Vehicle Diagnostics Protection: Firewall & Filters (Solution)

Vehicle diagnostics protection (VDP), diagnostic filters & firewall


Vehicle Diagnostics Protection (VDP):

Vehicle Diagnostics Protection (SFD), also known as Protection of Vehicle Diagnostics (PVD), replaces the existing Login & Security Access functionality. This means that basic functions such as reading control unit identification, events, diagnostic trouble codes (DTCs), or measured values will not be affected.

However, advanced functions such as coding, adaptation, basic settings, and/or output tests may be restricted and require an SFD unlock. SFD was first introduced in the 2020 model year and was initially limited to newly introduced models and/or control units. There are vehicles where individual control units still use the classic login/security access protection, while other control units in the same vehicle utilize the newer SFD protection.

A vehicle scan using VCDS will show you whether a specific control unit requires SFD unlocks for certain functions. This is indicated by the addition of "SFD" in the VCID line.

Code:

Adresse 09: Zentralelektrik (J519)   Teilenummer SW: 1EE 937 089 D    HW: 1EE 937 089   Bauteil: SAM_H         H08 0530   ASAM-Datensatz: EV_SAMVW31x 005001   VCID: 43DB1062BB164BA2C69-8016 SFD

Vehicle Diagnostics Protection 2 (SFD2):

SFD2 does not replace the SFD described above. Instead, it serves as an extension of the original SFD functionality to protect ECUs from unauthorized manipulation (as required by law). This primarily targets driver assistance systems, autonomous driving, software updates, and general cybersecurity (e.g., UNECE R 155 and/or UNECE R 156).

The vehicle manufacturer must ensure that all modifications are factory-authorized. This means that functions such as coding and adaptation, as well as updates, can only be performed if they are digitally and cryptographically signed.

This restriction does not apply to most service-related functions such as service resets, diesel particulate filter regeneration, brake pad replacement, or other typical workshop tasks. These can still be performed after a regular SFD unlock. However, SFD2 restricts/prevents most aftermarket modifications and similar attempts to enable features that are not originally available from the manufacturer.

A vehicle scan using VCDS will show you whether a specific control unit requires SF2-signed messages for certain functions. This is indicated by the addition of "SFD2" in the VCID line:

Code:

Adresse 19: CAN-Gateway (J533)   Teilenummer SW: 1EE 937 012 D    HW: 1EE 937 012   Bauteil: ICAS1 Host-SG 021 0411   ASAM-Datensatz: EV_GatewICAS1MEBUNECE 001013   VCID: 353F7EBAE5C2E51278D-8060 SFD+SFD2

See also:
Unlocking the vehicle diagnostic protection / Unlocking SFD
Discussion about SFD

The Diesel Mechanic SFD Checker will tell you which engine control units have which SFD (SFD/SFD2) and whether they are unlocked.