Group Actions
Engagement
  • Author Author: phoenixcomm
  • Date Created: Date Created
  • Views 1229 views
  • Likes 1 like
  • Comments 10 comments
Related
Recommended

NexGen: Hacking the Fuel Load Indicator.

phoenixcomm
Manufacture Part Number Miss
Parker Hannifin 219-100-001
Innovative Solutions 9D-00659-1 SW 7H-659-79419
Manufacture & Part Numbers
Table 1

imageI have had this Fuel Quantity Indicator  (Figure 1) for about 6 months or so. I have been stonewalled by ISI from getting any info. During Cockpit-Fest it was suggested that I cut the unit apart. Well, this unit is solder sealed and I don't have a fire ring.. So out came my Multi-Max (Figure 8) and put a metal blade on it.. well it took about an hour to get it apart and it's not pretty, but the job is done.

Well first by the numbers (see Table 1): Parker Hannifin made the unit. for Innovative Solutions got it and well good luck. In the bottom there is a PGA85 (Pin Grid Array) and I took off the label, and the part is a  5M-00497-1 which is a private label, and a date code of 9416.  More Work!

 

THE ANALYSIS: The unit consists of three (3) boards:

Part Numbers Description
8E-01117 Power Supply Board
8E-01082-18 Logic Board
8E-01081 Display Board
Part Numbers & Descriptions
Table 2
  • The back ie Power Supply (Figure 4): Has an LM-109 5vdc regulator + a bridge and some caps.
  • The middle ie Logic Board (Figure 5): Has a large EE??? part and a MAX690MJA microprocessor supervisor
  • The front ie the Display Board (Figure 6): Has two (2) HDSP-2131TXV  each display has 8 chars 5mm high of 5 x 7 chars each and has a 30 pin head connector.

If I can get the power supply board out of the housing I can tag in 5vdc from an external power supply to power up this unit... image

 

Keep Tuned In More To Come!! image

~~Cris H.

 

UPDATE:    informed me that IC manufactures sometimes put the part number in the silicon.... and he was right..

Our Mystery part is a Motorola MC68HC711  which is a MC68HC11 with a security feature..

 

image image
Fuel Repeater  / Indicator
Figure 1		 Fuel Repeater  / Indicator
Figure 2
image image
Front Half after the cut
Figure 3		 Rear Half after the cut
Figure 4
image image
Logic Card
Figure 5		 HP Smart Display Card
Figure 6
image image
Just Cut on the Line
Figure 7		 Dremel Multi-Max with Steel Blade
Figure 8
  • in reply to phoenixcomm

    Hi Cris,

     

    As far as I recall, the '7' signified a device with the main memory being EPROM (and an '8' would signify the main memory being EEPROM) but

    the '7' series also contained a small chunk of EEPROM too (for things like (say) config settings for the desired application).

    In some cases small programs could fit entirely in the EEPROM, whereas larger programs did need to fit in the EPROM on the 7 series.

     

    In this PDF datasheet doc page 55, it suggests that the security feature would only erase the EEPROM portion of the 7 series.

    So, you might be lucky and maybe nothing non-critical is stored in the EEPROM. On the other hand they may have stored some portion of the code

    in the EEPROM, and in that case you'd lose that.

     

    The above is only true if they have enabled the security feature when they programmed the device, i.e. they might not have since it is

    optional. Hard to know, but there is a reasonable possibility that they didn't lock it.

     

    If you're willing to risk losing the EEPROM contents, then the remainder EPROM can be read out, it entails writing a bootloader that will

    read the EPROM and pass the output over the UART so that you can log it.

     

    The bootloader could be custom, but it would entail studying HC11 machine instructions to create it. However, it happens that Motorola

    had a nice debug tool called PCBug11 (PDF user guide), which came with a bootloader, and the PC software would push it to the board

    over a serial port, and then use it to (say) display the EPROM contents. So, this could be a solution. However the software is

    ancient and probably needs MSDOS to run, and a PC with a built-in serial port possibly.

    However if you can obtain the PCBUG11 software (I'm sure there are copies on the Internet, it is likely in the public domain), then you could

    just use the bootloader portion possibly (this is guesswork however), and use some serial port software (maybe PuTTY) to push it to your board, and

    then press the keys that command the bootloader to dump out the EPROM contents (these commands will be documented in Motorola's user guide

    for PCBUG11, they were exceptional at documenting everything).

  • in reply to shabaz

    Shabaz the 687HC711 is the same design as the HC11 but with one difference! It has a security feature that when turned on:

    NOTE

    If the part is placed in bootstrap or expanded, the code in EEPROM and

    RAM will be erased and the microcontroller cannot be reused. The security

    software will constantly read the NOSEC bit and lock the part.

     

    so how can I dump the part any Ideas??

  • in reply to DAB

    Dab, I just called ISS and I spoke to a person in "Customer Service" he said:"The only information he has on the unit is the ATP, and its against policy to send out of the company".. but I asked him about the tri-ax connectors which I thought were 1553 but could not find the hardware upon opening the unit he confirmed they were inputs from the tank sensors (capacitive). At the end he said that he will send me the ATP..:)

  • in reply to DAB

    Dab no I found via shabaz to use microscope on the part and found the part number M68HC711 problem is that is 68HC11 but with security feature turned on.so you cant bring the chip up in most of the modes or it will erase itself!! I do have a "mad" plan though...

  • in reply to DAB

    Sadly quite a few companies have a hard time sharing information, they probably don't have mechanisms in place to get high-level (non-sensitive) engineering data to others : (

    It is maybe harder the older the product is, since people who know what is not sensitive and what is sensitive, have probably moved on.

    I had similar problems a week ago, trying to get just pinout information for a proprietary external connector/interface on a product (i.e. I wasn't even trying to look inside it).