20vt cam sensor hack

Thought this would be useful as with values the way they are I can imagine a 20vt being scrapped for a failed cam sensor + it would obviously be useful to be able to drive the car after the cam sensor has failed, even if just to get it to a specialist for a sensor/belt change.

So I've been looking at the firmware code for a while now, working out if it's possible to force the engine to start without a valid cam sensor reading.

Obviously there's no way to tell whether the engine is in a compression or exhaust stroke based on the crank sensor reading alone, so there can only be a 50% chance that it'll start each time without the cam sensor. But I reckon a 50% chance is an acceptable alternative to a 0% chance.

So after wasting a week searching intently for code that didn't exist, I finally got it working and have been testing this week, so now with just a chip change you can have a 50% chance of starting the engine even with the cam sensor unplugged. The cam sensor error is disabled and either the engine starts as normal or just turns over without starting, so after a few seconds of extra cranking you just switch off and try again until it starts.

Of course when it doesn't start it's injecting fuel on the exhaust rather than compression stroke, so I wouldn't advise using this as a long term solution, but to get the car moving again I think it'll be quite useful.

For anyone else who's ever examining the Bosch Motronic code, I'll explain what had me hunting for non-existent code for a week, it may help...

Turns out they access the same external RAM address through 2 different types of address setup instruction. The normal 16 bit address DPTR register instruction but also with the high address byte in hardware port 2 coupled with the low address byte from the top half of page 0 RAM.

The DPTR register method is accessing either the firmware ROM or external RAM, depending on the address, as they eventually map in external RAM into the unused space near the top of the ROM address space.

Quite obvious when you know how it all works, but until then you just assume the 2 different methods are addressing different external devices mapped separately by the memory controller, rather than exactly the same byte in the same device.

So if you find code accessing an interesting external RAM address using one of those methods, you also need to search for access to the same address using the other method, or you could miss something important.

Having never hacked 8051 code before I found this guide to the 8051 microcontroller hardware architecture very useful:

http://www.mikroe.com/chapters/view/65/chapter-2-8051-microcontroller-architecture/

Anyways, if anyone ever has a 20vt immobilised by a failed cam sensor, just drop me a PM.

Excellent work Graham!
Would this be in the form of a replacement/backup chip?

Having suffered a fail two hundred and fifty miles from home I would of been grateful to of had one, and not to of endured the three relay lifts it took to get home.

Interesting Graham.

Back in 1980 the printer manufacturer I then worked for first used an Intel 8051 chip as the processor for a whole new family of dot matrix printers whose derivatives were still going strong in 1995 when I left the company.

Odd to think that a chip I first came across putting dot on paper at up to 2000 characters a second should be driving the engine of my 20 year old sports/GT car.

Awesome work Mr L

Yes, a replacement chip, the hack can be added to a standard chip or a Gtec1 or whatever. It's not suitable to use all the time as even with a working cam sensor it still only has a 50% chance of starting each time.



Yes, the 8051 was first released in 1980 (the microcontroller in the coupe ECU even says "(c) Intel 1980" on it) and although more advanced versions are made today they still have the same basic core and instruction set.

You can tell that it's pushed to the limit in the coupe as the main engine control code is running on timer and hardware interrupts while the rest of the "housekeeping" stuff is done in whatever little processor time is left after that, so as engine rpm increases free processor time decreases and the "foreground" code slows down accordingly. So eg. you can't connect to diagnostics when the engine is running at over 2000 rpm.

You are 'not mucking about' Graham, are you!

As they say...

Respect...

Yeah Graham, I discovered that processor was thick as a brick; it's barely able to negotiate the connection half the time anyway, and it's *really* fussy about the timings for the connections. I don't know why they didn't use the 6805 chipset that Weber/Marelli use on the 16 - it's much more capable.

An alternative to your prom which I have read about but not seen tried is to replace the sensor with a flashing LED, so the ECU sees the voltage drop and thinks there's a working cam signal. Same issue as yours though - only a 50% chance of being on the right phase, so strictly a temporary 'fix'.

Great work Graham

Amazing! Always good to read about people pushing the boundaries and getting an understanding on the electronic / hardware side

Brilliant work Graham!
Would it be possible to have this programmed onto a chip but with some sort of switch or .... Panic button so you can switch it on if needed?

Was this cam sensors specific to the 20 valve engine?

Again brilliant work!

In theory it would be possible to switch between 2 firmware chips while the engine is off (actually I remember someone on the forum producing a board to do that about 10-12 years ago), but it would be a lot easier just to carry the few tools needed to switch the chip over in case the sensor ever fails and leaves you stranded.

Not sure which other engines used the same sensor, not even sure if the 20vt uses the same sensor as the 20v NA.

And to complete my exploration of the firmware code I can now disable the immobiliser with just a firmware hack, no need to modify the ECU hardware anymore.

I found the same cam sensor code in the 20v NA (non VIS) firmware so if anyone would like to test it by disconnecting the cam sensor, or has a 20v NA with a failed cam sensor then just send me a PM.