99.5 Cluster ROM documentation thread (applies to all pre-2K A4 non-NB and Passats)

[bhtooefr]

Been meaning to do more research on this, never got around to it, but Chimaera has been doing a lot of documentation, so I'm gonna go ahead and post what I've got.

I'm sticking this in the A4 VE/PD forum because most people who are interested in this thread are going to be 99.5 Golf and Jetta owners, but it applies to the following models:

1998-1999 Golf 1J
1999 Bora/Jetta 1J/9M
1997-1999 Passat 3B

It may also apply to the following models (in roughly decreasing order of confidence):

1997-1999 Skoda Octavia 1U
1998-1999 SEAT Leon 1M
1998-1999 SEAT Toledo 1M
1997-1999 Audi A3 8L
1999 Audi TT 8N

There may be other models it applies to - pre-2000 Polos and Audi A2s have a similar-looking cluster, and pre-2000 Audi A4s may also be compatible, although their clusters have some different features.

Some of this stuff I originally wrote almost a year ago, and never actually got around to posting, and intended it for a different thread, so it might read a little weird.

So, let's begin.

 

[bhtooefr]

When researching the 99.5 MFA mod, compu_85 mentioned to me that his speedometer was inaccurate. After some investigation... turns out, his ROM is from a modified 1J0 919 881 D. This is a 220 km/h cluster. Now, you're thinking, "but the top speed on a 140 MPH cluster is 220 km/h." But, the trick is, 140 MPH isn't 220 km/h, it's 225 km/h, and it's at the same point on the speedometer as 220 km/h.

So, the speedometer map is incorrect for a US TDI. This requires either the correct ROM, which would be an immo-deleted version of the 1J0 919 931 D ROM, or some hacking. Since we're in the US, and we have access to 1J0 919 951 ROMs, which have the correct maps, but not 1J0 919 931 D... let's do some hacking.

Now, before we proceed, two things.

First, you'll need a copy of VAG-Tacho, which is a tool that can dump firmware from a cluster and reflash it.

And, second, if you mess up your cluster doing this, it's your own fault. That said, you're only modifying the data map, not the code map, so this should be relatively safe - even if you "brick" the cluster, VAG-Tacho should be able to reconnect. If you don't understand the instructions below, do not proceed. You are modifying various maps in the cluster, and if the steps are performed incorrectly, you may damage your instrument cluster, it may provide misleading readings (including of coolant temperature and fuel level,) and you may inadvertently commit a felony. (Odometer tampering is a felony in most states. Don't do it.) It's best if you don't do this until you understand the position of every map in the cluster (which is what Chimaera is finding out), although I certainly don't, and my VCDS cable couldn't handle the timing necessary to connect to the cluster through a USB to serial adapter (so I couldn't muck with some of the maps without going for a drive.)

 

[bhtooefr]

Now that this disclaimers are out of the way...

Offsets 0x36 through 0x45, and 0x50, change with odometer changes. I don't fully understand the mechanism at work, and it seems like there's some form of encryption here, but it's an area that we shouldn't touch, other than to make it as close as possible to the original cluster.

Offsets 0x120 through 0x1FF are where the cluster's identification is stored, and where quite a lot of immobilizer data is. (If you have European firmware, this is where your SKC will be, as well.) The ROM from compu_85's cluster has different stuff here, whereas both my stock TDI cluster and the Passat gasser cluster are identical, other than the cluster identification. With a hex editor, the cluster identification will be obvious, and you can change it to whatever you want. (This affects the part number that you get when you scan the cluster with VCDS.) I went for 1J0931D, which is the UK MPH MFA cluster for a manual transmission TDI. This is between offsets 0x184 and 0x18A.

I haven't deciphered the actual maps here, yet, but between 0x90 and 0x11F, the speedometer, tachometer, and fuel level maps live. Most likely, the coolant temperature map is in here as well. Cluster coding is also in here - my stock TDI cluster is set for UK coding (24 hour clock,) whereas the Passat cluster was set for US coding, and when I replaced the Passat's 0x90-0x11F with the TDI's, after cycling the key, the Passat cluster took the UK coding.

 

[chimaera]

Having spent a lot of time poking at the cluster and testing things on my car, I've teased out a chunk of the map for these clusters. The information should apply to any cluster with 919 in the part number (xxx 919 xxx x) but check your own before modifying stuff.

It doesn't apply directly to the 920 CAN based clusters, but some of the stuff may be similar. There's documentation on this one around on the net anyway between here and other sites.

These clusters appear to be configured with two or more ROMs/chips/whatever you want to call it. The one we're working with here is a data configuration for the cluster. It appears the software is somewhere else. And that some volatile data is elsewhere again - more on this in a bit.

The cluster ROMs I've used in my analysis so far are:
3B1 919 930 C - UK Passat TDI 160mph (my own)
1J0 919 951 - US Golf TDI 140mph
1J0 919 881 D - Euro Golf TDI 220km/h
3B1 919 930 G - US Passat 1.8T 160mph

Here's the map so far: http://pics.tdiclub.com/data/500/919_Cluster_Map.pdf

A few things worth noting.

For all the gauges, the x values represent the physical measurement e.g. temperature, speed, rpm, fuel level. The y values represent the position of the stepper motor on the dial face. Every cluster seems to be unique in one or both ranges, though several are close to each other. I've mapped the needle positions for my own cluster and I'll post these later.

The speedometer map is protected by a checksum and I haven't figured out how to reset it yet. This is a work in progress.

With the temperature gauge, the middle value is important as this represents 90*C on the temp gauge. On my cluster, the 6 points for the original temp gauge map are (1040,43) (976,43) (920,741) (600,741) (400,1286) (240,1438). (760,741) represents 90*C - 741 on the y range maps exactly to 90*C on the gauge, and 760 is halfway between 600 and 920. So I've picked this value as one of the points for my straight line, and (240,1438) as the second, since 1438 represents 130*C. This plots the temperatures fairly linearly. In the actual map I've kept 1040,43 as the first point which gives a quicker response during initial warmup up to around 70*C.

I don't know yet whether any info is stored in here for the MFA calculations, or if that's kept in the software eeprom. The volatile data does not appear to be in here. I've compared 7 dumps from my car for different odometer readings (and therefore different MFA readings) and there has been no range changing apart from the odometer one. My guess is there's a third chip in there somewhere storing this info, and the trip meter.

I think the unknown regions contain stuff for converting the CTS signal to a temperature, for converting the engine and vehicle speed sensors into RPM and speed, etc. I just don't know which bits do which, and may not ever know. Zeroing out different blocks in turn and seeing what effects this has might point to some of this.

If any of you folks out there have access to a spare one of these clusters and have some skills in microprocessor programming, it'd be great to see what the software in the cluster is doing.

Also if anyone has a cluster with a different part number to the ones above and have access to VagTacho, I'd appreciate it if you could send me the ROM dump for it, along with the values of the adaptation channels, and the cluster coding.

 

[chimaera]

Time for some updates.

Still working on resetting the checksum. Pulling the two fuses for the cluster didn't trigger a reset so I think I have to go and pull power at the battery and see if that does it. I also plan to find out where the actual checksum is stored to see if I can work out how it's calculated.

I've found the coding section now. The coding on these clusters is in 4 groups. The first is 2 digits, the other three are 1 digit each. These are featured in reverse order from 0x055 to 0x058.

For those of us in Europe, I think the immobiliser PIN is stored three times in reverse order at the end of the cluster. I need to confirm this. When I zeroed out this part of the cluster coding, I had both the immobiliser and glowplug warning lights flashing at me.

The section from 0x1BD down to 0x1FF is all immobiliser stuff I reckon. It's identical between the two US clusters and the two Euro clusters are different to each other and the US ones.

 

[turbocharged798]

I don't mean to butt into this thread and I'll delete my post if its in the way, but what's the point of using a 919 cluster when we found that 99.5s have can-bus wires going to the cluster? The only thing is that the air bag unit does not have can-bus going to it. A bit of rewiring fixes that pretty easily.

I personally would not waste my time on a 919 cluster.

 

[chimaera]

I would say that many people, myself included, have these clusters already and want to change/modify them. If nothing else, it's an interesting exercise in reverse engineering

 

[compu_85]

That, and getting the "in the clock" mfa seems to be a much cheaper option for 99.5 owners. Plus I like the clock display more, it doesn't have the screen fade issues of the later cars, and the only feature it lacks is distance to empty. Plus you can turn the clock off.

-J

 

[chimaera]

@turbocharged798: any idea if the late non-CAN Passats can be set up to use the CAN clusters? My car is April '99 build and I believe CAN was introduced in May or June that year on them, so it may well have a lot of the CAN wiring on board already.

I'd like to switch to a metric cluster, and preferably FIS, which is near impossible to find for pre-CAN, but there are a few on eBay for CAN. If I thought it'd work, I'd go for it.

My current cluster is 3B1 919 930C, and the one I'd like is 3B0 920 840 A or 3B0 920 842 A. These two are the same generation as my car apart from being CAN enabled, so I'd imagine they use the same immobiliser revision.

 

[turbocharged798]

You can check to see if you have the orange/black pair of twisted wires going to the green plug. If you do, you have can-bus going to the cluster. Or you can just drop in a cheap 920 can cluster and see if the glow plug light works. That will tell you if you have can wires going from the cluster to the ECU.

 

[chimaera]

A look through the wiring diagrams shows a pair of wires running through the car labelled high and low bus. The only module they don't connect to is the ABS module, but that appears to have its own direct connection to the diagnostic port anyway.

 

[turbocharged798]

That, and getting the "in the clock" mfa seems to be a much cheaper option for 99.5 owners. Plus I like the clock display more, it doesn't have the screen fade issues of the later cars, and the only feature it lacks is distance to empty. Plus you can turn the clock off.

-J

Did a search on ebay and you are right, you can pick up a 98-99 B5 passat cluster for really cheap(like under $40). Non-can with the MFA in the clock. Hmm..

Anyway, don't mean to hijack this thread.

 

[bhtooefr]

Just as a note, the comment about these maps being in all nnn 919 nnn x clusters isn't necessarily correct.

919 simply refers to pre-CAN instrumentation, and dates all the way back to the very earliest VW Type 1s with fully mechanical instrumentation.

IIRC, the New Beetle clusters are made by a different company, and are NOT compatible, although I'd like to dump some Beetle clusters at Fest.

 

[bhtooefr]

Here's the IC list (of anything notable, anyway) on a 3B1 919 930 G cluster:

L9637D - SGS Thomson K-line driver
U6805B - Atmel hex driver IC with thermal monitoring
CDVO-3112-QB-M141 - Intermetall MCU
93C66 - Atmel 512x8 bit (512 byte) serial flash
D16430AGF - NEC LCD driver
LP2902M - NatSemi quad op-amp
ULQ2003 - STM 7-channel high-current darlington array
4279G - TLE voltage regulator

 

[jetta 97]

After lot of search I find out that All 99.5 has Can Bus. ABS was taking via Can Bus in 99.5.
Even 98 Passat Hybrid cluster will not show MPG if you don't have Can Bus . MPG is reading via Can Bus..

 

[bhtooefr]

FWIW, although there may be CAN support as well, the older cars use a fuel consumption pulse wire from the ECU - basically simulating a gasser fuel injector pulse.

 

[turbocharged798]

After lot of search I find out that All 99.5 has Can Bus. ABS was taking via Can Bus in 99.5.
Even 98 Passat Hybrid cluster will not show MPG if you don't have Can Bus . MPG is reading via Can Bus..

No its not. 98-99 passats are non-can and take the fuel consumption readings off T32 green. They will not work unless you hook up the wire per compu85.

The only thing 99.5's lack is can-bus going to the air bag controller otherwise there is can-bus wires going pretty much everywhere. Whether they are used with a 919 cluster, I have no idea. Pretty sure they are NOT used with the stock cluster.

 

[bhtooefr]

The entire point of a 919 cluster is that it's non-CAN - or, rather, the entire point of a 920 cluster is that it IS CAN.

IIRC, my 8/98 Golf does not have CAN wires to the cluster.

 

[compu_85]

Even 98 Passat Hybrid cluster will not show MPG if you don't have Can Bus . MPG is reading via Can Bus..

This is not what I found with the Passat cluster I put in my car: the MPG reading has its own wire from the ECU to the cluster. Before I added that wire the MPG reading didn't work.

-J

 

[jetta 97]

This is not what I found with the Passat cluster I put in my car: the MPG reading has its own wire from the ECU to the cluster. Before I added that wire the MPG reading didn't work.

-J

Your are right, I saw that in your post. I read that after I post this.

 

[jdias]

This is an old thread, but a friend of mine asked me to swap his 3B1919860C (without canbus) with a 3B0919847A (with canbus).
The original shows 220km/h and has no MFA/FIS and the new shows 260km/h and has FIS.
He wants this new only because of the clocks, having FIS or not doesn't matter to him.
My question is, is it possible to change the original cluster's dump for one without MFA/FIS but that shows 260km/h?
Does anyone has a dump file like that?

 

[Davegsm82]

Could anyone help me with setting the correct mileage in my 1J0 919 930 clocks? My MOT is in 2 days and I need the milage to bw correct for the test computer so it doesnt think ive done 120,000 miles since the van was last MOTd.

I can provide an EEPROM dump of the current cluster, so I can keep the softcoding etc.

Can anyone assist with this? If someone could provide a 0 mile dump I could just up load that and adjust with vagcom, otherwise it will need changing in the dump.

I throw myself upon your mercy.

Dave.

 

[Davegsm82]

I've managed to sort it now, I found a bit of software called 'TachoSoft's mileage calculator', this gives you a hex-value when you put in the mileage.
Slight snafu is that you have to convert the mileage to KM's, then the value you input is converted to a hex-value, then you reverse the two halfs of the hex value and put these values into the EEPROM dump starting at location 0x36, repeat them 8 times til you reach 0x46.
So, for example (not even using the TachoSoft program);
The mileage on the clocks I have just removed from my T3 show '40686'.



Take 40686 and convert to KM's, so multiply by 1.6093.

This value is 65477 KM's.

The digital clocks are quite complicated, there is an algorithm which deals with the lowest 16 miles, so there is a certain resolution you have to deal with.

Since the resolution is 16 miles, take your value of KM's and divide by 16.

This gives 4092, convert this to hexidecimal and you get 0x0FFC.

Subtract this from 0xFFFF and you get 0xF003

Swap the bytes so you then get 0x03F0.

In the EEPROM dump, starting at location 0x36, enter the values and repeat them 8 times, so it would look like 03 F0 03 F0 03 F0 03 F0 03 F0 03 F0 03 F0 03 F0.

Upload EEPROM to the clocks, i did this manually with an EEPROM Programmer, if VAGTACHO works for you then great but my lead doesnt work.



Happy days.

EDIT - After digging a little more, it would appear that the lower 16km's are stored in location 0x01F9, just before the SKC's at the end of the file. I haven't quite figured out the inconsistencies yet but will have a play about with it tomorrow and see what I can figure out. That's also why the clocks show 40682 instead of the intended 40686, since whatever value was in the EEPROM originally is still there.

 

[Davegsm82]

Ok, a little more digging into the encoding mechanism.

Turns out that I have no ida what is stored in location 0x1F9, possibly some kind of checksum but changing it doesn't seem to have any effect on the mileage and doesn't create a .dEF

Perhaps it's a Sub-KM counter? who knows.

Anyway, the encoding mechanism is weird. I started with 04 F0 this time, repeated 8x, which gave 40672 miles on the display.

Starting from the first repeated value and progressing forwards, if you DECREASE the first digit (remember that you're subtracting from 0x FF FF) then you increase by 1km Aprox. This gave the following results;

0x 04F0 Repeated 8x - 40672
0x 03F0 Repeated 1x - 40673
0x 03F0 Repeated 2x - 40674
0x 03F0 Repeated 3x - 40676
0x 03F0 Repeated 4x - 40677
0x 03F0 Repeated 5x - 40678
0x 03F0 Repeated 6x - 40689
0x 03F0 Repeated 7x - 40681
0x 03F0 Repeated 8x - 40683

It's a weird encoding mechanism and the missing gaps between 40674/40676 etc are probably something to do with the sub-KM counter I mentioned earlier.

Anyway, that's all I have to add for now, might help someone hopefully.

 

[turbocharged798]

The last digit is stored in stored in temp memory and not in the eeprom. This is why after you disconnect the battery, the mileage will read slightly different. It rounds it to the nearest 10KM and then converts it to mileage.