Chip Tuning Fundamentals

I started writing this article under a simple premise, to explain how our favorite tuners go about making chips and how these chips allow even our stock Euros to make added power. That's about the only simple thing you'll see in this article. I'll warn you now, this article might require a couple of reads and it will only skim the surface of aftermarket chip tuning. Most of the information here will be fairly general as every car, engine management system and tuner is significantly different. Hopefully you can at least have a better understanding of what chip tuners need to do to develop a product and how they go about modifying your stock ECU to create more power. I interviewed some prominent tuners from different sides of the industry, such as Dinan, GIAC and Powerchip, to gain an understanding of what they do and how it pertains to their market. I also tested Powerchip's software on an E39 M5 to see exactly how they go about their tuning. This article can't explain all fundamental concepts, but will hopefully point you in the direction of asking the right questions.

As many of you will point out off the bat, the term "chip tuning" is now more or less obsolete and a misnomer. The days of manually pulling and replacing EPROM chips from a factory electronic control unit (ECU) are long over. Chances are, a "chip" for your modern Euro is nothing more than a software upgrade that's reflashed onto your ECU's memory via the onboard diagnostic (OBD-II) port. This is sometimes referred to as serial programming and is actually the same thing that dealers do when you get your car serviced. Many times, just like with video games, there are patches or software updates that manufacturers send out to their dealers to ensure the vehicles are operating optimally. Serial flashing is the reason it takes a lot less time to get your car chipped nowadays than it did for your Mk II Jetta.

Modern ECUs

Carmakers go to suppliers such as Bosch, Seimens, Motorola and Magneti Marelli for engine management systems (EMS). These are complete electronics packages including the engine and transmission control units and any additional modules. The primary part of these EMS systems is the electronic brain, called the ECU or DME (Digital Motor Electronics for BMW/Porsche cars). All the vehicle's sensors required to run the engine, transmission, diagnostics, ABS, traction control, airbags and even security are also supplied with the integrated system. Between the car manufacturer and supplier, each system is custom designed and the software calibrated for each vehicle. Model year differences and sometimes option levels might also require different software calibrations and setup. As an example, one model year of the 3 Series might use an intake air temperature (IAT) sensor in the intake manifold while other model years use an integrated mass air flow (MAF) and IAT sensor. This means the ECU software and engine management algorithm would be different. There are myriad ECU configurations out there; some differences are even based on where the car is sold. European and U.S. market ECUs are very different since the two markets have different emissions regulations and fuel grades. That's why we can't use chips available from European tuners such as Alpina or AC Schnitzer.

The code

Reading raw code from an ECU's memory is like looking at your genetic code. You can read it in terms of its different base components like thiamine, cytosine, adenine and guanine, but to the untrained eye the individual values, much less a whole string, have no meaning. Deciphering this vast amount of data usually requires a trained eye and computer assistance. In the ECU, code is usually stored as 8-,16- or sometimes 32-bit instructions in hexadecimal format. Hexadecimal is a base-16 numbering system, meaning in addition to values running from 0-9 as in our (base 10) numbering system, it goes from 0-9 and then A-F. For example, the next value up from 00009 is 0000A. To non-computer geeks, reading hex code is like looking at some Matrix-like code string.

These values are unitless and can correspond to anything from your spark timing to your VIN number. For example, if you knew that a certain value corresponds to spark timing at a given load and rpm, an increase in that value could advance the spark timing by a set amount. Some management systems would advance it a degree per unit increase, others might advance it a fraction of a degree. It's all relative and easier to look at in terms of percentage changed. So an 8% change in a fueling parameter will yield an 8% change in how much fuel you inject. (I say could because some ECUs use a reverse convention where an increase in a value actually means a decrease in the output.) This is where tuners have to learn by trial and error.

Tables

Luckily, ECU designers are nice enough to group all the values for a fuel map or ignition map together into a table. A table is a matrix of values that an ECU references at a given load and rpm to figure out how much spark or fuel to deliver, sort of like a train schedule. This makes it easier for chip tuners to read data once they've figure out where each table begins and ends in the sea of code. Each discrete reference value in the table is called a cell or address. So when the car is at x rpm and y load (based on manifold pressure or air flow), it looks up the cell at x and y. If the load and speed do not fall exactly on a cell's coordinates, the ECU will calculate the appropriate value by triangulating from the values of the surrounding cells. Tuners often reverse engineer code by looking at what cells an ECU accesses during specific modes of operation. It could take up to two weeks just to map out the code and find addresses of interest for a given ECU.

Preventing hacks

The OEMs go to great lengths to ensure the integrity of their data and to guard their ECU code from people like us. This is mainly to prevent false warranty claims and also because legislation requires the ECUs to have security features to keep the cars emissions compliant. Older ECUs might use proprietary chips not readily available, or single flash chips that cannot be overwritten. Newer ECUs (now that they use flash memory) use software, chip and hardware encryptions and check sums. Tuners not only need to decrypt the code, but also disassemble it correctly so they can reasonably access its functionalities. Ironically, chip tuners also encrypt their code from to keep it from each other and, more importantly from the dealers. It's like a game of spy versus spy, where the undetected spy comes out the winner.

Power tuning and development

Chip tuners will take a whole spectrum of approaches to retuning your car for additional power. It has a lot to do with the type of car, level of modification, familiarity with the code and the market the tuner is trying to target. They are like artists with different philosophies, tools, approaches and abilities. The fact that they've cracked the factory ECU code means they are at least all already very competent at what they do.

I teamed up with Powerchip, an Australian tuning company, to see how they went about developing software for a stock E39 M5. Powerchip is a conservative tuning company that caters to many stock or moderately modified European platforms. Their emphasis is not necessarily on peak power, but drivability. In the case of the M5, Powerchip focuses on six primary modifications to the stock program: removal of the speed limiter, increasing the rev limiter, advancing part throttle and full throttle spark timing and rescaling of the e-throttle map for crisper response and leaning out the air/fuel at wide open throttle for added power. (For a turbocharged car, tuners will also modify the boost map for more significantly power gains, though over-aggressive turbo tuning will force the compressor to operate outside its optimal efficiency range.)

Changing the rev limit and removing the speed limiter is a simple matter of altering the values at a certain address that the ECU accesses. For the speed limiter, Powerchip just replaces the stock value at that address with something unattainable by the car. The real tuning (i.e. running the car) happens for the ignition and the wide open throttle (WOT) fuel tuning.