[fastboatster]

Couple of thoughts:
1. It’s not worth to spend time trying to figure out read/write process by sniffing the can communication given that there are tools out there which can do that on a budget (some PCMFlash module can read bmw zf 8hp even though it’s only listed for VW group cars) moreover, before the trans will let you to get into the programming session, you’ll have to pass a seed-key authentication. It’s not likely you’ll ever figure it out just by sniffing, the right way to do it is to actually look at the disassembled code. And again, for the cost of 170$ that pcm flash module costs, it’s not worth it. Better spend the time figuring out #2.
2. The trans is not allowing to shift from park because of the immobilizer. It will not shift from park unless dme and cas/fem modules from the original car are present. Worthy endeavor is how to patch its firmware to disable this immobilizer function.
Anyways, just my .02$

[colorado.e9x]

Contact this guy, he seems like he knows a good bit

[fastboatster]

Originally Posted by colorado.e9x

Contact this guy, he seems like he knows a good bit

He’s running TurboLamiks tcu, not the oem one. Full integration of oem tcu/mechatronic is still beneficial, imo.

[cheerio]

Originally Posted by fastboatster

Couple of thoughts:
1. It’s not worth to spend time trying to figure out read/write process by sniffing the can communication given that there are tools out there which can do that on a budget (some PCMFlash module can read bmw zf 8hp even though it’s only listed for VW group cars) moreover, before the trans will let you to get into the programming session, you’ll have to pass a seed-key authentication. It’s not likely you’ll ever figure it out just by sniffing, the right way to do it is to actually look at the disassembled code. And again, for the cost of 170$ that pcm flash module costs, it’s not worth it. Better spend the time figuring out #2.
2. The trans is not allowing to shift from park because of the immobilizer. It will not shift from park unless dme and cas/fem modules from the original car are present. Worthy endeavor is how to patch its firmware to disable this immobilizer function.
Anyways, just my .02$

Thanks, I appreciate the input.
I've already bought a Yanhua ACDP and the appropriate licenses, which if you trust them, are able to full read/write on the bench, and perform ISN reset when in the car.

So far, I've bought an 8HP70, flashed N20 E84 firmware to it, plugged into the car, reset ISN, and tested. It was throwing an error for position sensor with the engine started, so I'm hoping this is just due to the oil pump not being driven (transmission was not actually in the car), or some sensor difference between the 8HP70 and 8HP45.

In short, if the ACDP works as it's supposed to, #2 is already solved.
I finally bought the F10 8HP45 to install; will make a backup of it and flash the E84 firmware soon. I suppose we'll find out then.

As for #1, again, if we trust the ACDP, it's also already solved. However, the firmware and calibrations (files posted earlier in the thread) appear to have sections missing, and the full reads seem to be nonsense - they don't resemble the firmware/calibration files, and it doesn't seem possible to decompress or disassemble them. Therefore I want to snoop the bus, to see if the data is being modified or encrypted between being sent and being saved by the ACDP software.

On that note, I tried and failed to receive anything when snooping on a bench read using a CAN sniffer. I bought a generic logic analyser, and using this, found lots of activity on one pin, but not much else. It doesn't look like CAN. At a guess, I think it's some sort of ZF/Bosch specific bootloader protocol. Will have to do some further work to find out more.

The tricky part is writing modified calibrations to the box. I thought I'd have to modify the firmware to bypass the signature check, hence trying to reverse engineer the read/write protocol to get a firmware read I can disassemble.

Thanks for pointing out PCMflash. "Bosch SH725xx TCU Bootloader" seems to cover what I'm testing currently - might be good to look into if ACDP proves too much trouble.
I've also just recently found TGFlash, which can apparently write modified calibrations to E-series 8HP, including correct checksums and signature. If this is true, then between the ACDP and TGFlash, all the tools needed for the retrofit are already available, and I won't have to spend a heap of time reverse engineering firmware and protocols. I'll definitely look into this further.


Even if this approach does work, though, I'd still like to develop an open solution. It'd be great to allow others to do similar swaps without having to drop $1000 on a bunch of proprietary software.

[fastboatster]

Another 2 cents while trying not to get it to a whole dollar)
For #2, there’s typically one caveat that firmware updates via OBD are sent in the compressed and encrypted form. May or may not be the case for the e series chassises like e84, my guess that for the zf 8, that might be the case. You’ll need to see if the data looks like it contains some meaningful identifiers like part numbers etc. if it’s not encrypted, you are somewhat in luck. If it is, no other way than to look at the firmware.
Here’s some example how this can be done for some modules like ecus, it’s for Tricore but gives an idea what you might or might not be up against. Yes, it’s not BMW but still a good representative example, very nice and informative readme which describes the details nobody talks much about:
https://github.com/bri3d/VW_Flash
And boot mode:
https://github.com/bri3d/Simos18_SBOOT
Just a good read to understand what you might be potentially up against.
P.S. I was talking about module 83, it’s known to work with bmw non flex ray transmissions as well

[cheerio]

Originally Posted by fastboatster

Another 2 cents while trying not to get it to a whole dollar)
For #2, there’s typically one caveat that firmware updates via OBD are sent in the compressed and encrypted form. May or may not be the case for the e series chassises like e84, my guess that for the zf 8, that might be the case. You’ll need to see if the data looks like it contains some meaningful identifiers like part numbers etc. if it’s not encrypted, you are somewhat in luck. If it is, no other way than to look at the firmware.
Here’s some example how this can be done for some modules like ecus, it’s for Tricore but gives an idea what you might or might not be up against. Yes, it’s not BMW but still a good representative example, very nice and informative readme which describes the details nobody talks much about:
https://github.com/bri3d/VW_Flash
And boot mode:
https://github.com/bri3d/Simos18_SBOOT
Just a good read to understand what you might be potentially up against.
P.S. I was talking about module 83, it’s known to work with bmw non flex ray transmissions as well

Thanks so much for the links! Just had a chance to read through those repos more closely and they seem very interesting, especially the SBOOT one. Was recently looking at some logic analyser captures from the 8HP and was left a bit stumped - I’m no expert in reverse engineering so having something to use as a starting point will be very helpful.

The 8HP TCU is from Bosch and the processor seems very different to the Infineon stuff. Will be interesting to see how much of the same software concepts apply.

[cheerio]

I had a bit of a brainwave the other day - came to the realisation that the F10’s TCU cannot be compatible with the E90, on the basis that any CAN H/L lines need to be connected to a CAN transceiver chip, and as such, the same pin can’t be reused for LIN as is the case on the E84/E70.

I’ve looked up a bunch of 8HP valve bodies for sale and noted down their Bosch TCU part numbers:

E84 N20, 8HP45HIS
0260550075

F30 N20, 8HP45HIS
0260550074

F10 N20, 8HP45HIS
0260550074

2013 Jaguar XF, 8HP45
0260550076

2012 Dodge Charger
0260550046

F10 N52, 8HP45
0260550046

E70 N55, 8HP45
0260550051

E89 N20, 8HP45
0260550051

Audi Q5, 8HP55
0260550082

2011 Audi A4, 8HP55
0260550050

The lowest part number is 0260550046 - seems as if this is the “reference” implementation released first, and presumably features dual CAN buses as used on the F10. I haven’t cracked open my F10 box yet, but I suspect it will have this TCU in it.

051 seems to be a modified version with the CAN+LIN interface as used on the E70, E84 and E89. There’s also 050 which appears to be an Audi special.

The higher numbers all appear to be used in 8HP HIS transmissions, notably 074 which is used in the F10, F30 and others, and 075 which is used in the E84. Interestingly, this time the part numbers are right next to each other - perhaps they were delivered to BMW at the same time.

So what does this mean for our 8HP-into-E90-with-stock-TCU project? I guess it means that to run an 8HP in an E-series chassis, you’ll need the 0260550051 TCU for a non-HIS box, or the 0260550075 for a HIS box.

I think this means there’s no 8HP that can be directly swapped into a N52 E90. I don’t think there’s anything for RWD N55 either. N55 xDrive owners would probably be able to nab an 8HP45X out of an E70, though.

D’oh, I shouldn’t have sold that E70 transmission from earlier. Seems like I’ll now be buying a used TCU - hopefully won’t be too expensive.

[fastboatster]

Just heard about this new option called CANTCU:
https://www.canformance.net/product/...on-controller/
This transmission “controller” is actually a gateway translator between the e series and f series chassis canbus protocols. Also, it solves the EGS (transmission control module) immobilizer issue.
IMO, this is a very good option- even if the controller itself is 1k, used f series 8hps are very cheap and abundant, more so than e series x1 or x5 8hps. Way cheaper and less time consuming than digging into the 8hp flash and trying to find and disable immobilizer routines there.

[cheerio]

Originally Posted by fastboatster

Just heard about this new option called CANTCU:
https://www.canformance.net/product/...on-controller/
This transmission “controller” is actually a gateway translator between the e series and f series chassis canbus protocols. Also, it solves the EGS (transmission control module) immobilizer issue.
IMO, this is a very good option- even if the controller itself is 1k, used f series 8hps are very cheap and abundant, more so than e series x1 or x5 8hps. Way cheaper and less time consuming than digging into the 8hp flash and trying to find and disable immobilizer routines there.

Oops, it's been a while since I last logged in, so just saw your reply now.

I've been aware of CANTCU for a while now, and to be honest, it seems like a good product - when combined with a custom tune, I don't see why it couldn't provide a near 100% OEM experience. If this software tinkering doesn't pan out, it'll definitely be my fallback option.

That being said, I've already got the hardware here - N52 F10 transmission, and E-series EGS to transplant into it.

Now that I've got both of them on the bench here, I can say that the F-series EGS (0260550046) and E-series EGS (0260550051) are very, very similar. Externally, they're identical. Internally, they seem to run on the same microcontroller with slightly different peripherals (CAN on F-series, LIN on E-series). In theory, with full control of software, I think it'd be possible to use F-series EGS in E-series car, although perhaps without a working LIN bus, this would be... irresponsible.

Anyway. Still determined to figure out the software! I really, really like the idea of using purely OEM parts with the only custom work being software modifications. It'd be a shame to give up now.

[emanmor345]

Bump to this thread
Picked up a 6HP21 off a E92 from a dismantler

ZFS LU 7566911 found on E92/E93 328i N52
HW# 7566894

Got it with 83K miles w/ TQ


Location I’m in USA, California

[WgSo]

cheerio I'm curious to see how your project has been going. Looking to do a swap soon and was wondering if you were able to get things to work without a controller.

[cheerio]

Originally Posted by WgSo

cheerio I'm curious to see how your project has been going. Looking to do a swap soon and was wondering if you were able to get things to work without a controller.

I'd prepared the 8HP, engine, mounting, exhaust, everything to go into the car but unfortunately it was rear-ended so I won't be able to finish the job

There's a couple of well priced E61 530i locally so I may get one of those as a replacement car. I don't think the native 8HP swap will work in that chassis; it will have to be something from the E89 family.

Depending on how insurance / money / etc works out I will try to pick up a cheap E82/E90/E92 shell and finish the swap in that, but sadly this means it's going to be delayed even more.

[emanmor345]

6HP21 swap on my 2007 328i with a N51 motor is complete!! Success!! Gone is the GM shit box and the ZF is great! What I did is new mechatronics seals, valve body seals, sonnax zip kit, new solenoids. Then new pan and filled with hotshots adrenaline, highly recommend by sutphin 👍👍. Cherry on top is flashed with XHP stage 3, the driving experience is night and day. Everything lines up, only needed, ZF trans cooler lines, and re-pinning of the mechtronics connector

[colorado.e9x]

emanmor345 on a scale of 1-10 how difficult was it?

[emanmor345]

Originally Posted by colorado.e9x

emanmor345 on a scale of 1-10 how difficult was it?

For sure 7/10. Just to note, I have never replaced a transmission before. Im just an at home wrencher. Did it on jack stands. Most difficult part was lining up the trans back into the motor.

- My car wasnt high enough so I jacked the car up higher and pulled it through the front.

Everything else not too bad. New cooler lines since the ZF is longer and had a different hold down. re pin the mechatronics connector and thats it. Dont need to flash your vin to the car.

Make sure to reset engine adaptations and rest taught values for the transmission so that they get used to what your car has. the rest on the trans isnt resetting the adaptions but more of resetting the driving style. I have ACC so the trans will learn how to drive with that module in.

I made a more in depth post here https://www.reddit.com/r/E90/comment...zf_6hp21_swap/

[Gapo]

Originally Posted by cheerio

I'd prepared the 8HP, engine, mounting, exhaust, everything to go into the car but unfortunately it was rear-ended so I won't be able to finish the job

There's a couple of well priced E61 530i locally so I may get one of those as a replacement car. I don't think the native 8HP swap will work in that chassis; it will have to be something from the E89 family.

Depending on how insurance / money / etc works out I will try to pick up a cheap E82/E90/E92 shell and finish the swap in that, but sadly this means it's going to be delayed even more.

Love all the work you have done so far! I started my 8hp swap into a 335xi with a syvecs standalone and so far its not much fun🤣 isn reset done, vin changed in cas, e70 type code added build date updated. Im having a lot of the same problems you are.
I found a diagram in ista that shows the egs Conector x8500 pin 3 going to cas x13376 pin 30 without comfort acces or spliced at x10134 if comfort access is equiped in e60s. Pin 11 on the cas is shift interlock code i believe ground it out and i lost that code. With e70 cas i don't have the problem but, tool32 shows ews isn't even trying yet. Iam not sure i have the right zb for e70 and now im kind of stuck with errors in winkfp and vin errors in ncs expert for now

[cheerio]

Originally Posted by Gapo

Love all the work you have done so far! I started my 8hp swap into a 335xi with a syvecs standalone and so far its not much fun�� isn reset done, vin changed in cas, e70 type code added build date updated. Im having a lot of the same problems you are.
I found a diagram in ista that shows the egs Conector x8500 pin 3 going to cas x13376 pin 30 without comfort acces or spliced at x10134 if comfort access is equiped in e60s. Pin 11 on the cas is shift interlock code i believe ground it out and i lost that code. With e70 cas i don't have the problem but, tool32 shows ews isn't even trying yet. Iam not sure i have the right zb for e70 and now im kind of stuck with errors in winkfp and vin errors in ncs expert for now

Great to see someone giving it a go!
I think you might be better off using E84 coding/firmware instead of E70; the E70 seems to be set up differently to the E89 family.

Flash an E84 ZB to the EGS. IIRC, when I tried this it seemed to work aside from a DSC code. You shouldn't have to mess around with a E70 CAS. Use a JBBFE 3 from a late E90 or perhaps an E84. E84 electronic shifter should work once wired up.

Thanks for being the guinea pig and testing this out, I'm keen to hear how it goes.

[Gapo]

Originally Posted by cheerio

Great to see someone giving it a go!
I think you might be better off using E84 coding/firmware instead of E70; the E70 seems to be set up differently to the E89 family.

Flash an E84 ZB to the EGS. IIRC, when I tried this it seemed to work aside from a DSC code. You shouldn't have to mess around with a E70 CAS. Use a JBBFE 3 from a late E90 or perhaps an E84. E84 electronic shifter should work once wired up.

Thanks for being the guinea pig and testing this out, I'm keen to hear how it goes.

So far still no go. I loaded the .opa files 7650054a.opa and 7650056a.opa in ida pro and although i dont have the skill set to do much there, iam able to see they are both programetand e70. So i can load any config for e70 or e84. I still haven't gotten winkfp to work and flash anything unfortunately. I still have the vin on the cas as an e70 because i was hoping to use xhp to flash but xhp wont connect at all. So far ive lost more ground than I've gained.

Also tool 32 is saying ews not challenged and im not sure why? Not passing not failing not even trying i might have to put the motor back in the car and try to start it to see if i can get out of park.

[420always]

I've read lots of conflicting information on this topic. Still unclear. I have 06 330xi with a 6hp19x, requires replacement. Fwd driveshaft aft universal broke cracked the transmission housing. I cannot find a 19x, if a did I would swap the valve body's and be done with it. I can get a 6hp21x out of a 08 335xi. Are these compatible? I've read sometimes it's a replace and drive off, no coding. then I've read you require coding of the car wont move?!?! Is this any easy swap out? Is the torque converter the same? Driveshafts the same? Cannot get a straight answer. Your well appreciated knowledge and assistance is well received!!!

[colorado.e9x]

Originally Posted by 420always

I've read lots of conflicting information on this topic. Still unclear. I have 06 330xi with a 6hp19x, requires replacement. Fwd driveshaft aft universal broke cracked the transmission housing. I cannot find a 19x, if a did I would swap the valve body's and be done with it. I can get a 6hp21x out of a 08 335xi. Are these compatible? I've read sometimes it's a replace and drive off, no coding. then I've read you require coding of the car wont move?!?! Is this any easy swap out? Is the torque converter the same? Driveshafts the same? Cannot get a straight answer. Your well appreciated knowledge and assistance is well received!!!

Unfortunately they're not compatible. I learned this from experience. MSV70 is not advanced enough to accept information from the newer EGS. You would have to retrofit MSV80 + matching CAS (using donor car vin) to get the retrofit to work and use xHP