NefMoto

I have a 98 A4 1.8tqm and I've been toying with the idea of messing with the ECU in it.  I bought 2 or 3 557 and 558 ECUs to have as spares.

From what I gather, these ECUs use an Intel processor and a 28F200 flash chip unlike the ME7.x stuff that I'm finding more information for.  I'm going to take some pictures and try to hot-air the flash chip off one of the ECMs this weekend to read it.  I have a pretty decent set of gear (SMD rework station, scope, logic analyzer, EPROM prorammers, generic FTDI USB cable, 16bit EPROM emulator) and a decent amount of reverse engineering experience (Honda/8051, Honda/66K, Honda/SH4, Ford/8061, Ford/MPPC)  but not a ton of time right now (3wk old baby) so progress will probably be a little slow.

Anyone else working / interested in working on this platform?  I imagine there is going to be a pretty decent amount of code analysis that is going to have to be done with IDA, etc. before it's going to be very usable.  I'd love to try to find some more documentation on tables and workflow on ME3.8.x if anyone knows where to find such things so I have a better roadmap of what to look for.

Thanks!
-Dave

If you need any help with getting started, just let me know.

I don't have any plans to look at ME 3.8.3 myself though.

eh?  :) http://mycarbl0ws.com/me38.csv

Slow progress...

Found this: http://nefariousmotorsports.com/forum/index.php?topic=65.0
Very helpful

One chip I cannot identify...  National Semiconductor SCL4402-V4

Appear to be using Intel 87C196 processor, AM29F200B FLASH chip.

Flash chip WE connected to two chips on reverse.

Have flash chip removed.  Ordered PSOP44 adapter for EPROM programmer.  going to read chip, go from there.

Did a little more digging.

the AN87C196KR is an Intel MCS96 family MCU for automotive applications
http://www.datasheetcatalog.com/datasheets_pdf/8/7/C/1/87C196KR.shtml

The Flash chip is an AM29F200B.

Can't confirm but I highly suspect the chip marked B58274 is a 28 pin SRAM chip.

The WE pin on the 29F200B appears to be connected to a '573 latch on Q1 along with a pin on the SRAM (Write inhibit?).  D1 of the latch is connected to pin 25 of the MCU (P3.1)  and LE on the '573 is connected to pin 4 on the MCU (ALE).  This seems to indicate (at least preliminarily) that there are provisions for the Flash chip to be programmed in site by the MCU.

Dave,

As I mentioned when you came up a few weeks ago to pick up the 1.8t engine any help I can provide I am more than willing to. I do have a 98 1.8t ECU as well right now (as you know) and I also have a 98 2.8 V6 30v ECU in my car as well (I believe it uses Motronic 3.8.2).

Drew

@ k0mpresd :

Could you tell us forumpeeps what boxnumber (bosch/vag) this csv-file originates of ?

That would be really nice :)

Thanks,

Pascal

The CSV-file from k0mpresd comes from a M3.8.2 box
I will dig into it later on, to find the exact boxnumber.

If anyone has a damos- or asap-file from a m3.8.3 box, i would be very gratefull to
have a look to that and see the differences with the .2 box.

Thanks,

PvL

This is incredible lol. So you're cracking everything to tune the stock eprom chip correct? correct me if im wrong. Isn't it possible to buy a programmable eprom and solder that in place and begin tuning? will a special program be needed or what?

From ecuconnections:

ME 5.9.2 is closely related to ME3.8.3.

They are saying it's writable with 12v on pin 43 via MPPS or SPI. However, you CANNOT read the flash in any case and Galletto doesn't work at all.

"They are saying it's writable with 12v on pin 43 via MPPS "

True.

Just tested this, on a M3.8.3 AQ-box on the workbench.
3.07 minutes flat flashingtime with MPPS and a benchflashcable.

Does someone have a damosfile of M3.8.3 or 5.9.2 ? or any
info abouth these ecu's ?

Thanks,

PvL

Is that (12v to pin 43) equivalent to boot mode (ground to pin whatever) on the other ECUs?

I think so. Ecu stays closed. No opening up. Straightforward programming like obd-programming.

Hope this helps.

PvL

So, I curious as to why one is not able to read the eprom in boot mode. Is the processor the same as the me7 boxes?

"Ecu stays closed" = no bootmode.

Secondly, we have a FLASHrom inside. No eprom.

And i think there are limitations to the capabilities
of this specific hardware-setup, therefore the read
is (yet) not possible.

The processor is a intel processor, so no ME7.x kinda
siemens comparable thing.

Try to download some original files, and winols will tell
you the processor, if it's known @ evc-germany and
they programmed the recognition in win-ols.

I'm already happy that i don't have to solder and socket
stuff with these. Now onto a definitionfile for M3.8.3/M5.92
to get going. A Damos or A2L file will be most interesting.

Cheers,

PvL

PVL,

"I'm already happy that i don't have to solder and socket stuff with these."

Care to elaborate a little more?  I saw your post about +12V on pin 43.  How do you read/program from there?  If you could explain the algorithm or point me in the right direction on that I would greatly appreciate it.  I still have three or four ECUs with chips desoldered off them in the basement - I'd love to not have to break out the hot air station so much.

I've already started trying to take apart the code with IDA.  The 80C196 onboard in the ECU has 48k of onboard memory which I have not managed to read, yet.  I can't figure out which address in the memory space the Flash chip occupies.  I haven't been able to disassemble much of anything that makes sense from the flash chip, which is leading me to wonder if it is used exclusively for calibration data with the "operating system" if you will living inside the main processor.  There are tons of tables obvious in the data structure of the 29F200, that's for sure...

Processor: Intel 80196

Hi Dave,

After hot-air-reworking these, i get fed-up if wanted to tune them frequently.
Therefore, a nice interface like MPPS is the solution. Like i earlier described. No fuss,
and quick reprogramming of all flashrom-equipped ME3.8.3 and M5.92 ecu's.

Most of the files of these boxes are findable on the net, or on the very common ebay-dvd's
as these ecu's are a bit older than the newest ones in the current .a.g. cars.

That disassembling thing with IDA is very nice. If i had the time, i would also help with that.
I'm a bit of a lazy person, and i know for 101% that there is more info about (like a full
damos-file that explains all stuff. Then the disassembly with ida makes even more sense, and is speeded-up like LIGHTYEARS).
I would be happy to donate some cash on it, but no person yet has contacted me, that he has a full damos or a2L descriptionfile of a 3.8.3/M5.92 ecu..... sadly...

perhaps the one from kompresd can give us already some insight info as of map-positions/specific maps. As the 3.8.2 -> 3.8.3 is normally a slight update or enhancement.

A 1:1 comparisment would reveal more....  i think. Now i only have to find the time for this... As this is already complex stuff...

If you have a logging-device for obd2-ports,  as of hardware ready to pass on, i can put it between the obd-plug and the benchflashcable what kinda handshaking and protocol is used to program them ecu's...   any suggestions or tips ?  wuold like to log K+CAN lines for studying the way they interact with the ecu.

Cheers,

PvL

You can construct a "vampire" device by using something like a MC33199 tied to a FTDI232.  cheap, simple.

"Audi A3 8L 1.8T AGU ECUs
06A906018D - 0 261 204 254 - Bosch M3.8.2
06A906018AQ - 0 261 204 678 - Bosch M3.8.3
06A906018AR - 0 261 204 679 - Bosch M3.8.3
06A906018CJ - 0 261 206 516 - Bosch M3.8.3
06A906018CK - 0 261 206 515 - Bosch M3.8.3
06A906018R - 0 261 204 673 - Bosch M3.8.3

Golf MKIV 1J 1.8T AGU ECUs
06A906018R - 0 261 204 673 - Bosch M3.8.3
06A906018BB - 0 261 204 800 -
06A906018CG- 0 261 206 518 - Bosch M3.8.3
06A906018CH - 0 261 206 571 - Bosch M3.8.3

Skoda Octavia 1U 1.8T AGU ECUs
06A906018CF
06A906018DM
06A906018GB
06A906018GA - 0 261 206 519 - Bosch M3.8.3

Audi A4 B5 1.8T AEB 1996-1999
8D0907557 - Bosch M3.2
8D0907557E - Bosch M3.2.1
8D0907557M - 0 261 204 179 - Bosch M5.9.2 - OBDII Programable
8D0907557N - 0 261 204 179 / 0 261 204 178- Bosch M5.9.2 - OBDII Programable
8D0907557P - 0 261 204 258 / 0 261 204 581 - Bosch M5.9.2 - OBDII Programable - USA
8D0907557T - Bosch M3.8.2 - OBDII Not Programmable
8D0907558D - Bosch M3.8.2 - OBDII Not Programmable
8D0907558E - Bosch M3.8.2 - OBDII Not Programmable
8D0907558M - 0 261 204 179 - Bosch M5.9.2 - OBDII Programable
8D0907559 - 0 261 204 963 - Bosch M5.9.2 - OBDII Programable
8D0907559c - 0 261 206 315 - Bosch M5.9.2 - OBDII Programable - US"
http://forums.vwvortex.com/showthread.php?4678555-1.8t-AGU-unisettings-compatibility

I have 3 - 97-98 US 1.8T ECUs:
557P
558M
557N

They use an identical circuit board inside.

hey everyone...

this is my first post on this forum and i have to say i really like that.. besides that... i am very interested in the m3.8.3 infos and stuff and will try to give most info ive got... thanks

I am glad to see that this info was very useful since I collected it.  ;) ;) ;)

I have been able to read the eeprom and flash memory inside an M383 and M592 ECUs using Monoscan. Of course I can not write it.

Dave can you post some front pics of the ECUs you have? I mean, the main circuit side of the ECUs. I will appreciate it. I have been playing around with M383 and M592 ecus and I want to check something about Audi M592 ECUs.
Thanks in advance for your help.

hi to all
this is my contribution to this post.

this a damos file for a little old me3,8,3 ecu (0261204806)

btw... i use original MPPS interface, and its posible flash these type of ecus sending 12v thru OBD port with a little modification, 12v need to be sent in all write operation, and in a specific pin of obd port. in some cases will be necesary remove Fuse11

hope will be usefull

jpi

sorry, here the file

jpi512

@ jpi512 :

Sorry to spoil your party, my friend. But i gotta correct your post a bit.

The damosfile you've posted, is a M3.82 NON-flash version, sadly. The
thread is about the 3.8.3 (flashable version) Have a look to my screen-
print i've made, rooting trough your damosfile that you've posted.

If you have more of these files, please look into them and see if one of
them does state M3.83, as we then have a winner ! :)

Cheers,

PvL

Friends I think I found something related to descriptors of M383. Please can you check it out.

@ eliotroyano  : Great ! 

Thank you very much. Now doing a Excell-port from this file and some
minor corrections on it.

I hope that this corresponds with one of the 3.83 files.
You don't happen to know the vag - or boschnumber of this dump ?

Will post the Excell-file of this asap

Greetings,

PvL

As promised, the excell-file.

Now trying to identify the source of this file....

Anyone who knows, please chime in.

Thanks,

PvL

Hi PvL I found it some time ago, but I don't remember exactly if it was from Golf4.de or Ecuconnections forums  ;). But I remember that the person who posted it mention that was like a general descriptor file for M383 ECUs...... but I can't imagine that.

Although AEB & AGU engines are mechanically similar it software code is a little different, but basically all uses the very similar ECU map, almost 99% equal between software versions or revisions.
The main problem with DBC (drive-by-cable) engine it is lack of live tunability and as that are old engines that was harder to tune, not many people still support it. If fact seems to me that a special or not so common software/OBD cable was needed to reflash these Bosch M3.8.x ECUs.
Many of the maps done for that ecus/engines need to be emulated and/or tested before use.

I think that KW1281 support flash & eeprom management (read & write) but is really slow compared with newer KWP2000 ME7xxx, ME9xxxx, ....... Also are old ECUs with poor live tunability like you say.

Source file is Audi A3 1.8T-4B0907557B_0261204806_358127

@ 99pwr :

Thanks for your input.

Sadly this is also not a M3.83 damos descriptionfile.....  the saga continues...

Cheers,

PvL

not sure if this is what you require?? may be m3.8.2 not sure

my dear friend linken8te,

sadly this ain't either the right damos... have a look to the screenshot ;)

Thanks for your efford, b.t.w.  the search for the holy grale goes on ! :)

(http://)

pdf file on the Am29F200BB,
http://www.alldatasheet.com/datasheet-pdf/pdf/178733/AMD/AM29F200BB-90SI.html

I had been interested in this topic. I've done some mapping from M3.82 to M3.83 tables. Many tables are similar but are located at different offsets. Using knowledge how curve shape should look like for particular table it wasn't difficult to match and identify it. Some tables are equal and it helped to locate other tables in the dump. Many tables were "hidden" becasue WinOLS couldn't recognize them as maps due to unknown dimensions.
Actually I took .OLSs file from M3.82 ECU (D014B0907557B  1.8L R4/5VT MOTR    D020261204806103735812755/1/M3.82/05/400700/DAMOS30N/30N03-S/30N0302-S/170997/)
and compared tables with M3.83 ECU from AGU engine (06A906018CG 1.8L R4/5VT MOTR HS D020261206518103735212757/1/M3.83/03/400303/DAMOS3P1/3P10103-S/3P10103-S/160499/). Then added these maps in WinOLS Demo. Result is attached. I see this as a good start for discussion/tuning.

@ automan001 :

Good job you've did on it. I'm doing the same right now for the V03 version
of the R-computer from the golf. But manually. like you said, a lot can be found.
With the aid of winols, and it's detection-function, it's quite clear where the maps
are, for the ones described in the 3.8.2 compared to the 3.8.3. Sadly, no one has
taken it on, to produce a full descriptor file for it. So we have to spend lots of hours
doing it ourselves (when time permits). The little maps, and constants are most time-consuming, but the effort will return itselfe soon.
Within time i will put my version also online, so people can have a look at it.

Cheers,

Pvl

Good work friends. I have been playing without luck to make a definition in TunerPro for M383 1.8T AGU 06A906018CG ecu but it needs a lot of work and time to define maps and constants one by one. Then thanks a lot for the info about this topic.

i came across one of those ecus and starting slowly constructing the damos the main difference i noticed is that the ignition maps are 16x16 instead of 12x16 for older ecus. The ecu has code xxxxAR D05 i can share if anyone interesting. I also have problem flashing this ecu with mppsv12 i get security access error code don't know why. Regards.

Dono if you know it but you have to give 12v to pin43 of the ecu.

Yes thank you for the reply i know it. If i don't give 12V i get an error saying no programming voltage. I tried in car and on bench still get security access error. Any other ideas?

screenshot? dont know this error

@ Giannis :

I had the same issue..  and i think it has to do with the following shortcoming :

Pin 13 OBD port INSIDE the car is NOT wired to PIN 43 on BIG ecu connector.

Please use a multimeter to check this.

I made my own benchflashloom to do these ecu's. Just did one again today. Works a
treat. No issues with the non exsisting wire in the loom, that is needed to feed +12v
to pin 43 for PROGRAMMING ONLY.  After programming, undo this +12v wire, otherwise
you cannot get any diagnostic stuff going via vagcom !!!!

Cheers,

PvL

i noticed this so i connected the 12V wire direct to the ecu. But i still have security accees error. Any other ideas? Can't be done to the bench?

Most people do NOT read and do NOT use the searchfunction. Thats a pitty.
I did, and the outcome was quite predictable. My own made bench-harness works
a treat.

If you get ANY errors, recheck your wiring, power and computer.

Did you have any success flashing other ecu's with your mpps before ?!?!? or is this
the first one you take-on ?

First be sure your equipment is o.k.

If problems still persist..  post here....

I steal power off the car's battery..  And mpps always tells me the voltage...  Be sure this
is above 12.0v and not above 13v.  Don't use cheap-ass powersupplies..  Use the battery
of the car instead. A friend had issues untill he finally took my advice on the carbattery
and suddenly it worked-out !!!

Best of luck,

PvL

No need to upset my friend. I always use the search function before asking questions. The problem is it should have worked. My mpps works great on other ecus already tested it to me7.5 f800 and me7.5 f400 without problems i' m no tuner to have many cars to test. Just mine and for a couple of friends.also i use like you a 12v small lead acid battery witch has 12.2 volts for bench flashing so it is ok. I posted my problem cause i think i have made everything ok and wanted to know if anyone else is having similar problem. As far as i know security access has to do something with immo, but never read about it before. Thats why i asked if the bench flash works in theese ecus. Sorry for your time. Regards.

@ giannis;

I'm not mad..   Just getting frustrated a bit from people who want to be spoon-fed..  or 1st post-guys...  that come-in with questions
and think we all good nefmoto-folks give instant help + warranty...

I made my own simple benchflash-harness from a few wires, 1 switch to emulate the ignition-switch, and a removable jumpwire to give
power to pin 43. Also used a female obd2 connector that i connected up to the loom to create a easy pluggable solution for the mpps
dongle or vagcom...   Same loom also does ME7, as i splitted some wires and made it multi-purpose doing this.

To flash it, i undo the big connector on the car's ecu, under the bonnet. put my home-prepped oem-connector on the ecu, connect
+ and -  to the car's battery and jump the pin43 wire in the loom for programming.  Then connect the mpps and fire-up the laptop.
3 mins after beginning of the programmingsequence, it's done.
No need to undo the little connector on the ecu. I leave it always in place, like the ecu itselfe... i only pull it 3cm's out of the bracket
to be able to undo the car's big ecuconnector and place my benchloom's big connector on it. (bought a new empty one @ v.a.g. and
putted wires into it.

I didn't want to offent you and i am sorry if i did. I'm not a first poster here nor i want to feed me with the spoon . I very deeply appreciate all the help and knowledge found here cause without namy of you all of these would look like chineese to me. I just encountered a problem and wanted to know if anyone else having the same and what solution they found. I don't have a female ecu connector i only use female pins for bat+, Bat-, ign+, k-line and have a few spare if needed. The difference is that i didn't think leaving the other connector pluged to the ecu. Do you leave cars ignition on? Maybe the ecu wants it for checking with instrument panel. I will try this out and report back. Thank you. And sorry again.

You don't need any comms with any dash..  not needed.
Just :

1. +12v continuous power
2. +12v switched (ignition)
3. +12v to pin43 enable programming
4. -12v
5. K-line

these wires, directly connected to the ecu will do the job.
On this forum i thought i also posted the scematics of mpps/M3.8.3 programming.

Cheers,

PvL

Giannis:

Scematics for you ;) :

http://i76.photobucket.com/albums/j31/Panicos/ME38.jpg

http://i76.photobucket.com/albums/j31/Panicos/M59cablepinout.jpg

put a switch between ecu pin 1, so you can emulate the ignition on/off key.

And use a good carbattery.

Report back, if it worked-out or not.

Cheers,

PvL

Open the case and verify if it´s the rigth Flashprom...

One time I had an ECU with 28F200BB (or something like it) and didnt´t work...

normally these feature a AM29F200BB

no its not a am29f200bb its something else i cant remember i will check but i google it and is the same as 29f200bb.

The stock flash in this should be 29F200AB

open up your ecu, and take a clean/clear picture and add it to this thread please

ok i will mayby this is the problem. Thank you.

take a picture of the flashrom's legs..  if this seems to be a re-soldered part, and not
very nice equal shining solder, like bosch'es factory soldering, you know why this might
be a problem....

inform us, and post a picture here. HELP the community.....  CONTRIBUTE please...

As promised here are the pictures from ecu and program. It seems that one of the pins has a little something. I also have an older ecu with plcc44 chip inside. Can i use this instead so i can experiment on this one?

Hi Giannis,

It looks like factory-soldering. Very even on each pin, except the pin you are referring too. That looks 'touched'.

The PLCC-ecu cannot be used for reflashing sadly. I would really suggest you keep the AR computer for testing and
tuning. As the flashing of it, only takes 3 mins +/-.

We better find-out why you cannot flash it...  it shall be nothing really big. You have the V12 MPPS, like i also have.

What specs are your computer that you use for this job ? I use a P4 old compaq and a newer celeron acer laptop.
They both work without any flaws. Let's rule-out machine-compatibility first. A fresh install of Win7 or XP works best.
Plus no antivirus or spywarescanners on, please. They can interfere....

the 018AR is a audi-ecu...  you can also choose A3 under audi and M5.92...  1.8T. That also works. It's basically the same
way of reading it out.

You can diagnose this ecu via vagcom without any problems, right ???  ifnot, you might be having other issues with this ecu ;)

Cheers,

PvL

What pvl said. I always connect with vcds if I have any issues flashing.

The weird think is that it's working great and on the car and with vcds. I was asking about the "older" ecu to use if they are compatible to use in this car. So i dont have to immobilize the car and have time to experiment on this. I know that it can't be reflashed. I think i'm gonna desolder the 29f200 and try to write on external programmer. Maybe there is something wrong with the chip. I think the black spot on that leg is not irrelevent. As you all testify none of you don't have any problems with those ecus. By the way the antivirus never got me any troubles why to do now? I really appriciate the help from all.

And a last question the flash memory it uses is a b58755m (29f200b) can i use a am29f20bb?

Desolder the chip, get a meritek socket and reprogram the chip in a eprom programmer.....
If the chip won't reprogram in the programmer... you found your issue ;)

You can in the meantime also try another, clean and freshly installed win7-32bit laptop/pc
and try to do a benchflash. Use the pins on the ecu like i did with my benchflash-loom.
In-car 90% gives trouble...

Best of luck !

Cheers,

PvL

thank you i was thinking the same. If the programmer can't write it so its the chip. I wouldn't like to format my pc for that reason and don't have a clean pc at the moment. I prefer the programmer. Thank you anyway i will post the results.

(http://)

thats my flashrom...  

so the flash is different than mine.

the picture is from a VW Golf4 1.8T 06A906018CG 0261206518 1037358163

Friends AMD 29F200 flash memories have the following specs 2 Megabit (256 K x 8-Bit/128 K x 16-Bit) CMOS 5.0 Volt-only, Boot Sector Flash Memory.

And it part number or codes are:
AM29F200vw-xy where
v --> means A (0.5um technology) or B (0.32um technology) --> interchangable
w--> means T (top) or B (bottom) boot code sector architecture --> NOT INTERCHANGABLE
x--> means speed option with 55,70,90,120 & 150ns speed access --> USE THE SAME SPEED OR AT LEAST A FASTER ONE TO AVOID ISSUES
y--> other codes.

Then basically you can not take the first 29F200 that you find and put it on. Other think, these flash memories uses parallel type write/read procedures in other words different than newer processors and other microcontrollers that can be written using few pins, this flash eeproms needs that all it pins be soldered in place, because if not it will not work. I know by experience.

If you have a b58755m (29f200b) you can use a am29f20bb - 90ns or faster. Mines are 90 and 70ns. Also all the flash eeproms that I have seen in the M383 & M592 ecus are "B" bottom boot code sector architecture, then it could be 29F200AB or 29F200BB, both are interchangable.

Just my two cents to clarify the flash eeprom change doubts.

Thanks so much for this i was searching for some time now for that info. I am experiencing problems with a m3.83 i ordered a 29f200bb 70ns by luck as showed now. I am trying to solve a flashing problem i have with this ecu. I will report the results as soon as i receive the chip and start the testing. Thanks again.

Ok time to post update to my problem changed the flash memory now works fine. Flashing time is about 3mins. Thank you so much for your help.

Great that you solved the issue !
Thanks for the feedback.

Good to hear that it now works.

Cheers,

PvL

Hello Friends,

i need a little bit support !!

i have here a Bosch M3.83 Ecu with er Am29F200BB Chip !

I use Original MPPS V16 Version

i want to bench flash the ecu !! i dont know maybe i do something wrong or i forgott something

I have the Pic that someone postet with the pin connetions to ecu

Pin 1 = +12V

Pin 2 =  Ground (-12V)

Pin 3 = +12V

Pin 43 = +12V


Pin 19 = K line


so i have the MPPS OBD Connector

i have to connect pin 16 to +12V than pin 4 and 5 to ground and pin 7 Kline

that musst be enouth to flash the ecu or im wrong ??

thanks for answer !!

BR

Try it, and you will see.

TOO much info already about this on this forum.

Use the searchfunction and you will find a LOT of handy info on this matter.

Regards,

PvL

i have use the search button !! i found a lot of info but nothing about the MPPS Connector !!

problem is solved now !! all work without problems !

the K line had not good connection

writing time in fast mode 2 min 30 sec and normal mode 3 min with V16

BR

Thanks for your feedback,

My V12 does it also in 3min, but i never used the fast mode for this.
Perhaps today on a  AJH-Seat-Alhambra from 2000 i can test it out.
Hopefully i can also use the fast mode with the v12 version of MPPS.

PvL

I am trying to attempt tuning/flashing my 1999 A4 with the 1.8t AEB engine. I have an extra 8D0907558M ecu I bought so I still have the OEM untouched.

I found a partial definition file for this controller. One big item I noticed was the MAF table was missing. After looking around the A3 1.8t definition file (557B) I think I found where the table resides. Am I on the right track?

David

Another discovery. My 558M's flash is not labeled the same as the 557P (29f200b).

I am going to see if I can get an eprom reader from work as I'd like to make sure I have the correct file to start with.

Doesn't really matter, should be the same chip...

I successfully flashed the ECU and the car runs as expected. However, I had a P0601 code.

I was able to resolve this by disconnecting the 12V from Pin 43 before I turned the IGN off after flashing.

The 601 code is appearing after running the engine. WinOLS says checksum is ok. Ideas?

Sorry, 601 code is checksum error.

I still don't have a good understanding of what it is and how it works. The car has been running with the error, so far at least.

Publishing comparison of AEB (150 HP) and AJL (180 HP) firmwares.
It's M3.8.2 BUT is very helpful to find out where to start tuning 8)

Here is another little guide based in a simple Stage 1 tuned file and a limited map pack (OLSx). It is for M382 but the idea is the same. I hope you find it useful --> https://www.olsx.lu/getpage.asp?p=limited_map_pack (https://www.olsx.lu/getpage.asp?p=limited_map_pack)

Hi
Audi A3 8L 1.8T AGU,  flash 29f200AB bench write-ok with Mpps, 3,33m.
06A906018AQ - 0261204678 - 1037359525  Bosch M3.8.3

Bench was ok, great but do you test it flash in car?

works in car over here

does anybody know how to delete errors in this older motronics?

would like to remove 18259 - Powertrain Data Bus: Missing Message from ABS Controller P1851 - 35-10

You can clean DTC errors in eeprom dump, make it FF after backup zone. Check it out:

(http://www.mediafire.com/convkey/3296/ca2f706awcu70774g.jpg) (http://www.mediafire.com/view/ca2f706awcu7077/ME38x%20ME59x%2024c02%20Eeprom%20Immo%20OFF%20Info%20%26%20Checksums%20%26%20SoftCoding%20%26%20DTCs.png)

Also here are located adaptation channels. Test it.

So i have to clear Codes with vagcom, read out the Clean eeprom with monoscan.
Then run it in the Car to Set the Error, read it out again and compare?

Or is there another Way to find the right Spot?

Yes that way it should work.

I tried it on the bench. unfortunately the ABS / Powerbrake error was not included.

Looks like i have to find the software way in the flash...

Hi guys,
I have a 8D0907557T - Bosch M3.8.2 (1.8T AEB)
The chip is a 27C1024, and i changed with M28F102
Now,can i do flashed via MPPS bench flash?

No

Flashing is not a function of the eeprom ,but of the proccessor  ::)

Thanks,so certainly necessary a epromreader :(

That´s right.

But I have seen that many maps needed for ECU operation are uploaded to RAM, and can be readed. Also good areas of flash eeprom can be read, but not completely. Also factory test code (Reset or Boot secuence) does not include code to access serial or flash eeproms.

Yes, and also be aware that the 28F102 use completely different programming algorithms than your old 27C1024. Something to think of when you buy a programmer :)

Friends a question, I have seen some kinf of module that can replace a flash eeprom with a module that simulates eeprom itself but also have a serial port that allow memory to be flashed. I have some brands like Xilink, but do you know which boards are those?

Thank you for informations
I think a GQ-4X Willem Programmer and ADP-054,it works?

I have been using a GQ-4X with great sucess. Also GQ-3X, TL866 and other eeprom programmers will work with it associated adapter.

Thanks Elio  ;)

without reading through all the thread as its 4.30 am , is the immo data stored in the 24c02 on these and if so is it possible to access the eeprom while on the board without an eeprom programmer . i.e with other software . or do i need to purchase a new eeprom reader as my clone carprog seems it cannot read eeproms wether on or off the board .

Always desolder the eeprom mate, works oke, also with china carprog.

When you see the 2 the same lines on 0x000 and 0x060, then only do the 50 - 9E trick.

You see the same lines on 0x000 and 0x040, then do the 50 trick and correct the checksums.

I make 50 a 100 from this ecu's immo off and works like charm, never had a problem with it.

Good luck..

thanks for the reply but i dont know the  50- 9e trick you refer to , also how do i correct the checksumm on this eeprom ? this is the first old ecu ive ever had to immo off tbh 

ive attached a read of the chip . ecu is vw : 071 906 018 K

Please confirm.

Immo off

I want to make an ECU upgrade to 06A906018CG(me3.8.3) from 8D0907557T(me3.8.2)
Is it possible?

Hi Grey, both ECUs have similar pinouts. Internally are very similar too. In haven't tested it compatibility but I have read about some people changing 557xx ECU for 018CG ones with great sucess.

Thanks Elio,

I will try and report to here.

Passat worked with ECU ME3.8.3 (06A906018CG)

But i have 2 fault codes;

18044 - Powertrain Data Bus
            P1636 - 35-00 - Missing Message from Airbag Controller
18259 - Powertrain Data Bus
            P1851 - 35-00 - Missing Message from ABS Controller

What should I do now?

Tayfun did you recode CAN Gateway to same value you had in previous ECU? Airbag and ABS module are not communicating with ECU.

Hello friends, I'm in trouble with my ecu, and I want to tell me what happens.

I can not perform loads of programs through the diagnostic port, only soldering and unsoldering memory.

I read all the forum and all the steps but did not find the problem.

I am analyzing the hardware for problem with my ecu.

I have an AM29f200BB memory functioning properly.

The ecu is Bosch 3.8.3 and data accompanying it:

Bosch Software Number: 1037352127
Hardware Bosch Number: 0261206518
VW software Number: 06A906018MK
System Type Number; 06A906018CG

There is the possibility that the ecu come blocked or something for no charge for OBD2?

I tried on bench and in the car without success

I informed the Security Access Denied.

Thanks

Put ecu pin 43 to +12V

Now it works,thanks Elio :)

Does that really work?

Every one I've ever done has a checksum correction where you wrote "9E" (0x0E and 0x6E).
Since the original value at the cs location is 2A, shouldn't the new value be 7A and not 9E? (A0-50h=50h so 2A+50h=7A)

How does that work with 9E in the CS location? (that's not a valid checksum correction?)

 Hate to mess with an old post but you just saved me a couple hours of pulling out my hair. Thank you!

Another confirmation that the pin suggestions are correct and that pin 43 getting 12V is necessary, not only to write, but to ID the ECU too.

In my case, my crappy Chinese bench power supply supplied 14.0V ish and MPPS was happy. The write succeeded in 3minutes. I also tried it with the car battery as power source. This worked too.

The ECU I was working with was a 2000 2.slow 06A906018FB ME 5.9.2.

This forum rocks.

Hi at all

Here I want to share my own mappack for ols for the m3.8.3
I know there is no damos to find anywhere.
Its from a 06A906019R 0261204673 358109
Some Maps are still unknown for me but for the beginnig its ok

Hi,

what for a winols version you created this mappackage?

bb

Most likely the current one.

Believe ECU ID should be 06A906018R?

The Mappack was created with orginal OLS 3.98
and yes im sure thats 018R because it was my own Car  ;D

The reason I put the 8 in bold and asked, was because you had "019" in your post.

Hello guys, i am new to the forum and i came across this awesome topic for the m3.8.3 . I have an  audi a4  b5 1.8t 20vt  aeb, with this ecu m3.8.3]
BOSCH 0261204184/185  8D0907557T.  i do have some experience on tuning newer ecus especially diesel, but not as great with these old ecus mostly
because i could not found a way to read and write them, after searching and reading this threat i try a bench id with mpps and i was able to id ecu with m5.9.2
i do get only writing but no read, and i am ok with that because all i want is to flash an modified file. now i found a modded file and a damos for this ecu and i like to ask if anyone can check this files and see if are ok for this ecu , and second if i go through writing if it will work and not destroy this ecu..

thank you

this are the files please check!!!! :) :) :) :)

557T is M3.8.2 and cannot be flashed with any tool. Chip programmer, new ROM chip (27C1024 or equivalent flash) and some soldering required.

Oh and your files belong to 557 box without index, so even older M3.2 (or whatever) with 5 connectors.

Thank you very much for your information is very helpful, so basically i must buy a chip and do it manually, anyone that it has a ready chip tuned i can Buy?

Στάλθηκε από το MAR-LX1A μου χρησιμοποιώντας Tapatalk

Hi together,

Just a question.

Is it possible to crossflash a
06A906018AQ - 0 261 204 678 - Bosch M3.8.3

With a flashfile from

06A906018AR - 0 261 204 679 - Bosch M3.8.3?

I know the HW and Index number is a bit different. But maybe possible or should i transfer the maps from one to another?

Thx for Help.

Regards

If they have same file size than yes