Couldnt really find a section for this..

[antus]

Someone should read another chip, the FFFFFFFs might be what happens when it detects tamper and stops working, if so not a good base to work from.

[The1]

ok tried my best to trace.

pin1 to pin 5 MM74HC14N
pin1 through resistors, diode, cap to pin 2 LM2903N

pin2 to pin 8 & 11 MM74HC14N

pin3 to pin 4 CAT24C44

pin4 to pin 2 CAT24C44
pin4 to pin 7 lcd driver header then to pin 22 80C51BH

pin5 to pin 6 lcd driver header then to pin 23 80C51BH
pin5 to pin3 CAT24C44

[The1]

ok i soldered that first chip into this other cluster, it has 348982km, attached is another one which has 358604km

[festy]

Great - so the SPI NVRAM can be read and written without unsoldering it by the sound of it.
Assuming the CE line is hard wired and the /STORE and /RECALL lines are pulled high (i.e. EEPROM saves and recalls are performed by serial instructions instead of pulling pins 6 and 7 low) then you'd just need to pick up a ground somewhere and you should be able to reprogram it with a PC serial port and a few passive components.

The other two lines I have no idea what they do without studying the circuit - it could be 5v/gnd in a roundabout way, or it could be for putting the dash into a programming/checksum updating mode of some form. Actually, it must do something to the 8051, even if it's just putting it into sleep mode because all hell would break loose if it was still talking to the nvram at the same time as you were reprogramming it.

Pin 1 goes to inverter 3 input on the 74HC14N, and inverting input on the LM2903 comparator, and pin 2 goes to inverter 4 output and inverter 5 input on the 74HC14N. I guess an easy test is to see if there's 5v across pins 1 and 2 with the dash powered on?

I was looking at by Willem clone this morning, to program one of these chips you'd need to use the 93c* socket, and pull pins 6 and 7 high (there's vcc available on the header to the right on mine).

[The1]

big mouthful there for a electronics newb like me, good work, ill power it up after lunch and check that voltage on 1 & 2

[festy]

Code: Select all

00000000  ff ff ff ff ff ff 02 fd  ff ff ff ff ff ff d7 28  |...............(|
00000010  00 00 00 00 00 00 19 e6  00 00 00 00 00 00 13 ec  |................|

so the checksum just seems to be more like 02^fd = d7^28 = 19^e6 = 13^ec = FF - that fits both the samples and is a bit simpler.
Looks like 4 bytes of data, each with it's own checksum byte?

0xd7021319/10000 is almost spot on at 360,723 (2k over) but the other one is almost 5k over, will keep re-arranging the numbers and see if something jumps out at me...

[yoda69]

Remember there is a chance that the odometer may contain 0.1 or 0.01 or more of a kilometre that is not displayed.
yoda69

[festy]

ok i soldered that first chip into this other cluster, it has 348982km, attached is another one which has 358604km

Any chance you could read a chip, drive for a few km then read it again?
I think VL400 suggested this earlier, it'd be much easier to work out what is what when there's only a very small change.

Did you have any luck reading the chip as a S24H45? Did you read it as 8 bit or 16 bit?

[The1]

hey i looked the william doesn't have S24H45, i was reading them as 93C46B 16bit

[The1]

with power on MM74HC14N has 5v on pin 2&3 and measuring across pin 1&2 has +5v on pin 2