Feline Appetite Stimulants, Hyperthyroidism & Kidney Disease

It's a fairly common story.  My 15-year-old cat has developed hyperthyroidism and has also been diagnosed with kidney disease.  He was a 5.5kg cat about a year ago, but was now drinking a lot of water and has lost about 1.5kg, bringing his weight down to almost exactly 4kg.

His hyperthyroidism is being managed with Carbimazole, and blood tests have confirmed that the Carbimazole is working.  He isn't a candidate for either a thyroidectomy or radio iodine treatment, due to his kidney disease.  I learnt his as I was in contact with various vets, trying to work out if I can get him a better treatment than just managing his symptoms with Carbimazole.  The conclusion is that due to his kidney disease, they suspect that either treatment would result in death.

After being on Carbimazole for a couple of weeks, the cat was basically refusing to eat or would eat very little.  He would walk up to his food, sniff it, and walk away.  As such, blaming the Carbimazole for his lack of appetite, I took it upon myself to halve his dose to see if that would improve his appetite.

He was initially on a dose of 2.5mg twice a day (1/2 a 5mg tablet twice a day), which I reduced to approximately 1/4 of a tablet twice per day.  That seemed to improve things a bit, but he still wasn't eating well.  At about the 3 week mark, I called his current vet, and told them the problem and what I'd done.  Their response was that there was nothing they could dispense to help, and that if he still wasn't eating tomorrow, to bring him back in.  I wasn't happy with this response as I already knew that there were things that could be given to cats to increase their appetite, Valium for one.

I'd done some research in the past with regard to administering Valium to the cat in question, as he would occasionally get upset after having an altercation with another cat and would get fairly vocal. stop eating, and his behaviour would change - you could tell he was upset.  I found that a small dose of Valium would act a bit like a reset button, and he'd be back to normal fairly quickly.

I also found that Valium would have a few other side-effects.  Firstly, he became more affectionate and wanted more attention, his appetite would increase (usually within 45 minutes of administering the Valium) and he'd walk around like he was a bit drunk for an hour or two.  He'd be fairly floppy if you picked him up, and you'd have to put him back down carefully as he'd occasionally fall in a heap and hit his jaw on the floor.

While calling and e-mailing various vets to find out whether he would be suitable for either radio iodine therapy or a thyroidectomy, I came across one particular vet that informed me that there were two types of thyroidectomies and that she would like meet the cat and discuss his treatment options.

I figured that she just wanted to get a consultation fee out of me before giving me any information, but she was also the only vet that was willing to do a thyroidectomy if it was appropriate, and at this time, that was looking like it might be his only option.  So I took him in to see her.

The consultation was quite productive.  She had read through his medical history (15 pages to date) and went through everything relevant with me again,  I think to ensure that we were both on the same page.  I told her that I'd reduced his dose of Carbimazole to 1/4 of a tablet twice a day, and that he was eating better but still not eating well, and still not putting on any weight (but not losing weight either).  I also mentioned that he wouldn't eat the Hills Prescription Diet K/d food (it's easier on his kidneys than regular cat food).

We discussed his lack of appetite, which she explained was likely due to his kidneys not filtering his blood very well anymore, so he'd probably feel a bit like he has a hangover.  She explained that prior to getting his hyperthyroidism under control, he probably would have had high blood pressure and that would have meant more blood would be pumped through his kidneys, somewhat compensating for their inability to filter his blood properly.  She also informed me that they can give him medication to increase his appetite - pretty much the exact opposite of what his (now sacked) previous vet had advised.

I mentioned that I'd been giving him approximately 0.8mg of Valium on occasion to get him to eat, but that even that wasn't working as well as it used to and I wasn't sure if I was giving him the correct dose.  

She suggested that Mirtazapine would be another option and that it would also be better for his liver.  I was surprised to learn that Mirtazapine could be used as an appetite stimulant, and like the Valium, I already had some at home as I was prescribed it to help manage my anxiety disorder and to help me sleep, but unlike his original vet, she advised me that they can dispense Mirtazapine for the cat if I need some.

I asked if she knew what the correct dose of Valium would be to use as an appetite stimulant.  She asked her assistant to fetch "the book" and looked up the correct dose of Valium for use as an appetite stimulant: 0.2mg/kg.  So considering he was 4kg at the time, I was spot on.  She also informed me that there are other uses of Valium, and that the dose I'd been giving him was on the lower side, so a higher dose probably wouldn't have caused any harm.

The result of the consultation was a plan to feed him anything that he'll eat, try giving 1/2 a Carbimazole tablet once per day for 2-3 weeks and to give 1/4 of a 15mg Mirtazapine tablet every 3 days, then bring him back in for another blood test to see if it's working.

Approximately 3 weeks later, I took him back to his new vet.  He was weighed, heart rate checked, and they took more blood for another blood test.  The result of his blood test was that his thyroid levels were within the normal range, which was good news.  He had put on approximately 0.2kg, which was also good news, and the Mirtazapine was working better than the Valium, but it still wasn't perfect.

Administering the Mirtazapine, I found that by day 3, the cat was starting to get fussy with his food and his appetite was waining, but not always.  Sometimes he'd go the 3 days without a problem.  I asked if I could give 1/4 of a tablet every 2 days, when he occasionally stops eating.  I was advised that would be fine.

So, in summary:

This is not medical advice.  Please see your own vet for treatment options.  This is being documented here as I found it difficult to find the information online when I wanted it in the past and for my own use in the future, should I need to reference it.

0.2mg/kg is the correct dose of Valium for a cat to use as an appetite stimulant.
1/4 of a 15mg Mirtazapine tablet every 2-3 days works better than Valium for my particular cat.
1/2 a 5mg Carbimazole tablet, once per day, seems to be working better as well, even though Carbimazole is supposed to be administered twice daily.

... and I seem to have found a better vet.

The next step is a blood pressure test and somewhat optional urinalysis test to check protein levels in his urine.  The vet suspects that his protein levels are OK based on his blood test results, but would like it checked as a precaution and to have a baseline reference for use in the future.

Suzuki Alto 2009+ (GFC31S) ABS to ESP Upgrade

The ABS unit in my Suzuki Alto GL (2010) developed a rather disturbing fault, resulting in the need to replace the ABS unit fairly urgently.

You're coming down a hill, slowing down to turn left at the roundabout ahead.  There's a decent gap between you and the vehicle in front, which has stopped at the roundabout unexpectedly.  It's not raining, but the road is wet.  You're closing in on the vehicle in front, and now you're braking harder than you were planning to because you weren't planning on coming to a complete stop, but the vehicle in front isn't moving, despite there being no reason to remain stopped.  You're about 4 meters away from the car in front when you hit a seam in the road.  A wheel momentarily loses traction and the ABS unit kicks in to save the day, only it doesn't - the pedal goes to the floor and the brakes are released.  You're probably 2-3 seconds from impact.  You could go left, but you're going to hit the concrete curb, take out a white pole with a reflector on it and probably the roundabout sign.  In front is the rear end of the stopped vehicle, and to your right is unoccupied road for the other lane.  The best option was to go through the roundabout on the wrong side of the road (photo of roundabout below, not on the same day):

The seam in the road, just in front of the vehicle.

It's another day, and a different roundabout.  You're slowing down as you prepare to turn left.  This time, there's no cars in front or even in the roundabout.  It's all going well, when you cross railway tracks just before the roundabout while braking.  The ABS kicks in for a moment, the brakes disappear, and you end up turning left at the roundabout a little faster than you would have liked (photo of roundabout below, not on the same day):

Train tracks just before the roundabout (Mornington Railway, Moorooduc Hwy/Eramosa Road West)

(The light coloured strip in front of the large arrow is the railway line)

There were many more events like this, and as I got used to this new characteristic of the vehicle, I started driving with more caution, slowing down earlier, picking escape routes while braking, releasing the brakes before going over railway lines, keeping an eye out for seams in the road before roundabouts and intersections and releasing the brakes just before driving over them.  I basically learnt to live with it, but I knew there was going to come a time, probably sooner rather than later, when I'm going to need the ABS to work, and it's going to do the exact opposite of what I need it to do.

When this would happen, the brakes wouldn't work properly until you stopped the engine and pumped the brakes a few times.  For whatever reason, pumping the brakes while driving, or parked with the engine running, wouldn't normally fix the problem.  After one of these events, the brake pedal would go to the floor, then on subsequent application of the brakes, the pedal would have some resistance where the brakes would normally start working, but the pedal would slowly sink toward the floor and the brakes would fade as it was doing so.  Then, near to the floor, the brakes would start working again, and you could drive to your destination like that, stop the engine and pump the brakes.  95% of the time that would restore the brakes to normal operation (until the next ABS event), but other times they wouldn't come good for a day or two, no matter how much you pumped them.

Symptoms and Diagnosis:

Initially, the brakes failed rarely, it was just something weird that happened a couple of times and I didn't realise that it was ABS related.  As time went on, the problem got worse and I realised that the brakes were failing whenever the ABS activated.

There were no fault codes stored in the ABS module.  It was checked on multiple occasions.

The brakes were bled in an attempt to cure the problem, but this didn't help.

At all other times, the brakes worked fine and the pedal felt good.  It wasn't soft or spongy.

After I'd decided that it was probably a faulty ABS module, I removed one of the fuses for the ABS module (the pump fuse) which made the ABS inoperable but still allowed the vehicle speed to be displayed on the speedometer and also allowed the CAN bus to continue working, so other modules could still communicate with each other.  The vehicle drove fine like this - no brake system issues.

Oops:

Where this fairly straight-forward repair turned into an ABS to ESP upgrade, was when I went to a local self-serve wrecking yard and picked up the wrong ABS module.  While I knew that there were some models that only had ABS and others that had ABS/ESP/TC, I didn't realise that the connector on the engine bay wiring loom was different, or that the more advanced ESP module needed more sensors.

After I realised my mistake, I looked around for another ABS unit of the correct type, but there weren't any available at the self-serve wreckers.  Still not appreciating the work that would be involved, I decided to have a go at upgrading to the ESP version of the ABS module.

After studying the wiring diagrams for the ABS and ESP modules, I worked out that most of the necessary wires were already there, and that it looked like there were only two extra sensors and a TCSS switch that were needed, so I purchased those and decided to give it a shot.

Unknown to me at the time though, was that there were other things that were going to be needed as well.  Now that I'd spent the money on the ESP module and the extra sensors, I'd committed myself to this project.  Unfortunately, the whole project got a bit expensive.

My initial plan was to just replace the ABS module, see if it worked or not, and whether or not it solved the problem.  I was willing to play around with EEPROMs in order to make it work if need be, but it turned out that doing so wasn't necessary.

Upgrading the ABS module to the ESP version:

Let me start by saying that doing this really isn't worth the effort, and I'm not recommending that anyone does this.  It was an interesting project but I probably wouldn't do it again.

Parts Required:

• ABS/ESP/TC Module & Mounting Bracket
• ABS/ESP/TC Module Connector
• Brake Booster
• Brake Master Cylinder
• Yaw Sensor & Bolts
• Yaw Sensor Connector
• Yaw Sensor Cover & Bolts
• Steering Angle Sensor
• Steering Angle Sensor Connector
• TCSS Switch
• TCSS Switch Connector
• Instrument Cluster from an ESP Vehicle
• Automotive Wire (eg. from Rapid Cables)
• CANBUS Wire (eBay / AliExpress)
• Various connectors for the BCM (to get the sockets out of them).

Highly Recommended:

• A Tacho from another Alto (if you don't have one)
• Steering Wheel Puller
• Suzuki SDT (diagnostic software)
• Bosch VCM-II / VCM2 (or a good/high quality clone)
• Snap-on EPC for Suzuki vehicles
• An account on MHH AUTO (software, service manuals)

Terminology:

Here's the terminology I'll be using, just to be clear:

• ECM: Engine Control Module (Engine Computer)
• TCU: Traction Control Module (Automatic Transaxle Computer).
• SRS: Supplemental Restraint System (Airbag Computer).
• DLC: Diagnostic Link Connector (OBD-II Connector).
• ABS: Anti-lock Brake System.
• ESP: Electronic Stability Program.
• TC: Traction Control.
• ABS/ESP: This means I'm referring to both the ABS module and the ABS/ESP/TC modules or their respective connectors.
• Splice: Two or more wires joined together.
• CAN: Controller Area Network (a network of computers/modules that talk to each other).
• CAN bus: The physical wires connecting the various computers together.
• Tacho: Tachometer.
• SA sensor: Steering Angle Sensor.
• Connector pin numbers: All pin numbers mentioned are from the point of view of looking into the unplugged connector from the front of the connector (the back of the connector being the side where the wires enter the connector).

Useful Service Manual Pages:

• BRC-12/BRC-13: ABS Connector Wiring Diagram.
• BRC-65,66,67: ESP Connector Wiring Diagram.
• BCS-27, BCS-34: BCM Wiring Diagram & Connector Identification.
• PG-36: Shows location of connector G271 (Passenger cabin junction/fuse box).
• BCS-9 & BCS-10: Describes method to clear DTCs without a scan tool.

Sensor Locations:

The steering angle sensor (SA sensor) is located on the steering column, and is clipped into the airbag clock spring.

The yaw sensor is located under the carpet in the passenger cabin, at the front of the vehicle, near the bottom of the firewall (on top of the transmission tunnel - the hump that runs through the centre of the passenger cabin).  There's velcro joining the carpet together in this area.  Pull apart the velcro, then remove the plastic cover you find under there.  This will expose the yaw sensor.

Tips:

Before removing the clock spring, point the wheels straight if possible and use some tape to hold the clock spring in position once you remove it, as you will damage it if it is not centred when you replace it if the wheels are not pointing straight ahead.  You can re-centre the SA sensor if you need to, by carefully and gently rotating it all the way one way, and then rotating it all the way in the other direction, counting the number of turns, and then rotating it back half the number of turns you just counted.  At this point, it should be centred.

Yaw sensors tend to be expensive sensors, but the wrecking yard I purchased mine from had never heard of them.  It ended up going in as a miscellaneous module and only cost around $25.

If you end up cutting and soldering wires, which I recommend you avoid, then use heat shrink tubing with a glue liner (double wall heat shrink tubing).  The glue will seal the connection and keep out moisture, and will provide additional mechanical strength for the splice.

If you have a manual transmission, then get parts from a manual vehicle, if you have an automatic, then get parts from an automatic.  Note that I did this on a manual vehicle, so the same upgrade won't necessarily work on an automatic.

When buying parts, I don't suggest you mix and match parts from different models of the vehicle, as the part numbers vary between the vehicles and you and I probably don't know for sure that the part number is the only difference.  The brake boosters, for example, look the same, but have different part numbers on them, depending on whether it's for an ABS model or an ESP model and manual or auto.  The brake master cylinders are also physically different.  The brake lines that run between the master cylinder and the ABS/ESP modules are also different (ESP has thicker lines).  The part numbers for the brake lines that run to the callipers and the callipers themselves were the same, so no need to replace those.  The part numbers for the ABS/ESP wheel speed sensors are different, but I haven't replaced mine as the ESP module works fine and the vehicle speed is correct (vehicle speed is broadcast on the CAN bus from the ABS/ESP module).

If you're unsure whether or not you can mix and match parts from one vehicle with another, use the Snap-on EPC to check if the part numbers are the same or not.  If they're not, then you probably shouldn't use those parts, as they may be different, even if they look the same.

Keep in mind that the brake system is a fairly important safety feature of the vehicle, so anything you do needs to be done properly and with due thought and care.  This blog post isn't actually here to tell people how to do this upgrade, it's here to let any interested party know what they're going to be up for if they do attempt it, and for my own purposes, to document what I've done, should I need to reference it in the future.  It is primarily meant as an educational resource.

Testing:

I wanted to test that the ESP module I purchased and the various sensors were all working correctly and that the other computers in the vehicle weren't complaining about missing the old ABS module or not being paired with the ESP module.

The service manual for the vehicle has illustrations of the ABS/ESP module connectors, and states which colour wires go to which position in the connector.  You only need to match up the colours of the wires from the ESP connector to those in the ABS connector on the vehicle, using the service manual.

The wire colours in the ABS and ESP connectors are the same and go to the same things, so it's fairly easy to do.

I made this test loom in order to test the ESP module:

Wiring loom with Yaw Sensor, Steering Angle Sensor and ESP module connectors.

Notes regarding the loom above:

• Original high quality image: click here.
• The male pins used (with heat shrink tube over them) are for a male OBD-II connector.  They're made by Aptiv (formerly Delphi), MFG P/N 12047581.  Available from Mouser (P/N: 829-12047581) or RS Components (P/N: 801-0884).  The connectors were salvaged from scrapyard vehicles.
• Connecting the yaw sensor wires is easy - just match the colours up.
• The SA sensor needs 5 wires.  These are permanent power, ground, switched power (ignition), CAN-H and CAN-L.  In the service manual, the CAN-H and CAN-L wiring is reversed somewhere, which results in an inoperable CAN bus.  The wiring in the above photo is correct.
• [1] Ground for the SA sensor is spliced into a ground wire for the ESP module.
• [2] Permanent power for the SA sensor, spliced into the permanent power wire for the ESP pump.
• [3] Ignition ON signal (this wire has battery voltage when the ignition switch is on).
• [4] CAN-H.
• [5] CAN-L

For those interested, the CAN bus in the vehicle is just a daisy-chain of controllers all connected together in parallel, and each end of the CAN bus is theoretically terminated with a resistor.  The ECM connects directly to the ABS/ESP module via CAN, and the ABS/ESP module presents the same CAN bus wires on two more pins, which then connect directly to the BCM.  The BCM then fans out the CAN bus to the SA sensor and the instrument cluster, and the instrument cluster in turn provides CAN bus connectivity for the OBD-II DLC connector.  Any short or reversed wiring on the CAN bus will bring it down, preventing these controllers talking to each other.  This won't prevent the vehicle from starting or driving, but there will be plenty of fault lights illuminated on the instrument cluster, and you won't be able to talk to the various controllers via the CAN bus (eg. by using a diagnostic tool connected to the OBD-II port), but you can still communicate with some controllers (eg. the ECM, SRS computers) as they have an alternative bus as well.

Using the wiring diagram for the ABS module, you can match up the colours in the ESP connector loom and plug in all but five of those wires.  The five wires you're left over with are the four wires for the yaw sensor (power, ground, and it's own dedicated pair of CAN bus wires).  The other is the TCSS switch wire, which is momentarily connected to ground when you press the TCSS switch, so you can leave it disconnected.

You also need to connect the steering angle sensor, but it doesn't need to be installed on the steering column for testing purposes.  The steering angle sensor needs power and has to be connected to the vehicle's CAN bus, as shown in the wiring loom photo above.

Once everything has been connected, you need to set up a container of brake fluid and some hoses (I just used PVC hose from the hardware store for testing).  Get a syringe and prime the ESP module with fresh brake fluid, so that it's not going to run dry.  Put a reasonable amount of brake fluid into a container and connect hoses to all brake line ports on the ESP module, running them all back into the container of brake fluid.  Ensure all lines are submerged in brake fluid, so that the pump can't suck up air.  Try to force air out of the test setup by using the syringe to pump more brake fluid through the ESP module.  To achieve this, I cut the flared ends of the brake lines that go to the ESP module off a vehicle that was about to be sent to the crusher.

Using Suzuki SDT, you can check and clear any fault codes, perform diagnostic tests on the ESP module, and calibrate the steering angle sensor and yaw sensor.  The diagnostic tests will actuate the pump in the ESP module and prove that the module is working.  Unfortunately I don't have a photo of this setup, but I just sat the ESP module on a piece of polystyrene on top of the engine (engine not running).

Instrument Cluster:

Once you're happy that the ESP module is working and that all of the computers are happy with it, you can install the ESP instrument cluster (called the "Combination Meter" in the service manual).

You only need to replace the instrument cluster in order to gain the ESP and TCSS light functionality.  If you don't care about this, then upgrading the instrument cluster shouldn't be necessary.

Unfortunately, Suzuki found a way to save 20 cents (maybe less) and left the necessary components off the instrument cluster PCB used in the ABS-only vehicles.  This is a fairly common theme I've run into when upgrading this vehicle.  No speakers in the doors means there's no wires going to the doors for speakers either.  It seems that if they could save a few cents here and there, they would.  To this extent, I was pleasantly surprised to find that the nuts for the yaw sensor were welded into the chassis of the vehicle, even though they weren't used.

Upgrading the instrument cluster is easy.  It's just plug and play.  I got an instrument cluster from an vehicle which had ESP, plugged it in expecting the ECM or BCM to have a problem with it, but no, it just worked.  Whatever mileage was on the odometer in the vehicle it came from (in my case, much less than my original one) will be the mileage on your vehicle now.  As such, you could play with EEPROMs and transfer your original odometer reading over to the replacement odometer cluster, as I did, or you could not bother.  I would encourage you to be honest about the mileage if you ever sell the vehicle, and record the original mileage of both instrument clusters somewhere (eg. in the owners manual) for the next owner.

You can leave the ESP instrument cluster in the vehicle once it has been fitted, as the ABS unit will work fine with it.  From memory, the ESP and TCSS lights will stay on, because the ABS module won't command them to turn off, but other than that, it's fine.

Tachometer Upgrade:

If you're planning to fit a tachometer, the time to do it is when you've got the instrument cluster out of the vehicle.  For some reason, the automatics have a tacho but the manual doesn't, which was great thinking on Suzuki's part.  I did the tacho upgrade not long after I purchased the vehicle, but from memory it's just 4 wires that run from the tacho and into the connector that plugs into the back of the instrument cluster.  You should be able to get the sockets out of the instrument cluster connector on a salvage vehicle, using a safety pin or straightened out paper clip.  There will be a plastic locking latch you'll need to pry up as well.  If you're allowed to cut the connector out of the vehicle, then just do that, keeping the tacho wires in-tact, and deal with it later.  Take a photo of where the original wires were in the instrument cluster connecter before you remove them, so that you can put them into your own vehicle in the correct locations, and practice removing wires in the connector that don't matter to you first, in case you wreck something.  Connect the wires and the tacho will work with either the ABS or ESP instrument clusters.

Steering Angle Sensor:

The wiring diagram in the service manual doesn't show where all wires for the steering angle sensor are actually connected to.  It shows them connected to other modules and things, but doesn't tell you which connectors or which pins in those connectors.  They basically all go to various connectors either in the passenger cabin junction block (fuse box) or the BCM:

[to be completed - my notes weren't the best]

SA Sensor RED: G04-15 (BCM)
SA Sensor YEL/RED: G04-31 (BCM)
SA Sensor BLK: GND (vehicle chassis grounding point)
SA Sensor WHT: G271-29
SA Sensor GRN/ORN: G271-8

Notes:

• SA Sensor WHT is designated as WHT/RED in the service manual, but it's solid white (no red stripe) in the vehicle I got the SA connector from, as well as in the vehicle I checked to work out where that wire goes in connector G271.
• Page BCS-34 of the service manual shows the location of connector G04 (BCM, behind the fuse/junction block in the passenger cabin).
• Page PG-36 of the service manual shows the location of connector G279 (front of fuse/junction block in passenger cabin).

Preparing for Road Testing:

Before road testing, most of the upgrade needs to be completed.  Swapping out the ABS unit for the ESP unit should probably be the last step, in order to keep the vehicle drivable.  That said, you will still have brakes even if the ESP module isn't connected, just none of the functionality and a few extra warning lights on the dash.  The SA sensor, Yaw sensor and instrument cluster can all be installed while the original ABS unit is still in place and the vehicle will still be drivable.

• Install and wire up the SA sensor.
• Install and wire up the Yaw sensor.
• Preferably install the ESP instrument cluster.
• Install the ESP brake booster.
• Install the ESP brake master cylinder (leave brake lines disconnected).
• Remove the ABS module and install the ESP module in its place.
• Connect the four brake lines that go to the brake calipers.
• Connect the two brake lines to the master cylinder, but don't connect them to the ESP module yet.
• Prime the brake master cylinder (more on this below).
• Wire the ESP loom into the ABS connector and temporarily connect the yaw sensor and TCSS switch wires.
• Bleed the brakes!
• Pump the brakes!

Priming the Brake Master Cylinder:

I originally tried connecting all brake lines and installing brake fluid into the master cylinder reservoir, but couldn't get a brake pedal, as the master cylinder wasn't pumping any fluid.  To remedy this, I disconnected the two brake lines from the ESP module, put some paper towel under them and then pressurised the master cylinder reservoir with my mouth.  Once brake fluid was coming out of the lines at the ESP module, I tightened up the two brake lines again and washed my mouth out.

Doing this again in the future, I'd fit the two brake lines to the master cylinder, but leave them loose at the ESP module.  I'd then fill the master cylinder reservoir with brake fluid and pressurise the reservoir to prime the master cylinder.  At this point, the master cylinder should be primed and the brake lines can be connected to the ESP module.

Using a pressure bleeder would have made this job easier.

The Final Road Test Setup:

Once I'd done all this, it looked like this mess.  This setup was only supposed to last a lap or two around the block, but it ended up lasting for more like 6 months.  The main motivation for fixing it properly (other than road worthiness issues) was that winter was coming and I didn't want to leave the ABS connector exposed to the elements.  As it turned out, there was a very small amount of corrosion on some of the sockets in the connector, but nothing to be concerned about.

ESP module installed and temporarily wired into the vehicle.

What could possibly go wrong?  Lots, but not much did.  Just the odd fault code due to loose connections.  Original high quality image: click here.

Permanent Installation of the ESP Module:

After confirming that everything really did work, I made an ABS to ESP adaptor, so that I didn't have to modify the original wiring harness, and also so that I could put things back to how they were if need be. 

The connector with all the wires soldered into it is from the original ABS module.  I disassembled the original ABS module, removed the PCB and then cut off the male connector portion of the enclosure.

Here's some photos of it:

Original high-quality image

Original high-quality image

After getting to this stage, I taped up the exposed wires, sealed the entry point of the wires to the male ABS connector with silicone and then mixed up some polyurethane potting compound and filled the back of the male ABS connector with it, which seals it all up and keeps out contaminants such as dust and water.  I chose polyurethane as it can be removed in the event that something goes wrong and the adaptor loom needs to be serviced.  The additional connector (it's a 6-way water-proof Deutsch connector) has the wires for the yaw sensor and TCSS switch in it.

My only warning about doing things this way, is that if you look carefully inside the male ABS connector, you'll see pin numbers, but they're transposed compared to what's in the service manual.  As such, those pin numbers need to be ignored when making up the adaptor.

Original high-quality image

Above is just one way of achieving this, but really, it's the hard way.  The benefit of doing it this way is that it keeps the vehicle wiring harness in factory condition, and allows for a relatively easy downgrade back to ABS should it ever be necessary.

That's basically the end of the upgrade procedure.  If I were doing this to another vehicle, I'd be tempted to do it differently and avoid making the above harness.  Here's a photo of the finished conversion:

There's some decisions to be made with regard to how to make this a permanent installation.  For example, do you cut the original ABS connector off the vehicle and solder in the ESP one?  Do you muck around behind the dash trying to connect the SA sensor to their correct locations on the BCM or do you just run some extra wires through the firewall to the ABS wires and splice in there instead?

I chose not to cut and solder wires, mostly because of the added thickness/bulk that all the heat shrink tube would add to the wiring harness in the vehicle.  I also decided that it might be beneficial to leave the original engine bay wiring loom in factory condition, should I want or need to downgrade back to ABS in the future.  I think that the way I did this was the best way, but a close second would be to remove all of the sockets from the ABS connector and insert them into the ESP connector, in the correct locations.  This way there is no adaptor loom and no cutting of wires, and it would look like it was done at the factory.  There would still be a little bit of soldering and heat shrinking of wires, but only the ones for the yaw sensor and TCSS switch, and that could be hidden fairly easily.

The completed upgrade, ESP module installed.  Cable management is still to be improved:

ABS->ESP conversion loom and ESP module installed.

Other things - Not necessary for the ABS to ESP upgrade:

As I was unsure about how hard it would be to make this upgrade work, I was prepared to muck around with the various computers in the vehicle or just replace them all if need be.  As such, as part of this upgrade process, I also purchased the ECM from the vehicle that I got the ESP module from, as well as the BCM, instrument cluster and key reader (immobiliser antenna module).

If need be, I was willing to replace the whole lot, and then of course I'd have to deal with the immobiliser (part of the ECM).  My plan was to just get someone to disable the immobiliser in the ECM if need be, but none of this was necessary.  In preparation for this, I also purchased the necessary hardware to copy and reprogram the ECM, so that the software and/or EEPROM could be modified if necessary.

As part of this process, I also copied all of the EEPROMs from the original vehicle and most of the scrap yard parts, mostly just to have as a backup, but also because I was curious.

You can read (copy) or write (program) the ABS unit, instrument cluster and BCM by using an EEPROM programmer and a SOIC-8 in-circuit programming clip.  The clocks need to be stopped, or the respective microcontrollers held in reset while this is done, so that they don't interfere with the read/write of the EEPROM chips in the respective modules.

It's fairly easy to stop the clock if there's an external crystal on the PCB.  I simply loaded them with a 1K resistor, which I figured probably wouldn't damage the microcontroller crystal drive circuitry.  When it came to the instrument cluster, I instead held it in reset by pulling the reset pin of the microcontroller low, which essentially disables the chip.

All EEPROM ICs were copied/re-programmed using a Minipro EEPROM programmer.

Here's some photos:

Original (Faulty) ABS Module - Stopping the clock with a 1K resistor soldered across the crystal.
EEPROM: Microchip 25LC040E/SN

BCM - Stopping the clock with a resistor soldered across the crystal.
EEPROM: Seiko S-93C66B

Instrument Cluster - Stopping the clock by holding the microcontroller in reset state.
EEPROM: Seiko S-93C66B

Correcting the odometer:

This requires partial disassembly of the instrument cluster, which which needs to be done carefully so that you don't damage the speedometer, or put fingerprints on the LCD or other surfaces in there.

I didn't know where in the EEPROM the odometer reading would be stored, nor did I have any software or tools that could correct the odometer.  To work this out, I copied the EEPROM from the ESP cluster, then installed it in the vehicle and drove approximately 1KM.  I then took it back out and read the EEPROM again, and compared the two files, looking for changes.

This method worked, and I was able to find where the odometer reading was stored, for the most part.  I wasn't able to sync them up completely, but I go them within about 2KM of each other, and I was happy with that.

The original odometer reading was 208,539KM, while the ESP cluster originally had 87,097KM on it.  While that was nice and all, it wouldn't be very honest of me to leave things that way.  In the end, after the EEPROM was modified, the odometer would read 208,537KM.

The image below shows the chunk of data that I replaced in the EEPROM, in order to correct the odometer.  The original ESP odometer EEPROM content is on the left, and the modified data is on the right.

The reason that I didn't just copy the EEPROM from the original instrument cluster into the ESP cluster was because I wasn't sure if there would be calibration data (eg. for the speedometer) or other configuration data.  There are quire a few differences between each instrument clusters EEPROM contents, so it was probably a good decision not to just blindly copy the data from one into the other.

Some of the data that changed was probably for other things (eg. trip meter), so it probably wasn't necessary to modify as much of the data as I did.

Original vs Modified (Hex Fiend):

The ABS to ESP conversion was a fun project and a good learning experience.  It was somewhat challenging at times, but for the most part not too difficult.  Not all vehicles will be this easy to work with, as in some cars the various computers are all paired/married up to each other.  Correcting the odometer was also easier than I thought it would be.

Suzuki Alto 2009+ Adding Fog Lights and Daytime Running Lights

Fog Lights & Daytime Running Lights:

I've upgraded the vehicle by adding LED fog lights and Daytime Running Lights (DRLs) to the vehicle.  

I wanted to fit some sort of DRLs to the vehicle as it makes the vehicle more visible to other road users and pedestrians.  Prior to fitting the vehicle with DRLs, I used to drive around during the day with the headlights on, especially on overcast days.

You can purchase aftermarket fog light replacements from AliExpress which have DRLs built in.  As my variant of the vehicle is the cheap manual model, it didn't come with fog lights, which also means no fog light wiring loom.  As such, I made the fog light loom, which wasn't difficult - just follow the wiring diagram in the service manual.  In addition to that, I ran a pair of extra power wires, one for each DRL light.

To make wiring up the fog light part easier, you can do as I did and purchase a spare engine bay fuse box from a wrecking yard, in order to get the wires and connectors out of it for the fog light fuse and relay, which allows you to wire them in the same way it's done from the factory.

These are the fog lights I purchased: https://www.aliexpress.com/item/1005001456796944.html 

The DRLs are nice and bright, and the fog lights are aimed in a wide but narrow beam, which is what you want.  In fact, compared with the factory fog lights, the spread of the fog light beam is almost identical.  They are quite nice to drive with and complement the headlights quite well.  Due to the fog lights being LED and bright white in colour, I also changed the headlight globes to Philips H4 WhiteVision Ultra globes (4200K), which are apparently the whitest road-legal headlamps you can use in Australia.  These make the DRLs and fog lights look like they're supposed to be there, despite the headlight globes still being halogen.

These fog lights aren't ADR approved, so they're not road legal.  This is part of the reason why I used the factory connectors for the fog lights, so that they could be (fairly) easily removed and replaced with the factory fog lights for roadworthy purposes.

I've been driving around with the fog lights on at night and I'm not getting flashed by oncoming vehicles, so I don't think they're dazzling/blinding other drivers.

The pair of fog/DRL lights cost round $80 AUD at the time.  The lenses are unfortunately plastic, so time will tell how long they last.  If it's a problem, I'll probably try to remove them and replace them with glass lenses from the factory fog lights.

One note for anyone that purchases these, is that the LED driver board is inside a small metal enclosure, but the enclosure isn't waterproof.  They've gone to some trouble to fill the enclosure with potting compound, presumably to protect the PCB from moisture, but the PCBs in mine weren't completely covered.  As such, I used neutral cure silicone to cover the remaining parts of the LED driver boards, and I also sealed up the enclosure they're in with neutral cure silicone as well.  This will void the warranty, but what's a warranty from China worth?  In my experience, not much.

Note that you should only use neutral cure silicone when applying silicone to electronics.  This is because the acetoxy silicones release acetic acid when they cure, which is corrosive.

As my vehicle didn't come with fog lights from the factory, there were no wires for fog lights, and the vehicles never came with DRL's, so there's no wire for those either.  I made the loom using two fog light connectors that I got from another Alto at a self serve wrecking yard.  I purchased some automotive wire of the same colours (green and black) as used in the factory wiring loom, and decided that white would be a good colour for the DRL power wires.  I purchased a couple of new AMP Superseal 1.5 1-way connectors for the DRL power connectors, as these are waterproof automotive connectors.

These fog/DRL lights don't come with connectors attached, just bare wires that you need to fit connectors to.  As I wanted to run a factory-compatible loom for the fog lights, I purchased two second-hand H11 lamps (as used in the factory fog lights) and cut the connector off them.  There were other options, but this was the quickest method, short of waiting for connectors to arrive from China.

On the back of the H11 globes, you'll see a green plastic cover which you can remove, behind which you'll find where the two pins of the connector come out and go into the lamp.  I snapped the globe off, removed the metal clip around the base of the globe and basically just kept whittling down the globe assembly until I was basically just left with the connector.  I then soldered the wires onto the back of the connector (making sure to get the polarity right), filled it with silicone to waterproof it and clipped the green plastic cover back on.

Daytime Running Lights (DRLs):

DRLs can be added to the vehicle fairly easily.  DRLs should be on when the engine is running, and on some vehicles, the engine oil pressure switch is used for this purpose.  Unfortunately, the engine oil pressure which isn't just a simple on/off signal - it's a pulsed signal from the BCM, so using this wasn't going to be as easy as I'd hoped.

Thinking about this further, I decided that using the fuel pump relay to run the DRLs, via a second relay, would be the best way to do it.  The engine computer will stop the fuel pump when the engine isn't running, so this works out well.

In the engine bay fuse box, there's a relay for the fuel pump.  The relay has a pink wire going to it, which feeds power to the fuel pump.  I removed the pink wire from the fuse box housing, which has a female 6.3mm QC connector on the end, then using a scrap fuse box, I took out the pink fuel pump wire and attached a male 6.3mm QC terminal to one end, and also crimped in another wire for the DRL relay coil power at the same time.  Doing it this way, there are no permanent modifications to the vehicle wiring loom.

In the fuse box, you will find a couple of negative wire splices where there's a bunch of black wires all spot welded together.  You can solder an extra negative wire for the DRL relay to the spot welded splices.

The reason for using a dedicated relay for powering the DRLs was for safety reasons.  I theorised that during a frontal collision, it would be possible for the fog light and DRL power wires to short together, resulting in the fog light power back-feeding the fuel pump circuit and keeping the pump running.  This would obviously be a safety hazard.

Using the fuse box from the wreckers, I was also able to wire up a fuse for the DRLs, which is also present in the engine bay fuse box.  I chose a spare fuse position and inserted the missing terminal which I got out of the scrap fuse box.  To save future confusion, I labelled the DRL wires inside the fuse box.

Engine bay fuse box with Fog & DRL fuses and relays installed.

The DRLs use around 500mA (0.5A) each, so I chose to use a 2A fuse (2x0.5A = 1A).

The LED fog lights use around 1A each, so 2x1A = 2A,  I could have used a 3A fuse, but they were't available, so I chose a 5A fuse instead.

2A Fuses: Littelfuse Inc, P/N: 0891002.NXS (Digi-key P/N: F5926-ND)
5A Fuses: Littelfuse Inc, P/N: 0891005.NXS (Digi-key P/N: F5927-ND)

Read/Write/Clone Suzuki Alto 2009+ 33920-68K01 (Bosch 0 261 S04 260) ECU/ECM

It's time to experiment with a remap, so I had the need to read, write and clone the engine computer in my Suzuki Alto (GFC31S, K10B).  Unfortunately, the instructions given in Ksuite don't seem to cover this variant of the ECU, but I've worked it out so that you don't have to.  Actually, I've worked it out twice, because I seem to have forgotten to document it the first time, so here goes...

ECU: Bosch 0 261 S04 260 Motronic
MCU: Infineon TriCore TC1762
Ksuite Plugin: 340 - Bosch ME17.8.xx IROM TC1762

Connections:

ECU Pinout:

E01-1: Red
E01-9 Red
E01-52: Orange
E01-55: Green
E01-56: White
C01-6: Black
BOOT: Grey (see below)

All connections above match what is in the Ktag connection instructions, other than the black and grey wires.

BOOT Pad: 

The next thing to deal with is the BOOT pad on the PCB.  You'll need to connect to a pad on the PCB, either by soldering a small piece of wire or by holding a probe on the pin.  I've done both, as I opened a spare ECU that I purchased from a wrecker in order to attempt to read it, but preferred not to open my original ECU if I could avoid it.  To achieve that, I got some assistance from my father to make up a jig so that a hole could be drilled in the ECU in the correct location to access the BOOT pad on the PCB without opening it, which is the method I used to read the original ECU.

Side note, for those that are interested, the BOOT pad on the PCB connects to pin 87 (P4.1) of the TriCore TC1762 IC.  Port 4 (P4.x) pins are used to configure the boot settings for the TriCore chip, which tells the chip where you want it to boot from (eg. you can boot from flash, the CAN bus, or over serial (ASC0 pins)).  I found the BOOT pin that Ktag wants by trial and error, testing all pads on the PCB that connect to the P4.x pins on the TriCore IC, until one worked.  Search the TriCore TC1762 datasheet for BOOT and HWCFG if you wish to learn more.

The BOOT pad is shown in the image below, at the top, right of centre:

Ksuite:

1. Connect the Ktag to your PC
2. Connect a 12V DC power supply to the Ktag and turn it on
3. Start Ksuite
4. Click PROTOCOLS
5. Under the K-TAG section of the menu on the left, select BOOTLOADER TRICORE
6. From ECU LIST, select BOSCH ME17 SUZUKI
7. Click OK
8. Read the instructions, but skip the connection instructions
9. Click OK
10. Select "340 - BOSCH ME17.8.xx IROM TC1762"
11. Click Read to read the ECU Maps & EEPROM.

Other Notes:

The EEPROM is inside the TC1762 IC, it's not a separate chip in these ECUs.

Using Ksuite to write the EEPROM (EPR file) and Maps/Firmware/Code (MPC) file individually to a spare ECU resulted in the EEPROM being corrupted.  I discovered this after putting the spare ECU in the car, expecting it to start, but it didn't (immobiliser light stayed on).  After reading back the code and EEPROM from the spare ECU and comparing those files with the copies of the original (using HxD) the EEPROM data was found to be corrupt.

To work around this issue, I read the ECU (Maps and EEPROM) into a single file and then wrote that file to the spare ECU that I purchased from the wreckers.  This worked, and the car starts when the spare ECU is installed.

As an experiment, I've had a company do a "Stage 1" tune (remap) of the ECU, so I need to write the modified maps to the spare ECU to try it out.  I'm not sure how good it will be, as it was all done remotely, but it seems a fair few people do it, so I thought I'd give it a go.  If it kills the engine, it won't be a huge loss, since it's done a little over 220,000K's, so a newer engine probably wouldn't hurt.  If you want a copy, leave a comment below with your e-mail address and I'll be in touch (comments on this blog are moderated, so it won't be published but I'll be able to see it).

Update (29/07/2022): I can confirm that programming only the MPC file works, as I have programmed the spare ECU with a remapped MPC file.  I haven't experimented further with the EEPROM programming, to work out if I messed it up or if Ksuite or the associated hardware did.  I plan to re-visit this issue soon.

I can't say that I've noticed much difference with the remapped ECU, though on the first test drive I did notice that I was speeding everywhere by around 3-5km/h, so maybe there is a difference.  Further, less subjective testing is needed.  I'm also considering sending the original MPC file to another online tuning company and getting them to have a go at it as well.

Growatt Sungold 3000 Failure & Repair

I'm documenting this primarily for my own purposes, should I need to do this again at some point.  I'm also doing it to share the information, since it might help a suitably qualified individual repair one of these inverters.  This repair and testing isn't to be attempted unless you fully understand all of the risks.  You could end up being electrocuted if you don't take the necessary precautions.  An RCD won't save you if you mess this up.

Let's get into it!

"No AC Connection" it says, innocently enough.

It's lying and withholding information about the horror that has unfolded inside.

There's a 20A, 3AG HRC ceramic fuse, near to where the mains enters the power board.  It's blown.  

One instinctively looks around to find the actual inverter circuitry (the H-bridge), quietly hoping it's not an expensive pre-made inverter module.  Thankfully, it wasn't.  Just a heap of mostly discreet components combined with four IGBT's to form a H-bridge.  So, it's serviceable at the component level, which is nice.

There's a skid mark across part of the PCB down there, where one of the small transistors has pooped itself.  There's another one with the top blown clean off.  There's multiple burnt and otherwise damaged SMD resistors and a couple of damaged but still functional ceramic capacitors.  At this stage, I pretty much know what's happened.  At least one of those IGBT's has failed short and/or exploded and the gate pin has lost it's insulation property (that's the I in IGBT).  That's a problem, because the IGBT's gates are generally fairly low voltage - 15-30V, but the IGBT itself can often be switching voltages in the hundreds of volts.  In an inverter like this, it could be switching 500V, since that's the maximum voltage the inverter is rated for - but you'd be ill advised to run it anywhere near that.

There's four FOD3120 devices down there as well.  They're gate drive optocouplers for the four IGBT's, but there's a problem.  The isolation barrier has been compromised and some of the low voltage circuitry has been damaged.

There's a rectangular cut-out in the PCB where a couple of wires go to a thermistor attached to the heatsink under the power board.  There's quite a decent black mark down there as well.

H-Bridge Circuitry (damaged):

Second hand units on Gumtree?  Not at the moment.

Schematics available?  Couldn't find any.

Continuing the diagnosis then.  The path the current took via R51/R51A leads back to a low voltage power supply.  Everything there looks physically intact and everything checks out OK with a multimeter, so that's good news.  The logic board still works when there's power from the solar panels connected, so I'm thinking it might have a chance of being repairable.

Since the low voltage power supply also supplies power to all of the FOD3120 optocouplers and is also used for driving the LEDs in those optocouplers, they're possibly all damaged.  Tracing back where the LED side of the optocouplers are driven from leads me to the logic board, as expected.  There's a ULN2003A there, near the IDC header.  Poking around the ULN2003A didn't reveal any obvious damage, but I started the repair by replacing that chip, not taking any chances.   I had them in stock, since they're about as common as dirt.

I then went about identifying all of the components in the H-bridge circuitry.  Since it's a H-bridge, the "high" side and "low" sides are duplicated.  Thankfully, one high and one low section of circuitry survived, and due to this, I decided to commit to doing the repair, since all of the damaged components were going to be identifiable.

Components were ordered and the repair was done.  I replaced every component in the H-bridge circuitry and some others as well, mostly being cautious.  I'm $120 in and I've spent the best part of a day on it.  I don't want to see my efforts go up in smoke.

Repaired H-Bridge Section:

Note: If you look closely, you'll see all of the 20R0 resistors were replaced with 39R0.  There are two 39R0 resistors stacked on top of each other, but you can't see that in the photo, so they're actually 19R5 now.  I somehow forgot to order the 20R0 resistors but had the 39R0's in stock.  You can also see where I've replaced one of the 200R resistors with a leaded type, as I couldn't source any suitable 200R resistors in that size.

Bench Testing:

It was time to think about bench-testing the inverter.  I wanted all of my testing to be current-limited, in case something went wrong.  I didn't want to connect the inverter to the grid for testing purposes, nor did I want to put ~330V DC across the PV input terminals and hope that didn't end badly.  I also don't have solar power here, so the smart meter detecting anything that resembles feed-in had to be avoided, so that rules out connecting it to the grid via a ballast of some sort.  I'm not sure how I'd explain a feed-in event to the power company.

The bench test setup was using the isolation transformer in the schematic below to do the current limiting.  It's a 5A isolation transformer with a suitable fuse installed.  In future I'll be using a 100W electromagnetic ballast to limit the current, so it's included in the schematic, but wasn't actually there when this inverter was tested:

The variac was used to slowly ramp up the voltage and to cut off the PV feed-in to the inverter when the output current of the PV inverter got too high.  Photovoltaic panels are isolated from the mains normally, so an isolation transformer was also used.

The next thing to do was emulate the grid to trick the inverter into thinking it was grid connected.  I gave this a bit of thought and decided to risk killing a pure sine wave inverter by back feeding it a little. I had a Mishto 2500W/5000W inverter that I never use sitting in it's box, so used that.  There were some scary moments, but nothing went bang (kind of surprising since back feeding such an inverter is asking for trouble).

My understanding of how grid-tie PV inverters work is that they raise the output voltage slightly above the incoming grid voltage, and by doing so are able to feed into the grid.  This meant that the PV inverter was going to try to take over powering the test load if it could, and would probably be quite happy to back-feed the Mishto inverter and destroy it.

Using the variac, I was able to regulate how much current the PV inverter could put out, and thus keep the test load partially powered by both inverters.  It was a balancing act, and it got scary at times.  This is why I'd use a 100W ballast in future, combined with a test load over 100W, so that the PV inverter could never take over powering the test load completely.

Below is a diagram of the emulated "grid" side of the test bench setup:

The step-down transformer was used mostly to reduce the output voltage from the large 13.3A transformer feeding the low voltage side of the Mishto inverter.  Once rectified and when under no load, the voltage was too high and the Mishto inverter would indicate a fault.

Connecting the PV Inverter earth to the 240V neutral was done as the PV Inverter initially came up with a "PV Isolation Low" message.  This I feel is rather dangerous, since the metal chassis of both inverters is now tied to the 240V "neutral", which may not be safe to come in contact with.  Something I considered was instead connecting a 1uF X2 capacitor between the earth and neutral of the PV inverter, to again limit any current flow should something go wrong.  I never did it, so don't know if it would have worked to suppress the PV isolation fault message from the PV inverter (it won't start up with a PV isolation fault condition).

Test Bench Setup:

I'd like to find a way to protect the Mishto inverter from being back-fed, but haven't been able to think up a solution to that so far.  If you think you know of one, feel free to clue me in.

Component Values:

Here comes the useful information if you've got the skills to do this level of component repair.  Since there isn't a schematic diagram available at this time of writing, I've made a list of every component in the H-bridge circuitry, which I expect would be the most likely part of the inverter to fail.

I replaced some additional components out of an abundance of caution, since I didn't want to do this repair twice.  Not when it's costing $120 each time and risking damage to the main logic board, which could write-off the whole thing.  Until a schematic becomes available, I'd suggest you consider going the extra mile if attempting a similar repair.

Logic Board:

U2: ULN2003A (SOIC-8)

Power Board:

C43, C41, C47, C33, C35, C40: 220uF 25V LOW ESR (eg. UUD1E221MNL1GS)

C45, C46, C38, C39: 100nF 50V (0603)

D7, D10: UF1J (DO-41)

R64A, R64, R51, R51A: 20R0 (1206)

R61, R63, R71, R72, R47, R48, R53, R54: 3.3K (1206)

R57, R70, R40, R50: 68B (4.99K, 0805)

U5, U6, U3, U4: FOD3120SDV (8SMD)

Q15, Q16, Q13, Q14: MMBT2907A (Original Marking: 2E, PNP, SOT-23)

R38, R56, R39, R55: 100R (1206)

R46, R45: 0.02R (1206) *

R62, R60: 20R0 (1206)

D17, D19, D16, D18: UF1J (DO-41)

R52, R65, R49, R67: 47K (0603)

R41, R65, R42, R58: 200R (1W(?) Metal Film MELF) **

C37, C36: 220pF 100V (1206)

C42, C44: 470pF 100V (1206)

Q5, Q8, Q6, Q7: IXGH48N60C3D1

Other components I replaced as a precaution:

1x IXGH48N60C3D1 + FOD3120SDV

1x SPW47N60C3FKSA1

2x Song Chuan SCL-1-H-DPNO 12VDC Relays (they both had worn contacts).

* These two resistors are probably just zero ohm links, but the originals were unmarked.  As the original resistor that survived measured around 0.02R, I replaced them with 0.02R resistors (P/N: PF1206FRF070R02L).  I also checked the original component for inductance, but it wasn't measurable.

** R42 was damaged slightly.  I couldn't find a suitable replacement, so replaced it with a 200R Vishay PR02, and turned it into a surface mount resistor by bending the leads tightly under the resistor and cutting them short.

Update (29/07/2022): The inverter is still working well, no further problems so far.

Motorola MC68705R3P EPROM Copier / Reader

I needed to copy a MC68705R3P chip and needed to build some hardware capable of doing this.  There is an old project around dedicated to that, but the design is old and after looking at it, I decided it'd be easier to accomplish more modern electronics.

Below you will find information regarding my copier, which also doubles as a programmer, but it's still a bit clunky and needs refinement.  That said, if you're interested in the firmware for it, the source code can be provided.  Once someone shows some interest in the project, I'll probably devote a day or so to making up the schematic diagram.  That said, analysis of the firmware would likely give you enough information to make your own.

If you happen to be into MCU glitching, specifically for the purposes of firmware recovery, I'd be happy to hear from you.  Even if you'd just like to share your experiences, that would be appreciated, as I'm rather interested in the subject and would like to get into it somewhat.

My copier is based on an Atmel ATMEGA1284P.  Using the method that was discovered and documented by Peter Ihnat, I went about creating a copier using more modern technology than the copier I found here.

To understand roughly what my copier hardware does, please refer to Peter Ihnat's documentation regarding the method he found based on timing clock pulses.

My firmware for the Atmel ATMEGA1284P MCU is licensed under the BSD license.  You're free to do pretty much whatever you want with it.

Before we get started, below is an image of the first revision of my copier.  Using the schematic for the programmer circuit designed by Motorola and the information provided by Peter Ihnat, this is what I've come up with.

The circuit itself is fairly simple.  There is an 8-bit data bus running between the M68K MCU and the Atmel MCU.  There are 100ohm resistors inserted in this bus.  The reason for these was to provide some current limiting in the case that the M68K MCU didn't boot into programming mode and instead started to run its pre-programmed firmware.  I wanted to ensure that neither chip would be damaged in this case, as the Atmel chip will drain current and the M68K chip could potentially source current.  In the case where the M68K chip fails to boot into programming mode, the behaviour of that chip is somewhat undefined and unpredictable.  The circuit needs to take this into account to avoid damage to either chip.

The Atmel MCU is running at 20MHz, which provides it ample time to react to anything that the M68K chip needs.  An off-the-shelf Serial<->USB converter board is also used.  This helps with debugging and also provides a method to get information out of the Atmel chip, such as a firmware dump of the M68K MCU.

The disconnected wire you can see is a 1MHz clock signal that was intended to be connected to the M68K MCU EXTAL pin.  I'd disconnected the clock wire and replaced it with a 1MHz ceramic resonator as I was having problems getting my chips to boot into their programming mode.  It turned out that this had nothing to do with the problem.

Above: The M68705 MCU being copied is on the left, the Atmel ATMEGA1284P is in the centre.  You can also see that I have the ISP for the Atmel AVR connected to the board for easy firmware updates, and the USB<->Serial converter is also connected to another computer.

Regarding the problem getting the chips to go into programming mode, the problem was that the first chip I attempted to use was too defective (damaged) to boot into its programming mode.  The second chip I used contained the same firmware but was a mask ROM version and it wouldn't boot into its programming mode either.  This is probably because it's a mark ROM chip and likely doesn't have the bootloader code in it to activate the programming mode, since it would never need it.

Eventually, I got a third M68K chip and it went into programming mode first try.  I wasted quite a lot of time on this issue (days) but eventually got it figured out.  The main problem was that I was blaming myself and my hardware for the problem, convinced I'd somehow done something wrong.

Then there was another problem.  I could see that for the most part at least, my code was finally working.  I was able to see firmware data.  I was able to see some text in that data that identified the person who wrote the firmware I was trying to copy and the company that the firmware was written for.  At this point, I knew that I was mostly there, but just couldn't get the M68K MCU to verify that the code I'd retrieved from its EPROM was correct.

Resolving this issue, again, took days.  The main problem in this case was an assumption I'd made.

I'd assumed that it was very improbable that an engineer would design a chip like this and then require 4097 bytes of data to program the chip.  4096 bytes made much more sense, and I'd assumed that the documentation was wrong.  One night, I decided that I should figure out if I was wrong or if the documentation was wrong.  I changed my code to work up to the 4097th byte, not expecting it to reveal anything or even work for that matter.  To my surprise, it did work and another problem was solved.

That night, I finally got it.  The verified LED turned on.  The M68K MCU agreed that the firmware I'd fed it was the same as the firmware it was programmed with.  Finally, I had succeeded.  It took me much more time than I'd like to admit to get to this point.  All up, probably a solid 2-3 weeks of work.

Here it is, the green LED is the Verified LED.  The yellow LED is the Programmed LED.  All those other wires you can see are connected to a logic analyser.

This was a great moment.  Finally, things worked.  Better yet, the results were reproducible.  This was a small personal milestone for me, as I've been interested in "glitching" MCUs to reveal their code, and this, to me, is a small step in that direction.  This project will also bring a small financial benefit to me, being that it will enable to me repair some products that currently retail for $350.00 AUD or more.  Personal gain isn't the goal here, it's more about learning and a bit of geeky fun.

Overclocking:

Going by the datasheet, the maximum programming clock speed is 1.1MHz, the minimum being 0.9MHz.  As an experiment, I removed the 1MHz ceramic resonator and re-connected the clock wire to the EXTAL pin of the M68K MCU.  I've been able to get the M68K MCU to work correctly at 5MHz, which means that getting a copy of its EPROM only took 5 minutes.  Unfortunately, running the chip at 10MHz didn't work out, but I was pushing the limits as it were.

The firmware contains pre-tested timing values for 1MHz, 3.33MHz, 5MHz and 10MHz operation.  At this time, the code will need to be re-compiled and re-flashed to the Atmel MCU if you wish to try out these alternative clock speeds.

The default build runs at 1MHz.  This is in order to give you the best chance of success and to conform to the limitations of the M68K MCU specified in the datasheet.  It would be trivial to change the code to allow a simple DIP switch selection for the clock speeds, should you wish to do something like that.

Alternative methods:

Something else that I've been thinking about is the fact that since I have control over the clock for the M68K MCU, I should be able to eliminate the timing-based code and instead count clock ticks to determine if the bytes are correct or incorrect.  Since incorrect guesses take more clock cycles than correct guesses do, it should be trivial.  It would also mean that I'd be able to eradicate the timing values from the code and work solely on clock pulses, at any frequency capable of being produced by the Atmel MCU and that also works with the M68K MCU.

If you are interested in the code or the schematic for this project, please leave a comment below.  I will publish that information if there is demand for it.

SUH DER SD83-A AC Synchronous Motor Teardown

In an earlier blog post I did a teardown of a TYC synchronous motor.  We found that it was made of entirely plastic gears and was a little lacking in the quality.

Today I received a new batch of SUH DER SD83-A synchronous motors.  I purchased them directly from the manufacturer in Taiwan.  I also had an immediate need to replace a faulty one.

What follows is the teardown of the faulty motor.  The motor itself and its gears were all in perfect condition.  Its not pictured, but the failure occurred due to dirt and dust getting caught between the motor output shaft and the bushing on the front of the motor.

The bushing is pressed into the front metal panel of the motor.  In my case, when the output shaft had seized against the bushing, the bushing itself started to turn.  So the motor still worked.  That is, until the hole in the front panel of the motor became unevenly worn and the motor could then seize up again.

You may notice evidence of tampering to the motor in the picture below.  I had opened this motor previously in order to get it going again.  Brute force was involved, and it did work again, but it was time to find a new motor.

Let the teardown begin!

Motor with front cover removed.  We can see a mix of plastic and brass gears.  The large plastic gear appears to have a steel gear that mates with the brass gear.  It seems they have decided that plastic gears are good enough for the low torque part of the motor:

Close up of the output shaft gear.  It looks like a brass gear with the steel output shaft pressed into it:

All gears have been removed, the motor output shaft is seen here, along with its plastic gear:

Metal cover removed.  The metal cover is pressed into the exterior motor housing:

Close up of the motor's rotor:

Motor stator (the purple thing - it contains the winding for the motor) and the remaining shell that the stator was sitting in:

Motor stator, insulating tape still installed:

Motor stator, insulation tape removed.  Beneath the wires appears to be masking tape:

All of the bits and pieces that made up the motor:

You can compare the construction of this motor with a cheap eBay motor here:

TYC Synchronous AC Motor Teardown

All trademarks are the property of their respective owners.