Skip to main content

Inside stuff - Racechip car tuning thingie

I bought my unit half a year ago, so you can say I have plenty of experience using it. It functions as a man-in-the-middle between the ECU and the injectors. I believe it alters the injectors' on-time and perhaps even the timing with regard to the TDC.

See also: http://hackcorrelation.blogspot.de/2016/04/racechip-tuning-box-part-2-reverse.html

Short review


I wanted to lower the consumption of my 3L V6 diesel engine to slightly more frugal values, don't care as much about power. Sure, some extra low-end torque would be nice as I feel my particular car is lazy in shifting up.

Well, to my surprise, the unit actually does something, so it's not just a random box a la OBD-tuners. By the way, you cannot tune an engine through OBD, the engine protocol is filtered out by a gateway. Just some diagnostics are allowed through.

The highway mileage improved from 8L/100km (30 US MPG, 35 UK MPG) to less than 7L/100km. With the default settings (the unit can be adjusted) the low-end torque has also improved, as it was pretty sluggish under 1700 rpm.
However, the city consumption went up from ~10L/100 (23 US, 28 UK) to 12-14 liters, quite a bummer. More interestingly, the engine idle consumption increase was the noticeable one, going from 0.8L/h to 1.2L/h, that's the fuel you use while stuck in traffic or at traffic lights.


I've increased the settings on the adjustment switches (see images below) to some random values and at one point I got the yellow 'check engine' light, so I had to decrease the values. I also got the warning light under heavy acceleration while using a bad(?) fuel. Stopping and starting the engine 'fixed' that. Also the engine sounded 'harsher' with more ticking, like a really cold Diesel.
I could refer to this setting set as 'Performance/Highway'.

I wrote to Racechip support asking for a set of recommended values for lower city consumption and they responded [after a week] with two new values that are to be dialed in. These new values were a lot lower than their default ones and produced a noticeable difference. This time the engine revved up much higher before up-shifting and idling was really smooth with no noise or vibrations. However, city consumption was still a bit higher than factory.
I could refer to this setting set as 'Quiet/comfort'.

I wrote to them again but this time I didn't even get a response after one week.

Teardown


From the outside the unit is a plain ABS (glass-reinforced?) box with decent weather sealing. Installation is pretty straightforward and takes not more than 5 minutes. The mainboard slides out by unscrewing two T10 screws on each side of the connector.

That is also the only way how you can get to the adjustment dials.






The PCB is pretty simple, probably dual-layer and hints that most of the complexity is contained within the firmware.



From the upper left, going clockwise

  • two KDR162H hex-coded rotary DIP switches
  • Microchip MCP6004 standard op-amp
  • 4x SOT23-3 transistors or diodes, though they might look like SOT23-6
  • DB15 male connector on the right side, though only 6 to 8 pins are used
  • power input stage with a few diodes and a 78L05B voltage regulator
  • there's also a Zener diode going straight to a uC pin, not sure of it's purpose
  • STM8S105K6T6 microcontroller, 2K RAM, 32K Flash, 1K EEPROM, 16MHz
  • 10-pin programmer header on the lower left
I won't try and to a full reverse-engineering now, we'll just focus on the principle of operation.
The numbering on the uC starts with pin 1 marked with the black dot and counts up counter-clockwise.

Most of the pins are broken up to a point on the PCB, the RX/TX pins go the the 10pin header.

Pin 10 (PA5) goes to the Zener diode.

Pins 17-20 (PB1-PB4) seem to go to one of the DIP switches while 30-33 to the other one, but I haven't traced the connections yet.

The quad op-amp seems to be fully used and connected to the 4 transistors nearby.


Here's on first glance on how I believe it functions:
EDIT: ignore everything with strikethrough, see the first comment and my reply.

There are four output channels but in my car only one is used. That's because the connector has only 3 wires, out of which I assume one is power and one is ground. It might be possible that the op-amp is used for summing up signals to form a rudimentary DAC, but I doubt it.

The uC is intercepting the signal coming from the ECU, running it against a table look-up and outputting a modified signal. Obviously it cannot know the pulse length until the ECU has finished transmitting the injector pulse - and it might be too late to output a similar one - so I assume the box records the signal, passes it unmodified to the output and on the next rising edge it injects its own signal. So this might mean that the output transistors are there to switch between the car signals and the tuner signals.

The above might sound slow but in reality there's probably no discernible difference between reacting one RPM later than the car would.
Assuming that a V12 engine turns at 8000 rpm that means 1600 'sparks' per second, or 1200Hz. Even with spent-spark functionality in a petrol engine that doubles the frequency to 2400Hz. A microcontroller running at 16Mhz should easily be able to handle 10Khz, with time to spare.

If the signal wire also carries some binary information (which injector to fire) that would probably raise the requirements to hundreds of kHz. Need to research some more on the TDI signal structure.

Anyway, the uC receives the injector signal, maps it to a lookup table or a function (with parameters determined by the dip switches) and on the next cycle it outputs the modified signal. The timing of the signal can be derived from the previous pulses so that the injector can be fired before or after the 'normal' time. It would then also modify the injector time (more on-time means more fuel).

One of the DIP switches seems to affect the RPM range in which the unit functions, according to some comments on the Internet. The other one is for 'power'.

Edit: The unit intercepts the common rail high pressure transducer analog signal (G247) and alters it. You can search for SSP 350 and SSP 351 to get an understanding of how the rail pressure interacts with the other injection components. The engine's characteristic curve is also selected based on rail pressure so this is a poor man's way of doing remapping.

I still need to get the 'before' and 'after' traces to see what the unit is actually doing to the signal, but I assume that with 'aggressive' settings it sends a lower than actual signal to the unit which causes the ECU to increase the rail pressure. If the setting is too aggressive then the ECU detects a malfunction and reduces the engine power. Before that happened I could hear increased 'Diesel' noise which was probably the high-pressure pump working overtime.

'Diagnosis' plug


The tuner came with a plug that's supposed to light up green if everything is wired correctly. It's inserted in place of the tuner box.

A green LED should light up on the other end when the ignition is switched on.


Don't expect anything fancier than a couple of jumper wires and a current-limited LED:






Comments

  1. Sorry but you got it pretty wrong. The chip modulates analog signal coming from a common-rail pressure sensor. The signal contains no injector information (either binary or modulated into analog signal) and there are no "cycles".

    ReplyDelete
    Replies
    1. You are right, I was making some assumptions.
      I've taken a look at SSP 350 and 351 and the unit overrides the rail pressure sensor. I wanted to take a few measurements with 'before' and 'after' signals but it's a bit too cold outside for that.
      The piezo injectors take >100V signals anyway and have a connector for each one, so it cannot be that.

      Delete
    2. Here is what I believe is happening (what STM8S chip is doing):
      1) sampling and ADC conversion (one 10b ADC from STM8S is used for that)
      2) detection of the mode: comparing the value with the thresholds and calculating gradient of the signal using couple of points
      3) based on the mode look-up table (stored in 32kB Flash of STM8S) calculating offset to be applied to modulate input signal
      6) modulating input signal using a primitive DAC formed with 4 op-amps from MCP6004 and 4 transistors as switches and controlled by STM8S.

      Delete
    3. Correction, op-amps are not use as a primitive DAC, they are only used as buffers. Output analog signal is generated with Timer1 Ch1 and Ch2 from STM8S as PMWs and LP filter.

      Delete
    4. http://hackcorrelation.blogspot.de/2016/04/racechip-tuning-box-part-2-reverse.html

      Delete
    5. Great analysis! What happens if I connect one that I have which has been programmed for Diesel to Gasoline one?

      Delete
    6. Not sure if it works for gasoline cars, unless it also uses some kind of single-rail direct-injection setup.

      Delete

Post a Comment

Due to spammers, comments sometimes will go into a moderation queue. Apologies to real users.

Popular

FiberHome AN5506-02-F router hack

Ikea SKARSTA sit/standing desk hack

Floureon BYC17.GH3 thermostat teardown and impression

Non-genuine battery in Lenovo X230

Zoom G1 guitar effects pedal repair

Philips 3200 Coffee Machine - part 1

Racechip tuning box - part 2 - reverse engineering