Назад
Quantex2026.05.14 06:54 0

Working with the SFD system

SFD (Schutz der Fahrzeug-Diagnose / "Vehicle Diagnostic Protection") is a diagnostic protection system for VAG Group vehicles that controls access to coding, adaptation, and other service functions in control units.

SFD appeared around 2020 on MQB Evo and MEB platforms (Golf 8, Octavia IV, ID.3/ID.4, etc.).
This system replaced Security Access to enhance security and protect vehicle electronics from unauthorized interference (e.g., unofficial tuning, warranty fraud, or parameter changes without manufacturer approval). It also tracks who did what and when to the ECU: all changes in control units are logged and linked to a specific user/service.
To access protected functions, a special temporary token must be obtained from official manufacturer servers (e.g., via a GeKo account and the SFD server). Once the token is received, the service or diagnostic tool "unlocks" a specific control unit. Reading fault codes and measured values may remain available without unlocking the ECU.
The further development of the SFD system is SFD2. SFD1 (first generation) requires a token for operation, but the token can be used offline (after a one-time online acquisition). SFD2 is a more "strict" version: it operates only online and restricts and monitors the entire diagnostic process in real time.

Currently, the Scandoc diagnostic scanner only supports the first-generation SFD (SFD1) with offline activation.
If the ECU supports SFD, the "SFD" utility will appear in the "Manual mode" tab; if it does not support it, the "Security access" utility will appear.

What the algorithm for unlocking an ECU using the "SFD" utility looks like:
1. The "SFD" utility is launched.
2. An unlock request token is read from the ECU.
3. The request token is copied by the user and manually sent to third-party services, where an unlock token (key) is generated based on it.
4. The received unlock token is pasted into the corresponding field of the utility and sent to the ECU.
5. The unit is unlocked, and the utility finishes its work.

The unlock token (key) must be obtained by any available means independently; Quantexlab does not provide such tokens.
Information on factory repair of VAG vehicles, including SFD tokens, can be obtained directly from the manufacturer for a separate fee. On the official Volkswagen AG erWin Online website, you can access repair manuals, wiring diagrams, service bulletins (TSB) / product technical information (TPI), vehicle identification (by VIN), and much more.
This information is divided by vehicle market (North American region and the rest of the world).

Below are links to the main brands of the VAG Group:


Let’s take a closer look at how the SFD system works.

Let’s run the "SFD" utility, which is located in the "Manual mode" tab.


After launching the utility, you can check the activation status and select the actions to perform — activate SFD or lock the control unit.


1. Activating the SFD system

The screenshot below shows an example of the SFD system status for an ECU with locked access:

To activate the SFD system and unlock the control unit, press the "SFD Activation" button.



There are two options here.

Option A: If you do not yet have an unlock token (key), then answer "No" to the question "do you have a valid SFD token":




The next window contains two fields — a field for the SFD activation request token and a field for the unlock token (key).


If desired, you can re-read the SFD activation request token from the control unit using the "Read again" button.

Next, copy the byte sequence received from the ECU (SFD activation request token) from the upper field and obtain an unlock token (key) for it.

Then paste the unlock token into the lower field of the utility and press the "Activate control unit" button.



Option B: If you already have a valid unlock token (key), click "Yes":




Paste the token (key) into the utility field and send it to the ECU using the "Activate control unit" button.



If the operation is successful, a message will be received indicating that the procedure has been completed successfully.


If the operation fails, a message with the reason for the failure will be received.

The utility will then display the status to verify activation and will finish its work.





2. Locking the ECU

The screenshot below shows an example of the SFD system status for an ECU with unlocked access.

The remaining activation minutes depend on how much time has passed since the control unit was activated.

To lock the ECU, press the "Block control unit" button.




Confirm the operation.



If the operation is successful, a message will appear indicating that the procedure has been completed successfully.




The utility will then display the status to verify activation and will finish its work.





After unlocking the ECU and completing the work, it is advisable to lock the control unit again.

This is not mandatory (the ECU will lock itself automatically after the remaining time expires), but it is recommended.

Newer vehicle models (approximately from 2024 onward) have a specific feature — upon initial connection to the vehicle for diagnostics, only the data bus diagnostic interface ECU (gateway) is accessible. The remaining vehicle control units remain unavailable for connection.

To gain access to the other control units, you need to unlock the gateway via SFD and disable the diagnostic filter in it using the appropriate utility from the "Utilities" tab.

Комментарии