As of September 2026, most modules that stop mid-flash are recoverable — a genuinely dead controller is rarer than the panic suggests. The first rule is the one everybody breaks: stop touching it. Do not cycle the key, do not disconnect the battery, do not start a second flash with a different tool “to see if that one works.” Each of those is how a recoverable module becomes a bench job, and a bench job becomes a replacement.
This is written for the moment it happens: the progress bar has stopped, the software is showing an error, and there is a customer standing next to the car. What follows is the triage order we use on our own bench, the difference between the three states a half-written module can be in, and what each one costs to fix.
First: do nothing for sixty seconds
A stalled progress bar is not proof of a failed write. Some modules take an uncomfortably long time on a single block, particularly on large calibrations over a slow interface, and a good number of “bricked” calls to this desk are people who pulled the connector at ninety percent because nothing had moved for two minutes.
So the sequence is: leave it connected, leave the ignition exactly where the procedure put it, leave the maintainer on, and read the error the software is actually giving you. Write it down verbatim — the exact string matters later. Only then start diagnosing.
“Nine out of ten modules that arrive here as ‘bricked’ were alive when the write failed and got killed by what happened in the next five minutes. The recovery window is real and people spend it panicking.” — Bench technician, module repair
The three states a half-flashed module can be in
Recovery difficulty is not a spectrum, it is three discrete cases, and knowing which you are in tells you what it costs.
| State | How you recognise it | Route |
|---|---|---|
| Application corrupt, bootloader alive | Module still answers; tool offers to resume or recover | Retry over OBD — remote session |
| Bootloader reachable, no normal comms | Silent on scan tool, but the programming tool still sees it | Recovery mode — session or bench |
| No response at all | Nothing on any tool; often no current draw | Bench only — mail-in |
The middle row is the one that gets misdiagnosed most. A module that has lost its application will not respond to a generic scan tool, because responding to a scan tool isthe application's job. That does not mean it is dead — the bootloader lives in a protected region and is usually still there, waiting for a properly formed programming request. Our explainer on signed bootloaders covers why that region is separate and what it will and will not accept.
The triage sequence
- Check power and ground before anything else. Measure at the module, not at the battery. A voltage sag during the write is the single most common cause of a failed flash, and if it caused this one it will cause the next one. Get a real maintainer on the car — a jump pack is not a maintainer.
- Confirm the interface still enumerates. Some failures are the laptop or the pass-thru device, not the car. If the device has vanished from the operating system, you never had a module problem. The device compatibility matrix lists what is known-good for OE programming.
- Try the tool's own recovery path.Most OE applications have one, and it is designed for exactly this. This is where a remote session earns its money: we drive the manufacturer's recovery flow rather than an aftermarket approximation of it.
- Scan the whole bus, not just the module. A module stuck mid-programming frequently drags the network down with it, and the codes in the other modules tell you which one. If you are seeing lost-communication codes everywhere, our U0100 guide is the map.
- Stop escalating. If two proper attempts have failed, a third with a different aftermarket tool is not a plan. That is the point where the job becomes a bench job and further in-car attempts only add risk.
What a remote session can and cannot recover
A live session gets you the manufacturer's own recovery procedure driven by somebody who has run it before, through your own J2534 device over IgniteRemote, with a Google Meet call alongside so you can act on what the car does. That covers the first two states in the table above on the eight platforms we carry: $100 for GM, $150 for Ford/Lincoln, Nissan/Infiniti and Mazda, $250 for Toyota/Lexus, Volvo, VW/Audi and Mopar. Booking runs 9 AM to 9 PM Central, seven days, with the earliest slot thirty minutes out — which is deliberately built for the “it just failed and the customer is here” case.
What it cannot do is reach a module that has no communication at all. There is no software route to a controller that does not answer; that is physics, not policy. Those go to a bench, where the recovery is done through the module's programming header or directly at the memory device. The bench, boot and OBD read-method comparison explains what each of those access levels reaches and why the deepest one is the last resort rather than the first.
Why a stock backup decides everything
Here is the uncomfortable part. Recovery means writing something valid back into the module, and that something has to come from somewhere. If a full original read was captured before the work started, recovery is mechanical. If it was not, you are dependent on a manufacturer calibration being available for that exact controller and configuration, or on a donor file that matches closely enough — and “closely enough” is doing a lot of load-bearing work in that sentence.
This is why our return-to-stock and original-file backup guide is the most boring important post on this site. Ten seconds of discipline before a write is worth more than any recovery technique after one. Read before you write, every time, on every module, including the ones you have done a hundred times.
When recovery works and the car still will not start
A successfully recovered module is not automatically a running car, and this catches people out. Recovery restores software. It does not necessarily restore configuration, immobiliser pairing, or the security relationship between the module and the rest of the vehicle. On a lot of platforms those are separate write operations that have to happen afterwards.
If you are at that stage — module alive, communicating, engine cranking with no fire — the causes are enumerated in our post on why a swapped or reflashed ECU will not start, and immobiliser is at the top of that list far more often than anything mechanical. A P0606 internal-processor fault is a different animal again and has its own diagnostic guide.
Mail-in, and what it costs
For the third state — genuinely no response — the route is physical. Our mail-in service handles modules that cannot be reached in the car, and our packing guide covers doing that without adding static damage to whatever is already wrong. Mail-in PCM unlock and clone work is $250; other recovery work is quoted after we see what state the module is actually in, because pretending otherwise would be a number invented for a module nobody has looked at.
If the controller is outside what we cover, post it to the specialist network. Posting is free, specialists with different bench tooling bid, and you pay only if you accept one. That is frequently the fastest route for an unusual module, and it beats buying a replacement that then needs programming anyway — our used-ECU matching guide explains why that path is rarely the shortcut it looks like.
What to tell the customer while it is happening
There is a person standing next to the car, and how this conversation goes decides whether the job survives. Three rules from people who have had it many times.
Say something immediately, and say what is true. “The programming stopped partway through, the module is in a recoverable state and I am working the recovery procedure” is a sentence that keeps a customer calm. Silence while you stare at a laptop does not. If you do not yet know which state the module is in, say that too.
Do not promise a time you cannot hold. Recovery is either quick or it is not, and which one it is often is not clear for twenty minutes. Telling somebody it will be ten minutes and taking two hours is worse than saying up front that you will know more shortly.
Do not attribute blame to the car.“These always do this” is rarely true and it invites the customer to conclude the vehicle is defective, which becomes an argument about who pays. A failed write is a normal risk of module programming, it is why the maintainer goes on first, and it is usually recoverable.
The commercial version of the same point: an operator who books recovery work as a same-day session, tells the customer honestly what state their vehicle is in, and finishes it, ends up with a better reputation than one who never has a failure because they never take the difficult jobs. Our subcontracting guide for shops covers pricing that risk into the job rather than absorbing it.
Preventing the next one
Failed writes cluster around a small number of causes, and all of them are preventable for less than the cost of one recovery. The full list is in our six causes of failed remote sessions; the three that matter most are stable voltage held by a real maintainer, a pass-thru device that is known-good for programming rather than merely for reading, and a laptop that will not go to sleep, install an update, or drop its connection halfway through.
The industry context is worth a line. SAE J2534 standardised the pass-thru interface precisely so independent technicians could perform manufacturer reprogramming, and in the United States the National Automotive Service Task Force maintains the registry that provides a legitimate route to secure vehicle functions. Both exist because the alternative — every reprogramming job going back to a dealer — is not workable for a fleet whose average light vehicle was 12.6 years old in S&P Global Mobility's 2024 study.
We do not provide emissions defeat, delete files, or services intended to bypass emissions laws. Our services exist for tuning preparation, diagnostics, repair, motorsport, and off-road use where legally permitted. Customer is responsible for confirming legal use in their location and application.
Recovery work is squarely repair work, and it stays that way. A module restored to a manufacturer calibration is a module put back the way it was, which is the whole point.
The short version
Stop, do not cycle anything, read the exact error. Check voltage at the module. Establish which of the three states you are in before choosing a route. A module that still answers a programming tool is a remote session; a module that answers nothing is a bench job. Whether either is quick depends almost entirely on whether somebody took a full original read before the first write — and that is a decision made ten minutes before the failure, not after it.