Zytek ECU Tuning/Diagnostics

[solly]

From everything I've read, it is impossible to connect to the Zytek unit without the blue interface box. Other ecu makers also did this many years ago, something about computer communications protocols back in the late '80s/early '90s. And those boxes, which came in a blue plastic kit from JaguarSport are unobtanium. Apparently there are only 2 kits in North America and they are not available. So I can pay someone to try to hack the unit and see if they can make me some type of communicator, or I can upgrade to Motec or similar which I would hate to do, but may be my only choice. Or I can wait until the recommissioning is done and try a hard reset. I don't know the factory map for this car, but it will default to whatever settings were programmed in back in 1993. Decisions....decisions....

[PaulGover]

Knowing absolutely nothing about this, but suspecting the blue box is hiding a standard protocol (e.g. some years ago I was going to build some video editing software; my camcorder had a proprietary controller cord, but reading their literature carefully, is was just a very slow ethernet (8KHz!) just labelled something else), I went down the world-wide-rabbit-hole. And found a link that might be useful:

https://www.aim-sportline.com/download/ ... 00_eng.pdf

[xjs.v12]

Usually I spend time on the XJS forums/groups and sometimes wind up trying help XJRS owners w/ issues. I ran across this post looking for any data on the Zytek diagnostic systems.

It's weird that more info hasn't become more readily available. So much has been released or backwards engineered for old Range Rovers/Triumphs etc using Lucas ECUs, or Lotus using old GM ECUs etc, it's surprising Zytek's old ECUs are still so *obscure.*

I know those old diagnostic kits and interface are worth thousands right now. In order to make Zytek XJ220/XJRS/Janspeed etc diagnostics widely available it's going to take someone, or a combo of people to work together to make the Zytek protocol known/open to older Zytek ECU owners. Once those systems have been reverse engineered though they'll be worth a lot less. That's going to make owners think twice about suggestions #1 and #2 below although I hope someone will end up being generous.

What's needed:

1. A clone of the Zytek floppy data and installation software as an image using DiskClone/WinImage (or similar) and make that image available for download & dissection (possibly more problematic than #2).

2. Maybe a clone image of the hard disk of one of these Toshiba PCs (maybe not needed but could helpful - its possible to get that image running in a Virtual Machine on a modern computer).

3. Reverse engineer the protocol for communicating with the ECU and what's in the blue box. (This may not be as impossible as it sounds as there's some groundwork -cited below- on which to stand), but it would take either dissecting the Zytek software, OR observing an actual full diagnostic session via oscilloscope.

4. It might require a Blue diag box owner to Ohm out the ECU side diagnostic connector pins on the Blue Box to determine if there are any internal pull-up resistors that cross two of the diag port wires in order to initiate communication (like is sometimes used to get a GM OBD1 ECM to start talking).

I'm looking at the S80 pub for the XJRS (I don't have the XJ220 Elect PDF to compare) and there's a data connector with 6 pins used. From what I can see, only TWO of those pins could be used for communication. A TX and an RX probably? (Pin JSC4-9 and JSC4-6) Or one of them must be jumpered w/ a resistor (similar to GM OBD1) in order to put it into communication mode with a single TX/RX pin. JSC4-1 is 12V power, and the rest are connected to ground, or ECU ground in some fashion. OBD1 protocols work on a simple RX/TX protocol over an RS232 cable (serial cable) (usually using one wire). And the baud rate must be known. I bet the Blue Box is doing something very similar.

Typical OBD1 serial interface designs:





"$10 USB OBD1 cable"

This is usually dead easy to get OBD1 connected to USB using a FTDI USB cable, and beyond that there are number of designs for RX/TX serial interfaces between OBD1 and a computer that are probably very similar to what's in the blue box. USB would be a nice upgrade.

As for the protocol, hopefully the existing software can be re-used, or, (harder) the communication can be observed via oscilloscope and reverse engineered (that's above me, but for a superb example of *doing just that*, look at Stuart Schmitt's reverse engineering of the protocol for the GM E&C bus (-an OBD1 protocol contemporary for early communication between radio/controller/aircon etc) http://stuartschmitt.com/e_and_c_bus/
http://stuartschmitt.com/e_and_c_bus/bu ... ption.html

The arduino hardware interface Schmitt designed is almost EXACTLY like an OBD1 interface (the first picture above).

OBD1 backwards engineering here too:
https://lukeskaff.com/projects/car/gm-o ... scan-tool/

The PDF that Paul Grover linked shows a communication protocol table on Pg 3 that looks a bit like OBD1 Mode 1 communication data and that ECU uses a single RX/TX pin just like OBD1.

Hopefully this adds to the conversation in some way.

Best,

Paul K.

[marekh]

Dear Paul,
/1 of your post is already done. The XJRS software is available and runs in a DOS box under W2k or earlier - no Toshiba laptop needed.
/2 of your post will probably only yield alternative stored maps to those already in the ECU.

I think to progress this, people need to identify which Zytek ECU they have as Zytek made plenty of different ones over the years. Given that we are dealing with 1980/90s technology and that there is often an overhang from the previous ECU which affects how they'd implement the next ECU, documenting what we do know will often give a steer as to where they would have gone next. Other cars like a racing v12 from before this time or something like a Bentley of that period will be worth looking at - it clearly wouldn't have been economical to just supply a handful of Jaguars.

If someone will just photograph the insides of the blue box, that'll help. You know one end is PC serial port compatible and the other end mates with certain pins on a Zytec loom, so knowing the pinout of the loom for the ECU will help. (There is also plenty of technology for looking through solid objects - just sweet talk someone at your old university or buy a £20 ticket on Easyjet and carry it through airport security to non-intrusively look inside. The most I'd expect to see is an EPROM which needs replicating.)

kind regards
Marek

[xjs.v12]

/1 of your post is already done. The XJRS software is available and runs in a DOS box under W2k or earlier - no Toshiba laptop needed.

That's good to know Marekh. Any idea where that's available to look at/copy?

I suppose one place to start IDing ECMs is to put the word out here, JagForums, and some of the special niche Jag Facebook groups.

There are a couple of folks (2 cars) experiencing the same issue on the XJR-S / TWR owners Facebook Group where the ECM is waiting 20 seconds after key-on or trying to start before it powers the fuel pump relay. One car is doing it even w/ a spare known good ECM swap. The Zytek diagnostic system being unobtainium is a partial handicap in diagnosis.

That's an interesting suggestion.. checking the contents of the box w/ XRay backscatter. Ideally one could crack the box to directly identify the components and values, but for those boxes that are foamed/potted an external Ohm meter probe and X ray may be as good as it gets.

I'm betting the contents are very simple... maybe there's a 555 timer used or as you said, the eProm at most, but I'm betting its mostly going to be an analog thing...

~Paul

[solly]

I believe that reverse engineering old ecus and developing communications hardware/software for old Range Rovers and Triumphs made sense financially because there are so many of them. Only 280 xj220s (approximate) and I don't know how many XJR-S cars were made in total, and JaguarSport only distributed about 24 diagnostic kits for the xj220 and I don't know how many for the XJR-S. The interface boxes for the XJR-S, XJ220, and XJR-15 are identical according to a mechanic friend who has one. Only the software is different. I know of only 2 diagnostic units in North America, and one of them is in Canada. These were insanely expensive when new, about 30,000 GBP if you wanted one. I have no idea what a kit would cost today, but I assume it's a lot of money. So I don't think any kit owner is going to let someone take his interface box apart, melt all the resin, and try to determine what components are in the box. Same with X-ray, as it could fry any delicate electronics (if there are any) in the box.
The ZYTEK ECU connector in your car may be located next to the ecu, or somewhere else like under the dash. It looks like this:

The male plug from the interface box to this connector looks like this (can be green or usually black):

Only 4 functioning pins. I believe they are power, ground, and a twisted pair for I/O data. Not a very complicated setup.
Cables with ends:

[solly]

I followed the instructions to insert an image. Obviously didn't work. How do you get an image into a post?

[ptjs1]

Steven,

I don't think that your image urls are valid, either because they don't exist or perhaps because they don't have sharing permissions?

Paul

[solly]

I figured it out, but apparently limited to 3 images per post.
Interface box (can be blue or silver):

Side view of interface:

Side view of interface

SPD1039 is the correct part number for the interface. The cables are SPD1038 and SPD1040.
Unfortunately many of the original floppy disks are now corrupted, but there are people around who have backed up the disks to USB sticks and will sell the software on a stick. I will ask one owner if its ok if I post his name and contact info for those who need software. I purchased the software from him on a USB drive but haven't received it yet. It will run on an emulator as long as there is a hardwired serial port, not a virtual serial port. He has software for the XJ220, XJR-S and XJR-15. I believe this is all diagnostic "user" software that dealers would have gotten. It can diagnose but not make changes. There is also "super user" software that I am trying to find that will allow different mapping. That was for the factory and for race teams who wanted some changes from stock. There is also a map file for the 680bhp as used on the S cars floating around. If anyone knows where either of these is available please let me know. An EPROM from a 220S might work too (I think), then I could have one map for daily driving and another for the track.

So the software is available, the cables can probably be made, but who is going to be the first to loan his interface to someone who knows what he is doing. I'm sure we have some very technically skilled electronics people on here (I'm not one of them).

[davidr]

I'm enjoying this thread although I don't understand half of it! This illustrates perfectly the power of the Forum to bring people together in collaboration on a relatively obscure but important issue.
You can post more than 3 images if you place them inline.

[xjs.v12]

Some of this convo is split up on different forums as different questions get asked of potentially different audiences.

Some relevant thread links:
https://forums.jag-lovers.com/t/zytek-e ... ber/382369
(Did a bunch of parts documentation there)
https://forums.jag-lovers.com/t/zytek-s ... -pc/381667

Oh Dr. Solly, I agree no one is going to risk depotting their box in hot water unless it's dead already and they're using it as a doorstop.

I would say, although I fully understand the concern about X rays, many of those units have certainly already been through them several times via airport shipping when they were going all over the world. Electronics go through every day, and all documentation/info I can find is that X rays would have to be VERY intense and on for a very long time to even try to damage electronic parts, let alone the old robust stuff. But I get the concern given the dollars involved.

The only other suggestion (maybe one day we'll get it done) is to send the box and a spare XJRS ECM to a reputable ECM repair group w/ the special task of reverse engineering the box. I think watching communication w/ an oscilloscope that can record it is about the best and safest way of doing it. A little over my head ATM, but I've seen how it's done via my own interest in microcontroller programming.

Spitballing anyway...

Next it would be nice to know for sure what the pin to pin layout looks like for the
240° 5 pin din put to 9 pin RS232 port looks like (and if there are any resistors or crossovers in that.
As well as the 240° 5 pin din to PM4 plug pinout (as documented in the link above).

~Paul

[solly]

And as time goes on this will become more and more important. Now that people are driving these cars again because there are new tires, faults will inevitably pop up. And without a diagnostic kit and the correct software you will have to physically check every component being monitored (I believe there are 6 on the xj220, don't know about the other cars), and hope you will find a bad component that you can replace. But you will not know if you did it correctly or not without the diagnostic kit. The only other way to test it is see if the CEL goes off after FIFTY driving cycles. Not on/off, but real driving cycles. Then, if everything is OK, the CEL will disappear. Imagine doing that for all 6 monitored components until you find the problem. And if it's a bad sensor you will drive yourself crazy. And if the ECU itself has packed up it's all over. Now you must switch to a new setup like Motec, Link or similar, at roughly $30-40,000. I know the MegaSquirt is much cheaper, but it's hard to set up, needs a professional to program it on a dyno (minium 5-6 hours of dyno time, could be a lot more), and the name itself just makes me want to laugh at it.

I have been emailing back and forth with Richard Sterling at Zytek UK (now Continental engineering), who worked at TWR when these cars were being made. I explained the problem and he did some research on it. They still have an xj220 test area and a few kits they use (he sent me the picture of the green connector), but to manufacture new kits would have to make business sense to his company. He personally would love to do it, but I'm still waiting to hear back from him. How much could it possibly cost them to send the schematics to Taiwan and have a bunch of cables and interfaces made up?

And everyone should get a laptop with a real serial port before they are no longer made. While the software will run on a new Windows 10 machine in DOS/Win3.1 emulation, apparently it will not work with a virtual serial port. Has to be a real serial port, and those are disappearing as USB takes over. Personally I would love to keep the Zytek unit. It's a rugged robust unit. I just wish it had a knock sensor. I'll keep after the Zytek people and try to convince them to do this for the glory of old blighty (whatever that means. I'm from NY), like Bridgestone did with the tires (I wonder why Pirelli isn't making YouTube videos about the new tires they made for the xj220).
Meanwhile thanks to all of you for the help.

[PaulGover]

Maybe someone will wire up a Raspberry Pi to do it. The latest Pi has number of General Purpose IO pins you can sense or drive to 0 or 5V, plus two 4K TV sockets, all for under £40. Alternatively, someone could program a Pi to completely replace the Zytek kit. Just a Small Matter of Programming, as salesmen of my acquaint used to say (before I kicked them in the n**s).

[debill351214]

I have been working with electronics for 50 years but not computer software, I own a Rare 1987 TWR XJS with Zytek ECU which is working well, but i am aware of the EPROMs memory chip has a limited life and am wanting to backup its map before any problems occur, are there any schematics from Zytek showing the circuit of a 1980s ECU? this would allow us to make connection cables and possibly the interface?

[solly]

I recently acquired what is probably the last Zytek diagnostic kit on the planet. I have both the dealer diagnostic software and the dealer 4 pin connector (apparently JaguarSport did not want dealers monkeying around with the ecu). I also have the factory programing software with the 5 pin connector which was only released to race teams. I have diagnostic and tuning software for the XJ220 and XJR-15. Unfortunately I can't ship it to anyone because if it gets lost in transit it's game over. If you are in my neighborhood feel free to stop by and we'll hook your car up. As soon as my car is back together I will download the existing map, so if anyone's EPROM stops working I can reprogram a new one.

Does anyone know which turbos, fuel injectors, and fuel pumps were used in the TWR XJ220S cars? The Garrett T3 tops out at under 300 bhp (for each bank), so the "S" cars had to use a larger turbo on each side, but after reading hundreds of compressor maps i can't pin it down.