NefMoto

Can someone help me in building a bench harness? I looked at another topic yet I can seem to be able to read ecu info or even communicate. Maybe I wired it wrong.

nobody?

what do you need? This is all over ze interwebz.

(http://i79.photobucket.com/albums/j133/conglomeratejae/pinout.jpg)

Mistaking switched can high and low urghh!! but we got a read, repeat we have a read haha

What would this be used for? Like Galletto? Can Boot mode be done with this? Because I've been opening the ECM up

 i actually can flash it butttt you need to delete immobilizer first then you can flash on the bench or i can flash through obd2 port actually and read.

I'm having a hard time getting my harness to work.

Here is how I have it connected

ECU # 6 #92, #87 to the ac adapter positive and the OBD2 Connector  Pin 16
ECU # 2 , pin 4 on the OBD2 connector.

Can HI to Can HI from the ecu to OBD2 Pin 6 to 68
Can Low to Can Lo from the ecu to OBD2 Pin 14 to 67
Kline 86 to Pin 7

Still no communication any suggestions?

Bro same problem here :D

Try searching google images for bosch me 9.1 pinout.  Plenty pictures and they are all nicely colored.

Here are 2 connection possibilities based on which tool is being used:

(https://hosting.photobucket.com/images/i/GarageBill7/MED9.1_Connection.png)

A1/A2/A3 +12v
A5 Ground
B3 K-line
B7/B8 S1/S2

OR (**ECU is upside down in this image take note**)

(https://hosting.photobucket.com/images/i/GarageBill7/MED9.1_Connection_2.png)

12V/Gnd/K-line are all in the same places in this version, but the security connections are moved. I've been using both of these connections methods with success for years with both Magic Motorsport and bFlash, these are not so much universal connections but hopefully the positions help.

Dont mix things here.

Back in the days Bench was OBD on the Table.

Today, and what your pictures show, is the Bosch Service Mode with the S1/S2 Signal going into the ecu.

Valid observation! I started tuning with a Kess/Ktag setup and went from there, so never played around with a bench OBD setup. Well hopefully those help someone out  :)

Hi guys,
I'm trying to do a boot mode read of an MED9.1 VAG ecu using PCMFlash.
I just bought the module 77 for these ECUs however I do not have the official harness.
I have the connection diagrams similar to above (there are a few different variants of which GPT pins to use, tried them all).

Was hoping to get this going with a home-brew connection as it will take a few weeks for a harness to arrive.
I have a powerbox and cable, so power and KLine are taken care of.  Connecting to PCMFlash with Tactrix OPenport which I've been using fine with other modules like MED17 OBD, TCU direct connects etc.

I think I'm stuck on the GPT(security) pins.  The powerbox has a switchable 3.3/5v interface that I've used to provide the S1/S2 connections.
Have tried both 3.3v and 5v but so far without success in even identifying the ECU.

Can connect on the bench over the CAN pins and see the ECU ok with VCDS.

Just hoping someone might be able to assist with identifying what voltage is required on the GPT pins, and does it also require an inline capacitor to generate a frequency or just constant voltage?

Thanks in advance.

Why don't you ask support?

Yeah I'll ask in the forum, suspect I'll just get the 'use the official harness' answer

you will for sure i believe you need like a power cube or some crap. i almost bought that module till i saw that. :-p Flex works for me.

What exactly is service mode? I see some commercial tools exploit it but I'd love to know what exactly the signal/specification is like.

Bench read and write ecu full contents without having to open the ecu. For example EDC16u31 is BDM normally and requires to be open well with service mode no need to open the ecu

this is what i use with ksuite

Without getting into the software vulnerabilities:

Overall Bosch Service Mode / TSW is similar to the Continental TSW which I have documented, except it uses KWP2000 instead of a custom command-set over ISO-TP. It's kind of odd, it's almost like the two vendors received the same loose specification and then decided to use it in two dramatically different ways.

The break-in process is two PWM/square-wave signals applied to the so-called "S1 and S2" pins. This tells the ECU to boot into a command shell using KWP2000 over serial. On many CAN ECUs the serial runs through the CAN transceiver before it gets to the external pins, so you need to wire a UART into a CAN transceiver (yes, this works!) to use it.

http://nefariousmotorsports.com/forum/index.php?action=printpage;topic=18870.0

So in terms of hardware, yes, you don't just need two voltages on S1 and S2, you need specific frequencies. And you also need test hardware which can do KWP2000 over a CAN transceiver basically. With PCM this is why you need Scanmatik.

As I know some of Bosch ECUs can not be reflashed this way. Am I right they do not allow to calculate checksum for the password area?

I am going to correct you here, as you have the layers mixed up.

KWP2000 is the service layer. It can run over any transport protocol. For example ISO-TP, TP1.6, TP2.0 or K-Line.

What you mean here not KWP2000 over CAN, you probably mean K-Line over CAN ;)
As KWP2000 over ISO-TP or TP1.6/TP2.0 is a completely normal thing.

You're always keeping me honest! In this case though, I think there's a case to be made either way and this is pointless bickering... so, perfect for this forum :D

ISO 14230-1:1999 Road vehicles — Diagnostic systems — Keyword Protocol 2000 actually encompasses every layer, including Layer 1 (Physical), which is really just ISO 9141 rehashed anyway.

Anyway I think I'd be considered "wrong" anyway here since there are 2-byte length headers, rather than the KWP2000 Layer 2 3-byte ones anyway, although there is still an Add8/sum-byte checksum. And the baud rate negotiation isn't really the same.

Regardless, the point I was making was that on a "native" CAN ECU you need hardware that can route a UART over a CAN transceiver for Bosch Service Mode - which in addition to the two frequencies / square waves, is what keeps something like an OpenPort alone from being useful here.

Usually 14230-3 is referred to as KWP2000, the service layer.
Because KWP2000 service layer can also run over other transports.

Hence yes, in this case it is better to say ISO 9141 over CAN, as it is super confusing otherwise.