MrKev

Like this http://www.dborc.co.uk/goodwinch/pdf/tds%20exploded%20and%20drawings.pdf and this http://www.dborc.co.uk/goodwinch/pdf/tds_mounting_channel.pdf ? Kev

Chris Kelly on the Special Stage Kev

Worst case, you only have to try any value with 8 choices of check bytes, but give me little longer, I'll probably spot it, once my brain has cooled down. Unless anyone else wants to get there first..? C'mon, only 4 bits left to work out! Kev

Remember, you're only after a byte for the answer, so chuck the rest away (and with 0x00FF if you like). 0x170 >> 0x70. Algorithm still applies. Kev

Reassuringly, your new values also follow my 'pattern' Using the pair '0x105c -- 0x04FF' as as example... 1. Take the High byte and the Low byte from the calibration word, e.g. 0x105c gives 0x10 and 0c5c 2. XOR them together. In this example: 0x4c 3. Add the value in the Check byte, 0x04 in this example, gives 0x50. The result will be one of the following, for all the values you've given me so far: 0x50, 0x70, 0x90, 0xB0 I would imagine from that that results of 0x10, 0x30, 0xD0 and 0xF0 are also possible, and you just havn't come up with them yet. So that means for any specified value for the calibration, I can calculate back to 1 of 8 possible values for the check byte, but I'm sure there's a way of working out which of the 8 it should be. How's that looking so far? Kev

It was beginning to make sense again until that! Kev

Well, Ray, it is not guaranteed that the EEPROM in the aftermarket (which you can setup via the pushbutton, apparantly) gauge is the same layout as the TD5 standard one, but it will certainly be interesting to see the EEPROM dump from it, it might be helpful in understanding more how the TD5 one works if it is the same layout. Kevin

Well that's changed things a little!

No probs. I think we do need exact sequences - possibly not many, but the small jumps I'm sure will be periodic, and thus can be mathematically defined. June! Hold of re-programming the machine

Yeah, I see, but can't explain the pattern. I can't explain why it jumps an extra 'count' at 0x0DBD to 0xDBE, for example, which I believe is key to understanding the algorithm. I wouldn't mind betting, that if you take any other complete block that you've found, e.g. 0x3080 -- 0x00FF . . . 0x3000 -- 0x80FF then 0x3081, for example might pair with 0xFEFF (missing out 0xFFFF) It would seem that 0x8200, 0x8100 are missing (are these never seen..?) and are substituted with 0xFEFF and 0xFDFF. 0xFFFF is generally missing, so my thinking goes along the lines of 'the programmer wanted to make sure that he was pointing to a real number, and not an erased (0xFFFF) word in EEPROM). Occam hasn't fetched his razor out on this little project yet though Kev

Ok, I think I've spotted something. Try these then: either both of these will work 0x300C -- 0x74FF 0x4010 -- 0x80FF or this pair will work 0x4010 -- 0x70FF Kev

So are you saying for example that these pairs didn't work, or did you omit them for brevity? 0x1003--0x5DFF 0x1002--0x5EFF 0x1001--0x5FFF Similarly, the run between 0x0847--0x01FF and 0x0804--0x44FF Kev

May I suggest 0x2008 would be a useful figure, as that would be half mileage, so we'll have a set of 0x0802, 0x1004 and 0x2008.... Kev

So words 17, 18 and 52 control needle deflection, and words 8 & 13 seem to control input pulse count calibration.... Have you got any more value pairs, 'cos I can't spot a pattern just yet Kev

I'm not really experienced in expeditions, so can't really, comment much, but I do think that the back half shafts are straight, and the front half shafts need to have something bendy (like a CV joint) to make it go round corners... Kev

Nige, I thought you were the forum Surgeon? I could probably hit it with something. Megasquirting an engine seems like a reasonably techie thing to be doing, so I would have thought that most of the users would therefore be moderately PC savvy. Kev

I've played around a bit with quite a selection of these thingies, and also written USB host and device software for embedded whatnots. In general, I have found them to be ok, but not that great. The Prolific ones (PL2303 I think) have always struck me as a bit dobby, but generally work. There's another chip made by FTDI (FT232..) which I have found to be much more stable generally and more reliable than the Prolific ones for the situations I've used them in. When it comes to drivers, the windows serial usb driver (Usbser.sys) has several known faults, especially with missing packets under certain situations (details irrelevant here I guess). The FTDI chips come with FTDI written drivers, and are generally considered superior. Prolific adaptors also use their own driver .sys file to circumnavigate the windows offering. Do you know if you have had problems then with FDTI converters? Kev

I took out a new policy on my new truck with Frank Pickles over the weekend. Same great friendly service, same good price. I asked about the aforementioned Flux issue, and it was clarified to me. FP are only interested in modified 4x4s who are club members, and sub 5000 miles per annum - that's their niche and the general understanding is this type of person is likely to be one who cares about their vehicle and drives it responsibly etc. Basically, they'd had a lot of people who think that tinted windows and a few stickers with some puns about 'liking it in the mud' and 'if you can read this, turn me over' count as modified. If you're vehicle is genuinely appropriate, give them a call. If you just surf the website, you'll get through to an AF quote. Kevin

or better still: knowing which bytes to change, just visit: Donate Here

Of course, you'd replace the background of the dial with one that has the letters 'km/h' rather than 'mph', so it would probably have a suitable km/h scale too. The sensor pulses per stepper motor steps / degree of needle deflection would remain the same. Sure different speeds e.g. 140mph rather than 120mph would need a different calibration factor for the road speed versus needle angle, as RJF was suggesting. Google tells me that 1 mph = 1.609344 km/h so the 2562ppm might be slightly out (2547.621 pulses) Kev

If 'tis true that 4100 pulse/mile (0x1004) is stored in word 8, then 2562 pulse/mile gives 0x0A02 - might be useful if a km conversion is required. There was talk of this on another thread only a week ago or so. Kev

True, but an erased device would be all FF, and there are quite a few bytes that are not FF... Well yes, useful for warranty claim disputes etc. We do know that this particular unit has done at least 120mph, which is pretty fast for a TD5 Kev

The maximum mileage that can be stored therefore is in the region of 1.04 million miles. Has anyone done that sort of mileage in a TD5 yet? It's possible it might rollover in software at 999999 miles due to a lack of digits I can't make a huge amount of sense from any of those other numbers against the hex dump. Kev

I'm thinking Serial number for the speedo and VIN number maybe for the vehicle it was originally on maybe. It may be a general purpose bit of software the instrument maker uses for multiple vehicles, so CAN bus IDs and things may be in there too. Can't think of much else though. James, do you know the VIN of the vehicle that the speedo came from? Kevin

Sorry, should actually have been: CFBC CFBC CFBC CFBC CFBD CFBD CFBD CFBD M'theory goes like this: Memory space starts off as 8 words of FFFF, thus: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF This, I assumed to represent 1.0 miles, from your photo. Each 2 miles that elapse result in a decrement (big endian) of successive words, module 8, starting at address 0, i.e. FFFE FFFF FFFF FFFF FFFF FFFF FFFF FFFF represents another 2 miles, i.e. 3, assuming it starts at 1 after clearing it out. the next mile goes in the next word: FFFE FFFE FFFF FFFF FFFF FFFF FFFF FFFF = 5 FFFE FFFE FFFF FFFF FFFF FFFF FFFF FFFF = 7 FFFE FFFE FFFE FFFF FFFF FFFF FFFF FFFF = 9 FFFE FFFE FFFE FFFE FFFF FFFF FFFF FFFF = 11 FFFE FFFE FFFE FFFE FFFE FFFF FFFF FFFF = 13 and so on... So: to get 197,672 miles :- 197672 divided by 16 gives 12354.5 (ignore the decimal for now) subtract 12354 from 65535 (i.e. FFFF) gives 53181. Convert to Hex: CFBD 12354 * 16 gives 197664 so now to add 2 mile increments till we get to the desired mileage, in this case 3 lots, so decrement CFBD by on in the first four spaces: CFBC CFBC CFBC CFBC CFBD CFBD CFBD CFBD And there you have it. So removal of 12V power from the speedo will loose up to 1.9 miles, which is stored in RAM rather than in EEPROM. I'd love to know what all the other numbers mean though. There must be a bit for miles/km presumably, and probably a separate 'sensor pulses to distance' calibration perhaps. What else can a TD5 Speedo do?