NefMoto

Hi, Mine is a 022906032CS ECU, ME7.1.1G as reported by me7_1.31.exe in OBD mode:
C:\Aps\AutoTools>me7_1.31.exe --OBD -rp1 file.bin
Ver: 1.31
Com Port: 1
Baud Rate: 10400
Opening COM1 ... OK
Initiating communication ... OK
ECU ID response: 022906032CS
                 MOTRONIC ME7.1.1G
                 0005
                 SoftCod: 00032, WSC: 00066
Reading EEPROM ........................................................................... OK
File saved
Closing COM1

I'm using an KKL cable and was able to get a 512 byte file in OBD mode, inside the car, and in the bench. But have tried  everything I've read here to get into boot mode but got no success (ground pin 24 of the 800BB chip, with and without 000 resistor on the back). I've grounded 800BB's pin24 to the chassis, to the outter strip of the board, to the negative cable of my power source (car battery which is giving 12.65 v). I've tried grounding pin24 when connecting battery power to ECU's pins 3, 62 and 21, and when only switching ECU's pin #3 power on. ECU's pin #21 has a 2.2k-ohm resistor. 800BB's pin #24 is grounded via a 5k-ohm resistor.

This is what I get with ME's versions 1.31 and 1.4:
me7_1.4.exe --bootmode 95P08 --CSpin P6.3 -rp1 file.bin
.... Starting Boot_mode ... FAIL ... No ECU response. (error=0x20F07)...

Can someone shed some light on this?

post a pic of ur ecu board i ve done a few these

that is a 1kb e2p on that ecu btw. not 512 bytes. the 512 byte file is only the top half.

@vdubnation: This are two pics of the board: Full from the front and partial of the back before I desoldered the 000 resistor in red rectangle.

@k0mpresd: I'll try again with v1.4 OBD mode to see if it will download a 1k file.

v1.31 always saves 512 bytes in OBD.. don't know if this mode can identify different size.

v1.4 can't finish reading.


C:\Aps\AutoTools>me7_1.31.exe --OBD -rp1 file1.3.bin
Ver: 1.31
Com Port: 1
Baud Rate: 10400
Opening COM1 ... OK
Initiating communication ... OK
ECU ID response: 022906032CS
                 MOTRONIC ME7.1.1G
                 0005
                 SoftCod: 00032, WSC: 00066
Reading EEPROM ........................................................................... OK
File saved
Closing COM1

C:\Aps\AutoTools>me7_1.4.exe --OBD -rp1 file1.4.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 10400
Opening COM1 ... OK
Initiating communication ... OK
ECU ID response: 022906032CS
                 MOTRONIC ME7.1.1G
                 0005
                 SoftCod: 00032, WSC: 00066
Reading EEPROM .......FAIL. (error=0x50501)
Closing COM1

mcumall, gq3x + soic8 test clip, will solve all your problems.

i ve read it out its just a diff. boot pin see below.

http://nefariousmotorsports.com/forum/index.php?topic=4821.0title=

@k0mpresd. I think is my last resort... kind of pricey because of shipping and customs taxes :-(

@vdubnation: My board is not like that of the 40mhz pic... it's like the one described by G60Dub. I also have a switch for ECU's pin #3, but have also tried connecting +12v to all three ECU pins (3, 21 and 62) at the same time with 800BB's pin 24 grounded.

Does anyone know if I can switch-jumper 800BB's pins 24 with pins 13 or 32 (which are Vss in its data sheet)?

One thing I hadn't tried yet (because I don't understand) is what appears in picture ME7.1.1-Jumper.JPG. Do I need to just add a jumper between points 1 and 2.... or also add a switch between point 2 and the solder point to its right? (Appears to be a micro switch there). Or should I ground point 1 for normal operation, point 2 for "toolbox" (mode?) ? I'm confused!

Bench harness is easiest.


ground the pin shown in the attached picture for ~5 sec while powering on the ecu(after removing that previously mentioned 000 resistor, do not use resistors etc when grounding)


then use THIS to read: "me7_1.4.exe --bootmode 95P08 --CSpin P6.3 -p 1 -b 10400 -r file.bin"


and let us know how you did..  :)

Thanks sn00k, I've already done that. In fact I soldered a wire to pin 24 for easy connection to a on/off button. See attached pic.

me7_1.4.exe --bootmode 95P08 --CSpin P6.3 -rp1 file.bin
.... Starting Boot_mode ... FAIL ... No ECU response. (error=0x20F07)...

Tried with several combinations of CSpin as stated in the help of .exe file.

I'm thinking that the error maybe where the ground to pin 24 is connected because several times attempting to get into bootmode by grounding pin24 and running me7 with no success, I immediately (without powering off anything) run me7 in OBD mode and it works. So the ground didn't "catched up".

One tech note is that I'm running this on a virtual xp machine inside a mac. ME7....exe and VCDS work fine in there. I hope this isn't causing problems, though maybe has something to do with the timeouts... mmmm... :-/

Well, I finally could read file in bootmode. I'm sure I previously grounded pin 24 to battery negative cable, this time it worked for reading.

>me7_1.4.exe --bootmode 95P08 --CSpin P6.3 -rp1 -b 57600 file1.4.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 57600
Memory type: 95P08, size: 1024
Chip Select pin: P6.3
Opening COM1 ... OK
Starting Boot_mode ... uC ID response 0xD5 ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Reading IDCHIP ... 0x0C41: C167CS ... OK
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Reading EEPROM ... OK
File saved
Closing COM1


Edited file for immo-off along with checksums for banks 1 and 2. Tried to write but error arised... did not save that error log (whole computer freezed when I switched from KKL  to galleto 1260 cable).

Then I switched to Galleto cable & software and successfully read flash (1mb file). Checked it with ME7Check:
>ME7Check gall01.bin
==============================================================================
ME7Check v1.12 (c) mki, 06/2004-05/2012
Checking file gall01.bin (size=1048576)
Reading Version Strings...
-> Bootrom Version = 06.05
-> EPK = 44/1/ME7.1.1/120/6428.AA//24F/Dst01o/200602/
-> Contents of ECUID data table:
   - '0261207881'         (SSECUHN)         
   - '1037366374'         (SSECUSN)         
   - '022906032CS '       (VAG part number)
   - '0005'               (VAG sw number)   
   - 'MOTRONIC ME7.1.'    (engine id)       
-> Contents of ECUID data table:
   - 'HW_MAN004'                           


-> No errors found. File is OK.   *********************


I understand that eeprom file has basic info/settings and flash file has ecu maps. Is that right?

How do I read eeprom from galleto if radio buttons for flash/eeprom are dimmed?

Also, eeprom file is 1024 bytes, but 2nd half is filled with 0xFF and obviously those banks' checksums are not ok. Is this a valid file?

you are making it difficult for yourself by switching interfaces and whatnot, when all you needed was a proper gounding of the boot-pin.

dont use galletto for the eeprom-flashing.. just lower the baud-rate to 10400 and im sure you will be able to both read and write it just fine using argdubs tool and a dumb KKL cable.

there is nothing wrong with your eeprom-file, the second half of it should be FF:d.


the eeprom contains coding, adaption channels, immobilizer info etc.. whereas the flash contains the whole software and maps, so yes, you are correct in your assumptions.

Finally could write immo-off file to eeprom!!

But with several failed tries:

I did run:
C:\Aps\AutoTools>me7_1.4.exe --bootmode 95P08 --CSpin P6.3 -wp1 -b57600 95P08io.bin

And something almost allways went wrong. Until I stopped ungrounding pin 24 and executing the command with some variations of time between powering-on and hitting enter. I tried with all four possible baud rates. Then I realized there must be some thing with the timing between power-on and executing the program.

By saying POWER ON I mean I switched-on all three ECU pins 3, 21 & 62 (though ECU pin 3 has a separate switch to simulate key but I leave it ON).

Here are the common messages I got on the following iterations:
ME7_EEPROM v1.40
COM: 1, Baud Rate: 10400
Memory type: 95P08, size: 1024
Chip Select pin: P6.3
Opening COM1 ... OK
Starting Boot_mode ... uC ID response 0xD5 ... OK
Sending Loader + MonitorCore ... MonitorCore successfully launched
Reading IDCHIP ... 0x0C41: C167CS ... OK

Almost every iteration had some 10 secs or more after the previous one...

GROUND PIN24. POWER ON. SEVERAL TIMES USING 2-10 SECS INTERVALS TO UNGROUND PIN 24
...
Initializing registers ... FAIL. (error=0x40D01)
Closing COM1




GROUND PIN24. POWER ON (LEAVING PIN24 GROUNDED) WAIT 2-3 SECS...
...
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... FAIL. (error=0x40301)
Closing COM1


GROUND PIN24. POWER ON (LEAVING PIN24 GROUNDED) WAIT 1-2 SECS...
...
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM .............FAIL. (error=0x40301)
Closing COM1




GROUND PIN24. POWER ON (LEAVING PIN24 GROUNDED) WAIT 1 SEC...
...
Initializing registers ... OK
Sending EEPROM driver ... OK
Configuring SPI Interface ... OK
Checking EEPROM Status Register ... 0x00F0
Writing EEPROM ................OK
Closing COM1

SUCCESS!!!

Then read again to verify...

I think there must be some issue with ME's v1.4 since it almost all the time refused to even read eeprom even in OBD mode when v1.31 did it right:

C:\Aps\AutoTools>me7_1.4.exe --OBD -rp1 95P08or_modded_OBD.bin
ME7_EEPROM v1.40
COM: 1, Baud Rate: 10400
Opening COM1 ... OK
Initiating communication ... OK
ECU ID response: 022906032CS
                 MOTRONIC ME7.1.1G
                 0005
                 SoftCod: 00032, WSC: 00066
Reading EEPROM .............FAIL. (error=0x50501)
Closing COM1


C:\Aps\AutoTools>me7_1.31.exe --OBD -rp1 95P08or_modded_OBD_1.31.bin
Ver: 1.31
Com Port: 1
Baud Rate: 10400
Opening COM1 ... OK
Initiating communication ... OK
ECU ID response: 022906032CS
                 MOTRONIC ME7.1.1G
                 0005
                 SoftCod: 00032, WSC: 00066
Reading EEPROM ........................................................................... OK
File saved
Closing COM1

File has the intended changes!

Thanks to all who replied  :)

Thanks for info in this thread!

Ok im going to try the same on my 022906032HJ ECU

Nope.. dont seem towork... :(   I have 95160 chip.. not sure about which pin but I tried diffrent pins.. Harness is connected as pic below using KKL 409.1 cable.
Harness works with Me7_95040.. any tips..

For my last 7.1.1 that I fought, I ended up using:

I can't get my ECU into bootmode, or at least I can't connect to bootmode.  I've seen multiple threads some say to desolder a jumper others say not to, and some link to a picture where it should be circled but the link is now dead.  I have ECU on bench and am able to read it in OBD mode, but can't seem to get the boot pin to ground to get it working.
ME7EEPROM.exe --OBD  -rp3  testout.bin
ME7_EEPROM v1.40
COM: 3, Baud Rate: 10400
Opening COM3 ... OK
Initiating communication ... OK
ECU ID response: 022906032CS
                 MOTRONIC ME7.1.1G
                 0005
                 SoftCod: 00032, WSC: 00066
Reading EEPROM ........................................................................... OK
File saved
Closing COM3


and error in bootmode after shorting what i belive to be the boot pin on chip(24) and pad on board ECU is same model and looks like the one in this thread.  Am I better off trying something else?

ok, I was able to read eeprom after removing the resistor mentioned earlier in the thread, looking back I don't see how I missed that part, and I seem to have the same issue of having to maintain the ground connection while reading, 5 seconds and release doesn't appear to allow reading on it's own.

Would this be correct, and safe to attempt a write?

also it looks like 4 bytes at hex offset 112 differ between each read.