Aftermarket engine tuning has moved from soldering irons and socketed chips to a software fight against locked-down vehicle computers, according to engineers at Audi Performance & Racing, better known as APR. The payoff is familiar to anyone who has paid for a flash tune: more boost, more torque, and a car that feels less like the factory left free power on the table. The work behind it has become much less charming.
APR calibration engineer Chas Gorton told Ars Technica that older ECU tuning could be as direct as removing a memory chip from the engine computer, reading it, writing changed code to another chip, and reinstalling it. Tuners could then alter boost targets, fuel delivery, ignition timing, and related engine parameters.
In the early 2000s, APR added a more theatrical trick with its Enhanced Modular Chipping System. The EMCS module had its own processor and memory and could store four engine maps, including programs for different fuel octane ratings. On some Audi applications, drivers could switch maps with a sequence on the cruise-control stalk while the engine was off.
That was not magic. Gorton said APR reverse-engineered what the ECU could see from the added controller, monitored the cruise-control state, and used specific input sequences to change maps, clear fault codes, or trigger other functions. Earlier systems used a physical switch on the ECU, which meant opening the hood and getting to the computer. The stalk method was tidier and, yes, closer to a cheat code than most automotive engineering admits.
OBD2 made tuning easier, then security made it harder
The OBD2 port, mandated in 1996, gave automakers and repair shops a standard way to diagnose cars and update ECU software. Gorton said it also opened the door for tuners because the port could be used to write new software. At first, APR engineers said, manufacturer security still made bench work easier. By around 2005, port flashing had advanced enough that tuners often no longer needed physical ECU access.
That window narrowed. APR said Volkswagen and Audi tightened ECU security significantly by 2008, starting a cycle in which automakers added protections and tuners searched for new ways through them. Gorton said the company often cannot predict how long a new tune will take because it first has to defeat unknown layers of security.
Jamie Harvey, APR’s software engineering manager and a powertrain calibration engineer, said most new vulnerabilities the reverse-engineering team investigates end in failure after substantial work. Gorton described the process as stepping through code execution point by point, looking for places where the ECU can be made to behave unexpectedly, then chaining those behaviors into a path around protections.
One example involves the flashing process itself. A tuner may tell the ECU how large a file is and where it should begin and end. APR engineers test how the ECU reacts to odd values, bad sizes, or unexpected endpoints. Sometimes that research kills the hardware. Harvey joked to Ars Technica that APR creates plenty of “$1,800 lawn ornaments,” though the company may keep dead ECUs for later research.
Modern calibrations have many more moving parts
APR said older cars such as the B5 Audi S4 might need changes to roughly 10 to 15 parameters. A 2005 Volkswagen GTI needed about 90. Gorton said a 2022 GTI requires roughly 225 changes, while a current Porsche 911 Carrera can require more than 400. Harvey said APR is working on a newer product with more than 500 changes.
The reason is not just power. Modern ECUs manage torque requests, emissions behavior, fuel quality, thermal limits, fault detection, drivability, and region-specific operating conditions inside increasingly global software packages. Harvey said changing one value can cause dozens of others to react, so the calibration has to keep the factory protections working rather than bulldozing through them.
Even cars with shared engines can need different work. APR pointed to the 8V-generation Audi A3 and Mk7 Volkswagen GTI as examples where separate development teams made different choices about drivability and torque management. Gorton said the result is that matching hardware does not mean matching calibration logic.
Race cars used the same tricks
APR also used ECU control in racing. Gorton said the company had a calibration engineer at every event during its first year in the Grand-Am KONI Challenge Series, the predecessor to IMSA’s Michelin Pilot Challenge, so files could be adjusted for conditions.
Ian Baas, APR’s marketing coordinator and a driver in its 2008 and 2009 KONI Challenge seasons, said the team later used a rules interpretation to add a push-to-pass-style overboost function. A driver could pull the cruise-control stalk and get extra boost for a limited time, without tripping the ECU’s protections. Harvey said the system depended on precise boost control because time spent over a limit was counted in milliseconds.
APR’s engineers said the next phase will involve more locked-down ECUs and more complex powertrains, including hybrids. They said manufacturers such as BMW and Ford have changed their security approaches over time, forcing tuners to restart the same unglamorous work: find the door, prove it opens, and try not to turn another expensive ECU into office decor.
This story draws on original reporting from Ars Technica.
