# Dashpod Repairs - An Investigation



## jackott (Nov 28, 2005)

Hi,

You may or may not remember my recent thread regarding fixing of dashpods. A few days after my posting my dashpod failed in the same way again..... hence the delay in a reply
Since then i have spent a good deal of time with my dashpod in the lab, and would like to report my findings in a hopefully non too technical manner.
My dashpod fails with flickering dials and lamps when cold, along with clock reset to 1997 etc this is a common fault that gets worse until complete pod failure and imobiliser problems ensue.

My background involves 18 years of automotive electronic design and i have worked with Magnetti Marelli (say no more!) in the past and have been employed by a Formula One team as an electronics designer for 6 Years.

Anyway back to the pod.......

I stripped my pod yet again and inspected the quality of the circuit board manufacturing under a microscope
, this appeared to be quite good with no indications of solder problems (dry joints etc).
I then traced the exact componant responsible for the failures by powering up the pod on the bench and applying an electronics grade freezer spray to all componants in turn until.....BINGO.
When i found the culprit i repeated the above many times over a period of days and the only thing that would cause the pod to fail was a couple of drops of freezer spray to the body of the culprit.
I am 100% happy that the chip that is causing the failure is the Motorola MC68HC908AZ60 chip. After looking at the signals to and from the chip i could see that this chip is responsible for driving all gauges, dials and lamps, and when cold the running software keeps continuously resetting the chip (hence the flickering).
The cost of the chip is about Â£10 but unfortunately requires programming by Magnetti Marelli, as the code is read protected.
Conclusions:-

1) After complete stripdown, the pod still works (on a warm day!!).
2) The problem is a definate design fault and could possibly be solved with just a reprogram and or a new chip
at a very low cost. If i had the code i could replace the chip in about 15mins.
3) The build quality of the Dashpod appears quite good (suprisingly).
4) I am planning letters to both Marelli and Audi stating the above.

Any comments people???


----------



## J55TTC (Apr 25, 2005)

This news couldnt have come at a more convenient time if you tried.

Well done with your investigation, I for one am impressed!

Lets hope this helps with convincing Audi to put things right once and for all.


----------



## Rogue (Jun 15, 2003)

Well done on coming up with the answer to a problem that VAG and their millions of euros can't (or won't!) fix!
I can't believe I had to splash out Â£500+ for a new dash when it was a Â£10 part that was at fault!

As J55TTC mentioned, your findings couldn't have come at a better time.
You might even get on Watchdog 

Again, well done for solving the problem and thanks for sharing it with us.
It made a very interesting read. 8)

Rogue


----------



## petesky (Jul 24, 2002)

Up until recently I was a senior software engineer for Motorola in the automotive field (I briefly dealt with Magnetti Marelli).

It sounds like the software is not servicing the processor watchdog when the temperature is low. This is most likely caused by the embedded code either entering an infinite loop (in which case the watchdog trigger is correct and there is a valid issue) or that a parameter is not being updated quickly enough which is causing the processor to time out. 
As the dashpod issue seems to appear mostly after being installed after a long time e.g. a couple fo years) it looks like there is some "drift" in the circuitry which may be causing the software to go out of spec and reset.

Do you beleive this to be the case also JackoTT?

A new chip/circuit in this case would solve the issue only until the problem manifests itself in the "new" circuit.

In other words *unless the problem is solved by the engineers responsible* then this issue is likely to repeat even on replacement dashpod's.

The root cause needs to be determined as to whether a sub-circuit or message (from another module) within the car is malfunctioning causing the dashpod to reset or that the software is triggering the reset too early.

Petesky.


----------



## Chip_iTT (Nov 14, 2003)

jackott said:


> Hi,
> 
> You may or may not remember my recent thread regarding fixing of dashpods. A few days after my posting my dashpod failed in the same way again..... hence the delay in a reply
> Since then i have spent a good deal of time with my dashpod in the lab, and would like to report my findings in a hopefully non too technical manner.
> ...


While I applaud your work I would like to add a note of caution... what you have demonstrated is a repeatable failure mechanism for your pod, but this doesn't mean this is the only failure mechanism that would cause this problem or others of a similar nature... certainly the other failed pods i have looked at suggest that power supply regulation or xtal oscillator stability have similar side-effects and are not all temperature related. and then there is the whole class of pods that work OK but one or more instruments don't behave... these faults have been shown to be both mechanical and electrical in nature.

As you say, you would probably find that a re-flashing of the chip using the in-circuit programming connector on the back of the pod (I'm fairly sure thats what the 4 pin conector is for) could resolve the issue. Replacing the chip is, even with the right tools, a relatively non-trivial and time-consuming exercise, so we have to be careful not to over-simplify the repair cost. It's probably more like Â£150 but at that cost you'd probably just throw the circuit board away and replace it... even so, I agree its hard to justify the Â£600+ that Audi charge for a replacement pod.

What IS important tho is the demonstration that the failure of a relatively cheap component results in a disproportionatelty high cost to fix... because of the 'single unit' approach.


----------



## John-H (Jul 13, 2005)

Well done for tracing that Jackott. I'm not familiar with the chip but the data sheet indicates it's a little quirky to programme. I wonder if there is an issue there? Later devices were apparently going to be improved.

I'm slightly surprised this mass production item is not masked but being a FLASH device it would allow for upgrading - is there a socket nearby?

It's a 64 pin QFP package so not too dificult to remove intact and unbent. How about doing this then using it as master and making a copy on a programmer. You might need to keep your finger on it to keep it warm :wink:

Either that or a make little local heater :lol:


----------



## John-H (Jul 13, 2005)

petesky said:


> Up until recently I was a senior software engineer for Motorola in the automotive field (I briefly dealt with Magnetti Marelli).
> 
> It sounds like the software is not servicing the processor watchdog when the temperature is low. This is most likely caused by the embedded code either entering an infinite loop (in which case the watchdog trigger is correct and there is a valid issue) or that a parameter is not being updated quickly enough which is causing the processor to time out.
> As the dashpod issue seems to appear mostly after being installed after a long time e.g. a couple fo years) it looks like there is some "drift" in the circuitry which may be causing the software to go out of spec and reset.
> ...


Good comment. I wonder if there would be anything forthcoming from Motorola or Freescale Semiconductor, or whatever they're calling themselves these days, technical support?


----------



## Chip_iTT (Nov 14, 2003)

John-H said:


> Well done for tracing that Jackott. I'm not familiar with the chip but the data sheet indicates it's a little quirky to programme. I wonder if there is an issue there? Later devices were apparently going to be improved.
> 
> I'm slightly surprised this mass production item is not masked but being a FLASH device it would allow for upgrading - is there a socket nearby?
> 
> ...


John, In keeping with most MCU these days all Motorola (now Freescale) parts have a security bit that prevents the code being read externally... you can erase and reprogram the part but you can't read it once the security bit is set... the normal process would be to program and verify it, then set the security bit to protect it.


----------



## Rhod_TT (May 7, 2002)

Did anyone else feel like that all just went clean over thier head?

Chaps. I'm seriously impressed. Keep up the good work.


----------



## John-H (Jul 13, 2005)

Chip_iTT said:


> John-H said:
> 
> 
> > Well done for tracing that Jackott. I'm not familiar with the chip but the data sheet indicates it's a little quirky to programme. I wonder if there is an issue there? Later devices were apparently going to be improved.
> ...


Hi Irving,

Being mainly analogue the last programmable microcontroller I got to grips with was the H8 family and I don't remember there being any security - or if there was the softies never bothered setting it. There is a chance it's not set or if set the user key data is all zero or FFFF etc. in which case you'd be able to read it. Might be worth a try.


----------



## tim225tt (Sep 25, 2005)

> Did anyone else feel like that all just went clean over thier head?
> 
> Chaps. I'm seriously impressed. Keep up the good work.


yes i did and yeah keep up the good work lads


----------



## aidb (Mar 19, 2003)

Me noggin' hurts with all this technical too and fro. [smiley=freak.gif] :wink:

Excellent work chaps. 

I wonder why all dashpods aren't affected this way. 
What's the trigger that sets the various faults up?


----------



## Rogue (Jun 15, 2003)

aidb said:


> Me noggin' hurts with all this technical too and fro. [smiley=freak.gif] :wink:
> 
> Excellent work chaps.
> 
> ...


Warranty expiration :wink: 

Rogue


----------



## KenTT (Feb 20, 2005)

aidb said:


> Me noggin' hurts with all this technical too and fro. [smiley=freak.gif] :wink:
> 
> Excellent work chaps.
> 
> ...


There are many things that could Accelerate the failure of the dashpod, from is the car parked outside as opposed to in a garage. Also some seem to start exhibiting problems after main battery problems. Also not all the faults will be down to the same component.


----------



## Loz180 (Sep 20, 2004)

sensing light at the end of the tunnel..


----------



## petesky (Jul 24, 2002)

John-H said:


> Well done for tracing that Jackott. I'm not familiar with the chip but the data sheet indicates it's a little quirky to programme. I wonder if there is an issue there? Later devices were apparently going to be improved.
> 
> I'm slightly surprised this mass production item is not masked but being a FLASH device it would allow for upgrading - is there a socket nearby?
> 
> ...


Is it worth trying to short pin 3 of the [64 pin QFP] processor's RST to high voltage as this will disable the COP assert from internal means?
It obviously won't stop another device attempting the reset by asserting the reset line, in which case it isn't the processor which is causing the issue and it's the other device. 
I haven't looked at the circuit to see what's there so I can't say.

A warning though.....

Shorting the RST may also screw the module completely if flash/eeprom or something else is causing the reset as an illegal address was accessed!

It would be inetersting to get a debugger on it but oh well.

Peter


----------



## KenTT (Feb 20, 2005)

petesky said:


> John-H said:
> 
> 
> > Well done for tracing that Jackott. I'm not familiar with the chip but the data sheet indicates it's a little quirky to programme. I wonder if there is an issue there? Later devices were apparently going to be improved.
> ...


But if Jack has as he said, frozen very carefully just that chip and the fault alters state, then surely in his case the fault is with that CPU. :?:


----------



## John-H (Jul 13, 2005)

petesky said:


> John-H said:
> 
> 
> > Well done for tracing that Jackott. I'm not familiar with the chip but the data sheet indicates it's a little quirky to programme. I wonder if there is an issue there? Later devices were apparently going to be improved.
> ...


Good point that it may be internal or external reset so some doubt as the processor being at fault as such - although it does fall over with cold and should work down to -40 deg C. How about lifting the RST pin, pulling high through a 10k resistor and monitoring it on a scope? You could monitor the pad too.

As this appears to be used as a display driver only and not for imobiliser security etc. are we sure they would have bothered setting any security bit? It still may still be possible to read the code. I don't think the internal FLASH would be corrupting when cold because it would stay corrupted if the charge were lost from a cell. More likely some sort of level or timing issue affected by cold. How's the clock looking?

I had a look on the Motorola knowedge base but can't see anything.

Has anyone got a circuit diagram???


----------



## jampott (Sep 6, 2003)

Loz180 said:


> sensing light at the end of the tunnel..


Unless you have a faulty light sensor, of course... :lol:


----------



## jackott (Nov 28, 2005)

Hi Gents,

I have tried lifting the RST pin from the micro and pulling it up to +5 in order to determine the source of the resets (by isolating any external influences) and can confirm that the resets were still ocuring from within the micro!


----------



## John-H (Jul 13, 2005)

jackott said:


> Hi Gents,
> 
> I have tried lifting the RST pin from the micro and pulling it up to +5 in order to determine the source of the resets (by isolating any external influences) and can confirm that the resets were still ocuring from within the micro!


Excellent. As PeteSky suggests clamping it high may force it to work or it may just crash if there was a good reason for the watchdog tripping.

Any thoughts as to whether the code is protected or not?


----------



## petesky (Jul 24, 2002)

jackott said:


> Hi Gents,
> 
> I have tried lifting the RST pin from the micro and pulling it up to +5 in order to determine the source of the resets (by isolating any external influences) and can confirm that the resets were still ocuring from within the micro!


I know I sound like a dictator but while the RST pin is held high then can you confirm that the supply voltage doesn't "dip" at any point.
I believe everything else which could cause a reset will be related to either CAN messages or our beloved dashpod's application code - neither of which we are able to change!

One final test would be if we could (as someone originally suggested) read the contents of NVM from the microcontroller store them and re-program a new device. If that worked then it sounds like an application software issue or faulty microcontrollers.

Petesky.


----------



## John-H (Jul 13, 2005)

I've sent a service request through to Freescale Semi to see if they have recorded any issues relating to temperature and resetting. I don't expect a speedy response - but you never know.

If the security feature is enabled it will be possible to bypass as it's not strong - although it may take a while :wink: .


----------



## gt russell (Nov 27, 2005)

well done very impresive stuff but heres a thought , BBA REMAN do repair them also so is it worth contacting them to see if they are getting the same chip to fix. Or would they probably not say because they would lose buisness , after all they are charging Â£250 for a repair. Anyway this is getting close it sounds to getting a perminant fix. Well done lads :wink:


----------



## Chip_iTT (Nov 14, 2003)

John-H said:


> I've sent a service request through to Freescale Semi to see if they have recorded any issues relating to temperature and resetting. I don't expect a speedy response - but you never know.
> 
> If the security feature is enabled it will be possible to bypass as it's not strong - although it may take a while :wink: .


Why do u say that John? It looks pretty strong to me... 4 16bit numbers which have to be matched in sequence... thats 2 ^ 16 ^ 4 possible combos which is something like >500,000 years at 1,000,000 attempts a second...


----------



## John-H (Jul 13, 2005)

Chip_iTT said:


> John-H said:
> 
> 
> > I've sent a service request through to Freescale Semi to see if they have recorded any issues relating to temperature and resetting. I don't expect a speedy response - but you never know.
> ...


We'll see which comes first, the support or the crack :lol:


----------



## Loz180 (Sep 20, 2004)

I think I am going to sit in the garage and polish my flux capacitor... :?


----------



## Chip_iTT (Nov 14, 2003)

John-H said:


> Chip_iTT said:
> 
> 
> > John-H said:
> ...


Yeh, you're right there :?


----------



## jampott (Sep 6, 2003)

Chip_iTT said:


> John-H said:
> 
> 
> > I've sent a service request through to Freescale Semi to see if they have recorded any issues relating to temperature and resetting. I don't expect a speedy response - but you never know.
> ...


What a pessimist, Irving...

You don't have to test ALL the combinations - just stop when you get to the one that works. Chances are it'll be in the first couple tried, so will only take about 10 minutes. :lol:


----------



## Chip_iTT (Nov 14, 2003)

jampott said:


> Chip_iTT said:
> 
> 
> > John-H said:
> ...


Now thats just being optimistic!


----------



## John-H (Jul 13, 2005)

Well I'm impressed. Here's the response from Freescale Semi:



> Thank you for your interest in Freescale Semiconductors and for the
> opportunity to serve you.
> 
> In reply to your Service Request:
> ...


So, no device quality problems being admitted to but an implication that the device programming may have been done out of spec. I thought it looked a bit quirkey (exacting). Reading some apps notes, it's possible to optimise (rush) the programming cycle and think you've got away with it - but weak gate charge retention can result which can cause premature failure after a couple of years or so.


----------



## John-H (Jul 13, 2005)

JackoTT,

Did you manage to fix it in the end???

If not, I don't know if you've seen some recent posts... Audi are now replacing all faulty dashpods in UK registered TTs, regardless of age, free of charge. The less than 5 year rule has been dropped!  apparently.

Of course I would prefer to hear details of how you managed to heroically fix it :wink: That would be more interesting :lol:


----------



## Chip_iTT (Nov 14, 2003)

John,

i think the work JackoTT did, and the reply you got from FreeScale, supports the previously suggested problem for the earlier pods of poor programming. This was supposedly affecting a few batches of pods in the late 1999-2002 timeframe and the jumping needles issue hasn't IIRC been seen on later pods. Clearly there is sufficient information here to suggest a possible failure mechanism. However, as I have said on several occasions before this isn't the only failure mechanism. Indeed there are several distinct types of failure not all of which would be the result of faulty programming, but are failures of the voltage regulation, the mechanics of the gauges and circuit board track failures.

The issue is, and has always been, the fact that even a small problem renders a Â£700 piece of kit usless and cannot be resolved in isolation. Hence Audi's eventual acceptance of the need to replace them whatever the issue.


----------



## John-H (Jul 13, 2005)

Irving,

Yes it did seem as though the programming write timings were too short resulting in weak charge storage - it fits with the evidence. It would have been nice to find out what happened on this one. Did JackoTT fix it?

I agree there are other failure modes and your point about them potentially rendering the pod and car useless. Looks like Audi have indeed eventually done the decent thing and agreed to cover the entire issue. Well done to all concerned in fighting for a fair solution.


----------



## davidoff_ (Apr 11, 2006)

hi. iÂ´m from portugal and i follow this forum since sometime ago. I have a 99 TT 180bhp and iÂ´m having some problems with my dashpod. it happened as someone said before, after a problem in the main battery. the lights of the middle are working but no reading. neither miles or rpm. Since here in Portugal Audi doesnÂ´t assume responsabilities for the problem i would like to know if its possible to be repaired or i do have to buy a new one. Thanks for the help and i hope to participate more, hopefully about happier issues :? 
(PS: sorry my bad english  )


----------



## John-H (Jul 13, 2005)

Hi davidoff_ and welcome.

You might find this company of use as they advertise their ability to fix dashpods! Pitty Audi don't cover free fixing in Portugal.

http://www.bba-reman.com/content.aspx?c ... rd_failing

Might be worth giving them a ring and sorting something out. Good luck.


----------



## davidoff_ (Apr 11, 2006)

thanks for the tip...but there is a problem...if i buy their dashpod how can i put it in my car if i donÂ´t have the codes? I could get one from a crashed TT also...but no codes... :?


----------



## John-H (Jul 13, 2005)

Give them a ring - I presume they fix your old one so no codes required. It would mean you'd be without use of the car for a while though.


----------



## Tel boy (Dec 19, 2008)

Hi,
I stumbled upon this thread whilst searching on Google & found it very interesting given that I'm suffering very similar problems with my instrument cluster so thought I would resurrect it.

Did anyone ever go as far as replacing the MC68HC908AZ60 chip or try reprogramming it?

Thanks.

Regards.


----------



## John-H (Jul 13, 2005)

JackoTT got nearest but I think his efforts were suddenly overtaken by Audi announcing the free replacement scheme, so I doubt anyone did this in the end. The repair service advertised by BBA Reman may replace the processor but as it's encrypted code they would have needed to find a way of defeating the security or possibly getting it under licence. You'd need to get your keys adapted into the dashpod too by Audi - again that's all due to the security issue.


----------



## Tel boy (Dec 19, 2008)

Thanks for your reply John,

I'm afraid the car I'm having the problems on isn't an Audi TT....it's a Renault Laguna ...I should have mentioned this 

The instrument pod on the Laguna use the same chip & hence there seems to be lots of similar problems with them, unfortunately Renault have not had the commitment of Audi & offered free replacements.

The pod can be fixed by BBA but being a cheapskate & having a thirst for knowledge I would have liked to explore the possibilities of fixing the problem myself...with the help of someone that knows what they are doing 

Cheers.


----------



## jdmccarthy (Oct 27, 2009)

Hey Guys , this is my first post but I have been leaching infromation from this site for the past 5 years. Now its my turn to contribute (hopefully)

So my cluster started acting up a couple of weeks ago:





The cluster has in the meantime died completely and the car no longer starts. I suspected the ECU initially as I could no longer talk to it via the ODBII , but I found a post that suggested the commuication to the ECU is dependand on the cluster> You can however bypass that by bridging pin 5 and 28 on the green connector on the back of the cluster. After doing that I could talk to the ECU again and verify that the IMO is blocking the start.

I soon found that its a common problem and after havving Audi tell me that a replacement cluster is $2000 I decided to once again bypass them and see if I can fix it myself.

I found this post and I am planning to replace the microcontroller (ordered from http://www.codecard.lt/ preprogrammed)

I have just received it so I am planning to replace it tonnight. Any ideas/guidance?

(I have done surface mount replacements before and I am IT Systems Engineer who has "tinkered" with allot on my 2001 Audi TT 2001 MK1)


----------



## Pepperami (May 1, 2012)

Nice first post :mrgreen:

NO advice I haven't reprogrammed anything apart from eproms during my old Set top box days lol

Good luck with it, if your able to successfully fix the fault and are able to program the new chips, Im sure people here would pay for the service


----------



## kazinak (Mar 23, 2010)

it's friday  

Change the whole car , they only around £100 anyway

Send from my Android using Tapatalk 2


----------



## John-H (Jul 13, 2005)

This is the one I believe:

http://www.codecard.lt/electronic/car-e ... d_127.html


----------



## jdmccarthy (Oct 27, 2009)

Thats the one I got , sent them the millage etc so apparantly all you need to do is swop it out. I have to give these guys allot of credit. The dispatched it the same day i payed for it and i received it 2 days later. I will be documentating the replacement with pictures and will upload it on monday. If you dont hear from me I failed and pushed the car into a nearby lake  Like Kazinak say its only a $100 for a new one  if only that was true I would have a fleet of them.


----------



## 2074 (Jul 17, 2012)

A month has passed....I guess it did'nt end well?


----------

