Reading and writing ECU
Generally ECUs contains about 3 differents chips for stocking memory.
Contains informations regarding the vehicule and the immobilizer data
Microcontroller (MCU / MPC)
You could define this one as the "brain" of the ecu.
- Manage the inputs and ouputs
- Process all the calculations (Logics, functions)
- It posses its own memory
Flash memory (external memory)
Contains maps and few functions
Some ecu might not have an external flash memory and will use the embeded memory of the MCU (ME17.5 ecu for exemple).
- Fast memory, made to be written all over again (Good for 1,000,000 write cycle per sector)
- Offer sectors protections features (OTP)
Your ECU flashing tool will offer the possibility to either read all the memory or only a specific chipset. Memory cannot be changed while driving, you will have to turn off the engine each time you want to reflash modifications. It usually takes less than 5 mins, but it can be an hassle for tuning efficiently. You can however use an emulator if you are seeking live tuning features.
Everytime you edit a file, you will have to fix the checksums otherwise the engine won't start (except if someone disabled the integrity test).
A checksum is a generated number through an algorithm that match a certain memory block, it indicates wheter if the memory has been altered or not. If the memory block has been changed, it will not match the checksum and the integrity test will fail.
The ECU validate the checksums when it boot and will periodiclly recheck the checksums while driving.
You can use tools to recalculate cheksums (LSuite for example) and fix them. Some flashing tools will do it for you.
Reading and writing modes
There are 2 modes for reading and writing an ecu : OBD2 or Boot mode. Each mode has their own advantages and disavantages.
- User-friendly, no ecu removal required, just plug the cable to the OBD2 port
- Can only read flash memory (Some pricey tool can read eeprom, but might require boot mode to write it)
- On late ecu with TPROT, you might not be able to flash the file over OBD2 depending of your tool
Boot mode (OBD2 or Bench)
- Need to remove and open the ecu in order to ground the boot pin
- Can read anything even ecu with TPROT
When in boot mode, you shouldn't hear the trottle adapting nor the fuel pump priming.
Opening the ECU
This is required only for boot mode reads. The pictured ecu is a ME17.5, but it would be the same process for a ME7.1.1
Remove the 4x T15 bolt from the cover.
Using a heat gun, heat the edges of the ecu. It will make the sealant softer and make the cover removal easier
Using screwdrivers, gently pry the cover upward, then cut the sealant with a blade. Repeat the process on all the edges.
You can now remove the cover.
Reading and writing the ECU
Using MPPS V18+
MPPS is a very cheap solution, for reading it does the job in about 30 minutes. For writing, you might have to use boot mode and it can get tricky.
For reading, use "3.2L Bosch ME7.1.1 CAN". This module supports ST10 microcontroller and have the same memory chipset as the 2.5.
*If the identification fails (F1), ensure the OBD2 port is connected to the ecu CAN-BUS (CAN_L pin 58, CAN_H pin 60). MPPS does not use K-Line (pin 43).
Press F2 to read the file, the process will take about 30 minutes.
This is where MPPS can be troublesome. MPPS erase the flash memory and then proceed to program (write) the flash memory, but occasionally MPPS might not write the flash, but it will have erased the memory. If this happens, you will have to ground the boot pin (you can refer here), then write the file, it will give the following error : "Cannot download to specified address", write the file again, you will get this error : "General reject". Now key-off, close MPPS, key-on and proceed to writing the file again, this should do the trick.
For all tools, the ECU pinout should be the same
Refer to your tool's instruction for wires colors
Launch K Suite, go to PROTOCOLS
In the KTAG section, select BOOTLOADER ST10Fxxx and then BOSCH ME7.1.1 VAG HW III
A window will pop up with the warnings, recommendations and instructions. Once you read them, click ok.
You can select which memory you want to read or write. If you read everything, KTAG will save all the memory into one file. It will ask you if you want to save the files separately, click yes.
Files output will be .FLS (Flash), .MPC (Microcontroller), .EEP (EEPROM)
Bosch ME17.5 (2010+)
Using PCM Flash
Require module 65
*This module allow only writing operations and fix checksums automatically*
Plug-in your PCM flash key, launch the software. Use the following protocol :  VAG: ME17/MED17/EDC17 CAN TP2.0
First identify your ecu
You can now select and flash a file of the same part number
Pinout will vary between ME17.5 and ME17.5.6
Pinout might varies depending of your tool, please refer to your tool's manual. You will have to use the GPT connector on those ECU.
Using KTAG (Not for ME17.5.6)
Launch K Suite, go to PROTOCOLS
In the KTAG section, select BOOTLOADER TRICORE then BOSCH MED17 VAG
Read the warnings and recommendations. Then click ok.
You will be promted to select a plug-in, select 128 - BOSCH MED17.5 IROM TC1766 VAG (P128)
You can select which memory you want to read or write. If you read everything, KTAG will save all the memory into one file. It will ask you if you want to save the files seperately, click yes.
From there, KTAG will output the EEPROM and the MPC memory (MAPS)
- One-Time-Programming sectors cannot be overwrite, they are read-only
- Tuner protection use a encrypted connection when writing file, if your tool can't get the encryption key, you will brick your ECU and probably render the OBD2 port useless