Pages: [1] 2
Author Topic: How to bench read & flash your 1.8t ECU with nefmoto  (Read 37003 times)
turboat
Hero Member
*****

Karma: +45/-3
Offline Offline

Posts: 619


« on: July 04, 2014, 06:39:23 AM »

I have been trying to get a bench-rig working for a 032HN 1.8T AUQ ECU, previously Nef has always thrown "Disconnecting because no response was received for the Tester Present message.", now it works reliably with a 06A906032HN and a 4B0906018DC (both immo 3). This has also fixed the connection issues I was having with the 032HN, where it would take me many tries to get Nef to connect.

The big difference between my rig and the standard bench rig (detailed here: http://nefariousmotorsports.com/forum/index.php?topic=417.0title=) is that I've powered up pin 121 on the ECU (T121/121), which is the rightmost pin in the small ecu plug:


Connect the pins as follows:

ECU pins:
Pin 1 -> Ground
Pin 2 -> Ground (can be shared/connected with pin 1)
Pin 3 -> 12v
Pin 43 -> K-line on your ODB cable (Pin 7)
Pin 62 -> 12v
Pin 121 -> 12v

ODBII cable pins (see attached below)
Pin 4 -> Ground
Pin 7 -> K-line on ECU (Pin 43)
Pin 16 -> 12v

Otherwise its as normal, connect the K-lines, power the 12v lines and ground the rest - I am using a bench supply set on 13.5v but an ATX psu or 12v adaptor would do the trick. I got a pair of ECU plugs and a ODB plug from a scrap car for $2, stripped out the un-necessary wires and soldered/heat shrank it together. The black wire thats coiled up is an earth with the end tinned for putting ECUs into boot mode, the bullet connector is for the ignition live, in case I need to disconnect it at any point.



When I connect without the small plug on the ECU, I get the same issues that I was having with the Tester Not Present message:
Sending start communication request.
 Connected
 Reading ECU flash memory.
 ECU reports programming session preconditions have been met.
 Negotiating communication timings.
 Successfully changed to new communication timings.
 Requesting security access.
 ECU reports that security access is not supported.
 Starting diagnostic session.
 Disconnecting because no response was received for the Tester Present message.
 Disconnected
 Reading ECU flash memory failed.


When I connect up the small plug (powering up T121/121), this works fine:

 Connected
 Reading ECU flash memory.
 ECU reports programming session preconditions have been met.
 Negotiating communication timings.
 Successfully changed to new communication timings.
 Requesting security access.
 ECU reports that security access is not supported.
 Starting diagnostic session.
 Successfully started diagnostic session.
 Negotiating communication timings.
 Successfully changed to new communication timings.
 Requesting security access.
 Security access granted.
 Validating flash memory starts at 0x00800000 and ends at 0x00900000.
 Memory layout is valid.
 Starting to read data block.
 Calculating flash checksum to determine if reading is necessary for range
 Flash checksum matches, reading flash data is unnecessary, but reading anyway.
 Requesting upload from ECU for address range 0x00800000 to 0x00803FFF.
 Request upload from ECU succeeded.
 Starting data transfer.
 1% complete.
.......
 99% complete.
 100% complete.
 Data transfer complete.
 Requesting data transfer exit.
 Successfully exited data transfer.
 Calculating flash checksum to determine if reading was successful for range
 Flash checksum matches read data, reading was successful.
 Saved ECU flash memory to
 Reading ECU flash memory succeeded in 00


As always, the ECU needs to have the immobilizer off to bench flash over ODB with nef (or be an ECU without an immobilizer), bootmode flashing can be done using galleto/mpps without immo off. To turn the immo off use see the cluster/eeprom section.
« Last Edit: July 04, 2014, 06:48:19 AM by turboat » Logged
mikeb52
Full Member
***

Karma: +0/-2
Offline Offline

Posts: 102


« Reply #1 on: July 07, 2014, 01:28:20 PM »

Good write up!
Thanks.
Logged
fknbrkn
Hero Member
*****

Karma: +185/-23
Offline Offline

Posts: 1454


mk4 1.8T AUM


« Reply #2 on: July 13, 2014, 06:00:58 PM »

has the same issues with HN bench flashing
pin121-trick are solved this problem
thanks!
Logged
jogtx16v
Full Member
***

Karma: +6/-1
Offline Offline

Posts: 139



« Reply #3 on: July 13, 2014, 11:56:23 PM »

thanks for the tips of the pin 121 I will try next time.   Wink
Whats do the pin 121 ?
Logged
mikeb52
Full Member
***

Karma: +0/-2
Offline Offline

Posts: 102


« Reply #4 on: July 14, 2014, 05:58:49 AM »

Pin 121 needs 12 vdc power as well for read/write capabilities on bosch 7.5.
I just did this on the weekend. Pin 3, 21, 62,, and 121 need +12 vdc. On my rig  I run all 4 to the same switched power source.
Worked great.

Logged
turboat
Hero Member
*****

Karma: +45/-3
Offline Offline

Posts: 619


« Reply #5 on: July 14, 2014, 06:06:20 AM »

+1

IIRC pin 121 is the Terminal 30 feed, which is fed by the ECM relay.
Logged
KmosK04
Full Member
***

Karma: +5/-10
Offline Offline

Posts: 97


« Reply #6 on: October 16, 2014, 06:30:49 AM »

I just saw that. I try to read with nefmoto my 032hn ecu without pin121 and said something about immo and failed. After that I have no connection to nefmoto or vcds. Is it bricked or I have to power only pin121?
Logged
turboat
Hero Member
*****

Karma: +45/-3
Offline Offline

Posts: 619


« Reply #7 on: October 17, 2014, 11:06:56 AM »

It shouldnt be bricked, bounce the power. If you have not defeated the immo, then you will not be able to read it, otherwise you need to power up pin 121.
Logged
aef
Hero Member
*****

Karma: +69/-46
Offline Offline

Posts: 1600


« Reply #8 on: March 25, 2015, 04:18:49 AM »

I have a stupid question regarding pin21 on me7.5

The picture is showing a APP pinout with a relay.

Pin 3 from the Relay is kl30 which is + from the Batterie.
Pin 5 is direct connected to Pin 21 from the ecu and should be - negative voltage .
Together Pin 3 and 5 powering up the coil in the relay.

If 5/21 is the negative power why are we able to power up Pin 21 from the ECU with + voltage?
Logged
turboat
Hero Member
*****

Karma: +45/-3
Offline Offline

Posts: 619


« Reply #9 on: March 25, 2015, 11:52:23 AM »

In the diagram, pin 3/86 of the relay gets +12v from D78 rail, via pin 1/30 of the relay, which gets +12v from fuse S10 (15A).

Pin 5/85 gets +12v via the coil of the relay from 3/86. ECU earths pin 5/85 when it needs to turn that relay on.

No negative voltages involved.

Logged
eliotroyano
Hero Member
*****

Karma: +48/-8
Offline Offline

Posts: 825


« Reply #10 on: January 26, 2016, 08:55:17 AM »

In the diagram, pin 3/86 of the relay gets +12v from D78 rail, via pin 1/30 of the relay, which gets +12v from fuse S10 (15A).
Pin 5/85 gets +12v via the coil of the relay from 3/86. ECU earths pin 5/85 when it needs to turn that relay on.
No negative voltages involved.

Friends sorry to take this thread back from death, but that comment from Turboat means that ECU's pin 21 could be an open collector connection with voltage sensing capabilities? then that could affect some funcitonality of ECU on bench? Just like pin 121 commented in this thread. I take back this topic because I have working on an ME7.1.1 ecu and with and without pin 21 all the time I get "not response from controller" message. Now I can confirm that ECU is 100% working.
Logged
eliotroyano
Hero Member
*****

Karma: +48/-8
Offline Offline

Posts: 825


« Reply #11 on: January 27, 2016, 08:25:03 AM »

Friends sorry to take this thread back from death, but that comment from Turboat means that ECU's pin 21 could be an open collector connection with voltage sensing capabilities? then that could affect some funcitonality of ECU on bench? Just like pin 121 commented in this thread. I take back this topic because I have working on an ME7.1.1 ecu and with and without pin 21 all the time I get "not response from controller" message. Now I can confirm that ECU is 100% working.

For your knowledge friends Pin 121 --> +12V due the trick. ECU is a 07K906032J from a MK5 VW Jetta I5 20V 2.5L.
Logged
ianpgonzaga
Jr. Member
**

Karma: +0/-0
Offline Offline

Posts: 34


« Reply #12 on: April 10, 2016, 09:14:23 AM »

quick question

looking at my connector that i got from a 1.8t s3 AMK there is no pin 121 on the smaller connector??? only 120 is wired up...

do i move 120 over to position 121?

<edit> lol i was looking it the pins in the wrong orientation.... it's there i'm just tripping
« Last Edit: April 10, 2016, 09:38:43 PM by ianpgonzaga » Logged
TheCream
Jr. Member
**

Karma: +0/-0
Offline Offline

Posts: 41


« Reply #13 on: August 04, 2016, 07:21:23 PM »

Validated FTDI device is in dumb mode.
Disconnected
Connecting...
Starting slow init connection.
Connecting to address 0x01.
Slow init succeeded.
Switching to KWP1281 session.
Starting loading of info.
KWP1281 connect info: °6A906032LP 1.8L R4/5VT     G   0005O:OOO             (the 'O' are boxes)
Connecting to address 0x01.
Cancelling loading of info.
Slow init succeeded.
Switching to KWP2000 session.
Connected
Disabling Windows sleep mode.
Reading all ECU info.
Starting diagnostic session.
Successfully started diagnostic session.
Negotiating communication timings.
Successfully changed to new communication timings.
0% complete.
20% complete.
40% complete.
60% complete.
80% complete.
100% complete.
Read 5 ECU info entries:
        0x92, System Supplier ECU Hardware Number: 0261207955
   0x94, System Supplier ECU Software Number: 1037366194
   0x91, Vehicle Manufacturer ECU Hardware Number: 0x0D,   Odware No , 0xFF    (the 'O' in front of dware is a box)
        0x9B, Calibration Date: 06A906032LP , 0005, 0x00001D4C, 0x00000000, 0x0001, 1.8L R4/5VT    ,  G   
   0x9C, Calibration Equiment Software Number: 0x00000002
Restoring Windows sleep mode.
Disabling Windows sleep mode.
Reading ECU flash memory.
ECU reports programming session preconditions have not been met.
Reasons preconditions failed:
-Immobilizer not authenticated
Continuing despite programming session preconditions not being met.
Negotiating communication timings.
Successfully changed to new communication timings.
Requesting security access.
ECU reports that security access request was rejected.
Starting diagnostic session.
Unable to properly start diagnostic session, attempting to continue with current undefined session.
This can occur if the security lockout is running, or the engine is running. Please turn off the ignition and retry if this continues to fail.
Negotiating communication timings.
Too many consecutive unsolicited messages from ECU, disconnecting.
Disconnecting...
Disconnected
Reading ECU flash memory failed.
100% complete.
Restoring Windows sleep mode.

« Last Edit: August 04, 2016, 07:29:04 PM by TheCream » Logged
turboat
Hero Member
*****

Karma: +45/-3
Offline Offline

Posts: 619


« Reply #14 on: August 05, 2016, 02:14:25 AM »

@TheCream - assume it's not working and you need help? I think your issue is the "immobiliser not authenticated". Do an immo off or read/write the Ecu in the car (if you have the immo parts fitted and a paired key).
Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.041 seconds with 17 queries. (Pretty URLs adds 0s, 0q)