Help with MC68HC908AZ60 2J74Y chip please.

Maybe. "A security feature discourages unauthorized reading of FLASH locations while in monitor mode. The host can bypass the security feature at monitor mode entry by sending eight security bytes that match the bytes at locations $FFF6?$FFFD. Locations $FFF6?$FFFD contain user-defined data."

Some links that you found during your trawling may help clarify, but I'd normally bet against the uC itself as being the source of the problems, especially if it's otherwise operating properly once everything warms up. Could be temperature drift of the oscillator. May be from a low-voltage reset, or something as simple as a bad solder joint.

Lots of hits on "MC68HC908 programmer."

--
Rich Webb     Norfolk, VA

Hi, Thanks for your reply.

Apparently this chip is used in a lot of vehicle instrument clusters & seems to cause a lot of problems. In the article that I found where this chip was identified as the culprit the guy testing his cluster was quite experienced with electronics & stated that he was 100% sure that this was the cause of the problem.

You can read the article here, its the first post...

ola+dashpod

If you look at page 3 of the thread you will see a reply from the manufacturer of the chip (Freescale Semiconductors) explaining what the problem could be....no doubt you will make more sense of it than me.

Regards.

From the linked discussion, it does seem that a "weak bit" leading to an illegal instruction/address fault or infinite loop and subsequent COP reset might be causing the problems. The chip's manual does have rather a lot of warnings about using just the right programming algorithm -- not too much, not too little -- and that there is (was) a newer generation of flash in the pipeline.

I'm not an HC08 jock, so you may also ask in comp.arch.embedded for opinions, but it should be possible to at least try getting into monitor mode (i.e., activate the chip's firmware serial monitor program). Then IF the security bytes are unprogrammed it should be possible to read out the contents.

--
Rich Webb     Norfolk, VA

Before risking the chip to an unsure reading process, I would check that the reset circuit is not sending multiple pulses to the chip. The reset is responsible for setting the digital stuff to the same sync point and initialize the startup values... If it's sending multiple pulses, it can cause similar problems. Sometimes the reset is simply a single small chip or Transistor-resistor-Capacitor-cmos gate arrangement. A good logic probe or O-scope should help.

Cars power systems are very harsh... so there would mostlikely be a voltage regulator for that chip somewhere near it. I would check that those parts haven't degraded.. Flakey regulator, clamping diodes, capacitors can cause noise on the PS lines. A Fast needle meter or O-scope should help here.

--

--------------------------------- --- -- - Posted with NewsLeecher v3.8 Final Web @

------------------- ----- ---- -- -

ge

rts

e noise

Hi, Thanks for your help....here's a few pictures of the circuit board...can you see / direct me to any of the components you mention.

Regards.

noise

Get out your magnifying glass and look for cracked solder joints. Then, with component coolant spray, after the board has heated up to the working stage. Spray little area's to seek a failure spot..

Beyond that with your apparent skill set, I think you should pass it on to some one else if you really want that board repaired. Other wise, simply buy a new board.

Sorry if that wasn't the answer you were seeking for.

"

e

tage

parts

use noise

it

Thanks for that...

I did warn you that I was Dangerously under qualified for this project...LOL

The guy in this thread done exactly what you suggested & found the failure point to be the MC68HC908AZ60

Thanks.

ng

t

ate

oltage

e parts

cause noise

s it

...

Anyone know where I would be able to buy a new MC68HC908AZ60 2J74Y chip from...don't seem to be able to find one anywhere?

Thanks.

This document

seems to imply that the "2J74Y" specifies a particular mask applied to a more general purpose part. They may no longer be available.

--
Rich Webb     Norfolk, VA

Do you have the software to program it & a programer a MC68HC908AZ60?

2J74Y is the production date code, not part of the part number. I have programed these, a long time ago. You need to download and read the Motorola book on the MC68HC908AZ60 before trying to replace it. The only place you would find a programed, drop in replacment would be frpm the OEM of that PC board, or an identical board. The book is 480 pages. The MC68HC908AZ60 is not a simple MPU chip:

Features of the MC68HC908AZ60 include: ? High-Performance M68HC08 Architecture ? Fully Upward-Compatible Object Code with M6805, M146805, and M68HC05 Families ? 8.4 MHz Internal Bus Frequency ? 60 Kbytes of FLASH Electrically Erasable Read-Only Memory (FLASH) ? FLASH Data Security ? 1 Kbyte of On-Chip Electrically Erasable Programmable Read-Only Memory with Security Option (EEPROM) ? 2 Kbyte of On-Chip RAM ? Clock Generator Module (CGM) ? Serial Peripheral Interface Module (SPI) ? Serial Communications Interface Module (SCI) ? 8-Bit, 15-Channel Analog-to-Digital Converter (ADC-15) ? 16-Bit, 6-Channel Timer Interface Module (TIMA-6) ? Programmable Interrupt Timer (PIT) ? System Protection Features ? Computer Operating Properly (COP) with Optional Reset ? Low-Voltage Detection with Optional Reset ? Illegal Opcode Detection with Optional Reset ? Illegal Address Detection with Optional Reset ? Low-Power Design (Fully Static with Stop and Wait Modes) ? Master Reset Pin and Power-On Reset ? 16-Bit, 2-Channel Timer Interface Module (TIMB) ? 5-Bit Keyboard Interrupt Module ? MSCAN Controller (Motorola Scalable CAN) implements CAN

2.0b Protocol as Defined in BOSCH Specification September 1991

Features of the CPU08 include:

? Enhanced HC05 Programming Model ? Extensive Loop Control Functions ? 16 Addressing Modes (Eight More Than the HC05) ? 16-Bit Index Register and Stack Pointer ? Memory-to-Memory Data Transfers ? Fast 8´8 Multiply Instruction ? Fast 16/8 Divide Instruction ? Binary-Coded Decimal (BCD) Instructions ? Optimization for Controller Applications ? C Language Support

which is a 3,920,559 byte file.

--
http://improve-usenet.org/index.html

aioe.org, Goggle Groups, and Web TV users must request to be white
listed, or I will not see your messages.

If you have broadband, your ISP may have a NNTP news server included in
your account: http://www.usenettools.net/ISP.htm


There are two kinds of people on this earth:
The crazy, and the insane.
The first sign of insanity is denying that you\'re crazy.

60? . y

No I haven't a programmer for this chip....I was hoping maybe one of you guys would have & maybe you fancy a challange....LOL

From what I have read it's not the chip that's faulty, it's the way it has been programmed.....have a read of this....

"it's the Motorola MC68HC908AZ60 and the chip was never faulty as such

- it was the way it was programmed. I think Magnetti Marelli are being confused for Marconi here but the actual chip was made by Motorola (now called Freescale Semiconductor)

The Motorola chip a FLASH device that stores programme code in on-chip non-volatile memory which is electrically programmed in production. The code is stored in the form of electrical charge in the memory cells. If the timings used in signalling to the processor are incorrect (like if it's done in a rush), then weak charge storage is the result. This can cause the memory cells to be misread when the chip is cold and as time goes by, the problem gets worse and more frequent, with perhaps two or three years of functionality before the problem gets so bad that the car is rendered immobile.

The areas affected are various but can cause:

• "dancing needles" - where the processor continually attempts to restart without success until it warms up a little.

• Fuel, temperature and other gauge calibration issues - where even attempts to re-calibrate the cal number stored in memory fail to have an effect, suggesting that the programme is reading another memory location in error due to the corruption.

• LCD image corruption - a strange artifact in a background bitmap image was seen to change size and shape with time and temperature - a rare glimpse of the corruption in action - presumably the area of code where the bitmaps are stored.

There is no telling in which areas of code that the corruption starts.

Not all dashpod problems are down to this chip, but many were. Reprogramming the chip correctly should cure it"

Regards.

So it is temparature related. This is however often due to soldering problems. Check all solderjoints with a magnifying glass first. And then check what the power supply does during power up, and the rest of the reset and data lines, with an oscilloscope. It can also be the PCB itself.

I advise against this. Too early in your search.

The problem only seems to exists at a certain temperature. What you can do is use a freezing spray. And carefully cool down parts of the pcb. This will lead you to the cause of the problems.

Do not spray too much, you do not want condensed weater on the pcb, only cool it down a little. Start with the bad chip.

Success, P.

Hi, The solder joints have all been checked & re-flowed just to make sure!

The chip has already been identified as causing the problem using the method you describe....read the first post of this thread.... & the first post on page 3

The problem with my instruments only seems to happen when the temperature is below 9 degrees C

It would appear that it is possible to read the chip.....Read this.....

Maybe this company can supply me a chip with the correct mileage in Miles & not km's.

From what I have read about this problem it seems that the chip has originally been programmed out of spec...whatever that means....if the chip is read at room temperature & them reprogrammed with the same dump apparently it has a very good chance of fixing the problem.

Cheers.

So have none of you out there reading this got a programmer or anything that would read this chip ?

In message , snipped-for-privacy@hotmail.com writes

I would suspect that whatever security devices were built into the chip by Motorola will have been enabled when the device was programmed by whoever built the dashboard originally to prevent people reading the code out.

It's highly likely that the mileage is stored in the EEPROM area of the chip, not the main program flash and the companies that offer 'mileage correction' are just reading and altering that area, having nothing to do with program code.

As for the fault you have, it's more likely that whatever supply voltage is used for your device has become marginal or the clock oscillator has changed enough that the device can't start at lower temperatures, possibly a combination of the two. If the device is mounted on a flexible membrane then I'd suggest cracked tracks as another possiblity.

It's unlikely (but not impossible) that the device is faulty.

--
Clint Sharp

programmer or

Hi, Clint if you look at post #6 in this thread you can see 2 links to pictures of the chip on the circuit board.

Yeah I believe the mileage is stored in the EEPROM area of the chip.

Regards.

Found this....

Reading through the programmers user guide (PDF) it appears that the protection code on the chip can be bypassed so that you can read it...or that's how I read it...what do you think?

Cheers.

Well, there are 8 bytes that make up the security code. A brute force approach has to contend with 2^64 possible combinations. The ROM monitor that accepts (or not) the security bytes communicates at up to 28.8 KBaud. Each byte is echoed back, so the effective max rate is 14.4 KB. With 2^64 combinations, and 8*(1+8+1) bits per combination (send 8 bytes with start & stop bits, look for a break char, if not seen then reset and try again), a worst-case condition would require 80*2^64/14400 seconds, or 102.5E15 seconds or about 1.2E12 days, not counting reset time or testing for a break condition. If the expected value is half of that, it's about 1.6E9 years.

At least, that's how I read the datasheet.

--
Rich Webb     Norfolk, VA