[CarAbuser]

Hi,

I know this relates to an E89 rather than an E90 but they are close enough. I'm messing around with the EPS module in my Z4. I have a 35i and want to see if I can flash the software from the 35is onto my EPS module.

I've checked realoem and both vehicles have the same steering rack and the module share the same ECU type "EPSPL2". The difference is that the 35i comes with the ZB# 6791454 and the 35is comes with ZB# 6855892.

I tried to flash 6855892 using WinKFP but I get the error

Error 201:
Check hardware number
Wrong ECU hardware number: 6791454 (BSU not possible)

I've looked into NCSDummy and it's showing me that 6791454 is module EPS_E89.C01 and 6855892 is EPS_PL2.C03.

Both come under the banner of EPSPL2 in WinKFP. I'm only a novice with module coding so I don't know how meaningful these differences are.

Should I move forward and try and force the flash or am I doing something really stupid here and about to brick my EPS?

[Sensible_]

Got your PM. I wouldn't force flash it unless you have the ability to recover the module on a bench setup.

You need to have a look in the DAT files to see what HW Number is supported by which ZB Nr. I'll have a look for you tomorrow.

[CarAbuser]

Originally Posted by Sensible_

Got your PM. I wouldn't force flash it unless you have the ability to recover the module on a bench setup.

You need to have a look in the DAT files to see what HW Number is supported by which ZB Nr. I'll have a look for you tomorrow.

Brilliant, thanks for that👍

Didn't realise there was a way to check comparability in the DAT.

[CarAbuser]

Originally Posted by Sensible_

Got your PM. I wouldn't force flash it unless you have the ability to recover the module on a bench setup.

You need to have a look in the DAT files to see what HW Number is supported by which ZB Nr. I'll have a look for you tomorrow.

I've been doing some more research and it seems both 6791454 and 6855892 are both capable of being flashed to the same hardware.

The plan looks to be to use WinKFP in expert mode. Specify the PABD (080100EPSPL2.ipo), P-SGBD (10flash.prg), ECU Address (30) and program file (6855892A.0pa) copied into the DEVELOP folder) then flash that.

I don't have any ability to bench flash so I'd really like to avoid bricking this £2k module.
I honestly don't have much need to do this procedure but the curiosity is killing me

[CarAbuser]

Just a final update on this. I bought a scrap steering rack (EPSLP2.C02) from a 2007 E90 and flashed it with a different EPS ZB and it gets a program error and won't work. It can be flashes back to the correct ZB and will work again.

Basically EPSLP2 has 4 variants that I can see.
EPSE89.C01 - 2009 23i/30i/35i only
EPSPL2.C01 - 1 and 3 series up to 2006~
EPSPL2.C02 - 1 and 3 series up to 2010~
EPSPL2.C03 - 2010+ Z4, 1 series, 3 series

Cross flashing ZB numbers doesn't work due to signature checks.

EDIT: I still think this is possible, just need to get the correct bootloader flash to match the program flash. Maybe this isn't the final update

[4foothill]

Originally Posted by CarAbuser

Just a final update on this. I bought a scrap steering rack (EPSLP2.C02) from a 2007 E90 and flashed it with a different EPS ZB and it gets a program error and won't work. It can be flashes back to the correct ZB and will work again.

Basically EPSLP2 has 4 variants that I can see.
EPSE89.C01 - 2009 23i/30i/35i only
EPSPL2.C01 - 1 and 3 series up to 2006~
EPSPL2.C02 - 1 and 3 series up to 2010~
EPSPL2.C03 - 2010+ Z4, 1 series, 3 series

Cross flashing ZB numbers doesn't work due to signature checks.

EDIT: I still think this is possible, just need to get the correct bootloader flash to match the program flash. Maybe this isn't the final update

Did you have any luck with this? My understanding is the checksum is built into the program file, so providing there's no hardware compatibility check in the TCU then in theory it should work.

If there is a compatibility check then I wonder if we would be able to just copy the map parts of the file (assuming it works the same way as an ECU). Based on your posts I found on another forum where you mention the ECU IDs for each hardware version, they look very similar to the ECU codes used for the zf-6hp gearbox and INPA also identifies the manufacturer as ZF lenksysteme. I know they've had luck cross-flashing Alpina software to what I think is the ZF8 gearbox and there's a lot of research into breaking the ZF6's RSA protection. I've not had a chance to dig into either that much but hopefully they used a similar TCU on the EPS.

Do you know what the different steering flash would bring? Do the latter steering revisions (2010+ Z4, 1 series, 3 series) have a more aggressive steering feel? I read they introduced EPS to the 2015 m3 & m4 models, it's unlikely but I wonder if they used a similar module..

[CarAbuser]

I tried a few things like flashing the corresponding NAAB file and also pasting the data part of the 0pa into the correct 0pa and flashing that but all come back with a hardware compatibility error.

When I'm done on other projects I'll try disassemble the program and see if there's a routine responsible for it. Need to find what processor it uses so will crack open the EPS module on my spare steering rack first.

To be honest I don't think there's any benefit to be had with the programming alone. EPS is shit on all models, I'm just trying to do it for the sake of it.

I think the RSA protection is bypassed rather than cracked in most applications. In the DME and DCT TCU it's possible to pass the RSA check just by not calling the signature routine in the program code.

[Oldmanwithadirtbike]

stearling up this thread :-D

i crushed my LHD eps and got hand on a donor RHD steeringrack witch I took the motor from. it looks ecsactly same and partnumbers identical but motor sitts mirrorwise.

this is how my steering behaves now:

[mpower93]

hello, I am trying to change the VIN of my used EPS, but got this error in WinKFP, can please someone send me the file or can help me to get the right VIN on my EPS so that I can activate it with ISTA/P.

I also tried tool32 but there i can read aif but not write

thanks