Table of Contents
Parkwächter V1 disassembly and investigation
In Germany it is allowed to use electronic parking discs if it has an E24 number.
As the plastic casing of Parkwächter V1 (Art.-Nr.: AD286) has melted in summer (they use thermoplastics, d'oh!), I did not even have to open it, it literally opened itself. I assumed there would be an ASIC inside, but be astonished and read on!
Althogh it is a parking disc for the German market, I still like to do my write-ups in english. Use Google Translate if you want.
Edit: The seller (and at the same time the manufacturer) has sent me a new upper case in the original box.
Info
⚠⚠️WARNING: messing with certified electronics is prohibited! Do not alter hard- or software - it is illegal. Just don't do it.
This look inside for educational purposes only!
␆❗ If you like car stuff, also see disassembly of ADAC DriveDot and Gadgets you can get for your car.
Pictures
Hardware
The device consists of two LCDs (one big in the front, another in the back), controlled by a TI MSP430 MCU. Motion is detected by an accelerometer (labeled XXX).
There is a switch for changing from 15mins interval to 30mins and some buttons on the back to set the time on the rear LCD. Additionally, there is a LED .
Everything is powered by CR24 battery, which has already lasted for 1 year and is still going (I admit, I don't go much by car. Better ride your bicycle too!:).
Surprisingly there is also a pin header socket with silkscreen labeling (nice!).
What's ugly is the soldering tin junk splattered on the PCB next to the front LCD joints. Also there is flux all over.
It is really ignorant to use thermoplastics for the case which sits right behind the windshield frizzling in the sun. The four magnets are there to hold a blue plastic plate which is stuck to the windshield - you cannot see it in the pictures as it is still inside the car.
Pinout Header
The silkscreen labels of JTAG-header read:
| Pin# | Name | description | Pin# | Name | description | |
|---|---|---|---|---|---|---|
| 4 | TEST | Enter programming mode with RST / SBWTCK in Spy-Bi-Wire (SBW) mode | 8 | GND | Ground | |
| 3 | TDI | Test Data In (4-wire JTAG) | 7 | TDO | Test Data Out (4-wire JTAG) | |
| 2 | TCK | Test Clock (4-wire JTAG) | 6 | TMS | Test Mode Select (4-wire JTAG) | |
| 1 | 3V | VCC voltage | 5 | RST | Reset (active-low) / SBWTDIO (data line) in SBW mode |
Next Steps
Due to lack of time, I had to stop here. Next steps could be:
- Connect Lauchpad programmer to header
- Dumping Firmware: check lock-bits → Glitching? → Dump!
- send I2C “WHO_AM_I” request to accelerometer (LGA-16 package IC)
- Create GPIO-Pinout of MSP430
+ LCD front and back pinout