DIY: Replace dreaded steering-lock on 2009s and early 2010s.

kenchan · 01-18-2012, 12:54 PM

Quote:

Originally Posted by ChrisSlicks

可能在组合的一块555个定时器芯片。虽然便宜的联合微型控制器的价格我大概那些日子会被诱惑连同路线也是

is this your name in chinese, tiki tiki tembo?

wstar · 01-18-2012, 12:03 PM

Hmm I still think I don't quite understand it. I blame Nissan's documentation

This is my best current guess at how the whole thing operates, now:

The lock unit supposedly has 7 pins on it. I'm giving them my own names for now since I still haven't found a pinout for connector M40, which is the actual connector at the lock unit:

G1: Grounded permanently
G2: Grounded permanently
P1: power supply, switched by IPDM E/R
P2: power supply, switched by BCM
S1: feedback switch output: +12V when locked, 0V when unlocked
S2: feedback switch output: 0V when locked, +12V when unlocked
C: communication line between lock module and BCM

Physical states:
The steering lock can be in one of two physical states: locked or unlocked. Once it has switched to a given state, it will remain in that state until commanded to change, regardless of whether any power is supplied to the unit. No relay has to remain energized to maintain one of the states or anything like that.

Power supply states:
P1 (IPDM E/R): When ignition is ACC or ON, no voltage supplied. Temporarily supplies battery voltage for a short while after opening the driver's door when ignition is OFF, or after pushing the ignition button once when it's LOCKed.
P2 (BCM): When ignition is OFF or ACC, +12V is supplied. When ignition is ON, it is not.
None of this completely makes sense, but the bottom line is, when the ignition is ON, neither power supply pin gets voltage, so no change to steering lock status can occur. When ignition is not ON, one of the two power pins (or both) will give it power at the right times for it to respond to a lock or unlock command, somehow.
It could be the case that P1 (IPDM E/R) only powers the feedback switches that drive S1 and S2, and P2 (BCM) powers everything else (the mini-controller that communicates with the BCM and actually moves the lock)

Switch states:
The S1 and S2 outputs are redundant inverted status outputs. They're almost certainly driven by physical switches that are tripped by the locking mechanism itself. In the unlocked state only one of them provides +12V, and in the locked state only the other does. If they're both +12V or both not +12V, that triggers a diagnostic failure. If they don't feedback that commands were followed correctly, that also triggers a diagnostic failure. Also of note: these are connected to both the IPDM E/R and the BCM, so for some reason both modules want to see this status.

BCM Communication Line:

This is the perplexing 7th pin "C":

It's listed as both an input and an output for the BCM. It seems definitely sure that the BCM is who sends that little pulse train against a 12V background to send LOCK and UNLOCK commands, as an output. I misunderstood earlier that the pulse train came from the lock module.

What really makes no sense is how any of this could be an input back to the BCM. Maybe it's mislabeled (from my point of view), and it's a BCM-output only, and the BCM drives it at +12V while LOCKED, and 0V when unlocked for 15+ seconds, and whenever it wants to send a command, it applies the +12V (if unlocked before) and then sends the pulse signal.

I guess someone would have to figure out what the manual means by clipping onto this with a scope (or really, even a multi-meter would do, since the only complex bit is already documented in the diagram above).

ChrisSlicks · 01-18-2012, 12:25 PM

Quote:

Originally Posted by wstar

It's listed as both an input and an output for the BCM. It seems definitely sure that the BCM is who sends that little pulse train against a 12V background to send LOCK and UNLOCK commands, as an output. I misunderstood earlier that the pulse train came from the lock module.

What really makes no sense is how any of this could be an input back to the BCM. Maybe it's mislabeled (from my point of view), and the BCM drives it at +12V while LOCKED, and 0V when unlocked for 15+ seconds, and whenever it wants to send a command, it applies the +12V (if unlocked before) and then sends the pulse signal.

I guess someone would have to figure out what the manual means by clipping onto this with a scope (or really, even a multi-meter would do, since the only complex bit is already documented in the diagram above).

I think I agree from reading it that the pulse appears to be coming from the BCM. Not sure that you would capture the pulses with a multimeter, they appear to be only 1ms in duration at about 75ms, 35ms, 12ms apart respectively, definitely the job for a scope.

I think the main thing it going to be giving the ECU the correct signals on 97 (S1), 98 (S2).

wstar · 01-18-2012, 12:34 PM

Quote:

Originally Posted by ChrisSlicks

Not sure that you would capture the pulses with a multimeter, they appear to be only 1ms in duration at about 75ms, 35ms, 12ms apart respectively, definitely the job for a scope.

Well what I mean is, we don't really have to capture them, since they're documented and they have to come from the BCM because there's no other way it's signaling the module to make the change.

What I don't understand is whether the lock module also supplies voltage to this wire at times to provide feedback to the BCM or something.

One way or another, a replacement would need: a cheap microcontroller to sense the command pulses on the communication line and update a little NVRAM state indicating whether the fake lock is currently stuck-on or stuck-off, the microcontroller would need to be powered on any time either of the power supply pins lights up and provide S1/S2 feedback based on NVRAM, and possibly voltage feedback on the communication line as well.

ChrisSlicks · 01-18-2012, 01:02 PM

Quote:

Originally Posted by wstar

Well what I mean is, we don't really have to capture them, since they're documented and they have to come from the BCM because there's no other way it's signaling the module to make the change.

What I don't understand is whether the lock module also supplies voltage to this wire at times to provide feedback to the BCM or something.

One way or another, a replacement would need: a cheap microcontroller to sense the command pulses on the communication line and update a little NVRAM state indicating whether the fake lock is currently stuck-on or stuck-off, the microcontroller would need to be powered on any time either of the power supply pins lights up and provide S1/S2 feedback based on NVRAM, and possibly voltage feedback on the communication line as well.

I think the output voltage signal only needs to be supplied when the unit is in the powered state and that the unit can be power off pin 106. Pin 111 is also temporarily powered to 12V prior to any signal being sent.

One test that may be revealing is whether you can simply permanently send an "UNLOCKED" status voltage without throwing a terminal error (might show as a lock error but still allow you to start and drive). I wonder if failed units where not sending a voltage on either pin or registering "LOCKED".

Vaughanabe13 · 01-20-2012, 12:49 PM

Quote:

Originally Posted by wstar

Hmm I still think I don't quite understand it. I blame Nissan's documentation

This is my best current guess at how the whole thing operates, now:

The lock unit supposedly has 7 pins on it. I'm giving them my own names for now since I still haven't found a pinout for connector M40, which is the actual connector at the lock unit:

G1: Grounded permanently
G2: Grounded permanently
P1: power supply, switched by IPDM E/R
P2: power supply, switched by BCM
S1: feedback switch output: +12V when locked, 0V when unlocked
S2: feedback switch output: 0V when locked, +12V when unlocked
C: communication line between lock module and BCM

Physical states:
The steering lock can be in one of two physical states: locked or unlocked. Once it has switched to a given state, it will remain in that state until commanded to change, regardless of whether any power is supplied to the unit. No relay has to remain energized to maintain one of the states or anything like that.

Power supply states:
P1 (IPDM E/R): When ignition is ACC or ON, no voltage supplied. Temporarily supplies battery voltage for a short while after opening the driver's door when ignition is OFF, or after pushing the ignition button once when it's LOCKed.
P2 (BCM): When ignition is OFF or ACC, +12V is supplied. When ignition is ON, it is not.
None of this completely makes sense, but the bottom line is, when the ignition is ON, neither power supply pin gets voltage, so no change to steering lock status can occur. When ignition is not ON, one of the two power pins (or both) will give it power at the right times for it to respond to a lock or unlock command, somehow.
It could be the case that P1 (IPDM E/R) only powers the feedback switches that drive S1 and S2, and P2 (BCM) powers everything else (the mini-controller that communicates with the BCM and actually moves the lock)

Switch states:
The S1 and S2 outputs are redundant inverted status outputs. They're almost certainly driven by physical switches that are tripped by the locking mechanism itself. In the unlocked state only one of them provides +12V, and in the locked state only the other does. If they're both +12V or both not +12V, that triggers a diagnostic failure. If they don't feedback that commands were followed correctly, that also triggers a diagnostic failure. Also of note: these are connected to both the IPDM E/R and the BCM, so for some reason both modules want to see this status.

BCM Communication Line:

This is the perplexing 7th pin "C":

It's listed as both an input and an output for the BCM. It seems definitely sure that the BCM is who sends that little pulse train against a 12V background to send LOCK and UNLOCK commands, as an output. I misunderstood earlier that the pulse train came from the lock module.

What really makes no sense is how any of this could be an input back to the BCM. Maybe it's mislabeled (from my point of view), and it's a BCM-output only, and the BCM drives it at +12V while LOCKED, and 0V when unlocked for 15+ seconds, and whenever it wants to send a command, it applies the +12V (if unlocked before) and then sends the pulse signal.

I guess someone would have to figure out what the manual means by clipping onto this with a scope (or really, even a multi-meter would do, since the only complex bit is already documented in the diagram above).

The lock module almost certainly uses serial communication on line "C", which could be relative to the 12V power, but more likely it is relative to an internal voltage regulator (I'm guessing 3.3V or 5V) and probably optoisolated. It doesn't even matter what kind of protocol they are using (I2C, SPI, proprietary, etc.) because you could just use a bus pirate to record the streams that are getting received/sent from the lock module. Of course, this would require that you have a module that is actually working (and not intermittently). You could use a tiny microcontroller and a couple of relays to emulate a functioning lock. The use of flash or EEPROM for saving the switch state might not be the best solution, depending on how fast the micro boots up and how much time is available to send the "all clear" signal.

I can't work on this, unfortunately, because my Z is in storage. But it sounds like it wouldn't be too hard to make a fake lock module.

wstar · 01-20-2012, 01:27 PM

Quote:

Originally Posted by Vaughanabe13

The lock module almost certainly uses serial communication on line "C", which could be relative to the 12V power, but more likely it is relative to an internal voltage regulator (I'm guessing 3.3V or 5V) and probably optoisolated.

It's possible, but that would make the service manual wrong. The chart listed there is intended to be "what you see with a probe" on that line, and apparently it's 0V when it's been unlocked for 15+ seconds, 12V when it's locked (or recently unlocked), and then a signal a little negative pulse signal against a 12V background for the lock/unlock command. What makes no sense in that chart is: how does the BCM send the pulses against 12V to lock from the unlocked state, if the line is at 0V? :P Clearly, at the very least the chart just doesn't tell the whole story, but it does seem it's 12V and unlikely serial, just some timed pulses.

Quote:

It doesn't even matter what kind of protocol they are using (I2C, SPI, proprietary, etc.) because you could just use a bus pirate to record the streams that are getting received/sent from the lock module. Of course, this would require that you have a module that is actually working (and not intermittently). You could use a tiny microcontroller and a couple of relays to emulate a functioning lock. The use of flash or EEPROM for saving the switch state might not be the best solution, depending on how fast the micro boots up and how much time is available to send the "all clear" signal.

Good point on the flash, but how does a relay fix things? Is there such a thing as an electromechanical relay that keeps its persistent mechanical state through power cycles?

ChrisSlicks · 01-20-2012, 02:33 PM

Quote:

Originally Posted by wstar

It's possible, but that would make the service manual wrong. The chart listed there is intended to be "what you see with a probe" on that line, and apparently it's 0V when it's been unlocked for 15+ seconds, 12V when it's locked (or recently unlocked), and then a signal a little negative pulse signal against a 12V background for the lock/unlock command. What makes no sense in that chart is: how does the BCM send the pulses against 12V to lock from the unlocked state, if the line is at 0V? :P Clearly, at the very least the chart just doesn't tell the whole story, but it does seem it's 12V and unlikely serial, just some timed pulses.

This is common in the electronic world. The line is "pulled up" to the signal voltage (most electronics in the consumer world use 3.3V or 5V) and then switched to ground to send data pulses. Like you said this doesn't look like complicated data, just a simple pulse pattern with fixed frequency.

kenchan · 01-20-2012, 10:41 PM

chrisslicks, wstar, vaugnanabe - there's a member that posted this on another thread in the maintenance forum about his steering lock failure. wat strikes me is he could start the car with a faulty steering lock using his remote start.. just shuts off when the remote starter hands off controls back to the car when he steps on the brake.

do you think you can use a remote starter's signal to trick the BCM in this case??? that 'microprocessor' you guys were talking about earlier..

Quote:

Originally Posted by Jasonle

im screwed. This **** just happend to me tonight!

I have a car starter on there too..pretty sure i wont be covered under warranty. I can start the car with my car starter..it will start but i cant go anywhere..cuz on a car starter if u tap on the brakes it will shut off. unless i use the emergency as my brakes which im not doing..But other then that it wont start and the yellow key light and red light comes on. Guessing its goin to be over $1000 to fix huh

FL 4Motion · 01-21-2012, 01:04 AM

Quote:

Originally Posted by kenchan

thanks, tongman.

the Jan2010 build car that needed the steering lock replaced today unfortunately had no label on the unit... so couldn't tell which revision it was. very odd.

so it is confirmed Mar2010 build and after is using RevC.

Anyone with a factory installed RevC have an earlier build date than Mar2010?
Please post up your build date and full part number on your unit.

should look something like this: 48700-JF00C-A1-01 or 48700-JF00C-B1-01

(Apr 2010 build date here)

ChrisSlicks · 01-21-2012, 08:04 AM

Quote:

Originally Posted by kenchan

chrisslicks, wstar, vaugnanabe - there's a member that posted this on another thread in the maintenance forum about his steering lock failure. wat strikes me is he could start the car with a faulty steering lock using his remote start.. just shuts off when the remote starter hands off controls back to the car when he steps on the brake.

do you think you can use a remote starter's signal to trick the BCM in this case??? that 'microprocessor' you guys were talking about earlier..

My guess is that the remote starter in his case is wired in post BCM and IPDM (as I described in a previous post about a racing style setup), and they are instead sending signals directly to the ignition and starter relays. The remote starter is also wired into the brake switch on auto's and clutch switch on manuals as an anti-theft mechanism to prevent the car from being driven while on remote start mode. You could remove these wires if you didn't care about that aspect. So there is no BCM or IPDM trickery, just a complete bypass. When the BCM is back in control of the starting operation it says no go as the steering lock is stuck.

Given the frequency that these lock issues are starting to occur it might be time to start putting pressure on Nissan for a recall. Obviously they aren't going to do it voluntarily given that it is an expensive part. We could set up a petition and send it to Nissan or everyone that has had a failure can submit a complaint to NHTSA. If successful they are usually back dated so anyone that has paid for a replacement outside of warranty has an opportunity to get reimbursed.

Jasonle · 01-23-2012, 06:47 AM

Quote:

Originally Posted by kenchan

chrisslicks, wstar, vaugnanabe - there's a member that posted this on another thread in the maintenance forum about his steering lock failure. wat strikes me is he could start the car with a faulty steering lock using his remote start.. just shuts off when the remote starter hands off controls back to the car when he steps on the brake.

do you think you can use a remote starter's signal to trick the BCM in this case??? that 'microprocessor' you guys were talking about earlier..

With my car starter I ended up driving home going 5mph without using my brakes... i was 5 minutes away from home at a gas station..I had my friend in front of me and my brother in law behind me....comin up to a red light i downshifted and let it coast goin like 2mph and then emergency brake. I was goin to drop it off at the dealership at 2am that morning when no cars was out but my windows wont go back up and didnt want to leave the car there with my windows down...

Its now sitting in my garage. The dealership is 10 minutes away from my house..should I make a attempt again driving there or just fork up the money for a tow truck

wstar · 01-18-2012, 12:36 PM

Of course, for a race car you could probably remove this module completely and it would be ignored as part of disabling all anti-theft code via UpRev. Mostly I'm just thinking about whether we could make a cheap small replacement to avoid $500 when an A/B-series unit fails, or to swap in preemptively and avoid failure.

wstar · 01-18-2012, 01:10 PM

Oh I checked UpRev's rom editor, the 3x DTC codes related to the lock module aren't in the list UpRev can suppress (otherwise, I'd try just removing the unit and suppressing those DTCs).

ZedSled · 01-18-2012, 02:44 PM

This crap just happened to my Z last Friday, 13th (go figure) Got in my car to go to work in the morning and nothing happened when I pushed the start button. Got the little yellow missing key light. At the time I didnt know about the steering column trick or tapping the steering lock with a hammer. My car is now at Courtesy Nissan and they said the part is backordered for 3 weeks...WTF! Also my car is parked in the lot with the drivers side window down. Probably need to head up there and try the steering column trick to get my window back up.

BTW, this totally sucks!!! At least its under warranty and they supplied a loaner Nissan Sentra.

01-18-2012, 12:03 PM	#2 (permalink)
wstar A True Z Fanatic Join Date: Mar 2009 Location: Houston, TX Posts: 4,024 Drives: too slow Rep Power: 3595	Hmm I still think I don't quite understand it. I blame Nissan's documentation This is my best current guess at how the whole thing operates, now: The lock unit supposedly has 7 pins on it. I'm giving them my own names for now since I still haven't found a pinout for connector M40, which is the actual connector at the lock unit: G1: Grounded permanently G2: Grounded permanently P1: power supply, switched by IPDM E/R P2: power supply, switched by BCM S1: feedback switch output: +12V when locked, 0V when unlocked S2: feedback switch output: 0V when locked, +12V when unlocked C: communication line between lock module and BCM Physical states: The steering lock can be in one of two physical states: locked or unlocked. Once it has switched to a given state, it will remain in that state until commanded to change, regardless of whether any power is supplied to the unit. No relay has to remain energized to maintain one of the states or anything like that. Power supply states: P1 (IPDM E/R): When ignition is ACC or ON, no voltage supplied. Temporarily supplies battery voltage for a short while after opening the driver's door when ignition is OFF, or after pushing the ignition button once when it's LOCKed. P2 (BCM): When ignition is OFF or ACC, +12V is supplied. When ignition is ON, it is not. None of this completely makes sense, but the bottom line is, when the ignition is ON, neither power supply pin gets voltage, so no change to steering lock status can occur. When ignition is not ON, one of the two power pins (or both) will give it power at the right times for it to respond to a lock or unlock command, somehow. It could be the case that P1 (IPDM E/R) only powers the feedback switches that drive S1 and S2, and P2 (BCM) powers everything else (the mini-controller that communicates with the BCM and actually moves the lock) Switch states: The S1 and S2 outputs are redundant inverted status outputs. They're almost certainly driven by physical switches that are tripped by the locking mechanism itself. In the unlocked state only one of them provides +12V, and in the locked state only the other does. If they're both +12V or both not +12V, that triggers a diagnostic failure. If they don't feedback that commands were followed correctly, that also triggers a diagnostic failure. Also of note: these are connected to both the IPDM E/R and the BCM, so for some reason both modules want to see this status. BCM Communication Line: This is the perplexing 7th pin "C": It's listed as both an input and an output for the BCM. It seems definitely sure that the BCM is who sends that little pulse train against a 12V background to send LOCK and UNLOCK commands, as an output. I misunderstood earlier that the pulse train came from the lock module. What really makes no sense is how any of this could be an input back to the BCM. Maybe it's mislabeled (from my point of view), and it's a BCM-output only, and the BCM drives it at +12V while LOCKED, and 0V when unlocked for 15+ seconds, and whenever it wants to send a command, it applies the +12V (if unlocked before) and then sends the pulse signal. I guess someone would have to figure out what the manual means by clipping onto this with a scope (or really, even a multi-meter would do, since the only complex bit is already documented in the diagram above). __________________ 7AT Track Car! Journal thread / Car setup details Last edited by wstar; 01-18-2012 at 12:21 PM.

01-18-2012, 12:36 PM	#13 (permalink)
wstar A True Z Fanatic Join Date: Mar 2009 Location: Houston, TX Posts: 4,024 Drives: too slow Rep Power: 3595	Of course, for a race car you could probably remove this module completely and it would be ignored as part of disabling all anti-theft code via UpRev. Mostly I'm just thinking about whether we could make a cheap small replacement to avoid $500 when an A/B-series unit fails, or to swap in preemptively and avoid failure. __________________ 7AT Track Car! Journal thread / Car setup details

01-18-2012, 01:10 PM	#14 (permalink)
wstar A True Z Fanatic Join Date: Mar 2009 Location: Houston, TX Posts: 4,024 Drives: too slow Rep Power: 3595	Oh I checked UpRev's rom editor, the 3x DTC codes related to the lock module aren't in the list UpRev can suppress (otherwise, I'd try just removing the unit and suppressing those DTCs). __________________ 7AT Track Car! Journal thread / Car setup details

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Just joined the "Dreaded Steering Lock Club"	Timotay	New Forum Member	2	03-06-2013 04:40 PM
Need a steering lock assembly!!	bfowlzr33	Wanted	8	01-02-2013 04:40 PM
Dreaded steering lock	Jim Roberts	Exterior & Interior	2	12-12-2012 03:08 PM
Steering lock repair	fritz	DIY Section (Do-It-Yourself)	38	02-22-2012 09:30 PM

01-18-2012, 02:44 PM	#15 (permalink)
ZedSled Base Member Join Date: Apr 2011 Location: Dallas Posts: 38 Drives: 370Z 40th Anniv M6 Rep Power: 15	This crap just happened to my Z last Friday, 13th (go figure) Got in my car to go to work in the morning and nothing happened when I pushed the start button. Got the little yellow missing key light. At the time I didnt know about the steering column trick or tapping the steering lock with a hammer. My car is now at Courtesy Nissan and they said the part is backordered for 3 weeks...WTF! Also my car is parked in the lot with the drivers side window down. Probably need to head up there and try the steering column trick to get my window back up. BTW, this totally sucks!!! At least its under warranty and they supplied a loaner Nissan Sentra.