This is an old revision of the document!
Table of Contents
⚠️UNDER CONSTRUCTION!⚠️⚠
Parkwächter disassembly and investigation
In Germany it is allowed to use electronic parking discs if it has an E24 number.
As the plastic casing has melted in summer (they use thermoplastics, d'oh!), I did not even have to open it, it literally opened itself. I assumed there would be an ASIC inside, but be astonished and read on!
Althogh it is a parking disc for the German market, I still like to do my write-ups in english. Use Google Translate if you want.
Info
⚠⚠️WARNING: messing with certified electronics is prohibited! Do not alter hard- or software - it is illegal. Just don't do it.
This is for educational purposes only!
␆❗ If you like car stuff, also see disassembly of ADAC DriveDot and Gadgets you can get for your car.
Pictures
Hardware
The device consists of two LCDs (one big in the front, another in the back), controlled by a TI MSP430 MCU. Motion is detected by an accelerometer (labeled XXX).
There is a switch for changing from 15mins interval to 30mins and some buttons on the back to set the time on the rear LCD. Additionally, there is a LED .
Everything is powered by CR24 battery, which has already lasted for 1 year and is still going (I admit, I don't go much by car. Better ride your bicycle too!:).
Surprisingly there is also a pin header socket with silkscreen labeling (nice!).
What's ugly is the soldering tin junk splattered on the PCB next to the front LCD joints. Also there is flux all over.
It is really ignorant to use thermoplastics for the case which sits right behind the windshield frizzling in the sun. The four magnets are there to hold a blue plastic plate which is stuck to the windshield - you cannot see it in the pictures as it is still inside the car.
Pinout
The silkscreen labels of JTAG-header read:
| Pin# | Name | description | Pin# | Name | description | |
|---|---|---|---|---|---|---|
| 4 | TEST | Enter programming mode with RST / SBWTCK in Spy-Bi-Wire (SBW) mode | 8 | GND | Ground | |
| 3 | TDI | Test Data In (4-wire JTAG) | 7 | TDO | Test Data Out (4-wire JTAG) | |
| 2 | TCK | Test Clock (4-wire JTAG) | 6 | TMS | Test Mode Select (4-wire JTAG) | |
| 1 | 3V | VCC voltage | 5 | RST | Reset (active-low) / SBWTDIO (data line) in SBW mode |
MSP430 Pinout
The GPIO-Pins of MSP430 are the following:
<insert table>
LCD front and back pinout
#TODO. Pinout part is still missing.
Lauchpad programmer
Connect a debugger to the pin header of MSP430. I used a Lauchpad programmer dev-board collecting dust.
<insert picture>
Output
When connecting, we get the following initial output:
Dumping
The lock bits are set to:
output
Glitching?
Dump
Accelerometer
The Accelerometer comes in LGA-16 package.
<insert picture>
Its markings are:
<insert marking text>
When sending I2C “WHO_AM_I” request, we get:
ID