Checksums and Signatures: The Protection Inside Your ECU

People who hear about chip tuning for the first time often imagine it simpler than it is: read the file, change a few values, write it back, done. With an ECU from the nineties, that was actually not far off. Today, a whole series of protection mechanisms sits between the modified file and the running engine. The two most important are called checksum and signature. They sound similar but do completely different jobs. And they are the reason why serious tuning on modern cars is much more than changing numbers.

Checksums: protection against errors

A checksum is a check value calculated from a block of data. In the simplest case all bytes of an area are added up; more modern methods use a CRC calculation that reacts to even the smallest change. The result is stored at a defined place in memory. At start-up, the ECU calculates the check value again and compares it with the stored one.

If both match, the block is considered intact. If they do not, the ECU assumes the memory is damaged, for example by a bit error, an interrupted programming session or a hardware fault. Depending on the ECU and the affected block, the engine then does not start at all, runs in limp mode or stores a fault code.

So checksums were not originally meant as tuning protection but as a safety function. An ECU should not work with faulty maps, because that could damage the engine. For tuning, however, it means: whoever changes a map value also changes the data the check value is formed from. The checksum must then be recalculated and entered correctly.

Why the correction matters so much

A modern ECU does not have one checksum but often many: over individual calibration blocks, over the program, sometimes nested so that one checksum covers other checksums. Which areas are checked and how differs by manufacturer, ECU family and software version.

Common flash tools take care of the correction for the ECUs they support. It is one of their most important jobs: they know the structure of the file, recalculate the affected checksums and only then write. But this does not apply equally to every combination of tool and ECU. One example from the module list of PCMflash: for VAG Bosch MED9 ECUs it notes that RSA signatures are not corrected. That shows how closely you have to look at which tool does what on which ECU.

A wrongly corrected checksum is one of the classic sources of error. The result ranges from a fault code to an ECU that no longer starts and has to be recovered via bench or boot mode.

Signatures: protection against foreign software

A signature goes one step further. It does not answer "Is the file intact?" but "Does the file come from the manufacturer?". Technically, a cryptographic method such as RSA is used. The manufacturer creates a signature over the software with a secret key. The ECU only holds the matching public key, which can verify the signature but not create one.

The key point: unlike a checksum, a signature cannot simply be recalculated after a change. Without the secret key, nobody can create a valid signature. Every change to the signed areas makes the signature invalid.

On current ECU generations such as Bosch MG1 and MD1 or Continental Simos 18, the bootloader checks the signature before starting the software or before accepting a write over the diagnostic port. An ECU of this kind therefore does not simply accept a modified file over OBD.

How tuning is still possible

For signature-protected ECUs there is essentially one route: the ECU is prepared once on the bench or with the housing opened so that it accepts modified calibration data. This is called a bench unlock. Afterwards, in many cases it can be written over OBD again, for the actual tune, later changes or flashing back the original software.

For BMW ECUs of the MG1/MD1 generation, the effort depends on the build date: up to 08/2019 the unlock runs directly over OBD. From 09/2019 it needs a bench or AutoTuner/FEMTO unlock, which means the ECU has to be removed and sent in once.

For other brands, the extra effort is reflected in the price. An ECU that has to be opened for access costs 50 € more with us. A VW Golf 7 GTI with Simos 18 therefore starts at Stage 1 from 450 €: 400 € for the current ECU generation plus 50 € for opening it.

What it means for you

From the owner's point of view, the protection mechanisms boil down to three points:

• Checksums are routine. On supported ECUs they are corrected reliably. They are one more reason to work only with proven tools and on your own read-out file.
• Signatures decide the access route. Whether your ECU is handled over OBD, on the bench or in boot mode depends mainly on how its software is protected.
• The original file stays important. Especially with protected ECUs, a clean backup before the first change is the basis for any return to stock.

A tuning box, by the way, does not bypass these mechanisms. It never touches them: it changes sensor signals before they reach the ECU. Software and checks stay untouched, with the drawback that the protection logic also calculates with falsified values.

How to recognise a checksum problem

If something is wrong after a write, it usually shows immediately. The engine does not start although the starter turns. The ECU no longer responds in diagnostics, or only in bootloader mode. Or the engine runs, but with the check engine light and reduced power because a block was detected as faulty. In every case: do not keep trying blindly. Writing the same file again changes nothing, and every further attempt on a weak battery does not improve the situation.

The right way is to flash back the original file or to recover the ECU via a deeper access route. That is exactly what the backup before the first change is for. With it, such a case can usually be solved.

Legal framework

Checksums and signatures are technical hurdles, not legal ones. No matter how access to the ECU is achieved: changing the engine software voids the operating permit. Our calibrations are intended exclusively for motorsport; details are in the motorsport notice.

Conclusion

Checksums protect against errors, signatures against foreign software. The former are recalculated during tuning, the latter make a one-time unlock necessary on modern ECUs. Both are part of the craft and explain why the effort differs so much between ECU generations. The configurator shows which route your vehicle needs, with ECU and price.