# Flashing ZGW with esys



## tankren (Oct 21, 2012)

Can anybody tell me the detailed procedure to flash a module? and if I flash my cic with my Chinese VO, can the cic be localized? thx


----------



## shawnsheridan (Jan 10, 2009)

tankren said:


> Can anybody tell me the detailed procedure to flash a module? and if I flash my cic with my Chinese VO, can the cic be localized? thx


I don't know if it can be localized or not, but I would make sure L8AAA National version China is in my VO for flashing.

Here are the basic steps:

Go to Comfort Mode => TAL-Calculating
- Read and Save FA
- Activate FA
- Read and Save SVT Actual (SVT_ist)
- Create an SVT Target (SVT_soll)
Under KIS/SVT Target Calculation Strategy, select Complete Flash
Select I-Step (shipm.) to your original I-Level as read and shown in VCM I-Step (Shipment) 
Select I-Step (target.) to the latest I-Level
Do a KIS/SVT Target Calculation and Save
- Do a TAL Calculation and Save

Go to Expert Mode => TAL-Processing
- Load TAL
- Load SVT Target (SVT_soll)
- Load or Read FA
- Make checkboxes at blFlash, swDeploy, cdDeploy, ibaDeploy
- Press Check software availability
- Press Start.....

On the TAL, all ECU's identified as a Target for flashing are listed, but select the checkbox only for the desired ECU (e.g. HU_CIC).


----------



## maisav (Mar 31, 2013)

In your opinion, is it possible that, after reading SVT, my ZGW doesn't show any CAF with green flag?


----------



## miotoo (May 23, 2012)

maisav said:


> In your opinion, is it possible that, after reading SVT, my ZGW doesn't show any CAF with green flag?


There are no CAFs for ZGW in other words no changeable parameters..


----------



## miotoo (May 23, 2012)

shawnsheridan said:


> I don't know if it can be localized or not, but I would make sure L8AAA National version China is in my VO for flashing.
> 
> Here are the basic steps:
> 
> ...


This procedure will only work if I-Step Target is higher then I-Step Current.

If you do decide to follow a selective upgrade path as described above, make sure that in E-Sys Options/Settings/options tab both 'Update VCM after TAL execution' & 'Update MSM after TAL execution' are checked.


----------



## shawnsheridan (Jan 10, 2009)

miotoo said:


> This procedure will only work if I-Step Target is higher then I-Step Current.
> 
> If you do decide to follow a selective upgrade path as described above, make sure that in E-Sys Options/Settings/options tab both 'Update VCM after TAL execution' & 'Update MSM after TAL execution' are checked.


The I-Step Target is fixed based on the PSdZData version being used. Since for coding, the PSdZData has to be >= to current I-Step, generally this is always going to be higher. That said, I have never tried using a lower target to see if it worked. Have you tried with a lower version? I know some people have downgraded CIC firmware to bypass 9C FSC Code Requirement, but this was with WinKFP.

Why check Update VCM and MSM? I leave these unchecked as when flashing a single ECU, I don't want to update the vehicle's I-Step Current value.


----------



## miotoo (May 23, 2012)

shawnsheridan said:


> The I-Step Target is fixed based on the PSdZData version being used. Since for coding, the PSdZData has to be >= to current I-Step, generally this is always going to be higher. That said, I have never tried using a lower target to see if it worked. Have you tried with a lower version? I know some people have downgraded CIC firmware to bypass 9C FSC Code Requirement, but this was with WinKFP.
> 
> Why check Update VCM and MSM? I leave these unchecked as when flashing a single ECU, I don't want to update the vehicle's I-Step Current value.


The short answer: Let E-Sys do it's thing.

The long answer:

It's a risk exposure question.

Whoever reads this above procedure quickly thinks they can flash ANY module in the car with the same low risks which is absolutely NOT true.

If you prevent E-Sys from maintaining consistency, you increase the risks like needing additional post flashing tools, or having a dead car.

I say to keep VCM & MSM updates because non of us here has authority/knowledge to describe what it does in its entirety.

We are assuming that VCM update means register an I-Step figure in VCM, but do we know if that's all it does? When prompted, you can type in the same I-Step and keep the function on.

MSM being the Master Security Module sounds as important.

For flashing, where module data is wiped, I'm positive it's a good idea to allow E-Sys to 'do it's thing' for maintaining the Security information across the car network.

I have used I-Step Target=I-Step Current as I detailed in this thread http://www.bimmerfest.com/forums/showthread.php?t=694166 for changing VO type programming.

That procedure can be used as a shortcut for generating a TAL automatically, then replacing the PSdZdata with an older version and editing the TAL to reflect a 'downgrade'.

But that is already a manual TAL processing, no write-up for it yet.

I can understand the approach/objective to minimize change to the car and go for it, but I'm not looking forward to the day that forum members say they used the procedure listed and the car is now at the dealer with a couple K's bill..hence the detailed philosophy..


----------



## pancirm (Aug 13, 2013)

miotoo said:


> I have solved my problem flashing the ZGW.
> 
> In the Connection window, I selected the 'Connection via gateway URL' instead of via VIN, and use the car's IP address with the default port number 6801.
> 
> Passed with flying colors :thumbup:


I have the same problem bud connecting via URL doesn't work also. Unfortunately I try to flash ZGW at least :-( 
What can I doo now?


----------



## ap90500 (Oct 23, 2013)

pancirm said:


> I have the same problem bud connecting via URL doesn't work also. Unfortunately I try to flash ZGW at least :-(
> What can I doo now?


I have also the same problem, flashing whole car through gateway url tcp://169.254.26.6:6801 won't work. I read the ip with zgw search. Same result as flashing through vin connection. Any suggestions? Maybe wrong port? Car is f11 with current i-step f010-12-3-512, shipment f010-11-09-504. Esys v3.24.2, psdzdata v.51.2, enet cable.

edit. I did a full port scan, following ports are open:

23 (telnet?)
4444
6801
6811

I suppose there is no risk to try other ports because the ip adress is still the same?

Attached part of E-sys log, short vin replaced with xxxxxxx. Rename to esyslog.txt


----------



## ap90500 (Oct 23, 2013)

6801 seems to be diagnostic port and 6811 is control port. Maybe I should try 6811?


----------



## ap90500 (Oct 23, 2013)

Continuing to talk by myself.

This is a part from esys log, connecting through vin:


```
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: initialized local addresses: [/127.0.0.1, /0:0:0:0:0:0:0:1, /192.168.68.1, /fe80:0:0:0:0:5efe:a9fe:47ec%26, /fe80:0:0:0:55d4:5336:14d7:a959%12, /fe80:0:0:0:e0:0:0:0%17, /fe80:0:0:0:c9ff:52c5:d1f7:47ec%11, /fe80:0:0:0:e9f5:d3d6:2093:5ad1%22, /fe80:0:0:0:243a:c4e0:502:aeb1%16, /169.254.71.236, /fe80:0:0:0:bc2a:bedb:76e2:ef85%18] [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip loopback address /127.0.0.1 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip loopback address /0:0:0:0:0:0:0:1 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: will open socket for /192.168.68.1 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: send vehicle identification broadcast from /192.168.68.1 to /255.255.255.255:6811 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip ipv6 address /fe80:0:0:0:0:5efe:a9fe:47ec%26 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip ipv6 address /fe80:0:0:0:55d4:5336:14d7:a959%12 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip ipv6 address /fe80:0:0:0:e0:0:0:0%17 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip ipv6 address /fe80:0:0:0:c9ff:52c5:d1f7:47ec%11 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip ipv6 address /fe80:0:0:0:e9f5:d3d6:2093:5ad1%22 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip ipv6 address /fe80:0:0:0:243a:c4e0:502:aeb1%16 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: will open socket for /169.254.71.236 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: send vehicle identification broadcast from /169.254.71.236 to /255.255.255.255:6811 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.VehicleFinder: skip ipv6 address /fe80:0:0:0:bc2a:bedb:76e2:ef85%18 [AWT-EventQueue-0]
14-02-14 00:51:20,801 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.ResponseListener: /169.254.71.236: got data from address /169.254.26.6:6811 [Thread-16]
14-02-14 00:51:20,816 [INFO] [] com.bmw.psdz.vehicle.connection.vehiclefinder.ResponseListener: received vehicle WBAMW91070xxxxxxx_DIAGADR10 tcp://169.254.26.6:6801 [Thread-16]
```
If I understand correctly (can someone confirm?) e-sys is doing ip search through port 6811, but actual connection is made through port 6801. Port used when connecting through vin supposedly gets closed during flashing -> 6801 is not right for me.

Could someone who has flashed zgm connect through vin, close esys and then check from the log which ports esys is using?


----------



## ap90500 (Oct 23, 2013)

Could someone who has flashed ZGW with enet-cable, check which tal-processing parameters were used? Expert mode - tal processing -> parameters. I attached my current settings. I also would have use for an esys log file from succesfull flashing procedure, if someone could send me one.


----------



## ap90500 (Oct 23, 2013)

No progress on this one. I have tried E-sys 3.22, 3.23 and 3.24, psdzdata 51.2 and 48.3. Problem lies definitely in the ZGW, not in the software I use. I think that I must give up and buy an ICOM clone 

Last chance: Does ista/p or e-sys log traffic between the icom and the ZGW or only between the computer and the icom? Maybe I could use tool32 to do some tricks if I only knew what the icom does with the ZGW...


----------



## pancirm (Aug 13, 2013)

By e-net cable is not possible. I tried it last year without success. Finally I have had to buy icom. 

Sent from BimmerApp mobile app


----------



## ap90500 (Oct 23, 2013)

pancirm said:


> By e-net cable is not possible. I tried it last year without success. Finally I have had to buy icom.
> 
> Sent from BimmerApp mobile app


Thanks. So you bought an icom clone and flashed with e-sys?


----------



## pancirm (Aug 13, 2013)

Yes very easily....

Sent from BimmerApp mobile app


----------



## pancirm (Aug 13, 2013)

After flushing was my car in trasport mode. I needed ICOM and diagnosis anyway to clear faults of memory and to set all the necessary things... https://www.youtube.com/watch?v=zdnXoNzwRlA&feature=youtube_gdata_player

Sent from BimmerApp mobile app


----------



## ap90500 (Oct 23, 2013)

pancirm said:


> After flushing was my car in trasport mode. I needed ICOM and diagnosis anyway to clear faults of memory and to set all the necessary things... https://www.youtube.com/watch?v=zdnXoNzwRlA&feature=youtube_gdata_player
> 
> Sent from BimmerApp mobile app


Can you remember what you had to do after flashing? Steering angle sensor and airbag at least? Anything else? Transport mode after flashing is not a problem, just code one random module and that's it. Icom is btw not needed for diagnosis, it can be done with e-net.


----------



## pancirm (Aug 13, 2013)

I don't know exactly. I used ISTA/D in VMWare and calculated for trouble. I deleted transport mode, set Dinamic drive. I deleted some adaptive value and etc. Before that doesn't work Airbacs, DSC, ABS, SOS warning, Dinamic Drive,HeadUp Display,LRR and etc...


----------



## ap90500 (Oct 23, 2013)

pancirm said:


> By e-net cable is not possible. I tried it last year without success. Finally I have had to buy icom.
> 
> Sent from BimmerApp mobile app


Okay, my icom clone is here in few days. What settings did you use for icom and for e-sys? I think that the Type is REMOTE and IP is icom's ip but what is the Mode? I am using easy connect. Edit I just realized that easy connect is not needed because E-sys does not use ediabas?

In E-sys is it Connection via ICOM/Ethernet? Ip is icom's ip? Port is 50160?


----------

