Jump to content
Do Not Sell My Personal Information

Cluster Swap


Recommended Posts

Another little project - I was thinking of doing a cluster swap, as i have an intermittent fault with mine

The clusters are a plug and play swap with the 17 onwards with the mid are so much cleaner




Even tho the cluster is plug and play there are 3 issues

1. The mileage needs to be corrected

This one is fairly easy to overcome after a fair bit of digging i found the information required, The cluster needs to be read with a programmer luckily it uses the same board as the Auris/Rolla and Rav4, it uses a nor flash chip and is programmed via the Motorola/Fujitsu Processor (MB91F060BS) and needs direct connection to the pcb

This can not be done with Techstream as it requires access to Techdoc and security clearance with a Techdoc TARS username and password

2. The cluster is throwing a code for the PCS and LDA as the cluster is looking for the camera module

My car doesn't have TSS, so it needs to be disabled, it seems this can be done by changing the calibration file - Toyota do this via Techstream and requires a valid VIN, im hoping to find a CAL file or to modifying the bin/hex from the cluster.............. if i can

Found a TSB for the US trucks/4x4's  T-SB-0026-20

3. Audio controls (right side joystick)

2 options

1. swap the audio controls for the later type (i have a set i picked up dirt cheap) will have to swap the radio for full nav and hands-free support

2. mount these controls else where



Link to comment
Share on other sites

  • 3 weeks later...

A follow-up post

This may be a bit techy

After having a play and figuring what does what - the Mainflash (1MB) is the core software for the cluster and the Workflash contains the settings by pure accident i flashed a blank Workflash this defaulted the cluster but was unable to write the mileage

we now know the mileage is stored in the Workflash so if we compare a pair of files with different mileages we can see what changes are made to the binary with ExamDiff pro

we can now ignore any added, changed and removed data this should give us something to work with, the next step is to ignore any 00 or FF hex

either, i have to find a way to decompile the binary or just brute force it till i find the Switch/Key


To be continued..........................................

Link to comment
Share on other sites

More babble.......................

Getting somewhere now, think the settings are held in the 4000 offset range just 96 lines of 16 hex blocks, so 1536 entries around 1/4-1/3 are changed or added - that leaves 1153 - 1013 entries untouched, i should be able to reduce that by removing the 00 entries

here's a sample



Link to comment
Share on other sites

Do you also wear shades, a black trenchcoat and are unusually gifted at martial arts...? :laugh: 

Is that hexdump the encoded flashrom or decoded tho? I assumed the odo data was just stored as a plain number on the raw flash chip so I assumed you could just search for a number matching the odo value. I recall someone did that by attaching a SOIC8 clip to the flash chip and fudging the odo that way, although admittedly that was with a Ford, who don't tend to obfuscate their stuff as much as Toyota..

Link to comment
Share on other sites

No not at all just poking at things and seeing what works

that is the raw binary, I can not find any software that will decompile FR (Fujitsu Risc) to machine code/programming code - standard clusters without a MID use a standard SOIC 8 you just use a calc to adjust the mileage algorithm

flash works in the same way but is stored in a 64KB Workflash


I have "corrected" a few locked BIOS's over the years, so it is very similar to that, it's not genius, just pure dumb luck 70% of the time

Link to comment
Share on other sites

Yay, the PCS and LDA are now disabled after much modifying i couldn't pin it down to a few hexes so i replaced a section with FF fill (A000 - B820) mileage is correct, and it's still in Miles and MPG

I'm yet to test the full function in car yet, but it looks promising




  • Like 1
Link to comment
Share on other sites

  • 3 weeks later...

The project is now complete, here are some pics of the process

Cluster with the bezel removed, you need to remove the needles (tape and mark the position) remove the 2 rings, then the face



Direct connection to read/write the flash (I now can do this over OBD2)


See above for the Flash reprogramming - now tested and working without the 2 errors and bleeping



To properly use the cluster you need the 2017 on, wheel controls

Original Controls



You need to remove the airbag (disconnect the Battery for 15-20 mins) find the hole in the bottom of the wheel, officially they say use a torx driver (single piece) all you need to do is release the post by pushing the spring (Flat blade as an example) remove the airbag by unplugging the orange connector (lift up the yellow lock tab first)


remove the 2 screws it's just held by clips otherwise - unplug the connector from the clockspring and un-route the cables


Swap the controls over. Replace the airbag


Wiring - you need to connect 2 wires from the 12 pin connector on the clockspring to the 28 pin in the cluster both connectors use the Sumitomo NH series terminals

12 pin           28 pin

   3          -       28

  12         -        18




I didn't realize  but my EPS hasn't been working correctly no warning or MIL just some buried codes in the power module (B2282 and B2283), but it does now 😀 Digital speed readout and Temp Gauge are nice to have too (only thing that doesn't work is the speed limit button due to it not being programmed into the ecu on the  < 2017 facelift cars

  • Like 1
  • Thanks 1
Link to comment
Share on other sites

Well I thought the steering was a bit heavy at times, one of those codes is speed sensor related the EPS drops into a fail safe i have previously erased the codes, but it comes back due to an intermittent fault on the cluster

Yes I use Techstream and run a full health check that scans all systems, I also have an Autel maxidas among a few others

  • Thanks 1
Link to comment
Share on other sites

9 minutes ago, Cyker said:

Woo, that's pretty epic, especially as it works!! :biggrin: 


It was just a project, something different to do, Audio control are next on the list, but that's for another thread

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Create New...