The early 1802 CPU based Motronics were used by BMW for the 325e and 528e, the 533i and certain years of 633CSi and 733i.

They have 4KB of ROM from 0-$FFF, 128 bytes of RAM from $2200-$227F, and there is some I/O at $2000-$2023.

I have yet to find a complete dump of the 533i 008 ECU. I obtained one from the junkyard but it has four 1KB CDP ROMs with a multiplexed address bus which aren`t supported by my programmer. The others use a 2732.

ROM dump from 007 '82 528e Motronic ROM dump from 027 '85-'87 325e/528e Motronic

The only difference I have noticed in practice between the older 007 version and the 027 is that the newer box is more reluctant to cut the fuel off when engine braking. The tach usually has to be above 2K RPM for it to happen (making it mostly useless IMO) where as the 007 will usually send the MPG gauge to infinity when the throttle is closed at only 1500RPM. This behavior seems to depend on one of the values written to $2023. Looking at the area around $4DA, some tests are done and then either a $21, $22, or $23 are written by the old ROM. In the newer ROM there are additional tests and sometimes a $24 is written. Changing the byte at $F0C in the newer ROM from a $24 to a $23 will restore the lower fuel cutoff RPM.

There is also an 021 motronic which seems to behave like the 027 but I haven't dumped it because the chip is soldered down and I wanted to keep it in one piece as a spare for my car.

In the ROMs, there are a lot of differences in the data, the effect of which being unclear. The 027 ROM has some new code at $F00. Both have a jump table at $900 which in the 027 has a couple LBRs to $Fxx replacing calls to $Axx in the old one. There are also differences at $4B2.

What I have tested: rev limitter at $847, stock value is $7D when multiplied by 40 is 5000RPM. (Don't worry about the redline on the tach being at 4500, 4700, or 4800, it`s not relevant.) At $88B is a byte which gets written to $2021 (stock value is $B3). It seems to affect the RPM calculation (which I guess is done by the other large IC on the board). Increasing the value lowers the rev limit independantly of the value of $847, and also the fuel cutoff RPM. Decreasing it has the opposite effect. By filling the ignition map at $B1C with various values and then measuring advance using a timing light, I determined that the advance is equal to the value in the table plus 4 degrees (except at idle where it stayed at 8 degrees). The map is 16x7 with the values in the last column being used at WOT, and the rows being spaced roughly 500RPM apart. The last row is used from ~3500RPM on. Also, there does appear to be some interpolation for data points between rows.

I've never been good at figuring out other people`s code, and strange CPU architectures don`t help any.

  • There appears to be an interrupt service routine at $598, but I don`t know what triggers interrupts or for what purpose.
  • A bunch of stuff gets written to $2023, mostly constants.
  • The code at the very beginning writes zeros to all of RAM.
  • At $9F, there is some stuff to "emulate" a subroutine call since this CPU has no such opcode. R(4) is loaded with $9F and set as the program counter with the two bytes following the SEP instruction being the address of the routine. R(0) is increased by 2 and pushed onto the "stack" pointed to by R(2). When the routine finishes it returns by branching to $93 where R(0) is pulled from the stack and set as the program counter again.
  • Some registers appear to maintain the same value through the whole program. The high byte of R(9) is 8. The high bytes of R(2), R(6), and R(7) are $22. The high byte of R(8) is $20. R(E) is always $2023.
  • There are reads from $2001, $2002, $2003, and $2020.

    Dwell appears to be 4ms at low engine speeds. At 4K RPM it has dropped to about 3.6ms, and to roughly 2.4ms at 5800RPM (tested the same on both 007 and chipped 027)

    Injector pulse at idle:

    Injector pulse at full power:

    In the second half of the ROM there are various data tables. Some of them are a complete mystery, some are full of addresses pointing to code or other tables, and some have a particular pattern.

    What is all that stuff?

    wild-ass guesses as to what might be in there: cold-running enrichment, cold-running ignition timing modifier, dwell vs. battery voltage, dwell vs. engine speed, intake air temp vs. injector duty cycle

    In the 027 ROM, there are two data tables which appear to be 3 rows of 32 elements each, located at $DD9-$E38 and $E75-$ED4. In the 007 ROM there is only one such table located at $DAB-$E0A.

    Looking at one of the aftermarket chips, there are changes (compared to the stock 027 ROM) at:

  • 88B, 8AC, 8AD, 8F0, 8F1, 8F2, 8F5
  • in the ignition and fuel map areas at $B1C to $C1B
  • $C7A-$C8B
  • $CB5-$CC5
  • $CD4, $CD5
  • $CEE-$D06
  • $DA6-$DB1
  • $DD9-$E38 and $E75-$ED4

    questions: how to change ignition timing at idle? how to set ignition timing differently after 5K RPM? How do fuel map values affect injector pulse width?