17 replies to this topic

[slindborg]

Firstly thanks to Mr Badgerade for donating his dead (corroded pins) ECU to the cause.


Onto the fun.

I want to work out a few bits and pieces that the ECU¹... scrap that PCM² checks for diagnostics to determine howto get around the issues of removing/fitting items.

So take one PCM and use a knife to cut the silicone round the back of the unit. Undo the Torx bolts and then use the knife to cut round under the cover when lifting off.
Then you have to take some drastic action and cut the connectors off the top

You are then left with


Started the fun task of buzzing through some of the pin remains to determine which connector is which on the TIS and also work out some of the chips.
Problem is the 7 or 8 shiney squares with dots round the edge... no way to determine what they are and what they do 3 of them have crystals near them so must assume they are the processors for running the show, and the 10 IGBT's at the bottom are for running the Injectors and possibly the H bridge for running the ETB³ plus maybe a couple of other switched functions (fuel pump?)

If anyone has anymore info regarding the innards of this beastie then add here so we can begin the fun and games of 'hacking'


¹ ECU generally means Electronic Control Unit, but gets called Engine Control Unit
² PCM = Powertrain Control Module, for controlling the powertrain such as the Engine.
³ ETB = Electronic Throttle Body

[FLD]

Problem is the 7 or 8 shiney squares with dots round the edge... no way to determine what they are and what they do

This might be a stoopid question but this stuff is waaaay beyond me. Can you deterine what they are by tracing back the pcb tracks to ecu pins and consequently wires to engine?

Good job by the way.

[slindborg]

Problem is the 7 or 8 shiney squares with dots round the edge... no way to determine what they are and what they do

This might be a stoopid question but this stuff is waaaay beyond me. Can you deterine what they are by tracing back the pcb tracks to ecu pins and consequently wires to engine?

Good job by the way.

Aslong as they go straight back to a pin yeah, but 9/10 times they route through protection so its not so easy

[davemate]

are you looking for the locations of the chips, or are you just heading into the EEPROM?

Edited by davemate, 14 October 2011 - 10:49 PM.

[slindborg]

are you looking for the locations of the chips, or are you just heading into the EEPROM?

Initially just going for the chips and working out WTF goes on in there, then maybe head on into the EEPROM but I dont know how much use that will be to everyone

[jonnyboy]

Looks interesting. Whats the actual point of the exercise? (for internet forum clarity that isnt a sarcastic comment btw) Are you aiming to do anything with the code?

[slindborg]

No intention of touching the code, no point and no gain to be had imho. I plan to understand how the OEM got the hardware side of sensor power supplies and current detection working in order to make things to frig the damn thing

[slindborg]

Righteo then... Got a bit of spare time to just did a simple buzz through of the main parts.



Lambda 1 is the Precat (main) Lambda sensor heater driver
Lambda 2 is the post cat Lambda sensor heater driver
ETB driver(s) is the H-Bridge for running the throttle body.
Injector Drivers are the same Low Side Drivers as the Lambda ones but obv run at 1/4-1/2 engine speed Numbered as per the Cylinder they fuel.

Note that round the two Lambda drivers there is two 1Ohm fat ass resistors to do some current/voltage sensing in order to determine if the heater is 'gone'... Now to work out what the minmum current flow needed to stop the fault tripping

Edited by slindborg, 20 November 2011 - 07:58 PM.

[slindborg]

More beautiful 'paint' skills




Looking at the 4 chips enclosed in red.
Green = Ground
Red = Control signal (from a processor somewhere under those hologram covers )
Off Blue = 12V From pins 63 and 64 of X22
Pinky/lilac = Output to Pins 13 and 14 of X22 (motor drive)
Light Blue = Output to Pins 15 and 16 of X22 (motor drive, other side)
The two rectangles circled and titled Reverse Polarity Protection are to stop the High Side drivers from being fried and also to stop the throttle being jammed open if there was an electrical issue.


Onto the ones that are marked but not surrounded.
Yellow = output (well ok input as they sink current) to Pins in X22 for Lambda 1/2 heater and the 4 injectors
Red = Control Signals from Processor
Green = Ground (except in the case of the two Lambda heaters where they run through a 1Ohm resistor before hitting the ground plane).

Edited by slindborg, 20 November 2011 - 10:48 PM.

[FLD]

I'm sure if I knew what all this meant it'd be of vital importance. Shame I'm so thick

[alexb]

Long shot, is that stripped ECU still around? If so, is it possible to see what happens with the crank position sensor input? I mean the signal conditioning that's done in the ECU. As the sensor output is a pretty dirty sine with an amplitude between some 10's of mV when starting up to 10's of V at high RPM, there must be some signal conditioning in the ECU before the CPU to turn it into a more well behaved signal. I like to understand what signal the ECU, or better the conditioning circuit, can take instead of the signal from the crank sensor. As far as I can find from the TIS, it's pins 1 and 2, referred to as B34, but I'm not even sure about that, as it doesn't mention what the pin mapping (diagram to ECU) is

 

Easy way of finding out is to put a reluctance sensor amplifier like a TI LM1815 between the sensor and the ECU and see what happens, but that requires more guts than I have. I see lots of scenarios where the result is a blown ECU or engine and like to avoid that.

 

 

[Exmantaa]

Are you still looking into a software Saab<>Z22SE signal converter?

 

(Just fit external trigger on the Saab. Lot's of OEM engine hace that working flawless for years...)

[slindborg]

I think a crank signal modifier won't work without lots of other inputs and fun kit... As you say just fit an external sensor. The signal you describe sounds perfectly normal and needs no behaviour improvement..... Is worked since the 80's

[alexb]

Are you still looking into a software Saab<>Z22SE signal converter?

 

(Just fit external trigger on the Saab. Lot's of OEM engine hace that working flawless for years...)

 

Yes. Not to fit it, I'm about 95% sure that I will use an external trigger wheel. Main reason being that it's difficult to design something electronic for a car being able to handle all conditions. if you do something like that, you either have experience (not) and very good simulation tools (not) or what you do is make a prototype and just start to use it, accepting that things will go wrong. For me at the moment it's something I just like to try and learn a bit in the mean time.

 

I made an external trigger wheel a couple of weeks ago just to test it a bit. Things I don't like:

- it has to be centered really well to keep the pulley balanced. Best thing would be to mount the wheel and then balance the pulley+wheel.

- the gap between the wheel and the sensor is small (<1 mm) and the signal of the sensor depends a lot on that gap (= you need a small gap to start the engine)

- you easily get an error of 1-2 degrees in the whole set up. You have to really do this carefully, clocking the wheel accoring the sensor position etc. Not a real problem, but the sensor is exposed and can be knocked out of true. That depends a bit on how it's mounted of course, but still.

 

On the other hand you have the perfectly positioned and protected 60-2 triggerwheel in the engine, potentially providing much better position information. Seems a shame not to use it.

 

Signal conditioning of the 60-2 sensor is relatively easy. Using a PIC processor running on something like 10MHz should do the trick of counting the teeth and determining when to send a position/sync signal to the ECU. The 60-2 and the 6+1 wheels are not synchronized at the same angle, but that's not hard to handle. The only hard part is handling the start (low RPM, low VR signal, high accelaration of the trigger wheel which may cause losing sync). Luckily they removed 2 teeth instead of 1. Clever people these Bosch guys.

 

Issue that's left is the signal that is sent to the ECU. The ECU expects to get a VR signal and will have a circuit to condition it. Conditioning meaning that the processor in the ECU will not be able to handle the VR signal directly. You need some scaling, a threshold and hysterese to turn it into a more well behaved signal. And yes, that same signal is used for ages, but it only works because some people did smart things so that a processor can handle it and noise is filtered out etc. If that same conditioning circuit that is used in the ECU and that I can't change can take a fast going through 0 signal (as in a block signal coming out of the PIC processor), essentially I'm done. All I have to do is program the PIC. Never done that, but it's good to learn things

 

If not, you get into a more difficult situation. Either slow done the transition or worst case use a wave table with VR sensor samples. Can all be done, the right PIC can do DAC or PWM and handle wave and sample tables. You can also leave it to another circuit. It just makes things more complex.

[smiley]

 

 

Not a real problem, but the sensor is exposed and can be knocked out of true. That depends a bit on how it's mounted of course, but still.

 

 

 

That is still my biggest fear. A snapping belt destroying my sensor.

[Exmantaa]

Look in Smiley's Saab thread how we did the external trigger set-up. It's pretty solid mounted and I made a small ridge in the pulley to allign the triggerwheel. A 1mm trigger gap is sufficient. I thought about balancing, but in the end we didn't bother

 

the possible 1-2° allignment difference...  Well, your Saab 2,0 crank/piston combo needs anyway a new optimised timing table, so...     Ask Peter if /how the Z22SE ecu performs a crank triggger learn sequence. On the LSJ ecu I can start such learn mode manually, but I read somewhere that the Z22SE does that automatically on start-up or so...

 

We thought about a PIC translator box too, but in the end the risk is pretty high as timing errors can go badly wrong very quickly in a boosted engine...

[slindborg]

first off, Delphi made the Z22SE ecu, so botch cant be completely credited on that one

 

For VR conditioning, take a look at the yeee haw methods employed in the megasquirt system and go from there if you really really feel you have that bad a system.

 

To emulate the Vr signal you are looking at...

60 * 8000 = 480000 pulses/second to output as the worst case (assuming you run that fast, but its good to have overhead), running an analogue signal at that rate is gonna take a juicy processor.

 

PIc's are good and p*ss easy to work with.

[alexb]

Bosch did the 60-2 trigger wheel as far as I understand. At least it's often referred to as the Bosch 60-2 wheel, which makes me assume it's from Bosch.

 

8000 RPM you see 480000 pulses/min or 8000 per second. That's slow for a processor. You need some resolution per pulse. Say you like to have something like 100 counts per pulse with a signal conditioner that halfs the period of the pulse (that's how they usually work). At 10K RPM that means you need a 2MHz clock. High end is easy, it's really the low end that I see can cause problems. When cranking the engine, RPM is low and varies a lot. You have to take low battery > low and very uneven rotation into account, which makes it difficult to decide you see a real sync signal or not.

 

I actually ended up in a Megasquirt forum as searching for VR signal conditioning takes you there. BTW I don't feel I have a bad system. It does the trick, which is fine by me. With a B207 with an internal 60-2 wheel and a perfect place for a VR sensor, all OEM, it does feel less than optimal to work with an external trigger wheel. Like I mentioned before, very likely I will go that route, feeling miserable about it all the way. But it's still interesting to get an 60-2 to 6+1 emulator going and see what kind of problems you run into.