NefMoto

Hi guys, just starting out here, so bear with me. I have been trying to read the ECU off of my 2001 Audi TT 225Q. The ECU is a 8N0906018T - I believe this is a 512kb ecu.

I believe the correct memory layout is F800, but am not positive. I have tried all sorts of combinations of slow/fast init, baud rates, and memory layouts. My only "success" was using a baud rate of 10,400 with the F800BB layout, and that crashed at roughly 30%...

All read attempts have been in car so far. I have tried removing the radio, and both instrument cluster fuses (in various combinations) with no success. I do have a bench flashing harness 99% built, but am still waiting for my obdII port to arrive from Singapore... Should have just gotten one out of the junkyard...

At this point I am thinking that I will likely have to flash in boot mode or at least with the ECU out of the vehicle, guessing the instrument cluster isn't playing nice.

The following information was using the F800 memory layout with max baud rate set after a slow init where the software and ecu were restarted after the previous attempt failed and the batter was on a 2 amp trickle charge.

The dialogue presented to me was:
Validated FTDI device is in dumb mode.
Disconnected
Connecting...
Starting slow init connection.
Connecting to address 0x01.
Slow init succeeded.
Switching to KWP1281 session.
KWP1281 connect info: 8N0906018T  1.8L R4/5VT     G   0003

The log is below:
23/Mar/2013 04:01:24.231: LOG: Changed diagnostic session type to: ProgrammingSession
23/Mar/2013 04:01:24.234: LOG: ECU requesting specific baud rate: 124800
23/Mar/2013 04:01:24.238: USER: Successfully started diagnostic session.
23/Mar/2013 04:01:24.243: USER: Negotiating communication timings.
23/Mar/2013 04:01:24.247: LOG: Reading current communication timings.
23/Mar/2013 04:01:24.300: LOG: Sent message with service ID AccessTimingParameters
23/Mar/2013 04:01:24.307: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 1 of 9 bytes.
23/Mar/2013 04:01:24.310: LOG: Expected: 07 83 02 32 28 6E 14 0A 72
23/Mar/2013 04:01:24.314: LOG: Read:     07 02 00 32 28 4C 00 0A 72
23/Mar/2013 04:01:24.317: LOG: Clearing remaining expected echo bytes.
23/Mar/2013 04:01:24.321: LOG: Could not construct valid message from received data: InvalidChecksum
23/Mar/2013 04:01:24.324: LOG: Removing first byte from the receive buffer to try to create a valid message. Removed: 0x02
23/Mar/2013 04:01:26.332: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
23/Mar/2013 04:01:26.336: LOG: Flushing 7 bytes from receive buffer due to P1 ECU response inter byte time out.
23/Mar/2013 04:01:26.339: LOG: Message received no replies.
23/Mar/2013 04:01:26.342: LOG: Resending message. Send attempts: 2
23/Mar/2013 04:01:26.394: LOG: Sent message with service ID AccessTimingParameters
23/Mar/2013 04:01:28.396: LOG: Message received no replies.
23/Mar/2013 04:01:28.400: LOG: Resending message. Send attempts: 3
23/Mar/2013 04:01:28.452: LOG: Sent message with service ID AccessTimingParameters
23/Mar/2013 04:01:28.458: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 4 of 9 bytes.
23/Mar/2013 04:01:28.462: LOG: Expected: 07 83 02 32 28 6E 14 0A 72
23/Mar/2013 04:01:28.465: LOG: Read:     07 83 02 32 00 6E 00 0A 72
23/Mar/2013 04:01:28.468: LOG: Clearing remaining expected echo bytes.
23/Mar/2013 04:01:30.475: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
23/Mar/2013 04:01:30.481: LOG: Flushing 5 bytes from receive buffer due to P1 ECU response inter byte time out.
23/Mar/2013 04:01:30.485: LOG: Message received no replies.
23/Mar/2013 04:01:30.488: LOG: Failed to send message 3 times, message send failed.
23/Mar/2013 04:01:30.491: LOG: Did not receive any replies to message.
23/Mar/2013 04:01:30.499: USER: Reading ECU flash memory failed.
23/Mar/2013 04:01:30.972: LOG: Sent message with service ID TesterPresent
23/Mar/2013 04:01:30.978: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 3 of 4 bytes.
23/Mar/2013 04:01:30.981: LOG: Expected: 02 3E 01 41
23/Mar/2013 04:01:30.985: LOG: Read:     02 3E 01 00
23/Mar/2013 04:01:30.988: LOG: Clearing remaining expected echo bytes.
23/Mar/2013 04:01:32.995: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
23/Mar/2013 04:01:32.999: LOG: Flushing 1 bytes from receive buffer due to P1 ECU response inter byte time out.
23/Mar/2013 04:01:33.003: LOG: Message received no replies.
23/Mar/2013 04:01:33.007: LOG: Resending message. Send attempts: 2
23/Mar/2013 04:01:33.029: LOG: Sent message with service ID TesterPresent
23/Mar/2013 04:01:33.607: LOG: User Prompt - Title: Reading ECU Flash Memory Complete Message: Reading ECU flash memory failed. Result: OK
23/Mar/2013 04:01:33.612: USER: 100% complete.
23/Mar/2013 04:01:33.624: USER: Restoring Windows sleep mode.
23/Mar/2013 04:01:35.031: LOG: Message received no replies.
23/Mar/2013 04:01:35.036: LOG: Resending message. Send attempts: 3
23/Mar/2013 04:01:35.059: LOG: Sent message with service ID TesterPresent
23/Mar/2013 04:01:35.065: LOG: Read incorrect echo from ECU while sending message bytes. Matched first 1 of 4 bytes.
23/Mar/2013 04:01:35.068: LOG: Expected: 02 3E 01 41
23/Mar/2013 04:01:35.072: LOG: Read:     02 3C 01 00
23/Mar/2013 04:01:35.077: LOG: Clearing remaining expected echo bytes.
23/Mar/2013 04:01:37.085: LOG: Double checking receive buffer for embedded messages before flushing receive buffer due to P1 ECU response inter byte time out.
23/Mar/2013 04:01:37.089: LOG: Flushing 3 bytes from receive buffer due to P1 ECU response inter byte time out.
23/Mar/2013 04:01:37.093: LOG: Message received no replies.
23/Mar/2013 04:01:37.097: LOG: Failed to send message 3 times, message send failed.

Any insights would be greatly appreciated.

Thanks,
Matt

memory layout is f400 512Kb not 1024

you must read and write the ecu in boot mode ;-)

Thanks for the tip! Just got the bench flash setup done tonight and have the ECU down to the board. Don't see any chip numbers that sound familiar on there. Tried using a Ross tech cable in dumb mode to read and failed, then tried to get it into boot mode by grounding pin 27 on the flash chip with a 1k-ohm resistor... Didn't work, maybe its just finicky. I'll probably order a Galletto cable later tonight and see how that works. Any tips for getting into boot mode? Also, in perusing Galletto today they had my car (w/out year specified - It was something like 1800 225cv TT), but I believe it had the 800BB chip listed, will Galletto work even if I can get it into boot mode?

Again, thanks for the advice already, every little bit helps!

Pin 24=bootmode
Pin 27=snap, crackle, pop (potentially)

This is what I was going by: (forgot to mention it was the RAM chip... I hope that's right at least.)
(http://imageshack.us/a/img203/7201/altbootpin.jpg)


Found here:
http://forums.vwvortex.com/showthread.php?5401894-how-to-build-a-bench-flash-boot-mode-harness-for-your-me7-ecu

Which chip is the real pin 24 on?

29f400bb.
thats my picture btw.  :)

Small world, thanks!

I feel pretty dumb, I never had flipped the board over to look at the backside... It is indeed a 400BB chip. Also, I read on another forum that Galletto doesn't care which vehicle you select, just goes by the memory layout of the chip, and 400BB is listed, so should be OK there as well. Ordered a Galletto ebay cable last night, so will play around with it once that's in.

I also tried hex editing the Galletto executable to modify the serial number it looks for, but my old ross tech hex-usb (circa ~2001) has the serial number disabled according to MProg, and it doesn't seem like I am able to write a new one to the cable itself to match the one Galletto software looks for... For $14.99 I'd rather have the right cable anyways.

Still couldn't get boot mode to work using either pin indicated above holding against for 2-6 seconds during and after boot, but hopefully that is specific to Nefmoto. Oddly I did see a reduced amperage draw during a few boot mode attempts, normally it draws ~196 mA, and it was drawing ~155 mA during a few boot mode attempts, which makes me think it may have actually been in boot mode.

Is this the right pin or not?