FORD technical service bulletin : ICC touch screen display - Page 17

JasonACT · 10-07-2021, 11:23 PM

So.. Moving on..

I decided to run a brute force over the FG (I) EEPROM to check out if it's the same algorithm to protect the data areas (I don't have the firmware, it [the filename] is not divulged like it is with the FG2 unit)... Yep, same algorithm.

Plain dump:

0x000 00 00 75 00 00 00 d6 dc ad b9 5b 73 b6 e6 6d cd ..u...ÖÜ*.[s¶æmÍ
0x010 db 9a b7 35 6e 6b dc d7 b9 af 73 5f e6 be cd 7d Ûš·5nkÜ×.¯s_æ.Í}
0x020 9a fb 35 f7 6b ee 1e c4 36 46 50 41 41 41 4a 47 šû5÷kî.Ä6FPAAAJG
0x030 53 57 38 41 35 31 31 30 38 ff 1e c4 36 46 50 41 SW8A51108ÿ.Ä6FPA
0x040 41 41 4a 47 53 57 38 41 35 31 31 30 38 ff d3 73 AAJGSW8A51108ÿÓs
0x050 cf 66 93 33 ff ff 10 10 10 10 10 10 10 20 20 20 Ïf“3ÿÿ.......___
0x060 10 00 10 10 10 10 10 10 10 10 00 10 10 10 10 20 ..............._
0x070 20 20 20 20 10 20 20 20 20 20 81 0e 80 00 ff 00 ____._____..€.ÿ.
0x080 0f 5a ff 0f 1f 02 06 06 0a 00 56 97 19 01 08 c0 .Zÿ.......V—...À
0x090 50 36 ff ff 80 22 10 3c 06 00 38 52 32 39 ca 72 P6ÿÿ€".<..8R29Êr
0x0A0 1f 32 74 61 85 03 26 03 eb 02 a8 02 39 02 f9 01 .2ta..&.ë.¨.9.ù.
0x0B0 16 01 b6 00 7e 00 62 00 00 00 a0 0f 5e 1a 1c 25 ..¶.~.b...*.^..%
0x0C0 98 3a 50 46 c0 5d 78 69 30 75 f4 7e 11 00 94 70 ˜:PFÀ]xi0uô~..”p
0x0D0 00 00 a0 0f 40 1f e0 2e 80 3e 20 4e c0 5d 60 6d ..*.@.à.€>_NÀ]`m
0x0E0 00 00 65 02 0b 05 6b 07 cf 09 34 0c 98 0e fd 10 ..e...k.Ï.4.˜.ý.
0x0F0 02 00 84 71 00 00 00 14 00 1e 00 28 00 32 00 37 ...q.......(.2.7
0x100 00 46 00 82 00 00 00 15 00 1f 00 29 00 33 00 38 .F.........).3.8
0x110 00 47 00 83 00 00 59 03 06 05 b2 06 5f 08 35 09 .G.ƒ..Y....._.5.
0x120 b8 0b be 10 6b 13 04 00 28 4f 20 03 ab 03 c1 04 ¸...k...(O_.«.Á.
0x130 14 05 c8 05 ed 05 36 06 5e 06 00 00 0c 01 24 03 ..È.í.6.^.....$.
0x140 c4 03 2f 04 3b 05 53 07 5f 08 1e 00 47 c3 00 00 Ä./.;.S._...GÃ..
0x150 1e 01 e2 01 a7 02 2f 04 06 05 b2 06 89 07 5f 08 ..â.§./......._.
0x160 b8 08 c4 09 10 27 c4 09 f4 01 70 17 94 11 27 08 ¸.Ä..'Ä.ô.p.”.'.
0x170 0c 00 05 00 cf 03 0b 0b 0b 0b e4 cc 32 00 64 00 ....Ï.....äÌ2.d.
0x180 0a 00 00 00 2f 04 5f 08 00 00 70 00 e0 00 a0 05 ..../._...p.à.*.
0x190 c0 08 e0 0b 00 00 20 03 40 06 e8 cc 14 36 5e 80 À.à..._.@.èÌ.6^€
0x1A0 26 6e ba ff 80 a8 d6 ff 03 08 12 1a 80 a8 d6 ff &nºÿ€¨Öÿ....€¨Öÿ
0x1B0 00 08 12 1a 66 96 cf ff 66 96 cf ff 5e 01 7f 00 ....f–Ïÿf–Ïÿ^...
0x1C0 39 00 90 a7 c0 c7 c7 c7 c2 c2 c2 c2 f5 d1 00 00 9..§ÀÇÇÇÂÂÂÂõÑ..
0x1D0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0x1E0 00 00 21 12 00 01 95 2c ff 14 06 07 00 14 46 64 ..!....,ÿ.....Fd
0x1F0 ff 12 00 02 80 41 46 32 30 cf 20 46 00 00 00 00 ÿ...€AF20Ï_F....

Breakdown - where a length is shown [in hex], the next 2 bytes are a checksum:

0x000 ____ 00 00 75 00 00 00 d6 dc ad b9 5b 73 b6 e6 6d cd db 9a b7 35 6e 6b dc d7 b9 af 73 5f e6 be cd 7d 9a fb 35 f7 6b ee
0x026 (14) 1e c4 6FPAAAJGSW8A51108
0x03A (14) 1e c4 6FPAAAJGSW8A51108
0x04E (08) d3 73 cf 66 93 33 ff ff
0x056 ____ 10 10 10 10 10 10 10 20 20 20
0x060 ____ 10 00 10 10 10 10 10 10 10 10 00 10 10 10 10 20
0x070 ____ 20 20 20 20 10 20 20 20 20 20 81 0e 80 00 ff 00
0x080 (08) 0f 5a ff 0f 1f 02 06 06
0x088 ____ 0a 00 56 97 19 01 08 c0
0x090 ____ 50 36 ff ff 80 22 10 3c 06 00 38 52 32 39 ca 72
0x0A0 ____ 1f 32 74 61 85 03 26 03 eb 02 a8 02 39 02 f9 01
0x0B0 ____ 16 01 b6 00 7e 00 62 00 00 00 a0 0f 5e 1a 1c 25
0x0C0 ____ 98 3a 50 46 c0 5d 78 69 30 75 f4 7e 11 00
0x0CE (24) 94 70 00 00 a0 0f 40 1f e0 2e 80 3e 20 4e c0 5d 60 6d 00 00 65 02 0b 05 6b 07 cf 09 34 0c 98 0e fd 10 02 00
0x0F2 (36) 84 71 00 00 00 14 00 1e 00 28 00 32 00 37 00 46 00 82 00 00 00 15 00 1f 00 29 00 33 00 38 00 47 00 83 00 00 59 03 06 05 b2 06 5f 08 35 09 b8 0b be 10 6b 13 04 00
0x128 (24) 28 4f 20 03 ab 03 c1 04 14 05 c8 05 ed 05 36 06 5e 06 00 00 0c 01 24 03 c4 03 2f 04 3b 05 53 07 5f 08 1e 00
0x14C (2E) 47 c3 00 00 1e 01 e2 01 a7 02 2f 04 06 05 b2 06 89 07 5f 08 b8 08 c4 09 10 27 c4 09 f4 01 70 17 94 11 27 08 0c 00 05 00 cf 03 0b 0b 0b 0b
0x17A (20) e4 cc 32 00 64 00 0a 00 00 00 2f 04 5f 08 00 00 70 00 e0 00 a0 05 c0 08 e0 0b 00 00 20 03 40 06
0x19A (26) e8 cc 14 36 5e 80 26 6e ba ff 80 a8 d6 ff 03 08 12 1a 80 a8 d6 ff 00 08 12 1a 66 96 cf ff 66 96 cf ff 5e 01 7f 00
0x1C0 (0C) 39 00 90 a7 c0 c7 c7 c7 c2 c2 c2 c2
0x1CC (16) f5 d1 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x1E2 (04) 21 12 00 01
0x1E6 (12) 95 2c ff 14 06 07 00 14 46 64 ff 12
0x1F2 ____ 00 02 80 41 46 32 30 cf
0x1FA (06) 20 46 00 00 00 00

I can see the same tacho and speedo maps:

0x0CE
=====
00 00 = 00000 = 0
a0 0f = 04000 = 1000
40 1f = 08000 = 2000
e0 2e = 12000 = 3000
80 3e = 16000 = 4000
20 4e = 20000 = 5000
c0 5d = 24000 = 6000
60 6d = 28000 = 7000

00 00 = 0000
65 02 = 0613
0b 05 = 1291
6b 07 = 1899
cf 09 = 2511
34 0c = 3124
98 0e = 3736
fd 10 = 4349

02 00 ?

0x0F2
=====
00 00 = 000 (000)
00 14 = 020 (040)
00 1e = 030 (060)
00 28 = 040 (080)
00 32 = 050 (100)
00 37 = 055 (110)
00 46 = 070 (140)
00 82 = 130 (260)

00 00 = 000
00 15 = 042
00 1f = 062
00 29 = 082
00 33 = 102
00 38 = 112
00 47 = 142
00 83 = 262

00 00 = 0000
59 03 = 0857
06 05 = 1286
b2 06 = 1714
5f 08 = 2143
35 09 = 2357
b8 0b = 3000
be 10 = 4286

6b 13
04 00

So nothing especially different between the FG2 and FG, except for the CCC.

JasonACT · 15-07-2021, 09:13 PM

I feel my time here has come to an end. But it wasn't without many mistakes...

0x1E6 (12) 95 2c ff 14 06 07 00 14 46 64 ff 12
0x1F2 ____ 00 02 80 41 46 32 30 cf
0x1FA (06) 20 46 00 00 00 00

That's 12 HEX in the FG(I) dump Jason...

0x1E6 (12) 95 2c ff 14 06 07 00 14 46 64 ff 12 00 02 80 41 46 32
0x1F8 ____ 30 cf
0x1FA (06) 20 46 00 00 00 00

Also, it's not speed divided by 2, it's speed times 128, moving the significant part of the number(s) into the next byte but shifted by 1 bit - looking like a divide by 2.

Why do I feel like I'm done here though? Well, in the FG2 EEPROM, location 0x1DE (protected by a checksum at 0x1DC which my program will recalculate) controls this:

Setting it to 1 (binary 00000001) displays this splash screen. Setting it to 3 (binary 00000011) does the same, but also enables the 2 extra gauges. Setting it to 0x0B (binary 00001011) is what I'm settling on. The boost gauge can also act as a oil-pressure gauge on some FPVs (FG1 V8 non supercharged ones only I think)...

Once I worked this out on the FGX test unit running my FG2 EEPROM, I pulled out my G6E MK1 Cluster circuit board and did the whole EEPROM socket thing again (full size EEPROM socket for testing)...

Location 0x1CE (protected by a checksum at 0x1CC, which needs to be fixed in my sample FG2 EEPROM editing code, if you want it to work on a MK1) can be set to 0x0B to do the same thing.

Finally, on the FG2, location 0x062 is the options (Police mode = 0x01) but you can set 0x02 for the FPV 6K-RPM Alarm to go off. That's probably too late really, as I think the rev-limiter is 6K - but I've not found a way to lower it to something better like 5.5K - I'm not sure I really care though.

I've done what I came here to do.

Oh, sound volume was on my list, well... I think that's coded into the firmware raw sound data - so it would be far easier to do a circuit mod for that. Interestingly, there's a pretty big difference between the sound from the G6E MKI (think early 80's 8 bit micro) to what comes out of the FG2/X unit (proper chimes).

jakka351 · 15-07-2021, 10:07 PM

[/thread]

Thank you for putting in the effort to post and take photos

JasonACT · 16-07-2021, 09:31 PM

Quote:

Originally Posted by JasonACT

I think the rev-limiter is 6K - but I've not found a way to lower it to something better like 5.5K - I'm not sure I really care though.

I've done what I came here to do.

I'm not going to make a habit of posting extra stuff like this..

The FG2 EEPROM locations 0x07E, 0x07F & 0x080 all contain byte value 0x78. They can also be read and written by ID 0xEE01 via OBD2. Somehow there are 3 modes, each of which looks up one of these byte values, but I can't tell how to switch modes - so set them all to the same value - as they are presently...

0x78 (hex) is decimal 120, and 120 * 50 = 6000 (RPM).

5500 RPM / 50 = 110 which is 0x6E (hex).

Verified as working, on the bench... You're welcome.

**PHATAL** · 16-07-2021, 11:26 PM

Again - I don't understand most of this (I probably should though) but thanks sincerely mate for your efforts. It has been a wild ride.

Sent from my SM-G998B using Tapatalk

JasonACT · 17-07-2021, 12:52 AM

Thanks PHATAL, that means a lot.

Quote:

Originally Posted by QIKESP

Firstly; Absolutely outstanding thread and a fascinating read !

I'm curious if it's possible to change the input scaling for a gauges servo motor in the clusters code ?

For those of us running more than 1 bar, the boost gauge is constantly maxed out and it drives me nuts .

Yes, it is, at least on the FG2/X units, with the EEPROM...

0x194 = 0x00, 0x00
0x196 = 0x20, 0x03
0x198 = 0x40, 0x06

Change that to:

0x196 = 0x40, 0x06
0x198 = 0x80, 0x0C

And you will double the BOOST gauge's range (2 bar).

Chicka-chick-ahh.

QIKESP · 17-07-2021, 05:54 PM

Thanks again, Time to dust off the spare cluster and give this a go !

Appreciate all the effort you've put into this thread

JasonACT · 21-07-2021, 09:12 PM

Quote:

Originally Posted by JasonACT

I'm not going to make a habit of posting extra stuff like this..

I wish.

Quote:

Originally Posted by JasonACT

Somehow there are 3 modes, each of which looks up one of these byte values, but I can't tell how to switch modes - so set them all to the same value - as they are presently...

So, I'm talking to my car-mad mate at work about this stuff (the one who says I own a taxi, while he's got a couple of really old Skylines)... I tell him about the RPM alarm I've now got, and he asks, can you set it differently depending on which gear you're in, because that's what I had to do with new my set-up?

ID 0xEE01 via OBD2 may get a work-out sometime later, because I'm not pulling the Cluster out anytime soon again!

Incidentally, the boost gauge on the FPVs, that's a real gimmick I feel - it reacts at the touch of a, well, foot-pedal. I was sure I had the calculations correct for boost on my "home made" gauges (negative at idle, closing in on zero with revs in neutral, building with power in gear) but this thing seems to move about just to make you feel good. Maxes out fairly easily too, and while I've had my car tuned, there's not much more going on in the hardware over stock, cold-air-filter?

Maybe I am going to switch to a 2-Bar gauge soonish too. Lucky I moved the [new full-size] EEPROM to the other side of the circuit board [now using a socket]. 5 of the EEPROM pins are gounded, so I only needed 4 wires in ribbon format of about 9cm to do that. Good decision. I cut a couple of plastic air-vent bits off so it can be removed from the unit without any disassembly. Got to pull it out from the car though.

jakka351 · 21-07-2021, 09:52 PM

Quote:

Originally Posted by JasonACT

I wish.

So, I'm talking to my car-mad mate at work about this stuff (the one who says I own a taxi, while he's got a couple of really old Skylines)... I tell him about the RPM alarm I've now got, and he asks, can you set it differently depending on which gear you're in, because that's what I had to do with new my set-up?

ID 0xEE01 via OBD2 may get a work-out sometime later, because I'm not pulling the Cluster out anytime soon again!

Incidentally, the boost gauge on the FPVs, that's a real gimmick I feel - it reacts at the touch of a, well, foot-pedal. I was sure I had the calculations correct for boost on my "home made" gauges (negative at idle, closing in on zero with revs in neutral, building with power in gear) but this thing seems to move about just to make you feel good. Maxes out fairly easily too, and while I've had my car tuned, there's not much more going on in the hardware over stock, cold-air-filter?

Maybe I am going to switch to a 2-Bar gauge soonish too. Lucky I moved the [new full-size] EEPROM to the other side of the circuit board [now using a socket]. 5 of the EEPROM pins are gounded, so I only needed 4 wires in ribbon format of about 9cm to do that. Good decision. I cut a couple of plastic air-vent bits off so it can be removed from the unit without any disassembly. Got to pull it out from the car though.

Refer to it as an R33 Maxima, they get livid.

JasonACT · 22-07-2021, 05:22 PM

Quote:

Originally Posted by JasonACT

the EEPROM...

0x194 = 0x00, 0x00
0x196 = 0x20, 0x03
0x198 = 0x40, 0x06

Change that to:

0x196 = 0x40, 0x06
0x198 = 0x80, 0x0C

And you will double the BOOST gauge's range (2 bar).

I wanted to try this, so I took some photos while it was out:

For me, it makes more sense to make it a 1.5-BAR gauge though, as mine only really goes to about 16 PSI (having tested it this arvo). It only went a bit past the next notch after the centre one..

1.5-BAR...
0x196 = 0xB0, 0x04
0x198 = 0x60, 0x09

I also got the chance to re-zero one of the gauges while it was out, which is a physical needle position movement needed on the stepper motor shaft. FYI - you turn these needles anti-clockwise to pull them off, never clock-wise! Never directly up and off either! Pretend to unscrew it, even though there's no thread, while slightly pulling to get them off. If you do go clockwise by accident, the stepper moves and you need to reset them by powering it up, before putting back the needle.

It's nice to have all the needles perfect now!

FPVAUS · 23-07-2021, 11:54 PM

Worth a watch.

https://www.youtube.com/watch?v=kUUFz7pF0dU

JasonACT · 24-07-2021, 02:48 PM

Quite a while ago now, someone sent me their corrupt 2014 firmware which was non-Nav, I looked again today, there are appear to be no differences in the apps, bar the bootloader, kernel, missing navi and missing "FpvLe" directory with the images needed for the Fpv Gauges (/packages/factory/hmi/root_dir/usr/hmi/HighSeries/FpvLe). You would have to copy the FpvLe directory over (it's about 1MB - so should fit with what little space is left on those units - they are on github in the 2014 Navi archive).

You can possibly enable these gauges ONLY IF you are running the 2014 software (I've done it, but only on the Navi unit) with a script to run ***some*** of these commands (pick the 2 you want) in QNX:

#turn on FPV button (off=0 or on=1)
send2 -w /hmi/dp/1/1907 0
send2 -w /hmi/dp/1/1907 1

#switch manual (volts=0) or automatic (temperature=1)
send2 -w /hmi/dp/1/1908 0
send2 -w /hmi/dp/1/1908 1

To automate this when the unit boots, I created a shell file (unix line endings! not ms-dos, called say "gauges.sh") in the directory "/packages/system/trailer" with the chosen 2 lines.

Note: Only the voltage gauge works, but it could be a fun thing to do anyway. This can be done (copy guages.sh to the right place) with the recore program I posted earlier (WHICH YOU MUST NOT USE!).

Thanks to the anonymous PM guy who I did this for, who then blocked private messages before I could send these details. Have a nice day

(You should be able to remove the file easily too, the same way, if it doesn't work out.)

JasonACT · 03-08-2021, 06:39 PM

I bought one of these off ebay for $15 (came with a USB programmer too, but I was only really after the clip):

Here's a brand new EEPROM I've clipped in, to have a look how it connects:

Seems to work well enough...

Tried it out tonight, the V850E chip's manual states that if you are in reset mode (see the picture below for where I connected the wire to the capacitor to reset the chip when I wanted - you should be able to hold it in reset mode as long as is needed) OR you are in flash programming mode, where most pins stay in their reset (tri-state) configuration...

Then you can connect up an Arduino Nano using pins A4 & A5 (SDA & SCL respectively) to the EEPROM pins (using a common ground, and +12v applied to the Cluster's black-socket power pin) and read/write it while it's still soldered to the circuit board. That youtube video showed some specialist equipment that supplies ~3.0v to the board so the V850E chip doesn't quite power up properly, but still lets you talk to the EEPROM. No-one should attempt that with the cheap stuff being used here, you're likely to corrupt the EEPROM or ruin some of the other components.

This has been a community safety announcement

I forgot to mention, viewing from the front of the Cluster circuit board, the EEPROM is actually upside down - best not to mess with it if that comes as a surprise though.

jakka351 · 30-08-2021, 12:13 AM

Quote:

thats an overrev chime..... not when to change.. hahaha its in the cluster, its on autos but u can't hit it, the rev limiter hits before, and u overrev but punching the clutch on a downshift, loss of weight and flywheel spins up quicker.... Or you have a killer tune\motor and stock setting in the IC.

Shift Alert or Engine Overspeed Alert?

JasonACT · 30-08-2021, 08:48 AM

You can't hit it in an non-FPV with the default setting, true. By default it's set to 6K RPM like the limiter. From what I see of the FPV Cluster though, the limit is higher @6.25K RPM.

I have adjusted mine (it's an OBD2 writable setting, so no need for direct access to the EEPROM) to go off at 5.25K RPM and I can certainly "hit it" and use it to let me know when to shift up.

Whoever said what's in that quote thinks it's an on-off thing, and not adjustable, probably only fiddled with the known As-Built OBD flags - which is where the on-off part is. The adjustable setting is not part of the As-Built data, so they probably never found it while they were fiddling.

jakka351 · 30-08-2021, 10:56 AM

Definetly something I'm going to adjust, i can hit the alarm in every gear up until changing into 5th,( havent been able to since moving into the city, but probably a good thing).

It does log a faut code in the pcm everytime I hit it, saying max rpm reached - but that could also be limiter.

Ill post what I find after I figure it out while fidding with my falcon on this forum.

JasonACT · 30-08-2021, 05:05 PM

I checked my "Read By ID" dumps of the donor MKI G6E Cluster I've got here, also checked the MKI EEPROM dump in general. I don't see the same repeating value of 0x78 like I do in my MKII Cluster. It's possible it wasn't a changeable setting in the MKI.

EE01 is the ID to use in a MKII. That ID doesn't exist in a MKI either.

If you can get hold of a MKI Cluster firmware update file (should be a bit less than about 256KB) then I can find out for sure. I have managed to find another 8.8KB firmware part/file for the MKII Cluster (this bit loads into RAM for speedier execution, branching out to the larger Flash memory firmware when needed). But I have not been able to download any MKI firmware files from the Ford-IDS download site.

They remove old firmware files when there is an update and you need to guess the latest filename exactly to be given it. You would need to know someone who has had the IDS system for a while, and who has a nice collection of firmware files in the IDS Program Files directory. You would only need the filenames/directly-listing as the files will be available to download.

jakka351 · 30-08-2021, 05:30 PM

Quote:

Originally Posted by JasonACT

I checked my "Read By ID" dumps of the donor MKI G6E Cluster I've got here, also checked the MKI EEPROM dump in general. I don't see the same repeating value of 0x78 like I do in my MKII Cluster. It's possible it wasn't a changeable setting in the MKI.

EE01 is the ID to use in a MKII. That ID doesn't exist in a MKI either.

If you can get hold of a MKI Cluster firmware update file (should be a bit less than about 256KB) then I can find out for sure. I have managed to find another 8.8KB firmware part/file for the MKII Cluster (this bit loads into RAM for speedier execution, branching out to the larger Flash memory firmware when needed). But I have not been able to download any MKI firmware files from the Ford-IDS download site.

They remove old firmware files when there is an update and you need to guess the latest filename exactly to be given it. You would need to know someone who has had the IDS system for a while, and who has a nice collection of firmware files in the IDS Program Files directory. You would only need the filenames/directly-listing as the files will be available to download.

unfortunately I havent that sort of access to ids stuff, i am going trial and error with this document
https://github.com/jakka351/FG-Falco...ar_hacking.pdf

JasonACT · 30-08-2021, 05:38 PM

You might be surprised about who sometimes reads this thread and does have that information. I'll take a look for sure, if it appears here.

My best guess (which doesn't work) is that it (the first update) is called "8R29-14C026-AB" (-AA will never have been made available).

For an FG2, it's not "BR29" like most of the stuff in one, because some of the electronics came from the SZ which seems to have come out first, and which is "AR79".

jakka351 · 01-09-2021, 04:28 PM

Havent found anything yet, but am convinced I will be able to make my cluster play the guitar riff from the Sunday Bloody Sunday intro

JasonACT · 04-09-2021, 02:13 PM

From the dump at the top of this page (post 481, if this post spills over) there's a dump of a MKI XR6 with this content:

0x070 20 20 20 20 10 20 20 20 20 20 81 0e 80 00 ff 00 ____._____..€.ÿ.

Position 0x07A controls features: Police Mode & RPM Alarm
(81 = those two are off, 85 = Police, 89 = RPM Alarm ... 8D = Police & RPM)

Position 0x07E & 0x07F are the RPM Alarm configuration (here they are not set, being FF 00). On my spare MKI G6E Cluster, I've coded these bytes as 69 4A and turned on the RPM Alarm and it goes off when you hit 5250rpm (you can hit 5249 as much as you like, it won't go off). The value for 6000rpm (as mentioned earlier) and what an FPV will have set in these positions is 78 4A. The 4A part is some weird config to do with timing and how low the RPM needs to go below the set limit to reset.

Sad news though, I'm sorry to say, but even though I can enable the RPM Alarm and set where it goes off, these config changes in the EEPROM do not alter any of the values you can read via an OBD2 tool.

So... These are not settable on a non-FPV MKI without disassembling the Cluster.

Even if you enable the alarm, the default set limit will not allow the alarm to go off.

Edit: I forgot to mention... No special checksum needs to be recalculated for changes in that particular area.

jakka351 · 04-09-2021, 02:57 PM

Quote:

Originally Posted by JasonACT

From the dump at the top of this page (post 481, if this post spills over) there's a dump of a MKI XR6 with this content:

0x070 20 20 20 20 10 20 20 20 20 20 81 0e 80 00 ff 00 ____._____..€.ÿ.

Position 0x07A controls features: Police Mode & RPM Alarm
(81 = those two are off, 85 = Police, 89 = RPM Alarm ... 8D = Police & RPM)

Position 0x07E & 0x07F are the RPM Alarm configuration (here they are not set, being FF 00). On my spare MKI G6E Cluster, I've coded these bytes as 69 4A and turned on the RPM Alarm and it goes off when you hit 5250rpm (you can hit 5249 as much as you like, it won't go off). The value for 6000rpm (as mentioned earlier) and what an FPV will have set in these positions is 78 4A. The 4A part is some weird config to do with timing and how low the RPM needs to go below the set limit to reset.

Sad news though, I'm sorry to say, but even though I can enable the RPM Alarm and set where it goes off, these config changes in the EEPROM do not alter any of the values you can read via an OBD2 tool.

So... These are not settable on a non-FPV MKI without disassembling the Cluster.

Even if you enable the alarm, the default set limit will not allow the alarm to go off.

Edit: I forgot to mention... No special checksum needs to be recalculated for changes in that particular area.

What about mk1 FPV clusters, although I dare say mine is an XR8 one, its one of the first GS's

JasonACT · 04-09-2021, 03:20 PM

The G6E Cluster I have has an old firmware loaded into it, from July 2008 (though it's a bit more than a year older than that). It's possible a 2010 Cluster firmware from an FPV has been updated to allow using an OBD2 device to change those values. I've also seen pictures of MKI FPV Clusters, there is a later firmware. There is space for 2 extra gauges in this old G6E model, and I have no doubts I can enable them via the EEPROM.

You would have to scan the 65K IDs to find out. I don't like your chances though :(

I guess the take from my post is, MKI owners in general will need to go to extreme lengths to set this - but then again, they are far more easy to match-up to your car (using Forscan).

I actually have a feeling, you could copy a MKI FPV EEPROM into any MKI cluster and your car wouldn't know it wasn't the original. I think it's only the MK2 that has moved the security stuff into Flash memory, along with the EEPROM.

Edit: Even the FG2 OBD2 interface will not allow you to set the 4A byte, so I do feel it's locked out on MKI's.

JasonACT · 04-09-2021, 04:36 PM

FYI - I can enable the 2 extra gauges, but there is no FPV Splash Screen in this old MKI G6E unit's firmware.

jakka351 · 22-09-2021, 07:41 PM

Quote:

Originally Posted by JasonACT

From the dump at the top of this page (post 481, if this post spills over) there's a dump of a MKI XR6 with this content:

0x070 20 20 20 20 10 20 20 20 20 20 81 0e 80 00 ff 00 ____._____..€.ÿ.

Position 0x07A controls features: Police Mode & RPM Alarm
(81 = those two are off, 85 = Police, 89 = RPM Alarm ... 8D = Police & RPM)

Position 0x07E & 0x07F are the RPM Alarm configuration (here they are not set, being FF 00). On my spare MKI G6E Cluster, I've coded these bytes as 69 4A and turned on the RPM Alarm and it goes off when you hit 5250rpm (you can hit 5249 as much as you like, it won't go off). The value for 6000rpm (as mentioned earlier) and what an FPV will have set in these positions is 78 4A. The 4A part is some weird config to do with timing and how low the RPM needs to go below the set limit to reset.

Sad news though, I'm sorry to say, but even though I can enable the RPM Alarm and set where it goes off, these config changes in the EEPROM do not alter any of the values you can read via an OBD2 tool.

So... These are not settable on a non-FPV MKI without disassembling the Cluster.

Even if you enable the alarm, the default set limit will not allow the alarm to go off.

Edit: I forgot to mention... No special checksum needs to be recalculated for changes in that particular area.

Ive come up with a bit of a work-around, not going to risk damaging my cluster, but with a bit of raspberry magic and socketcan, can trick the cluster into momentarily thinking the engine is past the limit, triggering the shift alarm, and then clearing the resulting fault code that is logged everytime you the alarm goes off.

Was driving for around with it going off at 1000 rpm, became quite annoying after the novelty wore off.

Havent gotten the light to light up though, just the sound.

jakka351 · 24-10-2021, 11:22 PM

Quote:

Originally Posted by JasonACT

FYI - I can enable the 2 extra gauges, but there is no FPV Splash Screen in this old MKI G6E unit's firmware.

What would it take to edit that firmware and put in my own picture?

JasonACT · 26-10-2021, 05:22 PM

I never was able to find/download the MK1 firmware. Then it's protected from changes by a checksum, tested in the firmware bootloader (code of which Ford would never have made public). So, what would it take? Being good buddies with someone in their technology section who worked on all this, and them having held onto enough files and/or details, is about the only way.. So not going to happen, IMHO, sorry.

jakka351 · 26-10-2021, 05:44 PM

Quote:

Originally Posted by JasonACT

I never was able to find/download the MK1 firmware. Then it's protected from changes by a checksum, tested in the firmware bootloader (code of which Ford would never have made public). So, what would it take? Being good buddies with someone in their technology section who worked on all this, and them having held onto enough files and/or details, is about the only way.. So not going to happen, IMHO, sorry.

What about with renesas software?

JasonACT · 02-11-2021, 07:55 PM

I didn't just want to immediately say "No". But that's my answer. Even so, I had put this on my list of things to look at... I had previously gone to a lot of trouble to work out what Ford had done with these devices, they are locked down, Renesas do describe in detail how to secure their chips.. and from what I could see, there are no avenues to open them up.

The thing is, if you flash a bad image into the cluster, then for everyone's sake it's best to not "run" what got flashed - because doing so may crash the chip... Once it's crashed, you can't re-flash. The routines needed for doing so are no longer running.

You can't blame them.

In other news, I've managed to write some USB device drivers (I converted quite a few Linux USB drivers) for the MK2 touch screen. I've got the WiFi chip I'm using, which is connected to the "spare" HW serial port, working at ~250KB/s (or around 70KB/s with constant video decompression)... it's all a bit technical... But on a device plugged into the USB port it only runs at ~30KB/s. The difference is enough to make it not worth bothering too much with it. My application is a remote desktop to a raspberry pi running the Kodi media player.

Look at it this way, "remote desktop" has about 9 frames per second with a hacked-in device (smooth enough video, if you reduce the size to 25%, with a renderer that increases it back to full-screen) compared to less than 4 FPS with a non-modified unit with a USB WiFi dongle. FYI - they did use undocumented APIs for USB memory sticks which seems to work at 860KB/s, the internal flash chip runs at about 4MB/s while my SD card driver I made works at a little over 3MB/s.

But I think this thing is now "done". You either hack hardware into it to get something that works OK, otherwise it's not really ever going to be anything special. I'm a bit sad about that.

happy1 · 03-11-2021, 02:56 AM

Hi, very impressive what you have been able to find out and do with the ICC and cluster. '

Some years ago when I tried to swap in a full set of 2011 Mk2 XR6T(auto) electronics into a 2011 Mk1 XR6T(manual) I had problems to update the As-built data in the cluster, I needed to set it to 'manual' instead of 'auto', but couldn't figure that out back then.

Back then, if the vehicle had been a Focus III, there was a Russian website that had an as-built editor. http://ford.xtlt.ru/ab/ That editor wouldn't quite work with the Falcon file. Is that something that would be useful to do now, to develop an as-built data file fixer that works for FG2 and late Terri?

This link explains a little more how the FoCCCus app worked: http://blog.obdii365.com/2020/01/24/...-coder-reader/

I haven't looked too closely what Forscan can do these days, so maybe that has a solution for it already.

Cheers,