[pullesnoter]

Yes, in Galletto v54 in drivers, go to Tools Boot, and Infineon Boot mode for 29F400bb, it may say VW or Audi 29F400BB, but it's ok, it works.
It's even more stable than JM Garage.

Sometimes when writing if it crashes (some DMEs will do this randomly with different tools), just use a different tool such as JM Garage flasher with K+DCAN or VAG KKL cable.



Do you have original DME? If it still powers up, read the fullflash with Audi boot menu, and then flash to replacement dme in boot mode.
This is 100% clone and the car should start immediately without EWS sync.

I not have anymore the orginal ecu. Only the ews box.

[B1257]

Yes, in Galletto v54 in drivers, go to Tools Boot, and Infineon Boot mode for 29F400bb, it may say VW or Audi 29F400BB, but it's ok, it works.
It's even more stable than JM Garage.

Sometimes when writing if it crashes (some DMEs will do this randomly with different tools), just use a different tool such as JM Garage flasher with K+DCAN or VAG KKL cable.



Do you have original DME? If it still powers up, read the fullflash with Audi boot menu, and then flash to replacement dme in boot mode.
This is 100% clone and the car should start immediately without EWS sync.

I not have anymore the orginal ecu. Only the ews box.

So virginzie the ECU, reprogramm it in the car or bench and sync it to the EWS. If the ECU is not viginized it cant be sync to the new VIN and EWS of your car. You can do this job even manually, it is only a byte series which should be set to FF but you have to be familar with the HEX addresses and to build the checksum from the sratch.

From my experience there is always an EWS sync neccessary, even if you use a totally new Flash chip (for example a brand new AM29F400). I think the ECU is reading the manufacturer/device code (for example 20H, D5H, D6H, unique identifier ST M29F400BT/BB) or something else and verifies it with the stored data. I didnt find the time to investigate the why. On ECUs with Eproms it doenst matter, after a clone the engine is starting immediately.

But this is not the problem here, because a sync is done in some minutes.

Interesting is the data retention time about 20 years, so I am still waiting when the ECUs dont work anymore.

If you cant virginize the data post the full Flash here and I will do it.
But you will find near all the tools in this Forum.

Regards

[Enabled]

Siemens dmes on BMW do not virginize well. Most of the time the ISN doesn't write over the FF FF FF FF FF FF and you're stuck with sync -> start car once. Let it sit 10 minutes, no start. Sync again, start.

Then read fullflash and you have FF FF FF FF FF FF still.
On Bosch ecu it works all the time, not recommended for Siemens.

---

Best choice when missing original dme is to read EWS (PA Soft or similar) and apply the ISN to your replacement dme.


Or EWS delete...

[pullesnoter]

Siemens dmes on BMW do not virginize well. Most of the time the ISN doesn't write over the FF FF FF FF FF FF and you're stuck with sync -> start car once. Let it sit 10 minutes, no start. Sync again, start.

Then read fullflash and you have FF FF FF FF FF FF still.
On Bosch ecu it works all the time, not recommended for Siemens.

---

Best choice when missing original dme is to read EWS (PA Soft or similar) and apply the ISN to your replacement dme.


Or EWS delete...

Thank u all for this help. I will try to have a flashdump and try out this solutions.
For deleting the ews im afraid to have more problems, keytransponder...

[B1257]

Then read fullflash and you have FF FF FF FF FF FF still.
On Bosch ecu it works all the time, not recommended for Siemens.

If you would have this szenario the checksum is faulty too.
When you working with flash it is important that you have the right programming and ersase supply current also data bus timing is very important. Most of the time I modify ECUs on the bench.

There is a third software called Minimon, but you need the right driver for the corresponding Siemens ECU and at least the right flash pinning which depends on the ECU board design.

I the past I was doing both ways, resoldering and than programming the whole flash in a SOP44 Adapter (Batego II), than with Minimon and JMGarge flasher. The results were always the same, even the checksums were correct. Therefore I build a MS43 ECU with a soldered boot tact switch and a SSOP44 socket for quick tests and replacement of the flash chip itself.

[Enabled]

ISN, VIN, and some other data is excluded from checksum calculation.
Look at the winkfp hex flash files. All get the same checksums when flashing, not dependent on ISN (which WinKFP never touches).
I correct checksums all the time as needed, and ISN modification never requires it. And you would easily get DTC for internal error.
But your point about different flash chip revisions is curious, because I have had some MS43 that accepted new ISN. MS45, never. Just my observations. I have easily done over 50 DMEs on desk.

[B1257]

I correct checksums all the time as needed, and ISN modification never requires it. And you would easily get DTC for internal error.
But your point about different flash chip revisions is curious, because I have had some MS43 that accepted new ISN. MS45, never. Just my observations. I have easily done over 50 DMEs on desk.

When I was talking about checksum I mean the full dump from flash and outside the ECU in an SSOP44 adapter.

The address sections you are talking about are write protected and to rewrite this addresses you need special commands (take a look at the datasheet of a 29F400 flash). MS43 and below will always accept changes in ISN, MS 45 never this is true, but it depends on the rest of the code of the MCU. This was a developer decision to improve the securitiy or make it harder to sync an ECU.

Even over a periode of flash chip production there are more than one revision, sometimes for special automotive applications. You can see it on the last index letter.

I made a lot of MS4X Siemens ECUs and never had problems with ISN. Working more than 20 years as a MCU developer and starting programming from 1992 with eproms it was easier of course, but at least it depends on the microcode of the ECU or CPU build. If the timing is right and you are talking in the right language to a chip you can program all registers.

See tools outside from BMW like Hextool or Explorer, or check the Minimon Tool for the C167 Siemens family MCU (MS42/42). You can read full flash (boot mode) and write your own driver for a complete different flash pinout.

But we should help this user or show him a way to solve the problem.
Meanwhile the cars engine would run...

[pullesnoter]

Photo from dme box for rana