ME7.1 2.7T S4

Bosch Motronic ME7.1 ("M-box"), 16-bit petrol engine management for the Audi 2.7T biturbo V6 (EA030 / AGB-AZB-APB), Audi B5 S4 and C5 A6/allroad. Speed-density + MAF torque-based ME architecture (throttle-by-wire, torque monitor).

Reference - updated 4 August 2026

The ECU hardware

Siemens/Infineon C167-family 16-bit MCU (the 8D unit is a C167CR-derived core). CORRECTION: the program store is NOT on-die flash - it is an EXTERNAL 8-Mbit (1 MB) parallel NOR flash (Am29F800/M29F800-class, e.g. 29F800 @ chip-select region) mapped into the C167 address space at 0x800000. That external-mapping is exactly why the factory DAMOS/A2L addresses equal file offset + 0x800000 (verified: KFMIRL $814BEE -> file 0x14BEE, KFMIOP $816186 -> 0x16186). Little-endian throughout (16-bit words, LE u16/u8 cells). Box codes: 8D0907551M ("M-box") and 8D0907551L ("L-box") are both B5 S4 2.7T (Bosch SW 0261207143 family); the letter suffix tracks transmission/market (M is commonly the 6-speed manual, L the Tiptronic auto). CORRECTION to power/codes: the USDM B5 S4 is rated 250 hp / 258 lb-ft (engine code APB); Euro S4 is 265 PS (AGB/AZB). The draft's "USDM 265 hp" is wrong - US is 250 hp.

Fuelling and load sensing

Petrol/gasoline. EU: 95-98 RON (Stage 1 wants 98 RON). US: 91-93 AKI premium (91 AKI approx 95 RON, 93 AKI approx 98 RON; the knock model compares a RON-equivalent). Do NOT run aggressive boost/Stage-1 timing on 91 AKI - pull 1-2 deg or drop boost. E85 (approx 105 RON-equiv, ~35% more fuel mass) is a Stage 2/3 option that raises knock margin but demands larger injectors + pump. Safety net a boost-only tune leans on = closed-loop knock control (dwkr / per-cylinder retard) + closed-loop lambda; both are active and must NOT be disabled.

How this ECU is read and flashed

READ: full 1 MB flash over OBD K-line (ISO14230/KWP2000). The M-box answers NO-ADDRESS ISO14230 framing (probe framing per-ECU - some 2.7T revs use physical addressing). Flash is read via programming/dev session (0x10 85) + seed/key (0x27) + requestUpload 0x35 / transferData 0x36 / requestTransferExit 0x37, banked per 64 KB. EEPROM/RAM read via dev session 0x10 86 + readMemoryByAddress 0x23 is immo-free; the flash-upload path uses the programming session. On the commonly immo-off US M-box no immo auth is needed to read; on matched/EU cars the programming session itself can be immo-gated. WRITE (OBD reflash): NefMoto/Galletto-class works on this ECU - programming session (0x10 85), seed/key (0x27), erase (routineControl 0x31), requestDownload (0x34), transferData (0x36), exit (0x37); the write/dev session is immo-gated on matched cars. ALWAYS run an ME7-checksum pre-flight and protect the bootloader/bank0 region. BENCH/BOOT (recovery + RSA siblings): C167 boot-strap-loader (BSL) over K-line is immo-immune but needs ONE internal boot pin grounded (P0L.4 / flash pin ~24) - NOT a pure-cable operation; used to recover a bad flash or handle RSA-signed ME7.1.1 relatives. IMMO: US B5 S4 8D0907551M is commonly immo-off/'not provisioned' so flashing is straightforward; matched/EU cars need component security/SKC handled. A wrong-checksum flash sets P0601 and won't start; P0601 cannot be cleared from boot mode alone - it needs a checksum-correct file flashed via the normal VAG protocol.

Engine codes in this family

• AGB (Euro S4, 265 PS)
• AZB (Euro S4/A6, 265 PS)
• APB (USDM B5 S4 250 hp; also C5 A6/allroad)
• ATQ (later C5 2.7T)
• AJK/AZR (RS4 B5, 380 PS - ME7.1.1, RSA-signed, different box)

Staging - what each stage really gives

• stage1 - SOFTWARE ONLY, stock twin K03S turbos + stock hardware. Raise KFMIRL high-load rows (GIAC-style, rows >=5) and open the wastegate/N75 duty limiter (0x19BED) to match; raise the torque cap (KFMIOP/MDDKMAX) in lockstep; richen LAMFA at WOT (safe direction; some vendor tunes leave it stock). Leave KFZW stock (knock control adapts). Taper peak load so K03S stay out of surge/overspeed: ~0.9-1.1 bar gauge peak, tapering with RPM. Gains ~+40-60 hp -> roughly ~290-320 hp crank on 93 AKI / 98 RON (from the 250 US / 265 EU baseline). Do NOT run aggressive boost/timing on 91 AKI. This is the GIAC/APR '91/93' class; fueling stays within stock injectors/MAF.
• stage2 - Bolt-ons + the K04 turbo swap is the real Stage 2 (K04-015/064). The stock K03S is essentially maxed at Stage 1 (~0.9 bar / ~310 hp) - holding sustained >1.1-1.2 bar on K03S just cooks them past their efficiency cliff, so do not chase 'Stage 2 on K03'. With K04s: catback/downpipes, larger FMIC (SMICs heat-soak), free-flow intake, upgraded DVs, usually a 3-inch MAF housing, ~1.2-1.3 bar peak. If the MAF housing changes or the MAF clips, RESCALE MLHFM (or lean-out). Typical ~360-380 hp crank on 98 RON with matched fueling. Larger injectors (e.g. 550cc EV14, mandatory KRKTE recalc) are common here.
• stage3 - Hardware: bigger turbos (RS4/BW hybrid K04, GT28RS/GT30, or a large K-frame/big single), larger injectors (~550-1050cc -> mandatory KRKTE recalc), larger MAF (MLHFM rescale), FMIC, uprated fuel pump (Bosch 044 / Walbro 255), and an UPGRADED CLUTCH (stock B5 6MT clutch slips past ~350-380 lb-ft). ~1.4-1.6+ bar, ~400-500 hp on petrol; big-single/E85 pushes 450-600+ hp with supporting mods (forged rods recommended past ~450-500 crank hp). The captured GIAC 'Stage 3-minus' 8D0907551M is an entry K04-class recal (KFMIRL raised + boost/duty limiter pinned open, torque model kept consistent).

Safety limits

• TORQUE MONITOR (HARD, ECU-enforced): KFMIRL and KFMIOP/torque model MUST stay in lockstep, and MDDKMAX (torque-request cap) must be raised with the stage - raising the load request without matching the torque model triggers torque intervention (timing pull / fuel cut / limp). This is the single most important 2.7T limit.
• WOT LAMBDA / AFR: keep full-load ~0.80-0.85 lambda (~11.7-12.4:1). Never lean of ~0.86 under boost. Log AFR; enrich via LAMFA BEFORE adding boost/timing.
• FUEL TRIMS: keep STFT+LTFT within ~+/-10%. If MLHFM/KRKTE are wrong the trims saturate (+/-25%) and set P0170/P0171/P0173 - fix the MAF/injector scaling, do not let closed-loop mask it.
• INJECTOR DUTY: stock ~315cc injectors run out near ~330-350 crank hp; above ~85-90% static duty they go lean -> knock. Go bigger (Stage 3) rather than lean.
• FUEL SUPPLY / RAIL PRESSURE (was missing): the 2.7T is port-injection with a boost-referenced FPR (~3.0 bar base rising to ~4 bar under boost). The stock in-tank pump + FPR run out of delivery at high hp -> rail-pressure droop -> lean/knock. Log fuel pressure; fit an uprated pump (Bosch 044 / Walbro 255) at Stage 3.
• MAF CLIPPING: do not exceed the HFM sensor ceiling (~5.0V). Flat/clipped MAF under-reports air -> lean. Rescale MLHFM or fit a larger housing.
• BOOST / TURBO: stock K03S - do not sustain >~1.1-1.2 bar; past compressor pressure-ratio ~2.0 you hit the efficiency cliff (rising outlet temps, lost IC margin, shaft overspeed/surge). Larger turbos raise this but watch surge/spool.
• TRANSIENT OVERBOOST SPIKE (was missing): the boost PID can spike above steady-state on tip-in. Keep the SPIKE (not just steady-state) under the overboost cut or you trip a fuel cut even with a 'safe' peak; tune the duty limiter and boost setpoint to control overshoot.
• KNOCK CONTROL: monitor dwkr / per-cylinder retard. Sustained heavy KR (more than a few degrees pulled at WOT) = back off boost/timing or add fuel. Do NOT reduce KFKR (knock-controller authority) or disable knock detection - it is the real-time safety net.
• IAT / HEAT SOAK (was missing): stock side-mount intercoolers heat-soak quickly; IAT-based timing pull erodes knock margin on repeated pulls. Upgrade cooling for Stage 2+ and watch IAT-driven retard.
• MAP-SENSOR / OVERBOOST CEILING: the MAP sensor tops at 0xFFFF = ~2559.96 mbar; exceeding the overboost threshold triggers a fuel cut. Keep boost target under it (DSLOFS rescale only needed for >2.5 bar builds).
• EGT (petrol): keep pre-turbo EGT below ~900-950 C - adequate WOT enrichment (LAMFA) plus not over-retarding timing keeps it in check. K03 exhaust housings are heat-limited.
• MECHANICAL / BOTTOM-END + BELT (was missing): stock 2.7T rods/pistons are generally good to ~450-500 crank hp; budget forged rods beyond that. Timing belt + tensioner/water-pump service is a hard prerequisite before any power adder - this is an interference engine and a belt failure destroys it.
• CLUTCH / DRIVELINE (B5 S4 6MT, no DSG on this platform): stock clutch holds ~350-380 lb-ft; Stage 2+/Stage 3 torque requires an upgraded clutch or it slips.
• DPF/GPF: NOT APPLICABLE - this is a 2000-2002 petrol platform with no diesel particulate / gasoline particulate filter; there is no DPF regen or soot-load limit to manage.
• CHECKSUM / IMMO INTEGRITY: a flashed file with wrong ME7 checksums (ROMSYS/CRC-32/main/multipoint) sets P0601 and will not start; RSA-signed ME7.1.1 relatives cannot be re-signed by ME7Sum-class tools - do not 'fix and flash' those over OBD. Always run a checksum pre-flight and protect the bootloader/bank0.

Every car using this platform (1)

Stock power and typical remap figures per car. Stage results assume a healthy engine on good fuel.

How confident is this?

SOLID (in-house source-validated + public-corroborated): 1 MB C167 EXTERNAL-NOR full-flash, little-endian, +0x800000 DAMOS offset (verified on file). The ME7 checksum architecture INCLUDING the CRC-32 group - directly corroborated in the nyetwurk/ME7Sum C source (crc32.c poly 0xEDB88320; me7sum.c runs ROMSYS -> CRC/Main-Data -> Main-Program -> Multipoint, RSA/MD5-aware for signed bins) and NefMoto's M-box function masks - so the draft's CRC-32 claim is CORRECT, not fictional. 8D0907551M is NOT RSA-signed (ME7Check 'File is OK'). KFMIRL @ 0x14BEE and the boost/wastegate-duty limiter @ 0x19BED (u8; second row 0x19C04; GIAC pins both to 242) are diff-validated in-house against a real GIAC 'Stage 3-minus' read (0.668% / 7006-byte diff). The torque-lockstep requirement and the OBD/boot flash + immo boundary are firm. THIN / CAVEATED / CORRECTED: (1) US power is 250 hp (APB), not the draft's 265 - 265 PS is Euro. (2) Program store is external NOR mapped at 0x800000, not on-die flash. (3) KFMIOP (0x16186), LDRXN (0x1DCF4), KRKTE (0x1C2BC), MLHFM (0x14254), LAMFA (~0x1C370) are factory-DAMOS/XDF addresses, NOT separately re-isolated by the in-house diff - always re-decode dims/scale on the