CwazyWabbit

I'd guess the lack of oil had a lot more to do with it than the towing of an Ambulance, sorry to hear about the death of your gearbox

That would be great Ralph, there may be a few marks on the white plastic and the inner edge of the metal ring if digidash opened yours. Although I imagine they are quite practiced at it now so the marks may not be too obvious. Thanks again

Isn't anchor rope also a dynamic rope? Which unless I'm mistaken would be a right pain in the backside on a winch.

Middle pin goes direct to GND and the two others go via resistors to the only other chip on the board besides the eeprom. Unfortunately the IC manufacturer seems to be quite good at keeping their datasheets secret. The chip in question is a Micronas CDVN 2117, there's a picture somewhere on page 2 I'll take a look at the Xtal in a mo... I'm thinking a few more examples of flash contents might be helpful now..... any volunteers?

That explains why you know all the part numbers .... you must have replaced most of it by now

Well that must prove there is an external method to modify the memory. The fastest I could do it without opening the case would take about a week ....

Out of curiosity Ralph how long did they take to add that much?

Very good point, and it looks like it has microwire support already if people want to program their own flash http://code.google.com/p/the-bus-pirate/source/browse/trunk/scripts/pyBusPirateLite/MicroWire.py?spec=svn355&r=355

Good point, would make changing them a lot quicker, which has to be a good thing. So far all I know about that 3 pin port is Centre pin is GND The other two pins are connected to the main chip via resistors. There has been no observed activity on the pins during testing apart from one being pulled to 5v at power up. We have been unable to find the main chips datasheet....yet. We have anecdotal evidence that to reduce mileage requires opening the case but adding mileage can be done without opening the case. I have clocked the input on this speedo at approx 1.6khz with no adverse affects observed, mileage increased at approximately 25 miles per minute. Any greater frequency and the speedo fails to register a signal. Even so that is about 1500MPH which means you could add 50 000 miles to a speedo in about a day and a half, using a microcontroller You could automate the stop time so you don't overshoot. It has so far been a good day

That may be a good way to get more example flash dumps to help work out what the other contents are. At the moment I'd guess it would take about an hour to do the dismantling, soldering, reprogramming and reassembly... with the proviso we haven't actually put James's back together yet! How much of a forum donation would that be worthy of? I don't mind doing them for free providing any expense is covered (probably just return postage, can't think of owt else) and people understand no guarantees are provided. Also I reserve the right to change my mind if it turns out 1000's of people want them redone and I'm not getting any sleep! All information discovered about these Speedos will be published on LR4x4 so people are free to just reprogram their own if they like. Important point to note at the moment is there are some marks left on the back of the metal ring that holds the glass in place using our current method. These are not visible when it's put back in the binnacle though.

You need to look for points on the diagrams where there shouldn't be power unless the switch is on, if that makes sense, an example would be the wire going from the switch to the coil of a relay. It can be a bit of a nightmare but working methodically through a bundle of wires making a note of what you have tested and what reading you got really helps. Also there will be things that naturally will cause what appears to be continuity between wires, again this may be coils of relays etc, so it might help to unplug relays and fuses before testing to help save you getting false results, just remember what went where! digital cameras can be a god send .

But now it will be.... Knowing which Bytes to change ..... priceless .... well actually no price, just visit LR4X4

Well it's worth a shot, a good shot of WD40 to displace any water or carp in the connector then clean it up and seal it in some way, it won't do any harm. Another theory could be related to damaged insulation on some cables in the loom, maybe they have rubbed somewhere and are shorting out hence the interaction between different circuits, it's possible that some moisture is giving it a hand as well. It may be worth using a multimeter to see if there is some kind of short going on between the circuits.

There looks to be a red light there, but I've never seen one of these in a vehicle , I'm just doing this for the challenge and because I think people being charged a £100 for changing a few bytes is a bit rough.

Don't forget the total distance traveled recording, that isn't in pulses per angle of stepper motor, that must be a pulses per unit factor.

Good idea, I've tried a few different values in that word now and anything other than 0x1004 have so far left it refusing to move the needle all works fine again when it is changed back though

I'd say there are some mods for Rover though as there is a specific Rover sticker on the PCB. In this particular case I doubt it's storing the top speed as nothing changed when I ran it from the signal generator at an indicated 120MPH, if it has stored it then James will have some explaining to do to the authorities as to how he managed that speed in his 110 Although it is a very good point and recording uptime would be a very strong possibility even if just to sort out warranty issues between VDO and Land Rover. I might try some 'bit flipping' this evening to see if I can get it to read different speeds while running on a known clock speed.

These are all the numbers I can find printed on it... oh and a gratuitous mileage shot for James The date code on the stepper motor seems to agree with the '03 claim for the vehicle... In image 4 the number written in the same direction as VDO is 0249, you can only see the 49 in the picture.

My guess would be that pulses per distance and mph/kph are the same thing, i.e it's just pulse per unit or maybe degree..... time to find that now And top marks for the explanation Less than 24 hours since we started the project and already we understand the total mileage storage

Strange CFBC CFBC CFBC CFBD CFBD CFBD CFBD CFBD = 197671 CFBC CFBC CFBC CFBC CFBD CFBD CFBD CFBD = 197673 I can't get it to 197672 .... I drove around for a while at 120mph till it displayed 197672 but when I disconnected all power it returned as 197673, tried it twice now.

oops I can't count, under by 13miles sorry

Tsk, You are under by 3 Miles Well done! Spill the beans then

The fractional miles are lost when the permanent 12v is disconnected. Apparently the fractional mileage is only shown while the total is less than 100 000 as ther isn't enough space afterwards.

I think you have hit the Nail on the head there Sir! (Mr Freezer) It also explains something that was puzzling me, when you add a mile on it takes 1 away from one of the 16bit words, when you add the next mile on though it takes 1 away from the next 16bit word. I imagine this is a crude form of wear levelling for counters and would make the flash last longer. Thanks for that Now will just need a few more experiments to work it out properly..... then I think we should look at that 3 pin port ...... from what Ralph and Chris have seen from digidash it would seem you only have to open the instrument to remove miles so I'd guess adding miles on can be performed externally via the 3 pin port. Unless Digidash just used a drill on Ralphs!

I should add it's the first 8 bytes 16 bit words of the flash recording the mileage, the fractions of a mile aren't stored and neither is the trip mileage from what I can see.