[solved] Reverse Engineering ECU from 1991 Bosch Mono Jetronic A2.2 idle switch

[pplaninsky]

Hi,

I am dealing with 1991 Bosch EFI (Electronic Fuel Injection) system, however it is not a car question. It is about the Microcontroller or ECU in automotive terms.

Nevertheless, I need to give some description of participating modules:

* Idle switch - this switch closes when the driver releases fully the gas pedal, thus signaling the ECU to start taking care of the engine idle RPMs. Switch is normally open and closes to ground. The gas pedal is linked to the throttle with a simple metal wire, no fancy stuff. When the wire losses tension, the witch closes.

* Solenoid valve. In a feat of German engineering, on the other side of the switch there is a solenoid valve, connected to the car battery positive terminal. Once the gas pedal is released, the idle switch closes and current flows through the valve to ground. Thus activating the valve. The purpose of the valve is not important, but it just cuts some low pressure flow in a hose.

* The ECU has 25 pins connector and it listens for the Idle switch closing on pin3 of that connector. If the gas pedal is depressed, the idle switch is opened and pin3 is pulled high as the solenoid valve works as a pull up resistor to 12 volts (battery positive terminal). Releasing the gas pedal closes the switch and pulls that pin3 to ground. My expectation then is that this pin3 is somehow connected internally to the MCU (Intel 8051) and that the MCU listens for when that pin3 is pulled low to activate the idle engine subroutine.

All that is good, but after reverse engineering part of the ECU PCB - I am left with a WTF, this can’t really work. I checked and checked and checked and checked my reverse engineering, did it from scratch a few times and I am certain I haven’t made a mistake. Unless there is intentionally something on the PCB that throws reverse engineering off, I don’t know how this whole thing can work. And it works - I tested it on the car.

All schematics are attached. If someone is curios/interested in helping, please say so, post here, send me a message, anything.

Note:
The whole thing of how the idle switch and solenoid operate is taken from the official repair manual of the car. There is no documentation for the internal works of that particular ECU Bosch Mono-Jetronic A2.2


Thank you!

[Neepa]

Is this really only a two layer board? Or are there completely buried vias in there making a connection somewhere?

The little box on the left edge might clue one in if this is a stackup numbering of the board layers.

[pplaninsky]

I thought the same, but it looks like a 2 layers, very simple THT board.
Here is how it looks under a bright light.

Also, I have traced for continuity all other resistors on the board to that particular pin on 8051 MCU.
And nothing else seems to be connected. If it had hidden layers and there were more connections, they should ring on the DMM.
I am pretty sure I am missing something or that some weird black magic from Bosch in the 90s.

[pplaninsky]

One thing that comes to mind is that they installed a fake D380, which looks like a diode - but it’s is just a shunt.
Unfortunately, I desoldered D380 and wanted to test it if it is a Zener. Then I accidentally connected it to 25 volts.
There was a big spark and now D380 is indeed a shunt.

My bench PSU was set to 150 mA during the test, which is within the limit of BAV21 regular diode.
However, the total power 25V*0.150mA=3,75W is way above its limit of 0.5W when forward biased.
So, I guess it was a real diode as I remember testing it in circuit previously and having 0.6V drop.

Anyhow, if D380 is just a shunt - it should bring the 12 volts to the MCU. However, you probably don’t want to bring 12 volts to the MCU port, rather something like 5 volts.

I am totally stumped and either I am making a serious mistake in tracing the PCB or something is very weird and I don’t understand it.

[HwAoRrDk]

Are you absolutely sure you have the schematic and component values correct? As it is, it seems like it can't possibly work. Diodes D380 and D381 would prevent any current flow in either direction, and R381 would be permanently pulling down the MCU input pin and the state would never change. C380 would be serving no purpose.

The circuit would make more sense if D380 was shunted (or not part of the circuit at all) and R381 was actually a pull-up to 5V. But then 100uF for C380 would be insane, so I suspect it is more like 100nF. (What is the marking on that cap? Looks like it may be one of those blue ceramic caps. If so, no way it's 100uF in that small package.) That way, it doesn't matter that connector pin 3 is at 12V when the switch is open, because D380 prevents that voltage getting to the MCU. But the switch is still able to pull the MCU pin to ground when closed. The capacitor would serve as some de-bouncing for the switch signal. D382 prevents the voltage at connector pin 3 from going above V_batt + diode V_f (e.g. above approx. 12.7V).

[dustooff]

Hi,
if you look again at the anodes junction of D380 & D381, a track to R380 then passes to R303 & R370 (if I read that correctly).  If R380 is providing a pullup to a ref voltage or just the 5V rail, then when the idle switch is open the MCU.4 has a voltage.  Idle switch closed then D380 pulls low.
I have encountered this concept previously in similar automotive controllers.

[pplaninsky]

If so, no way it's 100uF in that small package.

You are absolutely right - it is 100nF.
It’s just my handwritten ‘n’ looks also like a ‘u’.
Sorry about that.
It is one of the gray plastic caps, with .1M marking => .1uF = 100nF

I thought the same about D380…

[pplaninsky]

Hi,
if you look again at the anodes junction of D380 & D381, a track to R380 then passes to R303 & R370 (if I read that correctly).  If R380 is providing a pullup to a ref voltage or just the 5V rail, then when the idle switch is open the MCU.4 has a voltage.  Idle switch closed then D380 pulls low.
I have encountered this concept previously in similar automotive controllers.

Thanks for that hint.
I went ahead and started tracing this part of the PCB as well.
You’ve read that correctly, unfortunately, R380 is not a pull up.
It would have some voltage on it, but in a weird and convoluted way.
Voltage wouldn’t be constant as R380 is connected to the TPS (throttle position sensor) - which is a pot, referenced to 5 volts.
So, R380 should see something between 0.5 to 4.5V depending on how much the gas pedal is depressed.
Also, that seems not to be the whole story as other things are also connected to this group of resistors and then the signal goes to the A/D converter, which is the only thing that makes sense.

I am not sure why the design is so convoluted. Perhaps, indeed fighting against reverse engineering.
I have once dealt with another automotive circuit, a motor speed control, which was as convoluted as this one (also German make). It is either a German automotive engineering tradition or intentional obfuscation.

I will have the chance to measure voltages live on the car in the next days and I will report back here.

[pplaninsky]

Hi,
if you look again at the anodes junction of D380 & D381, a track to R380 then passes to R303 & R370 (if I read that correctly).  If R380 is providing a pullup to a ref voltage or just the 5V rail, then when the idle switch is open the MCU.4 has a voltage.  Idle switch closed then D380 pulls low.
I have encountered this concept previously in similar automotive controllers.

Hi dustooff,

you were absolutely right. R380 is a Pull up resistor which goes to the +5 volts on the voltage regulator.
I missed that even when you hinted about it, because I was tracing the board and couldn’t see a trace going to there.
In fact there is a tiny trace that was ‘hidden’ below the bent leg of the resistor. See the picture below.

And somehow I missed to ‘ring’ the circuit.

I am also attaching the corrected schematic.
Now, it all makes sense, however it is still a weird design. I guess, a lot of diodes are needed to deal with transients and noise from the car’s electrical system and ignition.

[pplaninsky]

Hi dustooff,

one last question - I was just curious what purpose D382 might be serving in this design?

[SteveThackery]

one last question - I was just curious what purpose D382 might be serving in this design?

Strange, isnt it. I wondered if it might be a flywheel diode for the solenoid, but I can't make it work like that.

[moffy]

Hi dustooff,

one last question - I was just curious what purpose D382 might be serving in this design?

As SteveThackery suspects it is a freewheel diode, the input to the regulator should have storage capacitors and the energy from the solenoid on switch off gets dumped into them through D382.

[pplaninsky]

Immense thank you to all for the useful hints.

Indeed, there is a storage cap - 220 uF next to the Vreg.

Adjusted the schematics with this final detail.