Blog

Ah, the Germans, bless them. German people are some of my favorite nationalities. I spent some time studying their culture and language in my day and I can safely say that I love most of their culture and the values they represent. I do not believe for a moment that the stereotypes about the German people and culture are true, as fun as those memes can sometimes be. That said, even I must admit that sometimes Germans can be a bit…well, German. A classic case in point is the security of the vehicles they produce. Classic examples in this regard can be seen in Stuttgart, where we find constantly increased difficulty in security measures but today, we need to take a closer look at another manufacturer, the one in Wolfsburg where they have also taken a look at Stuttgart’s play book and said, “We can do that!” And they did.  But that does not mean that the Abrites developers stop working and do not make any progress. The latest victory of our development team concerns the well-known Delphi/ Bosch DCM 6.2. This ECU is very popular in many European cars – it works in Peugeots and Citroens and Fords and what not, but when it comes to Volkswagen AG vehicles it goes to a whole new level.

The DCM 6.2 started replacing the Simos PCR 2.1 in 2010 and is still being used today. We see those ECUs in the classic 1.6 tdi but it has also shown up in many 2.0 tdis as well as some 1.4- and 1.3-liter engines. The processor inside them does not really matter, they have no external EEPROM, but the EEPROM itself is emulated within the program flash of the processor, more specifically in the first 128 bytes of the processor’s pflash. Usually, the dump from the processor is encrypted and cannot be read without opening the ECU. 

Opening the ECU is not a simple task on its own. This makes for a hard time when you try adaptation – the front cover comes off easily but the back one is a real pain which often results in a complete destruction of the PCB. In our case we use the ZN051 Distribution box to read the DCM6.2s without the need to open them, which is safe for you and not damaging to the PCB. To be fair other companies also provide this reading, so this is nothing new, what is indeed new is the ability to obtain the CS data to adapt and program keys when you have no existing keys. In order to adapt a used DCM 6.2 ECU, you will need to read it. What we do is read it and then return it to a normal living state. We need the ECU in a normal state in order to obtain the data from the ECU in order to adapt it. The messages in normal state plus the dump is what we use to calculate the data we all need. You can obtain the Component Security bytes in this manner. This usually requires 3-4 seconds to calculate using the Abrites diagnostics for VAG software. There is one specific thing we need to be mindful of here – the Power Class. If the Power class is unknown, you need to know that the CS calculation time increases by 256x 3-4 seconds so expect a maximum time of around 15 minutes. I know it sounds like a lot, but this approach is certain to work and on top of that our developers have created an incredible self-learning system which improves itself every time you use the calculations. This means we are all collectively helping each other out by working on cars to lower the time expected for the Component Security calculation.  The ability to calculate the CS leads us to the ability to adapt the ECU from one car to another but this is not all.  There is another cool thing we can do here which is that if we know the CS once we can change it to a new one (the one from the recipient vehicle or whatever you want). Knowing the CS opens up the following possibility, when you have power class which does not match between the donor and the recipient, we can go into the diagnostic menu of the Abrites diagnostics for VAG and unlock the ECU using the 16 bytes CS to allow us to reprogram the ECU using the completely free function “SW update”. This reflash allows us to change the flash to the needed one. Use the 16 bytes plus the AUTH button to authenticate and put whatever flash you need with the power class you need.

There is one very important thing I need to mention here – DCM 6.2 is not complicated to connect on bench, we can basically never go wrong – we have positive, negative, CAN H, CAN L and ignition, so there is absolutely nothing to go wrong, right? In theory – yes, but our practice has shown that due to the 14 years of existence of DCM 6.2 we see some modifications in their evolution. The one thing we noticed during our testing is that although the hardware is the same, we have different software versions inside, this is normal but sometimes they decide they need two pins for ignition, rather than just one. This means that we may sometimes not be able to connect. We need to discuss this on a case-by-case basis with our support team. Once we get them all we will no longer have this problem but for now we need your assistance to update.

This is not at all everything though. When we combine the ability to read the Component Security Bytes, we can combine this ability with the well known ZN085 V850/ RH850 reading and writing programmer and perform lost. In MQB cars you normally need the CS from the ECU, dashboard (which is referred to as IMMO), the transmission and/ or DSG module.  At the current point in time, we are still facing difficulties reading the CS from the ELV/ ESL modules but we managed to break through once again – we will be able to calculate the ESL/ELV CS data for you if we have the ECU and transmission component security bytes. If the car is manual and has ELV/ ESL then I am sorry to say that we will not be able to assist for the moment but believe me, our developers have ideas there too.

Whenever we speak about All Keys Lost situations, we need to discuss transmissions. If it is manual there is no adaptation, so we do not worry about it, today we are focusing on automatic and DSG transmissions because they all have adaptation bytes. Remember – component security is for the IMMO modules and component protection is more for the comfort related modules. This is now changing under MQB where there is cross usage of CS and CP in the immobilizer related modules. The transmission control units we work with most commonly in modern VW, Audi, Seat, Skoda, Cupra and the others are the DSG and the ZF 8HP where I must remind you that of the DL501, AL551 up to 2018 MLB is not covered. We also support reading from the DQ250, DQ381 and DQ500 types up to around 2021. The best part of our work is that we have devised a cable which allows us to read the transmission in site without needing to dismantle the mechatronic itself because we all know how hard that is. Quick mention of some of the key differences here is related to the processors the transmissions use:

-    DQ381 and DQ500 all use the Renesas Super H processor
-    DQ250 and DL501 both use the Infineon Tricore processor
This is just for your information.

I think this is pretty much it, I just wanted to add that the DCM6.2 will require you to use the VN002 license and a valid AMS. The calculations require online connection via the Abrites diagnostics for VAG (the older looking software after version 34.7). Dashboard reading will need the ZN085 and the VN021, whereas transmissions are dealt with under the VN002 license.

So with that being said I am happy we got the chance to discuss the new horizons we are opening for under VAG and the details about the DCM 6.2 and the automatic and automated transmissions.

Until next week – try to have fun at work.
Alek