ME7.1.1 RS4 2.7T

Bosch Motronic ME7.1 (torque-structured petrol) — Audi RS4 B5 2.7T biturbo, 380 PS (ASJ/AZR, Cosworth-assembled). Same 8D0907551-family hardware as the S4 B5 2.7T ME7.1 (Infineon C167CR + 1 MB 29F800), carrying the RS4-specific K04 twin-turbo calibration. CORRECTION to the draft's 'ME7.1.1': the B5 8D boxes are plain ME7.1 (checksum-only). 'ME7.1.1' is properly used for some LATER 2.7T boxes (e.g.

Reference - updated 4 August 2026

The ECU hardware

Infineon/Siemens SAK-C167CR MCU (16-bit C166 core, little-endian; BSL ident byte 0xC5, confirmed on the 8D bench box). External flash = AMD/Fujitsu Am29F800BB (bottom-boot, 8 Mbit = 1 MB, 5V, byte/x8 mode), mapped at CPU 0x800000–0x8FFFFF so file offset 0 = 0x800000; the CPU reset/boot vector is at file offset 0 (FA 00 CC 76 = JMPS), NOT at the top. Immobilizer secret sits in a SEPARATE serial EEPROM (ST 95040 SPI, 512 B; some boxes 95080), driven off SPI chip-select P6.3 (verify per box) — it is NOT in the 29F800. OEM HW part numbers 8D0907551x (RS4 in the ...551K/M class) with Bosch device numbers in the 0261207xxx family. NOT RSA-signed on this 8D generation (fully ME7Sum-correctable, same as the confirmed 8D0907551M S4 box) — the draft's 'some later/aftermarket boxes carry RSA' applies to later ME7.1.1 variants (4Z/4B), not the B5 RS4. Single-CPU (single C167CR confirmed on the 8D box; verify if a rare dual-CPU 2.7T board is encountered).

Fuelling and load sensing

Petrol; 95 RON minimum, a Stage tune assumes 98/100 RON. Return-style fuel system (~4 bar rail, in-tank + inline pump), stock injectors ~349 cc @4 bar ×6 (KRKTE 0.0977). Fueling is governed by lambda (LAMFA WOT map + closed-loop trims + component-protection enrichment), not a diesel rail/smoke system. IMPORTANT: the stock 2.7T does NOT enrich via LAMFA (stock LAMFA reads all 1.00) — closed-loop lambda plus component protection handle WOT enrichment. A boost tune MAY lower high-load LAMFA toward ~0.85, but a field-proven Stage 1 (GIAC-class) leaves LAMFA stock; editing it wrong (u8-vs-u16 geometry) corrupts the bin.

How this ECU is read and flashed

Two paths. (A) OBD / K-line KWP2000 (ISO 14230): the Nefmoto flasher / Galletto / MPPS talk to the ME7 flash bootloader in a programming session (0x85) with seed/key unlock (0x27) to read/write the full 1 MB. Caveats: some boxes are app-locked, and a failed/interrupted OBD write can brick (needs bench recovery). The B5 RS4 8D0907551 boxes are NOT RSA, so a checksum-corrected modified full-flash CAN be OBD-written; only some later ME7.1.1 (C5 A6 4Z/4B) add an RSA signature that rejects a modified OBD write. (B) BOOT MODE / bench (recommended for RS4, field-confirmed reliable end-to-end): remove the ECU, ground flash pin 24 (= DQ4 = C167 P0L.4) LOW at power-on to force the C167 mask-ROM bootstrap loader (BSL), then read/write the full flash over the K-line BSL — raw autobaud: send 0x00 → CPU ident 0xC5 (C167CR) → upload the 32-byte primary loader (ack 0x01) + ~394-byte monitor (ack 0x03) → block read/write (fast path 38400 baud ≈ 1 MB in ~5 min, byte-perfect; 10400 is the slow fallback). RELEASE pin 24 ~2–3 s after power-on and BEFORE any read/write — leaving it grounded holds an address line low → corrupt read / failed write. Boot mode is immo-immune and bypasses the app-level lock AND the flash-time RSA gate; this is exactly how MPPS/Galletto/Combiloader/KESS/KTAG bench-flash these ECUs. The C167 BSL lives in CPU mask ROM (not in flash). Immobilizer lives in the separate 95040 EEPROM (SPI CS P6.3), untouched by flash R/W; After ANY edit: checksum-correct with ME7Sum (all four layers) and verify with me7check, or the ECU faults / won't run; clear P0601 over OBD after a boot flash. Always keep a verified stock backup + bench recovery harness before any write.

Engine codes in this family

• ASJ
• AZR

Staging - what each stage really gives

• stage1 - Software only, stock K04 turbos + stock hardware, healthy diverter/bypass valves, 98/100 RON. Field-proven approach (GIAC-class): raise the LDRXN boost ceiling + KFMIRL target load + KFMIOP torque model in LOCKSTEP, and open/retune the wastegate-duty limiter for stable boost. LAMFA and KFZW can be LEFT STOCK — stock closed-loop fueling and knock control handle them (GIAC does not touch them); optional safe-direction LAMFA richening only. Raise the TORQUE MODEL, not just boost, or torque intervention caps power (~80 % load). Typical ~380 → ~410–450 PS with a large mid-range torque gain, peak boost ~1.1–1.2 bar (~16–18 psi).
• stage2 - Bolt-ons: downpipes / high-flow or de-cat, upgraded intercoolers (the RS4 side-mounts heat-soak), larger intake + larger MAF housing, uprated diverter valves, high-flow exhaust. Rescale MLHFM for the new MAF (or airflow reads clip → leanout/limp), add boost, re-linearize WGDC. Typical ~450–490 PS. Cooling, fuel-supply headroom and MAF range become the limits — watch EGT, IAT, injector duty and fuel trims.
• stage3 - Turbos / injectors / clutch: hybrid or bigger-frame K04 or larger turbos, larger injectors (rescale KRKTE + dead-time) + uprated fuel pump/rail, uprated clutch/driveline, often intake/exhaust manifolds, and possibly a MAF-less / alpha-N strategy (KFMSNWDK, not WDKUGDN) or standalone for very large frames. Full boost/timing/fuel remap against VALUE-MATCHED references. Typical ~500–620+ PS depending on turbos and fueling; needs E85/race fuel and forged internals at the top end.

Safety limits

• Lambda under full load: target ~0.82–0.86 (AFR ~12.0–12.6:1); never leaner than ~0.90 at high load/boost — lean = knock + melted pistons. Stock 2.7T closed-loop already targets a safe WOT lambda; if you edit LAMFA, only ever RICHEN, and value-match the geometry first (a u8/u16 error writes garbage over fuel/axis bytes).
• Knock: no sustained knock retard beyond ~3° and zero audible detonation. Log per-cylinder knock retard (KR/dwkrz); if the ECU is pulling timing, back off boost/advance — do NOT out-fuel persistent knock. Leave KFZW stock unless value-matched.
• Boost on stock K04: sensible ceiling ~1.1–1.2 bar (~16–18 psi); past ~20–22 psi the compressors run out of efficiency (heat + surge) with little gain.
• Overboost / boost spike: retune the WGDC linearization + I-limiter so boost does not overshoot LDRXN — a spike trips the ECU overboost fuel-cut and stresses hardware. N75 is a binary solenoid; do not add a manual/electronic boost controller.
• Torque-model LOCKSTEP (functional safety, not a nuisance): any load/boost increase must keep KFMIRL↔KFMIOP consistent (and Level-2 monitor ceilings raised where applicable) or the ECU cuts fuel/boost via torque intervention — the #1 reason a correct-checksum tune 'won't make power'.
• Fuel supply / rail pressure: keep injector duty below ~85–90 % AND ensure the pump maintains rail pressure at peak flow (watch fuel trims / rail pressure). Stage 2+ needs an uprated pump; Stage 3 needs larger injectors + pump/rail (rescale KRKTE + dead-time). Running out of fuel = leanout at max load.
• MAF sensor saturation: the stock HFM-5 housing/sensor clips at high airflow (voltage ceiling) → airflow reads flat → leanout/limp. Upsize the MAF housing and rescale MLHFM at Stage 2/3.
• Intake air temp / heat soak: RS4 side-mount intercoolers heat-soak → IAT-driven timing pull, knock and power loss. Upgrade intercoolers for sustained boost and monitor IAT.
• Coolant / oil temperature: the 2.7T runs hot — keep oil and coolant in range (especially on track); heat drives knock and EGT up.
• Driveline / clutch: the stock RS4 clutch is the weak link around ~450–500 Nm at the crank — Stage 2+ torque needs an uprated clutch or you will slip/destroy it.
• Engine internals: the ASJ/AZR bottom end is generally safe to ~500–550 PS WITH correct fueling, EGT and knock control; above that plan on forged pistons/rods.
• Checksum & DTC: never flash a bin that fails me7check — it must pass ALL FOUR layers (main sum+~sum, multipoint table, ROMSYS, data-area CRC-32); a bad checksum no-starts or runs corrupt maps and sets P0601. A boot-mode flash does not clear stored codes — clear DTCs over OBD afterward. If a box is RSA-signed, do NOT OBD-write a modified bin (rejected / brick risk) — use boot mode.
• Always keep a verified stock backup and a bench recovery method (boot-mode harness) before ANY write — a failed/interrupted OBD write can brick the ECU.
• N/A for this platform: no DPF and no diesel rail/smoke limiter (petrol) — the equivalent functional limiter is the Level-2 torque monitor above.

Every car using this platform (3)

Stock power and typical remap figures per car. Stage results assume a healthy engine on good fuel.

How confident is this?

SOLID: overall ME7.1 architecture (1 MB Am29F800BB full-flash, Infineon C167CR little-endian, separate 95040 immo EEPROM on SPI CS P6.3, reset/boot vector at file offset 0); the FOUR-layer checksum (main sum+~sum, multipoint table, ROMSYS, MANDATORY data-area CRC-32 poly 0xEDB88320) — validated independently against nyetwurk ME7Check.exe on real built tunes — and the ME7Sum→me7check re-correction workflow; boot mode via pin-24→P0L.4 (BSL ident 0xC5, 38400 fast path), run end-to-end on the bench; and the identity / role / addresses of the key maps on the 8D0907551M (KFMIRL 0x14BEE, KFMIOP 0x16186, real load-ceiling LDRXN 0x1DCF4, wastegate-duty limiter 0x19BED, KRKTE 0x1C2BC, MLHFM 0x14254, KFZW 0x11C72), corroborated by the factory Bosch DAMOS, s4wiki, ME7Tuner and a real GIAC Stage3- diff (KFMIRL + KFMIOP + duty ONLY). The KFMIRL↔KFMIOP torque lockstep and the boost formula (mbar_abs = 10·LDRXN + 300) are verified. MODERATE/THIN: RSA is box-specific — the B5 RS4 8D boxes are NOT RSA (same generation as the confirmed 8D S4 box), but some later ME7.1.1 (4Z/4B) ARE RSA-signed and cannot be re-signed (boot mode only) — verify per box. The multipoint ACTIVE-entry count varies (table ho