EPAS firmware

The EPAS (Electric Power Assisted Steering) is the steering ECU in your Model S. It lives on the steering column and drives the electric motor that provides power assist. For NAP to command steering angles, the EPAS firmware must be patched — the stock firmware rejects external steering commands outright, and without the patch, the EPAS ignores everything NAP sends.

What the EPAS does and why patching is needed

The EPAS module sits on the Chassis CAN bus. It receives a steering angle request from the Gateway ECU (EPB_epasControl message, 0x214) and applies the motor assist accordingly. On stock pre-AP cars, the Gateway checks a flag called EPB_epasEACAllow before forwarding steering commands — if the flag is not set, the EPAS will not accept remote steering requests.

The stock EPAS firmware reads EPB_epasEACAllow from CAN and acts on it. The patch modifies three points in the firmware binary:

• At address 0x031750: the instruction that extracts EPB_epasEACAllow from the CAN message is replaced with a hardcoded load of 1.
• At address 0x031892: the instruction that extracts GTW_epasControlType is replaced with a hardcoded 1.
• At address 0x031974: the instruction that extracts GTW_epasLDWEnable is replaced with a hardcoded 1.

After patching, the EPAS always behaves as if those signals say "steering commands allowed." NAP still sends the full EPB_epasControl message over CAN — the EPAS just no longer waits for the Gateway to say it is allowed.

Known-good firmware variant

The EPAS flasher in NAP checks a specific firmware MD5 (9e51ddd80606fbdaaf604c73c8dde0d1) against the extracted binary before patching. If your EPAS firmware does not match this checksum, the flasher will refuse to continue. This is intentional — the patch addresses are calculated against one known firmware version, and applying them to a different version could corrupt the firmware or disable power steering.

If the flasher reports a checksum mismatch, post in the Discord with your car's build date — the community can help determine whether a different firmware path is needed.

Steering engagement gate

The panda safety mode (tesla_preap.h) disengages steering on EPAS error codes 6, 7, 8, and 9. These codes indicate the EPAS actively rejected a steering command — meaning either the angle or rate request exceeded what the EPAS would accept, or a safety layer check failed. If you see repeated steering dropout events in logs, check whether your EPAS has been patched and is responding normally.

The safety mode currently disables checksum and counter validation on the EPAS status message (0x370) because the pre-AP EPAS byte-sum checksum algorithm has not been fully verified across all firmware versions in the field. The safety layer notes in tesla_preap.h explain the tradeoff: enabling validation before confirming the algorithm would cause silent steering dropout on cars with unverified firmware variants.

Flashing EPAS firmware from the settings panel

In prior Tinkla-era installs, patching the EPAS required an external laptop, SSH access, a separate EPAS harness wired through the firewall, and physical disassembly of the frunk. All of that is gone. NAP patches the EPAS directly over CAN from the comma device, using the panda as the UDS (Unified Diagnostic Services) interface.

To flash the EPAS firmware:

1. The car must be on — key fob inside, foot on brake, in Park. The EPAS ECU only responds to UDS requests when the car is powered on.
2. In the NAP settings panel, go to the EPAS section and press Backup EPAS first. This extracts your stock firmware and saves it to the device. Do not skip this step — you need it if you ever need to restore.
3. Once the backup is confirmed, press Flash EPAS.
4. Read the on-screen warnings fully. After the confirmation slider, the flash proceeds.
5. Keep the car on and do not move it during the process. Power loss mid-flash will brick the EPAS module.
6. When complete, exit the car, let it go to Car Off mode, then turn it back on. The EPAS applies the new firmware on that power cycle.

To restore stock firmware:

Press Restore EPAS in the settings panel. This reflashes the saved stock image. You need a previously extracted backup for this to work, which is another reason to always back up before patching.

Risks and precautions

The on-screen warnings say it plainly: power loss during the flash can brick the EPAS module. Replacing a bricked EPAS is an expensive repair. A few precautions:

• Make sure your 12 V battery is at a normal charge level before starting. If the car has been sitting for a long time, charge it first.
• Do not start a flash if the car is showing low 12 V battery warnings.
• Have the stock firmware backup confirmed before flashing the patch.
• The UDS session uses CAN address 0x730 on bus 0.

Historical context

In the EON era, the EPAS harness was a physical wiring loom that ran from a JST connector at the EPAS unit through the firewall into the cabin, allowing the panda to communicate with the steering ECU. That harness required frunk disassembly and fishing wire through tight spaces. The full procedure is documented at /history/eon-era-hardware for reference. NAP's CAN-based approach over the existing OBD2 connection made the harness unnecessary.