A Prius ECT Spoofer MCU Controlled

Discussion in 'Gen 2 Prius Accessories & Modifications' started by ccdisce, Jan 11, 2011.

  1. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    You need access to 4 wires at the ECU to add this device.

    winston.
     
    3 people like this.
  2. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    This version monitors the temperature whenever it has power and will trip out at the 'window limits' . Its power is turned off when the car's ECU says so.

    Expanding the useable SOC ,,,,, hmmm CAN messages manipulation maybe.


    winston.
     
    1 person likes this.
  3. seilerts

    seilerts Battery Curmudgeon

    Joined:
    Mar 7, 2010
    3,326
    1,481
    38
    Location:
    Santa Fe, NM
    Vehicle:
    2005 Prius
    Either CAN spoofing or a custom battery computer are about the only ways I can think of. The spoofing depends on whether or not the battery computer will calculate SoC over 80% and not throw a code.

    Extending SoC below 40% carries risk. As SoC approaches zero, the weakest cell of the 168 will fall to 0V and reverse, become a resistor, and die quickly. The problem is that it is hard to know where to set that lower SoC limit between 0% and 40% to prevent this from happening. There is also the issue of needing a minimum amount of voltage to spin start the engine.
     
    1 person likes this.
  4. 2009Prius

    2009Prius A Wimpy DIYer

    Joined:
    Mar 25, 2009
    2,703
    480
    63
    Location:
    USA
    Vehicle:
    2009 Prius
    Thinking more about practically how this works in the car. I assume it will be mounted somewhere the LCD is easily seen and buttons easily accessible. Is there enough fail safe built in such that if a component or a connection fails then the ECU still sees the true temperature, not some wildly altered temperature?
     
  5. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    The ECT Spoofer presently does not have a case as the ones I was considering have been discontinued by PACTEC. I would suggest mounting it below the CD player somewhere to prevent the Airbags blowing it off into your face possibly with a light as the glass is not backlit .... oops the price just went up to add backlight leds.

    In a Prius that DOES NOT use this device, failure is possible in the ECU, its connector, wire and even the ECT sensor that is screwed into the block. The ECU could see a voltage between 0 and +5V which it should handle by interpreting the voltage acording to the curve that I have partially generated and posted. Typically the Resistor and NTC series combination covers from +340 to -169 deg F.
    The temperature readings control the fan in case the coolant on the input side of the block gets too hot, but the coolant Thermostat is off doing its own thing autonomously.
    In a high speed accident if 12V ever makes it to the ECT wires running from the ECT sensor thru the firewall to the ECU then the ECU will probably blow up.

    In a Prius that DOES use this device the ECT Spoofer will increase the the risk of failure because of the extra parts added to the system and if this design of the ECT Spoofer fails it is restricted to return a voltage between 0 and +5V to the ECU as it only gets 0-5V from the ECU. This design does not have a Fail Safe state designed into it in the form of T6 relays which will switch in a bypass jumper.

    The 'kit' would include a jumper plug to bypass the Spoofer and there would be an obligatory fuse on the spoofer itself. The bypass jumper is applied by the user.

    Adding T6 relays would increase the cost.
    A redundant arrangement could be made by having a motherboard with protection switching T6 relays and TWO Spoofers tied togther via a private link, one would be running the functions and the other would be in HOT STANDBY ready to take over if the primary acts up.

    The Heartbeat LED on the card would indicate that the code is working and the MCUs use sure start oscillators, brownout detectors, watchdog timers, power up timers, etc to make sure that the MCU gets going and stays running code.

    A marketing aspect that came to mind is to sell this device as a Passive Temperature Gauge (for more dinero of course as a Temperature Gauge that is ECT Spoofer cpable shhh.... that is a secret hack) which the user can 'hack' into by adding a jumper and changing wiring to enable ECT spoofing. Hmm...... an interesting marketing approach.

    winston.
     
  6. mrbigh

    mrbigh Prius Absolutum Dominium

    Joined:
    Sep 6, 2005
    3,686
    685
    2
    Location:
    Long Island, NY
    Vehicle:
    Other Electric Vehicle
    Now it is sounding like "Piracy Hacking" :eek:
     
  7. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    We are not hacking into the manufacturer's code, the car's CPU is being fed with a modified analog voltage which it interprets in a way it was programmed to by the manufacturer.
     
    2 people like this.
  8. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    Progress Notes
    1.0 'CUT' Version. The 'CUT' version, which has the lead going to the temperature sensor cut, has been fully tested, the transfer curve for the NTC sensor has been captured and fitted using TableCurve2D and loaded into the micro. I took the time to generate PCB artwork as my buddy is not in town at the moment plus this project could not afford to pay him. I wired up another prototype and it works fine. A third prototype, the SD form factor version, works and highlighted a problem that it was not getting online quick enough and the car's ECU interpreted the 5V present as a malfunctioning NTC sensor and posted a check engine light. Pulling it resistively to some intermediate fixes that and gives the MCU time to get online while the car thinks about the 2.5V that it is recieving.
    This version using LEDS needs very simple code to run as it needs less than 100 bytes of assembly code using a window sift technique to determine if Spoofing is required.
    A Table remap approach could also be used but would consume an additional 64 bytes of space for the re-map table. No real problem as the MCU has loads of FLASH space.
    The cost of building 5 day turn boards was not good so I let this version sit while I worked on the 'NoCUT' version in which the sensor lead. The plan was to come up with 1 design and PCB layout that could be stuffed differently to make both types.

    2. NoCUT Version.
    In this version, the Spoofer bridges across 3 leads, +5V, GND and ECT Lead. What this means is that the Spoofer has to sense the NTC sensor lead and then drive the lead, the problem comes when the lead has to be sensed the next time while it is being driven.
    Releasing the lead and hoping that a reading can be sneaked is not a good plan as the car's ECU could be scanning it at the same time and I did not want to sync the two systems.

    My next post will continue this and outline the solution that I came up with as this post could be getting long.

    Winston.
     
    1 person likes this.
  9. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    2. NoCUT Version Continued.
    The ECU in my opinion cannot be driven by a constant voltage source as it would become difficult to determine when the trip out point is reached so it was decided to drive the node with a lossy voltage source using the D2A driver in series with a fixed resistor whose value should be between 0 and some upper limit which will be established by the fact that the driven end cannot be lower than 0 volts or a little higher ( I used 5 clicks of the D2A). A dithering alogorithm was used to track the sensor output and fed back in software to hold the reading at +- 1 click (which is around 20mV). Rapid convergence is encouraged by going directly to the hex equivalent of the spoofed temperature ( I used 0x1D for 168 deg F) and then dither from there.
    The value in the dithering register is an indicator of the actual emperature of the coolant and bailout occurs when the count is at 0x1D on the HOT side and at 0X05 on the cool side. There is no need to release the sensor drive to measure the true temperature and the count can also be remapped into a temperature reading for display. When the need to bailout from the window spoofing area the D2A is put into tri-state.
    The code was ported from the PIC16F914 to the PIC16F960 and lately to the PIC16F684 The algo works fine and I went ahead and generated the PCB artwork for all 3 versions using a program called Eagle PCB from CadSoft for which I had to Pay $49 + taxes for a Light version. The PCB size for the LED version is 1.5in x .9in about the size of a SD memory card.
    The 690LED version of the Prototype PCBs have been ordered on a 2 week turn and are due in about a week.

    Winston.
     
  10. TheForce

    TheForce Ron Paul 2012

    Joined:
    May 30, 2005
    3,454
    463
    0
    Location:
    Wheelersburg, Ohio
    Vehicle:
    2006 Prius
    Model:
    N/A
    I dont know if you have been following my Arduino version but mine is dropping the fake temp once every few seconds. During this down time its grabbing 16 samples and then it starts faking again. It then does the average of those samples to get the real temp. This down time is very short. I dont know exactly how long but the car seems to be fine with it doing that. I even seen on the ScanGauge a few times where you would see the fake temp and then the real temp then back to the fake temp. It happens very quick and only maybe a few times per hour. So low and so quick the Prius does not seem to care.

    If you want to explore this route I dont think you have to worry about the Prius freaking out.

    I abandoned my start/stop settings based on the digital pot values because of the ambient temperature affecting both the digital pot and the transistor. Mostly because of the transistor since it was more sensitive to the ambient temperature.

    As long as your values wont change with ambient temperature it sounds like you should be good.
     
  11. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    The routines as I have them are working fine without me having to release the driver to gather the real temperature. The LEDs give an indication of the range and is confirmed by the heartbeat rate. It has been working fine for the past month while I have been learning how to drive the PCB123 and the Eagle PCB layout tools.

    I see no need to explore your route as I have another device that I want to continue developing.

    Ambient temperatures have no effect on the MCU and the D2A driver as it works fine from 32 to 85 deg F so far

    I also tested its supply sensitivity on the bench and it works finedown to 2.5V.

    Winston.
     
  12. TheForce

    TheForce Ron Paul 2012

    Joined:
    May 30, 2005
    3,454
    463
    0
    Location:
    Wheelersburg, Ohio
    Vehicle:
    2006 Prius
    Model:
    N/A
    Also a comment on the CUT version.

    Short... Dont do it!

    Long...
    I tried this a while back with the pure hardware version that JSTCD was helping me with. One issue is making sure the car sees something in the good range during startup and shutdown. Even if its just a few ms off from startup or shutdown the Prius complains. Also if you do any switching while the car is on it will complain even if the switching is done very quick. I would personally stay away from a CUT version of this hack. First it makes things more complicated and second you have to cut wires. I really wish I never cut my wires for the experiment.
     
  13. TheForce

    TheForce Ron Paul 2012

    Joined:
    May 30, 2005
    3,454
    463
    0
    Location:
    Wheelersburg, Ohio
    Vehicle:
    2006 Prius
    Model:
    N/A
    Sounds like you have everything under control then. Does your D2A give a true analog out or is it PWM?
     
    1 person likes this.
  14. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A

    I got the CUT version to work fine months ago. Check my earlier posts.

    Winston.
     
    1 person likes this.
  15. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    The D2A that I use is a Microchip MCP4911 which is a real D2A it is not poor man's emulation using a PWM circuit, a friend also suggested that I go the PWM route . That 10 bit D2A with 1/2 LSB D2A costs $1.05 in 100 piece pricing and it is tri-stateable.

    Winston.
     
    1 person likes this.
  16. TheForce

    TheForce Ron Paul 2012

    Joined:
    May 30, 2005
    3,454
    463
    0
    Location:
    Wheelersburg, Ohio
    Vehicle:
    2006 Prius
    Model:
    N/A
    That was the CUT version you got working a while back? OK. I thought it was the NoCUT version you got working.
     
  17. TheForce

    TheForce Ron Paul 2012

    Joined:
    May 30, 2005
    3,454
    463
    0
    Location:
    Wheelersburg, Ohio
    Vehicle:
    2006 Prius
    Model:
    N/A
    That MCP4911 looks nice. Uses SPI. Even comes in a 12bit version. Less than $2.50 each for the 12bit version. I might have to pick up a few to play with for other projects.
     
  18. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
    The D2A chips these days are inexpensive, high precision, I2C ,or SPI , multiple per package, etc, etc. I have seen them up to 22 bit but those are pricey.
    The PCB tool I used Eagle, its library of parts are a little short and I had to create symbols and pcb footprints for the board.
    Analog Devices have a number of parts including parallel parts.
     
    1 person likes this.
  19. TheForce

    TheForce Ron Paul 2012

    Joined:
    May 30, 2005
    3,454
    463
    0
    Location:
    Wheelersburg, Ohio
    Vehicle:
    2006 Prius
    Model:
    N/A
    Yeah I bet 22bit is pricey. I refuse to even to to find one to see what the price is. :)
     
    1 person likes this.
  20. ccdisce

    ccdisce Active Member

    Joined:
    Oct 10, 2010
    259
    142
    0
    Location:
    Stone Mtn GA USA
    Vehicle:
    2008 Prius
    Model:
    N/A
Loading...