LongGo Blog

Saturday,31-October-2015

Xantia Mk II odometer

Hi there,
I have no idea if you`ve got to the point when your dash start loose the sane but here is some tip:
When you take the unit out and rip it apart in small corner of it you`ll find IC C46CM6. That is 1KB of memory, seems to be enough to keep the “books” of that odometer ecu. So, now getting your new dash you can de-solder the chip out from the original one, and solder it on the “new”.

And ta-daaa - here is your kilometers back. But there is something else.
In that memory are stored some parameters for the fuel tank,fuel tank arrow and some that clue has only the developer of the unit. In that case I will offer you other road. Again remove it from the board and put it on programmer:

Once you get the content you`ll see:

84 44 61 22 - all that is repeated on the first row 4 times. And your guess is right: 446 122km is the mileage counted and 84 is kind of CRC check. Or not exactly but it has to be. It is four times, because during the writing process/car is moving/ the processor write in one last value, in the next, the new value, again the old one … If you pass 4km you`ll have 3 different values there. If you start, stop, start… few times but not move the car, there will appear set of equal numbers as on the picture
The second row are temp. A and B counters that you can reset at any point.They are doubled and use same logic of counting but that is not in interest because you can zero them.
Now million dollars question - how you can write numbers what you wish to?
Obviously the kilometers you can straight away, but what about first 2 bytes. That checksum.
First you need table for the numbers from 1-9. Do not ask how it come. It was just test I`ve made - reset to 0 the chip and with pulse signal copying car movement, add extra numbers.Then check, write down, check and so on. And the table is:

1 = E
2 = C
3 = A
4 = 8
5 = 6
6 = 4
7 = 2
8 = F
9 = D

Or as example:
- if you have 100km , then the HEX to write is: E1 00 01 00
- if you have 700km , then the HEX to write is: 21 00 01 00

Now - every first higher byte goes straight as second number in the CRC bytes

Example: B2 26 77 87 -> from 26, 2 goes close to B.
Example: E1 00 10 00 -> from 10, 1 goes close to E…. hope you get it. What is the last KM number on left goes second on CR bytes.
Now from where come the letter? You saw the table above, right?
Ok, you take the letter what is equal to that number what is max on left.
Examples:

POINT(A)
125 555km -> 12 55 55 -> 1 -> E
456 789km -> 45 67 89 -> 4 -> 8
083 200km -> 08 32 00 -> 8 -> F
999 999km -> 99 99 99 -> 9 -> D
000 012km -> 00 00 12 -> 1 -> E

That is the start point, now you need to sum all the rest but not the first one, or taking the upper ones:

POINT(B)
125 555km -> 1(we skip) -> 2+5+5+5+5 = 22
456 789km -> 4(we skip) -> 5+6+7+8+9 = 35
000 012km -> 1(we skip) -> 2 = 2

POINT(C)
Now write all 16 hex: 1 2 3 4 5 6 7 8 9 A B C D E F and the first table again:

HEX:E-C-A-8-6-4-2-F-D
DEC:1-2-3-4-5-6-7-8-9

Ok, the calculation(great thanks here for Coolman, who found the right calculation idea):
125 555km -> from (A) max left -> 1=> E , or “E” is your start point, and then count backward that many position what you sum, in that case we have: 22 - from (B).Key moment in counting is when you get to the left, start again… or:

HEX:-E>-D>-C>-B>-A>-9>-8>-7>-6>-5>-4>-3>-2>-1>-F>-E>D>-C>-B>-A>-9>-8>->7
POS:-*>-1>-2>-3>-4>-5>-6>-7>-8>-9>10>11>12>13>14>15>16>17>18>19>20>21>22

Your final HEX to write is: 71 12 55 55, lets make it again:
000 012km -> 1(we skip) -> 2 = 2 -> two moves from E backward
1 => E

HEX:-E>D>C
POS:-*>1>2

Your final HEX to write is:C1 00 00 12 , or can click here

Good luck

• Add a comment (3154 views)