Abrites Diagnostics

for VAG

The Abrites software and hardware products are developed, designed and manufactured by Abrites Ltd. During the production process we comply to all safety and quality regulations and standards, aiming at highest production quality. The Abrites hardware and software products are designed to build a coherent ecosystem, which effectively solves a wide range of vehicle-related tasks, such as:

• Diagnostic scanning;

• Key programming;
• Module replacement,
• ECU programming;
• Configuration and coding.

All software and hardware products by Abrites Ltd. are copyrighted. Permission is granted to copy Abrites software files for your own back-up purposes only. Should you wish to copy this manual or parts of it, you are granted permission only in case it is used with Abrites products, has “Abrites Ltd.” written on all copies, and is used for actions that comply to respective local law and regulations.

You, as a purchaser of Abrites hardware products, are entitled of a two-year warranty. If the hardware product you have purchased has been properly connected, and used according to its respective instructions, it should function correctly. In case the product does not function as expected, you are able to claim warranty within the stated terms. Abrites Ltd. is entitled to require evidence of the defect or malfunction, upon which the decision to repair or substitute the product shall be made.

There are certain conditions, upon which the warranty cannot be applied. The warranty shall not apply to damages and defects caused by natural disaster, misuse, improper use, unusual use, negligence, failure to observe the instructions for use issued by Abrites, modifications of the device, repair works performed by unauthorized persons. For example, when the damage of the hardware has occurred due to incompatible electricity supply, mechanical or water damage, as well as fire, flood or thunder storm, the warranty does not apply.

Each warranty claim is inspected individually by our team and the decision is based upon thorough case consideration.

Read the full hardware warranty terms on our website.

The Abrites products are to be used by trained and experienced users in diagnostics and reprogramming of vehicles and equipment. The user is assumed to have a good understanding of vehicle electronic systems, as well as potential hazards while working around vehicles. There are numerous safety situations that cannot be foreseen, thus we recommend that the user read and follow all safety messages in the available manual, on all equipment they use, including vehicle manuals, as well as internal shop documents and operating procedures.

Some important points:

Block all wheels of the vehicle when testing. Be cautious when working around electricity.

• Do not ignore the risk of shock from vehicle and building-level voltages.
• Do not smoke, or allow sparks/flame near any part of the vehicle fuel system or batteries.
• Always work in an adequately ventilated area, vehicle exhaust fumes should be directed towards the exit of the shop.
• Do not use this product where fuel, fuel vapours, or other combustibles could ignite.

In case any technical difficulties occur, please contact the

Abrites Support Team by email at support@abrites.com.

Copyright:

• All material herein is Copyrighted ©2005-2021 Abrites, Ltd.

• Abrites software, hardware, and firmware are also copyrighted
• Users are given permission to copy any part of this manual provided that the copy is used with Abrites products and the “Copyright © Abrites, Ltd.” statement remains on all copies
• “Abrites” as used in this manual synonymous with “Abrites, Ltd.” And all it’s affiliates
• The “Abrites” logo is a registered trademark of Abrites, Ltd.

Notices:

• The information contained in this document is subject to change without prior notice. Abrites shall not be held liable for technical/editorial errors, or omissions herein.
• Warranties for Abrites products and services are set forth in the express written warranty statements accompanying the product. Nothing herein should be construed as constituting any additional warranty.
• Abrites assumes no responsibility for any damage resulting from the use, misuse, or negligent use of the hardware or any software application.

1. Introduction

1.1 Installing the “Abrites Diagnostics for VAG”

2. Using the Abrites diagnostics for VAG

2.1 Configuration

2.1.1 Used protocols

2.1.2 Interface detection.

2.1.3 K-LINE baud rate settings

2.1.4 Timing parameters

2.1.5 K-LINE PINs

2.1.6 CAN resistance

2.2 Scanning units

2.3 Broadcast requests

2.4 Standard diagnostic requests

2.4.1 Identification

2.4.2 Read diagnostic trouble codes

2.4.3 Clear diagnostic trouble codes

2.4.4 Live data

2.4.5 Security access

2.4.5.1 Standard security access

2.4.5.2 User defined security access

2.4.6 Adaptition

2.4.7 Coding of the unit

2.4.8 Custom requests

2.4.9 Custom download / upload

2.4.10 Active diagnostic session

2.4.11 Flasher (SW Update)

2.5 Special functions

2.5.1 Special functions with “CAN Instrument ”

2.5.1.1 Special functions with instrument cluster CAN over TP2.0

2.5.1.2 Special functions with “VDO NEC”

2.5.1.3 Special functions with “Magneti Marelli” UDS 9S12

2.5.1.4 Special Functions “JCI with NEC μC and 95320 EEPROM”

2.5.1.5 Special functions with “A8 (4H) / A7 (4G) / A6 (4G) / Touareg (7P) UDS dashboard with 95320 EEPROM”

2.5.1.6 Special Functions with VDO based on MQB Platform 2014+

2.5.1.7 Added MQB cars key programming - adding spare key

2.5.2 Special functions with “EZS Kessy CAN”

2.5.2.1 Learning keys with EZS-Kessy

2.5.2.2 Reading and changing VIN

2.5.2.3 Reading / Writing EEPROM

2.5.2.4 Programming a blank key so that it becomes a dealer key

2.5.3 Special functions with “BCM2 A4/A5/Q5/A6/A7/A8”

2.5.3.1 Read BCM2 by OBDII

2.5.3.2 Read BCM2 with ABPROG

2.5.3.3 Key-learning procedure

2.5.3.4 Alarm OFF

2.5.3.5 Alarm ON

2.5.3.6 Audi A6/A7/A8 with ALL KEYS LOST

2.5.4 Special functions with “instrument K-Line”

2.5.4.1 Transferring keys from one RB8 instrument to another

2.5.4.2 Exchanging RB8 Instrument

2.5.4.3 Removing RB8/RB4 “DEF” error

2.5.5 Special functions with “Engine Control Unit”

2.5.6 Special functions with “EDC17/MED17 Boot mode”

2.5.7 Special function “Read EDC17/MED17 PIN/CS in direct mode”

2.5.8 Special functions with “DPF OFF”

2.5.9 Special functions with “Simos PCR2.1”

2.5.10 Special functions “Component protection”

2.5.10.1 Component protection generation 1

2.5.10.2 Component protection generation 2

2.5.10.2.1 Reset to virgin state

2.5.10.2.2 Learn module to the vehicle

2.5.10.3 Component protection “Manually set the component protection bytes or load the by ConfData dump

2.5.11 Special functions “Immo parts adaptation”

2.5.11.1 Adapting engine control units

2.5.11.2 Adapting Audi A8, VW Touareg immobilizer (Kessy)

2.5.11.3 Adapting comfort module on Passat B6/CC

2.5.11.4 Adapting Transmission gearbox on A6/Q7/Allroad

2.5.11.5 Adapting EZS-Kessy on A6/Q7/Allroad

2.5.11.6 ECU/TCU exchange using ZN051 DS Box and EM003 (IMMO III/IV EMU)

2.5.11.7 Read MM 9GV PIN/CS with DSBox (Immo III/IV cars)

2.5.11.8 IMMO III/IV authorize ECU (for bench flashing)

2.5.11.9 IMMO 3/4 ECU/TCU PIN and CS

This function will read the PIN and CS for engine control units and transmission control units from the Immo III and Immo IV generation.

2.5.11.10 MQB Immo Data (allows immo data change in the MQB cluster)

2.5.12 Special functions “Immo V adaptation”

2.5.12.1 Adapting engine control unit

2.5.12.1 Adapting engine control unit

2.5.12.2 Adapting BCM2

2.5.12.3 Adapting Transmission gearbox (A4/A5/Q5 2008+ and A6/A7/A8/)

2.5.12.4 Adapting Electronic steering lock (ELV)(A4/A5/Q5 2008+ and A6/A7/A8 2010+)

2.5.13 Special functions “Theft protection”

2.5.14 Special function “Steering lock adaptation”

2.5.15 Special function “MMI-TV configuration”

2.5.16 Special function “Custom memory access Download/Upload/ReadMemory”

2.5.17 Special functions with “Airbag”

2.5.18 Special function “VW Crafter”

2.5.19 Special function “Dump Tool

2.5.20 Special function “Service Interval”

2.5.21 Special function “Remote control adaptation”

2.5.22 Special function “Navigation”

2.5.23 Special function “Cruise control system”

2.5.24 Special function “Brake pads change”

2.5.25 Special function “ECU Exchange – Dump Tool”

2.5.26 Special function “Door unlocking”

2.5.27 Special function “Coding calculator”

2.5.29 MQB ECU and TCU adaptation

2.5.30 Read MQB transmission control units - Read CS, Clone/Restore

2.5.31 Manual Adaptation for Immo V cars -Engine control unit, Transmission control unit, Steering lock

2.6 MQB clusters bench wiring diagrams using ZN058

2.7 Force ignition in MQB cars

2.8 “Key learning”

2.8.1 Key-learning procedures

2.8.2 Key-learning modes

2.8.2.1 Standard mode

2.8.2.1.1 Key-learning

2.8.2.1.2 Preparing dealer key

2.8.2.2 Wizard mode

2.8.2.2.1 Learn keys

2.8.2.2.2 Add one key

2.8.2.2.3 Prepare dealer key

2.8.2.2.4 VN006- Immo III/IV Megamos 48 Key Programming

3. TROUBLESHOOTING

4. APPENDIX

WIRING DIAGRAMS:

WIRING DIAGRAMS:

Removing sill panel trim (front) Driver Side

Using PROTAG with the Abrites diagnostics for VAG

ZN051 Distribution Box Usage in

Abrites Diagnostics For VAG

EM016 - MQB/MLB CAN blocker

Abrites Diagnostics for VAG is a Windows based PC based diagnostic software for the vehicles from the VAG group, which are, in most cases, unsupported by the Manufacturers diagnostics tester. The “Abrites Diagnostics” also provides you full diagnostic capabilities for VAG vehicles.

1.1 Installing the “Abrites Diagnostics for VAG”

The “Abrites Diagnostics for VAG” is contained in the installation package, so please run the setup.

Once you have done that you are ready to start the “Abrites Diagnostics for VAG”. When starting the software a splash screen appears where the connection to the hardware is examined. Should there be no problem with it a message should appear saying “CONNECTION OK”.

The main screen looks like this:

The “Abrites Diagnostics for VAG” basically consists of two parts:

• Standard diagnostic functions such as reading/clearing trouble codes, device identification, adaptation, measured values etc.
• Special functions such as Key programming, Immo parts adaptation, Reading EEPROM etc.

All devices available to the car are listed on the main screen of the “Abrites Diagnostics for VAG” with their appropriate VAS number. If you would like to connect to one of the devices just double click on it. The “Abrites Diagnostics for VAG” will try to connect to the device using the following protocols consecutively:

• KWP2000 over TP2.0 with a 5000kb/s (CAN) baud
• KWP2000 over TP1.6 with a5000kb/s (CAN) baud
• UDS over ISO transport protocol (CAN)
• KWP1281 or KWP 2000 over K-line (the protocol is recognized automatically from the wake up pattern)

You can choose which of these protocols to use when attempting to connect as described in the

“Configuration” section.

2.1 Configuration

The “Abrites Diagnostics for VAG” can be configured by pressing the “Options” button from the main screen. The following dialog is displayed:

NOTE: Changes regarding the interface and timing parameters made in this dialogue box will be applied after restarting the application.

2.1.1 Used protocols

The meaning of the check-boxes is as follows:

• CAN TP2.0 – when trying to connect to the device the Diagnostics will try to connect to it using “KWP2000 over TP2.0 with baud 500KB/s”
• CAN TP1.6 – when trying to connect to the device the software will try to connect to it using “KWP2000 over TP1.6 with baud 500KB/s”
• UDS - when trying to connect to the device the software will try to connect to it using “UDS over ISO transport protocol” with baud 500KB/s
• K-Line KWP2000/KWP1281 - when trying to connect to the device the software will try to connect to it using “KWP1281 or KWP2000 over K-Line”

NOTE: These check boxes are used only for configuring the used protocols when trying to connect to the device in order to perform standard diagnostic requests. They are not applicable when auto-scanning devices.

2.1.2 Interface detection.

Normally the “Abrites Diagnostics for VAG” USB interface is recognized automatically.

2.1.3 K-LINE baud rate settings

When trying to connect to the device over K-LINE the “Abrites Diagnostics for VAG” will try to connect using one baud rate and if it does not succeed it will switch to another baud rate and attempt to connect once again. There are two baud rates currently in use- the 10472 and the 9600. Using the “10472\9600” and “9600\10472” in the dialogue box you could set the order in which these two baud rates will be used.

If the “10472\9600” is selected then the software will try to connect over the K-LINE using the 10472 and if the connection is not successful it will switch to the 9600 and try to connect over it. If the “9600\10472” is selected the software will try to connect using a 9600 baud rate and if that proves unsuccessful it will switch to 10472 and make another attempt.

ATTENTION: Some of the devices using baud 9600 cannot be woken up if they have been tried with 10472. If you cannot connect to a device through K-LINE try to change the options so that the software tries to connect through 9600 first.

2.1.4 Timing parameters

The protocols running under K-LINE require very precise byte timing. Since Windows is not a real time operational system these times are not always respected and the connection to some devices is unsuitable or it is impossible to connect to them. In such cases you can try and change some of the timing parameters from the “Advanced” button. The timing parameters have the following meanings:

• Wake up echo delay - time after slow initialization between receiving “55 xx yy” and sending the inverted value of “yy”(according to the K-LINE wake up procedure).
• Communication echo delay – time between reception of a byte under KWP1281 and sending it back to the device in an inverted form.
• Inter byte time – time between sending two bytes under KWP2000.
• Time between messages – time delay between reception of a response from a device and sending a new request to it.

2.1.5 K-LINE PINs

Normally the K-LINE output is at the seventh pin of the OBD2 connector; However in some models (e.g. 2004 Porsche Cayenne) the K-LINE can be located on pin 3 or 15. Because of that there is an option to choose the pin where the connection is to be attempted.

ATTENTION: If you check all pins to be examined (i.e. pin3, pin7, pin15 the time for scanning all units will be significantly increased. Due to this the default pin selected is only one (pin7).

2.1.6 CAN resistance

According to the CAN specifications there should be a resistance between CAN-LOW and CANHIGH. Normally the gateway has this resistance however if you would like to connect to a device “on bench/on a table”( bypass connection without a gateway) then you should use a resistor between the “Abrites Diagnostics for VAG” and the separate device itself (e.g. ECU, dash, immobilizer etc.).

For that reason you have the option to choose what resistance to use (None, 75 Ohm, 100 Ohm or 10 Kilo ohm). The default value used is 120 Ohm. Normally there should not be any issues; however should an issue appears you can try changing the CAN resistance.

2.2 Scanning units

After starting the application in the main screen of the “Abrites Diagnostics for VAG” you will see a list of all possible units with their appropriate VAS number.

Once you have that you are able to connect to the listed devices by double clicking on them.

There is a possibility to scan for all installed modules in the vehicle. There are two modes of scanning – smart scan and standard scan.

• Standard scan – the software is iterating through all possible units and is trying to establish connection to them. This was the only one scanning mode prior software version V24.

You can also choose a configuration of devices corresponding to the specific car (chassis type) instead of displaying all possible units. This is done by selecting the type (e.g. “1T – VW Touran) from the “Chassis type” combo box. If you then select the “Display button” it will show all devices that can be installed into the chassis type in question.

Pressing the “Scan all” button will attempt to connect to each device currently displayed in the list. Depending on the configuration options only the selected protocols will be used when scanning for the devices.

Instead of scanning all units (which can take a while) you can retrieve the list of the installed devices from the gateway by selecting the “Gateway config list” button, and then to press the “Scan all” button.

• Smart scan – this scan mode is introduced into V24 and is the default scan mode. It is scanning extremely fast for CAN-Bus vehicles, but also for the K-Line there is improvement. The found modules at the end of the scan should be the same as with the standard scan.

For all devices found by the “Abrites Diagnostics for VAG” a detailed information is displayed in the main screen. The following information is displayed for each device:

• VAS number.
• Unit Name.
• VAG number – returned by the device in the device identification.
• Description – returned by the device in the device identification.
• Coding – returned by the device in the device identification.
• Part / IMP / Supp N (Part number/ Importer number/ Supplier number) – the information is shown separated with spaces, also returned from the device with in the device identification.
• DTC – number of Diagnostic Trouble Codes stored in the unit.

Since clearing of the DTCs for all existing devices is one of the main diagnostic operations and broadcast requests for clearing of all DTCs are not accepted from all units there is a possibility to scan all devices and then if a connection to the device is possible to clear its DTCs. This is done by clicking on the “Clear all DTCs” button on the “Auto scan devices” panel. Once again, the standard or smart mode is applied.

2.3 Broadcast requests

Broadcast requests are the requests sent to all or a group of devices simultaneously.

The “Abrites Diagnostics for VAG” is able to send broadcast requests to all devices with a request to enter a desired transport mode, to clear all DTCs in all devices or to disable/ enable the communication of all devices. You can do this by selecting the corresponding button in the “CAN Broadcast panel”.

Here are the available functions:

[Transport mode]

Entering or exiting the vehicle from transport mode is used by the factory to place the cars into a “sleep” mode in order to conserve the battery charge during long periods of inactivity.

[Disable normal communication]

This function will disable the communication between units in the car. This can help you hold the current state of the as well as preventing disturbances in communication while performing a reflash.

[Enable normal communication]

Restoring the normal message transmition.

[Clear all DTCs]

Sending requests to all units in the vehicle in order to erase their DTCs.

2.4 Standard diagnostic requests

When double-clicking on a device in the “Abrites Diagnostics for VAG” window, you connect to the device in order to proceed standard diagnostic requests. The following dialog box is then opened:

2.4.1 Identification

“Identification” will provide you the VAG part number and software coding, software and hardware version, short module description, date of production, VIN, Immobilizer number, the identification for the FAZIT database, and also the flash programming information.

2.4.2 Read diagnostic trouble codes

“Read DTCs” will display all errors present in the master and slave units.

The errors displayed can be together with the freeze frame data depending on the “Read Freeze frame” checkbox.

2.4.3 Clear diagnostic trouble codes

“Clear DTCs” will clear all DTCs stored in the unit.

2.4.4 Live data

In the “Live data” section, the user is able to observe the measured data, to stimulate actuators and to activate the basic settings. It is possible to observe the measured data while the actuators are activated.

Measured values

• “Non UDS” modules.

“Measured values” provides you the possibility to check measured values in different groups.

The group of the data you want to check, is selected in a combo-box, and normally some short

description for the group is also available.

Some important measured values:

The most commonly used value is the key recognition in the immobilizer. The key recognition is at channel 2 if the immobilizer is by CAN or at channel 23 if the immobilizer is by K-LINE.

The only exception is the Audi Q7/A6/ Allroad where the recognition is at channel 23.

• ”UDS” modules

The “Measured values” provides you the opportunity to check the measured values by selecting features from a list.

Here you can see the measured values from a unit in a list view.

Actuator test

There are two types of tests available: “Selective” and “Sequential”.

In the selective test mode you have the possibility to enter a test code manually or to select it from a list box. When a test is selected all you need to do is press the “Start” button. But not all modules are supporting the selective mode, so for them a sequential test should be used (sequential test means that each actuators are activated one after the other).

Basic settings

“Basic settings” will expect you to select a number of the group and press the “START” or “STOP” button.

2.4.5 Security access

“Security access” provides you the option to perform security authorization on different levels.

2.4.5.1 Standard security access

This type of security access can be:

• “Security access ( log in )” - Typically used in immobilizer systems.
• “Security access ( Component Security)” - Typically used during adaptation of different units or parts.
• “Security Access ( System Specific )” - Security access different from the previous two types and from the authorization for programming.

Hints:

• When the device you connect to is using a “KWP1281” diagnostic then the only applicable option is “Security Access (log in)”
• If you would like to input security access to the ECU you should use “Security access (Component Security)”. This will allow you access to the adaptation channel 50.
• If you would like to input the security access to the immobilizer you should use “Security access (Component Security)”. If you receive an error message saying that it is not supported you should use “Security Access (log in)”.

2.4.5.2 User defined security access

In order for the authorization to be performed you need to clarify the type of security access by using the “Request seed” / “Send seed” buttons.

2.4.6 Adaptition

“Adaptation” will open a separate window for you where you could check the adaptation values.

• “Non UDS” modules.

You need to enter the number of the channel where the adaptation will be performed and then press the “test” button. If the specified value is accepted by the unit press the “Save” button.

The “Scan all” button will generate a file with all channels and the adapted values.

Some important channels used for adaptation:

- Channel 50 – typically used for adaptation of new parts. Usually to get access to this channel you should do a security access with the log in(PIN) of the device to which you are connected and the one you will adapt to the car. After gaining access to channel 50 you should input the log in (PIN) of the car to which you will adapt the new part.

- Channel 21 – If the immobilizer is by K-LINE then the adaptation of the keys is done in channel 21. To gain access to it you need to make a security access with the immobilizer.

- Channel 1 – If the immobilizer is by CAN then key adaptation is done in Channel 1. To gain access to it it is necessary to do a security access with the immobilizer.

You have to select certain items from a drop down list. When an item is selected it is automatically read and its current values are displayed in the “Current” column. The “Unit” column shows the measurement unit of the selected item. To change a current value you need to input or select a certain new value into the corresponding cell from the “New” column.

2.4.7 Coding of the unit

“Coding” will open a separate a separate window for you where you can change the coding value of the master and all slave units. In the example below only the master unit supports coding. Slave units 1 and 2 are without coding.

Pressing the “Coding helper” button will open a new window where you can see the corresponding coding information with an opportunity to change the appropriate settings.

2.4.8 Custom requests

Using this function you can manually send diagnostic requests to the corresponding unit.

The next example shows a request for identification of an instrument cluster.

2.4.9 Custom download / upload

“Custom download/ upload” allows direct read from the address map of the device. This option will only be available if you have some updates in your configuration such as “Reading / writing the flash counters”. Please note that in most cases there will be a security authorization required before you write or read the address map.

2.4.10 Active diagnostic session

Default diagnostic session established after connection to the unit is number “89”. You could request entering a different diagnostic where performing of diagnostic activities in the standard session “89” is not allowed. Please take into account that in most cases different diagnostic sessions require security authorization.

2.4.11 Flasher (SW Update)

There is a possibility to update the software of the modules. The files with the updates are not provided from Abrites, it is responsibility of the customer to find such files. Typically these files are provided with the original OEM software. These files are normally with “.SGO” extension (for modules using under “TP2.0” or “KWP2000”, or with “.FRF” extension for the modules using UDS. Please pay attention that update of the software is risky operation – if incorrect SW is uploaded to the module, it might stop work. Normally if the process is interrupted (e.g. because the battery is flat, or the PC is restarted, etc.) it is possible to start the process again. When the customer start this function, information about the current SW number and version is displayed, then the customer has to select the file which he wants to flash. If the module is with “UDS” diagnostic protocol, it is necessary to have Internet connection in order to get the data from the file.

2.5 Special functions

Special functions are specific applications allowing you to read security access codes, read/ program EEPROM / flash content etc.

The “Special functions” are available in the main dialog window of the “Abrites Diagnostics for VAG”.

The needed special function is opened by double click or by marking and clicking the “Open” button.

Note: For the purposes of some special functions (mostly key learning there are buttons for PIN auto detection and component security. This means that they will try to gather the needed information from the ECU and also from the instrument cluster (if the cluster is supplied by VDO.

Please be informed that for VDO units manufactured after the end of 2006 some parts of the instrument cluster needs to be re-flashed. The same applies for millage reading functions. As mentioned in the license agreement you will need to perform these operations at your own risk.

2.5.1 Special functions with “CAN Instrument ”

When this function is opened the “Abrites Diagnostics for VAG” tries to establish diagnostic with the instrument cluster using KWP2000 over TP2.0 or UDS.

If the session is established successfully the software will read the module’s identification and will try to automatically detect the instrument cluster type.

The following types can be detected:

• VDO/MM/Visteon -2007 (CAN TP2.0)
• VDO with NEC μC 2009+ (CAN UDS)
• JCI with NEC μC and 95320 EEPROM (CAN UDS)
• Magneti Marelli with 9S12 μC (CAN UDS)
• A8(4H)/A7(4G)/A6(4G)/Touareg(7P) with 95320 EEPROM (CAN UDS)
• DO based on MQB platform

If connection to the instrument cluster cannot be established or the instrument cluster’s type cannot be detected automatically you will see the following window:

Note: If you would like to select the instrument cluster manually you need to disconnect your AVDI from the OBDII and open the “Instrument cluster CAN” special function.

If one of the above types of instrument cluster is automatically detected the “Abrites Diagnostics for VAG” will not open the corresponding function window.

2.5.1.1 Special functions with instrument cluster CAN over TP2.0

Available functions are:

• Reading current mileage value.
• Read/ Program EEPROM(Configutation data) of instrument cluster immobilizer.
• Reading security access code of the immobilizer(Component Security (CS) )
• Read/ Write immobilizer related data.
• Program keys

Please note that the provided security access code from this application is immobilizer related and will not be accepted by the instrument cluster.

For Micronas dashboards it is also possible to extract the mileage value by available EEPROM and flash dumps using the “mileage by flash EEPROM dumps (Micronas)”.

Reading/ Writing the immobilizer data is done from the “Read IMMO data” and “Write IMMO data”.

For Micronas dashboards it is also possible to extract the immobilizer data by available

EEPROM and flash dumps by using the “Immo data by flash EEPROM dumps (Micronas)”.

If you would like to make a key you will need to read the immobilizer data first or to load it from flash and EEPROM dumps. After that you should have a transponder programmer (PROTAG) connected and then you should place the transponder inside. Once that is done the new key is added to the existing keys, allowing them to still function.

Note: It is possible to have up to 8 keys per car. If all positions are already taken when you create a key you have to substitute the 8th key position.

Note: The “Make dealer key and add it to the immo data” button programs the transponder as a dealer key and adds its transponder ID to the immobilizer data. The data however is not yet written in the micro controller. You will need to select the “Write immo data” button to do that. Alternatively you could exit without writing data ,since you already have have a dealer key. Of course you could always teach the transponder by diagnostics.

This application could be used with the following models:

VW Golf5, VW Caddy, VW Touaran, VW EOS, VW Individual, Skoda Octavia II, Skoda Scout, Seat Leon, Seat Altea, Seat Toledo, Audi A3, Audi A6, Audi A8, Audi Q7, Audi Allroad.

With Audi A6, Audi A8, Audi Q7, Audi Allroad the function for reading current mileage value is not available and key programming is done through EZS-Kessy or BCM2 special functions.

ATTENTION:

Please take into consideration that some instrument clusters of the Audi A3 and A8 have the access to the special functions blocked. The blocked access ones can be recognized by the unreal value they display when you read them. If you need to restore normal behavior to the instrument cluster you need to remove the fuse of the instrument cluster for one minute (e.g. in the Audi A8 you could remove fuse number 5). The most common reason for the blocking of the security access is the usage of low quality diagnostic tools in the past.

ATTENTION:

The “Abrites Diagnostics for VAG” is designed to calculate mileage values in metric units.

Please take this into account. Especially when using a dump tool or when the “Abrites Diagnostics for VAG” asks you about the displayed value of the instrument cluster.

2.5.1.2 Special functions with “VDO NEC”

The “VDO NEC” is dedicated to the VDO instrument clusters with a NEC micro controller.

Typically these instrument clusters are installed in VW/ Seat/ Škoda/ Audi cars produced after the year 2009.

After starting this function you will see the following dialog box:

This special function can be used to read mileage and making keys. It is also possible to use it for exchanging parts and adapting the identification and configuration.

The key making function requires a ley programming license while the mileage function requires a separate license.

In order to perform any operations on these dashboards you will be required to enter the car into service mode. The dashboard cannot be worked on without entering service mode. Entering the car in service mode is performed in three ways:

• If the car has a working key you could put it in ignition and then press “Enter service mode.”
• Using VN006 special function and Megamost with ID48 rewritable(all by OBDII) when all keys are lost.
• Reading the EEPROM (24C32 or 24C64) with a programmer or with ZN059 cable), then loading it once prompted by the software, then modifying it with the next step and finally writing the resulting file back to the cluster EEPROM using the programmer. Entering service mode, loading the EEPROM and reading mileage and IMMO Data looks like this:

We recommend that you detach the dashboard from the car and work with it separately (not in the car). Another thing you could do is switch the ABS module OFF during your work with the dashboard(when working in the car). If you prefer to work with the dashboard in the car and the ABS coding is lost, it is possible to be calculated with the “Coding Calculator” special function (short coding only). If the ABS has a long coding please save it before entering service mode(Diagnostics menu > ABS > Coding > save the coding string to a text file)

Once service mode is entered you can:

• Read/ Write the whole EEPROM
• Read the whole flash
• Read/Recalibrate the mileage
• Read/ Write immobilizer data
• Program a key for the car

Note: The S-Key(secret key) is generated once the already loaded cluster EEPROM is modified by the software. Once you enter service mode, the S-Key is automatically generated and you can save it. It is used to enter service mode without reading and writing the EEPROM. S-Key is a binary file and you can send it to friend so that he can read the same device easily on another PC.

Note: Sometimes writing of the data could fail. In order not to loose the information all written data is backed up in the “Dumps” sub folder.

Note: For dashboards with a colored TFT and other late model cars display with no working key you should enter the service mode and perform all changes before exiting the menu. Should you need to enter service mode once more you will need to modify the EEPROM yet again with a programmer.

Note: For the colored TFT and other later model cars display dashboards the specifics dictate that the dashboard remains sometimes dark while the service mode is active.

2.5.1.3 Special functions with “Magneti Marelli” UDS 9S12

The “Magneti Marelli UDS 9S12” special function is dedicated to the Magneti Marelli instrument clusters with a 9S12 micro controller and UDS diagnostic protocol. These are typically produced after the year 2009.

After starting this function you will see the following dialog box on your screen. In the example below the data is already read.

The special function is used for mileage reading and key making. Part exchanging and adaptation as well as identification and configuration is also possible. The mileage function requires a separate license while dealer key making requires the dealer key license.

When all keys are lost the micro-controller flash and eeprom (External Configdata) data have to be read and loaded into the software.

2.5.1.4 Special Functions “JCI with NEC μC and 95320 EEPROM”

The “JCI with NEC μC and 95320 EEPROM” special function is dedicated to the Johnson Controls instrument cluster with NEC micro controller, 95320 EEPROM and UDS diagnostic protocol.

After starting this function you will see the following dialog box on your screen. In the example below the data is already read.

Press the “Read mileage” button to read the current mileage value.

Press the “Read EEPROM” and “Write EEPROM” to read or write the EEPROM data.

Press the “Read Immo data” button to read the immobilizer data.

After you have read the immobilizer data you can modify and write it by using the “Write Immo data” button.

After reading the immobilizer data you could add a new key. Pressing the “Add key” button will prepare a dealer key. Then add it to the immo data and write the new immo data to the immobilizer.

2.5.1.5 Special functions with “A8 (4H) / A7 (4G) / A6 (4G) / Touareg (7P) UDS dashboard with 95320 EEPROM”

The “A8 (4H)/ A7(4G)/ A6(4G)/ Touareg(7P) UDS dashboard with 95320 EEPROM” special function is dedicated to the A8 (4H)/ A7(4G)/ A6(4G)/ Touareg(7P) instrument clusters with 95320 EEPROM and UDS diagnostic protocol.

After starting this function you will see the following dialog box if the IGN is not switched ON:

To do the mileage calibration, you can do the following:

1. Turn IGN ON

2. Enter the “CAN Instrument” menu

3. Read the current mileage

4. Enter the desired value and click on “Recalibrate mileage”

5. Once the procedure is complete, you will see the “Done” message on the bottom side of the window:

There is also a separated option to Fix the DEF error if necessary.

2.5.1.6 Special Functions with VDO based on MQB Platform 2014+

The mileage correction function for VDO clusters based on the MQB platform is able to perform mileage

editing in cars based on the MQB Platform from years 2014+. The function is found under “CAN Instrument” in the Special Functions Tab:

2.5.1.7 Added MQB cars key programming - adding spare key

The Key Programming for the MQB cars will allow you to add a spare key when one working key is present.

The list of the supported models is as follows:

Audi A3/S3 2014+

Audi Q2

Seat LEON 07.2014+

Skoda FABIA/OCTAVIA III 07.2014+

Skoda RAPID 06.2015+

Skoda KODIAQ/SUPERB III

Seat IBIZA/ATECA/TOLEDO 06.2015+

Volkswagen Golf 7/Polo/Tiguan II/Touran II 07.2014+

Volkswagen Crafter 2017+

Volkswagen Passat B8

The next screenshots will guide you through the first steps of the actual key programming on MQB cars:

5. Enter the desired number of keys you will

program

Once you have programmed the keys, the remote also gets programmed.

Note: For keyless go key programming on MQB cars, the key needs to be held close to the emergency slot and push the “Start” button and right after this, start the procedure to program a key.

Note: Specifics in MQB key programming for Skoda vehicles.

When programming keys to MQB Skoda vehicles there is one very important specific step we sometimes need to take.Due to the way the start button and the receiver coil are positioned (the coil is positioned around the start button) often times the keys which we want to program cannot be accepted by the coil. The button creates a disturbance and the coil does not “see” the new key or even the original one for that matter.

A good solution we have is to remove the plastic or aluminium trim around the start button and remove the start/ stop button without disconnecting it.

This will allow you to position the key on the coil and use the start/ stop button to complete the key programming.

This is based on our practice and we are sure it will help you too.

2.5.2 Special functions with “EZS Kessy CAN”

When you select this function the “Abrites Diagnostics for VAG” tries to establish a diagnostic session with the “EZS-Kessy / Entry And Start Authorization” using KWP2000 over TP 2.0.

This special function is dedicated to the Q7/ A6/ Allroad models and provides the following functions:

• Key learning. In most cases it requires a pre-programmed key (one using VIN) which can normally be purchased from a VW / Audi dealership. This function can also be performed without a dealer key, however you will be required to create a dealer key. You can do that with the Abrites dealer key special function and a PROTAG programmer.
• Read the EZS Kessy EEPROM (2KB)
• Write the EZS Kessy EEPROM (2KB) containing the PIN, component security and ECU synchronization.
• Change the VIN inside the EZS Kessy EEPROM.
• Program a blank key, so that it becomes a dealer key.

IMPORTANT: In order to perform any functions with the EZS-Kessy you need to have one of the following:

• The login (PIN) of the car and the first 6 bytes of the component security. The component security is normally 7 bytes, however the 7th byte is not required. The login and component security bytes can normally be read from the ECU(until 2008/2009). This applies for all cars with EDC16x/ MED9x/ ME7x/ EDC17/ MED17 ECUs. You can read the login and component security using the “Engine control unit” special function or from a decoded EEPROM dump using a programmer. It is also possible for the software to read
• all this information automatically when you press the “Autodetect” button.
• In this case the software will connect to the ECU and read the component security and login filling the required fields automatically.
• It is possible that the component security cannot be read from the ECU. In such cases you can use the car’s working key (provided you have one) and obtain the component security and PIN from the EZS-Kessy. This is done using the “Get component security from EZS-Kessy by OBDII” function.
• If the car has no working key you will need to open the EZS-Kessy and read its EEPROM with a programmer. Then you have to select “Get component security from EZS Kessy” and load the EZS Kessy dump. Once that is done you can learn or create a dealer key.

IMPORTANT: Provided that the car has no working key and you can not turn the ignition ON in order to get the ECU to communicate you will need to short the fuses as described in the appendix(pin 1 and 16 of the OBDII).

After obtaining the component security bytes you can restore the fuses.

IMPORTANT: If the car has no working key communication with the EZS-Kessy is only possible if you press the brake pedal.

NOTE: In order to perform any functions with the EZS-Kessy you will need to input the login and the component security bytes, or to load the EZS-Kessy from the EEPROM dump, or to get the component security by OBDII from EZS-Kessy. If that is not done any attempts to perform any actions will result in an error.

IMPORTANT: If a dump form the EZS-Kessy is available the Sokymat 8E transponder can be reset from the Tag Key Tool software and the key could be then re-used.

2.5.2.1 Learning keys with EZS-Kessy

In order to learn a key for the EZS Kessy you need to have the login and the component security bytes (as described above) and to specify the number of keys which are to be learned. Once you have that you need to select the “Learn” button and the keys will be learned. Key learning is done with dealer keys. They can be obtained at a VW / Audi dealer or can be made if you have the respective key programmer by using the “Make dealer key” button(Insert 1 in the “Number of keys to learn” field.)

2.5.2.2 Reading and changing VIN

In order to read or write the EZS Kessy VIN you need to have the login and the component security component bytes (as described above). Once you have that you can use the “read”/“write” buttons to change the VIN.

2.5.2.3 Reading / Writing EEPROM

ATTENTION: It is now possible to write areas $100 to $15F. In order to be able to write this area you need to have a working key. This is the area, that contains the Immobilizer data. Please be very careful when performing modifications here, because modifying some areas of the immobilizer data might lead to the car not being able to start because it will not be able to recognize the key (this is very much so in the component security range between $100 and $123). Another thing is that if you modify this area and have the

error above it will not be writable again due to the lack of a working key. Should such events occur you will have to create and learn a new key to the car in order to restore the ability to write this section again. There are a few ways you could approach this situation:

• You can learn a brand new transponder.
• You can unlock the original key, make it a dealer key and learn it again, making the area writable again.

2.5.2.4 Programming a blank key so that it becomes a dealer key

First you need to input the login and the component security bytes (as described above). After that you need to press the “Make dealer key” button(Insert “1” in the “Number of keys to learn” field.). At this point you should have a blank key inside the key programmer and the ABRITES Diagnostics should be connected to the car. A few seconds later you should have a dealer key ready. Then you can learn the key by selecting the “Learn” button.

2.5.3 Special functions with “BCM2 A4/A5/Q5/A6/A7/A8”

This special function is dedicated to key leaning for the vehicles equipped with the so called BCM2.

Normally these are the A4/ A5/ Q5 vehicles produced after the year 2008/2009 and also A6/ A7 /A8 produced after 2010 and Touareg produced after 2010.

Once you start the special function you need to select the model.

The models are divided in three general groups:

• Audi A4/ A5/ Q5 – for this group it is not necessary to have a working key.
• Audi A6/ A7/ A8/ VW Touareg – this group requires to have a working key ( a key, purchased from a dealer is also an option). If you would like to learn a blank key it is necessary to place the working key in the programmer and press the “Read working key” option. If you plan on relearning existing keys or learn a key, purchased from a dealer (i.e. without programming blank keys) it is not necessary to press the “Read working key” option.

The special function offers the following options:

Making keys for these vehicles requires to read the BCM2 module. In general the procedure is split into three steps:

Step 1: Check BCM type.

Step 2: Read BCM ( either by OBDII or with an ABPROG)

Step 3: Key learning procedure ( making dealer keys or learning keys)

• Audi A6/ A7/ A8 with ALL KEYS LOST – this is special case where no one key is available and then the procedure is generally different. It is separately described below.

After the model selection is complete the procedure is identical for both groups:

2.5.3.1 Read BCM2 by OBDII

This option will read the BCM2 by OBDII.

If all keys are lost you will see the message below. At that time you should disconnect the BCM2 module from the power supply for around 2-3 seconds and then reconnect it again (or disconnect the OBDII cable from the OBDII, disconnect the car battery for 2-3 seconds and reconnect the OBDII cable).

After doing that you should select the “OK” button. If there is a valid key and the ignition is ON you do not have to disconnect the BCM2 module from the power supply.

After the reading is finished the existing key count, power class and VIN are displayed and you can proceed to learning the key.

IMPORTANT: If the procedure is stopped and there is no communication with the BCM2 after disconnecting the BCM2 module from the power supply, it is required to repeat the procedure and keep the car awake by turning the lights ON and OFF.

2.5.3.2 Read BCM2 with ABPROG

If you select to read the BCM2 with the ABPROG programmer, you need to solder 6 wires on the module’s PCB, and you should temporary remove one resistance (after reading is finished, restore the resistance). There is also a wiring diagram applied. The wiring diagram is located in the program folder too.

2.5.3.4 Alarm OFF

This option is dedicated to a case where there are no keys for the particular car. If there is an alarm installed, after unlocking the driver’s door, the alarm will be set off in 15sec. If in the meantime you activate this function, the alarm will not start. Then you could unlock all doors by unlocking the driver’s door once again. Some vehicles do not have an alarm installed and after opening the driver’s door, all doors are unlocked.

2.5.3.5 Alarm ON

After the alarm is disabled and a new key is learned to the car, it is recommended to restore the alarm using this option.

2.5.3.3 Key-learning procedure

Once the BCM2 module is read, you can make as many dealer keys as you want. A brand new key is needed for the dealer key. Such a key can be made as a dealer key several times, but if you learn this dealer key to the car, it is locked during the key-learning procedure and cannot be used on other cars.

Once you have the required count of pre-coded dealer keys, you can learn them. Also the

original keys should be re-learned in this step, otherwise they will no longer function.

2.5.3.6 Audi A6/A7/A8 with ALL KEYS LOST

This function is dedicated especially for making keys for the models of Audi A6/A7/A8 (2010+). Please note that the VW Touareg 2010 is not included. The procedure of making keys is a little bit complicated and goes in several steps.

• Read the BCM2 by OBDII (with a programmer).
• Prepare a key (it should be an Abrites key!) and learn it to the car
• Read the transmission control unit and engine control unit by connecting to the internal CAN bus. Connection to the internal CAN and LIN bus are described separately in the appendix!
• Read the ELV by connecting to the internal LIN bus
• Calculate online the data necessary for programming the key (this could take up to 15 hours)
• Prepare the dealer key and learn it to the car

The procedure for calculation takes from 2 to 15 hours, so it is not necessary to wait the whole time online. Normally the software will remember till which step you proceeded last time, and if you start the software anew, it will allow to resume from where the procedure was interrupted. So when you press the “Next” button, if there are some cache data from previous BCM2 all keys lost attempts, the software will give the possibility to continue from where the procedure was stopped. This is dedicated to avoid the very long waiting period (15hours) until the calculation is finished.

Here are some more details about the steps:

• Load ELV dump (MC908GR) if available - if a dump from the ELV is available the time will be significantly.
• Read the BCM2 by OBDII (or with a programmer) - Since all keys are lost, the customer will need to disconnect and reconnect the BCM2 from the power supply during this step
• Prepare and learn a key – for this step a special Abrites key should be used. It is not possible to use other keys for this step.

• Read the transmission control unit and engine control unit by connecting to the internal CAN bus

For that purpose is necessary first to read the TCU and ECU. The TCU and ECU is not possible to be read by OBDII, but is possible to read it when you connect the TCU and ECU on the table, or when you connect the AVDI to the internal CAN-BUS of the car.

To read from the internal CAN-Bus, find the orange/black and orange/brown CAN wires and make the following connection of the AVDI:

• Orange/black <-> CAN-H (PIN6 of the OBDII)
• Orange/brown <-> CAN-L (PIN14 of the OBDII)
• Ground <-> GND (PIN4 of the OBDII)
• 12V <-> 12V (PIN16 of the OBDII)

NOTE: These are the same wires used for transmission control unit (TCU) adaptation

So once you have connection to the line, you should try to make several times ignition ON and again OFF (during these attempts you need to eject the key). Continue to make ignition ON and OFF with the key which you prepared on step 2, until you see the message “ELV read OK”.

Then you can continue with the next step.

• Calculate online the data necessary for programming the key – the calculations can take till 15 hours (if there are no other pending requests) and it is not necessary to hold this window open all the time. You can close the software, and then later to check if the calculation is ready. For that purpose you just need to select to use the last cached data.

• Prepare the dealer key and learn it to the car - once the calculation was made OK, you can make a dealer key and learn it to a car. You can use the same key from step 2, or you can use any other blank key.

If the ECU is Simos (which cannot be read using a direct connection) it will be possible to program a key to car only if a dump from the ELV is available.

• Read the ELV by connecting to the internal LIN bus – now you’ve to connect to the internal LIN bus. It is found on PIN17 of the T32C connector of the BCM2. To read the ELV by the LIN bus, you need to connect the LIN wire to PIN 7 of the OBDII, to provide also GND to PIN 4 of the OBDII, and 12V on PIN 16 of the OBDII. Once the AVDI is connected to the LIN, you will see indication for this as shown below:

2.5.4 Special functions with “instrument K-Line”

When you open this function the following window appears:

From this dialog box you will need to choose your instrument cluster type or the immobilizer and then you could read/ write the EEPROM ( read mileage, PIN etc.) Please be informed that the special function will only establish a connection via K-line ( KWP1281 or KWP2000) and this does not depend on the configuration options.

ATTENTION: All read EEPROM dumps will be stored in the “Dumps” sub folder of the Abrites Diagnostics for VAG so you could restore the EEPROM in case of any unwanted changes.

Automatic parsing of data from the EEPROM (mileage and immobilizer) is implemented for most instrument clusters.

For instrument clusters from Magneti Marelli please refer to Appendix A.

If a connection to the Motometer instrument is not successful please send the text file “motometers.txt” to the following e-mail address: support@abrites.com and the instrument will be added to the database within a three business day period.

NOTE: Sometimes if you try accessing the instrument cluster by selecting the wrong type of cluster from the dialog, the cluster might block or reject future diagnostic requests until it is reset by disconnecting the power supply either from the battery or the fuse. For example this is a common issue which appears always with the Bosch clusters being blocked when being accessed as “Instrument cluster (VDO66, VDO86, Motometer)”

NOTE: Please be very careful when selecting “Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001+” and “Instrument Cluster Audi A4 BOSCH RBx” instruments. You will be able to read the EEPROM of the instrument no matter which of both types is selected, but if you’ve chosen the wrong type and you try to make some changes, you can damage it. You can recognize whether the right type is selected by doing the following:

1.Choose “Instrument Cluster Audi A4 BOSCH RBx”

2.Read the EEPROM

3.If the displayed mileage corresponds to the real value, and if the displayed login is accepted, then the type is “Instrument Cluster Audi A4 BOSCH RBx”, otherwise it is “Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001+”

NOTE: When reading the RB8 EEPROM the device is put into service mode and “L0 x-y” is displayed. If by any reason the instrument leaves in this situation (e.g. if your laptop goes off due flat battery, or you disconnect the interface from the car, or the car battery is flat), you need to read the RB8 instrument EEPROM, and change the immobilizer status to 6.

2.5.4.1 Transferring keys from one RB8 instrument to another

Starting with a V5.2 of the ABRITES Diagnostics for VAG onwards it is possible to transfer the keys from

one instrument to another. After reading the RB8 EEPROM there are two additional buttons:

“Read keys” and “Write keys”.

• “Transfer learned key IDs” - these are the fixed code identifiers. If you do not transfer them you will need to perform key learning on the new dashboard.
• “Transfer learned key count” - transfer the amount of keys learned.
• “Transfer component protection data” - this transfers the key variable code. Without this the keys are not recognized and cannot be learned. Please note that in order to start the engine you need to adjust the component protection data in the ECU too.
• “Transfer login” - transfers the car’s login.

NOTE: There are two types of RB8 instrument clusters – those that have a 7 bytes component protection and those that have a 12 bytes one. The procedure above is valid for the 12 byte component protection versions. Almost all RB8 Instrument clusters have a 12 byte component protection. Those that have a 7 byte component protection are mainly found in A4 gasoline models; however the RS4 is also a 12 byte component protection car.

In order to transfer the keys you already have you have to first read the EEPROM of the source instrument and then by pressing the “Read keys” button you save them into a file.

Once you do that you need to go to the destination instrument, read its EEPROM and then after pressing the “Write keys” button you will be prompted to show the location where the source keys were read and saved. After selecting the file you will be asked to specify what information you would like to transfer from the source instrument to the destination one.

2.5.4.2 Exchanging RB8 Instrument

If you want to install a used RB8 instrument into a car, you have to to synchronize the ECU and the RB8 instrument. To do that you need to read the ECU component protection data and the ECU MAC. Then after reading the RB8 instrument a button “Reset Comp. Security” will be available. After pressing this button the following dialog will appear. All you have to do here is to input the component security and MAC of the ECU.

NOTE: There are two types of RB8 instrument clusters – those that have a 7 bytes component protection and those that have a 12 bytes one. The procedure above is valid for the 12 byte component protection versions. Almost all RB8 Instrument clusters have a 12 byte component protection. Those that have a 7 byte component protection are mainly found in A4 gasoline models; however the RS4 is also a 12 byte component protection car.

2.5.4.3 Removing RB8/RB4 “DEF” error

When you select the ICP type of “Instrument Cluster Audi A4 BOSCH RB8 CRYPTO 2004+” or “Instrument Cluster Audi A4 BOSCH RB4 CRYPTO 2001+”, a button “Repair RB8 DEF” (“Repair RB4 DEF” respectively) will appear. Pressing this button you will initiate the procedure of removing the “DEF” string from the dashboard display.

NOTE: It is recommended that you read and save the dashboards EERPOM and to make a note of the dashboard’s “Login” code before starting the procedure.

• Repair RB8 DEF:

During this procedure the software will read and write the EEPROM memory to the dashboard several times. It is normal for the dashboard to display a string saying “Error” during the time the procedure is in progress.

After writing the fixed EEPROM to the dashboard the software will try to automatically adapt the dashboard to the vehicle. (i.e. performing adaptation on channel 50). In order for this to be performed there will be a requirement for you to input a security access login. The login code needed is 13861. In most

cases dashboards are not ready for the security access login right away and you will need to wait a little. The software will then ask you if it is to complete the procedure automatically or if you would like to do this yourself manually.

If you select the automatic manner once the waiting time is over the software will automatically adapt the new dashboard’s security code to channel 50 and will then ask you if you would like to transfer the old keys or if you would like to learn a new set using the “Key learning” special function. Depending on your choice the software will transfer the keys or not and complete the procedure.

If you choose to complete the procedure manually you will have to wait some time with the key in the “ON” position in the ignition, then connect to the instrument cluster through standard diagnostics, perform the security access (Login) with the 13861 login code and then adapt the dashboard’s access code on channel 50. After doing this you need to learn new keys using the “Key learning” special function.

• Repair RB4 DEF:

During this procedure the software will read, modify and write the EEPROM memory to the dashboard.

After the fixed EEPROM is written to the dashboard the software will try to automatically adapt the dashboard to the vehicle (i.e. to perform adaptation on channel 50). In order to do this, a security access (login) is needed with a login code 13861. In most cases the dashboard will not be ready for the security access right away so it might be needed to wait some time. The software will ask you whether you would like to wait and let it finish the procedure automatically or you would like to choose to cancel the procedure and finish it manually.

If you choose the automatic manner, when the waiting finishes the dashboard will allow you to login. The software will automatically adapt the dashboard’s security access code at channel 50. If you choose to finish the procedure manually you have to wait for some time with the Ignition in the ON position, then connect to the Instrument cluster through standard diagnostics, perform security access (Login) with ogin code 13861 and then perform adaptation of the dashboards security access code on channel 50.

After the procedure finishes you have to learn all keys using the “Key learning” special function.

2.5.5 Special functions with “Engine Control Unit”

The “Engine Control Unit” special function provides the following options:

• Read/Write of the flash memory.
• Read/Write the flash counters.
• Read/Write EEPROM.
• Extracting security code/ PIN.
• Immobilizer Enable/Disable (EDC15/EDC16/ME7x).

The functions are available after pressing the button “ECU” from the special functions tab of the

main dialog:

Note: As of VAG version 28.0, all ECU Special Functions will be under one main ECU Button:

IMPORTANT: You need to specify the type of Engine Control Unit in the car before proceeding! There is also an “Auto detect function” implemented which will detect the ECU type in almost all cases, however it is possible that it is wrong and then you need to select the type manually.

You can choose the ECU type – VAG- EDC15x, VAG – ME7.1.1/7.5/7.8, Porsche 5.2/7.8 BOSCH VAG-EDC15x, VAG-ME7.1.1, VAG-ME7.1, VAG-ME7.5, VAG-Cartronic ME7.8, EDC16U1, EDC16U3x/CP, etc. (Extracting security code, enable disable immobilizer etc.)

The example shows: 1.9 TDI – EDC16

HINTS when reading/writing EEPROM memory of ECUs:

1. The whole EEPROM could be read for EDC15/ME7/EDC16. For MED9, EDC17 and Simos engine control units only the PIN/CS/MAC is displayed.

2. To read the EDC17/MED17 PIN/CS/MAC is required to have internet connection!!!

3. If you experience problems with reading ME7.x EEPROM it is better to remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again.

HINTS when reading/writing flash memories of ECUs (or changing flash counters):

1. In case of EDC15 the best advice is to remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster.

At a certain point during reading/writing flash memory of the EDC15 ECU, you will see “Trying gateway options...” written on the status line at the bottom of the “Engine Control Unit” window.

Turn the ignition OFF and ON at this point.

2. In case of ME7.x or ECUs from Porsche you can read the flash memory as if you are reading the EEPROM – the only difference is that you need to uncheck the checkbox for automatic detection of EEPROM and put the corresponding start address and length.

If you experience problems with reading ME7.x memory it is better to remove fuse 11 and fuse 15 to prevent disturbing of communication from the instrument cluster and try again.

3. When flashing the device please always read and save first the original flash!

4. When using EDC16 please note that the flash which was read is saved automatically in the “Flash” subfolder and can be used in case of failure to restore the flash.

ATTENTION: FILE IS CRYPTED!!! Don’t use it directly to write flash! In case of failure during the flashing the device should enter into a boot-loader mode which will allow you to flash the device (but not to read it). The flash can be then restored with the “Custom Read/Write” function.

5. Please, stop all screen savers/power saving options and unused application during the flashing! Please do not do anything else on your PC while flashing.

6. Please, take into account that the reading/writing of the flash will take a long time (especially when CAN connection is used) – as result the battery July go flat.

2.5.6 Special functions with “EDC17/MED17 Boot mode”

This function is dedicated to reading/writing of the EEPROM and flash memories of the EDC17/MED17 engine control units. Here not only VAG engine control units can be read, but also engine control units from other manufacturers (such as BMW, Opel, etc.).

You need to:

• Connect the boot pin of the engine control unit to ground
• Connect the CAN-H of the ECU to PIN6 of the AVDI OBDII Connector
• Connect the CAN-L of the ECU to PIN14 of the AVDI OBDII Connector
• Connect the ignition of the ECU to PIN7 of the AVDI OBDII Connector
• Connect the power supply (12V and Ground) of the ECU to a power supply source
• Check which microcontroller in used in the ECU (the Infineon TriCore type)

• Connect a 510Ohm resistance between power supply (12V) and PIN7 of the AVDI OBDII Connector

Connection diagrams can be found in the appendix

Then you should select the appropriate microcontroller and connect to it. Once connected the user has information about the flash/EEPROM size and protection, and has the ability to:

• Read/write EEPROM (Dflash)
• Read/write Flash (Pflash)
• Get PIN/CS/MAC for the engine control unit
• Make immobilizer bypass of the in the EEPROM (applicable for the ECUs till 2012)
• Make immobilizer bypass of the in the Flash (applicable for all ECUs)
• Fix the checksums in the flashing
• Clone the PIN/CS of and ECU (immo data section only of the EEPROM dumps is changed)

The Immo status can be:

• Normal (learned) – this is the normal operation mode of the engine control unit (i.e. adapted to the vehicle)
• Bypassed – This engine control unit has an “Immo bypass” and can start no matter whether the immobilizer recognizes the engine
• Virgin – This is a brand new engine control unit which was not build into a vehicle

The information about the PIN/CS/MAC can also be obtained if you have the EEPROM and Flash dumps from the engine control unit.

NOTE: For engine control units with installet TProt8 and higher, the procedure of reading is a little bit different. When trying to connect to them, after the initial connection the user should restore the boot pin to its original state (message box will indicate when to do this), then after some time the user should restore the boot pin (another message box will indicate this too).

2.5.7 Special function “Read EDC17/MED17 PIN/CS in direct mode”

The function is dedicated explicitly to read the PIN and CS of the EDC17/MED17 engine control units. With this function is possible to read even engine control units 2012+ which are with updated software and is not possible to read normally by OBDII. With this special function the EDC17/MED17 is not read through OBDII – you should have direct connection to the engine control unit. It is possible to make this on the table, you need to connect only 12V, GND, Ignition, CAN-H and CAN-L. It is possible to read the ECU also in the car, but you need to find the CAN-H (orange-black) and CAN-L (orange-brown) wires. So connect them to the AVDI and you will be able to read the engine control units.

2.5.8 Special functions with “DPF OFF”

This function will deactivate the DPF in the EDC16/EDC17 engine control unit flash dump. Abrites doesn’t warranty that the changes will not have some side effects, so use this function on your responsibility.

2.5.9 Special functions with “Simos PCR2.1”

This function is dedicated for reading the PIN/CS/MAC of the Simos PCR 2.1 engine control units.

The procedure of reading the Simos PCR engine control unit consist of 3 steps:

a) Unlocking the engine control unit.

These engine control units is possible to be read, only after the EEPROM is unlocked to the so called “developer mode”. These engine control units can be unlocked in two ways – by reading/writing the EEPROM with a programmer, or using boot-mode. The disadvantage of the reading/writing the EEPROM with a programmer, is that the EEPROM is found on the bottom side of the ECU and need to dismount the whole ECU shell, while the connection to the bootmode is much easier.

Unlocking of the EEPROM is made as follows:

• EEPROM (95640) is read with a programmer.
• With the button “Generate UNLOCKED Simos ConfData dump (95640) you generate a new dump
• Write this modified dump with a programmer.

Once the dump is written, the ECU is unlocked and you can continue with the procedure.

Unlocking through the boot-mode is made as follows:

Connect the ECU as shown on the wiring diagram.

Press “Lock/Unlock by boot-mode” button. If it is not possible to connect to the ECU, please try to make power-off/power-on of the ECU and try again

If the operation was successful, you can continue with the procedure.

With the button “Check ECU status” you can verify whether it is unlocked or not. If it is unlocked, then “ECU is unlocked and now can be prepared for reading” will become active. If the PIN/CS of the ECU was already read of the past and no additional preparation is required, then “ECU is already unlocked and prepared for reading” will be active.

NOTE: The customer has the ability to modify the automatic selection. This is so because the customer might want to update the ECU to another firmware than the original.

b) Prepare the ECU for reading. This is made by update of the SW of the ECU. For that reason the customer has to select the SW version to which he wants to update. The software has internal database of available software versions, from which the customer has to select. In the most cases the appropriate software is automatically selected. If it is not automatically selected, the customer has to select it manually.

NOTE: Selecting software with different VAG number than the current is useful only if you want to re-adapt the ECU to another vehicle. In this case update the ECU to a software with the same VAG number as the old ECU of the car, where you will put the new ECU. In all other cases it is recommended not to change the VAG number. If the VAG number to which you will update is the same as the original, but only the software version is different, then this is not a problem.

c) Once the engine control unit is prepared, the ECU can be read by OBDII. Once it is prepared, it is possible to proceed directly to the last step. It is also possible to read the PIN/CS/MAC from the “Immo parts adaptation” and “Engine control unit” special functions. But unlocking and preparing for reading can be made only from the “Simos PCR2.1” special function.

2.5.10 Special functions “Component protection”

As part of the security strategy, some parts of the modules build in the VAG vehicles, implement the so called “component protection”. This is a mechanism dedicated to prevent exchange of modules between different vehicles without central authorization from the VAG online database. Such modules placed in another vehicle activates the “component protection active” DTC and have restricted functionality. This special function allows to remove this “component protection active” trouble code and allows the module to work with its full functionality.

The component protection is first implemented in the A8 2003+ and in the A6 2004+ vehicles.

Component security is not implemented in all VAG vehicles.

There are actually two types of component protection – generation 1 and generation 2.

Component protection generation 1 is implemented in the A8 2003+ vehicles, while the A6/Q7/Allroad 2004+ use component protection generation 2 for most of the modules, and very few modules use component protection generation 1.

In the beginning you have to select which generation want to use:

2.5.10.1 Component protection generation 1

For the “Component protection - generation 1” you have to select the module which want to adapt and load the eeprom(ConfData) or flash dump:

Currently for most of the modules it is needed to read the internal EEPROM (for the MP3 CD Changer the internal flash) with a programmer first. If it is not necessary to read the flash, the “Load dump” to read flash or EEPROM will not be active and the user can proceed with the next step.

A8 2003-2010 only

If a module for A8 2003-2010 vehicles is selected, there is one additional step. You have to connect 3 wires from the AVDI DB25 connector to the vehicles – CAN-H, CAN-L and Ground. There is a wiring diagram on exactly how to connect them. The user has to splice into the organge/green (CAN-H) and orange/brown (CAN-L) wires. Additionally the GND and +12V should also be connected. The easiest way is to disconnect a connector (e.g. the connector of the module under the driver’s seat) and to place the two wires from the AVDI there. The ground of the AVDI can be connected to any metal part. There is also a picture with example on how to connect to these wires. After the wires are connected you need to press “Read component protection data”.

2.5.10.2 Component protection generation 2

This special function currently works with:

• Audi A6/Q7/Allroad 2004-2008. In these cars the customer is able to adapt completely by OBDII. Without any restrictions the component protection for the airbag, instrument cluster, comfort module and EZS-Kessy can be adapted. For the remaining modules with a component protection (e.g. DSP, Climate Control) you can adapt the component protection only if you have the Gateway EEPROM dump from the car from which the replacement module is removed.
• Audi A4/A5/Q5 2007-2014. In these vehicles the customer is able to adapt the instrument cluster.

IMPORTANT: For the A4/A5/Q5 2014+ models is strongly recommended to use the Generation 1 and 2 calculator option (Component protection > Generation 1 and 2 calculator). If the modules are in a virgin state it won’t be possible to adapt them using the Generation 1 and 2 calculator.

• Audi A6/A7/A8/Touareg 2010+. In these vehicles the customer is able to adapt the instrument cluster and the infotainment module(no need to read eeprom or flash of the modules) and the original dashboard and infotainment modules must be available for the procedure.

IMPORTANT: If the original dashboard and infotainment modules are not available(A6/A7/A8 2010+) the adaptation should be done from Generation 1 and 2 calculator option (Component protection > Generation 1 and 2 calculator). If the modules are in a virgin state it won’t be possible to adapt them using the Generation 1 and 2 calculator.

When the special function “Component protection generation 2” is started the system is examined and all modules with available component protection are displayed.

From the displayed list of available modules, the customer has to select the module which they want to adapt. Then the procedure of adapting the component protection is performed in two steps:

• Reset to virgin state
• Learn module to the vehicle

2.5.10.2.1 Reset to virgin state

Reset to virgin state is performed in three ways:

• by reading the module by OBDII (available for instrument cluster, airbag, comfort module and EZS-Kessy),
• by loading the module EEPROM dump (available for airbag and EZS-Kessy)
• by loading the gateway EEPROM dump from the car from which the module is taken (where it was originally built in).

The customer has to select from the following dialog in which way they want to proceed:

2.5.10.2.2 Learn module to the vehicle

To learn the module to the vehicle it is necessary to have the Gateway EEPROM dump from the car on which you install this module.

You have the option to read the Gateway EEPROM dump manually with a programmer, or to read it by OBDII. Reading by OBDII normally takes about 3-4min, but requires a module reflash. If the gateway is once reflashed, further operations of the EEPROM reading do not need a reflash.

So the customer has the option to select whether they want to read the EEPROM dump by OBDII, or to read it with a programmer. If they select reading it by OBDII, then the next dialog displays the status of the operation.

Once the EEPROM data are read/loaded, the adaptation of the component protection is performed. Once this step is completed successfully, the module should be fully functional.

2.5.10.3 Component protection “Manually set the component protection bytes or load the by ConfData dump

Using this function you have the option set the CP data manually either by entering the CP bytes or extracting them from a ConfData dump.

The procedure goes in three steps:

1. Enter the CP bytes or extract them from a dump(of the donor vehicle) > Press “Use the CP as current CP”

2. Enter the CP bytes or extract them from a dump(of the host vehicle) > Press “Use the CP as desired CP”

3. Press “Adapt module to vehicle”

2.5.11 Special functions “Immo parts adaptation”

This special function is dedicated to adapting a virgin or to reuse a “second-hand” immobilizer parts (e.g. engine control units, immobilizer (Kessy), transmission gear box) from one vehicle to another. In general some Immo III parts (e.g. the earlier EDC16 and ME7 and all EDC15) allow to adapt parts using only a PIN code and adaptation on channel 50.

However for the VW/Seat/Skoda starting from 2007, and for Audi models starting from 2003/2004 this is not possible. This special function is dedicated exactly for these parts which do not support the channel 50 adaptation. E.g. For engine control units this includes not only the Bosch EDC16/MED9, but also EDC17/MED17, and also Siemens VDO (Simos PPD and Simos 9.x/6.x/7.x) engine control units.

When the function is selected, the customer has to choose what part to adapt. There are the following possibilities:

• Engine control unit
• Audi A8, VW Touareg/Phaeton, Porsche Cayenne or Bentley continental immobilizer (Kessy)
• Passat B6/CC immobilizer (comfort module)
• Transmission gearbox for Audi A6/Q7/Allroad 2003+

2.5.11.1 Adapting engine control units

To adapt an engine control unit to the car you need the following:

If the engine control unit is virgin, you should only put the new CS (6 or 7 bytes) and new PIN code. You can read them from the immobilizer, or from the old ECU if it is present.

If the engine control unit is used, you need the existing CS and PIN of this “secondhand” engine control unit, plus the new CS and new PIN code.

When starting this special function the following dialog is displayed:

For EDC16/MED9/ME7/EDC17/MED17 and Simos PPD engine control units the customer can press “Read” directly and the old CS/PIN are displayed. If the engine control unit is a virgin state, this is automatically detected.

After the successful read of the existing data, they are filled automatically in the field below.

Please pay attention that the 7th byte of the CS is not required here.

Pressing the “Read button” will read the power class, existing PIN/CS, also VIN and immobilizer number.

Also after successful reading the fields for the CS/PIN, VIN and Immo-number will become active and the customer might specify the values they want. Please pay attention that the “power class” for the engine control unit is displayed. This is a very important value which is stored inside the engine control flash and cannot be changed. This value should be the same for the engine control unit and the immobilizer, this means that if the old (broken) engine control unit is from one power class, and the new one is from another, the car will not start, even if the adaptation procedure was completed. The meaning of the power class value is to prevent putting one engine control unit from for example a 3.0TDI to a car with a 2.0TDI.

2.5.11.2 Adapting Audi A8, VW Touareg immobilizer (Kessy)

This special function is dedicated to adapt “second-hand” immobilizers from one vehicle to another. In general the earlier VW Touareg/VW Phaeton/Porsche Cayenne/Bentley continental allow to adapt the immobilizer using only PIN code and adaptation on channel 50.

But A8 and later VW models (after 2007) require to use this special function.

To adapt the immobilizer to the car you need the existing PIN and CS of the “second-hand” immobilizer. You can extract it by reading the EEPROM dump of the second-hand module, or if you have the engine control unit from the car from which you have taken the replacement (second-hand) module.

When starting this special function the following dialog is displayed:

So you need to load the EZS-Kessy EEPROM dump, or to enter the PIN and CS of the second hand module manually.

ATTENTION: You should know the power class of the engine control unit before you execute this function! After pressing the read button, the customer has to enter the power class manually. If you enter the wrong power class and this is a working vehicle (i.e. ECU and Immobilizer are adapted), the car will stop

working. It will start working again only if you put the correct power class in the beginning of the procedure. This is so because the Immobilizer (Kessy) will take the power class you enter.

ATTENTION: If you put the CS manually (i.e. you put 6 bytes of the CS) and there is a working key for the immobilizer (Kessy), after finishing with the reading, the Kessy will no more recognize the key. To start recognizing it again, you should put the 7th byte and press “Change”.

2.5.11.3 Adapting comfort module on Passat B6/CC

This special function is dedicated to adapting “second-hand” immobilizers from one vehicle to another. To adapt the immobilizer to the car you need the existing PIN and CS of the “secondhand” immobilizer. You can extract it by reading the EEPROM dump of the second-hand module, or if you have the engine control unit from the car from which you have taken the replacement (second-hand) module.

When starting this special function the following dialog is displayed:

So you need to load the Comfort module EEPROM dump, or to enter manually the PIN and CS of the second hand module.

ATTENTION: You should know the power class of the engine control unit before you execute this function! Normally the power class of the comfort module is displayed automatically if you load the comfort module dump. Then you are able to change it (if the ECU has different power class). If you enter a wrong power class and this is a working vehicle (i.e. ECU and Immobilizer are adapted), the car will stop working. It will start working again only if you put the correct power class in the beginning of the procedure.

This is so because the Immobilizer (Comfort module) will take the power class you enter.

ATTENTION: After the reading is finished, any working keys will stop working and should be re-learned to make them working again.

NOTE: This special function can also be used for key-learning. If you have the comfort module dump, you can load it here and all 7 bytes of CS will be displayed. Then the customer can make a dealer key using these 7 bytes.

2.5.11.4 Adapting Transmission gearbox on A6/Q7/Allroad

This special function is dedicated to adapting used transmissions from one vehicle to another. To adapt the transmission you need the existing PIN and CS of the used gearbox. You can extract it by reading the EZS-Kessy or engine control unit from the donor car. Without having the PIN/CS of the transmission, you cannot adapt using this method. In that case you will need to apply the technique using EM003.

The below screenshots show what the procedure looks like:

1. Select the ECU option from the “Immo Parts Adaptation”

2. Autodetect the IMMO Data from the ECU and save it

3. Enter “Immo Parts Adaptation” and select Transmission A6

4. Either load a dump file or enter the donor TCU immo data

6. Press “Update” after entering the desired IMMO Data

2.5.11.5 Adapting EZS-Kessy on A6/Q7/Allroad

This special function is dedicated to adapting a “second-hand” EZS-Kessy from one vehicle to another. To adapt the EZS-Kessy you need the existing PIN and CS of the used EZS-Kessy or the PIN and CS of its ECU. You can extract it by reading the EZS-Kessy with a programmer and saving a dump file on your PC which can later be loaded into the software. These PIN and CS will later give you access to the unit, allowing you to change the immo data and write the data you need. The screenshots below will show what the procedure looks like:

3. You can load the donor EZS-Kessy dump if you have it

5. Pressing “Read” after entering the data manually will display a prompt:

1. Reading the PowerClass, CS and PIN from the ECU

4. If you have the donor IMMO data you can enter it instead

2. Enter “Immo Parts Adaptation” and select “EZS-Kessy”

2.5.11.6 ECU/TCU exchange using ZN051 DS Box and EM003 (IMMO III/IV EMU)

Exchanging an engine control unit/ transmission control unit in VAG vehicles using a distribution box and

an Abrites Emulator (IMMO III/IV EMU)

This procedure is used when you need to replace any immo module with an Emulator. The goal is for the

Emulator to emulate an Engine Control Unit or Transmission Control Unit in the IMMO system. Often times the CS and PIN of the ECU or TCU cannot be read(without opening the control unit) so you can use

an emulator instead.

In the cases when you need to replace ECUs/ TCUs in VAG cars you can emulate the immo section so as to allow the module to work without the need of a complex adaptation. The function applies to the transmissions of Audi A6 2003-2010, Audi Q7 2005-2015, Audi A8 2003-2010, and for all Immo III/IV engine control units (EDC16/EDC17/ME7/MED9/MED17/Simos benzin/Simos PPD/Simos PCR/Magneti Marelli/Delphi)

The function allows you to build immo-related parts in other vehicle, even when the brand or power different.

1. The first step is to ensure the PIN and CS are read from the ECU (example using EDC17 in diagnostic mode):

(screenshot 1, 1-1 and 1-3)

You could try reading the PIN and CS from Immo parts adaptation > Engine Control Unit as well.

2. You then need to go to IMMO PARTS ADAPTATION and go to IMMO III/IV EMU.

(2-1)

2.a Input the data you read from the ECU:

(2-2)

2.b.Press OK and make sure that the Emulator is connected to the internal CAN-BUS of the vehicle(it is also possible to connect through the DS box during the procedure):

(2-3)

RED - CAN Hight

BLUE - CAN Low

YELLOW - B+

BLACK - GND

2.c Select the unit you need (in our case this will be the master ECU):

(2-4)

2.d The procedure starts. Make sure you have internet connection and some patience.

(2-5)

2.e It is a matter of waiting for the calculation to complete (N.B. make sure you have a power supply on the

car).

(2-6) and (2-7)

You could also write manually the immobilizer data in the ECU/TCU by selecting Immo parts adaptation > Immo III/IV Emulator Write Data

2.5.11.7 Read MM 9GV PIN/CS with DSBox (Immo III/IV cars)

The function allows reading of PIN and CS from Magneti Marelli 9GV ECUs that are not supported for immo data reading via OBD or Boot Mode. The procedure can take 30mins - 4hrs. If the ECU is to be adapted, the user can take its immo data (PIN/CS1) and write it to the cluster. This will require the keys to be re-learned. There are ~30 versions of the software and the user can select the version from the ECU function. DSBox and active AMS are required as well. The screenshots below show what the function looks like:

2.5.11.8 IMMO III/IV authorize ECU (for bench flashing)

If the user is working on bench in an ECU without the cluster connected, the ECU cannot be flashed using an FRF file. If the ECU is authorized, writing the FRF flash file is possible and this is exactly what the function does. Once started, the procedure July last 30mins-2hrs and once finished, the ECU will be authorized (as if IGN is turned ON with a working key), which will allow the FRF flashing to be done. The screenshots below show what the procedure looks like:

2.5.11.9 IMMO 3/4 ECU/TCU PIN and CS

This function will read the PIN and CS for engine control units and transmission control units from the Immo III and Immo IV generation.

These are the CAN-Bus vehicles from about 2003 to 2014.

You can read the PIN/CS of the engine control units from the special functions > Engine Control Unit > Engine control unit Immo III/IV calculate CS or from Immo 3/4 parts adaptation > Engine control unit Immo III/IV calculate CS

You can read the PIN/CS of the transmission control unit from special functions > Immo 3/4 parts adaptation > Transmission control unit Immo 4 calculate CS

When the function is started, the connection to the control unit is established and the required data are read from there. It is necessary to have connection only with this module, not necessary to have the whole vehicle connected. I.e. this means that you can do this on the bench.

After the connection to the control unit is established, data are read and send to server.

When the calculation is finished, the PIN/CS will be displayed:

IMPORTANT: If the module (engine control unit or transmission) is not in its original state (e.g. the PIN/CS were already changed with some after market tool), the calculated data might be wrong.

IMPORTANT: The function does not work for Immo V vehicles such as MQB, MLB, BCM2 vehicles.

2.5.11.10 MQB Immo Data (allows immo data change in the MQB cluster)

The MQB Immo Data function allows the immo data of the MQB cluster to be read, saved and another MQB cluster to be updated with the same data so it can be adapted. (The donor MQB cluster needs to have a working key so it can be unlocked before the adaptation. The cluster needs to be the same as the original to avoid issues). Once the new cluster is adapted with the new immo data, the original keys will continue to start the car but the remote won’t work. The keys can be re-learned so that the remote can function once again. The screenshots below describe the functionality:

2.5.12 Special functions “Immo V adaptation”

The function is dedicated to adapt engine control unit, BCM2 unit or a TCU on the A4/A5/Q5/A6/A7/A8 vehicles.

2.5.12.1 Adapting engine control unit

To adapt the engine control unit you need to know the existing immobilizer data of the ECU. There are three possibilities how can you get this data and adapt the ECU:

• By OBDII. Not all engine control units are able to be read by OBDII
• By flash/EEPROM dump
• By manuall entering the CS and PIN of the donor car ecu (car)

NOTE: Some engine control units don’t support the possibility to change the immobilizer data by OBDII. In such cases the procedure for adapting the ECU is finished with success, but the car is not starting. In such cases, it is necessary to make modification in the ECU EEPROM using boot mode. First need to use the “Clone ECU” function where to prepare the ECU EEPROM, then write it, then use the function for the synchronization of the ID only.

2. Load the immo data followed by the corresponding model

2.5.12.1 Adapting engine control unit

To adapt the engine control unit you need to know the existing immobilizer data of the ECU. There are three possibilities how can you get this data and adapt the ECU:

• By OBDII. Not all engine control units are able to be read by OBDII
• By flash/EEPROM dump
• By manuall entering the CS and PIN of the donor car ecu (car)

NOTE: Some engine control units don’t support the possibility to change the immobilizer data by OBDII. In such cases the procedure for adapting the ECU is finished with success, but the car is not starting. In such cases, it is necessary to make modification in the ECU EEPROM using boot mode. First need to use the “Clone ECU” function where to prepare the ECU EEPROM, then write it, then use the function for the synchronization of the ID only.

2.5.12.2 Adapting BCM2

To adapt BCM2 module it is necessary to have the old one, and the new. First the old one should be connected in order to be read, then the new one is connected.

NOTE: It recommended before adapting the new BCM2 module, first to disable the ELV. This is made when you connect the original BCM2 and use the “BCM2” special function with the “Re-adapt BCM2 function” - there put the same VIN without changes, but when asked whether you want to disable ELV, answer with yes. After the new BCM2 is adapted, you can restore the ELV using the same procedure.

2.5.12.3 Adapting Transmission gearbox (A4/A5/Q5 2008+ and A6/A7/A8/)

This function is dedicated to adapt the transmission control unit (TCU) to the immobilizer (BCM2).

For that purpose is necessary first to read the TCU. The TCU is not possible to be read by OBDII, but is possible to read it when you connect the TCU on the table, or when you connect the AVDI to the internal CAN-Bus of the car.

To read from the internal CAN-Bus, find the orange/black and orange/brown CAN wires and

make the following connection of the AVDI:

• Orange/black <-> CAN-H (PIN6 of the OBDII)
• Orange/brown <-> CAN-L (PIN14 of the OBDII)
• Ground <-> GND (PIN4 of the OBDII)
• 12V <-> 12V (PIN16 of the OBDII)

The adaptation of the TCU goes in three steps, and during these steps connection to internet is necessary.

On the first step you need to read the TCU (with the connections described above). Once the TCU is read, you can connect the AVDI to the OBDII and proceed with the adaptation. Here is possible to use the so called “read from cache” which reads actually from the cache memory the last successfully read data for this TCU.

On the second step it is necessary to read the BCM2 module, the user has nothing to do than just to press “Next”

On the third step the TCU and BCM2 are synchronized and car can be started. If the ID of the TCU and the BCM2 is different, it will be synchronized too.

2.5.12.4 Adapting Electronic steering lock (ELV)(A4/A5/Q5 2008+ and A6/A7/A8 2010+)

This function is dedicated to adapt the electronic steering lock (ELV) to the immobilizer (BCM2).

ATTENTION: It is possible to adapt ELV from one car to another with some constraints:

• For A4/A5/Q5 – if you have the BCM2 (flash or immo data dump) from the car, from where you take the replacement ELV
• For A6/A7/A8/Touareg – if you have the BCM2 (flash or immo data dump) from the car, from where you take the replacement ELV, and a working key from the car, from where you take the replacement ELV

The procedure of adaptation is going on several steps:

Step 1 – it is necessary to select the car model from which you get the ELV. If the model is A4/A5/Q5, you will need only the BCM2 dump. If the model is A6/A7/A8/Touareg, you will need to read the working key (from car from where you take the ELV) in the programmer too. See picture below which shows the options when A4/A5/Q5 is selected.

• Step 2 – Read the BCM2 to which you want to adapt. Normally this is done by OBDII without user interaction
• Step 3 – Synchronize the BCM2 and the ELV. This steps also do not require and user interaction After completing these three steps, the ELV should work.

2.5.13 Special functions “Theft protection”

This function is dedicated to disable learning of additional keys for a vehicle by OBDII. This function is only relevant to OBDII functions. This protection can be installed or removed – but for both operations you need to have a working key. If the protection is installed and all keys are lost, you might need to read the immobilizer with a programmer. For the moment the following protection can be installed:

• A6/Allroad 2005-2010, Q7 2005-2014
• A4/A5/Q5 2007+, A6/A7/A8/VW Touareg 2010+
• Almost all VDO dashboards with NEC+24C32/24C64 EEPROM

2.5.14 Special function “Steering lock adaptation”

This function works with a NEW steering rack ONLY or if the original is out of sync.

The window “Steering lock adaptation” can be used for adaptation of steering lock control module to the VW Touareg/Phaeton/Porsche Cayenne/Bentley Continental/Audi A8. This adaptation can be by CAN TP2.0 or K-KWP2000.

To perform this adaptation you need to know the security access code of the immobilizer and working (aligned) key from the car.

2.5.15 Special function “MMI-TV configuration”

Using this special function you can change speed limit of MMI compatible vehicles to change the speed at which the TV is turned OFF.

Covered vehicles are:

• Audi A3/S3
• Audi A6/S6 (MMI up to July 2006)
• Audi Allroad (MMI up to July 2006)
• Audi A8/S8 (MMI up to July 2006)
• Audi Allroad (MMI up to July 2006)
• Audi A6/S6 (MMI starting from August 2006)
• Audi Allroad (MMI starting from August 2006)
• Audi A8/S8 (MMI starting from August 2006)
• Audi Allroad (MMI starting from August 2006)

Use the following rule when enabling TV:

• if the car is built before 2007 try with edition 1. In case you do not succeed wait with ignition ON for more than 30 minutes and then try with edition 2.

If the car is built after 2007 it is better to try edition 2 first.

2.5.16 Special function “Custom memory access Download/Upload/ReadMemory”

The “Custom memory access Download/Upload/ReadMemory” functionality is available from the “Special functions” list, but also it is available in the standard diagnostic dialog. The functionality is the same on both places with that difference, that in the standard diagnostic dialog the user should open the diagnostic connection, perform security access, enter into diagnostic session prior to starting the custom read/write. When this functionality is opened from the “Special functions” list, these actions are automated and performed from the “ABRITES Diagnostics for VAG”.

Using this application you can read/program memory in some electronic control unit. Requests sent from this application can be related to the currently running session of some of the electronic control units from the dialog.

You can use this application for many different purposes – investigations, read/program flash memories (for example you can program by this dialog internal flash memory of an EDC16).

In the example below we read a part of the flash of EDC16CP

In this dialog it is needed to clarify the diagnostic session which you want to be entered before starting of the read/program memory.

In the example above we use session “86”.

If you want to save currently running diagnostic session simply enter session “0”.

2.5.17 Special functions with “Airbag”

With this special function one can:

• Read/Write EEPROM memory of an airbag module
• Clear the crash data of an airbag module

For some airbag models it is not enough to clear the trouble codes (using “Clear DTCs” diagnostic request) and the crash data stored into device’s EEPROM should also be cleared.

For some models (see “Covered units:” below) crash data can be automatically cleared (using the “Clear crash data” function) from the device’s EEPROM, but for some models the user has to do this by hand (read EEPROM memory (using “Read EEPROM” function), find where the crash data is stored, change data, write EEPROM memory back (using “Write EEPROM” function).

Covered units:

Read/Write EEPROM:

1. All Siemens CAN Airbags 2003-2008 like 4F0959655B (Audi A6/Q7/Allroad 2003-2008), 1K0909605AB, 1K0909605C, 1K0909605AD, etc...

2. K-Line Airbags (Siemens and Bosch) - 1C0 909 605 C, 8L0 959 655 A, 1J0 909 609, 6Q0 909 605 C,6Q0 909 605 A, 6Q0 909 605 B, 3B0 959 655 B, 1C0 909 605 F, 1C0 909 605 H, 1J0 909 607, 1J0 909 603, 4B0 959 655 C, 4B0 959 655 J, 4D0 959 655 C, 8L0 959 655 F,8A0 959 655 C, 8A0 959 655 K, 8A0 959 655 K, 4D0 959 655 H, 8D0 959 655 C, 8D0 959 655 L

Clear crash data:

K-Line Airbags (Siemens and Bosch) - 1C0 909 605 C, 8L0 959 655 A, 1J0 909 609, 6Q0 909 605 C,6Q0 909 605 A, 6Q0 909 605 B, 3B0 959 655 B, 1C0 909 605 F, 1C0 909 605 H, 1J0 909 607, 1J0 909 603, 4B0 959 655 C, 4B0 959 655 J, 4D0 959 655 C, 8L0 959 655 F,8A0 959 655 C, 8A0 959 655 K, 8A0 959 655 K, 4D0 959 655 H, 8D0 959 655 C, 8D0 959 655 L

2.5.18 Special function “VW Crafter”

This special function gives the possibility to:

• Read the engine control unit’s EEPROM together with the PIN code and component security
• Read and modify mileage of the engine control unit
• Turn the immobilizer ON/OFF
• Learn keys with prepared transponders
• perform diagnostic on the engine control unit and the immobilizer.

NOTE: It is only possible to connect to the engine control unit and immobilizer for VW Crafter vehicles. To connect to any other device you will need the ABRITES Diagnostics for Mercedes.

Starting this special function brings the following dialog:

From these buttons it is possible to perform the following actions:

• When pressing “ECU EEPROM” the same dialog as in the “Engine control unit” is brought to the user and it is possible to read EEPROM, read mileage and bypass the immobilizer from here. You do not need to select any engine type, it is done automatically
• Pressing “Key learning” will bring the “Key learning” dialog, the user is not required to select a model, it is selected automatically

• “Engine control unit diagnostic” will perform a standard diagnostic (reading identification, trouble codes, etc.) to the engine control unit.
• “Immobilizer diagnostic” will perform a standard diagnostic (reading identification, trouble codes, etc.) to the immobilizer.

NOTE: If the car doesn’t have any working key it is not possible to turn ignition ON, respectively to get communication with the engine control unit over OBDII because the gateway (the EZS in this case) is not gating the CAN messages to the engine control unit if no valid key is recognized. So if you have a car without any valid key, you will need dismount the ECU and connect it on a table, or to connect the CAN wires of the ECU directly to the interface.

NOTE: For the key-learning it is needed to turn ignition ON with the valid key before starting the procedure. If there is no valid key, simply put the key into the ignition lock, the key-learning procedure will take about 5 minutes in this case. When the procedure is finished you will need to turn ignition ON with each key which you want to learn.

NOTE: Sometimes during communication with the immobilizer it is possible to lose communication with it, so you will need to repeat the procedure.

2.5.19 Special function “Dump Tool

Using this application you can calculate security access codes, calculate mileage and others.

This application needs the EEPROM dump from the corresponding unit. After the dump is loaded modifications will be made and you need to store the dump as a new file, which you can program into the device afterwards.

For more details about these functions, please refer to the appendix.

2.5.20 Special function “Service Interval”

Using this application, you can reset the service reminder, reset the service interval parameters or change service interval options.

With the opening of the special function window, the software will connect to the instrument cluster and read the available information concerning the service interval function.

Depending on the vehicle model, year, etc. you will have “Service reminder reset” or/and “Service interval reset” or/and “Change service options” sections enabled.

Together with these sections in the section “Applicable adaptation channels” you will see the adaptation channels whose values will eventually change if you select one of the listed above three operations, with their current values, units and short description.

When the read information is first loaded and also when certain options within the window are changed, the column “New value” of the “Applicable adaptation channels” table will be automatically filled with the default values that should be stored into the respective adaptation channels related to the chosen options.

The applicable (and available) adaptation channels from column “New value” are also available for editing, so the user might put any values there.

2.5.21 Special function “Remote control adaptation”

Using this application, you can learn remote controls.

With the opening of the special function window, the software will connect to the applicable for the vehicle control unit and read any available information related to the remote controls adaptation.

In the “Instructions” window, within the “Remote adaptation” section” directions what should be done to learn remote controls will be available.

Additionally, there might be an “Additional settings” table, where all the applicable adaptation channels with their current values and description which are related to the remote controls function will be listed. You can select the desired settings and press button “Change” to save them.

• This function is available for:
• Audi A3/S3 1997+
• Audi A4/S4/RS4 1995-2008
• Audi A6 1997 - 2006
• Audi TT 1999+
• Seat Exeo 2009+

• Seat Leon 2006+
• Seat Altea 2004+,
• Seat Toledo 2005+
• Skoda Octavia I 1997+
• Skoda Octavia II 2005+
• VW Caddy 2004+
• VW Eos 2006+
• VW Jetta 1998+
• VW Golf/Bora IV 1998+
• VW Golf/Golf Plus/Bora V 2004+
• VW Golf/Golf Plus/Golf Variant 2009+
• VW Touran 2003+
• Skoda Fabia 2007+
• VW New Beetle/Cabriolet 1998 - 2010
• VW Fox/Spacefox/Sportvan/Suran 2005+
• VW Passat 1997 - 2011
• VW Transporter 1997 - 2009
• VW Tiguan 2007+

For Audi A8, VW Touareg, VW Phaeton, Bentley remote controls are learned with the “key

learning” special function.

2.5.22 Special function “Navigation”

Using this application, you can enable/disable the “Eject” button of the “Navigation” system, eject the navigation CD/DVD holder and set “tire circumference” value applicable for the navigation controller function.

2.5.23 Special function “Cruise control system”

Using this application, you can activate/deactivate the cruise control system and change the related steering wheel electronics( SWE) configuration if SWE unit is available.

With the opening of the special function window, if SWE unit is available, the software will read and display it’s current configuration.

After the “Activate Cruise Control” or “Deactivate Cruise Control” button is pressed this will activate/deactivate the cruise control system function and apply any changes of the SWE configuration to the SWE unit.

2.5.24 Special function “Brake pads change”

Using this application, you can “Open rear parking brake for pad change”, “Close rear parking brake”, perform “Parking brake function test”.

This function is available for the following vehicle models: Audi A8 2004+, Audi A6/allroad 2005+, Audi Q7 2009+, VW Passat B6 , VW Tiguan 2009+.

For vehicle model Audi A8, it is also possible to set the pad thickness.

2.5.25 Special function “ECU Exchange – Dump Tool”

Using this application you can change the EEPROM dump of an engine control unit, so that after it is programmed into an ECU, the ECU can be adapted to a vehicle.

You need to read both the EEPROM dump of the engine control unit that is currently in the vehicle (application name: “active ECU”) and the EERPOM dump of the engine control unit with which you wish to replace (referred to as “replacement ECU”).

After opening the application, load both dumps (using buttons “Load active ECU dump” and “Load replacement ECU dump”). Press “Change replacement ECU dump” to do the needed modifications in the replacement ECU dump. Press “Save replacement ECU dump” to save the modified dump into a new file, which you can program into the device later on

2.5.26 Special function “Door unlocking”

This function is dedicated to opening car doors when the car is in SAFE mode.

To use this function you will need to connect some Pins of the DB25 interface of the AVDI with cables to the wiring of the car manually.

You have to find the desired wires in the car – orange with green (CAN-H) and orange with brown (CAN-L), and you have to connect them to OBDII connector PIN6 (CAN-H) and OBDI Connector PIN14 (CAN-L). Also you have to connect OBDII Connector PIN4 (Ground) to a metal part of the car.

After you are ready you can call the “Unlock doors” special function. The following dialog will be displayed:

So for any of the desired model you will have to press the appropriate button.

ATTENTION: In most cases this only opens the doors. It doesn’t disable the alarm!

12V Electric current should also be supplied for a later HW model.

2.5.27 Special function “Coding calculator”

Using this function you can calculate long code coding value of different modules.

When you open the special function the following window appears:

In the opened window you can check/un-check the desired features (see list with check-boxes in the above picture, modify certain value (see the list with the two columns (text and value) in the above picture) or select certain value by combo-box selection.

Check “Select all” check-box to mark as checked all the check-boxes from the check-boxes list.

The coding value is represented into the edit field at the bottom of the window (next to button “Show Coding Value”).

When a certain item is changed this is automatically reflected into the coding value.

If you would like to see certain coding value “meaning”, you should write down the value into the edit field and press button “Show Coding Value”.

2.5.29 MQB ECU and TCU adaptation

In order to adapt the ECU or TCU you need to get the CS of the control unit from the donor vehicle and to have a working from the host vehicle.

• ECU adaptation - in order to extract the current CS of an ECU you need to read its Data Flash and Program Flash(external/internal) and load them in the Engine Control Unit special function > EDC17/MEDC boot mode > Get PIN/CS from dump.

Once you get the current CS of the ECU you need to check what should be the new CS that has to be written to the ECU, this is done through CAN instrument special function > VDO based on MQB platform > Immo data . The new CS that you have to write to the ECU will be displayed when you go to the Configuration options > select ECU > select Show CS > Put a working key into your PROTAG programmer and the new CS will be displayed.

All you need to do then is to select “Adapt module to immobilizer” and insert the current (old) CS of the ECU and the new CS.

• TCU adaptation - the procedure is the same as for the ECU adaptation but the only difference is that you have to extract the current CS following the procedure described in chapter 2.5.28 from Immo V adaptation special function > Transmission control unit > MQB platform.

2.5.30 Read MQB transmission control units - Read CS, Clone/Restore

This function allows the user to read the MQB TCU immo data- CS and to clone or restore the TCU.

4. Read the Immo Data and proceed with the change *

2. Followed by Transmission control unit and MQB Platform

2.5.31 Manual Adaptation for Immo V cars -Engine control unit, Transmission control unit, Steering lock

This function allows the adaptation of ECU, TCU and ESL in Immo V cars (BCM2 cars and MQB cars) .

In order to use this function you have to open the “Immo V adapt manual” special function and insert the

current Component security bytes of the module, the new Component security bytes, the Power class. The MAC synchronization will be done automatically after inserting the Component security bytes of the immobilizer

2.6 MQB clusters bench wiring diagrams using ZN058

Below you can find the most common types of MQB clusters that can also be read on bench using the ZN058 Abprog adapter

2.7 Force ignition in MQB cars

In some MQB-based cars you can force the IGN to the ON position using a bridge between 3 pins on the

Keyless Entry Module connector that is to be found under the plastic cover right below the steering wheel. This will allow you to communicate with the car:

1. Bridging the pins marked in yellow will force IGN on in the car

2.8 “Key learning”

Inside every key there is a small chip called a “transponder”. In most cases this chip does not require an external power supply, it is supplied by a magnetic field, which induces an electric current. The immobilizer recognizes whether a proper key is used to start a car exactly by using the transponder. With the evolution of the VAG cars the transponder type and the records inside it have changed. In general, there are five different types of immobilizers/transponders used.

They are called Immo I, Immo II, Immo III, Immo IV and Immo V. Systems from ImmoI up to Immo III require that a transponder from the appropriate type is located inside the key, and they are able to learn these transponders.

Starting from Immo III it is required that the transponder is from the proper type, but also has some specific records inside it. Only transponders with such correct records can be learned.

According to the data inside there are the following types of transponders:

• Tp22 – dedicated for use in Seat vehicles;
• Tp23 – dedicated for use in Volkswagen vehicles;
• Tp24 – dedicated for use in Skoda vehicles;
• Tp25 – dedicated for use in Audi vehicles (especially A3 and A4);

Such transponders can be used in all cars of the specific manufacturer (e.g. Tp24 can be used for all Skoda models);

The lastest immobilizer systems Immo IV and Immo V require that the transponder is programmed with a specific code, and this code depends on the VIN number and is unique for each car. Normally, only the car manufacturer can deliver such keys and they are called “dealer keys” (because only the dealer can supply them). But the ABRITES Diagnostics for VAG is also able to pre-code the transponders/keys so they becomes the same as the ones purchased from the dealer.

2.8.1 Key-learning procedures

Normally, there are several key-learning procedures which are applied depending on the car type and year of production. You can check in the appendix section which car belongs to which key-learning procedure.

All key-learning procedures are listed below:

Procedure 1 – Normal key learning procedure – for vehicles from 1996 to 09/2006 year via K-line.

Learning of a transponder/key to the car requires only the PIN code and after the key-learning procedure (actually adaptation on channel 21) is finished, it is necessary to turn ignition ON with each key you want to learn. No preparation of the transponder/key is needed, instead a new transponder/key should be used.

You must use the following Keys or transponders – TP05,TP08

Note: some of the new vehicles need to remain with the ignition ON for five minutes before starting the key learning procedure (VW Golf5, Skoda Octavia II, VW Touaran, Seat Toledo 2004+,...). Other vehicles might need to stay more than 30 minutes with the ignition ON until programming becomes allowed (Skoda Fabia 2006+, Skoda Roomster 2006+, Skoda Superb 2007+, VW Polo 2006+, Seat Ibiza 2006+)

Procedure 2 – for CAN vehicles till 09/2006 year – VW, SEAT,SKODA via CAN

Learning of a transponder/key to the car requires only the PIN code and after the key-learning procedure (actually adaptation on channel 1) is finished, it is necessary to turn ignition ON with each key you want to learn. No preparation of the transponder/key is needed, instead a new transponder/key (TP22/TP23/TP24 depending on the type of the car) should be used.

For SEAT you must use a Virgin key or a Transponder – TP22,

For VW you must use a Virgin key or a Transponder – TP23

For SKODA you must use a Virgin key or a Transponder – TP24

Procedure 3 – for VW/Seat/Skoda CAN vehicles 2006+, Passat B6, Audi A3 CAN

Learning of a transponder/key to the car requires only the PIN code and after the key-learning procedure (actually adaptation on channel 11) is finished, it is necessary to turn ignition ON with each key you want to learn. Preparation of the transponder/key is needed (so called dealer key) using the component security (CS) and the car type (VW/Seat/Skoda/Audi).should be used.

Procedure 3.1 – Extracting the 7th byte using TA26 Sniffer (mainly used in VW Passat B6)

Using the TA26 Sniffer, you will be able to extract the 7th byte in a matter of seconds. The procedure below describes all the steps to be performed.

3. Select “Automatically trying to find the 7th

byte” and insert a blank key into the programmer:

2. Open the “Key Learning” Special function and click on “Autodetect Login/Security code” and read the 6 Bytes on the next screen”

7. You will be prompted to put the TA26 Sniffer again into the PROTAG programmer:

6. The following image will show you how the TA26 should be positioned towards the IGN lock:

9. The 7th byte was found and you will be prompted to insert either a transponder or a blank key into the programmer to program it:

4. You will be prompted to insert the TA26 sniffer into the programmer:

5. Remove the key from the programmer and make IGN ON together with the TA26 programmer:

Procedure 4 – for Audi A4 (RB8)

Audi vehicles equipped with an instrument cluster BOSCH RB8 with integrated immobilizer require a pre-coded key (using the 12 byte CS). Using this procedure the data necessary for the preparation of the transponder/key are read from the immobilizer automatically. Also the PIN code needed for the key-adaptation is read automatically.

Procedure 5 - For vehicles with Hitag2 Key (transponder) – VW Touareg, VW Phaeton, Bentley Continental, Porsche Cayenne, Audi A8

Learning of a transponder/key to the car requires only the PIN code and after the key-learning procedure (actually adaptation on channel 1) is finished, it is necessary to hold each key in CRANK position until the steering is unlocked.

For vehicles till 2007 you must use a virgin transponder PCF7936 or a virgin key, no need for other special preparation. If you use a Transponder – you only needed to switch it in Cipher (Crypto) mode. You can use your Key programmer for that purpose if you have one. This is done by replacing 0x06 with 0x0E in the first byte of the configuration page (Configuration page is page 3 where page 0 is the transponder ID, and pages 1 and 2 are the secret key). If this value is already 0x0E then the transponder is already in cipher mode.

For vehicles after 2007 and Audi A8 2002+ the transponder should be pre-coded using the CS.

Procedure 6 – for vehicles Audi A6,Q7,Allroad 2005+

For these vehicle there is a separate special function called “EZS-Kessy A6/Q7” where the keylearning

procedure is performed. Megamos 8E based transponder/key is used which is precoded using 12 byte CS. The key-learning procedure starts adaptation of the this transponder/key and the user should give ignition on with each key.

Procedure 7 – UDS dashboards

For these vehicles there is a separate special function where the key-learning is performed.

Please refer the the “Instrument CAN” special function manual.

These are typically the models produced after 2009. The immobilizer is integrated into the dashboard, and the required transponder for that cars is a Megamos 48 Crypto.

Megamos 48 keyless-go keys ( e.g. VW Scirroco, Jetta, Golf 6, Tuguan, Touaran 2010+ and others).

Procedure 8 – A4/A5/Q5 2007+ and A6/A7/A8/VW Touareg 2010+

For these vehicle there is a separate special function called “BCM2 A4/A5/Q5” where the keylearning procedure is performed. Hitag2Ext key is used which is pre-coded. The key-learning procedure starts adaptation of the this transponder/key and the user should give ignition on with each key.

2.8.2 Key-learning modes

There is standard and wizard mode for the key-learning. The standard mode requires more user interaction when performing the key-learning procedure while the wizard mode tries to perform most of the operation automatically. However in some models it is not possible properly to detect the different parts, for that reason the standard mode is present in the SW to give the user better control of the dealer key preparation and key-learning procedure.

2.8.2.1 Standard mode

Press “Standard Mode” to use key-learning special function as before version 15.0 of the “Abrites Diagnostics for VAG”.

Pressing “Standard Mode” will bring the following dialog:

The customer has to choose the vehicle model for which they want to learn a key to.

In the background the system tries to determine automatically what vehicle model it is connected to. If the model recognition is successful it will be selected automatically. If the system cannot recognize the model, the user has to choose the model manually.

NOTE: It is possible that the system does not recognize the model correctly. In this case you have to select the model manually. For example it is not possible to distinguish between “VW CAN -2007” and “VW CAN (2007+)”, for that reason by default “VW CAN (2007+)” is selected.

NOTE: Please pay attention that for some models the key-learning and dealer key prepration are made in separate special functions. So if the SW detects such case you will have a hint to go the respective special function where to make the key.

After the vehicle model is recognized, the system checks the key recognition and engine start conditions. They are displayed in the following fields:

• Engine start permitted: Having the value “No” means that the key or engine control unit is not properly identified by the immobilizer. A reason for that might be an invalid key or engine control unit not adapted to the car, or for some models there is a waiting time. “Yes” here means that the immobilizer recognizes the key properly and the engine is allowed to start, i.e. everything is OK.
• ECU Responding: This shows whether the immobilizer is able to communicate with the engine control unit
• Transponder type OK: This is used as an indication whether the key in the ignition has the correct transponder type. For example for Audi A3 the immobilizer expects a Megamos 48 transponder, but if you use dedicated for Audi A8 (which uses Hitag2 transponder), then the value will be “No”. If there is no key into the ignition, you will have “No” once again.
• Key count: shows the currently learned keys. After completing the key-learning procedure this field should be updated to the new value if all keys were learned correctly.
• Dealer key/transponder: Shows whether the keys/transponders were successfully coded to the specific car. After making a dealer key the position should change to “Yes” when you put the prepared transponder into the ignition
• Key/transponder locked: indicates whether the transponder is writable.
• Key/transponder learned: Indicates whether the transponder ID is recognized from the immobilizer as a valid ID for starting the car. After learning the key/transponder to the car this should change to “yes”
• Lock times – login acknowledge: if an invalid login was input several times to the immobilizer, the immobilizer rejects further attempts to input the login. This timer indicates how many attemps remain until new login attempt can be accepted
• Lock timers – transponder acknowledge: If you turn ignition OFF/ON cyclically, the immobilizer stops to recognize the transponder, and even a valid transponder will not start the car. This timer shows when the immobilizer will recognize the transponders. This value is typically set when trying to make keys for Passat B6/CC

2.8.2.1.1 Key-learning

To perform the key-learning you will need the Login. If pre-coding of a transponder is necessary, the button “Program dealer key” will be also available. The “Autodetect Login/security code” button is available in order to search the PIN/CS automatically.

The key-learning is performed as follows:

Enter security access code (or autodetect it with the respective button) and the number of keys

Turn ignition ON (new or existing key)

Press the “Learn” button

For some VW/Seat/Skoda vehicles it is possible to add a new key without the remaining keys being deactivated. If the software recognize that the immobilizer supports this option, you’ll be promted whether you want to add key, or erase all keys and learn only the available keys. If the immobilizer is not supporting this option, this step is skipped.

Wait until “adaptation finished” is displayed

Remove the key and turn ignition off with all remaining keys. Normally you need only the make ignition on, but for some models with electronic ignition there might be a little difference. The software recognize such cases and will give you the respective hints. E.g. for Touareg/Phaeton/Bentley/Cayenne/A8 it is necessary that you hold each key in CRANK position until the steering is unlocked. For Passat B6/CC/B7 it is required that you put each key only to the first position instead of putting the key to the normal ignition position.

2.8.2.1.2 Preparing dealer key

If the respective procedure requires pre-coding of the key/transponder before it is learned to the car, the button “Prepare dealer key” will be available. Preparing the dealer key require the 7bytes of the CS.

The preparation of a dealer key is a little bit different for vehicles using the Megamos 48 transponder and the Hitag2 transponder.

a) Preparing dealer key on vehicles with Megamos 48 transponder

Pressing the button will show the following dialog:

The 7 bytes of the component protection data are contained inside the immobilizer and sometimes inside the engine control unit. Inside the engine control unit there are always at least 6 of the component protection bytes stored, sometimes also the 7th byte is contained.

There are several ways to extract the component security:

• Simply press the “Autodetect component security” (select “Autodetect component security” and press “Next” in case of “Wizard mode”) and the component security bytes will be read from the ECU. This will also automatically decide whether you have the 7th byte, or you will need to search for it. Also the login will be displayed in the status bar. The autodetection is not always possible, it basically works for EDC16 and MED9x engines which are using a CAN diagnostic connection.
• The component security bytes are displayed e.g. using the special function “Engine Control Unit” - when reading the EEPROM of the engine control unit the ABRITES Diagnostics for VAG will show you the component security bytes:

• For CAN TP2.0 immobilizers in most of the cases it is possible to read all 7 bytes from the instrument/immobilizer. This is possible from the Immo panel – you have to go to “Special function”, then “Instrument CAN” and “Read/write immo data”. After you read the immobilizer data in the field “Serial Key” the 7 bytes of the component security will appear.

b) Preparing a dealer key with all 7 bytes available

If the 7th byte is different from “00” then you have all the 7 bytes of the component security and you are able to prepare a transponder directly with the Key programmer. In this case you must choose “All 7 bytes of the component protection data (component security are known)”, put the 7 bytes and press the “Program” button.

c) Preparing a dealer key by finding the 7th byte

If the 7th byte is not available you must choose “Find the 7th byte of the component security data” and you have to put the six bytes which you already have. There are three possible ways to check whether the 7th byte is correct:

• From working key – if you have a key which can start the car, put it in the programmer and press “Find 7th byte from working key” - after 70-80 seconds the 7th byte should be found;
• Automatically

This mode requires that the immobilizer and the Key can simultaneously read/write the transponder. For that reason you have to turn the ignition ON and place the programmer ring over the key (when the key is in the ignition).

NOTE: The automatic check might not be possible for some models (e.g. VW Passat B6). So it is required that the manual procedure is used in this case.

• Manual

The main difference between the automatic and manual procedure is that according to the anual procedure you should put the key into the programmer, then turn the ignition to ON with it, and then once again to the programmer and so on until the byte is found.

If you use the manual procedure you will be consecutively prompted to put the transponder into the program, and then to turn it to the ignition ON position.

Normally for most models it is required that the key is in the ignition, and you only change the position of the transponder. You will be prompted to put the transponder into the programmer, then to put it near the ignition lock so it is read by the immobilizer. An exception is the Passat B6. For it it is required that you put the key with the transponder into the programmer, then the key with the transponder into the ignition lock, UP TO THE FIRST POSITION ONLY, then again into the programmer, and again into the ignition lock until the byte is found.

NOTE: If you get an “XXX” message you need to stop at the current position and wait for 10 minutes before you continue.

ATTENTION: For the Passat B6 there are some cars for which you cannot search for the 7th byte. For such cars a key can be made only by opening the comfort module and reading the comfort module EEPROM. Then after having the 6 bytes of the component security from the engine, you can extract the 7th byte from the comfort module’s EEPROM using the dump tool. It is also possible to program directly the key

to the car from the dump tool if you have attached a programmer. For more details please refer to the dump tool section.

ATTENTION: As mentioned above for some cars it is not possible to find the 7th byte of the components security. You can understand if this is possible for the car you are working on by performing the following procedure:

a) Connect with 25-Immobilizer and go to “Measured Vaues”, Channel 2

b) Put the original key or key with a Megamos 48 transponder – in this case in the Measured values you should have a “yes” or “1” on the second position of channel 2

c) Eject the key so there is no key in the ignition lock

→ If the second position is changes to “No” or “0” you CANNOT search for the 7th byte

→ If the second position remains at “Yes” or “1” you can search for the 7th byte

After you obtain a dealer key/transponder you can proceed with normal key-learning. Simply put the number of keys to learn and the security access code and the keys will be learned.

Megamos 48 key less-go keys (e.g. VW Scirroco, Jetta, Golf 6, Tuguan, Touaran 2010+ and others) are also supported.

d) Preparing dealer key on vehicles with Hitag2 transponder

Pressing the button will show the following dialog:

There are following possibilities for preparing the dealer key

• Making the key without disassembling the Kessy (completely by OBDII)

The “Autodetect from ECU” button will try automatically to read the component security bytes from the ECU, and will select for you automatically whether you need to search for the 7th byte or not.

IMPORTANT: If you do not have a working key from the car, you will need to short the fuses as described in the appendix to get communication with the ECU.

After the component security is read, if you have all 7 bytes, you can program the key directly.

If you have only 6 of the bytes, you have to choose:

a) if you have working key from the car, you can put it into the programmer, and press the “Find 7th byte from working key” button - the 7th byte will be found in several seconds;

b) if you do not have a working key, you have to search for the 7th byte manually. The procedure takes approximately 20-25 min, but can last up to 45min. You have to connect the interface to the OBDII, and the programmer should be connected too. Then after pressing the “Program” button you will receive notification when to put the key into the ignition, and when to put it into the programmer.

IMPORTANT: You only need to put the key inside, please DO NOT ROTATE THE KEY.

IMPORTANT: You might hold the programmer near the ignition lock so you can proceed faster when you remove the key. But please pay attention that the programmer is at least 15cm from the ignition lock so the reading of the key from the car is not disturbed.

NOTE: It is always better to use a plastic key or an empty transponder when you search for the 7th byte, at least when you prepare such keys for the first time. If for some reason the key becomes locked (e.g. battery goes down, computer is hangup, etc.), you can find the encryption-key with the “Find 7th byte from working key” button, and then you can restore the key with the Tag key tool.

• Making a key by disassembling the Kessy or the ECU

You can load a dump of the Kessy or ECU using the “Load component protection from Kessy/ECU dump” radio-button. After pressing the “Load dump ”button you have to select the respective dump file, after that the “Program” button will be active.

NOTE: Please pay attention that in the ECU dump sometimes there are only 6 of the component security bytes. In this case you will need to search for the 7th byte as described above.

NOTE: Please pay attention that if you have the Kessy dump, you will have all the 7 bytes. But there are a lot of Kessy devices with different software versions, so it is possible that the EEPROM is incorrectly decrypted (especially for newer cars), respectively the component security bytes will be wrong. In this case the key will not work and you will need to restore the key using the Hitag2 programmer. The best way

to check whether the Kessy dump is decrypted correct, is to get the PIN code from the dump tool and to try to put it in the immobilizer. If it accepted, than the decryption of the EEPROM dump is OK.

• Making a key if the CS is already known

If you have already read the component security bytes prior to that (e.g. by dissoldering the ECU EEPROM and decoding it by dump tool), then you can put the component security bytes manually and proceed as described above After the key is prepared as a dealer key, write how many keys you need to program, write the security access and press the “Learn” button.

2.8.2.2 Wizard mode

Like in the standard mode, the software tries to autodetect the vehicle model, but the customer has the ability to select the model also manually. If the vehicle model is not autodetected a respective message will appear and user have to select it manually.

NOTE: Depending on the vehicle type there are 1 or more functions available. A hint for their meaning is displayed in the bottom of the dialog. Here is a more detailed description of the functions.

• Learn keys – this means that all available keys will be learned. Any already working keys that are not available will stop to work after this function.
• Add One Key – this function will add one key to existing key count. This means that also the key which are not available at the moment will continue to work.
• Prepare dealer key – for the vehicles types which accept only pre-coded key it is mandatory first to prepare the so-called “dealer key” before proceed with the “Learn keys”

2.8.2.2.1 Learn keys

Learning the keys requires to put the Login (PIN) code. PIN code can be automatically detected, can be retrieved from dump, or can be typed manually if it is already known to the customer.

When the Login code is available and the “Next” button is pressed, an informational dialog is displayed, where the key recognition and engine start conditions are checked. The meaning of the fields is the same as the described in the standard key-learning mode.

Pressing the “Next” button here will start the adaptation procedure and after finishing it the user

should give ignition ON with all available keys.

NOTE: Immo V A4/A5/Q5 and A6/A7/A8/VW Touareg 2010+ only – a different dialog is displayed to the customer, which is the same as described in the standard key-learning.

2.8.2.2.2 Add one key

This function the same as the mentioned above with the difference, that it is not required to have all keys available at the moment. The keys which are not available will continue to work.

Possibilities for this are:

• Manual input of the component security – if it is already known you can put it manually.
• Autodetect the component security. The autodetected component security is displayed in the field in the bottom of the dialog. Please pay attention that autodetection might find only 6 of the bytes, in this case the 7th byte need to be found in the way described below
• Find 7th byte – automatic trying by OBDII – requires to make ignition ON with new transponder/key and to place the programmer over this new transponder/key. Finding the 7th bytes takes till 15min
• Find 7th byte – from working key – if a working key is available it is much faster to find the 7th byte from it – just put the working key in the programmer and in one minutes the 7th byte will be found
• Find 7th byte - automatic trying by OBDII – Passat B6/CC only – it is required to search the 7th byte

2.8.2.2.3 Prepare dealer key

For the pre-coding of the key/transponder (the so called “preparation of the dealer key”) is required to have the 7bytes of the component security. Choosing the “Prepare dealer key” function you need to put the component security.

• manually. You will have message when to put the new key/transponder in the ignition lock to first position, and when to put it in the programmer. Procedure might takes till 30min

• Find 7th byte - automatic trying by OBDII – Passat B6/CC/B7 with EDC17/MED17 – the pocedure is the same as on the other Passat B6/CC, but it is necessary to read the comfort module dump with a programmer and to enter the Login (PIN) code.
• Get component security from Kessy dump – only for vehicles with the Hitag2 key (Touareg/Phaethon/Cayenne/A8/Bentley Continental) – additionally to the options above there is one more option - to get the information from the Kessy EEPROM dump (93C86) if it is read with a programmer.
• Find 7th byte - automatic trying by OBDII – only for vehicles with the Hitag2 key (Touareg/Phaethon/Cayenne/A8/Bentley Continental) – for these vehicles it is necessary to enter also the PIN code, The procedure of finding the 7th byte is manual, and the user will have message when to put the new transponder/key in the programmer (only put in the ignition without rotate), and when to put it in the programmer.
• A6/Q7/Allroad with EZS-Kessy only – for the preparation of the dealer key is required the PIN and the 6 bytes of the component security, which can be typed manually, automatically detected from engine control unit, detected from EZS-Kessy EEPROM dump (if read with a programmer) or detected from EZS-Kessy EEPROM by OBDII (if working key is available)

Programmer

needed

Transponder/Key

Programmer

needed

Transponder/Key

Programmer

needed

Transponder/Key

Programmer

needed

Transponder/Key