Xantia V6 broken exhaust (update: and rough low rpm running)

[addo]

A quick surf suggests it's a 406 ECU.

[Stempy]

A look here confirms it

http://www.bosch-automotive-catalog.com ... ation=true" onclick="window.open(this.href);return false;

Although it is listed as a part no for early Xantias, the next link shows that there are several options for later Xantias

http://www.bosch-automotive-catalog.com ... ation=true" onclick="window.open(this.href);return false;

[Mandrake]

Your links both just go to any empty search page, so I can't tell which items you're comparing.

[Stempy]

Pages must have expired. Do a vehicle search for the Xantia and/or the 406, select 'action's then 'show equipment', then click the 'All' tab at the top. Finally scroll down to the air/fuel supply section. It lists five alternative ECU's for the Xantia and two for the Pug, one of them being the same for both auto's.

[Mandrake]

The plot thickens!

According to the results from that Bosch page my ECU model number is correct for my car, as my RPO number is 7905. However there are a lot of different variants. If we ignore the manual variants we have:

0 261 204 234 (mine) - up to 12/1998 or RPO 8028. No mention is made of an immobiliser function in the info bubble.
0 261 206 063 - from 1/1999 or RPO 8029 onwards. No mention made of immobiliser function.
0 261 206 120 - no date or RPO range specified but specific mention is made of a built in immobiliser feature and that it is only available direct from the vehicle manufacturer...

So does that imply that 0 261 204 234 does not have an immobiliser feature ?? I'll check tonight if I get a chance to see what the code of David's ECU is. I'm not sure if his donor car is newer or older than mine, although it is definitely a S2.

One other thought I've had is that I may have inadvertently discovered a way to semi-permanently unlock the engine ECU's and may have done it to mine without realising it.

A couple of pieces of information have been nagging in the back of my mind about the whole immobiliser/unlocking situation with these ECU's.

On Series 1 cars with a keypad immobiliser its a well known trick to enter the immobiliser code, start the engine then unplug the immobiliser keypad while the engine is running and throw it away - rendering the ECU "permanently" unlocked, even if the power is disconnected. Another thing I have read is that some "unlocked" ECU's on the market can be inadvertently re-locked by trying to upgrade their firmware - I've seen multiple people warn against performing a firmware update on an "unlocked" ECU.

Here's my theory:

On a S2 car the CPH performs the role which the immobiliser keypad did in a S1 car - it sends an unlock request when the key is turned on by sending the transponder code to the engine ECU, along with the "confidential" code which matches the two ECU's to each other. At some point after the engine is turned off (a few seconds after the alarm is set, or a few minutes after the engine is turned off if the alarm is not set) the CPH sends a lock request to the engine ECU locking it once again.

What happens if the engine ECU is unplugged before the CPH has had a chance to send it the command to lock ? In other words immediately after stopping the engine disconnect the battery or unplug the engine ECU.

Does this have the same result as unplugging an immobiliser keypad ? Of course next time you connect it again to the same CPH the CPH will at some point send a lock request again and the ECU will be locked again.

But what if you plug this unlocked ECU into a different CPH which does not have the correct matching confidential code ? My theory is that not only must the confidential code of the CPH and engine ECU match for the ECU to be unlocked it must also match for the engine ECU to be locked again! Meaning that only the original matching CPH has the authority to lock the ECU again.

So here's what may have happened:

1) The car is running with the original ECU's - the engine ECU has been unlocked by the CPH.
2) I stop the engine, but then disconnect the battery before the CPH has had time to send a lock request to the engine ECU, leaving the engine ECU in an un-powered and unlocked state.
3) I removed and swapped the CPH.
4) I reconnect the battery and start the car. The engine ECU is still unlocked from before.
5) Some time after turning the key off the CPH attempts to lock the engine ECU, but it cannot, because its confidential code does not match! Every time it tries to lock the ECU after the engine is switched off it silently fails. No immobiliser warning appears when starting because as far as the CPH is concerned the engine ECU is telling it that its already unlocked.

As long as the engine ECU is never reconnected to its original matching CPH it will remain unlocked and will work with any other CPH as if unlocked.

If this theory is correct I believe that this may be one technique that the unlockers use, except they may have an interface of some sort that plays the role of the CPH to find the code to unlock the ECU. A firmware update could potentially wipe the "unlocked" state, thus rendering the ECU waiting for its unlock code from a matching CPH, which would explain the reports of unlocked ECU's locking after a firmware update.

Since I have two engine ECU's and two CPH's I can test my theory by trying to get my original ECU to re-lock with its original CPH, and if that works, see if I can attempt to get the new ECU to unlock and stay unlocked while working with my CPH.

The implications for engine ECU troubleshooting is huge - rather than having to swap both ECU's and keys just to test an ECU on a different car you could literally unplug the ECU of the donor car just after turning the engine off, and it should work in the second car indefinitely (but without an immobiliser) without swapping the CPH or keys...

[addo]

But - how is it DRIVING?

The car is... back to its old tricks, I'm afraid

I've found with keypad cars, if you don't open the doors (insofar as the central locking notes you have), the ECU doesn't require entering the PIN to restart.

Your security surmising is parallel to some of my thoughts, also you could cut immobiliser wires 820-22 once the engine is started, and see if it still ran.

[Mandrake]

But - how is it DRIVING?

Hard to say for sure, its running nicely at the moment but during the week it's usually only subject to short 10 minutes 30mph trips to the train station where it only just finishes warming up as we arrive... as I've said before, too early to tell due to the intermittent nature of the problem.

I've found with keypad cars, if you don't open the doors (insofar as the central locking notes you have), the ECU doesn't require entering the PIN to restart.

I didn't try opening the door but you could be right - I found if I armed the alarm with the fob while sitting in the car and then disarmed it 10-20 seconds later, that was enough to require the transponder, but if I just turned the key off and sat in the car it took somewhere between 2-5 minutes before it couldn't start without the transponder.

So ideally you would have the window wound down, engine idling, bonnet open, reach in, turn the key off, and immediately disconnect the battery without touching the doors.

Your security surmising is parallel to some of my thoughts, also you could cut immobiliser wires 820-22 once the engine is started, and see if it still ran.

Might cause an immobiliser warning to flash on the dashboard though ? When there is just a confidential code mismatch it doesn't seem to cause any visible warnings.

Either that or my ECU is genuinely unlocked. When I get a chance to try some more ECU swapping I will be able to confirm or disprove the whole unlocking hypothesis.

BTW remember me complaining about the poor range of the RF remote on my car ? From the front and sides I get maybe 5 metres but from the back I'd be lucky if I get 2 metres ?

With the new CPH in the car it unlocked from 20 metres away behind the car which it has never come anywhere near approaching before... different CPH and different fobs, so I don't know which one the improvement in range is coming from. Mind you with the glovebox still out the CPH may pick up a slightly better signal in that direction than it normally would...

[Mandrake]

But - how is it DRIVING?

The car was running extremely well again this morning, very zippy and responsive, however the mornings are starting to get quite cold now and there has been some correlation between temperature and symptoms before - with best performance with the engine cold then getting more sluggish as it warms up and the engine bay becomes heat soaked.

I think I'll leave the ECU swapping to figure out the immobiliser locking situation until the weekend because every time I unplug the ECU it resets it which will interfere with my testing of performance. (I want to see how well it runs over several days without resetting the ECU, since a reset can cause a temporary improvement)

[addo]

You can learn your original remote to David's computer set, and back again. I suspect the fob is weak in yours.

[Mandrake]

You can learn your original remote to David's computer set, and back again. I suspect the fob is weak in yours.

I don't have the confidential code yet, but yes when I do I will try programming all the fobs to the same CPH to compare their operating range.

[larppaxyz]

Hi, just a update.

Nothing has changed. Still runs like a pig. Stalling-while-driving issue was fixed, but it again started to act up when idling, doing that 'almost stalling' thing. Also power spike at ~3500rpm is pretty much back.

I have one question. When car is on idle and you rev it so that revs go to let's say 5000rpm and you take your foot of the throttle, revs start coming down, do they get "stuck" on around 1500 rpm for split second or so? I have this, but symptom goes away if i completely remove air filter pipes and everything else. I don't think this is really related, but would be interesting to know. And yeah, i have default air intake and filter is no problem.

[Mandrake]

I have one question. When car is on idle and you rev it so that revs go to let's say 5000rpm and you take your foot of the throttle, revs start coming down, do they get "stuck" on around 1500 rpm for split second or so? I have this, but symptom goes away if i completely remove air filter pipes and everything else. I don't think this is really related, but would be interesting to know. And yeah, i have default air intake and filter is no problem.

Yes mine does that hold at 1500rpm for half a second too, however I had not noticed that it doesn't do it with the air filter removed, and I think it may also be normal behaviour not related to the issues we're seeing.

I think the reason it holds like this is that if you watch the Idle Valve OCR reading when the throttle is open and the car is accelerating the idle bypass valve is fully opened. (OCR reading of over 80%) I had always assumed that the idle OCR valve stays at the same opening necessary to maintain idle when the throttle is opened but this is apparently not the case.

So when the throttle is closed suddenly at high revs the idle valve remains wide open (which is about 1500 rpm on a hot engine) until it drops to 1500 rpm then the idle valve is closed back to the normal opening percentage, which is about 30% depending on accessory load.

Why it fully opens the idle valve during acceleration I don't know, as the additional air flow would be minute compared to a fully open throttle plate, and seemingly unnecessary.

[Mandrake]

I did some more testing on the engine ECU unlock status today - my original engine ECU (at least original when I got the car, not the original factory fitted one!) is definitely unlocked.

I reunited it with its original CPH and tried to get it to lock - started the engine, turned the engine off, got out of the car, locked the car with the remote, came back 10 minutes later, started the car without any problems with the transponder antenna unplugged. I tried a few different things including disconnecting the battery for a while etc but nothing I did would re-lock my ECU, and my ECU would still happily start the car with the wrong CPH fitted let alone with the transponder antenna disconnected.

So there's no doubt that my ECU is unlocked. When doing the same tests with the other CPH/ECU the ECU would re-lock and only start with the transponder antenna connected and correct key present.

I've also got the confidential code for the substitute CPH now so I have now programmed my keys to work with it, which has allowed me to put my steering shroud back together

So I'm now just going to drive the car normally for the next couple of weeks to see whether there is any real improvement in the symptoms or whether the ECU is another red herring!

[larppaxyz]

I had some spare thime, so i watched some Youtube videos where people rev up their 406 V6 engines, none of those got stuck on around 1500 rpm. Even cars that had stock intake... hmm..

Few picks :

" onclick="window.open(this.href);return false;
" onclick="window.open(this.href);return false;

[Mandrake]

I had some spare thime, so i watched some Youtube videos where people rev up their 406 V6 engines, none of those got stuck on around 1500 rpm. Even cars that had stock intake... hmm..

Few picks :

" onclick="window.open(this.href);return false;
" onclick="window.open(this.href);return false;

Interesting. I found it hard to be sure that there wasn't a slight pause on those videos. I might try to take a video of mine at some point. What I noticed in those two videos though is how cleanly those engines rev when the throttle is snapped from idle, mine is stumbling and missing when revved from idle, but I'll save that for a later post...