VW / Audi P1570 Explained: Immobilizer Blocked ECU, Used-ECU Swaps, and the Two Real Fixes

What P1570 actually means

P1570 on a Volkswagen or Audi means the immobilizer has blocked the engine control unit. That is the whole message. The ECU powers up, joins the data bus, answers your scan tool, and reports fault codes normally. What it will not do is fire the injectors, because during the start sequence it asked the vehicle's security system a question and did not get the answer it was expecting.

Depending on scan tool, model year, and language pack, the same code appears with slightly different wording: "immobilizer active," "engine start blocked by immobilizer," "control module blocked," or "control unit locked." They all describe the same condition. Nothing is physically broken. The ECU is refusing to run on purpose.

This matters because P1570 sends a lot of people down the wrong repair path. It is not a fuel code, not a crank-sensor code, and not usually a wiring code. Chasing relays, pumps, and grounds on a P1570 car is how a weekend disappears. The code is a security verdict, and the fix has to happen at the security layer.

P1570 is a manufacturer-specific code, which is why it is not in the generic list your parts-store reader prints out. Under the diagnostic standards published by SAE International, codes in the P1xxx block are reserved for manufacturer-defined faults, while P0xxx codes are the standardized set every carmaker shares. That is also why a cheap generic reader may show P1570 with no description at all, or with a description borrowed from an entirely different brand. Read VAG codes with a tool that speaks VAG.

The two real paths out of P1570

There are exactly two, and it is worth being blunt about them before going any further.

Path one: adapt or match the ECU to the car. The ECU and the module that holds the immobilizer data are brought back into agreement, so the handshake succeeds and the engine is authorized to start. This is the correct, factory-intent repair for the overwhelming majority of P1570 cars, and it is the path you should want.

Path two: remove the immobilizer routine from the ECU. Often called immo-off or immobilizer delete, this modifies the ECU so it no longer requires the security handshake before running. It exists for legitimate repair situations where path one is genuinely impossible, for off-road and competition vehicles, and for orphaned platforms where the original security data cannot be recovered at any price. It is a real tool for real dead-end repairs, and it requires proof of ownership.

Which path is available to you is not a matter of preference. It is determined by your platform generation, by whether the original security data still exists somewhere on the car, and by whether the ECU is a locked unit still married to a different vehicle. So the generations come next.

How the VW / Audi immobilizer chain works, generation by generation

Volkswagen Group has run four broad immobilizer architectures on cars still on the road in the United States. Getting the generation right is the single most useful thing you can do before spending money.

IMMO 2 and IMMO 3 — the data lives in the cluster

On the older architecture, roughly the mid-1990s through the mid-2000s depending on model, the instrument cluster is the security brain. The cluster stores the immobilizer secret, learns which transponder keys are allowed, and holds a component security code. At every key-on the cluster and the ECU exchange a challenge and response. If the ECU does not get the expected answer, it blocks the start and logs P1570.

The practical consequence is enormous: on these cars the cluster is a security part, not a gauge assembly. Swap a cluster and you have swapped half the immobilizer. That is exactly why cluster work on these platforms is key-programming work and lands on a bench rather than in a driveway, and it is the reason the VW and Audi cluster key programming service exists as its own dedicated job at $250.

IMMO 4 — the data spreads out

From roughly the mid-2000s, VAG moved to a distributed model. The security data no longer lives in one box. Instead it is spread across several modules that cross-check each other. Depending on model that set can include the cluster, the engine ECU, the comfort or body control module, and on keyless cars the Kessy access-and-start module. Each holds a piece, and each verifies the others.

This is the generation where the phrase component protection enters the conversation. A control unit is cryptographically bound to one specific vehicle, and if it turns up in a different car it will refuse to operate fully until it is authorized against that vehicle's security data. The distributed design was a deliberate anti-theft measure, and by that measure it works. It also means a single-module swap by an owner in a driveway now has a far higher chance of ending in a no-start than it did a generation earlier. If it helps to see the whole distributed picture side by side, our VW and Audi immobilizer no-start guide by platform walks the generations model by model.

IMMO 5 and the MQB era — tightest of all

The newest architecture on the road tightened the same idea further, with more modules participating, longer keys, and stronger cryptography. On the newest cars some authorization steps are designed to be completed only with online access to the manufacturer's secure servers. That is not a marketing claim, it is the design. We will come back to it in the honest-limits section, because it is the boundary where any workshop that tells you the truth has to stop and say so.

The direction of travel across all four generations is the same one the whole industry has taken. The National Highway Traffic Safety Administration has documented for years that the count of networked control units in a mainstream vehicle keeps climbing, with a modern car commonly carrying well over 50 electronic control units, and security functions have moved from one box to many. Industry coverage from Car and Driver has noted that electronics and software now account for a large and rising share of a new vehicle's cost, by some estimates approaching 40% of the value of a new car. Meanwhile the National Insurance Crime Bureau reports vehicle theft in the United States running into the hundreds of thousands of vehicles per year, and the Federal Bureau of Investigation tracks motor-vehicle theft as one of the more common property crimes in the country. Immobilizers got harder because theft pressure never let up.

Why a used ECU from a scrapyard throws P1570 immediately

This is the most common way people meet this code, so it deserves its own section.

You buy a used engine ECU with the correct part number, from the correct model year, from a car that looked exactly like yours in the yard. You bolt it in. The car cranks and will not start, and there is P1570 sitting in memory.

Nothing went wrong with the installation. The donor ECU is still carrying the other car's immobilizer identity. It knows a different VIN, a different security code, and a different set of key secrets. Plugged into your car, it asks your cluster or comfort module for an answer it will never receive, so it blocks the start exactly as it was designed to.

The part number matching is a red herring. Part numbers describe hardware and calibration compatibility. They say nothing about identity. Two ECUs can be electrically and functionally identical and still be permanently unwilling to run each other's cars. If you want the underlying mechanics of where that identity physically lives on the circuit board and how it moves between units, our explainer on how ECU cloning works at the EEPROM and immobilizer-data level covers it in detail.

There are three ways a used ECU ends up usable on your car:

1. Clone your original ECU data onto the donor. If your old ECU can still be read, even when it is unreliable in the vehicle, its identity can often be copied onto the donor. The car then sees your original ECU, and your keys still work.
2. Adapt the donor to your vehicle. Where the platform allows it, the donor's identity is rewritten to match your VIN and security data so the handshake succeeds.
3. Immo-off the donor. Where neither of the above is possible and the situation qualifies, the security routine is removed so the ECU no longer requires the handshake. This is the last resort, not the opener, and it needs proof of ownership.

Any workshop that jumps straight to option three without asking whether one or two is possible is not doing you a favor.

Symptoms that travel with P1570

P1570 rarely arrives alone. The pattern is consistent enough to be diagnostic on its own:

• Crank, no start. The starter turns the engine normally. There is no stumble, no cough, no attempt to fire. It simply cranks.
• Immobilizer icon flashing. On most VAG dashboards a small key or car-with-key symbol flashes rather than illuminating steadily. A flashing icon is the security system saying it did not recognize the key or did not complete the handshake. A steady icon during a normal start sequence is not the same thing.
• Fuel and spark absent by command. Bench and live-data checks show injection and ignition are being withheld, not failing. That is the ECU obeying the block.
• The ECU communicates perfectly. No lost-communication codes, no bus faults. The module is healthy.
• Symptoms appeared immediately after a parts change. ECU, cluster, comfort module, ignition switch, or key work is by far the most common trigger.
• A second key behaves identically. If both keys fail the same way, suspect the module chain rather than the key.

That last one is a useful five-minute test before spending anything. One bad key is a key problem. Two keys failing identically points at the modules.

Adapt versus immo-off — the honest comparison

	Adapt or match the ECU to the car	Immo-off (remove the routine)
What changes	The ECU and the security modules are brought back into agreement	The ECU no longer asks for authorization at all
Factory anti-theft after the fix	Fully intact	Reduced or removed on the engine side
Best for	Nearly all P1570 cars, including used-ECU swaps where data is recoverable	Repair dead ends, off-road and competition use, orphaned platforms
Requires original security data	Yes, from your cluster, ECU, or comfort module	No
Keys still needed to start	Yes	Not required by the ECU
Proof of ownership	Required	Required, without exception
Typical bench services	Cluster key programming $250, immo delete and VIN program $250	ME7 immo off $250, EDC16 TDI immo delete $250, UDS immo off $350

The table makes the point that the price difference is small and the security difference is large. Choose adaptation whenever adaptation is possible. Choose immo-off only when the alternative is a car that never runs again.

What has to be shipped in, by platform family

Because the security data is distributed, the right answer to "what do I send you" changes by generation. This is why the intake conversation happens before anything goes in a box.

• Gasoline cars on Bosch ME7, roughly 1998 to 2006. The immobilizer routine sits in the engine ECU with the cluster holding the counterpart data. For a genuine dead-end case the VW and Audi ME7 immo off service is a $250 flat bench job on the ECU.
• Diesel cars on EDC16, the common TDI generation. These are their own family and their own procedure, handled by the VW and Audi EDC16 TDI immo delete service at $250.
• Later UDS-protocol control units. Newer diagnostic protocol, more security, more work, which is why the VW and Audi UDS immo off service is $350 rather than $250.
• Cluster-centred cars needing keys or alignment. Where the cluster is the security brain and the real requirement is key programming or immobilizer alignment, the cluster key programming service at $250 is the job, and the cluster is what ships.
• Cars needing a used or replacement ECU brought onto the vehicle. The VW and Audi immo delete and VIN program service at $250 covers writing the correct VIN and addressing the security block on the unit you send in.

On distributed-security cars it is common to need more than one part on the bench at once, most often the ECU together with the cluster, and on some cars a working key. That is normal and it is cheaper to establish up front than to discover after one part has already made a round trip.

"Ninety percent of the P1570 cars that reach me arrived on a hook after somebody fitted a yard ECU with the right part number. The part is fine. It just belongs to another car and it knows it. If the customer had sent me both units at the start we would have cloned the original identity across and had it running the same day, keys untouched, security intact." — Independent European driveability technician, 18+ years (anonymized)

The diesel and Touareg angle

TDI owners find this code by a slightly different route, and it is worth naming directly because the search terms differ.

Diesel VAG cars have long service lives and strong parts availability, which means used-ECU swaps are unusually common on them. An owner facing a failed engine controller finds a same-part-number unit for a fraction of dealer money, fits it, and lands on a crank-no-start with the immobilizer flashing. The result is a lot of searching for "Touareg TDI ECU fault" or "TDI ECU replacement no start" when the actual condition is P1570 and the actual cause is an unadapted donor unit.

Two extra wrinkles apply to the diesel family. First, larger VAG diesels sit on the more distributed architectures, so more modules participate in the handshake and a single-part swap is less likely to succeed unaided. Second, the EDC16 family is its own procedure with its own tooling, which is exactly why it is a separate service rather than a footnote on a gasoline one. If your engine is a TDI, say so in the first message, because it changes the answer.

Diesel or gasoline, the underlying rule has not changed since the Environmental Protection Agency required standardized on-board diagnostics on light vehicles sold in the United States beginning with the 1996 model year: the ECU is a networked computer with an identity, and identity does not transfer with a part number.

The honest limits

Here is where a workshop should tell you what it cannot do.

Some late component-protection cars require online factory access. On the newest architectures, certain authorization steps are designed to be completed only through the manufacturer's secure online systems. No bench, no tool, and no clever workaround changes that by wishing. When a car falls in that group the honest answer is that the job belongs to a facility with that online access, and we will tell you that before you ship rather than after.

Immo-off is not a universal escape hatch. It applies to specific control-unit families with known, documented procedures. It is not available on every VAG car, and it is not offered for late component-protection platforms where the correct repair path is authorization.

Software cannot fix a physically failed module. If an ECU has a dead driver stage, water damage, or a failed processor, no security work makes it run. That is a repair or replace decision, not an immobilizer one.

A read may not be possible. Cloning your original identity onto a donor assumes the original still reads. Sometimes it does not, and then the options narrow. That is why intake starts with what you still have rather than with what you want.

Legal framing and proof of ownership

Immobilizer delete work is offered for legitimate repair, off-road and competition use, and orphaned-platform cases where the original security data is genuinely unrecoverable. It is not a convenience feature, it is not a way around a lost key, and it is not sold or framed as a way to bypass anti-theft protection on a vehicle you do not own.

Proof of ownership is required for all key, immobilizer, and security-linked work, without exception. In practice that means documentation tying your name to the vehicle, such as a registration or title. Reputable shops verify ownership. A shop that does not ask should worry you, and the Federal Trade Commission publishes consumer guidance on vetting automotive services that is worth reading if you are choosing a provider for the first time.

Removing an immobilizer routine also has consequences you should weigh with clear eyes. The engine-side theft deterrent that the factory fitted is reduced or removed. That can matter for insurance, for resale, and for how the vehicle may be operated where you live. You are responsible for compliance with the laws that apply to your vehicle and your intended use, and if the vehicle is a daily-driven, road-registered car with a recoverable security path, adaptation is the better answer on every axis.

The mail-in workflow

The whole point of a bench service is that you ship a part rather than move a vehicle. This is a nationwide mail-in workshop, so the sequence is the same wherever you are.

1. Text us before you remove anything. Send the VIN, year, make, model, engine, the module part number from the label, a photo of that label, whether the ECU is your original or a donor, how many working keys you have, and exactly when P1570 appeared. This is where the generation gets identified and the right path gets chosen.
2. Provide proof of ownership. Nothing security-linked proceeds without it.
3. Ship what we ask for. Sometimes just the ECU. On distributed-security cars often the ECU plus the cluster, and occasionally a working key. Ship to 1168 W Pioneer Parkway, Arlington TX 76013, in an anti-static bag inside a padded box.
4. Bench read and archive. Modules are powered on a regulated bench supply, the existing data is read where the unit still reads, and it is archived before any change.
5. Adapt, program, or where appropriate remove. The path agreed at intake is carried out on the bench, where a voltage sag cannot brick a module mid-write the way it can in a car with a marginal battery.
6. Bench verify. Communication and function are checked before anything leaves the shop.
7. Return with tracking. Return shipping is a flat-rate tier you choose at checkout, from $14.95, with faster options available. You reinstall the part.

Frequently asked questions

What does P1570 mean on a VW or Audi? P1570 means the immobilizer system has blocked the engine control unit from starting the engine. The ECU is powered, communicating, and healthy, but it did not receive the expected security response during the start sequence, so it withheld fuel and spark deliberately rather than failing.

Why does my car crank but not start after installing a used ECU? Because the donor ECU still carries the previous vehicle's immobilizer identity. Matching part numbers only prove hardware compatibility, not identity, so the used unit asks your car for a security answer it will never get and blocks the start. It has to be cloned, adapted, or in dead-end cases immo-off before it will run.

Can P1570 be cleared with a scan tool? No. Clearing the code erases the record but not the condition, so it returns on the next start attempt. P1570 is the outcome of a failed security handshake, which means the fix has to happen at the immobilizer layer by adapting the module or, in genuine dead-end cases, removing the routine.

Is immobilizer delete legal? Immobilizer delete is offered only for legitimate repair, off-road and competition use, and orphaned platforms where the original security data is unrecoverable, and proof of ownership is always required. Because it reduces factory anti-theft protection, you are responsible for compliance with the laws that apply to your vehicle and intended use.

Do I need to send the cluster as well as the ECU? Often yes on distributed-security cars, because the immobilizer data is spread across the cluster, ECU, and body or Kessy module rather than living in one box. On older cluster-centred cars the cluster alone may be the correct part. Send the VIN first and the intake answers this before anything ships.

Can every VW or Audi be fixed on a bench? No, and any shop claiming otherwise is overselling. Some late component-protection vehicles require online access to the manufacturer's secure systems to complete authorization, and those jobs belong with a facility that has that access. We identify those cars at intake and tell you before you spend money on shipping.

Does immo-off affect my keys? After an immobilizer delete on the engine side, the ECU no longer requires a valid key handshake to allow the engine to run, which is precisely why it reduces theft protection. Where your keys and security data are still recoverable, adaptation keeps your keys working and keeps the factory anti-theft intact, which is the better outcome.

The bottom line

P1570 is not a mystery code. It is the immobilizer telling you it blocked the engine control unit, and the only question worth answering is why the handshake failed. On older cluster-centred cars the security brain is the instrument cluster. On IMMO 4 and later the data is deliberately spread across the cluster, ECU, body module, and Kessy so that no single swapped part can quietly bring a car to life. That design is why your correctly numbered scrapyard ECU cranks and never fires.

Two paths lead out. Adapt the ECU to the car and keep every bit of factory security, which is the right answer for the large majority of vehicles and covers used-ECU swaps whenever the original data can still be read. Or, only where the first path is genuinely closed, remove the immobilizer routine under a proof-of-ownership requirement and with clear eyes about what that trades away. Bench pricing is flat and public: $250 for immo delete and VIN programming, $250 for ME7 immo off, $250 for EDC16 TDI immo delete, $350 for UDS immo off, and $250 for cluster key programming, with return shipping chosen at checkout from $14.95.

If the security block sits in a body module rather than the engine controller, our guide to what a body control module does and when it needs programming is the companion read. And if you are holding a used ECU right now with P1570 on the screen, stop before you buy a second one. Text us the VIN, the part number, and a photo of the label, and we will tell you which of the two paths your car is actually on.