We've had many people asking why we need to open the ECU's of the later cars brought to us, and what is this "tuning protection" many companies are talking about. Here's a brief explanation of it.

"Tuning Protection" for the Infineon TriCore TC-series processors (Bosch MED17/EDC17)

On the CR TDI and 1.8/2.0 Turbo Petrol engines with the latest Bosch ECU generation (MED17 for the petrols, EDC17 for the diesels, I'll just refer them to MEDC17 from now on...), Bosch has implemented some new security measures to protect against aftermarket reprogramming of the engine control unit calibration data.

Bosch originally started to use various checksums in the late 80's to verify the data integrity of the engine control unit memory content. Originally this was just a simple additive checksum, where you count the sum of all bytes in the file, and store the value in one place.

Later on, it was also used to protect the data from unauthorised modifications (thats us...). For example, ME7.5 ECU (1.8 Turbo) contains about 70 different checksum blocks, and the result values are filtered through various functions to have a secure method of verifying data integrity. At around the same time, Bosch started using access control on the outside ECU reprogramming (that is what we call the OBD flashing nowadays). It's usually a normal challenge-response scheme with a seed-key algorithm.

Of course, the chiptuning industry kept on and solved these functions to have methods of correcting the checksums, and to have OBD programming capability of these ECUs.

About 7-8 years ago, Bosch started using RSA signatures to control the ECU contents. Early on, just a 256bit RSA, then 512bit RSA, and nowadays, on these new ECUs, its a hash from a 1024Bit RSA signature. Something thats virtually un-crackable with traditional brute force methods.

Since these keys are yet to be solved, tuners have had to find other ways of programming the ECUs.

When the MEDC17 ECU family was released, a backdoor was found in the programming algorithm. Originally this hash was checked only after certain conditions were met. If they are not met, it was not checked. So the programming method made sure that was the case every time they programmed the ECU.

This "Tuning Protection", as it is commonly called, just means that this backdoor has been sealed, and the ECU always checks the hash validity after every OBD programming attempt. If this is not valid, it sets a flag in the memory that prevents the car from starting.

Our tools can detect this function just by reading the ECU via OBD. Many others, including some big brand names, have problems with cars not starting after writing.

That is why, for now, on these protected ECU's, we need to open the ECU to use a processor function built in the TC17xx-series processors, which allows us to boot and reset the ECU at any given moment from pins on the motherboard. This way the ECU does not detect it as being an OBD programming attempt, and skips the hash validity check.

At this time, there are no tuning companies who can bypass this security check and if an ECU has "Tuning Protection" then it will need to be programmed by taking the ECU out and opening it. Some call it "bench flash", some say they "install a probe", but this is how it is done by ALL tuners who are offering remaps on "protected" MEDC17 ECUs.

Guys, how do I know if my 1.8tsi uses the new protected ecu? I don't have access to vcds and I'm not exactly round the corner from you but I like everything I hear about Shark remaps?

Out of interest, once you have access to the ecru, is it as tuneable as the previous generation ecu's as fitted to the older mk 2 vrs tfsi?

Thanks in advance.

It's just about impossible to tell if it's protected or not, without trying to read it first.

The ECU is just as tunable as the 2.0TFSI ECU although they work in a totally different way

EDIT: I've tried to drop you a PM but I guess your inbox might be full, could you drop one of us a PM or email at some point as we may have something that'll help

Edited 15 November, 201015 yr by shark_90

It's just about impossible to tell if it's protected or not, without trying to read it first.

The ECU is just as tunable as the 2.0TFSI ECU although they work in a totally different way

Thanks for the prompt response Ben

So the only way to read it is to pay you a visit or get it connected up to vcds? No other way?

Tried to drop you a PM with another option

Tried to drop you a PM with another option

Pm sent. Many Thanks.

Edited 16 November, 201015 yr by FocusZtec

Pm sent. Many Thanks.

Hi Ben, just checking you got the pm as vie cleared down my inbox until I get a chance to renew freedom membership, but not sure if it would have gone to you beforehand. Thanks. :-)

Will check and reply when on a proper PC mate

Will check and reply when on a proper PC mate

No worries Ben, many thanks, just thought it may not have gone and I would be still be running standard power for longer.... not good!

Please also feel free to remove these posts to tidy up the thread and keep it on topic. :yes:

Interesting read, cheers

Steve

Thats a bugger, my car is (theoretically) untunable then! Just wish there was a way to "tweak" mine up.

So far almost everyone has said they won`t do it. Even Superchips said they can`t do it and they didn`t want to use my car as a "prototype"!

Thats a bugger, my car is (theoretically) untunable then! Just wish there was a way to "tweak" mine up.

So far almost everyone has said they won`t do it. Even Superchips said they can`t do it and they didn`t want to use my car as a "prototype"!

I presume you're referring to your Fabia; have faith.

From what I have been told, if it is doable then Shark Performance can do it.

yes I was referring to the Fabia, luckily the Superb has the mappable CR170 engine so has been done already.

Happy for my car to be used as a test subject if thats any help!

yes I was referring to the Fabia, luckily the Superb has the mappable CR170 engine so has been done already.

Happy for my car to be used as a test subject if thats any help!

From conversations I have had with Ben, the 1.2 TSI has a Siemens ECU, which software is not yet available, however it is possible. Correct me if I am wrong here Ben!

I would also like to know when this is available as my Dad has a brand new DSG 1.2 TSI 105 and would like it remapped

At the moment there isn't a way of getting into the ECU to tune it, so at the moment no one can offer software. I'm sure it'll be along shortly though!

I just bought my Superb 1.8tsi and it has the MED17 Tricore. Superchips tried to map it via OBD but could not even read it. Gave REVO a call and they immediately asked me to bring the car over. They successfully installed the MAP within 20 mins VIA OBD and I was good to go...Needless to say the map was amazing with immediate difference in boost and acceleration!! Apparently REVO is the only ompany so far who can bypass the protection on the MED17/EDC17 Tricore. Kudos!!

Edited 3 January, 201115 yr by Nick P
Massive quote removed

Are you sure it was protected?

I just bought my Superb 1.8tsi and it has the MED17 Tricore. Superchips tried to map it via OBD but could not even read it. Gave REVO a call and they immediately asked me to bring the car over. They successfully installed the MAP within 20 mins VIA OBD and I was good to go...Needless to say the map was amazing with immediate difference in boost and acceleration!! Apparently REVO is the only ompany so far who can bypass the protection on the MED17/EDC17 Tricore. Kudos!!

I'm surprised at Superchip's approach as, from my discussions with them (Buckingham HQ) in recent months they are well aware that any new Yeti, Octavia or Superb cannot be mapped via the OBD and needs to have the ECU removed. Were you dealing with a local Superchips 'agent'? Perhaps they were not up to speed with current ECUs.

Finally; are you truly in Mumbai as your signature suggests? I can't find either a Superchips or REVO dealer there!

A dutch tuner has already cracked the Siemens ECU on the 1.2TSI and has been testing for a few weeks now.

Word is the little 105bhp is capable of alot more than 135bhp, they are talking a 50% increase in power..............

Not sure how true this rumour is though, but it was told to me by Taiwans top remapper.

I called BS on the 50% increase in power from such a small turbo, he then showed me the 140bhp 1.4tsi engine, it also has a tiny turbo but remaps to over 200bhp safely.

So fingers crossed!.

I doubt very much whether my 1.4 TSi engine could be remapped to that, the twincharger unit however, yes.

The big question I have is for Ben; has a solution to the additional protection stopping my ecu from being remapped, been found yet?

A dutch tuner has already cracked the Siemens ECU on the 1.2TSI and has been testing for a few weeks now.

Word is the little 105bhp is capable of alot more than 135bhp, they are talking a 50% increase in power..............

Not sure how true this rumour is though, but it was told to me by Taiwans top remapper.

I called BS on the 50% increase in power from such a small turbo, he then showed me the 140bhp 1.4tsi engine, it also has a tiny turbo but remaps to over 200bhp safely.

So fingers crossed!.

The Siemens project is currently in Beta testing and should be released soon, 6-8 weeks maybe. Possibly sooner

I doubt very much whether my 1.4 TSi engine could be remapped to that, the twincharger unit however, yes.

The big question I have is for Ben; has a solution to the additional protection stopping my ecu from being remapped, been found yet?

No not yet unfortunately, you will be the first person I call as soon as it has

hum, I fancy a trip up to you in a few weeks if you can crack it then Ben! More oomph from my Fabia possibly!

hum, I fancy a trip up to you in a few weeks if you can crack it then Ben! More oomph from my Fabia possibly!

1.2TSI development car required, ECU now cracked. PM me for something of a special offer