Type 2 in Z32 for R33 RB25DET pinouts - document

[crans]

Series 1.5 is real its a series 1 body with series 2 engine. I have no ignitor pack and a shitty looking bonnet so is a crossover betwen the 2 series.

[Eric]

@crans: I had a look at the file and it looks like it is running the safe/knock maps (as you already figured out) with a few more degrees ignition pulled.

So either it detects (false) detonation or something else is wrong.
(I presume you have no DTC's show up ? )
Have you checked the actual engine timing with a stobe light is the same as what the ECU thinks it is ?

If that's the case, check what happens if you set the values in the last row of the knock ign. maps to 7-8 degrees.
Also I'd change the TP-MAX table values to have lower (or the same) values then the TPLIM (TP LOAD LIMIT) table.

I think the Z32 ECU handles these tables slightly different compared to the R33 ECU.
the Z32 ECU/code will first check the TPLIM table, then the TP-MIN and lastly the TP-MAX tables.
So I'm not sure what happens if the values in the TPMAX are higher then the TPLIM

-Eric

[crans]

I had a chance to work on my car on the weekend,

I removed the wire on the loom that goes to the fuel temp pin and installed the Z32 ECU with a 2.2k resistor for the fuel temp. I started the car and opened Nistune, the fuel temp sat at 23 degrees, no DTC codes.

With that fixed I warmed it up and took it for a drive. Everything was looking sweet, till I accelerated hard in second, around 4500 it lost power and went onto the knock maps. Seems to be detecting knock. The tune I was running had a max of 15 degrees under full load and it was a cold day, I figured it should not be knocking and it was running good with the stock ECU.

I then synced the fuel and timing to the knock maps and tried again. The engine consistently pulled through to redline, fuel mixtures were spot on and it didn't get any worse after 20 minutes.

This seems like a good enough fix for now, but I do not want to lose the safety of running knock maps.

Would changing the knock sensors be enough to fix the problem?

I also recall that the R33 ecu didn't have a knock board like the Z32...

[Torque]

I had a chance to work on my car on the weekend,

I removed the wire on the loom that goes to the fuel temp pin and installed the Z32 ECU with a 2.2k resistor for the fuel temp. I started the car and opened Nistune, the fuel temp sat at 23 degrees, no DTC codes.

Hi!

Glad my observation was helpful.
The pin36 (grey cable) goes actually to the Fast Idle Circuit .. not fuel pump.

As for the knock detection try removing one knock sensor (just cut one cable at the loom)
The Z32 ECU mod runs the R33 knock sensors in parallel .. I don't know if this helps ... it's just a thought.

How is idling after cold start?
I have a bit of a rough engine run after about 20secs .. rough idling goes away after the engine reaches about 60C.

[Matt]

Well the R33 and Z32 do use different part # knock sensors

One option is to try a single knock sensor and would be interesting to see if having two sets of knock noise going into one input causes more false positives. I suspect it may not since the amplitudes may be the same, and it will produce a square wave output regardless - but then the knock sensor board may be getting confused also

Z32 ECUs use the same knock sensors as SR20s, so that would be option #2

[crans]

I have no problems with cold start, idles high when cold, then settles down when warmed up. It has a slight tendency to want to stall at times when the rpm drops quickly.

[Torque]

Well the R33 and Z32 do use different part # knock sensors

One option is to try a single knock sensor and would be interesting to see if having two sets of knock noise going into one input causes more false positives. I suspect it may not since the amplitudes may be the same, and it will produce a square wave output regardless - but then the knock sensor board may be getting confused also

Z32 ECUs use the same knock sensors as SR20s, so that would be option #2

Hi ...
I always though knock sensors produce some kind of sine wave around 15khz?

[PL]

It's pretty much just a burst of noise. But yeah, more sine than square. Should be around the 6Khz area according to all I've read. Plus a raft of mechanical noise...

PL

[Torque]

Yes .. the frequency seems dependent on the engine design.
And the waveform is a bit of a noise sine pattern.
http://www.picoauto.com/waveforms/Senso ... ve121.html

If you put 2 sine wave generators in parallel sine waves cancel each other out.. (depending on phase)



Could somebody please have a look at how the 2 knock sensors are connected at the genuine R33 ECU?
(I would do it myself but my ECU is 1000 km away)



Matt told me that he was unable to locate the ECU-register / memory address that
indicates a knock event.

That's a shame .. since this would be very helpful.


Cheers,

Andrew

[Matt]

R33 ECU wont help, it all goes into small orange modules which have the circuitry in it, same with the S13 SR20s

The best which would help is a S13 CA18DET or R32 RB20DET ECU which has the big Hitachi external knock sensor board - and takes two knock sensor inputs

With these I resistored one of the sensor inputs and put the other knock sensor input on a knock plate (SR20 knock sensor btw since thats all I had) and then bang the plate, this causes the sine wave similar to that link on my scope. These waves go into the knock sensor board into some chip, magic happens and a single square wave happens and comes out of the board for each spike which is detected as knock

I very much doubt two signals in parallel would cancel each other out (if they did then the ECU would report less knock rather than more which is occuring)

[Eric]

>> if they did then the ECU would report less knock rather than more which is occuring..

My thoughts exactly.
I'd assume connecting 2 knocksensors to one input rather has an amplifying effect more than it has a cancellation effect

Like Matt suggested, disconnect one of the knock sensors and see if anything improves.

[PL]

I suspect feeding 2 inputs in would have the affect of increasing effective amplitude because in phase signals will add and out of phase signals will subract. But the knock sensing circuitry would probably just see the peak from the signals that add.

There's a lot more to it than this because there's input filtering involved in any knock detection circuit. As well as timing for the knock window. It gets difficult very fast. I've dug out a few interesting documents on knock sensing. I'll upload them to my website next time I'm doing updates. But it gets very complex very fast!

Matt and I have both put considerable effort into knock sensing/detection. Myself mainly from a tuning point of view ie: how can I best monitor knock while tuning whether via NIStune, other electronic means, or just some sort of aural method. And Matt has done extensive bench testing and code dissasembly to try and work out a way to extract knock information from the factory ECU.

The main problem in the ECU's is that they all do it differently. Matt has made some progress on some ECU's. But this information is of little use on other ECU's. And extracting any sort of data has proven quite difficult. I know that eveyone thinks that there must just be a number somewhere indicating knock levels - and we thought that too. But after Matt spending hours going through code and trying to simulate knock on the bench it's proven rather elusive to say the least.

PL

[Torque]

I know that eveyone thinks that there must just be a number somewhere indicating knock levels - and we thought that too. But after Matt spending hours going through code and trying to simulate knock on the bench it's proven rather elusive to say the least.

PL

Yeah ...exactly what I though, the ECU must read some register where it detects knocks.
It must be hidden quite nicely within the ECU's code.

Must be a nightmare browsing through all these instructions.
How far has the code been dissembled anyhow?

Do you people have the full memory and address map?
(I mean for the custom chips and ports?)

Is a lot of it interrupt driven?


Cheers,
Andrew

[PL]

All questions for Matt I'm afraid. You're more likely to find me detecting detonation with a set of det cans on the dyno than in the code....

PL

[Matt]

Thats correct on the Hitachi ECUs there is a register which is read which has a bit set to '1' when knock is detected. This is then used to maintain knock counters. I added my own counter which is read via a new consult insturction and then reset. That way the application can read the counts at its leasure without timing critical reads required

I have found most of them on the Hitachi ECUs which are the ones which currently have knock support (except for Z32 which has still escaped me. Might be since its relate to the JECS ECUs and knock circuitry is done differently perhaps?)

I was able to test this by bypassing the knock sensing board and send a square wave signal directly into the chip which takes the signal normally from the board. This then set a bit on the knock register for me to confirm

The Mitsubishi (JECS) ECUs have an imbuilt filter circuit and I am unable to intercept directly. I am also unable to know with the registers I have suspected if they work, since the filter circuitry may be filtering out my attempts to simulate knock with frequency generators

Yes its a nightmare. How far with which code code? There are about 70 different ECU part numbers for nissans that I deal with. Each code base varies (hence so does the disassembly). I've done basic disassembly (maps and consult addresses) on most of them, and then look into it further as required

Some others like Eric (eg Z32 VG30DETT) and Dave (B13 SR20DE etc) from tunercode have done a tear down on a particular ROM image to see how they work in more detail

No one has a complete memory map/address map from what I know. Parts in these ECUs are ASIC (application speciifc interface chip) so many of the registers are not known. Most of my knowledge comes from the basic consult information (reverse engineered from Techtom unit and published by PLMS) and map information (reverse engineered by the Japanese in ROM editor and associated GRID tuning packages). Working out also from patents in addition to the basic information from the maps you can start figuring out what the code is meant to do

There is an interrupt table in the various ECUs and the vectors are used. For example consult runs from the SCI vector, injection code on RB30 runs from the multipurpose ASIC A/D converter interrupt which takes in CAS signals and processes from there. It tends to vary between various ECUs but most of the maps and functionality remains the same which is good