ECU unlock fails on MD1CS003 (BlueHDi 1.5 EAT8) with key 1948 → 7F2735; ESPMK100_UDS write fails with key 7884 → 7F2E31

[antoniomaaarin]

Hi! First of all, thanks for PyPSADiag.

I’m trying to perform configuration writes on two ECUs on my vehicle but I’m getting two different failures:

1. Engine ECU (MD1CS003): ECU unlock fails with an invalid key (NRC 7F 27 35).
2. ESPMK100_UDS: write configuration zone fails with 7F 2E 31.

I’m not sure if this is expected behavior for these ECUs/vehicle configuration, if the seed-key algorithm is unsupported, or if I’m using the wrong procedure/session/security level.

---

Vehicle / ECU info

• Vehicle: Peugeot 2008 (2021)
• Engine: 1.5 Diesel BlueHDi 130 cv
• Transmission: Automatic (EAT8)
• Current feature state: ACC30 enabled; attempting to code ACC Stop & Go

ECUs involved:

• MD1CS003 (Engine ECU)
• ESPMK100_UDS (ESP module)

---

What I tried

1) MD1CS003 (Engine ECU) – Unlock

I tried to unlock using key 1948. Result:

2026-01-28 18:31:43.119264 –|  ECU Unlock Failed (27): Invalid Key (7F2735)

My interpretation:

• Service 0x27 (SecurityAccess) → NRC 0x35 (InvalidKey)

2) ESPMK100_UDS – Write configuration zone

I tried to write/codify using key 7884. Result:

2026-01-28 18:25:42.526569 –|  Write Configuration Zone: Failed (7F2E31)

My interpretation:

• Service 0x2E (WriteDataByIdentifier / write zone) → NRC 0x31 (RequestOutOfRange)

This is a different error from the engine ECU one, which makes me think the unlock may not be the blocker here, but the write is rejected due to range/permissions/session/conditions/DID mapping.

---

Steps to reproduce

1. Connect to the vehicle and select the ECU:
   • MD1CS003 (engine) or ESPMK100_UDS (ESP)
2. Start the diagnostic session as required by PyPSADiag workflow
3. Attempt ECU unlock:
   • MD1CS003 key: 1948
   • ESPMK100_UDS key: 7884
4. Attempt write:
   • For ESPMK100_UDS: attempt to code ACC Stop & Go (vehicle currently ACC30)

---

Expected behavior

• Successful unlock (or a clear message if this ECU variant/seed-key algorithm is unsupported).
• For ESP ECU: successful write, or clearer indication of what prerequisite is missing (required session, security level, unsupported DID/zone, conditions not correct, etc.).

---

Actual behavior

• MD1CS003: unlock fails with 7F2735 (Invalid Key)
• ESPMK100_UDS: write fails with 7F2E31 (Request Out Of Range)

---

Logs / attachments

MD1CS003 (Engine ECU) – full log

Click to expand

2026-01-28 18:31:39.422658 --|  > >6A8:688
2026-01-28 18:31:39.544772 --|  < OK
2026-01-28 18:31:40.054650 --|  > KU
2026-01-28 18:31:40.162206 --|  < OK
2026-01-28 18:31:40.167645 --|  > 1003
2026-01-28 18:31:40.171711 --|  < 7F3E03  ** Skipping/Stripping **
2026-01-28 18:31:40.376714 --|  < 500300C80014
2026-01-28 18:31:40.883287 --|  > 2703
2026-01-28 18:31:40.989291 --|  < 6703168BC5E2
2026-01-28 18:31:41.002566 --|  Waiting 2 Sec...
2026-01-28 18:31:43.006323 --|  > 27042F1F15D7
2026-01-28 18:31:43.112602 --|  < 7F2735
2026-01-28 18:31:43.119264 --|  ECU Unlock Failed (27): Invalid Key (7F2735)
2026-01-28 18:31:43.123300 --|  > S
2026-01-28 18:31:43.228053 --|  < OK
2026-01-28 18:31:43.234219 --|  > 1001
2026-01-28 18:31:43.339584 --|  < 500100C80014

ESPMK100_UDS – full log

Click to expand

2026-01-28 18:24:30.151913 --|  Reading ECU Zones: Successful
2026-01-28 18:25:37.888439 --|  > >6AD:68D
2026-01-28 18:25:38.012512 --|  < OK
2026-01-28 18:25:38.530513 --|  > KU
2026-01-28 18:25:38.635630 --|  < OK
2026-01-28 18:25:38.640449 --|  > 1003
2026-01-28 18:25:38.643511 --|  < 7F3E03  ** Skipping/Stripping **
2026-01-28 18:25:38.848269 --|  < 500300C80014
2026-01-28 18:25:39.354425 --|  > 2703
2026-01-28 18:25:39.460887 --|  < 670346B9DF00
2026-01-28 18:25:39.472522 --|  Waiting 2 Sec...
2026-01-28 18:25:41.476797 --|  > 27047BEF3BFF
2026-01-28 18:25:41.583744 --|  < 6704
2026-01-28 18:25:41.588422 --|  > S
2026-01-28 18:25:41.692738 --|  < OK
2026-01-28 18:25:42.098547 --|  > 222101
2026-01-28 18:25:42.206362 --|  < 62210105FEFFFFFF7FFFFFFFDFFFFFFFFFFEF7FFFEFFFBDFDA7EFF
2026-01-28 18:25:42.413138 --|  > 2E210105FEFFFFFF7FFFFFFFDFFFFFFFFFFEF7FFFEFFFDDFDA7EFF
2026-01-28 18:25:42.520351 --|  < 7F2E31
2026-01-28 18:25:42.526569 --|  Write Configuration Zone: Failed (7F2E31)
2026-01-28 18:25:42.731849 --|  > 222101
2026-01-28 18:25:42.841144 --|  < 62210105FEFFFFFF7FFFFFFFDFFFFFFFFFFEF7FFFEFFFBDFDA7EFF
2026-01-28 18:25:42.846992 --|  > 222901
2026-01-28 18:25:42.953078 --|  < 7F2231
2026-01-28 18:25:42.959771 --|  > 2E2901FD000000010101
2026-01-28 18:25:43.065272 --|  < 7F2E31
2026-01-28 18:25:43.071340 --|  Configuration Write of Secure Traceability Zone: Failed (7F2E31)
2026-01-28 18:25:43.075882 --|  > S
2026-01-28 18:25:43.180750 --|  < OK
2026-01-28 18:25:43.185895 --|  > 1001
2026-01-28 18:25:43.291544 --|  < 500100C80014
2026-01-28 18:25:43.296983 --|  Write Successful

[Omelnyk55]

Most likely your ESP100 simply does not support the ACC Stop&Go. I presume that your pump is "IPB Base" variant, yes? Most likely it's 9842946180. In other words, the pump blocker here is not the key, but the part itself. At the moment nothing could be done with that, except changing the pump to "IPB High" variant, or, theoretically, flashing the firmware from such pump into yours. But I am 99% sure that this will do nothing more than simply bricking it, or, if done via Diagbox online - will simply not allow you to do this at all.

[16D]

Show zi and za zones, I will check what key it operates

[antoniomaaarin]

Most likely your ESP100 simply does not support the ACC Stop&Go. I presume that your pump is "IPB Base" variant, yes? Most likely it's 9842946180. In other words, the pump blocker here is not the key, but the part itself. At the moment nothing could be done with that, except changing the pump to "IPB High" variant, or, theoretically, flashing the firmware from such pump into yours. But I am 99% sure that this will do nothing more than simply bricking it, or, if done via Diagbox online - will simply not allow you to do this at all.

We noticed together with another guy that the coding on this control unit is negligible because the stop & go works just the same

[16D]

If it's MD1CS003 E6.3 or E6.4 key will be 4454

[Barracuda09]

Regarding the log, which version of PyPSADiag is this?

[Omelnyk55]

Most likely your ESP100 simply does not support the ACC Stop&Go. I presume that your pump is "IPB Base" variant, yes? Most likely it's 9842946180. In other words, the pump blocker here is not the key, but the part itself. At the moment nothing could be done with that, except changing the pump to "IPB High" variant, or, theoretically, flashing the firmware from such pump into yours. But I am 99% sure that this will do nothing more than simply bricking it, or, if done via Diagbox online - will simply not allow you to do this at all.

We noticed together with another guy that the coding on this control unit is negligible because the stop & go works just the same

Please clarify what did you mean. If stop&go works just fine for you without coding, why are you trying to code the pump?)))

[antoniomaaarin]

Most likely your ESP100 simply does not support the ACC Stop&Go. I presume that your pump is "IPB Base" variant, yes? Most likely it's 9842946180. In other words, the pump blocker here is not the key, but the part itself. At the moment nothing could be done with that, except changing the pump to "IPB High" variant, or, theoretically, flashing the firmware from such pump into yours. But I am 99% sure that this will do nothing more than simply bricking it, or, if done via Diagbox online - will simply not allow you to do this at all.

We noticed together with another guy that the coding on this control unit is negligible because the stop & go works just the same

Please clarify what did you mean. If stop&go works just fine for you without coding, why are you trying to code the pump?)))

encoding bsi, cmm and av4 with acc stop and go works the same, to complete the coding I had to write on esp100 but it didn't work and I tried anyway and it works

[Omelnyk55]

to complete the coding I had to write on esp100 but it didn't work and I tried anyway and it works

This makes no sense to me. "To make acc stop&go work, you need to code esp100, which didn't work". But then you tried and it works - what works? Coding works? But you say it's not working. ACC stop&go works without coding? I find it rather hard to believe. Anyway, if ACC stop&go works for you without coded esp100 - that's nice to hear.

[antoniomaaarin]

This makes no sense to me. "To make acc stop&go work, you need to code esp100, which didn't work". But then you tried and it works - what works? Coding works? But you say it's not working. ACC stop&go works without coding? I find it rather hard to believe. Anyway, if ACC stop&go works for you without coded esp100 - that's nice to hear.

Yeah, sorry — maybe I explained myself poorly. The coding for the adaptive cruise control Stop & Go works even without coding ESP100; you just need to set it to ‘ACC30’ and code the remaining ECUs as adaptive cruise control.

We tested the following configuration:
• BSI: Type of mode of ACC = Stop and Go (BVA)
• CMM: Presence ACC Stop and Go = With ACC Stop & Go; RVV = Without Cruise Control / With Adaptive Cruise Control
• AV4: Type of speed regulator = ACC Stop & Go

[Omelnyk55]

This makes no sense to me. "To make acc stop&go work, you need to code esp100, which didn't work". But then you tried and it works - what works? Coding works? But you say it's not working. ACC stop&go works without coding? I find it rather hard to believe. Anyway, if ACC stop&go works for you without coded esp100 - that's nice to hear.

Yeah, sorry — maybe I explained myself poorly. The coding for the adaptive cruise control Stop & Go works even without coding ESP100; you just need to set it to ‘ACC30’ and code the remaining ECUs as adaptive cruise control.

We tested the following configuration: • BSI: Type of mode of ACC = Stop and Go (BVA) • CMM: Presence ACC Stop and Go = With ACC Stop & Go; RVV = Without Cruise Control / With Adaptive Cruise Control • AV4: Type of speed regulator = ACC Stop & Go

And the car actually decelerates to a halt and then starts on its own with these settings?

[Barracuda09]

What about this #110 (comment)

2026-01-30 08:15:44.187684 --|  > >6AD:68D
2026-01-30 08:15:44.206550 --|  < OK
2026-01-30 08:15:44.711606 --|  > KU
2026-01-30 08:15:44.715675 --|  < OK
2026-01-30 08:15:44.717288 --|  > 1003
2026-01-30 08:15:44.721256 --|  < 500300C80014
2026-01-30 08:15:45.222700 --|  > 2703
2026-01-30 08:15:45.230752 --|  < 67036B0A71E0
2026-01-30 08:15:45.232239 --|  Waiting 2 Sec...
2026-01-30 08:15:47.234002 --|  > 2704737476EE
2026-01-30 08:15:47.243531 --|  < 6704
2026-01-30 08:15:47.249818 --|  > S
2026-01-30 08:15:47.260479 --|  < OK
2026-01-30 08:15:47.666982 --|  > 222101
2026-01-30 08:15:47.676523 --|  < 62210106F7FFFFFFFFFFFEFFFFFFFFFFFBFFFFFFF7FF7FFFFBFFFFF7FA7EFF
2026-01-30 08:15:47.878512 --|  > 2E210106FFFFFFF7FFFFFEFFFFFFFFFFFBFFFFFFF7FF7FFFFBFFFFF7FA7EFF
2026-01-30 08:15:47.892353 --|  < 7F2E31
2026-01-30 08:15:47.897949 --|  Write Configuration Zone: Failed (31) Request Out Of Range (7F2E31)  <-- ** Different **
2026-01-30 08:15:48.100238 --|  > 222101
2026-01-30 08:15:48.108122 --|  < 62210106FFFFFFF7FFFFFEFFFFFFFFFFFBFFFFFFF7FF7FFFFBFFFFF7FA7EFF
2026-01-30 08:15:48.114961 --|  > 222901
2026-01-30 08:15:48.125392 --|  < 622901FD000000010101
2026-01-30 08:15:48.131050 --|  > 2E2901FD000000010101
2026-01-30 08:15:48.142520 --|  < 6E2901
2026-01-30 08:15:48.148357 --|  > S
2026-01-30 08:15:48.153898 --|  < OK
2026-01-30 08:15:48.156413 --|  > 1001
2026-01-30 08:15:48.163311 --|  < 500100C80014
2026-01-30 08:15:48.165280 --|  Write Successful

[antoniomaaarin]

This makes no sense to me. "To make acc stop&go work, you need to code esp100, which didn't work". But then you tried and it works - what works? Coding works? But you say it's not working. ACC stop&go works without coding? I find it rather hard to believe. Anyway, if ACC stop&go works for you without coded esp100 - that's nice to hear.

Yeah, sorry — maybe I explained myself poorly. The coding for the adaptive cruise control Stop & Go works even without coding ESP100; you just need to set it to ‘ACC30’ and code the remaining ECUs as adaptive cruise control.

We tested the following configuration: • BSI: Type of mode of ACC = Stop and Go (BVA) • CMM: Presence ACC Stop and Go = With ACC Stop & Go; RVV = Without Cruise Control / With Adaptive Cruise Control • AV4: Type of speed regulator = ACC Stop & Go

And the car actually decelerates to a halt and then starts on its own with these settings?

I correct what I said, the stop and go does not work because it does not keep the car braked, but unlike the ACC30 it can now be activated at any speed and the car can easily keep the ACC in traffic without deactivating, it deactivates once the car comes to a complete stop.

It's not stop and go but a great middle ground

[JonnyMnemonicUA]

I correct what I said, the stop and go does not work because it does not keep the car braked, but unlike the ACC30 it can now be activated at any speed and the car can easily keep the ACC in traffic without deactivating, it deactivates once the car comes to a complete stop.

It's not stop and go but a great middle ground

Not so fast. I tested all combinations on my 2008 allure with IPB Base (has only ACC30) and only camera - if you set up stop and go in all blocks except esp - it works, but you got permanent erros in gearbox and esp reading with diagbox - sofware not supported. So i ended up with ACC Full stop, because its more smoothly braking than acc30. Also all combinations brakes till 5 km/h then turn off and start after 30 km/h. But if you change esp to proper one with support stop and go or full stop it will work as it should with only camera or camera + radar.

[antoniomaaarin]

What errors do you have in diagbox?

[JonnyMnemonicUA]

What errors do you have in diagbox?

software compatibility error with ESP in Engine ECU and Transmission ECU you can check with diagbox if you have it, because on dashboard no errors and all works. And did you activate stop and go in transmission? because adaptive cruise control (acc full stop or stop and go) need to be activated in trasmission (8EAT) too