BA Falcon Instrument Cluster EEPROM Programming

[TazzI]

ops nevermind. I didnt realise I still had the VZ ecu on bench connected up to the can line. I thought the cluster was answer back to my security unlock requests. But that function is not supported by the cluster according by its return error.

The multiline functions on the ELM are a bit dicky. I have to keep re-telling the ELM that Im in full control and not to do any formatting. Otherwise it cracks the shits and doesnt do what you want.

On another note. I couldnt get my eeprom clip to get a good connection on the 93C56 chip. And struggled to get a clean read. Im unsure whether the reads were inconsistent because the board sucks out too much power.. or simply due to lack of connection. Will try again using some probe clips and see how we go from there.

[TazzI]

Couldnt read it out while on board using the probe clips and I know that was a proper connection. Maybe my GQ-4 simply cant do them on board?
Not a big fan of having to desolder chips

aumatt, if you have access to a BA or BA, then capturing a few seconds worth of raw chatter from the car will be enough to suss out which frame sends the RPM, speed ect.


Also, these are the only configs I can see.. No "shift alerts" yet. But I need an FPV ecu tear code or cal number... will have to try track one down in google.

[TazzI]

Catch codes galore.. need these to get access to everything:

BA
A3YA
32HG
32VD
32BG - BA Series 1 Falcon Manual ECU XR6 - 3R23-12A650-BG
A3AD
A3AC - BA Series 1 falcon Auto ECU XR6 - 3R23-12A650-AAC
A3BD - BA Mark 2 falcon Manual ECU XR6 - 3R23-12A650-ABD

A3AB - BA XR6 auto - 3R23-12A650-AAB
A3HA - BA XR6 Turbo 4spd Auto Sedan - 3R23-12A650-AHA
A3GC - BA XR6 Turbo Manuel Sedan - 3R23-12A650-AGC
A3LA - BA GTP - 3R23-12A650-ALA
A3MA - BA Boss GT Sedan Manual 5speed - 3R23-12A650-AMA
A3XA - BA 2004 Boss XR8 Ute Manual 6spd - 3R23 12A650 AXA
A3KC - BA 2004 UTILITY 5.4L 5speed manual - 3R23 12A650 AKC

BF
A5ZC
A5GC - BF XR6 Turbo 6spd Manuel Sedan - 5R29-12A650-AGC
A7FA - BF 2008 Typhoon (270Kw) 6spd Auto sedan - 7R29-12A650-AFA (ASU-224)
52JD - BF falcon 2007 6spd manual XR8 - 5R29-12A650-JD
52JC - BF 2004 XR8 5R29-12A650-JC

FG
A0VE
A8AC
82CC - FG Falcon 2009 XR6 - 8R29 12A650 CC
82CB - FG Flacon - 8R29 12A650 CB
82LB - FG FPV FT 315KW 6spd Manual - 8R29 12A650 LB
82CB - FG Ute 5spd Auto 6cyl - 8R29 12A650 CB

[aumatt]

Sorry Tazzi, Sold my BA a few months back. But I did capture some data when I was testing a OBD tool for someone else. Ill have to dig up my old laptop to find it.

I could never read off the board either , I always desolder the eeprom (using a hot gun) and resolder a new chip in.

I've gotta do a job for a wreckers that handles Fords(FPV etc) let me know any info you need and i'll grab some.

Matt

[TazzI]

Sorry Tazzi, Sold my BA a few months back. But I did capture some data when I was testing a OBD tool for someone else. Ill have to dig up my old laptop to find it.

I could never read off the board either , I always desolder the eeprom (using a hot gun) and resolder a new chip in.

I've gotta do a job for a wreckers that handles Fords(FPV etc) let me know any info you need and i'll grab some.

Matt

Bugger,

Thats alright, any generally chatter captured will work.

If I can find anything interesting or of use, Ill send through the requests to try out!

[Rerouter]

Tazzi, I'm guessing the micro that controls everything has a crystal due to being on Canbus, have a look what state pins 1-4 on the eeprom are at if you power it on with the crystal shorted, if they are Hi-Z, then you can read/write in circuit with external power applied, and not connecting pin 8, when done remove the short and it should power up and run ok,

seeing as its a low level signal for the crystal, you should be able to get away with a logic level fet, for automating the shorting process to quickly test parameters,

[TazzI]

Tazzi, I'm guessing the micro that controls everything has a crystal due to being on Canbus, have a look what state pins 1-4 on the eeprom are at if you power it on with the crystal shorted, if they are Hi-Z, then you can read/write in circuit with external power applied, and not connecting pin 8, when done remove the short and it should power up and run ok,

seeing as its a low level signal for the crystal, you should be able to get away with a logic level fet, for automating the shorting process to quickly test parameters,

That would have been a better way about this *double bugga!*

Iv already started desoldering the eeprom unfortunately, One side can be lifted easily all at once using a suitable thin soldering head. But the other side is a little tedious.

Now, MCU mall software has a few choices for the 93C56.

Iv got:
93C56A (8bit)
93C56B (16bit)
93C56C (8bit)

Id assume Im sticking with 8bit. I cant read the rest of the chip writing since it looks like its been rubbed/touched previously or just old age.? Will just try on all of them to see what differences occur.

[TazzI]

I also tried to find a datasheet for the MCU. It is a micronas cdvw1608 s103

But, I couldnt find anything! Would be great to know where/if any SPI pins are.. be nice to get some custom lcd work going. Will have to google the other chips and see if they give any other clues.

[Rerouter]

The eeprom is spi type??? trace him out and see where he connects, that will be at least 1 set of your spi pins, in this arrangement i would imagine a few devices to be in parallel with the eeprom each with a chip select line, if so you could hijack the chip select line to use your own custom display, or at-least read-modify-write the content,

And for the love of... buy one of these already rather than risking tearing an eeprom in half,
http://www.ebay.com.au/itm/858D-Desolde ... 1609993734 , combine it with some pen flux and leave it set to 300 degrees,

If you must use an iron, then add excessive solder and lay the iron along the troubled side, its most likely the ground plane causing an issue on a ford, so you will need to get a ridiculous amount of heat into that piece of copper,

you should be able to tell fairly easily from the mileage line whether or not the dump is read correctly, generally reading the wrong type will either result in doubled content, (every other byte, then repeated from half way down the dump) or doubled bytes, both of which should be eaily obvious,

[aumatt]

One of the ways Intel if the eeprom is read correctly is look at location 0xff , this is the location of the EE version.

Matt