NefMoto

I have read the stickies, but can't find the answer to my query.
Have 4B0907551G from 2001 2.7t AJK with Tip. And want to know if I can flash any other bin into it (as long as it is 1M like original), as AJKs don't have misfire count, and want to troubleshoot an issue.
I have previously managed to dump a complete bin from the Ecu, via kkl cable, in the car.
Also have been confused by contradictory comments regarding, certain info being lost, I believe from Immo, after flashing.
Don't have a spare ecu, but any flash would be an improvement.

Yes, you can flash any ME7.1 bin

however, you will lose immo if you choose a bin that does not have immo, and if you choose a bin that has immo, you may need to re-adapt the eeprom or disable immo manually.

8D0-551M does NOT have immo.

Hope that makes sense

Thanks for putting me straight. Can I pull my immo data from my bin with a hexedit program, and later return it to 'factory'? Just want to be clear as no spare ecu: I can flash a stock 8D0... M bin on, or are there more extensive cloning/Imaging I need to do to take a snapshot of original before anything else?

Have made mistakes before with my saab ecu, and had to boot mode it. So prefer research to action at moment.

8D0-551M is manual though.
I have a hitachi MAF ready to swap in, but need a Tip bin, that is suitable.
would  8D0-551AA be okay? or 4B0907551R?
Maybe it's just a matter of preference, but thought it best to check.
Thanks again for guiding.

8D0-551L is tip and shares the same map locations as 551M

The others do not have anywhere near as good publicly available map definitions.

Finally got hold of another 4B0907551G Ecu.

Put nefmoto Sw on laptop to checkecu info and clear codes, of 'new' ecu.
Couldn't connect, tried original ecu and connected fine.

So opened up the new ecu cover to see this, pics attached.

I've got some ecu loom plugs en route from Poland so I can do a bench setup, but want to know what I should do?

I have built PCBs on a 0603 level before (DAB breakout boards), and hope that the mess in the pics is just surplus flux that hasn't been cleanned with IPA or conformal coating being bubbled off with a hot air.

Any advise welcome, cheers.

I've came across this aswell.

It's a riser board, basically renders the ECU useless unless you have the tools and knowledge to properly desolder the board and put the flash memory chip back in place.

Some companies used to do this back in the day, which to me seems odd because you can read the software it just won't let you overwrite it.

Can resolder it, shalll do it Louis Rossman style: TOOOOO much flux!!

Found the website for it, 'Key 610 EVC electronic' on back of board: https://www.evc.de/en/product/keys/keys.asp#KEY610 (https://www.evc.de/en/product/keys/keys.asp#KEY610)

One question though: How do I get the chip out? There is an arrow on the plack plastic cover, but is that to close or open?!?
---edit--- Gone got it out safely

Also any advantages in having that chip removable?

Done, not too bad.

Must be other things involved, as still no response from controller, in vcds.

Shall search for riser boards now...nope nothing.

Hopefully someone in-the-know shall chime in and enlighten me.

check resistors around memory and compare to identical ECU - I had once problem after removing a riser board from Oetinnger , and the resistors where displaced

Shall do, cheers.

You need to bootmode flash a valid bin into it now.
You removed the riser, and resoldered the chip. Now the chip has the lines scrambled, so the software inside is trash.

Use a tool in bootmode to flash a valid bin on it, and your ECU should boot.

Prj is right I forgot that after removing I used a programeer to write bin and after that needed to correct resistor positions

Is there a guide for boot mode? Had a search but couldn't find one in noob guides.

Have the bench setup from http://nefariousmotorsports.com/forum/index.php?topic=417.0 (http://nefariousmotorsports.com/forum/index.php?topic=417.0)

But obviously want a concrete guide with clear instructions before shorting anything when powered!!

Thanks for all this.

https://s4wiki.com/wiki/Boot_mode

I am new to this, so please bear with:



I assume I need to flash a stock bin on for example (4B0907551G https://files.s4wiki.com/stock/ (https://files.s4wiki.com/stock/) )
or 8D0-551L as Nyet recommended in an earlier post.
Which has the Hitachi MAF too, see pic from S4Wiki.

However what program should I use to flash it? NefMotoECUFlasher? or is there a CMD based program?

Normally I would get mad and say to search, but this is legitimately confusing anymore.

http://nefmoto.com/wiki/index.php/ECU_Boot_Mode is sort of a start, but also confusing.

Unfortunately ME7 bootmode was never finished in Nef (although some parts of the user interface have the beginnings of an implementation, which is VERY confusing for people).

Galletto is the most popular tool for this, or MPPS clone.

You can find Galletto info here: http://nefariousmotorsports.com/forum/index.php?topic=3088.0

Thanks, I have done Boot Mode with a SAAB ecu, and had to build a Just4Trionic combi interface, so understand there are various ways of going about it.

Please know that I shall do/ have done searches for these, but it is a little difficult when you are a green noob!

Cheers

Okay, this is what i've gathered:

Boot mode http://nefmoto.com/wiki/index.php/ECU_Boot_Mode (http://nefmoto.com/wiki/index.php/ECU_Boot_Mode)

Power on, with Ignition off (pin 3)
Ground chip pin 24 to ground OR if installed a switch on ECU, turn ON (bridged)
Ignition ON (Pin 3), wait 2-3 seconds....
Turn ECU Switch OFF (unbridged).
Now in Boot mode.

Have followed ddillenger's Galletto topic http://nefariousmotorsports.com/forum/index.php?topic=3088.0 (http://nefariousmotorsports.com/forum/index.php?topic=3088.0)

So now my Chinese clone of a RossTech has same S/N as offset 0x249E90 in Galletto exe. S/N 47514789 {checked exe with HxD}

But when about to proceed, I read ddillenger's post:

"...Try the bootmode option with nefmoto to verify you're in bootmode. You won't be able to do anything, but at least it'll confirm."

So unsure what the next step is. Has nefmoto the capability to flash the bin in bootmode?

Also what's the sequence?
a)Boot mode ECU >connect USB to laptop> connect nefmoto in bootmode
b)connect USB to laptop > Boot mode ECU > connect mefmoto in bootmode
c) anything else.

I know the sequence can be very particular, hence how I found out how to do BDM with the SAAB ECU. :o ::)
Want to check before turning a brick into a.....half brick!?!

--edit--
Never used Galletto Sw so not sure if I should 'Open file' and add the stock 8D0-551L bin {as Nyet recommended in an earlier post}.
Or if that is not relavant to this situation. Soz.




______EDIT________

Success!
Took the plunge.
Went with the 8D0-551L bin, paniced when the box appeared at the end in Italian!!
Used translate on phone, and it was just the 'turn ingition off for 10 sec' message. Phew
Completed 100% successfuly.
Used Mprog to return serial of my china-rosstech cable.
opened NefMoto and it connected and i read the DTCs and it recognised it as 8D0-551L bin.

Thank you all so SO much.

Thanks for the update! It is always helpful when people followup with how they fixed things. It helps everyone.

Is the riser board worth keeping?
EVC Electronic Key 610 https://www.evc.de/en/product/keys/keys.asp#KEY610 (https://www.evc.de/en/product/keys/keys.asp#KEY610)

Seems it's just for protecting a custom map.

No.

When connected, it threw an error saying the ECU 8D0-551L not compatible with Transmission Module;
Address 02: Auto Trans        Labels: 01V-927-156.lbl
   Part No: 4B0 927 156 L
   Component: AG5 01V 2.7l5VT RdW 2526 
   Coding: 00001
   Shop #: WSC 00000 
   VCID: 306FA5C7F0235A06A3-515A

Shall flash the stock old bin, and mod the Hitachi MAF.

---edit ----
Read on Ross Tech forum, that you need to match ECU softcoding: https://forums.ross-tech.com/index.php?threads/24150/
So, shall try that.

Had a search but couldn't find a fix for a simple issue:
When copy/ pasting the values/tables for Hitachi MAF from 8D0-551L

MLHFM
MLOFS
KFKHFM

The KFKHFM row and column axis values dont change.

Sure there's a simple fix to this, but 'me no understand'.

Also read up about KFMLDMX also being a value that might also need copying for a Bosch > Hitachi MAF conversion.

Hi, you need to locate the axis address (make axis map for you xdf) and then change the axis.

Had some searches, but couldn't find a tutorial, or guide.

Is it better to modify in Hex?

All new to me so; Itry not to ask too many stupid questions.

Still getting to grips wit Tuner Pro.

Every file has a different XDF. Stop using the 8D0-M XDF with 4B0-G.

8D0-L and 8D0-M *happen* to be able to share, but that is very rare. Just use L.

Think Mprog has not restored data to china rosstech. Not working and not being recognised.

Found thread and fixed: http://nefariousmotorsports.com/forum/index.php?topic=8894.msg78988#msg78988

When I connect the spare ecu with the 8D0-551L map on it i get these DTCs:

                Address 01: Engine       Labels: 078-907-551-AZA.lbl
Control Module Part Number: 8D0 907 551 L
  Component and/or Version: 2.7l V6/5VT     G   0001
           Software Coding: 05752
            Work Shop Code: WSC 02325 
                      VCID: 3365AACB0135611EDE-5178
13 Faults Found:

18320 - Pressure Sensor for Brake Boost (G294)
            P1912 - 35-00 - Short to Plus
17881 - EVAP Leak Detection Pump
            P1473 - 35-00 - Open Circuit
17841 - Secondary Air Pump Relay (J299)
            P1433 - 35-00 - Open Circuit
17840 - Secondary Air Injection Solenoid Valve (N112)
            P1432 - 35-00 - Open Circuit
17530 - Oxygen (Lambda) Sensor Heating; B2 S2
            P1122 - 35-00 - Open Circuit
17526 - Oxygen (Lambda) Sensor Heating; B1 S2
            P1118 - 35-00 - Open Circuit
17837 - Circuit for Brake Vacuum Pump
            P1429 - 35-00 - Open Circuit
16684 - Random/Multiple Cylinder Misfire Detected
            P0300 - 35-00 -
16688 - Cylinder 4
            P0304 - 35-00 - Misfire Detected
16686 - Cylinder 2
            P0302 - 35-00 - Misfire Detected
17522 - Oxygen (Lambda) Sensor; B1 S2
            P1114 - 35-00 - Internal Resistance too High
17548 - Oxygen (Lambda) Sensor; B2 S2
            P1140 - 35-00 - Internal Resistance too High
16486 - Mass Air Flow Sensor (G70)
            P0102 - 35-10 - Signal too Low - Intermittent

Readiness: 0110 1101


Had a look for how to 'code out' various stuff, but flummoxed.

My car doesn't have:
pressure sensor for brake boost
evap leak detection pump
any SAI
any post cat lambdas

did have two faulty injectors, hence misfire,
and bosch maf (have since installed an adapter cable for hitachi MAF).

Have resorted back to Original ECU, but want to fix DTCs in secondary as tracing another misfire (probably PCV related).

Any advise appreciated.

https://s4wiki.com/wiki/Tuning#DTC_disables

You need to be more specific, you'll get the dtc's with no parts on it, sort them as per wiki/numerous threads, sort eskonf - done. You are using a definition file right?

Yes, using one from here http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=491.0;attach=522 (http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=491.0;attach=522)
and here http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=491.0;attach=509 (http://nefariousmotorsports.com/forum/index.php?action=dlattach;topic=491.0;attach=509)

Shall go through the s4wiki link, thanks I didn't see that particular page.

I hope you mean section anyway

Still very new to WinOLS & TunerPro, so youtubed it.
Found out there's me7eskonf https://www.youtube.com/watch?v=0z9U8JBFlH8 (https://www.youtube.com/watch?v=0z9U8JBFlH8)

Can't find it here though. Is there a trusted source for DL, or even a github available?

You don't need it. Find KFKHFM (easy map) few places before that in hex is your ESKONF. Should be able to recognize it.

Quick example from a stock ME7.5 bin

edit: excuse me for my mistake address is 0x10BF4

You have too much faith in me knowing what I should look for!
Using the 8D0-551L from s4wiki files & xdf from the previous post in WinOLS.
When I drag xdf brings up weblink for plugins, as using demo version.

Tried using Turboman's vid https://www.youtube.com/watch?v=0dkuoFh2foQ&t=81s (https://www.youtube.com/watch?v=0dkuoFh2foQ&t=81s)
but have no refence to match it to.
I really am a FNG to all this.

Also thought ME7.1 for my 4b0-551G ecu with 8d0-551L map. Would they look the same?

This is what I get when I do a search for:
MLHFM
ESKONF

And 10BF4 in HxD.

https://s4wiki.com/wiki/Tuning#ME7.1_bit_pairs

From my own ME7.5 "knowledge". See what is installed and what is not. Calculate using binary > hex this should give you a pattern to look for. Atleast that's how I would go about it. And we know it is before KFKHFM, so i believe this method to be quite bullet-proof.

Though i'm not sure if XX would be 10 or 11 but you'll find out fast enough. If you look for it you'll also find ME7ESKONF on here, i must have it somewhere on my PC.

No- that address doesn't match with your 2.7T ME7.1. It comes from my own ME7.5 1.8T. Your ESKONF is twice as large.

Read wiki and it will start to make sense.

Thank you Sandstorm3k for the pointers. I'm learning slowly but surely.

Not sure how to contact s4wiki admin/mods, but https://s4wiki.com/wiki/Tuning#ME7.1_bit_pairs (https://s4wiki.com/wiki/Tuning#ME7.1_bit_pairs)
is missing Byte 9 for ME7.1

Also anyone know what the "ZUE: Ignition coil" refers to?
Original 3 pin coils with coil packs thingies on top of airbox (for 2.7t's)
or the 'RS6' coils or whatever people call them, with modded loom and 4 wire coils.

with my decoding of the Hex (Technically Theka Hexidecimal  [10+6 decimal, not 6 decimal!!]) shows EV2 & EV4 'not installed' which is ONE HELL of a coincidence since I have had misfires from those two cylinders.

Obviously no rush in responding as running original 4B0-551G ECU, but hope to switch over to 8D0-551L without any DTC's.

Cheers

Its a wiki; you can edit it yourself. Are you familiar with wikipedia?

Anyway, that looks like a typo. Also ME7.1 only has 6 cyl, not 8, so probably its doubly wrong.


Quite literally, the output pins of the ECU that correspond to the spark plugs.

ESKONF merely represents what outputs are enabled on the ECU.

Totally irrelevant.


no idea what you're saying here. if ESKONF is wrong for EV2/EV4 your car would not start.

Not done S4's but eskonf unsurprisingly looks same/similar to 7.1.1.'s, usually around the 010xxx mark at quick look, printed off a csv if it's same/similar/cross flashing etc - it's 1a.m. I'm sure you can figure it out!

This s4 file;
http://nefariousmotorsports.com/forum/index.php?topic=467.0

Anyway, the ESKONF is "13 bytes in the 2.7 flash"...
"Bit pair legend:
    11 = SKIP, as in that component is not installed.
    10 = SPECIAL TREATMENT. For all intents and purposes, we're going to ignore this.
    00 = INSTALLED

ME7.1 bit pairs

Byte  0: EV6    EV3     EV4     EV1
Byte  1: XX     NWS1    LULK    TEV
Byte  2: XX     EKP     AKF     XX
Byte  3: XX     XX      XX      SLP
Byte  4: EV5    SLV     XX      NWS2
Byte  5: HSH2   ULT     EV2     LDR
Byte  6: XX     BKV     HSH     XX
Byte  7: XX     XX      XX      XX
Byte  8: ZUE    ZUE     ZUE     ZUE
Byte  9: ZUE    ZUE     ZUE     ZUE
Byte 10: XX     XX      XX      XX
Byte 11: XX     XX      XX      XX
Byte 12: XX     XX      XX      XX"  << An assumption

0)   00 - 0000 0000 - EV6 EV3 EV4 EV1
1)   FC - 1111 1100 - XX  XX   XX  TEV
2)   E3 - 1110 0011 - XX  XX   AKF  XX
3)   FC - 1111 1100 - XX  XX   XX   SLP
4)   0C - 0000 1100 - EV5 SLV XX NWS2
5)   00 - 0000 0000 - HSH2 ULT EV2 LDR
6)   C3 - 1100 0011 - XX BKV HSH XX
7)   FF - 1111 1111 - XX  XX  XX  XX
8)   AA - 1010 1010 - XX   XX  XX  XX
9)   FA - 1111 1010 - XX   XX  XX  XX
10) 55 - 0101 0101 - XX   XX  XX  XX
11) 55 - 0101 0101 - XX   XX  XX  XX
12) 55 - 0101 0101 - XX   XX  XX  XX


corrected to remove:
HSH (rear o2s),
BKV (Brake Booster Pump),
SLP (J299 SAI pump relay) &
SLV (N112 SAI solenoid valve).

0)   00 - 0000 0000 - EV6 EV3 EV4 EV1
1)   FC - 1111 1100 - XX  XX   XX  TEV
2)   E3 - 1110 0011 - XX  XX   AKF  XX
3)   FC - 1111 1111 - XX  XX   XX   SLP -> FF
4)   0C - 0011 1100 - EV5 SLV XX NWS2 -> 3C
5)   00 - 1100 0000 - HSH2 ULT EV2 LDR -> C0
6)   C3 - 1111 1111 - XX BKV HSH XX -> FF
7)   FF - 1111 1111 - XX  XX  XX  XX
8)   AA - 1010 1010 - XX   XX  XX  XX
9)   FA - 1111 1010 - XX   XX  XX  XX
10) 55 - 0101 0101 - XX   XX  XX  XX
11) 55 - 0101 0101 - XX   XX  XX  XX
12) 55 - 0101 0101 - XX   XX  XX  XX


00 FC E3 FF 3C C0 FF FF AA FA 55 55 55

It helps if I write it all out, to show my 'workings', or errors.

Thank you for all your help, and please forgive my naivety.

I think they're calibration files in that last link so it may not be 100% accurate, but you'll find a set of values similar around that area in yours if not the same. You're on the right track though!

Also, don't forget to read threads like this;

http://nefariousmotorsports.com/forum/index.php?topic=615.0

Looking for ESKONF in my original 4B0907551G.bin that I read some time ago.

Think I found it at: 14ED9-14EE5

00 FC EF FF 3C C0 FC FF AA FA 55 55 55 from 4B0-551G
00 FC E3 FC 0C 00 C3 FF AA FA 55 55 55 from 8D0-551L


Not sure if this of any use though!

edit

Realise I removed BKV for no reason!!
basically should have copied entire 13 bytes of ESKONF from 4B0-551G to 8D0-551L.

http://nefariousmotorsports.com/forum/index.php?topic=615.0 (http://nefariousmotorsports.com/forum/index.php?topic=615.0)

"phila_dot
   
Re: Emissions delete and setting actual readiness
« Reply #5 on: July 09, 2011, 03:45:34 PM »
   VCDS displays "Passed" for all readiness checks. See below for secondary O2 changes in my file.

All set to zero:
CLAHSH
CLAHSH2
CLAHSHE
CLAHSHE2
CLALSH
CLALSH2
CDHSH
CDHSHE
CDKAT
CDLASH
CDLSH
CDLSHV
CWDLSAHK

After flashing these changes, I ran the readiness checks for the O2 sensors per the Ross tech wiki.
http://wiki.ross-tech.com/wiki/index.php/Readiness_-_APB_Engine_Code "

Think that might do it....?


EDIT
Nope, missed this, from s4wiki Rear O2 ESKONF. https://s4wiki.com/wiki/Tuning
ESKONF[5] HSH2 (0x10C7A) - set to 0xC0 (set bits 6 and 7)
ESKONF[6] HSH (0x10C7B) - set from 0xF3 to 0xFF (M-box) (set bits 2 and 3)
ESKONF[6] HSH (0x10C7B) - set to 0xC3 to 0xCF (L-box) (set bits 2 and 3)

And CDLATV  to zero if 02s not setting readiness Reply #107 trichard3000 http://nefariousmotorsports.com/forum/index.php?topic=615.105


& of course Check Checksums:
http://nefariousmotorsports.com/forum/index.php?topic=5872.0

00 FC EF FF 3C C0 CF FF AA FA 55 55 55
https://s4wiki.com/wiki/Tuning#Rear_O2_ESKONF

Presume it's a typo, should say "ESKONF[6] HSH (0x10C7B) - set to from 0xC3 to 0xCF (L-box) (set bits 2 and 3)", as the line above it says.

Would this mean that if those bytes were NOT C3, they should NOT be changed to CF? Or just... change to CF?

If someone could check my working, I'd be greatly appreciative.

Original bin from https://files.s4wiki.com/stock/ (https://files.s4wiki.com/stock/)

edited ESKONF in HxD

Zeroed:
CLAHSH
CLAHSH2
CLAHSHE
CLAHSHE2
CLALSH
CLALSH2
CDHSH
CDHSHE
CDKAT
CDLASH
CDLSH
CDLSHV
CWDLSAHK

in Tunerpro.

Corrected Checksums the `short way (by ddillenger)` http://nefariousmotorsports.com/forum/index.php?topic=5872.0 (http://nefariousmotorsports.com/forum/index.php?topic=5872.0)



-----
edit
Well seemed to flash ok to ecu, shall try in car tomorrow.