Mercedes-Benz Forum banner

21 - 40 of 44 Posts

·
Registered
1974 450SL (US), 2005 SLK200 (UK)
Joined
·
503 Posts
I think it was blocked because you are new member. Not sure how to get around it.

Andy
 

·
Premium Member
1983 380 SL
Joined
·
3,099 Posts
I think it was blocked because you are new member. Not sure how to get around it.

Andy
Minimum number of posts required before PM is allowed. I don't remember the number.
 

·
Registered
1974 450SL (US), 2005 SLK200 (UK)
Joined
·
503 Posts
Microcontroller is M3872 from SGS. It's not enough to replace it, it would need to be programmed as well. Has 4Kb of ROM and 128 bytes of RAM. Perhaps the UK guy scavenged them from working units that were not locked.

The mechanic's tool connects to a 12-pin connector. Hopefully the number of each pin is shown on the circuit board next to the connector. As best as I can work out:

1 - LCD enable 1 out
2 - LCD enable 2 out
3 - data in/out
4 - clock out
5 - button data in (serial)
6 - on button
7 - off button
8 - five lamps
9 - single lamp
10 - no connection
11 - Positive out
12 - GND

Because the tool has two buttons perhaps one correponds to the on button (green?) and the other corresponds to the off button (red?). If so try connecting pin 6 to pin 12 and power on. Although if that works then why bother with the tool in the first place?

Unlocking could be more complex than that. It could look for a specific set of buttons being held down at power on. Think Ctrl+Alt+Del for Windows.

Or they could have made it even more complex and have a sequence of button presses in the right order and too quickly for a human to do. Think combination lock.

Andy
 

·
Registered
1974 450SL (US), 2005 SLK200 (UK)
Joined
·
503 Posts
MoonUnit drew my attention to IC906 where power is on pin eight and is maintained by a 3.4V battery.

This is a PCD8571. This is an eight-pin serial RAM chip containing 128 bytes. If the battery dies the contents of this RAM chip also die.

My guess is that when new from the factory this part is programmed with some magic value that tells the radio to work. When the battery dies the contents are lost and the microcontroller shows dashes. Then when the workshop tool is connected it gives the microcontroller a specific sequence of some kind of signal or signals which instruct it to restore the contents of the RAM chip and it works again.

In theory it would be possible to take a working radio and connect some test hardware into the circuit then read out the contents of the RAM chip. It might then be possible to restore a locked radio by again connecting some test hardware and reprogramming the RAM chip. Tedious work, time consuming and not easy for anyone to just DIY.

Andy
 
M

·
Guest
Joined
·
0 Posts
MoonUnit drew my attention to IC906 where power is on pin eight and is maintained by a 3.4V battery.

This is a PCD8571. This is an eight-pin serial RAM chip containing 128 bytes. If the battery dies the contents of this RAM chip also die.

My guess is that when new from the factory this part is programmed with some magic value that tells the radio to work. When the battery dies the contents are lost and the microcontroller shows dashes. Then when the workshop tool is connected it gives the microcontroller a specific sequence of some kind of signal or signals which instruct it to restore the contents of the RAM chip and it works again.

In theory it would be possible to take a working radio and connect some test hardware into the circuit then read out the contents of the RAM chip. It might then be possible to restore a locked radio by again connecting some test hardware and reprogramming the RAM chip. Tedious work, time consuming and not easy for anyone to just DIY.

Andy
Hi Andy,

I had exactly the same thoughts when I looked at it. I assumed the PCD8571 held some 'key' value that enabled the main microprocessor to start up properly. However, a common use for that chip is storing phone numbers in phone systems, and I thought it may just exist to store the radio presets. I am not sure what the battery does - it could be that it's to keep the code alive if the car battery is disconnected or flat. When the radio is removed from the car, in addition to the 4 pin power plug, there is a 5 pin 'anti-theft' plug which connects in to the same circuit as IC906. If one assumes the key code lives in this chip, then one might assume that a) the on-board 3.6v battery keeps it in memory for normal times unless b) the 5 pin anti-theft plug is pulled, in which case some wiping event is triggered (my electronics isn;t good enough to work out what happens if that plug is removed).

Thus, a radio with flat onboard battery could continue to work provided the car battery is still powering the radio, but if the car battery dies, the radio would 'dash out'.

Simply replacing the battery doesn't fix the problem.

Removing the anti-theft circuit doesn't fix it either, but in the two radios I have the do work, the anti-theft circuit has been removed.

All the online resources I found said to not re-connect the anti-theft plug, if still in the car.

The only thing I could think of to do next was to remove the IC906 from a working radio, read it with an EPROM reader, program a new chip and solder that into the broken radio. The risk of course is that I damage the good radio in the process and I thus lost my nerve.

I am also pretty sure the main processor has its own memory and it's quite possible that IC906 is a red herring here, and the code in the microprocessor needs to be re-programmed. Certainly, my UK repair man suggested that the main chip needed to be replaced. There was no mention of the small IC906.

So - if anyone has any other ideas, I am all ears - ideally I'd love to either buy that tool or maybe it's possible to find someone in the states who can investigate 'cloning' it, depending on what it does.

If it's a simple as the tool holds various pins high or low on startup, that should be easy to replicate. It could be that it re-programmes the main microprocessor instead.

Thoughts?
 

·
Registered
1974 450SL (US), 2005 SLK200 (UK)
Joined
·
503 Posts
You can't remove IC906 because it is RAM not EPROM. As I mentioned before as soon as it loses power it will lose it's contents.

Replacing the battery wouldn't fix it because it's already too late - data has been lost. Now it needs to be restored to factory status.

The theft status needs to be stored somewhere. It's not likely to be stored in the microcontroller as I doubt it has the ability to do that. It would need EEPROM which wasn't common in the mid-80s microcontrollers. Also in-circuit reprogramming was not common. I wasn't able to find a copy of the datasheet to confirm. Basic search indicated this is simple ROM and RAM only.

IC906 is maintained by the battery so that seems to be the most likely place. There is room to store this single status bit along with phone numbers.

If the UK repair person says the microcontroller needs to be replaced then how does he explain that others have been able to unlock their units using the tool instead of replacing the microcontroller?

It seems the battery is either not used or maintained by the anti-theft connector. If your unit has the connector missing then when the battery eventually dies I would expect it to lock again.

The way I would read out IC906 would be using a jig with pogo pins - no hardware modification required. Same for reprogramming.

Andy
 
M

·
Guest
Joined
·
0 Posts
"You can't remove IC906 because it is RAM not EPROM. As I mentioned before as soon as it loses power it will lose it's contents."

Meaning that if I did remove it from the good radio, it'd lose it's contents and I'd be stuffed?

I figured that would be the only way to read it, once it's isolated from its connections to the processor. I have seen various HEX dumps of files that people claim are from IC906 and work, I'll attach some for your enjoyment.

I assumed the microprocessor was reprogrammable, so the tool could reprogram it via the faceplate connection. I am also assuming that Becker had the microprocessors made pre-programmed and the repair guy has one of these left.

BTW, the closest I got to establishing the indentity of the processer was a phillips 80C31, I will attach the datasheet.

We need the tool, really.
 

Attachments

·
Registered
1974 450SL (US), 2005 SLK200 (UK)
Joined
·
503 Posts
Looks like those hex dumps are from a 24C01 which is an EEPROM. Didn't see that on the schematic, but if it's on there somewhere then it could also hold the theft status.

Andy
 
M

·
Guest
Joined
·
0 Posts
Looks like those hex dumps are from a 24C01 which is an EEPROM. Didn't see that on the schematic, but if it's on there somewhere then it could also hold the theft status.

Andy
Yes - I think they are. I got them from various sites on the net. I tried without success to program the IC906 and put the failure down to it being still on the circuit board and thus not being powered properly by the programmer (clip on lead). But more fundamentally, if IC906 isn't an EPROM in the first place, it wouldn't have worked [slap forehead].
 

·
Registered
1974 450SL (US), 2005 SLK200 (UK)
Joined
·
503 Posts
There is a good chance you have damaged IC906 by doing that. IC906 uses I2C and has a different pinout to an EEPROM.

Andy
 
M

·
Guest
Joined
·
0 Posts
There is a good chance you have damaged IC906 by doing that. IC906 uses I2C and has a different pinout to 24C01.

Andy
Hmm, well that's not good, I'll have to go back to see exactly what I did try to do. I've been ferreting around in the dark on this and had come to believe the tool was an urban legend, so to see it here is exciting ...
 

·
Registered
1974 450SL (US), 2005 SLK200 (UK)
Joined
·
503 Posts
I looked again at the schematic - can't see a 24C01 on there... if you know where it is please post an image of that part of the schematic.

Andy
 
M

·
Guest
Joined
·
0 Posts
I looked again at the schematic - can't see a 24C01 on there... if you know where it is please post an image of that part of the schematic.

Andy
I don't believe there is a 24C01 - I think it's being confused with the PCD8571 chip. Certainly, when I was looking into all this a while back, I found a Polish site, which I thought implied the RAM chip was / could be replaced by an EPROM. See https://www.elektroda.pl/rtvforum/topic129638.html#16980526 although you have to put the posts through google translate. Some tantalising hints.

Also, this page -= CODEDRADIO =- Base navigation suggests the main processor is an 80C31 (search for radio BE754).
 

·
Registered
1974 450SL (US), 2005 SLK200 (UK)
Joined
·
503 Posts
The entry for BE754 on the Polish site doesn't match up with the schematic.

8051 was a core type and many silicon vendors made derivatives over a period of 25+ years. It's possible that the SGS part used in this radio is an 8051 but that information doesn't help much without the SGS datasheet.

Probably your best course of action is to send your radio to Becker and have them unlock it and I believe they can deactivate the anti-theft feature.

Andy
 
M

·
Guest
Joined
·
0 Posts
I noticed on the schematic there is a key that has a symbol that looks like a keyhole. Does this button actually exist?


Andy
That button is actually a depiction of an aerial. On the 754 model, it does not exist, but on the 755 model (which I think is a US version) it does, and successive presses increases the scanning sensitivity when scanning for channels.
 

·
Premium Member
1986 560SL with M120 V12 Engine, 1988 560SL Stock
Joined
·
10,515 Posts
I had an extra Becker 754 radio (previously from a 300E) that I wanted to install in my '89 560 R107. As many know, the 754 model utilizes a lithium battery (cutting edge technology at the time) and when the radio is removed from a power source (e.g., stolen and or pulled out of the car) the lithium battery will eventually go dead, putting the radio into a locked mode where once powered up again, the display will show dashes. Unfortunately, these radios do not have a security code like many of the Becker units. The Becker 754 requires a "reset" by the dealer. I wanted to provide what I did to bring this radio back to life, as there is little information on this subject.

1. I took the radio to a local electronic repair shop and we replaced the lithium ion batter (3.6 volts / half AA size) and soldered the new battery to the board. (This cost $20)

2. I then approached a contact at my local Mercedes dealer (Hendrick Mercedes - Charlotte, NC) and asked if they had any "old timers" that may remember how to reset one of these radios. Luckily, one mechanic knew how to do this, and still had the tool to "reset" the radio. He said he would do this at no charge!

3. Remove the face plate of the radio (easiest when removed from the car). With face plate removed, install the radio in the car / connect all wiring to the rear of the radio.

4. With the ignition off, insert the reset tool (see photos) into the face (where to connect should be obvious). Hold down green button on the reset tool, then turn on the ignition to power the radio. Release the green button. Remove the reset tool and install the face plate back on the radio. The radio should now work and it should be "unlocked" / eliminate the dashes that previously appeared on the screen. The instructions for this process are also located inside the case that houses the dealer's reset tool.

Hopefully this helps others who may want to restore / revive a Becker 754 radio. Also, many thanks to the folks at Hendrick Mercedes in Charlotte, NC.
Thanks for posting this. I'm getting a new (old) Becker this week from a parts car.
 

·
Registered
Mercedes 560SL 1988
Joined
·
5 Posts
So did anyone figure out how to get the radio out of theft mode short of sending it to Becker? I have a 780 with the same problem. I’m in Orlando FL and can’t find a dealer that has the tool used to reset
 

·
Registered
Mercedes-Benz w126 280s euro; 500sel euro
Joined
·
45 Posts
Mine is Europa 2000 , same 4 dashes ( _ _ _ _ ) ,can someone suggest what to do, the unit is in mint condition :(
 
21 - 40 of 44 Posts
Top