NefMoto

Hi, it's my first post of the forum, so hello.

I've messed up my cluster on my 2002 Audi TT. I messed it up using VAGTACHO. The cluster is a Magneti Marelli brand. I also tried to read the cluster eeprom using vag k commander. This saved a file, but it doesn't look right. I've attached the file to this post.

Can anyone give me advice on how to fix this please? The actual mileage is 132000m.

Thanks in advance for any help offered.

I've managed to dump the full eeprom I think. Please find attached.

With the Magneti Marelli brand clusters, they can sometimes take 1-4 hours to crack the SKC.
Once you have the SKC, go and login then adjust your mileage reading accordingly.

Otherwise, find another cluster, pull SKC then perform a cluster swap and adaption.

Hi, I have the SKC for the cluster, just don't know how to change the odometer. It's stuck on 999999 at the moment. I've tried changing it with VAG tacho, (This is what messed it up in the first place)

Are you referring to a different method to changes the odo?

Thanks the the reply.

Jase

Try to write cluster odometer to 000000. I have read that any cluster with less than 100kms can be changed using VCDS/VagCom to the mileage you want without messing it up with other software. I tested it when I change my cluster to a newer one and works quite good.
Also cluster needs to be adapted before for sure.

I've tried that, it still shows 999999. These marelli clusters are tricky. I read that the odometer is stored 0xAA to 0xC8 and has two blocks that are 0x90 bytes long, one storing the an inverse odo and the other storing the real odo. I don't know how to decipher the reading I have in my dump to try and make changes offline and re-flash the eeprom.

Any ideas?

vagtacho, just be able to assist you with this.

VAGtacho messed it up in the first place. I have tried again, however, any value I put in, always shows up as 999999.

I think the first cluster dump you posted is the correct one, I say this as I have read the Dump off my clusters with carprog directly off the board and it's the same as your ttcluster1.bin file in terms of size and layout. This was the way Kompressed said I needed to read it.

I have the same problem , as mine went 99999 with vagtacho and I'm hoping to fix it in a hex editor and reflash, Not much luck at the moment though as Kompressed very kindly had a look at the file for me and corrected it back to 00000 but even with the changes it is still reading 99999 on the cluster!

I have bought 3 cheap clusters off ebay all working bar the dials which is an easy fix so will get the dumps off thoughs and see what I can find out.

Nice one, I hope you find a solution. I've worked out how the mileage is stored but, I think there must be some other info or a checksum somewhere in the eeprom.

When I dump the cluster using the "direct" setting, I get an file that is 0x10000 bytes long, the part of interest to us starts at 0x3800 and is 0x800 bytes long.

The odo seems to be recored 36 times in inverse hex and 36 times normal hex below are some examples from a dump of this forum, I worked out the mileage for easy reading, the reading seems to go up in twos but the lowest reading isn't at the start or end, it's in the middle and there are two orders in each column. When I have tried reseting using vagtacho, each of the readings in the columns is set to the same number and doesn't go up in twos:

FFFE5444   0001ABBB   109499
FFFE5442   0001ABBD   109501
FFFE5440   0001ABBF   109503
FFFE543E   0001ABC1   109505
FFFE543C   0001ABC3   109507
FFFE543A   0001ABC5   109509
FFFE5438   0001ABC7   109511
FFFE5436   0001ABC9   109513
FFFE5434   0001ABCB   109515
FFFE5432   0001ABCD   109517
FFFE5478   0001AB87   109447
FFFE5476   0001AB89   109449
FFFE5474   0001AB8B   109451
FFFE5472   0001AB8D   109453
FFFE5470   0001AB8F   109455
FFFE546E   0001AB91   109457
FFFE546C   0001AB93   109459
FFFE546A   0001AB95   109461
FFFE5468   0001AB97   109463
FFFE5466   0001AB99   109465
FFFE5464   0001AB9B   109467
FFFE5462   0001AB9D   109469
FFFE5460   0001AB9F   109471
FFFE545E   0001ABA1   109473
FFFE545C   0001ABA3   109475
FFFE545A   0001ABA5   109477
FFFE5458   0001ABA7   109479
FFFE5456   0001ABA9   109481
FFFE5454   0001ABAB   109483
FFFE5452   0001ABAD   109485
FFFE5450   0001ABAF   109487
FFFE544E   0001ABB1   109489
FFFE544C   0001ABB3   109491
FFFE544A   0001ABB5   109493
FFFE5448   0001ABB7   109495
FFFE5446   0001ABB9   109497

I think the problem is the MCU has been corrupted. To fix it is a solder job. I think carprog will fix it.

Thanks for the reply ddillenger. Excuse my ignorance but what is the MCU?

Using Vag Commander, I can read two different size dumps. The biggest is 10000 bytes long the smaller one which is part of the 0x1000 byte dump and  contains the immo and odo data is 0x800 bytes long. The smaller file is made up of data from address 0x3800 and 0x800 bytes long.

Is the data from 0x3800 and 0x800 bytes long the eeprom data? If so, I goes the rest of the data is software. Is that the MCU software?

I hope the above makes sense, as I'm pretty new to this kind stuff.

Thanks again

Microcontroller.

It's a Motorola mcu and needs 4 wires soldered on to the board and use carprog to read the flash.

It's actually pretty simple and just needs the rear case removing, once the wires are soldered on you can either run it whilst plugged into the dash harness or use a bench harness..

The flash you down load is as I uploaded in the original sections...

try these 2 files, report back

I had some trouble a while back and setting the cluster to 0km wouldn't work but setting it to 1km did.

I'm away from home for two weeks, soon as I'm back, I'll try the files and report back. Thanks for all the replies

If I do try those files, will the immob info and VIN be wrong for my car? Just checking, as I don't want to compound my problem further.

Vin might be different,

I have not looked into the specific files loaded BDK. But with the hex editor you can correct your IMMO info as well as the VIN info.
Just watch out, I have discovered the cheap Vag Tacho's are very inconsistent.

IF my main unit was not damaged I would likely not have know this.
Even thou you read the info, it displays the IMMO SKC as FF FF. Not as per actual SKC hex.
However, after a few attempts it still finds the SKC.

The 2 files I posted are your first file modified through the avdi dump tool.  I just set the mileage to 0 and 1 in each file.  Your immo data was not touched.  The basic file structure and size looks right at a quick glance.

I've been able to fix a few clusters where the mileage showed 999999 just by correcting the eeprom.  I haven't needed to rewrite the mcu flash section yet and I don't think I have a way to do it.  From what I've read the display reads 999999 if the mileage and checksum don't match up.  Vagtacho clones don't correctly fix the file on later clusters.  The avdi dump tool writes the mileage blocks to all the same number as you noted but it also changes a couple bytes further down in the file,  maybe a checksum of some sort?  I'm not an expert.  I would've thought that the inverted mileage was written so that the value for the checksum would add up correctly but it doesn't appear that way.  Keep in mind I have a very basic understanding of checksums.

As for the mileage blocks all being set to the same value that is normal.  If you update the mileage with vcds and read the eeprom it shows the same pattern of all the same values instead of incremented by 2.  Also for whatever reason setting it to 0 didn't work on 1 cluster but has worked on others.  On the cluster that didn't work on 0km, 1km did work.  So I supplied both files.  If it works out then you can just adapt the mileage with vcds and you should be fine.

Reading the mcu via carprog looks like it must give the same data as you avdi does.

I have a cluster with dodgy dials, I have ordered new motors to replace them but wondered as I've heard the firmware can become corrupt as well. Is this the case?

Here is a interesting writeup regarding faulti dash because of cold winter days.
http://www.motor-talk.de/forum/kombiinstrument-tacho-totalausfal-l-selber-reparieren-diy-t2597323.html

log story short: if your dodgy dials were replaced but you have still problems its maybe useful to replace this chip

http://www.codecard.lt/electronics/2j74y/mc68hc908az60-2j74y-processor-already-programmed-with-software-you-need/prod_127.html

Just got back from my holidays, and was going to flash the files that were provided for me, before I did I wanted to check thought the pin and immob data. The first smaller I file I provided for some reason different immob and vin information and shows a pin of 01545.

The second file, the bigger of the two, shows a pin of 00251 which matches the pin in the ecu, I've some how mixed files up?

Also, looking at the full cluster dump there is an area with a string of Xs and looks like this:


AUZ5Z0B0166003 XXXXXXXXXXXXXXXXX

TRUZZZ8N321020392

Why are there Xs there, I know the first is to do with the immob, the last is the vin?  Can anyone help me clear this up before I go and flash?

Some how I uploaded the wrong file in the first place, so please ignore my previous post.

I'm now failing in extraing the eeprom using vag commander, whilst attempt a read using the direct setting not tt, the cluster seems to reset and vag commander then crashes. The cluster is in a timer that can be view in VCDS on channel 24 of the cluster, it seems to count down from 19, but takes about a minute per digit.

I need to pull the full eeprom again somehow, any tips?

Right, I know have carport, not sure how to proceed. Does anyone have a tips please?

intrigued to find out if this was sorted as i have a tt marelli dash i'd like zero'd ish / 500 miles to match the new/replacement BT engine.

Vagtacho seems to read it ok as a post 2000 file, no option to write back over obd

I had to send it off to a company in London to get the chip flashed. It don't have the equipment or knowledge to do this. Cost me £120

Hi,

can anybody assist me in finding the skc out of this full dump?

couldt find any info one the net so far :(

I think its either 01106 or 20996

I agree with jase, looks like 1106.  Usually located in two bytes before immobilizer serial number, just need to convert to decimal.