# Anyone want a REAL challenge?

#### f150john

Joined Mar 28, 2020
3
The challenge is not necessarily related to circuitry as much as it is related to dealing with me. In other words, your expertise will be tested by my ignorance on all things technical. For all I know, what follows is the dumbest thing anyone has ever heard, but I'm willing to try.

BACKSTORY YOU CAN SKIP = I'm an English teacher with absolutely no knowledge of circuits, but I enjoy figuring things out. Back in January my 2000 F-150 would not start. I always fix my own cars, so I traced the problem to no fuel injector pulse. I traced it even deeper to a malfunction on my instrument cluster, which houses an immobilizer chip. I know the PCB on my old instrument cluster is bad, so I got one from the junkyard. Now the truck will not start because the immobilizer data inside doesn't match the key/pcm. When I asked for info in an F-150 discussion forum, everyone insisted that only a dealer could solve the problem. I just can't accept that. Why should a dealer get to have all the fun when I'm willing to learn something new?

CHALLENGE = I have a 2000 F150 instrument cluster with a damaged PCB. I need help identifying the EEPROM chip that holds the immobilizer data so that I can remove that chip and reattach it to a new PCB. Below are pictures of the chips on the PCB. Which chip do you think holds the immobilizer data?

#### Papabravo

Joined Feb 24, 2006
13,560
Ford, as a matter of corporate policy does not want you do what you could do in a prior era when things were mechanical, repairable, and understandable. In short they are limiting the publicly available information, they are restricting the supply of spare parts and tools, and in general making it as difficult as they possibly can to repair your vehicle. You may think that you own your vehicle, but in reality, you do not. They own the firmware that runs the chips and there ain't squat you can do about it. Crack your nut on this problem if you want, but don't expect any kind of rapid progress. If you think your situation is unfair, you should listen to the farmer's who purchased John Deere tractors and combines. What those dealers charge is akin to highway robbery.

https://www.wired.com/story/john-deere-farmers-right-to-repair/

In short I don't think your question is dumb, and you may have been struck dumb, by my answer, but keep looking around and see if I have given you the straight story.

Rumor is there may be Ukrainian hackers who have access to some tractor firmware.

https://www.wideopencountry.com/john-deere-tractor-hack/

#### f150john

Joined Mar 28, 2020
3
Papbravo,

Thanks for the reply. Nothing unfair in this scenario. I bought a truck for $900 three years ago and drove the heck out of it! I'd hate to send it to the junkyard, and I love tinkering. Am I to surmise from your reply that you don't have any input on which chip I should look at? #### Papabravo Joined Feb 24, 2006 13,560 Papbravo, Thanks for the reply. Nothing unfair in this scenario. I bought a truck for$900 three years ago and drove the heck out of it! I'd hate to send it to the junkyard, and I love tinkering. Am I to surmise from your reply that you don't have any input on which chip I should look at?
That is true. Looking at the photos I don't recognize the markings on them. Notice in particular the "For 0025A". That is a dead giveaway for a custom chip. This probably means they are not commercially available, off the shelf parts, but rather custom chips with FORD specific markings. Your chances of finding a datasheet for such a chip are nil, and a replacement part could only come from another finished board. There are not likely any you can buy on the open market. You can scrounge in junkyards for replacement boards but again you have the network interconnection that won't recognize a board from a foreign vehicle.

#### MrChips

Joined Oct 2, 2009
20,918
I know that Motorola MC68HC711E20CFN2 chip and its MC68HC11 varieties were used extensively in the automotive industry. My guess is the data is in IC2T stored in EEPROM.

There is a member here on AAC who has a lot of experience on these automotive issues.

#### Papabravo

Joined Feb 24, 2006
13,560
I know that Motorola MC68HC711E20CFN2 chip and its MC68HC11 varieties were used extensively in the automotive industry. My guess is the data is in IC2T stored in EEPROM.

There is a member here on AAC who has a lot of experience on these automotive issues.
How do you know any of the chips are a variant of the HC11? The intel 80C196 was use extensively in Ford engine controls, but none of the chips in the picture has the required number of pins (to be an 80C196). Also IC2 has what looks like a Philips logo. Is that the one you think is the EEPROM?

Edit: I see we have IC2T and IC2 on the same board(s). That's going to confuse one or two folks.

Last edited:

#### MrChips

Joined Oct 2, 2009
20,918
Chip IC2T has the Motorola logo on a 52-pin PLCC package. I have used this chip extensively and have intimate knowledge of its architecture. I wrote my own code assembler for HC11 before commercial IDEs became available for it.

#### Papabravo

Joined Feb 24, 2006
13,560
Chip IC2T has the Motorola logo on a 52-pin PLCC package. I have used this chip extensively and have intimate knowledge of its architecture. I wrote my own code assembler for HC11 before commercial IDEs became available for it.
I'll grant you it has a Motorola logo, but no other obvious marks, that identify it as a member of the 68HC11 family. There are certainly other chips from the 1997 era that could be inside. The obvious way to start checking is to see if you can locate the E-clock pin. Also is there a nearby crystal that might offer a clue?

#### MrChips

Joined Oct 2, 2009
20,918
..., but none of the chips in the picture has the required number of pins.
Here are the clues.
1) It has a Motorola logo.
2) It has 52 pins on a PLCC package. Motorola MC68HC711 chips are packaged in 52-pin PLCC.
3) The xtal is connected to pin-7 and pin-8. Same as MC68HC711.
4) MC68HC711 variants contain EEPROM. No need for external memory chip.
5) Ford used Motorola MC68HC711 chips.

#### atferrari

Joined Jan 6, 2004
3,930
So, we discard now the 4 chips starting with N7100 (probably IO extensions) and just 2 are left.

#### graybeard

Joined Apr 10, 2012
10
If you are interested in trying to figure out the guts of the instrument cluster PATS circuitry, be my guest. I will watch what you do with great interest. But if you just want to get your truck running again, find an SCTFlash dealer who can sell you a handheld unit for reflashing the PCM along with a tune that disables the PATs system. Or you could find a local tuner who can give you a custom dyno tune that will wring every ounce out of your your particular engine. Or you could do like I did, and buy their ProRacer Package. The PRP isn't cheap, but you can then do all of the tuning and option setting that you want to.

TwEECer is a cheaper alternative to the SCT handheld: https://www.tweecer.com/ccode/

In either case, you will lose the PATS function, so maybe a car alarm or a hidden kill switch would be a good idea.

#### Papabravo

Joined Feb 24, 2006
13,560
Here are the clues.
1) It has a Motorola logo.
2) It has 52 pins on a PLCC package. Motorola MC68HC711 chips are packaged in 52-pin PLCC.
3) The xtal is connected to pin-7 and pin-8. Same as MC68HC711.
4) MC68HC711 variants contain EEPROM. No need for external memory chip.
5) Ford used Motorola MC68HC711 chips.

View attachment 202755
Are you suggesting that the 68HC11E was the only part in a 52 pin PLCC made by Motorola?

#### f150john

Joined Mar 28, 2020
3
Mr. Chips, thanks a bunch. You've given me a starting point. I'll start Googling the IC2T chip to learn more.

Atferarri, I'm being sincere when I say I hadn't noticed that 4 chips had the N7 in common. The process of elimination is helpful.

Graybeard, thank you for the insight. The Tweecer sounds like a good option if all my tinkering leads to nada.

Papabravo, Maybe you can find another place to troll. Here's one for you https://www.farmersonly.com. I'm sure someone over there would love to hear all about those tractors you mentioned above.

#### Papabravo

Joined Feb 24, 2006
13,560
Mr. Chips, thanks a bunch. You've given me a starting point. I'll start Googling the IC2T chip to learn more.

Atferarri, I'm being sincere when I say I hadn't noticed that 4 chips had the N7 in common. The process of elimination is helpful.

Graybeard, thank you for the insight. The Tweecer sounds like a good option if all my tinkering leads to nada.

Papabravo, Maybe you can find another place to troll. Here's one for you https://www.farmersonly.com. I'm sure someone over there would love to hear all about those tractors you mentioned above.
I don't know why you think that, I spent a number of years working in and around automotive electronics. I was trying to give you some insight on the challenges you are facing and what you might be up against. Good luck finding what you want.

#### MrChips

Joined Oct 2, 2009
20,918
Are you suggesting that the 68HC11E was the only part in a 52 pin PLCC made by Motorola?
Non sequitur.
All I am saying is that the MC68HC711E9 or MC68HC711E20 are good candidates that match the footprint.
For more clues, trace pin-20 and pin-21 to see if they go to serial comm ICs.
I already see that pins 1, 26, 51, 52 look like power pins.

#### MrChips

Joined Oct 2, 2009
20,918
@f150john
All I am telling you is where the EEPROM is located. None of this information is going to help you solve your problem.

(I have the expertise to readout the EEPROM but I would not do that for a million dollars.)

#### Papabravo

Joined Feb 24, 2006
13,560
Non sequitur.
All I am saying is that the MC68HC711E9 or MC68HC711E20 are good candidates that match the footprint.
For more clues, trace pin-20 and pin-21 to see if they go to serial comm ICs.
I already see that pins 1, 26, 51, 52 look like power pins.
I agree that there is a continuing circumstantial case to be made for that conclusion, but in my experience with auto makers they almost always ask for changes an enhancements when they pay the upfront costs for a custom chip. You may in fact be correct, but that doesn't necessarily mean the the challenges are over, they are likely to have just begun. I still hope the TS can find what he wants and defeat the "forces of evil". I don't think it should be this difficult fix a vehicle or a tractor.

#### be80be

Joined Jul 5, 2008
2,027
Find a good locksmith I found one he came out and reset my key to match my car is what you have going on here he charged me 50 cash the dealer wanted 650 and I pay 250 to tow my car there
this was in a 2000 ford car but the same problem