A Prius ECT Spoofer MCU Controlled

You need access to 4 wires at the ECU to add this device.

winston.

 

This version monitors the temperature whenever it has power and will trip out at the 'window limits' . Its power is turned off when the car's ECU says so.

Expanding the useable SOC ,,,,, hmmm CAN messages manipulation maybe.


winston.

 

The ECT Spoofer presently does not have a case as the ones I was considering have been discontinued by PACTEC. I would suggest mounting it below the CD player somewhere to prevent the Airbags blowing it off into your face possibly with a light as the glass is not backlit .... oops the price just went up to add backlight leds.

In a Prius that DOES NOT use this device, failure is possible in the ECU, its connector, wire and even the ECT sensor that is screwed into the block. The ECU could see a voltage between 0 and +5V which it should handle by interpreting the voltage acording to the curve that I have partially generated and posted. Typically the Resistor and NTC series combination covers from +340 to -169 deg F.
The temperature readings control the fan in case the coolant on the input side of the block gets too hot, but the coolant Thermostat is off doing its own thing autonomously.
In a high speed accident if 12V ever makes it to the ECT wires running from the ECT sensor thru the firewall to the ECU then the ECU will probably blow up.

In a Prius that DOES use this device the ECT Spoofer will increase the the risk of failure because of the extra parts added to the system and if this design of the ECT Spoofer fails it is restricted to return a voltage between 0 and +5V to the ECU as it only gets 0-5V from the ECU. This design does not have a Fail Safe state designed into it in the form of T6 relays which will switch in a bypass jumper.

The 'kit' would include a jumper plug to bypass the Spoofer and there would be an obligatory fuse on the spoofer itself. The bypass jumper is applied by the user.

Adding T6 relays would increase the cost.
A redundant arrangement could be made by having a motherboard with protection switching T6 relays and TWO Spoofers tied togther via a private link, one would be running the functions and the other would be in HOT STANDBY ready to take over if the primary acts up.

The Heartbeat LED on the card would indicate that the code is working and the MCUs use sure start oscillators, brownout detectors, watchdog timers, power up timers, etc to make sure that the MCU gets going and stays running code.

A marketing aspect that came to mind is to sell this device as a Passive Temperature Gauge (for more dinero of course as a Temperature Gauge that is ECT Spoofer cpable shhh.... that is a secret hack) which the user can 'hack' into by adding a jumper and changing wiring to enable ECT spoofing. Hmm...... an interesting marketing approach.

winston.

 

We are not hacking into the manufacturer's code, the car's CPU is being fed with a modified analog voltage which it interprets in a way it was programmed to by the manufacturer.

 

Progress Notes
1.0 'CUT' Version. The 'CUT' version, which has the lead going to the temperature sensor cut, has been fully tested, the transfer curve for the NTC sensor has been captured and fitted using TableCurve2D and loaded into the micro. I took the time to generate PCB artwork as my buddy is not in town at the moment plus this project could not afford to pay him. I wired up another prototype and it works fine. A third prototype, the SD form factor version, works and highlighted a problem that it was not getting online quick enough and the car's ECU interpreted the 5V present as a malfunctioning NTC sensor and posted a check engine light. Pulling it resistively to some intermediate fixes that and gives the MCU time to get online while the car thinks about the 2.5V that it is recieving.
This version using LEDS needs very simple code to run as it needs less than 100 bytes of assembly code using a window sift technique to determine if Spoofing is required.
A Table remap approach could also be used but would consume an additional 64 bytes of space for the re-map table. No real problem as the MCU has loads of FLASH space.
The cost of building 5 day turn boards was not good so I let this version sit while I worked on the 'NoCUT' version in which the sensor lead. The plan was to come up with 1 design and PCB layout that could be stuffed differently to make both types.

2. NoCUT Version.
In this version, the Spoofer bridges across 3 leads, +5V, GND and ECT Lead. What this means is that the Spoofer has to sense the NTC sensor lead and then drive the lead, the problem comes when the lead has to be sensed the next time while it is being driven.
Releasing the lead and hoping that a reading can be sneaked is not a good plan as the car's ECU could be scanning it at the same time and I did not want to sync the two systems.

My next post will continue this and outline the solution that I came up with as this post could be getting long.

Winston.

 

2. NoCUT Version Continued.
The ECU in my opinion cannot be driven by a constant voltage source as it would become difficult to determine when the trip out point is reached so it was decided to drive the node with a lossy voltage source using the D2A driver in series with a fixed resistor whose value should be between 0 and some upper limit which will be established by the fact that the driven end cannot be lower than 0 volts or a little higher ( I used 5 clicks of the D2A). A dithering alogorithm was used to track the sensor output and fed back in software to hold the reading at +- 1 click (which is around 20mV). Rapid convergence is encouraged by going directly to the hex equivalent of the spoofed temperature ( I used 0x1D for 168 deg F) and then dither from there.
The value in the dithering register is an indicator of the actual emperature of the coolant and bailout occurs when the count is at 0x1D on the HOT side and at 0X05 on the cool side. There is no need to release the sensor drive to measure the true temperature and the count can also be remapped into a temperature reading for display. When the need to bailout from the window spoofing area the D2A is put into tri-state.
The code was ported from the PIC16F914 to the PIC16F960 and lately to the PIC16F684 The algo works fine and I went ahead and generated the PCB artwork for all 3 versions using a program called Eagle PCB from CadSoft for which I had to Pay $49 + taxes for a Light version. The PCB size for the LED version is 1.5in x .9in about the size of a SD memory card.
The 690LED version of the Prototype PCBs have been ordered on a 2 week turn and are due in about a week.

Winston.

 

The routines as I have them are working fine without me having to release the driver to gather the real temperature. The LEDs give an indication of the range and is confirmed by the heartbeat rate. It has been working fine for the past month while I have been learning how to drive the PCB123 and the Eagle PCB layout tools.

I see no need to explore your route as I have another device that I want to continue developing.

Ambient temperatures have no effect on the MCU and the D2A driver as it works fine from 32 to 85 deg F so far

I also tested its supply sensitivity on the bench and it works finedown to 2.5V.

Winston.

 

I got the CUT version to work fine months ago. Check my earlier posts.

Winston.

 

The D2A that I use is a Microchip MCP4911 which is a real D2A it is not poor man's emulation using a PWM circuit, a friend also suggested that I go the PWM route . That 10 bit D2A with 1/2 LSB D2A costs $1.05 in 100 piece pricing and it is tri-stateable.

Winston.

 

The D2A chips these days are inexpensive, high precision, I2C ,or SPI , multiple per package, etc, etc. I have seen them up to 22 bit but those are pricey.
The PCB tool I used Eagle, its library of parts are a little short and I had to create symbols and pcb footprints for the board.
Analog Devices have a number of parts including parallel parts.

 

Here is a PDF print on 8.5x11 (aprox) to indicate the size of the prototype pcbs that are being built.

BRD Photoshop pictures from cars photos on webshots