Reading and writing ECU

From The 07K Wiki

Revision as of 00:29, 24 July 2022 by Arte (talk | contribs) (ECU information, checksums, how to open, memory layout)

This section is underdevelopment by Arte. Feel free to add content.

ECU memory

EEPROM from a ME7.1.1

Generally ECUs contains about 3 differents chips for stocking memory. EEPROM

Contains informations regarding the vehicule and the immobilizer data

Microcontroller (MCU / MPC)

You could define this one as the "brain" of the ecu.

  • Manage the inputs and ouputs
  • Process all the calculations (Logics, functions)
  • It posses its own memory

Flash memory (external memory) Contains maps and few functions

ST10F725 MCU with AM29F800BB Flash

Some ecu might not have an external flash memory and will use the embeded memory of the MCU (ME17.5 ecu for exemple).

  • Fast memory, made to be written all over again (Good for 1,000,000 write cycle per sector)
  • Offer sectors protections features (OTP[1])

Your ECU flashing tool will offer the possibility to either read all the memory or only a specific chipset. Memory cannot be changed while driving, you will have to turn off the engine each time you want to reflash modifications. It usually takes less than 5 mins, but it can be an hassle for tuning efficiently. You can however use an emulator if you are seeking live tuning features.

Checksums

Everytime you edit a file, you will have to fix the checksums otherwise the engine won't start (except if someone disabled the integretity tests).

A checksum is a generated number through an algorithm that match a certain memory block, it indicates wheter if the memory has been altered or not. If the memory block has been changed, it will not match the checksum and the integrity test will fail.

The ECU validate the checksums when it boot and will periodiclly recheck the checksums while driving.

You can use tool to recalculate cheksums and fix them. Some flashing tool will do it for you.

Reading and writing

There are 2 modes for reading and writing an ecu : OBD2 or Boot mode. Each mode has their own advantages and disavantages.

OBD2

  • User-friendly, no ecu removal required, just plug the cable to the OBD2 port
  • Can only read flash memory (Some pricey tool can read eeprom, but might require boot mode to write it)
  • On late ecu with TPROT[2], you might not be able to flash the file over OBD2 depending of your tool

Boot mode (OBD2 or Bench)

  • Need to remove and open the ecu in order to ground the boot pin
  • Can read anything even ecu with TPROT

When in boot mode, you shouldn't hear the trottle adapting nor the fuel pump priming.

Opening the ECU

This is required only for boot mode reads. The pictured is a ME17.5, but it would be the same process for a ME7.1.1

Remove the 4x T15 bolt from the cover.

Using a heat gun, heat the edges of the ecu. It will make the sealant softer and make the cover removal easier

20210408 003459.jpg





Using screwdrivers, gently pry the cover upward, then cut the sealant with a blade. Repeat the process on all the edges.

20210408 003612.jpg




20210408 003635.jpg





You can now remove the cover.

20210408 003653.jpg




  1. One-Time-Programming sectors cannot be overwrite, they are read-only
  2. Tuner protection use a encrypted connection when writing file, if your tool can't get the encryption key, you will brick your ECU and probably render the OBD2 port useless