Module programming, coding and security access

The Lindqvists' minivan is back for the software update that Kiran found in Lesson 1's bulletin. Its idle has stayed steady since the relearn, but the bulletin says the original software can lose its learning again, and Anna Lindqvist would rather fix it once. Marty sets up the programming cart in the quietest bay, plugs in the battery support unit and the shop's pass-thru interface, and logs in to the manufacturer's service website. "Programming isn't hard," he says. "What's hard is that it can't be undone halfway. If the power drops or the connection fails in the middle, you can turn a working module into a paperweight. So we do it by checklist, every time."

This lesson explains what programming a module means and the different kinds of programming, the tools and access a shop needs, the steps of a safe programming session, the extra controls on security-related work such as keys and immobilizers, and the legal and ethical limits that every technician must respect. It finishes the minivan's job from Lesson 1.

What programming means

A vehicle's control modules run software stored in flash memory, which can be rewritten. Manufacturers release new software for many reasons: to fix a driveability problem, as on the minivan, to improve a transmission's shift quality, to correct a false code, to meet an emissions or safety requirement, or to add support for a new part. Rewriting a module's software is called reprogramming or flashing. It replaces the program and its calibration, the large set of numbers that tune the program for a particular engine and vehicle, with a new version from the manufacturer.

Other kinds of module setup are often grouped with programming but are different. Configuration, or coding, tells a module which options and equipment the vehicle has, such as its engine, transmission, tire size, market and installed features, and often its vehicle identification number. A replacement module usually arrives blank or generic and must be configured before it works correctly. Initialization and relearns, such as the idle relearn in Lesson 1, the crankshaft variation relearn in Lesson 6 or a throttle body relearn, let a module learn values from the vehicle without changing its software. Security procedures pair keys, immobilizer modules and the engine control module so the engine will only run with an authorized key.

Tools and access

There are three common ways to program a module. The manufacturer's own diagnostic tool, which dealers use, can do everything the manufacturer supports. Many professional aftermarket scan tools can perform some configuration and relearn procedures, and some can program certain modules. And most manufacturers support programming through a pass-thru device: an interface that connects a laptop to the vehicle's diagnostic connector and follows the SAE J2534 standard, so that the manufacturer's own programming software running on the laptop can talk to the vehicle through any compliant interface. The extended version of the standard, J2534-2, adds optional features some manufacturers use. North American regulators required manufacturers to make emissions-related reprogramming available through pass-thru devices, which is why independent shops can do this work at all.

The software and calibration files come from the manufacturer's service website, usually downloaded during the session for the specific vehicle identification number, and the shop pays for access by the day, month or year. Some manufacturers also require their own programming application, a registered user account, and in some cases a specific interface model. Ridgeline keeps a list on the programming cart of which brands it has accounts for, which interfaces each accepts, and how much short-term access costs, so Bev can quote the job accurately.

Some manufacturers protect their vehicles' networks with a secure gateway module, which blocks a scan tool from sending commands, clearing codes or programming unless the tool and the technician are authenticated. On many Stellantis vehicles since about the 2018 model year, an independent shop unlocks the gateway through an online authentication service, AutoAuth, which registers the shop, the technician and the scan tool and records each session. Other manufacturers have their own systems. The shop's scan tool and the technician's account must both be registered before the job starts, or the session will fail at the first protected command.

The programming checklist

Ridgeline's checklist follows the manufacturer's instructions, which always take priority, and adds the shop's own lessons from experience. Kiran works through it item by item and initials each line.

• Confirm the need: the bulletin applies to this vehicle, and the module's current calibration identification is one the bulletin says to update.
• Record the current calibration identifications of every module that will be touched, and save a full scan of codes before starting.
• Connect a programming power supply, not a battery charger, set to hold the voltage the manufacturer specifies, typically around 13 to 14 volts, and confirm the battery is in good condition.
• Switch off everything that draws current: headlamps, blower, radio, interior lights; close the doors or latch them, so modules stay awake but loads stay low.
• Use a wired internet connection if possible, disable the laptop's sleep and update settings, and plug the laptop into mains power.
• Route the interface cable where nobody will trip over it, and put a sign on the vehicle so nobody opens a door, starts the engine or disconnects anything.
• Run the programming session without interruption, following every on-screen instruction exactly, including key-off timing.
• After programming, clear codes in all modules, perform any relearns the instructions require, and record the new calibration identifications.
• Verify: road test, check that the original complaint is fixed and that no new codes have set in any module.

The power supply rule exists because a module being programmed draws power continuously for many minutes, and other modules on the network stay awake too. A battery alone can sag below the module's minimum programming voltage partway through; a battery charger in charge mode can produce a ripple or a voltage swing that the module rejects. Either can abort the session at the worst moment. A programming supply holds a steady voltage under the full load. Kiran logs the voltage during every session, and the shop's script checks the log afterward.

# Check a programming session's voltage log: the voltage must stay within the window the whole time
v_min, v_max = 13.0, 14.5             # window from the manufacturer's instructions (illustrative)
log = [(0, 13.62), (60, 13.58), (120, 13.55), (180, 13.60), (240, 13.57), (300, 13.54), (360, 13.56),
       (420, 13.59), (480, 13.58), (540, 13.61), (600, 13.57), (660, 13.60)]
low = min(v for _, v in log); high = max(v for _, v in log)
gaps = [b[0] - a[0] for a, b in zip(log, log[1:]) if b[0] - a[0] > 90]
ok = v_min <= low and high <= v_max and not gaps
print(f"session length {log[-1][0] / 60:.0f} min; voltage {low:.2f} to {high:.2f} V; logging gaps: {gaps or 'none'}")
print("within the window throughout" if ok else "OUTSIDE the window or a gap in the log: check the module before releasing the vehicle")

session length 11 min; voltage 13.54 to 13.62 V; logging gaps: none
within the window throughout

The minivan's update

Kiran confirms the bulletin applies, records the engine control module's calibration identification and the other modules' versions, and connects the programming supply and the pass-thru interface. The manufacturer's software identifies the vehicle from its identification number, compares the installed calibration with the latest, and offers the update. The session takes eleven minutes. The script confirms the voltage stayed between 13.54 and 13.62 volts. Afterward the software asks for a key-off of 30 seconds, then for the idle relearn, which Kiran performs. All modules are scanned again: no codes except a few communication codes that set during programming, which the instructions say to clear.

# Confirm the update: compare calibration identifications before and after with the bulletin
bulletin_affected = {"68312345AB", "68312345AC"}
bulletin_new = "68312345AF"
before = "68312345AC"
after = "68312345AF"
print(f"before: {before} ({'affected' if before in bulletin_affected else 'not affected'})")
print(f"after:  {after} ({'matches the bulletin' if after == bulletin_new else 'DOES NOT match: do not release'})")

before: 68312345AC (affected)
after:  68312345AF (matches the bulletin)

On the road test the idle stays at 700 rpm through hot restarts, and Kiran asks Anna to call if it ever hunts again. The repair order records the bulletin number, the calibration identifications before and after, the voltage log result and the relearn. Anna asks why the update cost more than the relearn last time; Simone explains the subscription and the extra steps, and Anna is satisfied that the fix is permanent.

When programming goes wrong

If a session fails, the first rule is not to panic and not to disconnect anything. Most manufacturers' software can recover a failed session by restarting it, as long as the module's bootloader, the small permanent program that accepts new software, is intact. Kiran is taught to read the error message, check the power supply, the internet connection and the cable, restart the session as the instructions say, and call the manufacturer's technical support line if it fails again. A module that cannot be recovered must be replaced and programmed, which is why the checklist exists. In years of programming, Marty has had two sessions fail, both before the shop bought a proper programming supply.

Security access: keys and immobilizers

Programming keys, replacing immobilizer modules and similar security work could help a thief steal a vehicle if done by the wrong person, so manufacturers control it more tightly than other procedures. In North America, much of this information is released through the National Automotive Service Task Force's Vehicle Security Professional registry. A registered technician works for a business with a United States federal taxpayer identification number or a Canadian business number, holds the licenses his or her municipality requires, and is in good standing; once approved, the technician receives credentials that the manufacturers' systems check before releasing key codes, immobilizer information or security procedures. Each request is recorded against the technician and the vehicle.

Marty is Ridgeline's registered security professional. When Hal's company loses a key for van 3, Marty verifies ownership before doing anything: the registration in the company's name, a work order signed by Hal, and Hal's identification. Only then does he request the key information through the registry and program a new key, and the old lost key is deleted from the vehicle so it can no longer start it. Kiran watches but does not perform it; she will need her own registration once she is certified. Ridgeline never programs a key for a vehicle whose ownership has not been verified, however convincing the story.

Legal and ethical limits

Programming tools can do things that are illegal or unsafe, and a professional technician refuses them. Altering an engine's emissions calibration, removing emission equipment from the software, or installing software that disables a monitor is prohibited in both countries, as the emissions course explained, and Ridgeline's anti-tampering policy covers programming as well as parts. Changing an odometer reading to misrepresent a vehicle's distance is a crime in both countries; a replacement instrument cluster is set only to the correct distance, following the manufacturer's procedure, and documented. Bypassing an immobilizer, disabling a safety system or turning off a recall-related protection is also refused.

The rule Kiran writes in her notebook is simple: the shop programs only what the manufacturer releases, for the vehicle it was released for, with the owner's approval, and records it. Anything else is refused politely, written on the order as declined, and explained to the customer. Bev backs every technician who refuses.