Need some feedback from the ECU hardware savvy ones, I suck at embedded stuff. When looking at the ME7.9.10 code (this is ST10F275-CEG with 512+384 built-in flash) it is clear that upon boot the program tries to map the calibration area addresses into external memory of some sort. A check is made for the presence of the valid application checksum in there, and if that fails, the $90000-$BFFFF calibration area is mapped back to flash. This is done by manipulating the XADRS3 register. By peeking into this register I verified that during regular ECU running this external memory is not mapped (most likely because it's just not there, no surprises here).

This looks to me as an interface to an external live calibration device of some sort. I have no clue whether it is something that is soldered onto the board, or connected externally through the plug. I have not yet been able to trace the connections on the board, I thought I'd ask first for opinions / facts before I dive into this (which looks like a pointless exercise anyhow, but curiosity is killing me ). Any thoughts?

Another thing is the ECU program accessing some external 4K memory block mapped to the $117XXX addresses. During the above mentioned boot phase the checksum code is copied there, and then the block is de-mapped. In other places of the code, a periodic copy of the RAM data is made to this block following a RAM address structure that is disabled in the factory calibration. In short, this looks like a memory monitoring mechanism, executed at different intervals (including crank sync). Assuming the existence of the above calibration interface, the logging areas can be dynamically changed. Again, it is probably the case that in the consumer configuration this device is simply not there. Anyone came across something like this in the other ME ECUs?

I have already implemented a live zwgru changer through the active / actuator diagnostics interface, in fact, this interface is so versatile and simple to mod on this ECU I could even be tempted to implement a proper monitor (I mean to live upload proper code to RAM and execute it), I just do not see the point. With write by address it is probably even simpler, I just did not get to the point of checking write by address availability. And as you say, ignition is probably the only thing one really needs to have live, all else is doable with careful logging (was not on my first ever tune on an ECU that did not have the notion of AFR). Thus I gave up on the idea of some clever remapping of the data area into parts of RAM, there is like 32K free on this ECU. I though of doing this by hacking the map reading routines, rather than concrete map reading locations, but it's not worth the effort, not for a single ECU for sure. Flashing the calibration data takes under around 20 seconds.

But, I was just curious about this factory interface and possibilities, for the pure reason of just understanding its functionality. I will look up this ETK thing (briefly just saw what it is about) and see if that matches what I see in the OS.