Alright this is going to take me some time to get this all edited up nicely so bear with me.
All of this was done in a 2009 Mazdaspeed 3. This will for certain work on the Mazdaspeed 6 and I assume the systems we describe here are identical on the Gen2 platform as well, but it's only an assumption. I have not tested or researched very thoroughly compatibility for Gen2 speeds. I'm also going to make the assumption that you have sourced a replacement ECU for your vehicle. There are several services available (got mine from eBay) that will send you a remanufactured ECU with your VIN number already flashed, for a pretty reasonable price.
If you have an AccessPort installed, see if you can get it to uninstall from your ECU. I was able to successfully uninstall my AccessPort, as the only bit on my ECU that was not functioning seemed to be fuel system control. If your ECU will not boot at all, check fuses. If it sill won't boot, you will need to send your AP to Cobb to have it set back to "uninstalled".
Overview of the process.
Mazda and Ford were friends at one time, as you can tell from the variety of fomoco stamped parts in your speed. Maybe they still are, who cares. Anyways, they actually employed damn near the exact same anti-theft system between both companies. PATS, which stands for Passive Anti-Theft System. This system works similar to a two-tier PKI in the computer/cryptography world in that there is a "shared secret" between your ECU and the HEC (the computer that lives in your instrument cluster). You turn your key over, the HEC verifies that they key ID is stored in it's memory and allows the ECU to begin to boot if so. Both systems boot and exchange a handshake on the CANBus. If your handshake is not successful (you dropped a fresh ECU into the car that doesn't have the same 'secret key'), the ECU will not boot further and the HEC will report that a theft has occurred and your vehicle is now immobilized. Fun times!
Mazda's process for this repair is to replace the ECU, connect their VCM-II computer diagnostic device to the OBD port in your vehicle, and perform a procedure to marry the two computers in your vehicle, via the Mazda IDS software. Both the ECU and the HEC will present an "Outcode" during this process. The Mazda technician makes note of each Outcode, plugs them into Mazda's service website, and the website spits back out two separate "Incodes". This algorithm on Mazda's service website is the key to making these two computers talk to each other, and is typically behind a paywall/subscription/fee. Fuck that.
It quickly became apparent that my biggest hurdle was going to be trying to track down the hardware and software that Mazda uses at the shop for this sort of bullshit. And I'm sure as fuck not paying Mazda/Bosch $1795 for a glorified microcontroller with some relays. Oh and I'm sure as shit not paying for a subscription to use their software to FIX MY OWN CAR.
One final note, you will need AT LEAST two keys to complete this procedure. I have only ever had one key with this car as I bought it used, so I ordered some replacements and had them cut at the local hardware store (unsuccessfully but more on that later). Really all you need is one functioning cut key that will turn in the cylinder, and you can use an uncut key as the secondary as long as it has the appropriate RFID chip inside. Oh and some tinfoil.
Part 1 - Finding a VCM-II unit
Tracking down a functional non-ripoff unit seemed to be more difficult that I thought! There are SO MANY 'emulators' and just straight up bullshit products on the market so be very careful and vigilant in your research. I ended up finding this video on YouTube, of a gentleman tearing down one of these products. Once I saw what the inside of the unit he received looked like, I knew I had found my VCM. The vendor being a co.uk website, I was leery.....and against my better judgement and after being burned by this sort of crap in the past, I placed an order on the website the gentleman in the YT video ordered his unit from, and I was pleasantly surprised with a very nice VCM-II unit. See the description in the video for more info on where that was ordered from, I am not affiliated with the seller in any way, you are on your own for this part unfortunately and I accept no liability or whatever legal jargon I need to say "don't blame me if you don't get a good product". I'll do everything I can to show you what to look for here but there's always some shitbag out there looking to make a quick buck by selling a bogus computer.
LM Auto Repairs - Mazda VCM 2 interface teardown: https://youtu.be/yhhxcAy9QnQ
Here's a quick side-by-side of one bad cheap knock off VCM tool, and a solid clone.
Piece of SHIT - DO NOT BUY
Where's the chips?!? We should be seeing two separate (much larger) processor units on this board and we should see several memory chips on the PCB. None of that is present, and we're seeing a single ARM processor. Not cool. Most likely running some sort of diag emulation crap that is going to be very non-useful.
Solid clone - Quality product!
Another view without the daughter board attached
Notice the substantial differences between the two PCB's. Here are our larger processing units, and two separate PCB's. A daughter board attached to the main board, which should have some sort of Altera processor. THIS is what we are after.
Your new VCM-II unit should come with a copy of Mazda IDS software!!! If it did not, please PM me and we can see what we can do for you, but most vendors will send you a CD with the software along with your order. The version I received is v106, which worked just fine. With this tool, and the software, you are now ready to tackle literally anything you can imagine in your Mazda (and/or Ford if you purchased the dual purpose VCM-II unit). ECU replacement and reprogramming, key replacement and reprogramming, fob replacement and reprogramming, perform computer driven self checks on each system in your car all at once or individually, etc. It's pretty cool!
Part 2 - Installing the software and getting your VCM connected
From my research, Mazda IDS only runs on Windows 7. I have not tried running it on Windows 10 yet because the laptop I have for my garage is an absolute flaming piece of garbage and I'm not wasting my time doing anything more to it than I have to. There are two programs that should install along with the Mazda IDS suite. There is the Mazda IDS software which installs a few utilities related to the VCM and of course IDS itself, and there should a Mazda Calibration setup to run, which extends the device configurations for newer model cars. Mine was labeled 'MazdaCalibration C93'.
Alright so first thing is first, we need to connect the VCM-II via USB to your fancy pants laptop. Launch the 'VCM II Manager' software and you should be greeted with this nice little message.
Hit connect!
Leave this window open and now plug the OBD end of things into your car's OBD port and lets launch the IDS software.
Part 3 - Connecting to the car's ECU via Mazda IDS
Launch the IDS software now that your VCM device is connected, and you should be greeted with this screen. These menu's are clunky as hell btw :|
Start a new session, and select All other, then hit the checkmark in the bottom right.
At this point, if you have purchased and installed the proper PCM unit you should see the appropriate vehicle information displayed here. For this particular screenshot my PATS status is "Equipped" as I've already programmed this PCM and the HEC is happy. When things are not happy, PATS will report vehicle immobilized.
If the software does not connect here, you need to make sure that the ECU is actually booting by checking for a 5v reference coming out of the thing. Double check fuses in the passenger footwell and ensure you have 12v to the ECU with the KOEO in the fuse box in the engine bay. I fought this step a bit as I had some really shitty wires that needed replaced.
Next you are going to be asked if your vehicle is equipped with DSC. Select yes, and hit the green checkbox.
Confirm your market
This next screen is more for keeping track of servicing if you are a genuine Mazda tech shop. Feel free to leave all this crap blank, it doesn't make any difference that I can tell aside from note keeping.
Double check your VIN, you probably don't want to end up with an incorrect number here.
Part 4 - Resetting and reprogramming the PCM and HEC
Now we are at the fun part. This menu contains the bulk of features this VCM is capable of. The yellow sign post icon at the top has additional niftiness and your VCM device should actually support plugging in a probe and performing oscilloscope work directly in the IDS software which is pretty bad ass, which you will find in that menu.
For now, we need to start in Body > Security > PATS Functions, and hit the check in the bottom right.
Follow the instructions
You will be asked if your vehicle has an SKE system which is fancy keyless entry. My vehicle did not have it, if you have a Speed 6 or a Genpu this may apply here. It's not going to end the world if you select yes, if anything it's going to complain that it doesn't detect the SKE and you will be dumped back a couple steps. No big deal.
Now, what I did here was select Parameter Reset.
This next step describes the process for gaining security access to your car.
Now is where you need to make a note of the Outcode for your HEC module, and the Outcode for the PCM. Make sure you know which one is which, taking a picture of the screen with your phone is easiest for sure.
There are several apps available to take care of this next step, and I was lucky enough to find one that worked well the first try. I have an android phone and don't have good instructions if you have an iPhone...I think there are some apps available but you will need to search for them. Sorry!!
Incode by Outcode - Published by OBD High Tech
Launch the app, and plug in your first Outcode. Write down the resulting Incode. You can either go back in the app and get lucky enough to be able to run another Outcode operation, or I had luck with force closing the app and relaunching it to skip the cooldown timer. Punch in your second Outcode, and make note of the generated Incode.
Enter your codes into the Mazda IDS software, and hit the checkmark in the bottom right.
Hell yeah brother!! Fuck you Mazda service center!
You will now be warned about needing two keys. Heed this warning and have two ready.
If you, like me, only have one functioning cut key and one key that is either uncut or does not turn in the cylinder, do not fear. Your best pal tinfoil is here. During the programming process you will be asked to put the first key into the ignition, turn it over and wait 5 seconds. Then you will be asked to plug the second key in and do the same thing. Instead what you are going to do is wrap the end of your good key in a couple layers of tinfoil, so that you are blocking the RFID signal. Put the key in the ignition, and hold the plastic end of your other nonfunctional key up to where your tinfoil covered key now sits, nice and close to the RFID receiver in your ignition cylinder. Turn the key over keeping the other key close and presto! You programmed the HEC with the RFID module in the second non-cut/non-functional key. Now that you have IDS and a VCM you can get as many keys as you want later!
I unfortunately do not have a screenshot of the key procedure, as I programmed my ECU before I made this tutorial, but I assure you as long as you read the instructions in the IDS software, the process is very simple to program both keys. This next screen after you have reset things, make sure to select that you have replaced the PCM, and hit the checkbox.
Here is where things get fuzzy for me in my recollection of events, I was about in shock that this was all actually working hahaha. If you have not already been asked to perform the key programming procedure, or your car will still not start, you need to select "Ignition Key Code Erase and Program' from this same menu screen.
You will be asked to perform the Outcode/Incode procedure each time you go through this process. So far my numbers have been different each time so keep the Incode by Outcode app handy!
Really, this is the bulk of the procedure that was needed for me to replace the ECU in my car. Once PATS is satisfied again and you can turn the motor over, re-install your AccessPort and flash your tune back to the vehicle before you go ripping around again!
If anyone ever needs to go through this process and gets to a step I haven't covered here or you need help with anything, let me know and I'm happy to try and assist you with what I can! Good luck out there dudes and gentleladies and don't blow your car up!
There is a lot more you can do in the way of diagnostics with your fancy new VCM-II device, including autonomous logging to the onboard SD card just like we do with our AccessPorts. You should definitely poke around the menu's now that you've gotten this all connected and working. You deserve it! Also beer, you deserve beer.
All of this was done in a 2009 Mazdaspeed 3. This will for certain work on the Mazdaspeed 6 and I assume the systems we describe here are identical on the Gen2 platform as well, but it's only an assumption. I have not tested or researched very thoroughly compatibility for Gen2 speeds. I'm also going to make the assumption that you have sourced a replacement ECU for your vehicle. There are several services available (got mine from eBay) that will send you a remanufactured ECU with your VIN number already flashed, for a pretty reasonable price.
If you have an AccessPort installed, see if you can get it to uninstall from your ECU. I was able to successfully uninstall my AccessPort, as the only bit on my ECU that was not functioning seemed to be fuel system control. If your ECU will not boot at all, check fuses. If it sill won't boot, you will need to send your AP to Cobb to have it set back to "uninstalled".
Overview of the process.
Mazda and Ford were friends at one time, as you can tell from the variety of fomoco stamped parts in your speed. Maybe they still are, who cares. Anyways, they actually employed damn near the exact same anti-theft system between both companies. PATS, which stands for Passive Anti-Theft System. This system works similar to a two-tier PKI in the computer/cryptography world in that there is a "shared secret" between your ECU and the HEC (the computer that lives in your instrument cluster). You turn your key over, the HEC verifies that they key ID is stored in it's memory and allows the ECU to begin to boot if so. Both systems boot and exchange a handshake on the CANBus. If your handshake is not successful (you dropped a fresh ECU into the car that doesn't have the same 'secret key'), the ECU will not boot further and the HEC will report that a theft has occurred and your vehicle is now immobilized. Fun times!
Mazda's process for this repair is to replace the ECU, connect their VCM-II computer diagnostic device to the OBD port in your vehicle, and perform a procedure to marry the two computers in your vehicle, via the Mazda IDS software. Both the ECU and the HEC will present an "Outcode" during this process. The Mazda technician makes note of each Outcode, plugs them into Mazda's service website, and the website spits back out two separate "Incodes". This algorithm on Mazda's service website is the key to making these two computers talk to each other, and is typically behind a paywall/subscription/fee. Fuck that.
It quickly became apparent that my biggest hurdle was going to be trying to track down the hardware and software that Mazda uses at the shop for this sort of bullshit. And I'm sure as fuck not paying Mazda/Bosch $1795 for a glorified microcontroller with some relays. Oh and I'm sure as shit not paying for a subscription to use their software to FIX MY OWN CAR.
One final note, you will need AT LEAST two keys to complete this procedure. I have only ever had one key with this car as I bought it used, so I ordered some replacements and had them cut at the local hardware store (unsuccessfully but more on that later). Really all you need is one functioning cut key that will turn in the cylinder, and you can use an uncut key as the secondary as long as it has the appropriate RFID chip inside. Oh and some tinfoil.
Part 1 - Finding a VCM-II unit
Tracking down a functional non-ripoff unit seemed to be more difficult that I thought! There are SO MANY 'emulators' and just straight up bullshit products on the market so be very careful and vigilant in your research. I ended up finding this video on YouTube, of a gentleman tearing down one of these products. Once I saw what the inside of the unit he received looked like, I knew I had found my VCM. The vendor being a co.uk website, I was leery.....and against my better judgement and after being burned by this sort of crap in the past, I placed an order on the website the gentleman in the YT video ordered his unit from, and I was pleasantly surprised with a very nice VCM-II unit. See the description in the video for more info on where that was ordered from, I am not affiliated with the seller in any way, you are on your own for this part unfortunately and I accept no liability or whatever legal jargon I need to say "don't blame me if you don't get a good product". I'll do everything I can to show you what to look for here but there's always some shitbag out there looking to make a quick buck by selling a bogus computer.
LM Auto Repairs - Mazda VCM 2 interface teardown: https://youtu.be/yhhxcAy9QnQ
Here's a quick side-by-side of one bad cheap knock off VCM tool, and a solid clone.
Piece of SHIT - DO NOT BUY
Where's the chips?!? We should be seeing two separate (much larger) processor units on this board and we should see several memory chips on the PCB. None of that is present, and we're seeing a single ARM processor. Not cool. Most likely running some sort of diag emulation crap that is going to be very non-useful.
Solid clone - Quality product!
Another view without the daughter board attached
Notice the substantial differences between the two PCB's. Here are our larger processing units, and two separate PCB's. A daughter board attached to the main board, which should have some sort of Altera processor. THIS is what we are after.
Your new VCM-II unit should come with a copy of Mazda IDS software!!! If it did not, please PM me and we can see what we can do for you, but most vendors will send you a CD with the software along with your order. The version I received is v106, which worked just fine. With this tool, and the software, you are now ready to tackle literally anything you can imagine in your Mazda (and/or Ford if you purchased the dual purpose VCM-II unit). ECU replacement and reprogramming, key replacement and reprogramming, fob replacement and reprogramming, perform computer driven self checks on each system in your car all at once or individually, etc. It's pretty cool!
Part 2 - Installing the software and getting your VCM connected
From my research, Mazda IDS only runs on Windows 7. I have not tried running it on Windows 10 yet because the laptop I have for my garage is an absolute flaming piece of garbage and I'm not wasting my time doing anything more to it than I have to. There are two programs that should install along with the Mazda IDS suite. There is the Mazda IDS software which installs a few utilities related to the VCM and of course IDS itself, and there should a Mazda Calibration setup to run, which extends the device configurations for newer model cars. Mine was labeled 'MazdaCalibration C93'.
Alright so first thing is first, we need to connect the VCM-II via USB to your fancy pants laptop. Launch the 'VCM II Manager' software and you should be greeted with this nice little message.
Hit connect!
Leave this window open and now plug the OBD end of things into your car's OBD port and lets launch the IDS software.
Part 3 - Connecting to the car's ECU via Mazda IDS
Launch the IDS software now that your VCM device is connected, and you should be greeted with this screen. These menu's are clunky as hell btw :|
Start a new session, and select All other, then hit the checkmark in the bottom right.
At this point, if you have purchased and installed the proper PCM unit you should see the appropriate vehicle information displayed here. For this particular screenshot my PATS status is "Equipped" as I've already programmed this PCM and the HEC is happy. When things are not happy, PATS will report vehicle immobilized.
If the software does not connect here, you need to make sure that the ECU is actually booting by checking for a 5v reference coming out of the thing. Double check fuses in the passenger footwell and ensure you have 12v to the ECU with the KOEO in the fuse box in the engine bay. I fought this step a bit as I had some really shitty wires that needed replaced.
Next you are going to be asked if your vehicle is equipped with DSC. Select yes, and hit the green checkbox.
Confirm your market
This next screen is more for keeping track of servicing if you are a genuine Mazda tech shop. Feel free to leave all this crap blank, it doesn't make any difference that I can tell aside from note keeping.
Double check your VIN, you probably don't want to end up with an incorrect number here.
Part 4 - Resetting and reprogramming the PCM and HEC
Now we are at the fun part. This menu contains the bulk of features this VCM is capable of. The yellow sign post icon at the top has additional niftiness and your VCM device should actually support plugging in a probe and performing oscilloscope work directly in the IDS software which is pretty bad ass, which you will find in that menu.
For now, we need to start in Body > Security > PATS Functions, and hit the check in the bottom right.
Follow the instructions
You will be asked if your vehicle has an SKE system which is fancy keyless entry. My vehicle did not have it, if you have a Speed 6 or a Genpu this may apply here. It's not going to end the world if you select yes, if anything it's going to complain that it doesn't detect the SKE and you will be dumped back a couple steps. No big deal.
Now, what I did here was select Parameter Reset.
This next step describes the process for gaining security access to your car.
Now is where you need to make a note of the Outcode for your HEC module, and the Outcode for the PCM. Make sure you know which one is which, taking a picture of the screen with your phone is easiest for sure.
There are several apps available to take care of this next step, and I was lucky enough to find one that worked well the first try. I have an android phone and don't have good instructions if you have an iPhone...I think there are some apps available but you will need to search for them. Sorry!!
Incode by Outcode - Published by OBD High Tech
Launch the app, and plug in your first Outcode. Write down the resulting Incode. You can either go back in the app and get lucky enough to be able to run another Outcode operation, or I had luck with force closing the app and relaunching it to skip the cooldown timer. Punch in your second Outcode, and make note of the generated Incode.
Enter your codes into the Mazda IDS software, and hit the checkmark in the bottom right.
Hell yeah brother!! Fuck you Mazda service center!
You will now be warned about needing two keys. Heed this warning and have two ready.
If you, like me, only have one functioning cut key and one key that is either uncut or does not turn in the cylinder, do not fear. Your best pal tinfoil is here. During the programming process you will be asked to put the first key into the ignition, turn it over and wait 5 seconds. Then you will be asked to plug the second key in and do the same thing. Instead what you are going to do is wrap the end of your good key in a couple layers of tinfoil, so that you are blocking the RFID signal. Put the key in the ignition, and hold the plastic end of your other nonfunctional key up to where your tinfoil covered key now sits, nice and close to the RFID receiver in your ignition cylinder. Turn the key over keeping the other key close and presto! You programmed the HEC with the RFID module in the second non-cut/non-functional key. Now that you have IDS and a VCM you can get as many keys as you want later!
I unfortunately do not have a screenshot of the key procedure, as I programmed my ECU before I made this tutorial, but I assure you as long as you read the instructions in the IDS software, the process is very simple to program both keys. This next screen after you have reset things, make sure to select that you have replaced the PCM, and hit the checkbox.
Here is where things get fuzzy for me in my recollection of events, I was about in shock that this was all actually working hahaha. If you have not already been asked to perform the key programming procedure, or your car will still not start, you need to select "Ignition Key Code Erase and Program' from this same menu screen.
You will be asked to perform the Outcode/Incode procedure each time you go through this process. So far my numbers have been different each time so keep the Incode by Outcode app handy!
Really, this is the bulk of the procedure that was needed for me to replace the ECU in my car. Once PATS is satisfied again and you can turn the motor over, re-install your AccessPort and flash your tune back to the vehicle before you go ripping around again!
If anyone ever needs to go through this process and gets to a step I haven't covered here or you need help with anything, let me know and I'm happy to try and assist you with what I can! Good luck out there dudes and gentleladies and don't blow your car up!
There is a lot more you can do in the way of diagnostics with your fancy new VCM-II device, including autonomous logging to the onboard SD card just like we do with our AccessPorts. You should definitely poke around the menu's now that you've gotten this all connected and working. You deserve it! Also beer, you deserve beer.
Last edited by a moderator:
