Reading and writing ECU

ECU memory

EEPROM from a ME7.1.1

Generally ECUs contains about 3 differents chips for stocking memory.

EEPROM

Contains informations regarding the vehicule and the immobilizer data

Microcontroller (MCU / MPC)

You could define this one as the "brain" of the ecu.

• Manage the inputs and ouputs
• Process all the calculations (Logics, functions)
• It posses its own memory

Flash memory (external memory)

Contains maps and few functions

ST10F725 MCU with AM29F800BB Flash

Some ecu might not have an external flash memory and will use the embeded memory of the MCU (ME17.5 ecu for exemple).

• Fast memory, made to be written all over again (Good for 1,000,000 write cycle per sector)
• Offer sectors protections features (OTP)

Your ECU flashing tool will offer the possibility to either read all the memory or only a specific chipset. Memory cannot be changed while driving, you will have to turn off the engine each time you want to reflash modifications. It usually takes less than 5 mins, but it can be an hassle for tuning efficiently. You can however use an emulator if you are seeking live tuning features.

Checksums

Everytime you edit a file, you will have to fix the checksums otherwise the engine won't start (except if someone disabled the integrity test).

A checksum is a generated number through an algorithm that match a certain memory block, it indicates wheter if the memory has been altered or not. If the memory block has been changed, it will not match the checksum and the integrity test will fail.

The ECU validate the checksums when it boot and will periodiclly recheck the checksums while driving.

You can use tools to recalculate cheksums (LSuite for example) and fix them. Some flashing tools will do it for you.

Reading and writing modes

There are 2 modes for reading and writing an ecu : OBD2 or Boot mode. Each mode has their own advantages and disavantages.

OBD2

• User-friendly, no ecu removal required, just plug the cable to the OBD2 port
• Can only read flash memory (Some pricey tool can read eeprom, but might require boot mode to write it)
• On late ecu with TPROT, you might not be able to flash the file over OBD2 depending of your tool

Boot mode (OBD2 or Bench)

• Need to remove and open the ecu in order to ground the boot pin
• Can read anything even ecu with TPROT

When in boot mode, you shouldn't hear the trottle adapting nor the fuel pump priming.

Opening the ECU

This is required only for boot mode reads. The pictured ecu is a ME17.5, but it would be the same process for a ME7.1.1

Remove the 4x T15 bolt from the cover.

Using a heat gun, heat the edges of the ecu. It will make the sealant softer and make the cover removal easier

Using screwdrivers, gently pry the cover upward, then cut the sealant with a blade. Repeat the process on all the edges.

You can now remove the cover.

Reading and writing the ECU

Bosch ME7.1.1

OBD2

Using MPPS V18+

If you buy a V21, please ensure it has a reset function otherwise the device will lock itself after 10 operations and could leave you stranded

MPPS is a very cheap solution, for reading it does the job in about 30 minutes. For writing, you might have to use boot mode and it can get tricky.

For reading, use "3.2L Bosch ME7.1.1 CAN". This module supports ST10 microcontroller and have the same memory chipset as the 2.5.

*If the identification fails (F1), ensure the OBD2 port is connected to the ecu CAN-BUS (CAN_L pin 58, CAN_H pin 60). MPPS does not use K-Line (pin 43).

Press F2 to read the file, the process will take about 30 minutes.

Writing

This is where MPPS can be troublesome. MPPS erase the flash memory and then proceed to program (write) the flash memory, but occasionally MPPS might not write the flash, but it will have erased the memory. If this happens, you will have to ground the boot pin (you can refer here), then write the file, it will give the following error : "Cannot download to specified address", write the file again, you will get this error : "General reject". Now key-off, close MPPS, key-on and proceed to writing the file again, this should do the trick.

Boot mode

For all tools, the ECU pinout should be the same

Refer to your tool's instruction for wires colors

Using KTAG

If using a clone, ensure you're using an EU clone with a red board

Launch K Suite, go to PROTOCOLS

In the KTAG section, select BOOTLOADER ST10Fxxx and then BOSCH ME7.1.1 VAG HW III

A window will pop up with the warnings, recommendations and instructions. Once you read them, click ok.

You can select which memory you want to read or write. If you read everything, KTAG will save all the memory into one file. It will ask you if you want to save the files separately, click yes.

Files output will be .FLS (Flash), .MPC (Microcontroller), .EEP (EEPROM)

Bosch ME17.5 (2010+)

OBD2

Using PCM Flash

Require module 65

*This module allow only writing operations and fix checksums automatically*

Plug-in your PCM flash key, launch the software. Use the following protocol : [65] VAG: ME17/MED17/EDC17 CAN TP2.0

First identify your ecu

You can now select and flash a file of the same part number

Boot mode

Pinout will vary between ME17.5 and ME17.5.6

ME17.5 (TC1766)

ME17.5.6 (TC1767)

Pinout might varies depending of your tool, please refer to your tool's manual. You will have to use the GPT connector on those ECU.

Using KTAG (Not for ME17.5.6)

If using a clone, ensure you're using an EU clone with a red board

Launch K Suite, go to PROTOCOLS

In the KTAG section, select BOOTLOADER TRICORE then BOSCH MED17 VAG

Read the warnings and recommendations. Then click ok.

You will be promted to select a plug-in, select 128 - BOSCH MED17.5 IROM TC1766 VAG (P128)

You can select which memory you want to read or write. If you read everything, KTAG will save all the memory into one file. It will ask you if you want to save the files seperately, click yes.

From there, KTAG will output the EEPROM and the MPC memory (MAPS)