# Bypassing ECU & RPM Generation



## edharvey (Apr 18, 2012)

Hi Everyone

I've done some reading here about how to go about faking signals to ECU's. I have started work on a 97 Honda Torneo (Accord). I'm hoping that I will be able to make it think the engine is going just by re-creating the RPM signal?

Assuming I do manage to do this, is the general concensus that the stock RPM meter should be replaced with a custom one? The reason I ask is that if I simply read the electric motor RPM into the ECU, my electric power steering and electric brake pump will cut out when the vehicle is not moving. This usually wouldn't be such a big deal but a situation could occur when the vehicle is coasting downhill with no power applied to the motor with the clutch in.. In this case the ECU would think the engine was off..

One obvious way to prevent this would just be to generate a set RPM signal, however this would cause the dash rev meter to be incorrect, hence I ask if replacing it with a custom rev meter is the best idea.

Sorry if this has been answered elsewhere, thanks for your help.


----------



## bjfreeman (Dec 7, 2011)

I would put an AVAR, that would generate a signal that approximates what the ECU expects. the AVAR input would come from the RPM signal of the motor so the Out put of the AVAR would vary according to the Motor RPM.
so zero RPM from the motor would be 700 rpm(idle) to the ECU


----------



## edharvey (Apr 18, 2012)

Thanks for the reply, only I'm not too sure what an AVAR is..? The important thing is the method though and I'm sure I could manage something like that with some sort of micro. So back to my last question, you would recommend replacing the stock rev meter and fuel gauge etc with custom gauges? Or rewire them in some way, obviously it would be ideal if the rev meter displayed the actual motor revs rather than the simluated ones.

Cheers


----------



## bjfreeman (Dec 7, 2011)

edharvey said:


> Thanks for the reply, only I'm not too sure what an AVAR is..? The important thing is the method though and I'm sure I could manage something like that with some sort of micro. So back to my last question, you would recommend replacing the stock rev meter and fuel gauge etc with custom gauges? Or rewire them in some way, obviously it would be ideal if the rev meter displayed the actual motor revs rather than the simluated ones.
> 
> Cheers


apologize AVR is a micro with Analog and Digital lines. so with one like the Arduino or the OLIMEXINO if you need more pins and the Canbus you can accomplish all of that.
as a start look at 
http://www.diyelectriccar.com/forums/forumdisplay.php?f=16


----------



## edharvey (Apr 18, 2012)

Ok, cheers. I've had a go today with a function generator driving a sinewave signal into the ECU. I think this is the right way to go about it? According to my Haynes manual the crank position sensor is responsible for generating the rpm signal, do you have any intuition as to what amplitude and frequency this may be expecting?
The sensor that I am assuming is the crank position sensor (from looking at the disassembled engine parts) is this one here:

http://gzhaoxiang.en.alibaba.com/pr...osition_Sensor_37840_PAA_A01_029600_0500.html

Although these are referred to as 'cam position sensors'. Is it possible that one would sense cam position and one would sense crank position?

Anyway it looks like these are magnetic sensors, so I assume that generating a sine wave signal won't solve the problem?

Sorry I'm a bit lost on this, engine knowledge isn't the best!
Thanks again for the help


----------



## edharvey (Apr 18, 2012)

Here's an update: Today I've tried everything I can think of to get it going. For a start I used a function generator to create a sine wave of around 2.5V peak to peak. I varied this signal from around 200Hz to 800Hz, no luck. Next I tried attaching the magnetic sensors (that I assume are the crank position sensors) to a bracket with an electic motor attached that spins a piece of metal in front of them. This was generating up to about 20V peak to peak at around 300Hz (from the magnetic sensors). No luck from this either.
I next tried generating a higher voltage signal from the function generator at about 400-800Hz 15V peak to peak. Still no luck.

It doesn't help that the Haynes manual that I have is actually for the accord (they don't make a manual for the torneo F20b engine). These vehicles are very similar but I'm not too sure on some of the details..

I pulled the ECU out today and googled the part number, came up with almost no results so no chance of getting any data on it I don't think.

Would be keen on just pulling the ECU out but I'm not sure if this will just give more problems with respect to EPS and ABS control. I think these systems have their own control modules, but I assume these are enabled by the ECU/PCM once it detects an rpm signal.

Any ideas from anyone who has done a similar thing would be much appreciated


----------



## drgrieve (Apr 14, 2011)

Sorry I can't offer much help except from previous build threads I've read folks record the signals while the stock car is running.

Is it possible to find someone with the same car and record their outputs?


----------



## electricmini (Oct 21, 2008)

edharvey said:


> Hi Everyone
> 
> I've done some reading here about how to go about faking signals to ECU's. I have started work on a 97 Honda Torneo (Accord). I'm hoping that I will be able to make it think the engine is going just by re-creating the RPM signal?
> 
> ...


Try re-creating the vehicle speed sensor's input, not engine rpm.
The power steering pump and brake (ABS pump?) systems would base their behavior on this sensor, as it's related directly to vehicle speed without needing to know what gear the car is in. 
At least, this is how the Supra's systems work...

Also, you might need to fool the ECU into thinking that you've started the engine (e.g. activate the starter, then give a cam position signal that replicates the engine idling normally) .
You'll probably need to fake a whole bunch of other signals too, depending on how much stuff the ECU does(is it "all-in-one", or does the car have several different ECUs that don't really communicate much (like the Supra) ?)

It's quite likely that the rpm signal is actually created by the ECU, to operate the rpm gauge in the instrument cluster. the ECU knows what speed the engine is turning at by looking at the cam position sensor,
then it knows when to fire the ignition coils, etc.


----------



## edharvey (Apr 18, 2012)

Thanks for the help guys, in terms of the speed sensor, I assumed this wouldn't make any difference as at least the power steering is usually still active even if the vehicle is stationary? I agree that they probably do have speed inputs, however I think in my case at least their systems should still be switched on at idle. I currently have the EPS and ABS lights showing on the dash, before the engine was removed these would usually switch off after the engine started..
You may also be right about re-creating the cam position sensors etc, I did read another post here about a 2003 Mazda that also needed coolant sensors displaying correct readings.
At this stage it seems like a big hassle when I should't really even need it, there may well just be a 5V logic line going to the seperate ABS and EPS computers instructing them to switch on when the ECU detects RPM.... Perhaps I will try to follow these wires and recreate the signals (without setting the airbags off in the process).
I'll let you know how it goes.

Thanks again


----------



## bjfreeman (Dec 7, 2011)

Think of the ECU, EPS, ABS as AVR's with special tasks. Each digital and analog inputs/outputs. Between them they use Can bus ODBII.
So i would start by reading the ODBII codes
I think the speed sensor would be a pulse (non sinusoidal) of a certain width 
if you can find a cooperative mech and they service this type of car you can remove sensors and see the ODBII codes that get generated.


----------



## edharvey (Apr 18, 2012)

Just as an update here (incase this will be useful in the future), I have bought an OBD2 reader to at least find out if the ECU is receiving my rpm signal. Unfortunately the reader that I have bought doesn't work. I've tried it on three vehicles all later than 1997 and no luck. Will let you know if I have any luck once I get a replacement.


----------



## bjfreeman (Dec 7, 2011)

best of luck.


----------



## edharvey (Apr 18, 2012)

Hi Everyone

It's been a while but I thought I'd update this in case anyone has this problem in the future, because there certainly seems to be a lack of definitive information about it...(maybe I've been searching for the wrong things..)

Anyway. First I'd just like to make a comment about my search for OBD2 readers. It turns out that if your vehicle is not OBD2 compliant then things can get difficult and expensive pretty quickly. I originally thought that my car (1997 Honda Torneo/Accord) was OBD2 compliant as it was made after 1996.
After all many of the OBD2 readers say "Works on all vehicles 96 and later" After buying two of these standard OBD2 readers, with no luck, I realised I hadn't really done my homework properly. It turns out that only American vehicles are OBD2 compliant after 1996. Europe adopted this standard in 2001 and Japanese vehicles are all over the show by the sound of it. I have tried the OBD2 readers on my vehicle along with a 1997 Toyota Caldina, a 1997 Subaru Impreza, a 1997 Mitsubishi Legnum and a 2003 Toyota Rav4. It worked on none of them... As none of these vehicles are actually OBD2 compliant even though they have the same looking plug.. They are all using variants of manufacturer based standards.

After I found this out, the best bet seemed to be a scanner called the VCS or "Vehicle Communication Scanner". They are on Ebay for around $200-$300 USD, so a bit dearer than the cheaper standardised OBD2 readers but apparently are suitable for over 40 makes of vehicles. I was finally able to connect to my car with this scanner, although I have found the software provided to be of quite poor quality. It may just be my computer/vehicle but it tends to freeze after 10-30 seconds every time you try to display live data and requires the USB cable to be pulled out and put back in again.

Anyway.. After getting this scanner I was able to get back to the problem at hand. One of the first things I noted was that I could still connect to the EPS and ABS modules, even when the ECU was removed from the vehicle. I was pretty impressed with the amount of data retrievable from these modules, individual wheel speeds, brake and handbrake positions, ABS solenoid status etc were all available for live data display. The most interesting however was that the EPS module had its own value for RPM, suggesting that the ECU actually fed this to the EPS module rather than simply 'telling it to switch the power steering on'. I was able to find a simple pinout for my ECU on the internet, (I will post the link on my website as I don't have the copy here at the moment, see link below). This website seemed to have most models of vehicles so could be handy for someone doing this as well. After I located this pin, I basically guessed a wire that I hoped was ground as this was not noted on the pinout. (It was a thicker brown wire slightly separated from the rest on the plug). After attaching a function generator to these two wires I experimented with a few different values and finally heard a relay click on, sure enough the power steering was on! There was however still no value on the dash RPM meter. My VCS was noting RPM's wildly varying from -2000 to around 20000. After trying a few different settings I found that the signal had to be a square wave varying from around -2.5 to +2.5 volts at about 80-100Hz (a sine wave may work as well) to give a reading of about 3000RPM if I remember rightly. (This can be determined easily by experimentation.) Although the previous input had switched on the power steering, it had obviously only temporarily registered a suitable value. 

So at this stage, I have the power steering working nicely and the ability to control the rev gauge by simply varying the function generator frequency. I'm not sure if I will need the ECU but at this stage I'm dead keen to just get rid of it as it seems clear that these other modules and almost certainly the ABS and airbags will be quite happy working without it. I will still have to figure out whats happening with the vehicle speed sensor, the ECU may receive this value and send it straight to the dash.. Hopefully not, but even if it does I should be able to manipulate this somehow.

I'll let you guys know how things go after I do some more work.
Cheers for reading


----------



## bjfreeman (Dec 7, 2011)

I apologize for not explaining more.
the ODB2 is not the same as the signaling used to control circuits.
ODB2 and the extended codes are to report and change parameters, not control.
the +- voltage may be what is known as RS 485 or RS422 signaling. these require two wires to work.
The +- is used to reduce noise interference.
they also my be using Edge sensing, instead of voltage sensing, so a square wave is necessary for faster response. A sine way may not have the right slope for quick response.


----------

