that. Suggest dump that into excel, and graph to see what fuel/power curve they're using for stock, vs modded, and compare.

    I suppose if you poked me with a stick enough times, I could get off my ass and do it for you though

    New "toymobile" in China is a 96 328i Convertible, with M3 mods (previous owner). I'm repainting, and returning some of it to stock though. The silly fake M3 side things are the first to go. Was embarrassed to have that on the car!
    I like the sound of the M3 exhaust it currently has on it though, the sound is a wonderful deep purr to growl that says watch out, douchebag with sports car on his way Gets the bicycles and pedestrians out of the way though, so it does its job haha.

    I did like the 7 though, its a fine drive, much like my other car garaged back home, my '77 450SLC Merc in mint condition.

    Have to say, I much prefer older cars. I've had a new 3 series, and actively hated it as it was so annoying. Bing bing f..king bing all the time. It wasn't a car it was a nanny. Got to me so much so that I sold it at a loss, and bought the 7.

    The 7 begat the 3 (and the 3 is pre stupid nanny computer. It only bings when it makes sense - eg you've turned the car off and the lights are on).

    My colleague just bought an M5 (2009 model), and thats his first complaint about the damn thing too...

    I also think his interior is too damn similar to the E90 3 I had, the M5 should be decent inside, but its almost identical - plastic crap... Not what I would expect for the price you pay...

    ...but thats a whole different diatribe

    Last edited by shanghailoz; 03-02-2011 at 03:15 AM.


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts