360 How to "Bench flash" your Ferrari 360 Ignition ECU's! - Ferrari Life
Reply
 
LinkBack Thread Tools Display Modes
post #1 of 53 Old 12-30-2012, 01:32 PM Thread Starter
Owner
 
360trev's Avatar
 
Join Date: Nov 2005
Location: UK
Ferrari Life Posts: 354
How to "Bench flash" your Ferrari 360 Ignition ECU's!

DIY: How to "Bench flash" your Ferrari 360 Ignition computers

Disclaimer: This is dangerous and could damage your car, you do any of this at your own risk. I acquired a spare ecu and experimented on that. You have been warned...

Firstly I bought a simple OBD II to USB lead. (see pics) Its very cheap off ebay, about $15 usd.

The 360 Modena uses a Bosch ME7.3 (H4 Variant) firmware that's easy to pull the firmware (software) out off using a backdoor mode reserved for engineering. Its called 'boot mode' - assuming you can work out the pin out (which is a bit of a pain) its relatively straight forward. I had access to the workshop manuals so I traced the pins.

In total I found that 11 pins are needed to read and write the flash software from the Bosch Motronic ECU's found in the Ferrari 360 Modena, 360 Spider and also the
Challenge Stradale.

Here's my pin out that I used successfully;

obd-ii cable to pc. run software

Key:
(+) to +ve batt
(-) to -ve batt
(K) to k on ecu, directly wired <----> to pin F53
(L) not req.d - unused.

Power Requirements:
1. I used an adjustable Bench DC Power Supply set @ 13.5V (purchased from Maplin's). Just make sure its a reliable source of power that's noise free.

Firstly these 4 pins must go to (ground) ;
(-) F10 Boot Mode earth [Shorted or Not]
(-) F24 Reference earth
(-) F25 Reference earth
(-) F49 Reference earth

These 5 pins must go to (positive) ;
(+) F15 Power supply +30 Power input
(+) F16 Power supply from main relay
(+) F32 Power supply from main relay
(+) F47 Power supply +15 Power input
(+) F48 Power supply from main relay

This 1 pin is the (Serial Programming K-Line) ;
(K) F53 Serial line K <-------- to USB OBDII cable --------->

This pin to the case of the ecu
(L) F20 Serial line L <-------- to ECU case Ground --------->


Looking at the ECU (out of the car) straight on, its the 49 pin ECU connector on the RHS (just above the white sticker) that your putting your pins onto.
Attached Images
           

Strive for perfection in everything we do. Take the best that exists and make it better.
When it does not exist, design it. Accept nothing nearly right or good enough.
Henry Royce
360trev is offline  
Sponsored Links
Advertisement
 
post #2 of 53 Old 12-30-2012, 02:09 PM
Owner
 
eric355's Avatar
 
Join Date: May 2006
Location: Toulouse (France)
Ferrari Life Posts: 75
Great post Trev. Thanks to experiment on that
What S/W are you running on the laptop? KWP2000, Galleto or something different? Have you a link for the interface and software?
eric355 is offline  
post #3 of 53 Old 12-30-2012, 02:28 PM Thread Starter
Owner
 
360trev's Avatar
 
Join Date: Nov 2005
Location: UK
Ferrari Life Posts: 354
I have written my own stuff for the firmware map region patching, immo patcher, etc.

Here's the first release I did today (bsd open source license so technically 'do what you want' license ), all source-code and executable code hosted on Github.

https://github.com/360trev/ME7Sum

This does the checksum validation that your dumped file is ok. It will also soon be released with checksum recalc and save.

I will release my serial flasher soon too but its not yet cross platform (linux and windows) compatible. For now just use the Galleto 1260 s/w that comes with the lead. If on win7 you'll need to download the FTDI drivers direct from the ftdi website. The cd that comes with it doesn't have working drivers for anything but xp.

I've worked out a way that once you backup your flash you can flash a dummy app firmware (written in c16 assembly) which reads the contents of the eeprom flash and dumps it out to serial hex. Which you can then convert back to binary modify. Next you can flash another firmware to 'upload' a new firmware which modifies the eeprom and writes it back. That way you can 're-code' the ecu to your existing remote controls without any restrictions the original firmware/boot loader imposed.

A much easier way is IMMO killer patch of the firmware but that's not nice!

Strive for perfection in everything we do. Take the best that exists and make it better.
When it does not exist, design it. Accept nothing nearly right or good enough.
Henry Royce
360trev is offline  
 
post #4 of 53 Old 12-30-2012, 02:53 PM Thread Starter
Owner
 
360trev's Avatar
 
Join Date: Nov 2005
Location: UK
Ferrari Life Posts: 354
Quote:
Originally Posted by eric355 View Post
Great post Trev. Thanks to experiment on that
What S/W are you running on the laptop? KWP2000, Galleto or something different? Have you a link for the interface and software?
Here's one of the cheap Galletto leads like mine for less than $20 usd.

From UK Galletto 1260 ECU Chip Tuning Interface on EDC16, EDC15, MEx.x ,DELCO | eBay

Just ignore all the web based pinout examples. None of them are entirely correct, the info I gave is correct, it works on an actual 360 ecu.

Strive for perfection in everything we do. Take the best that exists and make it better.
When it does not exist, design it. Accept nothing nearly right or good enough.
Henry Royce
360trev is offline  
post #5 of 53 Old 12-30-2012, 08:04 PM
Owner
 
Rob4092xx's Avatar
 
Join Date: Sep 2012
Location: Phoenix, AZ
Ferrari Life Posts: 73
I don't have a freakin' clue what any of this means....whew! You guys are too smart for me!
Rob4092xx is offline  
post #6 of 53 Old 12-31-2012, 04:22 AM Thread Starter
Owner
 
360trev's Avatar
 
Join Date: Nov 2005
Location: UK
Ferrari Life Posts: 354
Whats this all about and why its useful?

Quote:
Originally Posted by Rob4092xx View Post
I don't have a freakin' clue what any of this means....whew! You guys are too smart for me!
Not really Rob, its just a lot of stupid terminology is used in electronics and computers that takes time to learn and understand.

This kind of work involves lots of investigation, it requires methodical research and involves multi-disciplinary skills across both software and hardware engineering. They can all be learned as huge amounts of information exists on the web for those so inclined. Once you understand it it all starts to make sense. Its not for everyone certainly, essentially this thread is about gaining access to be able to 'software upgrade' the software in the ignition computers used in the Ferrari 360.

Q. Why you may ask would you want to do that?

... Well plenty of reasons actually. One of the biggest incentives is in the quest for Improved Performance: Maps are sort of like the rows and columns in an Excel spreadsheet. They tell the fuel computers exactly how much petrol to meter out at any given point in the rev range for the available air (the mixture). For upgraded performance parts such as aftermarket high flow exhausts, cats and sports headers being able to customize these maps can yield improvements in power but need to be done by experienced tuners on a dynometer to verify air to fuel mixtures (AFR ratio's) are correct. Too much fuel and the engine runs rich, too little and it runs lean. Both can damage engine components so its vital a rolling road session is done with accurate wide band oxygen sensors to measure things in real-time as maps are being tuned. Its not for the novice.

Also other maps exist such as throttle sensitivity and they can also be tweaked too (the throttle is drive by wire) so its all software... Ferrari themselves did this for the Challenge Stradale and indeed some people simply use the factory software from the CS in their Modena computers to get a healthy increase in power (+10hp gain) with just a re-flash alone.

You back up your computer right? ...But not your cars data! Another great use is to save money, if one of your ECU's is faulty and dies it could cost literally thousands of dollars to replace and get setup by a dealer with an SD2. Armed with ECU knowledge you could seek out a cheap used ecu and then reprogram it (swapping over your details of your immobilizer codes, etc) then re-use it. These Bosch ECU's are used in many cars such as Alfa Romeo's of the same vintage so being able to do this can literally same huge cash in the event of failures.


Strive for perfection in everything we do. Take the best that exists and make it better.
When it does not exist, design it. Accept nothing nearly right or good enough.
Henry Royce
360trev is offline  
post #7 of 53 Old 12-31-2012, 05:52 AM
Owner
Elite Member
 
cribbj's Avatar
 
Join Date: Apr 2010
Location: Houston
Ferrari Life Posts: 2,199
Trev or Eric, any idea if the software/hardware works with older Motronics, ie the 5.2's?

I'd like to pick up a BMW 5.2 Motronic for their V12 application for cheap and see if it can be reflashed with the Ferrari 550 code.

'99 550, Rosso Corsa / Nero, S/N:114654, Assy: 31836, Engine: 52084

High mileage, low compression, and missing on a few cylinders.....just like my cars.

Maranello Skunkworks Team Member
cribbj is offline  
post #8 of 53 Old 12-31-2012, 06:49 AM Thread Starter
Owner
 
360trev's Avatar
 
Join Date: Nov 2005
Location: UK
Ferrari Life Posts: 354
Quote:
Originally Posted by cribbj View Post
Trev or Eric, any idea if the software/hardware works with older Motronics, ie the 5.2's?

I'd like to pick up a BMW 5.2 Motronic for their V12 application for cheap and see if it can be reflashed with the Ferrari 550 code.
I believe it does. Models officially supported;
  • FERRARI 360 MODENA
    • BOSCH ME7 IBRIDA R/W Modena 3.6 Bosch ME7.3H4
  • FERRARI F355 & 456
    • M52 BOSCH MOTRONIC MICRO CC460
  • FERRARI F430
    • BOSCH ME7.3.2 29F800BB R/W 430 4.3 V8

Strive for perfection in everything we do. Take the best that exists and make it better.
When it does not exist, design it. Accept nothing nearly right or good enough.
Henry Royce
360trev is offline  
post #9 of 53 Old 12-31-2012, 07:56 AM
Owner
 
eric355's Avatar
 
Join Date: May 2006
Location: Toulouse (France)
Ferrari Life Posts: 75
Quote:
Originally Posted by 360trev View Post
Here's one of the cheap Galletto leads like mine for less than $20 usd.

From UK Galletto 1260 ECU Chip Tuning Interface on EDC16, EDC15, MEx.x ,DELCO | eBay

Just ignore all the web based pinout examples. None of them are entirely correct, the info I gave is correct, it works on an actual 360 ecu.
Thank you Trev
I have a spare ME7.3H4 from a Fiat, but had not yet spent time trying to play with. It seems they are not all the same, the one I have is supposed to have the boot pin on the other connector. One day, I will try ...
eric355 is offline  
post #10 of 53 Old 12-31-2012, 08:11 AM
Owner
 
eric355's Avatar
 
Join Date: May 2006
Location: Toulouse (France)
Ferrari Life Posts: 75
Quote:
Originally Posted by cribbj View Post
Trev or Eric, any idea if the software/hardware works with older Motronics, ie the 5.2's?

I'd like to pick up a BMW 5.2 Motronic for their V12 application for cheap and see if it can be reflashed with the Ferrari 550 code.
Hi John, long time, hope you are well.
IMO the Motronic 5.2 is probably the worst ECU to work with. I spent some time on it when I had my F355, and finally decided to not play with it. I also bought a pair of BMW V12 ones but never tried to read or flash them. I still should have one complete if you want to experiment.
Here you will find some discussions we have on tis subject, a couple years ago : view and edit motronic maps! - Page 2 - FerrariChat.com
Jim Conforti is probably the one guy who knows those ECU the best.
eric355 is offline  
post #11 of 53 Old 12-31-2012, 08:42 AM Thread Starter
Owner
 
360trev's Avatar
 
Join Date: Nov 2005
Location: UK
Ferrari Life Posts: 354
Quote:
Originally Posted by eric355 View Post
Thank you Trev
I have a spare ME7.3H4 from a Fiat, but had not yet spent time trying to play with. It seems they are not all the same, the one I have is supposed to have the boot pin on the other connector. One day, I will try ...
Eric,

You need to know the original pinout first to communicate to the ecu. Don't forget they are reprogrammable pins, they are GPIO (General Purpose Input Output) so the software determines their functions. Once fully 100% reflashed it should take the form of the 360 pinout (!). Just like you discovered on the TCU's from F430 to CS...

Strive for perfection in everything we do. Take the best that exists and make it better.
When it does not exist, design it. Accept nothing nearly right or good enough.
Henry Royce
360trev is offline  
post #12 of 53 Old 12-31-2012, 12:52 PM
Owner
Elite Member
 
tazandjan's Avatar
 
Join Date: Aug 2011
Location: Albuquerque, NM
Ferrari Life Posts: 11,858
Eric- That reminds me, if I send you my 575M HGTC TCU, can you copy to hard drive for me? I need to have a new Motronic DME to match with the TCU or it will not work, so not using it right now and might as well have it documented.

Taz
Terry Phillips

Present: 575M 135171
Past: Dino 246 GT 02984, 365 GTB/4 14009, 308 GTS 25125

Every day I look around, and if nobody is shooting at me, it is a pretty good day.
tazandjan is offline  
post #13 of 53 Old 01-01-2013, 12:05 AM
Owner
 
Join Date: Oct 2011
Ferrari Life Posts: 212
it looks like you are trying to reinvent the wheel.... the chip appears to be an every day EPROM... EPROM burners / readers are dirt cheap, with various socket / pin configurations to accomodate most commonly used chips... EPROM stands for eraseable / programable / read only memory... The chip stores the instructions for whatever that it will control...the eprom reader allows to copy / read all the info /download it to the computer... to use however wanted...or just archive it... Eproms are cheap ( literally pennies in quantity ). New car electronics are designed where these chips can be upgraded with new data in place or a new replacement chip can be programed in the car as well... all that is needed is the correct software and connection / access point... or a new chip can be burned on the bench using a burner.... doing it on the bench is easier allowing to burn different varients... then it is a matter of switching out the chips to decide which is the preferred setup.... you can make a chip to use for intown driving, make a chip for each track that you go to, have one for cold weather driving, have one for hot weather driving... you can set up engine management for any occasion

Last edited by fromage; 01-01-2013 at 12:16 AM.
fromage is offline  
post #14 of 53 Old 01-01-2013, 01:39 AM
Owner
Elite Member
 
cribbj's Avatar
 
Join Date: Apr 2010
Location: Houston
Ferrari Life Posts: 2,199
Quote:
Originally Posted by eric355 View Post
Hi John, long time, hope you are well.
IMO the Motronic 5.2 is probably the worst ECU to work with. I spent some time on it when I had my F355, and finally decided to not play with it. I also bought a pair of BMW V12 ones but never tried to read or flash them. I still should have one complete if you want to experiment.
Here you will find some discussions we have on tis subject, a couple years ago : view and edit motronic maps! - Page 2 - FerrariChat.com
Jim Conforti is probably the one guy who knows those ECU the best.
Thanks Eric and Happy New Year to you & yours! I'll try to contact Jim.

'99 550, Rosso Corsa / Nero, S/N:114654, Assy: 31836, Engine: 52084

High mileage, low compression, and missing on a few cylinders.....just like my cars.

Maranello Skunkworks Team Member
cribbj is offline  
post #15 of 53 Old 01-01-2013, 02:06 AM
Owner
 
eric355's Avatar
 
Join Date: May 2006
Location: Toulouse (France)
Ferrari Life Posts: 75
Quote:
Originally Posted by cribbj View Post
Thanks Eric and Happy New Year to you & yours! I'll try to contact Jim.
Thank you John.
Happy new year!!
eric355 is offline  
post #16 of 53 Old 01-01-2013, 02:19 AM
Owner
 
eric355's Avatar
 
Join Date: May 2006
Location: Toulouse (France)
Ferrari Life Posts: 75
Quote:
Originally Posted by fromage View Post
it looks like you are trying to reinvent the wheel.... the chip appears to be an every day EPROM... EPROM burners / readers are dirt cheap, with various socket / pin configurations to accomodate most commonly used chips... EPROM stands for eraseable / programable / read only memory... The chip stores the instructions for whatever that it will control...the eprom reader allows to copy / read all the info /download it to the computer... to use however wanted...or just archive it... Eproms are cheap ( literally pennies in quantity ). New car electronics are designed where these chips can be upgraded with new data in place or a new replacement chip can be programed in the car as well... all that is needed is the correct software and connection / access point... or a new chip can be burned on the bench using a burner.... doing it on the bench is easier allowing to burn different varients... then it is a matter of switching out the chips to decide which is the preferred setup.... you can make a chip to use for intown driving, make a chip for each track that you go to, have one for cold weather driving, have one for hot weather driving... you can set up engine management for any occasion
It appears that the ECU Trev is talking about (Motronic ME7.3H4) use an hybrid circuit. IC dies are directly installed on a ceramic substrate. There is absolutely no way to remove/replace the EEPROM.
The easiest way to reflash those ECUs is how Trev is doing it.
Attached Images
 
eric355 is offline  
post #17 of 53 Old 01-01-2013, 02:25 AM
Owner
 
eric355's Avatar
 
Join Date: May 2006
Location: Toulouse (France)
Ferrari Life Posts: 75
Quote:
Originally Posted by tazandjan View Post
Eric- That reminds me, if I send you my 575M HGTC TCU, can you copy to hard drive for me? I need to have a new Motronic DME to match with the TCU or it will not work, so not using it right now and might as well have it documented.
Happy new year Terry!
Yes, of course, if you want, I would be glad to make a back-up of your HGTC TCU. It could be useful, never knows ...
eric355 is offline  
post #18 of 53 Old 01-01-2013, 02:42 AM Thread Starter
Owner
 
360trev's Avatar
 
Join Date: Nov 2005
Location: UK
Ferrari Life Posts: 354
Quote:
Originally Posted by fromage View Post
it looks like you are trying to reinvent the wheel.... the chip appears to be an every day EPROM... EPROM burners / readers are dirt cheap, with various socket / pin configurations to accomodate most commonly used chips... EPROM stands for eraseable / programable / read only memory... The chip stores the instructions for whatever that it will control...the eprom reader allows to copy / read all the info /download it to the computer... to use however wanted...or just archive it... Eproms are cheap ( literally pennies in quantity ). New car electronics are designed where these chips can be upgraded with new data in place or a new replacement chip can be programed in the car as well... all that is needed is the correct software and connection / access point... or a new chip can be burned on the bench using a burner.... doing it on the bench is easier allowing to burn different varients... then it is a matter of switching out the chips to decide which is the preferred setup.... you can make a chip to use for intown driving, make a chip for each track that you go to, have one for cold weather driving, have one for hot weather driving... you can set up engine management for any occasion
Have you actually opened a ME7.3.1 H4 ecu from a 360? I really do not understand the 're-inventing the wheel comment' comment. Let me explain...

Its not on a traditional printed circuit board like your typical ECU. Starting from the F430 Bosch began using industry standard PCB designs (probably for cost reasons). Off the shelf flash chips which can indeed be re-programmed (also worth looking at what Eric did with the Magneti Marelli TCU, he wrote up a full description for that which he de-soldered [there are no socketed IC's on these mass produced boards] the flash chip from).

The 360's pair of Bosch ME7.3 ECU's looks like a bit like you've lanced the top of all of the IC's and when you put it under a high power microscope you can see why... Just like their older gen ABS did its all visible logic gates! Obviously done for lowest possible cost and size to allow Bosch at the time to save money and meet exacting packaging requirements when IC where still huge! This allowed their ecu's to go into harsh environments like engine bays because they where small and low power. Its not a problem when these designs ran at such slow clock speeds on very old cpu's like the Siemens C16x. Ofcourse inside it is using chip logic but not ones you can remove with the de-solder techniques you describe.

There are two different storage types used in the ME7.3, a microscopic SPI bus tiny 512 byte EEPROM used for settings (things like pairing to immobilizer), as well as orders of magnitude larger flash (512Kbytes) for the main code and maps.

The way to address this is via boot mode (the built in method) or via OBD-II protocols once you figure out the communication modes over serial because you certainly are not going to desolder them.
Attached Images
 

Strive for perfection in everything we do. Take the best that exists and make it better.
When it does not exist, design it. Accept nothing nearly right or good enough.
Henry Royce
360trev is offline  
post #19 of 53 Old 01-01-2013, 02:46 AM Thread Starter
Owner
 
360trev's Avatar
 
Join Date: Nov 2005
Location: UK
Ferrari Life Posts: 354
Quote:
Originally Posted by eric355 View Post
It appears that the ECU Trev is talking about (Motronic ME7.3H4) use an hybrid circuit. IC dies are directly installed on a ceramic substrate. There is absolutely no way to remove/replace the EEPROM.
The easiest way to reflash those ECUs is how Trev is doing it.
Eric, you beat me to it Great pic by the way!

Strive for perfection in everything we do. Take the best that exists and make it better.
When it does not exist, design it. Accept nothing nearly right or good enough.
Henry Royce
360trev is offline  
post #20 of 53 Old 01-01-2013, 03:30 AM
Owner
 
eric355's Avatar
 
Join Date: May 2006
Location: Toulouse (France)
Ferrari Life Posts: 75
Quote:
Originally Posted by 360trev View Post
Eric, you beat me to it Great pic by the way!

Happy new year Trev!
It's a pic of the Fiat ECU. I have not tried to read or flash it ... but I did open it
eric355 is offline  
Reply

Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page
Display Modes
Linear Mode Linear Mode



Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome
Copyright 2012 ONE Media, Inc.
FerrariLife is independently run with no affiliation with Ferrari SpA
Ferrari for Sale | Maserati for Sale