Hi All,

My first contributing post so please be gentle. Looking for a nudge in the right direction here. Looking to read the software out of a 2011 Audi TT RS Haldex Gen 4 module. Have had experience with engine ecu's etc but no matter what I try I cant seem to get a data read out of this module. More than happy to share my results with other forum members so any help with pointing me in the right direction would be appreciated. Have seen some post regarding Gen 1 and 2 modules but not Gen 4.

Trying to get the data out of this module with the aim to disassemble the software and be able to make changes to torque split etc.

So here is where I am at the moment:

Tools I have: VCDS cable, MPPS cable, Galletto cable, FGTech Galletto 4 BDM, nefmoto software, 3 standard Haldex Modules etc

I have removed the cover and found it runs a ST10F272M processor. Have tried nefmoto and FGtech to read the data via CAN wires but no response from module (Possibly due to not being in bootmode?) I seem to be slightly confused as everything i can find on ST10F chips uses K line communications but this module only has CAN H and L connections. Got the data sheet for processor. Have tried to force the module in to boot mode as other ST10F chips run by running 100k resistor to pins for RESETIN (pin 140) to ground, tried also removing resistor on pin 141 as some other ST10F seem to use to ground but no change. Checked the board with a meter for potential BDM pads. Only found one in the middle of the board with 2 ground pads next to each other but no 3.3v or 5v programming voltage on what would be pin 1.

So what I'd like to ask is what would be the best way to proceed? Try and BDM somehow? Is it possible via Can? How could i activate boot mode if so?

Not sure if I've missed a simple step or something obvious or if a resistor needs to be installed somewhere to activate boot mode but this is my first solo project and I'm still in the learning stages.

Like I said I don't expect someone to do everything for me but if someone has had experience with this chip or module and could give me a hint as to what I'm doing wrong i would be greatly appreciative.



Cheers
Shauno

Flip it over.... there is a AM29F200BB . Similar to the chip used in our ECUs. Id imagine you could place the chip on an ME7 board and read it in boot mode for lack of hardware to read it.

in attachment original haldex gen 4 file from rs3 2012
i have convert sgo to bin using winols software
Have anyone tryed to understand logic? find damos?

This was converted from the VW flash update database (Flashdaten) out of an SGO file. It's what VCDS sends over the diagnostic interface to update the module. It's likely (although I haven't disassembled it to look) that it's not quite 100% of what's running on the control module - usually there is a stub bootloader which isn't uploaded over OBD. But the full application logic and calibration should be here, and can be reversed to locate the calibration tables.