MSG Equipment shared a bench study showing how the flash and EEPROM of BMW F-series electric power steering (EPS) units can be read and written over FlexRay — without opening the case or using JTAG.
A technical bench note on the MSG Equipment blog describes accessing the memory of BMW F-series electric power steering (EPS) racks without opening the housing. The work was done on removed units on a test bench, for remanufacturing and diagnostics.
The steering ECU (loader tag “19EE”) is built around a dual-core, safety-oriented NXP MPC5643L, with calibration data split between on-chip flash and an external M95640 SPI EEPROM, and factory tooling communicates over FlexRay. Instead of desoldering the EEPROM or opening the sealed case for JTAG, a small helper program is loaded over FlexRay to read and write both memories through the existing connector.
The bench used the MSG MS561 EPS tester and a FlexRay cable. The author deliberately leaves out OEM security-access details.