Tuning your Motronic ECU (ME7.1)

[the dog]

This just may be a boost cut map....
If the actual value of the boost is higher than the one show on the map it throws a cell and takes the car in safe mode..

I think I will conitrate on the n75 boost map for now.... Anyone was a vagcom log showing channel 118 at WOT from 2000 to redline of the S4/RS4 2.7T?

[NorCalS4]

Okay, major progress. Stay tuned.

[NorCalS4]

Okay, I have done a lot of work today and believe I have identified all the tables need to tune. I already ordered a cable and software that is suppose to be able to read and write ROMs. It should be here soon. After I do some trail flashes and testing, Ill have more info....

[rarak69]

way to go brother! what cable you get?

[the dog]

I can try them now. I allready have the tool....
Send a pm with map and address

[NorCalS4]

What program are you using to flash and read ROMs? does it make the ROM file a .bin file? more importantly, can it load a .bin or .ecu file?

[NorCalS4]

Also, what year car and ECU box do you have??

[the dog]

I have 2 tools to flash the ecu and I am waiting for delivery of a third one
1.Mpps.
2.Galleto (bench flash)

I am waiting for cmd

They both load bin files
My ecu is a 2000 agb S4 with 8D0907551C ecu....
I also have a 1.8T B6 and TT (7.5) that I can play around with.So please send the address and map description so I can check them,twaek them and try them out....

[NorCalS4]

I have 2 tools to flash the ecu and I am waiting for delivery of a third one
1.Mpps.
2.Galleto (bench flash)

I am waiting for cmd

They both load bin files
My ecu is a 2000 agb S4 with 8D0907551C ecu....
I also have a 1.8T B6 and TT (7.5) that I can play around with.So please send the address and map description so I can check them,twaek them and try them out....

I dont have the address' for C-box. Im only doing the M box ecu so I dont know if it will work, as I already trying to look at other box ROMs and they wouldnt work. I can email you a modified Mbox ROM (3k rev limit) and you can seee if it will flash and work.

Also, couple more questions. Whats Mpps? what do you mean by "bench flash"? Whats cmd? Also do these programs just use a laptop & cable to flash?

[NorCalS4]

I just tried looking at a C-box ROM and everything is off when using the m-box definitions, so the address' for the m-box and c-box are different.

[NorCalS4]

What do you guys think? N75 duty cycle?
The translator says "KF linearization to boost = f (TV) (10x16)"

Im pretty sure this is the "Map for linearization of boost pressure = f (TV)" map.

x-axis should be TPS % and y axis should be RPM

[rarak69]

I dont have the address' for C-box. Im only doing the M box ecu so I dont know if it will work, as I already trying to look at other box ROMs and they wouldnt work. I can email you a modified Mbox ROM (3k rev limit) and you can seee if it will flash and work.

Also, couple more questions. Whats Mpps? what do you mean by "bench flash"? Whats cmd? Also do these programs just use a laptop & cable to flash?

MPPS is the new kwp2000 tool from amt cartech.
bench flash is taking the ecu out, using "bench flash cables" just get cables from a junk yard to hook ecu up to a 12v power supply and obd2 connector, then put it in boot mode by grounding out the boot pin on the ecu.
CMD, i think thats a BDM tool, it connects directly to the ecu pad's to program, like they do from factory. this is what they use on the mk5's i believe.

[NorCalS4]

MPPS is the new kwp2000 tool from amt cartech.
bench flash is taking the ecu out, using "bench flash cables" just get cables from a junk yard to hook ecu up to a 12v power supply and obd2 connector, then put it in boot mode by grounding out the boot pin on the ecu.
CMD, i think thats a BDM tool, it connects directly to the ecu pad's to program, like they do from factory. this is what they use on the mk5's i believe.

Okay, a couple things. first, can the S4 ECU be programmed by the OBD2 port? If yes, which programs can do it? Also, does anyone here know how to put the S4 ecu into boot mode?

[rarak69]

Okay, a couple things. first, can the S4 ECU be programmed by the OBD2 port? If yes, which programs can do it? Also, does anyone here know how to put the S4 ecu into boot mode?

yes it can via the obd2 port as many tuners do, software to do this is rather expensive, i have had no luck with other software that is available(kwp2000+ me7 genesis, galletto 1250)
boot mode, theres two pads on the board you can bride on 1.8t ecu's, s4 ecu's i think you must ground the pin on the flash directly. im not 100% on the s4, i can give it a run this week sometime when i get a chance, havnt messed with my s4 yet.

theres a guy over on vortex, and maybe here, he has self tuned his 1.8t BT, using boot mode id assume. search that guy out, it was in the motronic forum i saw his posts.

[NorCalS4]

^
Okay. Do you have kwp2000+ me7 genesis, galletto 1250??

also dont the 1.8t have different ECUs.

I believe your right on having to ground a pin to get it into boot mode. now we just have to figure out which pin.

Also, I believe the dog has a way to flash and read, maybe he'll enlighten use. Also I have a stock S4 ROM that I changed the rev limiter to 3k that I want him to try to use, to see if it works.

[rarak69]

yea the dog has mpps, thats supposed to be a pretty nice setup. that should do the obd2 flash no problem.

i do have kwp2000 and galletto tools,

the 1.8t ecu's are pretty close to the same. theres an immo chip on them, s4's dont. but the flash procedure is the same more or less. without me ripping my ecu out, what chips in the s4 ecu, do you have one handy? just look at the chip, and look up the schematic online for it. it should tell you what pin it is

[the dog]

First thing first....
What does the "Map for linearization of boost pressure = f (TV) map" do?

Boot mode for 400BB chip...



Power up the ecu and ground the contact shown. Notes how the circuit lets to a 'leg' of the chip...Remove ground BUT NOT the power...You are in boot mode now and you can read/write ...If you need help with wiring the pins to the odb plug of the flash tool (galleto etc) let me know...

The 800BB (S4) chips need to ground the exact some 'leg' of the chip but there is no contact to ground.You have to ground the 'leg'. Also note that the chip is located at a different location than pictured.

I use MPPS to OBD flash the tune....Easy and fast....
I only use galleto when I have a problem with the obd flash...
CMD is also a OBD flash but it can also flash ME17 ecus (1.8TFSI etc)

You allready have my email to send me the


PS....I am NOT a profesional.....

[rarak69]

looks like the 1.8t ecu that i played with, two pins like that.


pin 24 or 25 sound right to you dog?

[NorCalS4]

First thing first....
What does the "Map for linearization of boost pressure = f (TV) map" do?

Boot mode for 400BB chip...



Power up the ecu and ground the contact shown. Notes how the circuit lets to a 'leg' of the chip...Remove ground BUT NOT the power...You are in boot mode now and you can read/write ...If you need help with wiring the pins to the odb plug of the flash tool (galleto etc) let me know...

The 800BB (S4) chips need to ground the exact some 'leg' of the chip but there is no contact to ground.You have to ground the 'leg'. Also note that the chip is located at a different location than pictured.

I use MPPS to OBD flash the tune....Easy and fast....
I only use galleto when I have a problem with the obd flash...
CMD is also a OBD flash but it can also flash ME17 ecus (1.8TFSI etc)

You allready have my email to send me the


PS....I am NOT a profesional.....

I dont know what the "Map for linearization of boost pressure = f (TV) map" does. I have what seems like complete definitions and can see the names for all the maps and all the values correctly, but i dont know what maps do what. I believe I have identified the main timing maps, fuel maps and maps for rev limiters, but there is 144 maps total. About half are 2D and half are 3D.

Okay, what program and cable or such do i have to get to do OBD port flashing on the S4s? MPPS?? how much do those cost and do you have a link?

Okay I sent you a modified M-box ROM. Its a .bin file. the only modification I made was changing the rev limiter from factory stock (6800) to 3K. Let me know if it works.

[Focal]

Finally someone actually doing something with these ECU`s, instead of just talking about it :)

Most forums I`ve found where they talk about this, the tread just die after a couple of weeks

I just orderes an obdII-usb cable, and got a couple of 1.8T (A4 B6) ECU`s from the scrapyard. I`ll try to play a bit with them, and put it out here if I find anything worth mentioning :)

[NOTORIOUS VR]

Good job on keep thing is alive and moving forward guys. I'm sorry I haven't been as active, I've just been very busy with my own issues for now and while I do post on here in other threads taking the time to make an informative post about tuning ME is quite time consuming.

What I CAN add to this though is, I've flashed 3 S4 ECU's so far... H, T, and M boxes. I haven't had to open them to pull that pad to ground to read or write a flash using Galleto and all the ECU's wrote fine and worked after.

Galetto puts the ECU into boot mode itself (as far as the S4 ECU's are concerned).

NorCalS4, good job on converting the definition lists for each map, I also started that but never finished lol... I think I got 1/3 down the list and then had to stop because something else came up.

If we need web space for anything I can host files/images/whatever on my web space @ http://schnell-engineering.com/

I actually didn't even want to renew my year subscription with my hosting company as I'm not longer 'officially' going to tune (new customers anyway) but I didn't remember my renewal date and my CC got charged for another year :P. I think putting anything we do and anything else we've found scattered over the internet in one place would be a good idea, and I have a ton of bandwidth and space as well.

Let me know what you guys think!

-Sascha

[NorCalS4]

Good job on keep thing is alive and moving forward guys. I'm sorry I haven't been as active, I've just been very busy with my own issues for now and while I do post on here in other threads taking the time to make an informative post about tuning ME is quite time consuming.

What I CAN add to this though is, I've flashed 3 S4 ECU's so far... H, T, and M boxes. I haven't had to open them to pull that to ground to read or write a flash using Galleto and all the EU's wrote fine and worked after.

Galetto puts the ECU into boot mode itself (as far as the S4 ECU's are concerned).

NorCalS4, good job on converting the definition lists for each map, I also started that but never finished lol... I think I got 1/3 down the list and then had to stop because something else came up.

If we need web space for anything I can host files/images/whatever on my web space @ http://schnell-engineering.com/

I actually didn't even want to renew my year subscription with my hosting company as I'm not longer 'officially' going to tune (new customers anyway) but I didn't remember my renewal date and my CC got charged for another year :P. I think putting anything we do and anything else we've found scattered over the internet in one place would be a good idea, and I have a ton of bandwidth and space as well.

Let me know what you guys think!

-Sascha

So what exact hardware and software did you use to flash the S4 ecu's? Did you just use Galletto??

I only have two things (figure out what tables to modify, like I said above, I already have an idea of some tables; find a convenient way to flash and read ROMs) to do and I can release a complete HOW-TO, along with programs to use and cables to buy, etc!!!

[Focal]

I actually didn't even want to renew my year subscription with my hosting company as I'm not longer 'officially' going to tune (new customers anyway) but I didn't remember my renewal date and my CC got charged for another year :P. I think putting anything we do and anything else we've found scattered over the internet in one place would be a good idea, and I have a ton of bandwidth and space as well.

Let me know what you guys think!

-Sascha

Sounds like a good idea.
Are you thinking like putting up a forum so that we can discuss what we find, or just a place to store files?

The best thing would ofcourse be to have a forum like this where we could discuss what we find, new ideas, put in maps/remaps and so on..

[the dog]

i do not trust galletto or KWP2000 to do a obd flash...I have seen them to many times crashing and locking ecus....With galleto I only use bench flash.......

The boot pin is only one pin.....

The file you send NorCalS4 is for a M box....Did you just change the rpm limiter map?
I have to find the exact some map and modify it on my ECU to see if it works. What is the address of the map you changed?
Any chance you will send over the definition file..?

[NOTORIOUS VR]

So what exact hardware and software did you use to flash the S4 ecu's? Did you just use Galletto??

I used Galetto only. As for the hardware, it was some ebay knockoff cable that uses the KWP protocol. The cable wasn't mine but looked exactly like this one:

I only have two things (figure out what tables to modify, like I said above, I already have an idea of some tables; find a convenient way to flash and read ROMs) to do and I can release a complete HOW-TO, along with programs to use and cables to buy, etc!!!

Well we all relatively have the same goals here, some might be looking to do this to other ECU's, where as I and probably you are only looking to do this to S4 ECU's.

Flashing in my experience hasn't been an issue at all. I've flashed all three of the 6 speed Hitachi ECU's I've mentioned above quite a few times. Never had to open one to enter boot mode either. I did however get my hands on a true RS4 computer that was chipped and couldn't read or write to it as it had a different flash chip and Galetto wouldn't let me do anything with it no matter what I tried.

The main issue I see here isn't not knowing where the maps are or what they do. I see the issue here with ME7 being how to exactly tune one properly being it's a torque based system and that it seems it takes many of the maps in to consideration to give you the end result.

It's not like you can just plug in timing and fuel values like a standalone ECU and know what you're going to get a certain rpm/load value.

So that will be the largest learning curve IMO.

[NOTORIOUS VR]

Sounds like a good idea.
Are you thinking like putting up a forum so that we can discuss what we find, or just a place to store files?

The best thing would ofcourse be to have a forum like this where we could discuss what we find, new ideas, put in maps/remaps and so on..

I could start up a simple forum to collaborate with a files section I guess, might be a better idea. I'll look into that in the next little while

[NOTORIOUS VR]

i do not trust galletto or KWP2000 to do a obd flash...I have seen them to many times crashing and locking ecus....With galleto I only use bench flash.......

I was able to successfully flash 3 ECU's with Galetto in my car, but recently for some reason there seems to be an issue somewhere and the ECU will fail randomly. I noticed that when the write fails the radio will turn on and off quickly. Although I do believe it has something to do with voltage.

So i made a bench flash harness and Galetto worked flawlessly ever since using a regulated power supply set @ 13.5-14V.

That's all I can really add.

[NorCalS4]

i do not trust galletto or KWP2000 to do a obd flash...I have seen them to many times crashing and locking ecus....With galleto I only use bench flash.......

The boot pin is only one pin.....

The file you send NorCalS4 is for a M box....Did you just change the rpm limiter map?
I have to find the exact some map and modify it on my ECU to see if it works. What is the address of the map you changed?
Any chance you will send over the definition file..?

Yes, its for a M-box. Yes I only changed the rev limiter.

I already tried looking at the same address in the C-box ROM and its not there, meaning all the boxes have different address' for the tables. But tuners all the time flash whatever box they want, to whatever ECU (i.e. I have an A-box ECU that is flashed to completely be a M box). After finding out that the other ECU's have different addy's for stuff and the previous thing I said, I think we should/could maybe just flash the M-box file to whatever ECU, and make the M box file standard ROM, so that we wont have to disassemble every box.

[NorCalS4]

I used Galetto only. As for the hardware, it was some ebay knockoff cable that uses the KWP protocol. The cable wasn't mine but looked exactly like this one:





Well we all relatively have the same goals here, some might be looking to do this to other ECU's, where as I and probably you are only looking to do this to S4 ECU's.

Flashing in my experience hasn't been an issue at all. I've flashed all three of the 6 speed Hitachi ECU's I've mentioned above quite a few times. Never had to open one to enter boot mode either. I did however get my hands on a true RS4 computer that was chipped and couldn't read or write to it as it had a different flash chip and Galetto wouldn't let me do anything with it no matter what I tried.

The main issue I see here isn't not knowing where the maps are or what they do. I see the issue here with ME7 being how to exactly tune one properly being it's a torque based system and that it seems it takes many of the maps in to consideration to give you the end result.

It's not like you can just plug in timing and fuel values like a standalone ECU and know what you're going to get a certain rpm/load value.

So that will be the largest learning curve IMO.

Most tuner lock there files so people dont steal there info, so we probably wont be able to read any chipped ECUs. But in the EVO world, someone made an unlocker to get around that stuff. Also, I already got a RS4 ROM from someone in this thread and like I said in my previous post, the addy's for the tables and values were all wrong and i got nothing.

[NOTORIOUS VR]

Most tuner lock there files so people dont steal there info, so we probably wont be able to read any chipped ECUs. But in the EVO world, someone made an unlocker to get around that stuff. Also, I already got a RS4 ROM from someone in this thread and like I said in my previous post, the addy's for the tables and values were all wrong and i got nothing.

As far as I know there isn't any way to prevent anyone to steal a true OBD port flash. This is why many tuners are now using encryption boards.

Either way, I have successfully read/write 'tuned' ECU's. And the one very good thing about that is, I can now be able to use the stock 'M' box .bin and compare it to the 'tuned' .bin(s) I pulled and see exactly what tables they touched, which will give us a good starting point of what we need to touch

That said, the RS4 ECU wasn't locked it was just that Galetto didn't recognize the flash chip on the ECU as I was on the S4/2.7T drop down... It matched the flash chip's of a 1.8T ECU, but selecting that didn't work either (maybe it might have worked with the boot mode jumper mod? Who knows).

[NorCalS4]

OH SHITTT. Found what we need. HOW-To soon.

[the dog]

All the 1.8T ecus I read worked with boot mode, so the RS4 should need the boot pin to work...

I don’t think it will work NorCalS4. The file size of the C vs the M is different. Mine is 512kb,your is 1mb...
I just need to see how the rev limiter map looks like, so that I can search for it in the C box and chance that, just the way you change it and try it out...
I will need the original file, so that I can compare it with your file, and see exactly at what address you changed...

You can even pull Revo files with bench flash.. But you can not use them on other car.. With OBD flash is a different story....The "brand" chips usually closes the port to read/read from the imo chip.. That’s why is so difficult to completely get rid of them...

I did find a good ols project file....A RS4 B5 with all its definition for maps BUT its in German. The good thing about this is that the definitions are 100% correct. The bad thing is that they are hundreds of maps...

Any chance you will send that definition file you have?

We are in a good road....

[NorCalS4]

Address for rev limiter in the M-box definition is 0x1630A

[the dog]

OH SHITTT. Found what we need. HOW-To soon.

Cant wait......

Is this the limiter map you found?It doesnt make sense......This map is from 0x1630A to 0x16319

[NorCalS4]

Cant wait......

Is this the limiter map you found?It doesnt make sense......This map is from 0x1630A to 0x16319

Thats what I was saying. The address i gave you was for the rev limiter map in teh m-box, but in the c-box that map is at a different address.

anyways, stop what your doing and look below

[NorCalS4]

Okay. Close this thread. HOW-TO POSTED!!!!!!!!

http://www.audizine.com/forum/showth...80#post3933880

[the dog]

Okay. Close this thread. HOW-TO POSTED!!!!!!!!

http://www.audizine.com/forum/showth...80#post3933880

Its your M file...Btw the checksum was wrong.....Or at least thats what it says..
I am off to the other post.....

[NorCalS4]

As far as I know there isn't any way to prevent anyone to steal a true OBD port flash. This is why many tuners are now using encryption boards.

Either way, I have successfully read/write 'tuned' ECU's. And the one very good thing about that is, I can now be able to use the stock 'M' box .bin and compare it to the 'tuned' .bin(s) I pulled and see exactly what tables they touched, which will give us a good starting point of what we need to touch

That said, the RS4 ECU wasn't locked it was just that Galetto didn't recognize the flash chip on the ECU as I was on the S4/2.7T drop down... It matched the flash chip's of a 1.8T ECU, but selecting that didn't work either (maybe it might have worked with the boot mode jumper mod? Who knows).

Can you please email me any tuned .bin files you may have. Email addy PM'd

[Focal]

does anyone have a tuned file for the 1.8T that I can use to compare with stock?

EDIT: for A4 B6 (-02)

[NorCalS4]

^ the only person would be Notorious