Knock sensor

[Ctn]

Has anyone found an address for the knock sensor for the 7790?

[Calum]

If I was going to hunt down that I would start with the 'knock filter' stuff (you'll have to hunt a bit to find that) and then start walking backwards through the disassembly from there.

[Ctn]

Yep will try that

[bakgwailo]

i am also very interested in this, lmk if there is anything I can do to help. I also remember reading that nistune had this feature somehow ? not sure on the technical details

[darkhalf]

Nistune doesnt have it yet except for a HCR32 prototype which I got working several months ago. I added a counter in and it passes the knock count out through the interface and resets it each read. That gives a respective knock count per maptrace cell based on the consult serial data output

So the prototype and application code works fine... just need to add it in the firmware for all the different ECUs

Requires special patching to insert the counter (and an autopatcher update to cover all the code bases)

I started tracing from the consult DTC codes (Knock sensor DTC) and then found which addresses held the DTCs (easy these are grouped together and reset on consult 'clear dtcs' command). Then found the third address contains the knock sensor DTC entry

Then looked through the code to see what set it... thats where the knock sensor input impedance is checked to see if the sensor is connected and has a valid resistance. It was around this section of code the same register which contains the flag which sets the knock DTC also contains the 'current knock' indication

If you have a HCR32 ECU handy, trace the prefiltered knock line in and monitor the output lines when knock occurs (i put in a continous wave pulse generated knock). You will get square wave output which is your knock signal. That traces directly to the knock register which bit is set.

When that bit is set, that is where I start counting it. You cant pump this directly through the serial interface because the occurance is so small. How to know when to reset the counter? I added another consult command to retrieve and reset it

The 16 bit ECUs I believe I've found the address but I cant get it to trigger with signal generators. So I suspect there may be some more filtering here that I cant get through. Might need to test with real knock on a vehicle for that one... or look at those patents more closely when I get time

[Ctn]

Thanks for the imformative reply darkhalf, it was *incredibly* helpful !

I haven't had much time to investigate this further since I first posted.

You've just made my day !

[epstein]

Has anyone found an address for the knock sensor for the 7790?

I've been working on the S13 SR code base for a while now and decided to go after this. The raw knock voltage appears to come in as a 16-bit value in 4212. I found a block of code where the 8 ADC's are loaded into sequential (16-bit) registers starting at 4204. Then, I removed the 7790 chip and started back probing the PCB. According to Calum's Memory.txt file, 4204 should be the MAF sensor. Sure enough, the first ADC went to the MAF sensor pin. From there I found that knock goes to the last ADC.

Just so you know, a there is a significant amount of analog filtering and conditioning on the knock signal. See all those SOIC-16 packages and weird resistor packs? From what I can tell, that's nearly all knock related.

I watched 4212 and 4213 in NDS and it appears to be knock related. I was getting MSB's of 01 and 02 during idle and cruise with 03 readings under boost at 8psi. I really need to patch the consult stream and log it as I really can't be staring into the passenger seat when I'm running high boost, where the chances of knocking are greater.

There is a nice block of code following a write to 4212 which I can only assume is the knock count generation. It also appears to be using a block of lookup tables. I'm assuming that maps knock counts to degrees of timing retard. I'm familiar with java and C++, but I'm super slow at reading through assembly. I just need to spend more time with this. I was actually hoping that someone could take this info and figure something out!

For completeness, here's the rest of the raw ADC registers on a E5 SR20DET ECU. This should be the same on B13/S13KA stuff.
4204 = MAF
4206 = Coolant
4208 = Battery
420A = O2
420C = TPS
420E = Rear Pot (diagnostics)
4210 = grounded at the chip
4212 = knock sensor

-Chris @ RS Enthalpy

[darkhalf]

thats really good info to start with. Next thing is to find where they are incrementing the knock count, intercept the routine and add a separate counter for passing out via the consult interface to use for knock reporting

[darkhalf]

I've been tacking the S13 SR20 again tonight

I see where you copy the raw knock voltage from register 0x22 to 0x4212 and I've monitored that using my RAM trace and noted knocking the sensor will increase the values upto about 0x03xx maximum at that memory address

But I dont see any usage in the code for S13 SR20DET/KA24DE of this address. Is it even used???

Also noted that the knock sensing stuff (DTC reporting out of range on knock sensor) is raised bit 0x10 on address 0x4408

This comes from checking register 0x0C and if 0x40 is clear then the out of range DTC is raised

So we have a raw voltage address and an out of range bit in knock report regster 0x0C

On the 8 bit variants all ECUs use the knock report register to also flag when knock is occuring (ie I see another bit set occasionally on the RAM trace on that register when knock is detected). I'm not seeing that by tapping the sensor on the S13 SR20 like I have with these 8 bit versions...

Time to start digging through more knock code. If anyone doesnt mind knocking their engine whilst monitoring address 0x000C in NissanDataScan it might change when it knocks (or it might not...)

[seishuku]

To test it, you might have to actually bolt the sensor to a large piece of plate steel (12x6 of maybe 0.5" at least, 3/4 to 1" would be better) and hit it with a hammer.
I don't think tapping on it would be nearly sharp enough to trip it.
That plate and a metal hammer would be more like the situation on the engine when knock occurs.

[darkhalf]

I've got the SR20 knock sensor bolted to the plate as you mentioned and gone from tapping to hitting it hard

I use the same setup on the older 8 bit ECUs and it has worked fine with that getting through filtering circuitry and incrementing my knock count, its just not doing it on the 16 bit ones

[seishuku]

Weird, I can't imagine why they would change it to make it less sensitive... Unless they run more conservative timing on the OBD2/16BIT ECU engines, and didn't want the knock sensor making things worse.

[clshoo176]

As an experienced diver, I actually would drown in the water.

You're not the classic joke set in 2007

Word classic 2007 version, today What you laugh?

1, a second-class bus, drive over a BMW, next to a skilled are the people on his side, said: "Look, just in the past that bike is IBM."

[URL=http://www.christian-louboutin-hot.com/christian-louboutin-pumps/christian-louboutin-black-suede-toe-pumps]
Christian Louboutin Black Suede Toe Pumps[/URL]
[URL=http://www.christian-louboutin-hot.com/christian-louboutin-pumps/christian-louboutin-black-suede-toe-pumps]
sale Christian Louboutin Black Suede Toe Pumps[/URL]