Hi folks,
Anyone here got nanocom and also an oscilloscope? My nanocom is playing up talking to EAS, and I'd like to see a known good trace of a chat between the two, to aid finding the fault.
Thanks,
Miah
Hope this isn't too far off-subject...
I recently bought an Launch X431 Diagun 5, it will do OBD2 and OBD1 stuff on a wide range of vehicles and communicate not just with the engine ECU but also with other ECU modules. I had a P38 here for LPG diagnostics repair only yesterday but didn't really have an excuse to connect the Launch because I diagnosed and fixed the LPG problem in no time but I'd have liked to have tried the Launch on the P38 to find it's capabilities on the P38, I doubt it will feature as much on a P38 as a Nanocam but it would be nice to know if it could do suspension level sensor learns etc. The 'fix' to get the LPG working again on this P38 turned out to be to open the manual shut-off valve on the old Ikom 30 degree tank (old enough to have a 12mm copper fill pipe) lol. But as soon as it pulled up I told the owner he probably had a knacked lambda sensor, I could smell the exhaust running rich. Turned out these 2 young lads run a P38 dismantlers/scrapyard and were already aware their P38 needed a lambda probe. I told them it was needed on bank2 and advised them to join this forum - could be good news for some of you too if they do join up (since they run a scrapyard for P38's).
On another make/model vehicle I recently attempted diagnosis of an intermittent misfire accompanied with error codes pointing to the crank sensor and sometimes cam sensors, the same codes occurred even with the cam sensors ruled out (running the engine in group injection mode with cam sensors unplugged a fault still occurred pointing to the crank sensor and the revcounter reading that is crank sensor driven fluctuated when the fault was occurring). Using my cheap digital oscilloscope I diagnosed this problem as one of a knacked flex plate, something related to massive crank thrust bearing problem or knacked rear main crank bearing... because when the fault occurred the crank sensor signal connected directly to the scope showed an occasional double width pulse (the flex plate teeth seemed in good order and the same results were repeatable with several different crank sensors). This conclusion seems a little far fetched even to me (I made the conclusion) but when you've ruled out everything else the remaining possibility(s) must be true and I can think of nothing else that could be true in this situation. The car has since been to another 'specialist' (vehicle dismantler rather than diagnostics master in reality) whom, like me, at first suspected a dodgy engine ECU. He swapped and recoded a replacement ECU but the problem remained. The same car will be going back to the scrapman in a few weeks and I'm quite certain that this specialist won't be connecting an oscilloscope... But I do expect he could fix the problem by fitting a replacement engine along with it's flex plate and he has easy opportunity to do that because he has plenty engines lying around. If he ends up fitting a replacement engine I reckon that either the flex plate will be the fix or the engine without mega excessive crank end float would be the fix... and I expect my unusual diagnosis conclusion to be correct.
Well, it's about time I came over for an LPG service on the P38 if you want to hook up diagnostics to it while I'm there - no worries.
How are you fixed?
Morat wrote:
Well, it's about time I came over for an LPG service on the P38 if you want to hook up diagnostics to it while I'm there - no worries.
How are you fixed?
Hi Miles!
A busy week next week but may be able to do Friday 19th if we could play that one by ear... Could do Fri 26th for sure, may be able to do an earlier day that week too. Any problems with it? Yes we can try the Launch on it if you don't mind.
I'll check and drop you a message :)
Thanks!
Wouldn’t a logic analyzer be more appropriate for recording the entire communication? My limited understanding is that a scope is better suited for analyzing repetitive signaling or the signal integrity. I ask because it’s on my someday list of things to do, to grok the P38 wire protocols and bend them to my will.
On a related note why couldn’t someone clone the functionality of a nanocom, which itself is a clone of sorts of testbook, by watching the signaling on the wire between the nanocom and the various ECUs? I realize that being able to see the digital signal doesn’t mean you can know the data payload. Exploring this has been on my someday list for a long time.
What cheap scope would be worth getting for a P38?
Beowulf wrote:
Wouldn’t a logic analyzer be more appropriate for recording the entire communication? My limited understanding is that a scope is better suited for analyzing repetitive signaling or the signal integrity. I ask because it’s on my someday list of things to do, to grok the P38 wire protocols and bend them to my will.
Absolutely, but I know the comms are there, just that the nanocom appears to be half deaf when it comes to receiving the EAS' reply. It knows it's there enough to not give a 'no comms' error, but not enough to do something useful. So it simply stops responding to any input, and you have to force a power off.
On a related note why couldn’t someone clone the functionality of a nanocom, which itself is a clone of sorts of testbook, by watching the signaling on the wire between the nanocom and the various ECUs? I realize that being able to see the digital signal doesn’t mean you can know the data payload. Exploring this has been on my someday list for a long time.
You'd be surprised.. ;)
What cheap scope would be worth getting for a P38?
I have a Micsig, which is pretty decent, and battery powered so portable. Tbh any scope will be sufficient for working on a p38, there's nothing particularly high speed etc.
Lpgc wrote:
Hope this isn't too far off-subject...
Pretty far, but I'll let you have it :)
On another make/model vehicle I recently attempted diagnosis of an intermittent misfire accompanied with error codes pointing to the crank sensor and sometimes cam sensors, the same codes occurred even with the cam sensors ruled out (running the engine in group injection mode with cam sensors unplugged a fault still occurred pointing to the crank sensor and the revcounter reading that is crank sensor driven fluctuated when the fault was occurring). Using my cheap digital oscilloscope I diagnosed this problem as one of a knacked flex plate, something related to massive crank thrust bearing problem or knacked rear main crank bearing... because when the fault occurred the crank sensor signal connected directly to the scope showed an occasional double width pulse (the flex plate teeth seemed in good order and the same results were repeatable with several different crank sensors). This conclusion seems a little far fetched even to me (I made the conclusion) but when you've ruled out everything else the remaining possibility(s) must be true and I can think of nothing else that could be true in this situation. The car has since been to another 'specialist' (vehicle dismantler rather than diagnostics master in reality) whom, like me, at first suspected a dodgy engine ECU. He swapped and recoded a replacement ECU but the problem remained. The same car will be going back to the scrapman in a few weeks and I'm quite certain that this specialist won't be connecting an oscilloscope... But I do expect he could fix the problem by fitting a replacement engine along with it's flex plate and he has easy opportunity to do that because he has plenty engines lying around. If he ends up fitting a replacement engine I reckon that either the flex plate will be the fix or the engine without mega excessive crank end float would be the fix... and I expect my unusual diagnosis conclusion to be correct.
Interestingly enough, I hooked my scope up to my crank sensor a week or two ago, trying to find a reason for slightly lumpy running. Noticed that most of the signal spikes were the same amplitude, but three or four of them were higher. Took the cover off and very subtly tweaked a couple of teeth which weren't bang on parallel, and it made a big difference to the running. Bizarre, but hey.
My best guess is that the ECU looks for a voltage increase above a threshold, and the faster ramp time on the big pulses was causing it to fire ever so slightly early.
Beowolf said: "On a related note why couldn’t someone clone the functionality of a nanocom, which itself is a clone of sorts of testbook, by watching the signaling on the wire between the nanocom and the various ECUs? I realize that being able to see the digital signal doesn’t mean you can know the data payload. Exploring this has been on my someday list for a long time."
Simple answer to that Beowulf is that the Proprietary Protocols (particularly the handshaking) used are very difficult to 'reverse engineer'; Just observing the pulses is not enough... The EAS is (was) the 'simplest' of them all to 'emulate' of course, and even that took much inspiration/perspiration...the Engine ECUs are another matter entirely.
mace wrote:
Interestingly enough, I hooked my scope up to my crank sensor a week or two ago, trying to find a reason for slightly lumpy running. Noticed that most of the signal spikes were the same amplitude, but three or four of them were higher. Took the cover off and very subtly tweaked a couple of teeth which weren't bang on parallel, and it made a big difference to the running. Bizarre, but hey.
My best guess is that the ECU looks for a voltage increase above a threshold, and the faster ramp time on the big pulses was causing it to fire ever so slightly early.
I should have mentioned that I tried a couple of replacement crank sensors before reaching the conclusion.
The output from these crank sensors always give pulses of the same amplitude and the connecting wire to the ECU isn't a shielded wire, I expect the crank sensor on this vehicle contains electronics that clean up / filter the signal and always output the same amplitude pulse. There are 30 grooves on the flex plate for the crank sensor to pick up on (the crank sensor doesn't use ring gear teeth) set in 3 groups of 10, each group separated by a long uncut section. I expect that if the crank sensor misses a groove (due to seeing a double width pulse) it will count 9 pulses (instead of 10) in quick succession and then interpret the longer pause (due to the uncut section) before seeing a 10th pulse as a sudden drop in engine rpm, the rev counter and OBD readings certainly seemed to agree with this. Looking through the crank sensor hole I rotated the engine looking for any scars / debris / dirt, I did find some seemingly magnetic particles stuck to the flex plate and removed them, don't know if these came from a failed previous crank sensor or from the starter motor, same problem remained after I'd cleaned the flex plate best I could anyway. I got someone to crank the engine while I watched the flex plate, there was a little bit of run-out as it turned but I didn't think it excessive or enough to cause the problems. I considered trying to use a de-gauzing wand on the flex plate but working through the small hole the crank sensor uses I doubt I could have got in with a de-gauzing wand even if I could find one (probably last saw one my dad owned for tape recorder heads around 40 years ago lol) and if I'd have got it wrong with the de-gauzing wand could have created even more problems. Using my scope (and it's limited capabilities including it's low resolution small screen) I could only accurately see around 180 degrees of engine rotation at around 2000rpm but I ran the same tests many times and the double width pulse and engine symptoms only ever occurred simultaneously.
While I've been typing this the owner has txted me to say he's been to the specialist vehicle dismantler who has spent 6 hours changing crank and cam sensor looms and 'running various other diagnostics'. I asked if he'd used a scope to check the crank sensor pulses...No he didn't. He doubts the flex plate or crank float is the problem (even though he hasn't checked the long pulse) and suggests changing the main loom for £400. The owner asked me if I wanted to buy the car, er no thanks! I reckon I could fix it by changing the engine (and making sure the replacement engine comes with a flex plate) but I don't want to change another engine. On this model car it's almost just as easy to change the engine if the gearbox has to come off so I wouldn't just change the flex plate while I had it in bits I'd change the engine to rule out crank float and bearings at the same time as flex plate.
Thanks to all for the discussion. I know it’s a lot harder than it looks.
Is replacing the flex plate something worth doing when you have the engine out? I believe that it is. My spare engine, the one I’m rebuilding, doesn’t show any damaged teeth or cracks on the flex plate.
The Crank Sensor is just a basic coil, and there is precious little attempt to clean up the output, and as we know it can fail without producing a Fault Code so -IMHO- it is 'not exactly integrated into the Digital Electronics within the engine ECUs'. Again (with a pristine coil) the distance from the sensor to the teeth is probably the key factor. and similarly any detritus on the teeth will also affect the waveform produced, which (should) look like:
http://www.lanzo.se/auto/graphics/jag.gif (I would personally invest in a 'scope and/or borrow one before replacing the flex plate...)
EDIT: Had a quick (failed) look for the LR illustration for this signal for the GEMs, in the ETM IIRC (?), but the main point (as the the Jag/Pico diagram above illustrates) is that the peaks are not much higher that the base noise and so the possibility for false trggers is also high.......
davew wrote:
EDIT: Had a quick (failed) look for the LR illustration for this signal for the GEMs, in the ETM IIRC (?), but the main point (as the the Jag/Pico diagram above illustrates) is that the peaks are not much higher that the base noise and so the possibility for false trggers is also high.......
Please explain.. The peaks are way higher than the base noise from where I'm sitting?
It depends Mace/Miah on what you mean by 'way higher' there - as the base noise on that diagram is about 10V and the CKP pulses (only) about 12V - plus this is an analogue (magnetic/AC) system of course. Thus any fault - eg, larger sensor/tooth gaps, bent teeth, cracks in flex plate, detritus etc affecting that magnetic field can easily result in false triggers - eg. the (expected regular) pulse missing (in particular) or causing (less frequently) multiple pulses, thus confusing the ECU/timing.
Hope that helps, if I can find any illustrations (or photos) of a faulty CKP I will post that up !
davew wrote:
The Crank Sensor is just a basic coil, and there is precious little attempt to clean up the output
I was talking another make/model vehicle
The signal still looks very square even with the scope set on a faster time base but I didn't take any pics on faster time bases.
The engine symptoms (sudden multiple cylinder misfires) and rev counter reading fluctuation (also rpm reading in OBD live data) occurred simultaneously with the double width pulse, no double width pulse no symptoms, no symptoms no double width pulse. Tried with several different crank sensors fitted the results always the same. The fault and symptoms mostly occurred with pinj>9ms (> around 0.8bar map) and rpm > around 2K but it also sometimes displayed symptoms of poor starting.
Looks more like a (proper) Hall Effect sensor there Lpgc rather the P38 ('Reluctance') type ... but it still illustrates the problem very well, thanks !
Again if the problem on a P38 causes a 'missed pulse' or an 'extended/double pulse' it confuses the ECU no end of course; Bad design LR !!!
.
davew wrote:
It depends Mace/Miah on what you mean by 'way higher' there - as the base noise on that diagram is about 10V and the CKP pulses (only) about 12V - plus this is an analogue (magnetic/AC) system of course. Thus any fault - eg, larger sensor/tooth gaps, bent teeth, cracks in flex plate, detritus etc affecting that magnetic field can easily result in false triggers - eg. the (expected regular) pulse missing (in particular) or causing (less frequently) multiple pulses, thus confusing the ECU/timing.
Hope that helps, if I can find any illustrations (or photos) of a faulty CKP I will post that up !
Maybe I'm misreading that scope output, but looks to me like there is negligible base noise, and the teeth are triggering 4v pulses, with the tooth after the blank triggering a slightly higher pulse at 6v for some reason, perhaps double width?
? Think you misunderstood: I assume you are referring there to the 'scope photo by Lpgc Mace ?
Again, for clarification therefore the P38 uses an analogue reluctance (AC) CKP sensor (and produces a signal just like the one in the link in #12)
The one Lpgc posted in #15 is (probably) a Hall Effect (DC) CKP sensor in another vehicle/make.
However, and for further clarification, obviously somewhere within the P38 ECU the CKP AC signal is converted to a DC/Square Wave signal....
and it might well look like the 'scope trace, albeit depending on the specific nature of the fault on the CKP !
Like Mace I don't see much noise on your scope trace though Davew?
Ah, I see where you misunderstood: In this particular context of course the 'base noise' is (using your choice of voltage) the 4V signal and the Timing reference signal is the 6V spike (triggering a positive on the leading edge and a negative on the trailing edge of the tooth in the PICO/Jag scope illustration I posted).
The main point again though is that we are just dealing with a few volts (AC) here between 'states' (ie. between tooth/no tooth/ or even double tooth..) and this can be very easily disrupted, particularly by the tooth-sensor 'air gap'; It makes more sense if/when you see a faulty P38 CKP signal in practice... I have (had ?) a photo of this -somewhere- posted up years ago on RRsnet, via a storage scope IIRC (along with the ECM illustration,) but I am not going to try to search for it on there thanks to their almost-useless 'search facility' !
If you do scope it mace take a photo ....