Lotus Elise T4E - ECU - secret Datasheet (as it seems)

[cybernet]

Hi,

Big (austrian, no kangaroos fan of this blog, cudos to dave !
Im mostly into reverse engineering (anything electronic in my car, out of curiosity and to fix some stuff that bugs me) so far i've done the gauge cluster (http://www.warp.at/lotus/) and now im onto the ECU (the lotus really hasnt much more) which is a tough one as only one person has cracked it so far. (by unknown means)

Anyhow i ordered one from ebay, and dremeld it out of its tamper proof casing and its still working - i was able to map out all the parts but one - and that is an "ST L9119D" (20pin SOP) - seems to have an SPI bus, and seems to talk to the mosfets that control the ignition. I mailed ST micro, but they immediadly accused me of reverse engineering and told me i wont get any details (bad luck i guess), i found a brazilian website that sell those (ECU repair shop) but they also told me they dont have any specs, and said its very hard to get those. Forget google and co, nothing comes up except chinese resellers. Thats why im trying my luck here - so if anyone has any insight what this device does and/or datasheets that would be cool.

Btw this is not a reverse engineer it - and make a closed source product out of it project, i do share the infos because im certain some ECU guys know what to do once they have full access to the ECU

Some pics, and datasheets of the ECU http://www.warp.at/lotus/t4e/

[amyk]

I did a quick Google and as you said, there are no good results, but one of the results (which doesn't have the part number, but was somehow included) caught my eye:
http://www.ti.com/product/TPIC8101

Automotive chip, same package, SPI bus. Does the pinout match?

[poorchava]

I would expect some highly integrated mosfet driver with some advanced logic (for example you only set frequency, duty cycle and deadtime with spi and the logic takes care of the rest).

Are the injectors driven with low side or high side? N or P channel? I would look for a bootstrap capacitor or an external smps that provides high voltage for mosfet switching in case it's high-side switched. In the past external loads in ECUs were switched with low side, because it was easier to accomplish and required least of additional components. Now I have an impression that industry is moving to high-side switching, because of cheaply available and adequately specced smart high-side switches. Low side switching poses a danger, because in case of wiring loom damage high-side wire can get shorted to gnd and cause damage to ECU or even fire.

It's not an unusual situation in automotive business. It's something I would call a customer specific standard circuit. It means that Lotus (or whoever else designed this ECU for them, because I think Lotus is too small company to pull this off) forced or convinced ST to manufacture chip for them, but it's not an ASIC. In theory you can buy that stuff from ST, but you will not get the DS as it's probably confidential to some point.

My company does the same (but unfortunately, as you may expect I shouldn't say what semiconductor companies or what chips - you won;t probably ever see those anyway ).

[Baliszoft]

Are you sure the spi line you see is not a part of the daisy chain for the output stage diagnosics line (open load/short to gnd/short to vbat)? It would reveal a lot more if you would look at where do its outputs go.

[cybernet]

much appreciated guys, i will definitly follow the leads presented here. i've desoldered one of the micros and setup a little PA rig, and as it seems the HC8 derivate used is vulernable to it, hope that brings any new insights because that one seems to run on the same SPI bus. might need to get one of those uCurrents ....

[poptones]

Motorola has an injector driver in their lineup. It's made to automatically send a high current pulse, a lower current holding current, protect against overload, etc.

Here's one at freescale. I can't find a part number for the motorola.

http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=MC33812

[free_electron]

ST L9119D

The fact it has an open market pert number means nothing. it may be a stripped version of an asic. Blow a few fuses to protect the key IP and sell it open market.
But you may still not be able to lay your hands on it. A lot of parts are not sold in the distributor channel. If the datasheet is not on the St portal you can kiss it goodbye.

[cybernet]

yes probably some custom chip for EFI - which are an automotive ECU designer from italy. however the code seems to have been written by lotus, or at least adapted heavily - same ECU is used in some lambos - one on each side for 2x4 cyls ..

[poorchava]

A completly custom is IMO rather unlikely. I mean cost of setting up ASIC production is something like 100-150k USD. Automotive industry generally uses ASICs in two situations: extreme high runners (I'd guess for example electric window motor driver with CAN in VAG passenger cars) or when they can put the same ASIC into many products (eg. uber-safe power supply, diagnostics interface etc). I think injector driver chip fullfills neither of those. On top of that Lotus or Lambo are not produced in high quantities.

It may happen that several companies signal a demand for similar product, and the distributor itself orders an ASIC taking the business risk and initial setup costs.

[free_electron]

I mean cost of setting up ASIC production is something like 100-150k USD.

Can you tell me the company that does it for only 100 to 150K i'd like to hire them immediately.....

Full custom mixed signal asic with some high voltage to boot starts at an order of magnitude higer than what you mention...
A 45nanometer maskset alone is over 2 M$ ... Go to 32nM and it jumps well over 4M$. The masksets for a modern intel cpu cost well over 12 M$. And that is just the masks. you have not paid any design effort or sent anything into fab...

[0xdeadbeef]

The CPU is on from the old Motorola "Oak" MPC5xx family. They have a power PC core, a TPU (timer processing unit). Chances are that you can connect it via JTAG or Nexus.

[poorchava]

Can you tell me the company that does it for only 100 to 150K i'd like to hire them immediately.....

Sorry, my bad. I've got a habit of converting currency from Polish PLN to EUR with 1/4 factor. I meant 450k, and EUR not USD. Probably makes a difference

For sure it depends on trade agreements with particular ASIC designer/fabricator. The ASIC which i had in mind was i think 0.6 or 0.8 um high voltage CMOS process with some analog extensions.

I don't think that the mysterious IC in questions is much different. If we talk about ASIC for an oscilloscope or something (like the ones in Agilent InfiniiVision or new Rigols) i suppose 45nm makes sense (btw. i suspect those would rather be made in some kind of BiCMOS process rather than pure CMOS). For an ASIC usage situations where the main purpose is integration or cost reduction, much larger process geometries make more sense, because they are cheaper and tremendous speeds are usually not required.

[poptones]

If it has the PPC core in it, and it's Lotus, it very likely is based on Ford's EEC V. That means the injector driver can easily be custom and proprietary because Ford shipped Millions of the things.

I know someone I could ask, but I don't know if he could tell me without killing me afterward