Pages: [1] 2 3 ... 9
Author Topic: How to prepare a spare MED9.1 ECU?  (Read 54971 times)
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« on: January 23, 2014, 04:22:05 AM »

Hi everyone.

Would anyone know interchangeable the MED9.1 2.0 TFSi ECU’s are?

Here’s my scenario. I want to make a spare MED9.1 ECU, that I can use for testing both on the bench and in the car and keep my original ECU as a backup. I’m not worried about a perfect clone, quite happy with an IMMO-OFF spare that will start and run the car.

I cannot open my original ECU to BDM it. I can ODB read it as much as I like, but opening up the case is not an option.

Reading other threads on here, I think I can:

1)   Get a spare MED9.1 ECU
2)   Open the case and BDM-read everything (full read)
3)   Take the resulting BDM-read files and find/pay someone to IMMO-OFF them
4)   BDM write these files back to the ECU (full write)
5)   Then in theory, after the steps above, I have an IMMO-OFF ECU on the bench I could ODB write my original ECU’s .bin to. Or use BDM to do a partial write of just the .bin?

So my questions:

1)   Can the spare ECU come from any 2.0 TFSi motor of a similar year with a part code of XXX 907 115 (e.g. does it matter if the donor is VW, Audi, Seat, Skoda?)
2)   Would ODB / partial-BDM write of my original ECU’s .bin to the freshly prepared IMMO-OFF ECU overwrite the IMMO-OFF and take me back to square one?

Bear in mind I haven’t used BDM before or tried anything like this previously. Just an enthusiast. Be kind  Cheesy

My original ECU details:

Audi S3 2.0TFSI 265HP 8P Model Year 2008

VCDS scan:
Monday,11,November,2013,13:02:26:53506
VCDS Version: Release 12.12.0 (x64)
Address 01: Engine
Control Module Part Number: 8P0 907 115 H
Component and/or Version: 2.0l R4/4V TFSI 0050
Software Coding: 01030003180F0060
Work Shop Code: WSC 06314

Advanced Identification
Serial number: AUX7Z0GNFNQ0NG
Identification: RB8-658
Revision: 5BH16---
Date: 13.11.07
Test stand number: 1360
Manufacturer number: 0129
Flash Status
Programming Attempts: 0
Successful Attempts: 0
Programming Status: 00000000
Required Conditions: 00000000
Software
A000
A4.8.6
Misc.
Hardware number: 8P0 907 115 B
Immo Challenge: AB 17 95 39

Bosch ECU Hardware ID: 0261S02342
« Last Edit: February 14, 2014, 10:08:33 AM by Basano » Logged
ddillenger
Hero Member
*****

Karma: +618/-19
Offline Offline

Posts: 5647


« Reply #1 on: January 23, 2014, 09:05:30 AM »

The 2.0 TFSI MED9.1's are all the same at a hardware level. No worries there.

Once the immobilizer is defeated (need both the eeprom and flash) you are correct, the ecu is able to be benchflashed, or whatever else you want to do.

PM me when you're ready.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
prj
Hero Member
*****

Karma: +287/-29
Offline Offline

Posts: 3507


« Reply #2 on: January 23, 2014, 09:42:00 AM »

There is no need to defeat the immobilizer...
Just read and write the eeprom by BDM.
Logged
ddillenger
Hero Member
*****

Karma: +618/-19
Offline Offline

Posts: 5647


« Reply #3 on: January 23, 2014, 11:45:58 AM »

There is no need to defeat the immobilizer...
Just read and write the eeprom by BDM.

He says he is unable to open the ecu for any reason Tongue
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
matchew
Sr. Member
****

Karma: +42/-18
Offline Offline

Posts: 488


« Reply #4 on: January 23, 2014, 01:16:51 PM »

Get the pin code of your car and the 2nd ECU, recode the 2nd ECU to your car.
Logged
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #5 on: January 24, 2014, 03:37:55 AM »

All, thanks very much.

He says he is unable to open the ecu for any reason Tongue

Yep, that's the constraint I have to work with.

Get the pin code of your car and the 2nd ECU, recode the 2nd ECU to your car.

I thought the pins codes were only applicable to the Immo 4A devices? After reading the Ross-Tech immobiliser wiki, I got the impression that later Immo 4B was not supported. But I'm guessing and also I don't have the pins to begin with Sad

http://wiki.ross-tech.com/wiki/index.php/Immobilizer#Immobilizer_Generation_4

The 2.0 TFSI MED9.1's are all the same at a hardware level. No worries there.

Once the immobilizer is defeated (need both the eeprom and flash) you are correct, the ecu is able to be benchflashed, or whatever else you want to do.

PM me when you're ready.

Sorry for all the noob questions but curious why you have to immo-defeat both the eeprom and the flash to start with? I'll try and explain what I mean.

1) Start with my eBay ECU
2) Extract the contents with BDM - eBay_ECU_eeprom.file and eBay_ECU_flash.file
3) Immobiliser Off - eBay_ECU_eeprom_immo_off.file and eBay_ECU_flash_immo_off.file
4) Write these back to the eBay ECU with BDM

Now the eBay ECU boots up and allows bench access etc. But since I would want to take the flash from my own car which I read with ODB (carA_ECU_flash.file) and load it on the eBay ECU via ODB, am I not just overwriting eBay_ECU_flash_immo_off.file with carA_ECU_flash.file which isn't Immobiliser Off and thus it won't work?

Or is it a case of the eBay ECU won't boot up without matching eBay_ECU_eeprom_immo_off.file and eBay_ECU_flash_immo_off.file to begin with, but then once it boots I can write whatever I want to it (carA_ECU_flash.file, carB_ECU_flash.file etc) over ODB and it's own internal subroutines do the housekeeping so subsequent reboots of eBay_ECU_eeprom_immo_off.file and carA_ECU_flash.file are fine to boot from?

Could I shortcut things at step 3 above by getting eBay_ECU_eeprom_immo_off.file and carA_ECU_flash_immo_off.file and BDM writing these to the eBay ECU instead? Or do the eeprom and flash files need to come from the same ECU before you can Immobiliser Off them? Some discussions here http://nefariousmotorsports.com/forum/index.php?topic=1068.420

Much appreciated and thanks for your patience. I appreciate you must be tired of explaining the same things over and over again...
Logged
ddillenger
Hero Member
*****

Karma: +618/-19
Offline Offline

Posts: 5647


« Reply #6 on: January 24, 2014, 08:32:51 AM »

You're going to have to modify your current file with the immo-off data contained at 6C00. If not, you can just do a data area write, which leaves that area intact.

As for why you need both the eeprom AND flash, that's just how most people do it.
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
nyet
Administrator
Hero Member
*****

Karma: +424/-51
Online Online

Posts: 9524


WWW
« Reply #7 on: January 24, 2014, 12:57:19 PM »

Much appreciated and thanks for your patience. I appreciate you must be tired of explaining the same things over and over again...

dd is probably one of the most patient guys around when it comes to that.

In any case, I'm impressed enough with your work so far that I don't think it is too much to ask of us Smiley

Especially if you intend on making a nice writeup on everything MED9 you've learned Smiley
Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #8 on: January 26, 2014, 02:37:23 PM »

Thank you, that’s probably the nicest thing someone could have said  Grin

Good news, spare ECU is ordered and on it’s way from eBay. Should arrive midweek!

(it's part number 8P0 907 115 AE but should be suitable as per dd)

 Cheesy
Logged
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #9 on: January 28, 2014, 03:20:04 AM »

I was trying to explain to someone what I was trying to do with my ECU and realized it might be worth mentioning a few background concepts. If you’re reading this you probably know it already though! Feel free to comment, it would be nice to be as clear as possible Grin I haven’t mentioned K-Line since I’m concentrating on MED9.1

ODB read / write
This uses the KWP2000 protocol over CANBUS to communicate with the ECU. The ECU has to be booted up and working properly  to start with, plus this communication is protected with security access before you can request the ECU to read out the contents of the memory or write new data to the memory. There are several memory IC’s on the ECU circuit board, plus the memory inside the main microprocessor itself. ODB cannot access all of these memory contents. You don’t have to remove the ECU from the car or open up the casing, you can simply connect to the ODB diagnostic port in the car which is networked via CANBUS to all the various ECU’s in the car. Typically if you do remove the ECU from the car and try to access it on the bench using ODB, you can read but not write as the ECU cannot see the other immobiliser components (instrument cluster) and denies write access. Hence immobiliser defeat is necessary for ODB write bench access.

Examples of tools
•   MPPS
•   Galletto

BDM read / write
This uses the JTAG physical connection that is found on most ECU circuit boards, but to get to this JTAG connector, you’ll need to remove the ECU from the car and open up the case (which is normally sealed with anti-tamper bolts and some kind of security girdle making it pretty obvious that you cracked it open). This JTAG physical port gives you access to all the IC’s on the board (it’s there for test and programming on the assembly line after all) and the ECU doesn’t have to be up and working. It doesn’t use KWP2000 or CANBUS, but rather connects directly to the components on the circuit board. No security access to worry about either, since you are going in at such a low level that the OS on the ECU hasn't even started up yet! You’ll need some kind of frame or jig with spring-loaded pins to press up against the solder pads on the circuit board or solder on some kind of header yourself.
http://en.wikipedia.org/wiki/Background_Debug_Mode_interface
http://en.wikipedia.org/wiki/Joint_Test_Action_Group

Examples of tools
•   BDM100


Since the JTAG connection physically connects to all the IC’s on the circuit board, you’d use BDM to read and write the memory that can’t be accessed with ODB. If your ECU is in a sorry state and won’t even boot up and start communicating over ODB, then BDM is what you’d use to refresh the contents of the memory IC’s on the PCB by writing directly to them. If you have a second-hand ECU like I’ll be getting, without any corresponding immobiliser components, BDM is your friend.

Logged
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #10 on: January 28, 2014, 03:24:37 AM »

My BDM arrived and I installed it last night. It’s a second-hand clone from eBay so I didn’t have high expectations and was a bit wary of what software I might inadvertently be installing! However, I found a fairly neat solution (I think). I installed a product called Oracle VM VirtualBox and then loaded a copy of Windows XP SP3 as the guest virtual machine. Then I installed the BDM in the Windows XP3 virtual machine and it seems happy enough, plus it’s boxed off in its own little environment where it can’t get up to any mischief  Roll Eyes

So I have a couple of questions. I can see that you can either do a Single File (which I assume is a full read of everything it possible can into one big file) or alternatively Advanced (individual files for External Flash, MPC5xx Flash, Serial E2Prom)

What are these various memories (External Flash, MPC5xx Flash, Serial E2Prom ) and what’s typically contained within them?



« Last Edit: January 28, 2014, 03:26:37 AM by Basano » Logged
oldcarguy85
Full Member
***

Karma: +14/-1
Offline Offline

Posts: 247


« Reply #11 on: January 29, 2014, 09:28:35 AM »

Basano,
I'm just beginning my journey down the MED9.1 path... could you possibly post a link to the BDM tool you bought?  did it come with the spring loaded header thingy to actually use on the ECU?

Thanks!
Logged
Basano
Full Member
***

Karma: +70/-2
Offline Offline

Posts: 176


« Reply #12 on: January 29, 2014, 02:09:32 PM »

Excellent!

I'm glad to hear there's more interest in this Grin

This is the BDM I ended up with:

http://www.ebay.co.uk/itm/BDM100-ECU-Tuning-programmer-ECU-Reader-flasher-BDM-100-/151018490383?pt=UK_Diagnostic_Tools_Equipment&hash=item2329674a0f

It did come with CMD software which seemed incomplete but at least had the drivers. Google will also find CMD 1255 software you can download which is what I did.

Don't ask me how the three little PCB's supplied with it are meant to fit, they don't even connect to the ribbon cable! (wrong gender) and there's definately no spring loaded pins Huh I'm going to try and make a spring loaded adapter myself using something like these:

http://uk.farnell.com/harwin/s25-212/receptacle-2-54mm-wire-wrap/dp/9960279   
http://uk.farnell.com/harwin/p25-0123/probe-pointed-2-54mm-pitch/dp/9960210

There's also some information on the bosch pinout here:

http://www.jtagtest.com/pinouts
http://www.tek-tronics.co.uk/BDM100.pdf

Had a mixup with the spare ECU I ordered, it arrived tonight. Correct part number as advertised but the small print on the label said MED17.5 Sad Ooops. So that one has been relisted on eBay and another ECU ordered and I've checked the photo of the label carefully this time (MED9.1).

Logged
oldcarguy85
Full Member
***

Karma: +14/-1
Offline Offline

Posts: 247


« Reply #13 on: January 29, 2014, 02:28:34 PM »

Cool! Just ordered one! i saw in the long MED9 thread someone recommended this: http://www.ebay.com/itm/BDM100-ECU-spring-loaded-probe-adapter-12-position-/250430088180?pt=Motors_Automotive_Tools&hash=item3a4ecbe3f4&vxp=mtr so i ordered one of those as well.  Looks like the Bosch pinout is 14 pins, but i'd bet 2 pins probably aren't used. 
Logged
ddillenger
Hero Member
*****

Karma: +618/-19
Offline Offline

Posts: 5647


« Reply #14 on: January 29, 2014, 02:47:54 PM »

The BDM frames on ebay come with the pogo pin adapters that work well with the chinese BDMs. That's what I did!

I use the chinese BDM all the time. This is coming from someone who owns a real one-lol
Logged

Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience!

Email/Google chat:
DDillenger84(at)gmail(dot)com

Email>PM
Pages: [1] 2 3 ... 9
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.027 seconds with 17 queries. (Pretty URLs adds 0s, 0q)