Cluster Swap

[flash22]

Another little project - I was thinking of doing a cluster swap, as i have an intermittent fault with mine

The clusters are a plug and play swap with the 17 onwards with the mid are so much cleaner

 

Even tho the cluster is plug and play there are 3 issues

1. The mileage needs to be corrected

This one is fairly easy to overcome after a fair bit of digging i found the information required, The cluster needs to be read with a programmer luckily it uses the same board as the Auris/Rolla and Rav4, it uses a nor flash chip and is programmed via the Motorola/Fujitsu Processor (MB91F060BS) and needs direct connection to the pcb

This can not be done with Techstream as it requires access to Techdoc and security clearance with a Techdoc TARS username and password

2. The cluster is throwing a code for the PCS and LDA as the cluster is looking for the camera module

My car doesn't have TSS, so it needs to be disabled, it seems this can be done by changing the calibration file - Toyota do this via Techstream and requires a valid VIN, im hoping to find a CAL file or to modifying the bin/hex from the cluster.............. if i can

Found a TSB for the US trucks/4x4's  T-SB-0026-20

3. Audio controls (right side joystick)

2 options

1. swap the audio controls for the later type (i have a set i picked up dirt cheap) will have to swap the radio for full nav and hands-free support

2. mount these controls else where

 

 

[flash22]

A follow-up post

This may be a bit techy

After having a play and figuring what does what - the Mainflash (1MB) is the core software for the cluster and the Workflash contains the settings by pure accident i flashed a blank Workflash this defaulted the cluster but was unable to write the mileage

we now know the mileage is stored in the Workflash so if we compare a pair of files with different mileages we can see what changes are made to the binary with ExamDiff pro

we can now ignore any added, changed and removed data this should give us something to work with, the next step is to ignore any 00 or FF hex

either, i have to find a way to decompile the binary or just brute force it till i find the Switch/Key

 

To be continued..........................................

[flash22]

More babble.......................

Getting somewhere now, think the settings are held in the 4000 offset range just 96 lines of 16 hex blocks, so 1536 entries around 1/4-1/3 are changed or added - that leaves 1153 - 1013 entries untouched, i should be able to reduce that by removing the 00 entries

here's a sample

 

[Cyker]

Do you also wear shades, a black trenchcoat and are unusually gifted at martial arts...?  

Is that hexdump the encoded flashrom or decoded tho? I assumed the odo data was just stored as a plain number on the raw flash chip so I assumed you could just search for a number matching the odo value. I recall someone did that by attaching a SOIC8 clip to the flash chip and fudging the odo that way, although admittedly that was with a Ford, who don't tend to obfuscate their stuff as much as Toyota..

[flash22]

No not at all just poking at things and seeing what works

that is the raw binary, I can not find any software that will decompile FR (Fujitsu Risc) to machine code/programming code - standard clusters without a MID use a standard SOIC 8 you just use a calc to adjust the mileage algorithm

flash works in the same way but is stored in a 64KB Workflash

 

I have "corrected" a few locked BIOS's over the years, so it is very similar to that, it's not genius, just pure dumb luck 70% of the time

[flash22]

Yay, the PCS and LDA are now disabled after much modifying i couldn't pin it down to a few hexes so i replaced a section with FF fill (A000 - B820) mileage is correct, and it's still in Miles and MPG

I'm yet to test the full function in car yet, but it looks promising

 

 

TBC

[flash22]

The project is now complete, here are some pics of the process

Cluster with the bezel removed, you need to remove the needles (tape and mark the position) remove the 2 rings, then the face

Direct connection to read/write the flash (I now can do this over OBD2)

See above for the Flash reprogramming - now tested and working without the 2 errors and bleeping

 

To properly use the cluster you need the 2017 on, wheel controls

Original Controls

 

You need to remove the airbag (disconnect the Battery for 15-20 mins) find the hole in the bottom of the wheel, officially they say use a torx driver (single piece) all you need to do is release the post by pushing the spring (Flat blade as an example) remove the airbag by unplugging the orange connector (lift up the yellow lock tab first)

remove the 2 screws it's just held by clips otherwise - unplug the connector from the clockspring and un-route the cables

Swap the controls over. Replace the airbag

Wiring - you need to connect 2 wires from the 12 pin connector on the clockspring to the 28 pin in the cluster both connectors use the Sumitomo NH series terminals

12 pin           28 pin

   3          -       28

  12         -        18

 

 

I didn't realize  but my EPS hasn't been working correctly no warning or MIL just some buried codes in the power module (B2282 and B2283), but it does now 😀 Digital speed readout and Temp Gauge are nice to have too (only thing that doesn't work is the speed limit button due to it not being programmed into the ecu on the  < 2017 facelift cars

[stantheman1]

Clever stuff, well done Bob!

How was your power steering misbehaving, what were the symptoms and did you use Techstream to find the buried codes?

[Cyker]

Woo, that's pretty epic, especially as it works!!  

 

[flash22]

Well I thought the steering was a bit heavy at times, one of those codes is speed sensor related the EPS drops into a fail safe i have previously erased the codes, but it comes back due to an intermittent fault on the cluster

Yes I use Techstream and run a full health check that scans all systems, I also have an Autel maxidas among a few others

[flash22]

9 minutes ago, Cyker said:

Woo, that's pretty epic, especially as it works!!  

 

It was just a project, something different to do, Audio control are next on the list, but that's for another thread

[inteli7]

On 8/20/2021 at 4:40 PM, flash22 said:

Another little project - I was thinking of doing a cluster swap, as i have an intermittent fault with mine

The clusters are a plug and play swap with the 17 onwards with the mid are so much cleaner

 

Even tho the cluster is plug and play there are 3 issues

1. The mileage needs to be corrected

This one is fairly easy to overcome after a fair bit of digging i found the information required, The cluster needs to be read with a programmer luckily it uses the same board as the Auris/Rolla and Rav4, it uses a nor flash chip and is programmed via the Motorola/Fujitsu Processor (MB91F060BS) and needs direct connection to the pcb

This can not be done with Techstream as it requires access to Techdoc and security clearance with a Techdoc TARS username and password

2. The cluster is throwing a code for the PCS and LDA as the cluster is looking for the camera module

My car doesn't have TSS, so it needs to be disabled, it seems this can be done by changing the calibration file - Toyota do this via Techstream and requires a valid VIN, im hoping to find a CAL file or to modifying the bin/hex from the cluster.............. if i can

Found a TSB for the US trucks/4x4's  T-SB-0026-20

3. Audio controls (right side joystick)

2 options

1. swap the audio controls for the later type (i have a set i picked up dirt cheap) will have to swap the radio for full nav and hands-free support

2. mount these controls else where

 

 

Hello flash22,

I was looking into getting this done a while ago but was unsure if it was possible. Seems like it is, which is great!

What would that be if you were to put a price on all of this, including labour? I would love to do it on my 2014 Yaris Hybrid, and since you did it and went through the whole process, it will be so smooth.

Is this something that you would consider doing for others? How long did it take you to do it?

 

Thank you

[flash22]

Unfortunately, due to personal circumstances, I can not do the mod, it took me 5-6 hours the first time over a few days, and I have only done 2 others about an hour on the bench to read and program the flash, then correct the mileage, Plus 45 mins to fit and confirm calibration in the car

the hard bit was finding the relevant part in the binary file

[inteli7]

11 minutes ago, flash22 said:

Unfortunately, due to personal circumstances, I can not do the mod, it took me 5-6 hours the first time over a few days, and I have only done 2 others about an hour on the bench to read and program the flash, then correct the mileage, Plus 45 mins to fit and confirm calibration in the car

the hard bit was finding the relevant part in the binary file

No worries. Thank you for letting me know!

[Greg1986]

 

Sorry for off topic. I have 2017 Vitz from Japan that I would like to convert to English. What’s the easiest path to achieve this ? Changing entire dashboard to European or trying to re-flash current one ?

[flash22]

not 100% sure about this type of display have a look in the settings menu if it has a language setting

the kanji looks like this

 

[Greg1986]

My LCD is in colour but it doesn’t have this menu sadly. I asked the guy from NZ who is doing translation and got quoted anywhere from 500-1000$. Probably not worth it. 

[flash22]

only a few markets use that style of dash, swapping to a euro dash may be an option, most dashes are either in KPH or Miles only

[BFleming]

Some thread resurrection here! I have a 2016 Yaris Active 1.0 with the very basic instruments - speedometer only. I've been looking at the instruments from the Icon model, where you get the rev counter & fuel gauge either side of the central speedometer. The connectors on the back look identical to mine. So... plug & play?! I will be going for like years, so apart from the mileage, will it work?

 

[flash22]

yes it needs to be from a 1.0/1.3 tho, though you will also need the mileage corrected too

loads of part numbers depending on specs - 62 to be exact

 

I assume it's a base car with no pre-collision

 

can you PM me a VIN number