Group Actions
Engagement
  • Author Author: phoenixcomm
  • Date Created: Date Created
  • Views 1584 views
  • Likes 2 likes
  • Comments 10 comments
Related
Recommended

NexGen: Hacking the Fuel Load Indicator.

phoenixcomm
Manufacture Part Number Miss
Parker Hannifin 219-100-001
Innovative Solutions 9D-00659-1 SW 7H-659-79419
Manufacture & Part Numbers
Table 1

imageI have had this Fuel Quantity Indicator  (Figure 1) for about 6 months or so. I have been stonewalled by ISI from getting any info. During Cockpit-Fest it was suggested that I cut the unit apart. Well, this unit is solder sealed and I don't have a fire ring.. So out came my Multi-Max (Figure 8) and put a metal blade on it.. well it took about an hour to get it apart and it's not pretty, but the job is done.

Well first by the numbers (see Table 1): Parker Hannifin made the unit. for Innovative Solutions got it and well good luck. In the bottom there is a PGA85 (Pin Grid Array) and I took off the label, and the part is a  5M-00497-1 which is a private label, and a date code of 9416.  More Work!

 

THE ANALYSIS: The unit consists of three (3) boards:

Part Numbers Description
8E-01117 Power Supply Board
8E-01082-18 Logic Board
8E-01081 Display Board
Part Numbers & Descriptions
Table 2
  • The back ie Power Supply (Figure 4): Has an LM-109 5vdc regulator + a bridge and some caps.
  • The middle ie Logic Board (Figure 5): Has a large EE??? part and a MAX690MJA microprocessor supervisor
  • The front ie the Display Board (Figure 6): Has two (2) HDSP-2131TXV  each display has 8 chars 5mm high of 5 x 7 chars each and has a 30 pin head connector.

If I can get the power supply board out of the housing I can tag in 5vdc from an external power supply to power up this unit... image

 

Keep Tuned In More To Come!! image

~~Cris H.

 

UPDATE:    informed me that IC manufactures sometimes put the part number in the silicon.... and he was right..

Our Mystery part is a Motorola MC68HC711  which is a MC68HC11 with a security feature..

 

image image
Fuel Repeater  / Indicator
Figure 1		 Fuel Repeater  / Indicator
Figure 2
image image
Front Half after the cut
Figure 3		 Rear Half after the cut
Figure 4
image image
Logic Card
Figure 5		 HP Smart Display Card
Figure 6
image image
Just Cut on the Line
Figure 7		 Dremel Multi-Max with Steel Blade
Figure 8
Parents

  • Hi Cris,

     

    I can't recall any microcontrollers in PGA format, probably because I guess it is an expensive package and in aviation maybe this is an extremely reliable package.

    Is there a PROM window on it, underneath the label? If so, a magnifying glass or microscope may reveal some information, since the manufacturer's name may be written on the silicon.

    Also I wonder what the yellow label (circle with three arrows pointing inward) means, it is in a couple of places in your photographs.

  • in reply to shabaz

    You where right!! MC68HC711 which is a MC68HC11

  • in reply to phoenixcomm

    Oh, awesome : )

    That's a nice microcontroller, it was among the first that didn't need any expensive programming tools, if you sent it

    a special character on start-up to it's uart, then it would accept a bootloader of your choice. Then the bootloader could be

    used to pull in the code to be programmed into the in-built memory. And the HC11 has a nice architecture and instruction set.

  • in reply to shabaz

    Shabaz the 687HC711 is the same design as the HC11 but with one difference! It has a security feature that when turned on:

    NOTE

    If the part is placed in bootstrap or expanded, the code in EEPROM and

    RAM will be erased and the microcontroller cannot be reused. The security

    software will constantly read the NOSEC bit and lock the part.

     

    so how can I dump the part any Ideas??

Comment
  • in reply to shabaz

    Shabaz the 687HC711 is the same design as the HC11 but with one difference! It has a security feature that when turned on:

    NOTE

    If the part is placed in bootstrap or expanded, the code in EEPROM and

    RAM will be erased and the microcontroller cannot be reused. The security

    software will constantly read the NOSEC bit and lock the part.

     

    so how can I dump the part any Ideas??

Children
  • in reply to phoenixcomm

    Hi Cris,

     

    As far as I recall, the '7' signified a device with the main memory being EPROM (and an '8' would signify the main memory being EEPROM) but

    the '7' series also contained a small chunk of EEPROM too (for things like (say) config settings for the desired application).

    In some cases small programs could fit entirely in the EEPROM, whereas larger programs did need to fit in the EPROM on the 7 series.

     

    In this PDF datasheet doc page 55, it suggests that the security feature would only erase the EEPROM portion of the 7 series.

    So, you might be lucky and maybe nothing non-critical is stored in the EEPROM. On the other hand they may have stored some portion of the code

    in the EEPROM, and in that case you'd lose that.

     

    The above is only true if they have enabled the security feature when they programmed the device, i.e. they might not have since it is

    optional. Hard to know, but there is a reasonable possibility that they didn't lock it.

     

    If you're willing to risk losing the EEPROM contents, then the remainder EPROM can be read out, it entails writing a bootloader that will

    read the EPROM and pass the output over the UART so that you can log it.

     

    The bootloader could be custom, but it would entail studying HC11 machine instructions to create it. However, it happens that Motorola

    had a nice debug tool called PCBug11 (PDF user guide), which came with a bootloader, and the PC software would push it to the board

    over a serial port, and then use it to (say) display the EPROM contents. So, this could be a solution. However the software is

    ancient and probably needs MSDOS to run, and a PC with a built-in serial port possibly.

    However if you can obtain the PCBUG11 software (I'm sure there are copies on the Internet, it is likely in the public domain), then you could

    just use the bootloader portion possibly (this is guesswork however), and use some serial port software (maybe PuTTY) to push it to your board, and

    then press the keys that command the bootloader to dump out the EPROM contents (these commands will be documented in Motorola's user guide

    for PCBUG11, they were exceptional at documenting everything).