Thing That Go Boom..

On Tyler’s truck (with a 3.08 axle ratio), a tire with a 3rd order harmonic vibration can disguise itself as a 1st order driveshaft complaint. This 3rd order vibration can coalesce with the 1st order driveline vibration to produce a phasing vibration (a vibration that seems to increase and decrease in amplitude at a steady speed). The repair is to make the 1st order vibration as low as possible to eradicate the phasing boom.

“I never got that much into vibration diagnosis,” Tyler mentioned. “I use a sirometer that I use for small engine repair.”

A sirometer is nothing more than a coil of wire inside of a two-piece plastic housing. Dialing the top half of the sirometer lengthens and shortens the wire. The vibrations make the wire vibrate when the length is set just right for a particular frequency. Then, the user reads a numeric scale on the housing of the sirometer to see where a little pointer stopped at to get the frequency.

Everything has a preset frequency that it emits when it vibrates. The frequency measured is a fingerprint of the component that is causing the problem.

“Imagine a tire with a single bump on it,” I explained, “It would generate a frequency of once per revolution. If that tire had another bump, then it would be twice per revolution and then a third bump would be three times per revolution. That’s your First order, Second order and Third order vibration.”

“That sounds easy enough,” Tyler said.

“There can be a lot of math involved in vibration analysis,” I said.

“Bob, I never liked math. This is a hands-on business,” Tyler said, “I don’t like math.”

“Geez, you sound like some students I know, Tyler. It is a hands-on business but you have to think with your brain what your hands are going to do.”

I showed him on paper. Tyler gave me the tire size of a vehicle in the shop: 255/70R16. We used are tire size chart to find the diameter: about 30-inches. The chart also identified the tire circumference of 94.42-inches (although π x diameter works).

“Then divide the 63,360 (inches in a mile) by 94.4”. The revolutions per mile is 692,” I said.

“Okay—now what?”

 “Now we can determine the frequency, or revolutions per second, by dividing by 60 for an answer of 11.5 Hz. When using this formula, it will provide a Hz reading for the vibrating tire at around 60 mph.”

“I still don’t get it,” Tyler said.

“The tire will produce a first order vibration with a 11 Hz to 12 Hz reading if it were the source of the highway speed vibration. If there are two bumps on the tire, then it will produce a second order vibration reading between 22 Hz and 24 Hz,” I explained.

We used another truck in Tyler’s shop. The rear differential ratio on the truck was 1:3.73 and the tires were 255/70R16. The customer said his truck had a vibration around 40 mph and 1,500 rpm that was hardly noticeable, but was there. My vibration analyzer picked up a vibration of 36 Hz measured at the center console.

“Let me guess—more math,” Tyler commented.

“We could do that, but let’s try some special software that does the calculations for us.” After plugging the rear differential specs into the software, and the engine rpm at which it occurred, we get an answer of first order driveshaft vibration. A first order driveshaft vibration will cause one disturbance for each revolution of the driveshaft. 

“Anything that’s out-of-balance will cause only a first order vibration, never any higher order vibrations,” I said.

First order driveshaft vibration is usually caused by a component rotating at the same speed as the driveshaft that’s out-of-round or out-of-balance. 

“Driveshaft balance issues can generally be felt at vehicle speeds over 30 mph,” I said.

Tyler realized that a ‘hands-on’ business such as the repair business involves plenty of flexing of the gray mass between your ears.

2015 Kenworth

A 2015 Kenworth T660 PACCAR MX-13 had the concern of using a tank of diesel exhaust fluid every 1000 miles or so, which is far too much DEF. I remembered helping a shop out that replaced 3 doser valves in one year on a 2011 Volvo D13. Upon inspection, we found a large buildup of crystallized diesel exhaust fluid in the exhaust pipe less than six weeks after a dealer replaced the valve and cleaned the pipe. On that one, the exhaust temperature wasn’t hot enough to completely atomize the DEF. The DEF crystallizes, building up and restricting the exhaust pipe. Volvo’s repair is and insulated wrap around the pipe several inches from the doser valve, maintaining more heat. All Kenworth’s beginning with 2013 emission level engines utilize Selective Catalyst Reduction (SCR). SCR is a process in which Diesel Exhaust Fluid (DEF) is injected into the exhaust downstream of the engine. DEF is converted to ammonia by the heat of the exhaust system. Inside of the SCR canister a catalyst causes a chemical reaction to occur be­tween the ammonia and NOx, turning it into water and nitrogen.

On our Kenworth, we pulled the DEF composition pipe, cleaned the crystallization, and reinstalled the pipe. No DTCs were stored.

Next, we performed the system initiation verification cycle. You either drive the Kenworth with a loaded trailer or bobtail—but the coolant temperature has to reach 150ºF.

“That was easy,” Brighton said.

“We’re only just beginning,” I laughed. “We have to do the steady state verification cycle now.”

The manufacturer prefers to have you use a loaded trailer on a flat road with minimum gradient, but we didn’t have one. “That’s okay, Brighton—we can turn on the A/C and fan to generate a load. We drove the Kenworth above 50 mph, highest gear, with an rpm window of 1100 to 1500. We had to activate the cruise on a continuous distance of 3-5 miles, but idiot drivers prevented that from ever happening. They cut in front of us without using turn signals and then slowed down.

“Drivers down here never did know what that lever on the side of the steering column does,” Brighton said.

We drove the Kenworth in three different increments of 1-mile each, which also works. Using a scan tool, I monitored exhaust gas temps before and after the SCR and pump module. We also had to perform the SCR and DEF Doser cycle the same way as the steady state cycle.

“Now a DTC just set,” I said, noticing a P3915. The EAS-3 ECU flags the code when the NOx sensor heater can’t maintain its normal operating temperature. It was back to Brighton’s pole barn. We rechecked connections and wiring, and I crosschecked component parts against the electronic catalog.

“Someone put a 24-volt NOx sensor in place of the 12-volt sensor,” I said, noticing the wiring job.

“This truck was at the dealer a few times,” Brighton said.

We also checked the resistance of the A-CAN nework at the NOx sensor after the converter (60 Ω measured),the terminators in the PCI ECM (122 Ω measured). By unplugging the Aftertreatment harness connector from the engine harness connector, you can isolate the E-CAN from the A-CAN network. There is an A-CAN terminator in the PCI ECM and one in the EAS-3 ECU connector. The individual terminators came in at 120 Ω, which was good.

A road test and steady state verification cycle confirmed the repair. We later discovered that the original truck owner was a backyard mechanic and installed the wrong NOx sensor.

“This driver also uses a Georgia Overdrive—what is that?” Brighton asked.

An Oldie but a Goodie?

 

Talk about shaking the cobwebs out from deep in your memory, Tyler had a mint-condition, 1987 “C” car with a 3.8 sequential fuel injected engine and C3I (Computer Controlled Coil Ignition) system. Everything about the car was beautiful—including the misfire, occasional stalling and backfire.

“It happened shortly after we rebuilt the engine,” Tyler said. We replaced the injectors, the ECM, the crank sensor once and the cam sensor twice. Oh—and the MAF sensor. That didn’t correct the issues and even the C3I ignition module.”

“Were they all OEM parts?”

“They were known good parts taken off a couple of engines,” Tyler said.

I wrote that down.

“Any suggestions?” He asked.

“Yeah—it probably isn’t an injector, ECM, crank or cam sensor, ignition module or MAF,” I said. “And I doubt if you have a bad plug wire,” I said, noticing a new set on the car. When you think about it, my job is relatively easy. I only get called after a lot of components were replaced and systems have been checked. But sometimes, you just must walk away from a vehicle that has been causing grief to you. It happens to all of us.

They checked the grounds, power feeds, battery, fuses and did a visual inspection. “There just isn’t that much scan tool data to look at for help,” Tyler said. “There are no misfire counters or anything.”

He was right. On-board diagnostics back in 1987 were sparse as were the data lists available. “I used a spark-tester tool, everything fired,” he said. “I also used an injector tester noid light.

“I even checked to make sure that the ECM and C3I module were at the same ground level,” he said.

Over lunch, I remembered my history. The purple/white wire provided a digital input from the ignition control module to the PCM that is used to calculate RPM and crankshaft position. The PCM compares pulses on this circuit to any that are on the Reference Low circuit, ignoring any pulses that appear on both (passive filtering). Since this was a Sequential Fuel Injected engine, once the PCM saw a certain RPM, a single injector would be triggered every 120-degrees of crankshaft, in the firing order.

The ground that Tyler mentioned is a PCM input or more correctly a ground “offset” circuit connected between the PCM and the ignition module. This is a low reference circuit for the digital RPM counter inside the PCM, but the wire is connected to engine ground only through the ignition control module. Although this circuit is electrically connected to the PCM, it is not connected to ground at the PCM. The PCM compares voltage pulses appearing on the IGN reference input to those on this reference low circuit, ignoring pulses that appear on both, which is likely due to EMI (aka “noise”) thus allowing this interference to be filtered out and ignored.

The tan/black wire was the bypass line. Above a certain RPM, the PCM applies the 5V bypass to connect the Electronic Spark Timing circuit to the coil primary control field-effect transistors.

Once 5V has been picked up by the IGN control module it will “switch” to EST or Ignition Control (IC) mode and connect this signal to the primary FET circuits controlling each waste-spark coil pack.

When I got back to his place I decided to use my oscilloscope connected to the brown/white wire at the cam sensor which goes into a buffer amplifier in the ignition module. The signal had a fair share of noise on it. I observed that the signal was going low between the normal pulses and it was assumed to be an extra low pulse as interpreted by the C3I module. The module ended up re-sequencing its coil firing order around the false pulse, resulting in the coil now firing 120-degrees BTDC. My inspection camera revealed that the insulation was shaved off from the cam sensor signal wire under the power steering pump. I pointed it out to Tyler.

“Wow—was there ever a time when you got stumped?”

“You know, Tyler, the only thing more dangerous than ignorance is arrogance. I’ve made a ton of mistakes and I’ve learned from each and every one.

This was a perfect example of following a diagnostic process along with an understanding of the fundamental circuits and what they do.

Had Tyler’s shop performed a thorough visual inspection, there is no doubt in my mind that he would have found it.

“I’m thinking about teaching part-time,” Tyler said, “Any tips on how to teach young adults?”

Don’t teach them,” I said, “Instead, why don’t you provide the right conditions in which they can learn?”

Tyler shrugged his shoulders. “But I don’t have a teaching degree,” He said.

“You’ve got experience, right, Tyler? Well, actual experience creates knowledge that is both respected and valued by others. The experiences you have in life provide the best lessons for others. The experience that you have is rich in knowledge and that is the most compelling and authentic way to make a difference in the lives of your students. And that advice is priceless.”

“I wish your bill was charge-less!”



 

Easy Money Impossible

 

 

"I've checked everything and everything checks out fine," Darrell said about the pickup truck. "It came in for a misfire, according to the customer; but the fact is, the torque converter clutch keeps cycling intermittently."

 

When I get an email, I research technical service bulletins and other documents, and Safercar.gov and for programming updates. I may look at online forums as well. I found nothing on the truck. "The truck has been around to several top shops in the area," Darrell said. "The transmission was replaced three times, the Powertrain Control Module was replaced three times, the coolant sensor was replaced twice, as was the throttle position sensor and mass airflow sensor. And new plug wires were installed."

 

"Were they all OEM new parts?" I asked. "Every one of them, yes."

 

"Good," I said, "At least you've ruled out a lot of possible causes." I wrote it all down in my pad. "You said it's intermittent. Tell me about it," I said, asking all the questions. Darrell said engine temperature didn't matter. Ambient temperature made no difference. Neither did rainy weather. It happened mostly under steady cruise conditions on the highway. "The thermostat was also replaced," Darrell said. I wrote it all down. I did a visual inspection for obvious conditions and wrote my findings down. I checked all fuses and ran a ground credibility check. I wrote all of my findings down. There was an old MAF sensor DTC. A road test did not duplicate the concern. By this time I decided to go to lunch. During lunch, I typically look over all the notes that I took, reviewing what I've learned. I showed Darrell what my visual inspection found.

 

"You know what EMI is, right?" Darrell nodded. "Electromagnetic Interference," he said.

 

"Inductive coupling takes place with magnetic fields. Current flowing in one conductor will create a magnetic field (left hand rule or right hand rule, dependent upon which hand you use to write with) that then induces current flow on a nearby conductor. Then you have conductive coupling.

If something creates a high frequency pulse, such as a loose battery cable, the current pulse caused by the connection will be seen on the wires. Capacitive coupling is another way."

 

"I wish I paid more attention in school," Darrell said. "I remember the instructor said something about it. Please explain."

 

"When a conductor has alternating current flowing within it, a potential difference will exist between it and any nearby conductors. This creates an electric field, or capacitive coupling. The wiring will see this potential difference and current flow will occur."

 

After lunch, we went back to the shop and road tested the truck again. This time, it acted up. While watching the TCC PWM solenoid, we saw that the duty cycle was bouncing all over the place as the TCC cycled on and off. "The PCM is commanding the TCC on and off. It can't be another bad PCM--can it?"

 

Remember what the visual inspection caught? The wiring harness moved too close to the spark plug wiring after the clip that held it in place unlatched. EMI cot into the TCC wiring, confusing the PCM.

 

"I guess they clip those wiring harnesses for a reason," Darrell said.

 

"I guess they do," I replied. "EMI stands for Easy Money Impossible."

 

 

 

 

 



Imagine malware, capable of infecting a vehicle's network of computers, virtually undetectable, and capable of infecting a laptop-based diagnostic tool through an interface? Even more incredible is the capability of infecting a nearby vehicle--a process called air-gapping--and turning control over to a remote host. Dark Tech Investigations is accepting applications. The technician of the future will have her hands full, combating malware-induced issues. This, of course, is a work of fiction. A fictional investigation that occurred in a fictional place by two fictional investigators. Names have been changed.

On a limited-access roadway in McLean, Virginia, beyond a "Warning" sign identifying a restricted government installation, a four-bay service facility sits in the middle of a cu-de-sac, performing routine maintenance on government vehicles. There is a lower level, however, called "Building 17," that won't even appear in the darkest corners of the Dark Web.
It was in this facility that a vehicle driven by a high-ranking US official was in a bay, under examination by a team of technicians. After unsuccessful attempts to diagnose why the driver experienced runaway acceleration, ineffective braking and steering, members of Dark Tech Investigations were called in. Together, Mike and Ben had over 80 years of experience in automotive and computer technology.
They reviewed the work history: an oil change and tire rotation were the only services performed on the vehicle. A thorough visual inspection revealed no discernible problems. There were no add-on components or systems. The only reason the driver survived was because the vehicle ran out of fuel. Attempts to shift the runaway vehicle into park were ineffective, as were attempts to turn the ignition to OFF.
When a factory scan tool was installed, the investigators observed more phenomena that seemed straight out of a science fiction thriller. Diagnostic fault codes appeared and disappeared. There were blank spots where certain data PIDS should have been. Federal investigators introduced an antivirus program that proved ineffective. The infection persisted, almost like a strain of bacteria that's able to survive extreme antibiotic therapies. Even with every computer replaced, the infection returned. Computer forensics has been crucial in the conviction of terrorists, murderers and other undesirables; but malware introduced for the purpose of controlling vehicles is a new threat to the government experts.
Mike and Ben attempted to recreate the drivability concern and they were successful. The vehicle exhibited runaway acceleration while on the lift. Braking and steering systems were affected. We attempted to record the running data but the critical data streams wouldn't record! That was impossible! Until they discovered that their diagnostic tool became infected! This was the stuff of urban legend; the advanced, persistent threat equivalent of a Sasquatch sighting. This malware had the ability to use high-frequency transmissions to bridge air gaps. Ben and Mike used a CAN payload attack called DARK NEMESIS to search, locate and annihilate the malware. And they were successful. The scan tool and associated software had to be decontaminated. "It is feasible to use high-frequency sounds broadcast over speakers to send network packets," Ben said. Our laptop became infected. And then another laptop became infected.

,

 We determined that the malware possessed high-frequency networking capability after seeing encrypted data packets being sent to and from our infected laptop that had no network connection with--but was in close proximity to--a nearby clean machine. The data packets were transmitted even when the laptop had its Wi-Fi and Bluetooth cards removed! Mike and Ben even disconnected the laptop's power cord so it ran only on battery power to rule out the possibility that it was getting signals over the electrical connection. Nope--our special forensic tools showed the packets kept flowing over the air-gapped laptop. When Mike removed the laptop's internal speaker and microphone, the packets suddenly stopped.
Here is the real nightmare: the infected vehicle was able to infect another nearby vehicle. Now that is in the realm of Dark Technology. Vehicles infecting vehicles, just by being in close proximity with each other, such as in traffic, or in a parking lot. How do you fight that?