Delphi MT60 Car ECU Revisit - No activity on CPU

[Gjackson]

Hi all,

This is a continuation of the first post I made about this ECU. The ECU has no communication, dashboard fails to light up and so does the car. With all other devices unplugged and the ECU on my bench I powered it and scoped on both the CPU pins and the 2 pin crystal resonator. With respect to signal GND I saw absolutely no activity on both legs of the resonator, and for the cpu no oscillation seems to be happening, pins are either stuck at 3v3 or GND. The CPU still gets lukewarm im not sure if that's normal given the missing clock. Power rails seem to be present from what I saw (12v, 5v, 3v3, 1.2v) so I don't think that's causing the no oscillation. Possible to suspect the resonator itself? I don't believe they die often? If so I would need help sourcing some information about it as the only markings it has are on the top metal casing reading (D2997419I) which I can't find online

Thanks

[stj]

resonators are plastic, crystals and oscillators are metal
and they do fail
got a picture?

[Gjackson]

Must have got them confused then, my bad. Not too versed in that area. Here's a pic.

Thanks!

[Gjackson]

I tried probing around with a logic analyzer and I saw a waveform on the crystal. I don't think my sampling rate is high enough, logic analyser goes up to 16MS/sec, and I can just about see the square wave. It looks strange but I believe that's due to sampling rate issues. I'm not confident about the frequency but most probably 8MHZ crystal. still don't really see any activity on the CPU however.

What would be a good way to tell If CPU is alive, preferably not using a scope. I saw some people trying to read the ECU by performing some mod on the tricore CPU:
http://blog.vvdishop.com/use-vvdi-pr...-with-tricore/

Could I maybe use this to check if the tricore alone is alive?

[redwire]

There should be a Supervisor/PMIC/System Basis chip that has a bunch of stuff in it- functional safety challenge-response watchdog, reset control, voltage regulators, some even have power drivers for throttle motor built in.
Infineon Automotive PMICs

So I'm saying the supervisor IC might be detecting a fault and preventing the MCU from running. Check what is paired up with the MCU.

[Gjackson]

Alright, I've included a picture as well as all the information I know about this ECU currently, If there is a supervisor IC then I believe that must be the 20845-004 Onsemi IC located on the top right of the picture, wether it has capabilities apart from voltage regulation I cannot say, no datasheet exists for it from what I can find. It seems to be working ok? from what I can tell, 5v, 3v3, 1.2v are present when probing the IC which are probably all the rails needed for functionality. (Again no datasheet, can't tell for sure)

the top right large black coil has 12v on both sides, I'm unsure as to why a coil is present usually those are used for buck/boost circuits so I'd expect something other than my input voltage. but the 12v on the coil seems to be the same as the one from my bench input. the top blue inductor has 5.8v and the bottom blue inductor has 4v which seems a little strange, those are not standard voltages. both are smps and the 20845-004 is what's driving them.

on the bottom right is a SC900711CVW idle driver IC, I'm unsure how to test this (no datasheet) but I wouldn't expect it to kill the whole system if it malfunctioned so I didn't focus on it.

the infineon CPU in the middle I believe is getting clock, although I can't be 100% sure due to my scope not having fast enough sampling rate. But I think the crystal is most likely 8MHZ. Again I'm unsure how to confirm that it's working ok.

top left is a "gate array IC" by Onsemi part number 21093-001, I found an old blog that described a succeful repair having the same symptoms as my ECU involving a reball of this IC, I did successfully reflow it but still nothing. If I exhaust all options I might consider attempting a reball.

The top 3 Ic's all get somewhat warm during operation. (see thermal image), the CPU and gate array IC getting hottest while the voltage regulator IC get's barely warm. the Idle speed IC has no temperature change. I've tested all other discrete components on the board as best as I could and found no damage or faults.

I'm unsure how to proceed at this point without any sort of datasheets but I'm pretty sure the fault lies on one of the 3 IC's up top, how can I test these IC's? Might have bit off more than I could chew with this one

[CapLeaker]

Since it isn’t communicating, maybe the cpu and everything is fine and the problem is the CAN bus on the ECU?

[Gjackson]

That's definitely possible, any ideas on how to diagnose faulty CAN lines or what could go wrong? this is what I initially suspected as resistance between CAN L/H to GND on my ECU is suspiciously low from what I read should be the norm. Wether that's the cause of one of the IC's or a discrete compoment along the way going bad I can't say, would CAN go to the CPU or the gate array IC? This thing is a real pain to reverse engineer given one side of the PCB is plastic welded to the case

Thanks for your help!

[Gjackson]

Alright so I went ahead and tried tracing the CAN lines from the main connector to where they go, from what I can tell it's pretty simple, they go through 2 vias into a filter (the one with the white casing) and then after the filter go through 2 more vias into the gate array IC, so it seems that it's responsible for handling CAN, now the fact that resistance from CAN L/H to GND is 18k when it should be O.L and I can't really pinpoint any other components along the way on the CAN lines (unless on the other side of the PCB) I suspect that the gate array might be bad. Only way I can test this is to remove it I suppose the terminating resistor, any pullups/pulldowns and CAN logic is probably in there.

I found some replacements on aliexpress which might work marketed for MT22.1 ECU which is not my exact model, I hope they are not programmable chips however since I'd have no way of reprogramming.

[stj]

to check a crystal you need a frequency counter with a high impedence low capacitance input or a scope and a x10 or x100 probe.

a mutimeter with a 10meg input usually works too - but most meter other than the UT-61e dont go very high.


the explanation is simple - if your probe has a capacitance of more than a few pF it will effect or even stop the crystal!

[Gjackson]

Yep, I don't have any of those unfortunately. Explains why I can't get a proper reading.
Thanks for the info!

[Gjackson]

I went ahead and pulled out the gate array IC, resistance from GND to CAN L/H is now around 11M which is a lot like what I'd expect, I've ordered a replacement which should arrive in the coming days, interesting as I tried probing the IC after it was removed and resistance between the CAN L/H pins on it and GND and it reads 33k on both pins which is slightly higher than the 18k while it was onboard. resistance between L/H is 55k on it maybe the 18k is the resultant of all parallel resistances. I'll keep you updated once the IC arrives!

[CapLeaker]

You should have figured out which side of the CAN bus high or low didn’t work. I am doubt full that both don’t work. I guess the ECU didnt have any terminating resistors in it?
Did you power the ECU and look at the CAN Aline’s with the oscilloscope?

[Gjackson]

Yes I did that, terminated the bus too with a 120ohm resistor. Both lines showed no activity on scope remaining at a constant 2.5v, the second terminating resistor is located somewhere on the ECU but not on the gate array IC as the 120ohm resistance was still there after pulling the chip. The chip was responsible for signal generation however as with it removed no 2.5v is present now. From what it looks like to me, either a bad gate array or bad CPU and swapping CPU is not a realistic option as it requires flashing new firmware with tools I don't have.

[CapLeaker]

The 2.5v comes from the divider network and means that it isn’t connected to anything.
Shit like that happens when the battery is totally flat and someone jump starts the car.
I’ve got a ECU from an 18 wheeler, in which the owner jump started the truck on totally flat and to make things worse, he also had the polarity reversed.
I gave up on the board, because after taking a dozen bad IC’s off, others were still shorted. Worst ECU I have ever gotten in.

[Gjackson]

Hmm strange, the car that the ECU came from didn't experience any of that I believe. Went to start it and it just refused to, randomly. I get reverse polarity frying everything but how would jump starting a dead battery cause damage? I'm thinking current surge or something of that sort maybe?

Couple more questions if you don't mind,

Is the divider network you mention located somewhere on the motherboard generating 2.5v which is then passed by the gate array onto CAN L/H or is it inside the gate array IC?

And when you say that it's not connected to anything, CPU got fried and stopped telling gate array to send data? Or was the gate array damaged and wasn't able to pull the data lines high or low to send data?

Thank you for the info, really interesting stuff!

[CapLeaker]

I should have been clearer in my wording. If you get 2.5V flat line on the can bus of a module, it also means the module didn’t detect any other device. It also won’t “talk” if the ignition isn’t turned on.

Mercedes and also others do not like to be jump started on a totally flat battery. You can risk damaging things, which is costly. For a battery swap on certain cars the manufacturer even states to provide 12VDC 1A during swapping. I ran into this like 8 years ago. One of my cars went into the paint shop for like 5 weeks. Car came out running. Went in, drove 2 meters and stopped. Unlucky me I forgot something, so I turned my car off, to retrieve something. Went back to the car and she was dead. So they jumped it with a booster pack. Guess what happened? Christmas lights everywhere on the dash. 5 year old car, never had electrical problems.

[Gjackson]

I was hoping the ECU would occasionally poll to check for other devices which Is what I was looking for on the scope, I made sure the Ignition was getting 12v but since I don't have the car available to test on I had no other module to connect it to to test communication. That might explain the steady 2.5v

[Gjackson]

Update:

Got the new gate array and replaced it successfully, unfortunately nothing seems to have changed however I haven't tried it in the car yet. I did however get my hands on a decent scope so I checked both the crystal and SMPS. Crystal seems to be oscillating good at 8MHZ on one pin however the waveform has a lesser amplitude and looks distorted on the other pin, I'm not sure if this is normal (see pics)

I checked the 2 coils driven by the power IC to see if they are switching correctly. They operate at around 400KHZ and the 4v rail looks ok however it is switching duty cycle very rapidly which is a little strange, the 5v rail has a strange slope near the rising edge of the square wave, to me this is not normal.



Any ideas? Thanks!

[stj]

the crystal is normal,
i dont understand exactly how they work but the drive circuit usually has some kind of drive-feedback between the pins so it's almost driving itself!

the switching psu frequency/duty cycle is another curse of modern design, the control chips like to shift stuff around to avoid being detected causing rfi.