ECU read methods explained: OBD, bench and boot mode

Before an ECU's software can be compared, studied or restored, it has to be read. There are three common ways to do that — through the vehicle's diagnostic socket, on the bench, and in the processor's boot mode — plus a few older, chip-level methods. Each one reaches different parts of the ECU's memory, which is why reads of the same unit can look different.

This guide explains the methods so you know what your own read contains and how it relates to an original you buy. OriginalECU sells original files and map packs; the reading and writing itself is done with your own tools, following their instructions.

OBD: through the diagnostic socket

An OBD read uses the same connection a diagnostic tester uses — the 16-pin socket in the cabin — and talks to the ECU over its diagnostic protocols (UDS or KWP2000, over CAN or the older K-line). The tool authenticates itself with the ECU and then uses the programming services the vehicle manufacturer built in for software updates, or procedures the tool maker has developed for that ECU.

• Advantages: the ECU stays in the car, nothing is opened, and it is quick.
• Limits: many ECUs only allow parts of the memory to be read this way — often just the calibration area — and some do not allow reading over OBD at all. EEPROM data is usually not included. Support depends on the exact ECU variant and software version.

A calibration-only OBD read is perfectly usable for comparing calibrations, but it is not a complete picture of the ECU's memory.

Bench: on the desk, through the connector

For a bench read the ECU is removed from the vehicle and connected to the tool through its own connector, with a harness or adapter that supplies power and the communication lines. Some bench procedures still use diagnostic protocols; others put the ECU into a service or programming mode through particular pins.

• Advantages: usually a full read of the flash and, on many ECUs, the EEPROM or data flash as well. It also works on ECUs that are locked over OBD.
• Limits: the ECU has to be removed, which is easy in some vehicles and awkward in others; the pin-out has to be right; and the unit needs a clean, stable power supply.

Boot mode: at the processor

Most ECU microcontrollers have a boot (bootstrap) mode intended for production and development: when started in it, the processor accepts a small program over a serial connection instead of running the software in its flash. Reading tools use this to load their own routine and read the memory directly — independent of the installed software and its protections. Infineon TriCore processors, used in Bosch EDC17 and MED17 units, are a well-known example.

• Advantages: the most complete read — program flash and data flash — on ECUs where other methods cannot reach everything.
• Limits: the housing has to be opened and probes or wires placed on the circuit board, which takes skill and care (static discharge, correct points, sealed housings). Done badly, the unit can be damaged.

Older and chip-level methods

Older ECUs often keep their program in separate flash chips and their settings in a small external EEPROM. These can be read with a programmer connected directly to the chip, either soldered out or with a clip. Processors with debug interfaces — BDM on Motorola/Freescale PowerPC units such as Bosch EDC16 and MED9, or JTAG on others — can also be read through those interfaces on the board.

The methods side by side

The table shows the typical case. What a given tool reads on a given ECU depends on that tool's support for that exact variant — check its compatibility list.

Why the method matters for files

Because each method reaches different memory, reads of one ECU can differ in size and layout: a short calibration file from OBD, a full image from the bench, a full image plus data flash from boot mode, or the tool's own container format. The software version is the same in all of them, which is why you compare files by their identification numbers and not by size. The details are in why ECU file sizes differ.

The same applies the other way round when you write. A tool that writes over OBD usually writes only the areas the manufacturer's update process writes; a full image read on the bench may need to be written on the bench or in boot mode. Some tools only write files that come from their own read session. Know what your tool expects before you choose a file.

Good practice whatever the method

• Save every file the tool produces, and keep the first read of the unit somewhere safe.
• Use a stable power supply. Voltage drops during reading are an inconvenience; during writing they are a real risk.
• Follow the tool's connection diagram for that exact ECU variant.
• Compare your read with the original before you write anything — see how to check you have the right original.

Looking for the stock software of your ECU? Search by HW or SW number with the search box at the top of the page, or browse by vehicle make or ECU type.