EFC

VAG Simos18 MQB ECU: What's Possible in 2026

Checksum recovery is Live on VAG Simos18, IMMO-OFF is Soon, and Simos PCR2.1 is RSA-signed and unsupported. Why the split exists and what the honest alternative is.

11 min readVAG · Simos18 · Coverage
By ECU Flash Cartel · ECU Flash Cartel · US-based · Texas operations

On the VAG MQB platform — the Simos18 family fitted to 2014-onward Volkswagen, Audi, SEAT and Skoda petrol cars — checksum recovery is Live in our service today, IMMO-OFF is Soon, and the closely related Simos PCR2.1 is not supported at all because it is RSA-signed. That three-way split confuses more customers than any other family in our catalog, so this guide sets out exactly what is possible, what is not, and what the honest alternative is for the parts that are not.

As of July 2026 these statuses are current. They are also the reason we would rather publish a Soon than take your money and hope.

What Simos18 is, and where it sits

Simos18 is Continental's direct-injection engine management family for the VAG MQB architecture, in the .1, .6 and .10 sub-variants we list. It runs on Infineon TriCore silicon and appeared across the MQB range from roughly 2014 — Golf Mk7 and the platform siblings, Audi A3 8V, SEAT Leon and Skoda Octavia being the volume applications.

In generational terms it sits two steps beyond the Bosch ME7 that dominated the 1.8T era. ME7 was an unsigned, byte-patchable module with its immobilizer data in a small external EEPROM — the family our Hella-sticker identification guide covers, and one of our strongest IMMO-OFF coverages at Live status. MED17 came next and is where the picture starts splitting by revision, as our MED17 guide details. Simos18 is the generation after that, and the difference is not incremental.

The status split, stated plainly

FamilyTypical eraIMMO-OFFChecksum recovery
Bosch ME7 (95040 / 95080 EEPROM)1998–2005Liven/a — EEPROM side
Bosch ME7.5.201998–2005LiveLive
Bosch MED17 / EDC17 (non-VDS)2008–2018SoonLive
Simos18.1 / 18.6 / 18.102014+SoonLive
Simos PCR2.12012+Manual — RSA-signedManual

Read down the two right-hand columns and the shape of the problem appears. Checksum recovery marches forward through the generations; IMMO-OFF does not. That is not laziness — it is the nature of the two engineering problems.

Why checksum is solved and IMMO-OFF is not

Checksum recovery means knowing the algorithm and the block layout for a family. Solve it once and it generalises: the same implementation covers revision after revision because the integrity scheme is a property of the platform, not of a particular firmware build. Our Simos18 entries use the VW-flash family algorithm and are Live for that reason.

IMMO-OFFmeans finding where one specific firmware build performs its immobilizer check and modifying that path without disturbing anything adjacent. That knowledge does not generalise across builds at all. A patch derived from one revision applied to another can land at plausible offsets, recalculate to a clean checksum, and produce a module that boots into behaviour nobody intended. Which is precisely why our BMW MS43 coverage is listed as four separate revision entries rather than one “BMW” line — see the M52 / M54 identification guide for what that discipline looks like in practice.

On Simos18 there is a second complication. Immobilizer authorisation on MQB is not a self-contained routine inside the engine module the way it was on ME7. It is distributed across the vehicle's component-protection scheme, which involves several modules agreeing with each other. Patching one participant out of a multi-module conversation is a materially different problem from flipping four bytes in a 512-byte EEPROM, and it is why we are unwilling to call it Live until it is validated on real donor pairs.

What you can do with Simos18 today

What you cannot do — and the honest alternative

You cannot buy an instant Simos18 IMMO-OFF from us today, because it does not exist at Live status and we do not sell Soon as if it were Live. If your MQB car has a module-pairing problem, the routes that actually work are:

  1. OE programming and adaptation.The manufacturer's own software performs component protection adaptation properly rather than bypassing it. This is the correct answer far more often than customers expect, and on a car this age it is also the answer that leaves the vehicle in a supportable state.
  2. The specialist network. Post the job and let vetted operators with different tooling bid. Posting is free and you only pay if you accept a bid; payment is escrowed until you confirm completion.
  3. Contribute a donor pair. If you hold a confirmed original plus a known-good modified file for the same Simos18 revision, that is genuinely useful to us and tends to move a Soon along, because without one, patch development is inference rather than verification. Our coverage-status guide explains how statuses actually advance.

Reading a Simos18 module

TriCore silicon on a modern platform means the read paths are the modern ones: bench harness on most tooling, boot mode where the family requires it, and OBD only where your tool holds the relevant protocol licence. Our read-methods guide covers which to reach for and the failure modes of each.

Two Simos18-specific cautions. First, read twice and diff — a marginal bench contact produces a file that looks plausible and is subtly corrupt, and on this family you will not spot it by eye. Second, voltage discipline is not optional. The SAE J2534 pass-thru procedures every OE reprogramming routine is written against all open with a battery-maintenance requirement, and a MQB-era module that browns out mid-write becomes a bench recovery job at best.

A VAG-focused operator we work with described the generational shift concisely:

“On a Mk4 you opened the ECU, changed four bytes, and the car started. On a Mk7 the engine module is one voice in a conversation between five modules that all have to agree. People want the same twenty-dollar answer and the platform stopped offering it about a decade ago.” — Independent VAG diagnostics specialist

Where the wall actually is

Simos PCR2.1, listed alongside Simos18 in our catalog, is flagged Manual and annotated RSA-signed; not yet supported. That is a different category of “no” from a Soon. A Soon is engineering work not yet finished. An RSA-signed bootloader verifies a manufacturer signature over the firmware image before accepting a write, and producing a valid signature without the manufacturer's private key is not an engineering problem — it is a cryptographic one, and it does not have a solution.

Our signed-bootloader guide covers that boundary in full, because understanding it is the single most useful thing an owner or shop can learn about modern ECUs. The practical summary: patchable old, OE-programmed new, and the line between them has been moving forward one model year at a time for a decade.

Emissions, plainly

We do not provide emissions defeat, delete files, or services intended to bypass emissions laws. Our services exist for tuning preparation, diagnostics, repair, motorsport, and off-road use where legally permitted. Customer is responsible for confirming legal use in their location and application.

On MQB diesels in particular this needs saying without softening. Section 203(a)(3) of the federal Clean Air Act prohibits tampering with emissions controls and the manufacture or sale of any defeat device, software included, and the EPA has pursued that theory directly against tuning operations. Checksum recovery on a legal calibration and OE programming of a replacement module are ordinary repair operations. Emissions deletes are not, and we decline them.

The independent side of this work is formally recognised: the National Automotive Service Task Force maintains the channel through which independent shops obtain service information and vehicle-security credentials, and J2534 reprogramming is an established independent-repair path rather than a workaround.

The short version

On Simos18 today: checksum recovery yes, IMMO-OFF not yet, PCR2.1 not at all. If your MQB car needs a module programmed or adapted, book a remote VW/Audi session at $250 and keep the car in your bay. If it needs a pairing bypass, post it to the specialist network rather than shipping a module against a Soon.

And before any of that, run the free identifier— on this family more than most, the sub-variant decides everything, and the full status table is always current on the coverage matrix.

Frequently asked

Can you do IMMO-OFF on a VAG Simos18 ECU?
Not today. Simos18.1, 18.6 and 18.10 sit at Soon for IMMO-OFF in our catalog as of July 2026, while checksum recovery on the same variants is Live. We publish Soon rather than selling it as Live because immobilizer authorisation on MQB is not a self-contained routine inside the engine module — it is distributed across the vehicle component-protection scheme, which is a materially different problem from patching four bytes in an external EEPROM.
Why is checksum recovery Live but IMMO-OFF is not?
They are separate engineering problems. Checksum recovery means knowing an algorithm and block layout for a family; solve it once and it generalises across revisions because the integrity scheme is a property of the platform. IMMO-OFF means finding where one specific firmware build performs its immobilizer check and modifying that path without disturbing anything adjacent, and that knowledge does not generalise at all. It is the same reason our BMW MS43 coverage is listed as four separate revision entries.
What can I actually get done on a Simos18 module today?
Three things. Checksum recovery on a modified file, which is Live and automated — if a calibration change has left the module refusing to boot, stale checksums are the usual cause. Free variant identification, which reports the family, sub-variant and per-operation status in seconds. And live remote OE programming, where we run VW/Audi manufacturer software into your own J2534 device at $250 per session, typically 30-60 minutes, with the car staying in your bay.
What is the difference between Simos18 and Simos PCR2.1?
Simos18 is Soon for IMMO-OFF, meaning engineering work that is not finished and can move. Simos PCR2.1 is flagged Manual with the note "RSA-signed; not yet supported", which is a different category of no. A signed bootloader verifies a manufacturer signature over the firmware image before accepting a write, and producing a valid signature without the private key is a cryptographic impossibility rather than an unfinished engineering task.
How do I read a Simos18 module safely?
TriCore silicon on a modern platform means modern read paths: bench harness on most tooling, boot mode where the family requires it, and OBD only where your tool holds the relevant protocol licence. Two cautions specific to this family — read twice and diff, because a marginal bench contact produces a corrupt file you will not spot by eye; and maintain voltage properly, since every OE reprogramming procedure written against SAE J2534 opens with a battery-maintenance requirement and a MQB-era module that browns out mid-write becomes a bench recovery job.
My MQB car has a module pairing problem — what should I do?
Three routes that actually work. OE programming and adaptation, which performs component-protection adaptation properly rather than bypassing it and leaves the vehicle in a supportable state. The specialist network, where you post the job free and vetted operators with different tooling bid, with payment escrowed until you confirm completion. Or, if you hold a confirmed original plus a known-good modified file for the same revision, contributing that donor pair — it is what moves a Soon along.
Do you do emissions deletes on MQB diesels?
No. We do not provide emissions defeat, delete files, or services intended to bypass emissions laws. Section 203(a)(3) of the federal Clean Air Act prohibits tampering with emissions controls and the manufacture or sale of any defeat device, software included, and the EPA has pursued that theory directly against tuning operations. Checksum recovery on a legal calibration and OE programming of a replacement module are ordinary repair operations; deletes are not.

Ready to put this into practice?

Book a remote ECU programming session in minutes — or drop a dump on the free identifier first to see whether we cover your variant.