Inside stuff - Racechip car tuning thingie

I bought my unit half a year ago, so you can say I have plenty of experience using it. It functions as a man-in-the-middle between the ECU and the injectors. I believe it alters the injectors' on-time and perhaps even the timing with regard to the TDC.

See also: http://hackcorrelation.blogspot.de/2016/04/racechip-tuning-box-part-2-reverse.html

Short review

I wanted to lower the consumption of my 3L V6 diesel engine to slightly more frugal values, don't care as much about power. Sure, some extra low-end torque would be nice as I feel my particular car is lazy in shifting up.

Well, to my surprise, the unit actually does something, so it's not just a random box a la OBD-tuners. By the way, you cannot tune an engine through OBD, the engine protocol is filtered out by a gateway. Just some diagnostics are allowed through.

The highway mileage improved from 8L/100km (30 US MPG, 35 UK MPG) to less than 7L/100km. With the default settings (the unit can be adjusted) the low-end torque has also improved, as it was pretty sluggish under 1700 rpm.
However, the city consumption went up from ~10L/100 (23 US, 28 UK) to 12-14 liters, quite a bummer. More interestingly, the engine idle consumption increase was the noticeable one, going from 0.8L/h to 1.2L/h, that's the fuel you use while stuck in traffic or at traffic lights.


I've increased the settings on the adjustment switches (see images below) to some random values and at one point I got the yellow 'check engine' light, so I had to decrease the values. I also got the warning light under heavy acceleration while using a bad(?) fuel. Stopping and starting the engine 'fixed' that. Also the engine sounded 'harsher' with more ticking, like a really cold Diesel.
I could refer to this setting set as 'Performance/Highway'.

I wrote to Racechip support asking for a set of recommended values for lower city consumption and they responded [after a week] with two new values that are to be dialed in. These new values were a lot lower than their default ones and produced a noticeable difference. This time the engine revved up much higher before up-shifting and idling was really smooth with no noise or vibrations. However, city consumption was still a bit higher than factory.
I could refer to this setting set as 'Quiet/comfort'.

I wrote to them again but this time I didn't even get a response after one week.

Teardown

From the outside the unit is a plain ABS (glass-reinforced?) box with decent weather sealing. Installation is pretty straightforward and takes not more than 5 minutes. The mainboard slides out by unscrewing two T10 screws on each side of the connector.

That is also the only way how you can get to the adjustment dials.






The PCB is pretty simple, probably dual-layer and hints that most of the complexity is contained within the firmware.



From the upper left, going clockwise

• two KDR162H hex-coded rotary DIP switches
• Microchip MCP6004 standard op-amp
• 4x SOT23-3 transistors or diodes, though they might look like SOT23-6
• DB15 male connector on the right side, though only 6 to 8 pins are used
• power input stage with a few diodes and a 78L05B voltage regulator
• there's also a Zener diode going straight to a uC pin, not sure of it's purpose
• STM8S105K6T6 microcontroller, 2K RAM, 32K Flash, 1K EEPROM, 16MHz
• 10-pin programmer header on the lower left

I won't try and to a full reverse-engineering now, we'll just focus on the principle of operation.

The numbering on the uC starts with pin 1 marked with the black dot and counts up counter-clockwise.

Most of the pins are broken up to a point on the PCB, the RX/TX pins go the the 10pin header.

Pin 10 (PA5) goes to the Zener diode.

Pins 17-20 (PB1-PB4) seem to go to one of the DIP switches while 30-33 to the other one, but I haven't traced the connections yet.

The quad op-amp seems to be fully used and connected to the 4 transistors nearby.

Here's on first glance on how I believe it functions:
EDIT: ignore everything with strikethrough, see the first comment and my reply.

There are four output channels but in my car only one is used. That's because the connector has only 3 wires, out of which I assume one is power and one is ground. It might be possible that the op-amp is used for summing up signals to form a rudimentary DAC, but I doubt it.

The uC is intercepting the signal coming from the ECU, running it against a table look-up and outputting a modified signal. Obviously it cannot know the pulse length until the ECU has finished transmitting the injector pulse - and it might be too late to output a similar one - so I assume the box records the signal, passes it unmodified to the output and on the next rising edge it injects its own signal. So this might mean that the output transistors are there to switch between the car signals and the tuner signals.

The above might sound slow but in reality there's probably no discernible difference between reacting one RPM later than the car would.

Assuming that a V12 engine turns at 8000 rpm that means 1600 'sparks' per second, or 1200Hz. Even with spent-spark functionality in a petrol engine that doubles the frequency to 2400Hz. A microcontroller running at 16Mhz should easily be able to handle 10Khz, with time to spare.

If the signal wire also carries some binary information (which injector to fire) that would probably raise the requirements to hundreds of kHz. Need to research some more on the TDI signal structure.

Anyway, the uC receives the injector signal, maps it to a lookup table or a function (with parameters determined by the dip switches) and on the next cycle it outputs the modified signal. The timing of the signal can be derived from the previous pulses so that the injector can be fired before or after the 'normal' time. It would then also modify the injector time (more on-time means more fuel).

One of the DIP switches seems to affect the RPM range in which the unit functions, according to some comments on the Internet. The other one is for 'power'.

Edit: The unit intercepts the common rail high pressure transducer analog signal (G247) and alters it. You can search for SSP 350 and SSP 351 to get an understanding of how the rail pressure interacts with the other injection components. The engine's characteristic curve is also selected based on rail pressure so this is a poor man's way of doing remapping.

I still need to get the 'before' and 'after' traces to see what the unit is actually doing to the signal, but I assume that with 'aggressive' settings it sends a lower than actual signal to the unit which causes the ECU to increase the rail pressure. If the setting is too aggressive then the ECU detects a malfunction and reduces the engine power. Before that happened I could hear increased 'Diesel' noise which was probably the high-pressure pump working overtime.

'Diagnosis' plug

The tuner came with a plug that's supposed to light up green if everything is wired correctly. It's inserted in place of the tuner box.

A green LED should light up on the other end when the ignition is switched on.

Don't expect anything fancier than a couple of jumper wires and a current-limited LED: