Crank / Cam Signal Emulator

[kidturbo]

Ok I'll keep experimenting then. I can say that a FPR gets F_ing hot really quick with no fuel flowing through it.. Key on 5 minutes, and you couldn't touch that little sucker..

Goal for tonight is test the driver input modes 2,4HI,and 4LO to see how those tables actually interact. Then I'm moving onto CANbus data fuzzing to see if I can isolate the traction control / torque limiting commands fed to ECM from other modules. Got a little side project in the works.

 

[THEFERMANATOR]

Also noted that ECM is adding or subtracts up to 150us to each individual injectors pulse, even though it reports as 3900us.

I'm guessing your injection amount differences is the injector flow rate data programmed into the ecm. Maybe try programming the ecm with a tech 2 and put the same value into all 8 spots and see if that evens it out.

 

[kidturbo]

That's a good idea I'll give it a try and we'll see.

Here is one for ya. I always thought there was only one LMM OS and pinout.

When I was trying to test the torque tables of 4wd mode, I realized the ecm 4lo signal wires listed in pinout were not in harness. So I added them. Then discovered the pin has 12v sipply on it now.

Seems there must be a different OS for trucks with Floor Shift transfer case. The GM pinout it has a (NQG/NP2) designation on that circuit. Testing tonight on a buddies truck with 4wd shift dial I found the ecm is notified by canbus message. So, now to locate that other OS..

Sent from my SAMSUNG-SM-G890A using Tapatalk

 

[darkness]

I wonder if the different os’s are associated with having factory trailer brake control or even where the 2/4wd switch is mounted? But not limited to just those 2 things.

 

[kidturbo]

Best I can tell, it has to do with the floor shift version being manually controlled and not computer as all others. The harness lists two wires, half shaft and 4Lo sensor. So guessing they used simple switches to inform ECM what position the case is in.

The OS I'm testing, P/N switch and Brake switch are both hard wired to ECM. Even though both those are available in canbus data. So,, unless somebody has a copy of a floor shift OS I can examine, think I'll need dig up a VIN from such truck and load one with Tech2.

 

[2004LB7]

What does the schematic show? Does it indicate that the pin gets grounded to activate or supplied voltage to activate?

 

[kidturbo]

I don't have access to the complete harness diagrams, only ECM connector pinout I had saved.
The circuits in question are ECM connector X1-57 [1694] & 82 [1695] if anyone has the ability check those #'s.

 

[THEFERMANATOR]

The switch on the transfer case is a 3 wire switch, it sends 12v+ out for 4x4 to engage the front cad and to tell the ecm its in 4x4, and it sends a ground signal to the ecm when its shifted to 4 low. As far as I know from those that have done swaps, either OS should work with either one, but only the OS with the correct segments will send the signal to the cluster to illuminate the clusters 4x4 light(push button just uses the lights in the switches). So having power on the 4low pin sounds right as its looking for the switch to pull it to ground.

 

[kidturbo]

Thanks for the details. I only tried grounding one pin at a time while watching the State position in EFIlive. Maybe it's a combo deal requires both pins grounded together, cause I was mostly playing with the 4Lo pin here on the bench.

Looks like this pinout "option" was only on the E35B version, cause E35A shows same pinout without the (NQG/NP2) on those circuit lines.

If you have a chance, take looks at those state switches with a scan tool on a LMM manually wired up and let me know what you see.

 

[kidturbo]

What does the schematic show? Does it indicate that the pin gets grounded to activate or supplied voltage to activate?

Found it, see attached..

Yeah it's switched to ground, and this ecm OS isn't responding to those input signals. It receives the transfer case gear position over HS GMLAN from the 4WD Control Module.

Verified the canbus side of this last night by capturing the data off my buddies 08 3500 with regular knob shifter. Was able to isolate the TC status data set, then played it back to my bench ecm while monitoring State 07 with EFIlive. Also saw the fueling change when I fed it a 4Lo status. So 100% positive there is a different OS for the NQG case designation. Now to find it, or locate the pinout option in raw bin and create CAX file to change it...

 

[kidturbo]

The switch on the transfer case is a 3 wire switch, it sends 12v+ out for 4x4 to engage the front cad and to tell the ecm its in 4x4, and it sends a ground signal to the ecm when its shifted to 4 low. As far as I know from those that have done swaps, either OS should work with either one, but only the OS with the correct segments will send the signal to the cluster to illuminate the clusters 4x4 light(push button just uses the lights in the switches). So having power on the 4low pin sounds right as its looking for the switch to pull it to ground.

Ok big thanks to Mark B for supplying me a stock (NQG) tune file, which helped sort this out. While both tune files share same OS# 12628594, checksums are different. And it controls more than just the 4WD pins I've found..

Fermanator your description is correct. Took me a minute to catch it, cause as you stated, the 4WD axle signal [82] is looking for 12v, then you ground the 4WD Lo signal line [57] to switch into LO Range tables. In that order..

Rather than go way off topic here, I'll start a new thread under swaps with details on these calibration differences. This looks well worth exploring further, specially if your into stuff like programmable launch control for a $1...


Post new link here shortly.

 

[THEFERMANATOR]

FYI, for swaps it is best not to connect the 4 low signal to the ecm I found. I kept tripping a p0500 with mine everytime I went into 4 low. I found in 4 low the ecm looks for a secondary speed input to verify the vehicle speed against. I ended up killing the p0500 code because I got tired of clearing the code whenever I used 4 low. I also found I got some really weird defuels in 4 low that I didnt get in my donor, and I had to max out the max torque tables for the shafts to get any power in 4 low.

 

[kidturbo]

All those points I have been able to replicate on the bench over past 24hrs.

With the crank cam Sim, and some recorded canbus data from short drive in a buddies truck, I have it pretty much sorted out. But my crappy ISP had me unable to post anything till now.

Your correct the torque tables, BTM, and speed limiters all come into play when you ground that 4LO pin. But once you see it live, in a bench setting where can hold rpm, throttle, and speed for unlimited periods, was pretty easy to get the flow figured out. I see lots of potential actually.

That speedo thing I'm still working on. Thought I had that one sorted out couple years back in a post here about using GPS input on VSS high. However, it's got me stumped now.. What the V2 pid shows its reading, doesn't correspond to what the ecm is accepting, or broadcasting to the BCM. Little sucker keeps kicking out the hard wired pulse and wanting a canbus speed from the TCM. Which in turn controls both speed limit tables in the tunes. Soon as I learned to give it signal the way it wants, all those limit became active. IE: 38mph factory cutoff in 4LO.

Ok back to starting new thread on that topic. The little simulator is the bomb for next level tuning. Andrew is sending me a full set of LMM injector solenoids to finish my bench build. I should be able to get running live with no DTC issues in factory tunes. Then we can really play with this dyno in a box..

Sent from my SAMSUNG-SM-G890A using Tapatalk

 

[2004LB7]

What kind of load does the ecm think it is under while running? Obviously it has zero load. Is it just a calculation of rpm and mm3? Or does it need VSS to calculate it? Its been awhile since I've looked it up

Wondering what it would get if you ran the MPG pid on it like this, but you'll definitely need the speed sensor for it to work

I know it is pointless to measure them with a setup like that but I am curious

 

[kidturbo]

Actually all good points. And I was just getting ready to dig up the old MPG pid to try and calibrate a GPH meter to go in the boat.

Depending on which tune, load is calculated off RPM, TP, MAP, and MAF. So it tracks just like it would in a truck on the bench. However in the speed density tune it never exceeds 50%. So MAF signal plays a big role in it. Those results are same on bench as we're on dyno.

Sent from my SAMSUNG-SM-G890A using Tapatalk

 

[kidturbo]

Ok here is link to the (NQG) related topic.

https://www.duramaxdiesels.com/forum/showthread.php?t=81937

Now back to fudging CANbus packets.. Discovered the transmission DeFuel On Shift packets pattern last night. Aw the fun I could have screwing with my buddies who leave their BT dongle connected all the time... :rofl:

 

[kidturbo]

Score!!

A full set of LMM injector solenoids, minus a few alignment tabs. As they say, one man's junk is another man's treasure.

Thanks Andrew G.

Sent from my SAMSUNG-SM-G890A using Tapatalk

 

[kidturbo]

These cleared all the injector codes.

However the old Pyramid inverter couldn't handle power demand to fire em. Once I hooked up a battery, they danced around on my desk like jumping beans...

Its cool to hear the differences in pattern when pilot shuts off. Think if stick a piece of aluminium tube though these in correct firing order, I can make the world's first Duramax ECM powered rail gun...

 

[kidturbo]

On a side note, I've been unable to replicate the high RPM misfire issue we experienced on the dyno, and attributed to signal interference on the crank / cam lines. I've even wrapped the signal wires around a couple injector magnets, no luck.

Haven't hooked the scope up again yet, but guessing the duty cycle on this emulator is higher than what an ECM produces off the actual sensor, so it's not as susceptible to the interference. I even tried loading a solenoid by making one lift a screwdriver at 3800rpm, still, wasn't messing with the ECM enough to log a misfire..

 

[DAVe3283]

It could be the duty cycle, could be the drive strength of the emulator is higher than the real sensors. If you want it to freak out, you could put some resistors in line with the emulator outputs. Start with 1 ohm or so and start going up until the ECU gets unhappy.

This is a cool experiment you're running. Thanks for sharing the details as you go along!