View Single Post
Old 01-20-2012, 01:49 PM   #75 (permalink)
Vaughanabe13
Enthusiast Member
 
Vaughanabe13's Avatar
 
Join Date: Jul 2011
Location: Iowa
Posts: 387
Drives: 09 Nissan 370Z M6
Rep Power: 14
Vaughanabe13 has a spectacular aura aboutVaughanabe13 has a spectacular aura about
Default

Quote:
Originally Posted by wstar View Post
Hmm I still think I don't quite understand it. I blame Nissan's documentation This is my best current guess at how the whole thing operates, now:

The lock unit supposedly has 7 pins on it. I'm giving them my own names for now since I still haven't found a pinout for connector M40, which is the actual connector at the lock unit:

G1: Grounded permanently
G2: Grounded permanently
P1: power supply, switched by IPDM E/R
P2: power supply, switched by BCM
S1: feedback switch output: +12V when locked, 0V when unlocked
S2: feedback switch output: 0V when locked, +12V when unlocked
C: communication line between lock module and BCM

Physical states:
The steering lock can be in one of two physical states: locked or unlocked. Once it has switched to a given state, it will remain in that state until commanded to change, regardless of whether any power is supplied to the unit. No relay has to remain energized to maintain one of the states or anything like that.

Power supply states:
P1 (IPDM E/R): When ignition is ACC or ON, no voltage supplied. Temporarily supplies battery voltage for a short while after opening the driver's door when ignition is OFF, or after pushing the ignition button once when it's LOCKed.
P2 (BCM): When ignition is OFF or ACC, +12V is supplied. When ignition is ON, it is not.
None of this completely makes sense, but the bottom line is, when the ignition is ON, neither power supply pin gets voltage, so no change to steering lock status can occur. When ignition is not ON, one of the two power pins (or both) will give it power at the right times for it to respond to a lock or unlock command, somehow.
It could be the case that P1 (IPDM E/R) only powers the feedback switches that drive S1 and S2, and P2 (BCM) powers everything else (the mini-controller that communicates with the BCM and actually moves the lock)

Switch states:
The S1 and S2 outputs are redundant inverted status outputs. They're almost certainly driven by physical switches that are tripped by the locking mechanism itself. In the unlocked state only one of them provides +12V, and in the locked state only the other does. If they're both +12V or both not +12V, that triggers a diagnostic failure. If they don't feedback that commands were followed correctly, that also triggers a diagnostic failure. Also of note: these are connected to both the IPDM E/R and the BCM, so for some reason both modules want to see this status.

BCM Communication Line:

This is the perplexing 7th pin "C":


It's listed as both an input and an output for the BCM. It seems definitely sure that the BCM is who sends that little pulse train against a 12V background to send LOCK and UNLOCK commands, as an output. I misunderstood earlier that the pulse train came from the lock module.

What really makes no sense is how any of this could be an input back to the BCM. Maybe it's mislabeled (from my point of view), and it's a BCM-output only, and the BCM drives it at +12V while LOCKED, and 0V when unlocked for 15+ seconds, and whenever it wants to send a command, it applies the +12V (if unlocked before) and then sends the pulse signal.

I guess someone would have to figure out what the manual means by clipping onto this with a scope (or really, even a multi-meter would do, since the only complex bit is already documented in the diagram above).
The lock module almost certainly uses serial communication on line "C", which could be relative to the 12V power, but more likely it is relative to an internal voltage regulator (I'm guessing 3.3V or 5V) and probably optoisolated. It doesn't even matter what kind of protocol they are using (I2C, SPI, proprietary, etc.) because you could just use a bus pirate to record the streams that are getting received/sent from the lock module. Of course, this would require that you have a module that is actually working (and not intermittently). You could use a tiny microcontroller and a couple of relays to emulate a functioning lock. The use of flash or EEPROM for saving the switch state might not be the best solution, depending on how fast the micro boots up and how much time is available to send the "all clear" signal.

I can't work on this, unfortunately, because my Z is in storage. But it sounds like it wouldn't be too hard to make a fake lock module.
__________________
2009 Nissan 370Z Touring, w/sport, 6MT, chicane yellow/black.
Vaughanabe13 is offline   Reply With Quote