Bosch ME7.1 on the B5 S4 2.7T biturbo

Bosch Motronic ME7.1 ("M-box"), 16-bit petrol engine management for the Audi 2.7T biturbo V6 (EA835 / AGB-AZB-APB), Audi B5 S4 and C5 A6/allroad. Speed-density + MAF torque-based ME architecture (throttle-by-wire, torque monitor).

Reference - updated 7 October 2026

The ECU hardware

Siemens/Infineon C167-family 16-bit MCU (the 8D unit is a C167CR-derived core). The program is NOT stored in on-chip flash. It lives in an EXTERNAL 8-Mbit (1 MB) parallel NOR flash chip (Am29F800/M29F800-class, e.g. 29F800 on a chip-select region) mapped into the C167 address space at 0x800000. That external mapping is exactly why factory DAMOS/A2L addresses equal file offset + 0x800000 (confirmed on a real file: KFMIRL $814BEE -> file 0x14BEE, KFMIOP $816186 -> 0x16186). Little-endian throughout (16-bit words, LE u16/u8 cells). Box codes: 8D0907551M ('M-box', Bosch 0261207143) and 8D0907551L (Bosch 0261207004) are both B5 S4 2.7T boxes. There are many suffix letters (A to T across the S4 and RS4), each tied to a market, gearbox and software version, so go by the label on your own box. Power: the US-market B5 S4 is rated 250 hp / 258 lb-ft (engine code APB); the European S4 is rated 265 PS (engine codes AGB/AZB).

Fuelling and load sensing

Petrol/gasoline. EU: 95-98 RON (Stage 1 wants 98 RON). US: 91-93 AKI premium (91 AKI approx 95 RON, 93 AKI approx 98 RON; the knock model compares a RON-equivalent). Do NOT run aggressive boost/Stage-1 timing on 91 AKI - pull 1-2 deg or drop boost. E85 (approx 105 RON-equiv, ~35% more fuel mass) is a Stage 2/3 option that raises knock margin but demands larger injectors + pump. Safety net a boost-only tune leans on = closed-loop knock control (dwkr / per-cylinder retard) + closed-loop lambda; both are active and must NOT be disabled.

How this ECU is read and flashed

READ: full 1 MB flash over OBD K-line (ISO14230/KWP2000). The M-box answers NO-ADDRESS ISO14230 framing (probe framing per-ECU - some 2.7T revs use physical addressing). Flash is read via programming/dev session (0x10 85) + seed/key (0x27) + requestUpload 0x35 / transferData 0x36 / requestTransferExit 0x37, banked per 64 KB. EEPROM/RAM read via dev session 0x10 86 + readMemoryByAddress 0x23 is immo-free; the flash-upload path uses the programming session. On the commonly immo-off US M-box no immo auth is needed to read; on matched/EU cars the programming session itself can be immo-gated. WRITE (OBD reflash): Galletto-class flashers work on this ECU - programming session (0x10 85), seed/key (0x27), erase (routineControl 0x31), requestDownload (0x34), transferData (0x36), exit (0x37); the write/dev session is immo-gated on matched cars. ALWAYS run an ME7-checksum pre-flight and protect the bootloader/bank0 region. BENCH/BOOT (recovery + RSA siblings): C167 boot-strap-loader (BSL) over K-line is immo-immune but needs ONE internal boot pin grounded (P0L.4 / flash pin ~24) - NOT a pure-cable operation; used to recover a bad flash or handle RSA-signed ME7.1.1 relatives. IMMO: US B5 S4 8D0907551M is commonly immo-off/'not provisioned' so flashing is straightforward; matched/EU cars need component security/SKC handled. A wrong-checksum flash sets P0601 and won't start; P0601 cannot be cleared from boot mode alone - it needs a checksum-correct file flashed via the normal VAG protocol.

Engine codes in this family

• AGB (Euro S4, 265 PS)
• AZB (Euro S4, 265 PS)
• APB (USDM B5 S4 250 hp; also C5 A6/allroad)
• ASJ/AZR (RS4 B5, 380 PS)

Staging - what each stage really gives

• stage1 - SOFTWARE ONLY, stock twin K03S turbos + stock hardware. Raise KFMIRL high-load rows (GIAC-style, rows >=5) and open the wastegate/N75 duty limiter (0x19BED) to match; raise the torque cap (KFMIOP/MDDKMAX) in lockstep; richen LAMFA at WOT (safe direction; some vendor tunes leave it stock). Leave KFZW stock (knock control adapts). Taper peak load so K03S stay out of surge/overspeed: ~0.9-1.1 bar gauge peak, tapering with RPM. Gains ~+40-60 hp -> roughly ~290-320 hp crank on 93 AKI / 98 RON (from the 250 US / 265 EU baseline). Do NOT run aggressive boost/timing on 91 AKI. This is the GIAC/APR '91/93' class; fueling stays within stock injectors/MAF.
• stage2 - Bolt-ons on the stock K03s: downpipes and exhaust, intake, intercoolers and upgraded DVs, with the map to match. Published figures for the 265 PS S4 are about 330-340 PS (B&B 340 PS / 520 Nm, TurboPerformance 330 PS / 490 Nm); past about 1.1-1.2 bar sustained the K03s run off their efficiency. The bigger step is the RS4 turbo swap (K04-025/026 with RS4 injectors, MAF and intercoolers), which most tuners sell as Stage 3: about 430-450 hp crank on premium fuel (GIAC 430 hp, APR 447 hp). If the MAF housing changes or the MAF clips, RESCALE MLHFM. Larger injectors (e.g. 550cc EV14, with KRKTE recalculated) are common at that point.
• stage3 - Hardware: bigger turbos (RS4/BW hybrid K04, GT28RS/GT30, or a large K-frame/big single), larger injectors (~550-1050cc -> mandatory KRKTE recalc), larger MAF (MLHFM rescale), FMIC, uprated fuel pump (Bosch 044 / Walbro 255), and an UPGRADED CLUTCH (no torque rating is published for the stock B5 clutch; the Sachs Performance kit is rated 550+ Nm). ~1.4-1.6+ bar, ~400-500 hp on petrol; big-single/E85 pushes 450-600+ hp with supporting mods (forged rods recommended past ~450-500 crank hp). The captured GIAC 'Stage 3-minus' 8D0907551M is an entry K04-class recal (KFMIRL raised + boost/duty limiter pinned open, torque model kept consistent).

Safety limits

• TORQUE MONITOR (HARD, ECU-enforced): KFMIRL and KFMIOP/torque model MUST stay in lockstep, and MDDKMAX (torque-request cap) must be raised with the stage - raising the load request without matching the torque model triggers torque intervention (timing pull / fuel cut / limp). This is the single most important 2.7T limit.
• WOT LAMBDA / AFR: keep full-load ~0.80-0.85 lambda (~11.7-12.4:1). Never lean of ~0.86 under boost. Log AFR; enrich via LAMFA BEFORE adding boost/timing.
• FUEL TRIMS: keep STFT+LTFT within ~+/-10%. If MLHFM/KRKTE are wrong the trims saturate (+/-25%) and set P0170/P0171/P0173 - fix the MAF/injector scaling, do not let closed-loop mask it.
• INJECTOR DUTY: stock injectors (349cc at 4 bar) run out near ~330-350 crank hp; above ~85-90% static duty they go lean -> knock. Go bigger (Stage 3) rather than lean.
• FUEL SUPPLY / RAIL PRESSURE: the 2.7T is port-injection with a boost-referenced FPR (~3.0 bar base rising to ~4 bar under boost). The stock in-tank pump + FPR run out of delivery at high hp -> rail-pressure droop -> lean/knock. Log fuel pressure; fit an uprated pump (Bosch 044 / Walbro 255) at Stage 3.
• MAF CLIPPING: do not exceed the HFM sensor ceiling (~5.0V). Flat/clipped MAF under-reports air -> lean. Rescale MLHFM or fit a larger housing.
• BOOST / TURBO: stock K03S - do not sustain >~1.1-1.2 bar; past compressor pressure-ratio ~2.0 you hit the efficiency cliff (rising outlet temps, lost IC margin, shaft overspeed/surge). Larger turbos raise this but watch surge/spool.
• TRANSIENT OVERBOOST SPIKE: the boost PID can spike above steady-state on tip-in. Keep the SPIKE (not just steady-state) under the overboost cut or you trip a fuel cut even with a 'safe' peak; tune the duty limiter and boost setpoint to control overshoot.
• KNOCK CONTROL: monitor dwkr / per-cylinder retard. Sustained heavy KR (more than a few degrees pulled at WOT) = back off boost/timing or add fuel. Do NOT reduce KFKR (knock-controller authority) or disable knock detection - it is the real-time safety net.
• IAT / HEAT SOAK: stock side-mount intercoolers heat-soak quickly; IAT-based timing pull erodes knock margin on repeated pulls. Upgrade cooling for Stage 2+ and watch IAT-driven retard.
• MAP-SENSOR / OVERBOOST CEILING: the MAP sensor tops at 0xFFFF = ~2559.96 mbar; exceeding the overboost threshold triggers a fuel cut. Keep boost target under it (DSLOFS rescale only needed for >2.5 bar builds).
• EGT (petrol): keep pre-turbo EGT below ~900-950 C - adequate WOT enrichment (LAMFA) plus not over-retarding timing keeps it in check. K03 exhaust housings are heat-limited.
• MECHANICAL / BOTTOM-END + BELT: stock 2.7T rods/pistons are generally good to ~450-500 crank hp; budget forged rods beyond that. Timing belt + tensioner/water-pump service is a hard prerequisite before any power adder - this is an interference engine and a belt failure destroys it.
• CLUTCH / DRIVELINE (B5 S4 6MT, no DSG on this platform): no torque rating is published for the stock clutch, so budget an upgraded one for Stage 2+/Stage 3 torque (the Sachs Performance kit is rated 550+ Nm).
• DPF/GPF: NOT APPLICABLE - this is a 2000-2002 petrol platform with no diesel particulate / gasoline particulate filter; there is no DPF regen or soot-load limit to manage.
• CHECKSUM / IMMO INTEGRITY: a flashed file with wrong ME7 checksums (ROMSYS/CRC-32/main/multipoint) sets P0601 and will not start; RSA-signed ME7.1.1 relatives cannot be re-signed by ME7Sum-class tools - do not 'fix and flash' those over OBD. Always run a checksum pre-flight and protect the bootloader/bank0.

Every car using this platform (1)

Stock power and typical remap figures per car. Stage results assume a healthy engine on good fuel.

How confident is this?

Well established: the 2.7T S4 ECU has a 1 MB full flash on an EXTERNAL NOR chip read by a C167 processor. It is little-endian, and factory DAMOS addresses equal file offset + 0x800000 (confirmed on a real file). The program is stored on this external NOR chip mapped at 0x800000, not in on-chip flash. The ME7 checksum layout, including the CRC-32 group, matches the open-source ME7Sum code (crc32.c uses poly 0xEDB88320; me7sum.c runs ROMSYS -> CRC/Main-Data -> Main-Program -> Multipoint and is RSA/MD5-aware for signed bins) and the published M-box function locations. 8D0907551M is NOT RSA-signed (ME7Check reports 'File is OK'). KFMIRL at 0x14BEE and the boost/wastegate-duty limiter at 0x19BED (u8, second row at 0x19C04, both set to 242 by GIAC) were confirmed by comparing stock against a real GIAC 'Stage 3-minus' read (0.668% / 7006 bytes differ). Two things are firm: the torque model must move in step with KFMIRL, and the OBD/boot-mode flashing and immobiliser boundaries hold. Uncertain or variable: (1) KFMIOP (0x16186), LDRXN (0x1DCF4), KRKTE (0x1C2BC), MLHFM (0x14254) and LAMFA (~0x1C370) are factory-DAMOS/XDF addresses that were NOT separately confirmed by the tune comparison.