IPace Air Con Valve Block Topic is solved

Jaguar / Landrover hardware hacking
Post Reply
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

IPace Air Con Valve Block

Post by Pete9008 »

Just bought this I-Pace air con valve block:
I-Pace Valve Block.JPG
Hoping to use most of the bits off it but need to figure out the valve controls - does anyone have any experience or information on this type of valve that they could share?

I'm fairly sure all the valves come from Sanhua Automotive (https://www.sanhuaautomotive.com/produc ... ion-valve/)based on the logo on the electronic expansion valve. While the valve I have doesn't look quite like the one on their web page I think it is probably the previous generation as there are a few pictures of a similar one on the web linked to Sanhua.

The larger valves only have Jaguar marking but I think they are electric ball valves also from the same company (https://www.sanhuaautomotive.com/produc ... all-valve/).
I-Pace Valve.JPG
Again they don't look exactly like the picture but similar enough, and with the same connectors, to make me think they are older generation Sanhua parts.

I can't find any information on the electrical interface online. While I could sacrifice one of the valves to work it out (the case is glued/plastic welded shut so would need cutting open) I'd prefer not to if possible.

All current Sanhua parts are detailed as having either both LIN and PWM interfaces (expansion valves) or just a LIN (ball valves) so LIN seems a likely candidate.

Does anyone have any tips for identifying which pins are power and which are comms, or a good process for hacking LIN bus interfaces?
User avatar
EV_Builder
Posts: 954
Joined: Tue Apr 28, 2020 3:50 pm
Location: The Netherlands
Contact:

Re: IPace Air Con Valve Block

Post by EV_Builder »

Pete9008 wrote: Sat Jun 18, 2022 2:12 pm Just bought this I-Pace air con valve block:
I-Pace Valve Block.JPG

Hoping to use most of the bits off it but need to figure out the valve controls - does anyone have any experience or information on this type of valve that they could share?

I'm fairly sure all the valves come from Sanhua Automotive (https://www.sanhuaautomotive.com/produc ... ion-valve/)based on the logo on the electronic expansion valve. While the valve I have doesn't look quite like the one on their web page I think it is probably the previous generation as there are a few pictures of a similar one on the web linked to Sanhua.

The larger valves only have Jaguar marking but I think they are electric ball valves also from the same company (https://www.sanhuaautomotive.com/produc ... all-valve/).
I-Pace Valve.JPG
Again they don't look exactly like the picture but similar enough, and with the same connectors, to make me think they are older generation Sanhua parts.

I can't find any information on the electrical interface online. While I could sacrifice one of the valves to work it out (the case is glued/plastic welded shut so would need cutting open) I'd prefer not to if possible.

All current Sanhua parts are detailed as having either both LIN and PWM interfaces (expansion valves) or just a LIN (ball valves) so LIN seems a likely candidate.

Does anyone have any tips for identifying which pins are power and which are comms, or a good process for hacking LIN bus interfaces?
I'm haveing the same device from Tesla EXV to open/discover. Looking for the same answer being well fit with CanBus LIN is another type of structure. With message types and with Checksum types.

To determine interface i would try to dig up the jaguar schematics for the vehicle it comes from. i'm planning on building a thermo controller for using those sensors and the canbus AC unit from tesla.
Converting an Porsche Panamera
see http://www.wdrautomatisering.nl for bespoke modules.
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

Re: IPace Air Con Valve Block

Post by Pete9008 »

EV_Builder wrote: Mon Jun 20, 2022 7:50 am To determine interface i would try to dig up the jaguar schematics for the vehicle it comes from. i'm planning on building a thermo controller for using those sensors and the canbus AC unit from tesla.
Unfortunately I haven't had any success finding the diagrams or workshop manuals (even paid for ones) online. If anyone has access to them I'd appreciate it if they could let me know the pinouts?

In absence of the pinouts I'm going to assume that the electronics are well designed and reverse polarity protected! The plan is to try to power the valves on each possible combination of pins (using a current limited supply to increase the chance of not killing anything). If the current consumption looks sensible I'll then send LIN headers into each of the remaining pins in turn. If there is no response move to the next permutation.

I have ordered a LIN transceiver (TJA1020) to connect to an FTDI USB to TTL serial cable I already have. I can't find any LIN hacking tools so have written a fairly crude program to send out all the possible frame headers in sequence. There are only 64 so it is a pretty quick test to run. If the valve responds to any address I'll then add code to send data frames of varying length and content to see if they can be persuaded to move. This stage is likely take a lot longer as there are a lot more combinations of slower tests :(
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

Re: IPace Air Con Valve Block

Post by Pete9008 »

Think I've got the first of the I-Pace valves working, the electronic expansion valve one - this one (there are various numbers on it and I'm not sure which is the Jaguar part number):
LINTestRig.JPG
Ignore the wire colours, they were from an initial setup based on some Tesla (who use a similar looking valve) wiring diagrams and don't match the signals (in the picture +12V is on the grey and LIN is on the red wire). The pins are numbered inside the valve connector and the pinout is:
  • Gnd - Pin3
  • LIN - Pin2
  • +12V - Pin1
The picture also shows my serial to LIN bus cable. It is just an FTDI USB to serial converter with a TJA1020 used to provide the interface. I'm talking to it with a very rough Qt command line application.

The valve talks LIN at 9600baud and uses the LIN 2.0 extended checksum calculation.

It responds to two LIN bis ID's:
0x35 - read from the valve, returns 8bytes plus checksum. The last 4bytes are always 0xff, the other 4 bytes are:
  • Byte0 - Status
  • Byte1 - Error Flags
  • Byte2 - Current valve position - low byte
  • Byte3 - Current valve position - high byte
I've only figured out half of the status bits:
  • Bit0 - Receive error flag - 1 if a receive error has occurred since last status read
  • Bit1 - Unknown - to date always 1
  • Bit2 - Valve is currently calibrating end positions
  • Bit3 - Calibration process has completed (0 at power up until calibration is commanded and has completed)
  • Bit4 - Valve is moving
  • Bit5 - Unknown - to date always 0
  • Bit6 - Unknown - to date always 1
  • Bit6 - Unknown - to date always 1
And two of the error bits:
  • Bit4 - Supply over voltage ( > ~17.5V)
  • Bit5 - Supply under voltage ( < ~8V)
  • Others - Unknown - to date always 0
Fairly sure there will be bits to flag a stalled motor, motor open/short circuit, maybe temperature, etc but have no means to identify them.

0x34 - write to the valve, accepts 8bytes plus checksum. The last 4bytes are always 0xff, the other 4 bytes are:
  • Byte0 - Target position - low byte
  • Byte1 - Target position - high byte
  • Byte2 - Valve enable, 0x01 to enable, 0 to disable
  • Byte3 - Force calibration, 0x01 to start, needs valve to be enabled
Some notes:

The valve will revert to the closed position and then power down if no status read is received for a few seconds. Commands only need to be sent when a position update is needed. I've used 100ms and 200ms message intervals and both worked fine.

Power consumption is less than 10mA when powered down, ~20mA when powered up but stationary and around 100mA when moving.

Valid valve command positions range from 0 (closed I think) to 480 (0x1e0 - fully open).

On power up the valve will report a position of 120, no idea if this is real or not as I can't see the needle valve. It won't accept a target position until a calibration has been run but a target position when sent with the calibration is accepted.

The calibration winds the valve to fully open (0x1e0) and then to fully closed (0x00) and then to the target position. You can hear the motor stall at the endpoints.

The status register reads the position during calibrations and moves (real time update).

I'm sure there are other fields and flags but this seems to cover the basic operation so I'm going to stop there and move onto the ball valves. There is a patent from Sanhua describing a very similar looking valve. It gives some details of LIN packets but they don't match the above (guessing an early prototype). However it does mention commands to control the stepper motor current and step speed so it is possible these may still be in the protocol somewhere?

For anyone interested the test process I developed to figure this out was:
  • Had a good look for pinouts or wiring diagrams online. Couldn't find any so had to try a slightly more risky approach.
  • Randomly made connections to the valve, using a current limited power supply (~20mA), until it pulled a sensible current. Note - in doing this there is a high likely hood or reverse powering the valve - a well designed valve should be able to survive this but there is no guarantee. Similarly the LIN bus pin should survive this. Would be much less inclined to try this with other buses though.
  • Send all ID (0-60) headers to the valve to see what it responds to. I started at 19200baud and then dropped it to see what worked. 9600 was the only rate that got a response.
  • Scoped the valve response to check it was actually 9600
  • Checked the message checksum from the valve to see which one it was using.
  • Added code to send data packets with the same checksum to all other IDs while watching the status register. Noticed that only 0x34 caused a change to the status register and then only if it wasn't an 8byte packet. Hypothesised that the status change was an error bit and therefore 8bytes on 0x34 was the only valid ID.
  • This wasn't a good result as there are an awful lot of combination of 8bytes. Tried setting the last 6bytes to 0xff (same as status message) and cycling through all the values for the first two bytes (automated in code looking for a status reg change but still took over an hour) with no result.
  • Got lucky! Tried sending the same value to all 8bytes and found that 0x01 got the valve to move. Once it was moving a few more lucky guesses found the rest.
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

Re: IPace Air Con Valve Block

Post by Pete9008 »

Bit more progress, have figured out the comms for the ball valves. These:
BallValves.JPG
Turns out that the one on the left is a simple ball valve with around an 8mm bore while the one on the right is an expansion valve. The expansion valve is actually a larger diameter ball, still with an 8mm port and main bore, but with a smaller (2mm) groove ground into the circumference to allow a leakage path around the circumference of the ball. The length of the path, and so the restriction, varies as the ball turns. It is also possible to open the valve fully to allow flow through the full 8mm bore or to close it fully. The picture below shows the valve opened beyond the point where the main bore in the ball can be seen with the leakage path going off to the left. This is exactly what I was hoping for :)
ExpansionValve.JPG
One really strange thing is that although the valves respond with status on different IDs they both accept the same command ID to set the positions. I've checked this several times as it seems a really odd thing to do. All I can assume is that they are designed to operate in sync but it would have offered far more flexibility to have different command IDs and sync them together in the control firmware. What this means is if you want to use both these valves and control them independently they need to be on separate LIN buses. It's possible that there is another control register somewhere that changes this behaviour but I've not been able to find it.

The pins are numbered inside the valve connector and the pinout is:
  • Gnd - Pin4
  • LIN - Pin3
  • Pin2 unused
  • +12V - Pin1
The valve talks LIN at 9600baud and uses the LIN 1.3 short checksum calculation.

It responds to two LIN bus ID's:

0x03 (ball) or 0x05 (expansion) - read from the valve, returns 2bytes plus checksum:
  • Byte0 - Current valve position - low byte
  • Byte1 - Current valve position - high byte (note - the MSB is always set)
No status bits or error flags that I have found (possible that the high byte MSB means something but I don't know what)

0x2f - write to the valve, accepts 4bytes plus checksum:
  • Byte0 - Valve enable, 0x40 to enable, anything else to disable
  • Byte1 - Target position - low byte
  • Byte2 - Target position - high byte
  • Byte3 - Unused, value seems to have no effect
Notes:

The valve will revert to the open position and then power down if no status read is received for a few seconds. Commands only need to be sent when a position update is needed. I've used 100ms and 200ms message intervals and both worked fine.

Power consumption is ~20mA when powered up and stationary and around 140mA when moving. There is no low power state on these.

Valid valve command positions differ for the two valves. The ball valve ranges from 0x000 (closed) to ~0x6b0 (open). The expansion valve ranges from 0x000 (closed) to ~0x900 (open). The leakage groove ends and the main orifice starts at around 0x600.

The position readout in the status position is live and operational from power up (you can see the valve moving and occasional jitter), guessing that it is a filtered version of data from a real absolute position encoder on the shaft.
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

Re: IPace Air Con Valve Block

Post by Pete9008 »

Just for completeness had a quick look at the sensor on the valve block, this one:
TempSensor.JPG
It looks like a fully passive sensor and just measures as three resistors. One resistor varies with temperature the others appear static. It's possible that one or both of these varies with pressure but I haven't investigated that. Fairly confident that it is used to measure the refrigerant temperature following out of the evaporators to allow the superheat to be accurately controlled via the expansion valves. Not planning on using it so not investigated further.
User avatar
EV_Builder
Posts: 954
Joined: Tue Apr 28, 2020 3:50 pm
Location: The Netherlands
Contact:

Re: IPace Air Con Valve Block

Post by EV_Builder »

Yes it's a pressure and temperature sensor. What are you gonna use then?

The sensor exists in two variants this one and a black one. The pressure range sets them apart.
Converting an Porsche Panamera
see http://www.wdrautomatisering.nl for bespoke modules.
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

Re: IPace Air Con Valve Block

Post by Pete9008 »

EV_Builder wrote: Sun Jul 03, 2022 12:26 pm Yes it's a pressure and temperature sensor. What are you gonna use then?

The sensor exists in two variants this one and a black one. The pressure range sets them apart.
I'm planning to use the VW LIN bus pressure sensor, as it looks simpler to implement, plus a NTC temperature sensor on the exit of the evaporator. If you have a link for more information on the above sensor I might change my mind though.
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

Re: IPace Air Con Valve Block

Post by Pete9008 »

There is a service bulletin out (SB-21-18-002) which suggests that there is a problem with reliability of these sensors. I think I'll go with the VW part! Plus sensing the temperature and pressure at the same point in the system won't work for me.
User avatar
EV_Builder
Posts: 954
Joined: Tue Apr 28, 2020 3:50 pm
Location: The Netherlands
Contact:

Re: IPace Air Con Valve Block

Post by EV_Builder »

Pete9008 wrote: Sun Jul 03, 2022 1:18 pm There is a service bulletin out (SB-21-18-002) which suggests that there is a problem with reliability of these sensors. I think I'll go with the VW part! Plus sensing the temperature and pressure at the same point in the system won't work for me.
It's the same sensor Tesla uses. In my vehicle the sensors are different 3 wires.
So i suspected a less sophisticated control.

I have the Thermal controller which with the sensor i planned on reading/figuring out the scaling table of the sensor.
Converting an Porsche Panamera
see http://www.wdrautomatisering.nl for bespoke modules.
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

Re: IPace Air Con Valve Block

Post by Pete9008 »

EV_Builder wrote: Sun Jul 03, 2022 2:01 pm It's the same sensor Tesla uses. In my vehicle the sensors are different 3 wires.
So i suspected a less sophisticated control.

I have the Thermal controller which with the sensor i planned on reading/figuring out the scaling table of the sensor.
If you already have hardware that interfaces to the sensor then it's probably worth trying to get it working.

Unfortunately I don't so would have to guess the interface (some kind of bridge?), build a prototype interface circuit, build a rig to pressurise the sensor, characterise the sensor and then possibly do it all again if it doesn't work first time! The VW LIN bus sensor just looks like a much easier proposition! I do plan on using the two expansion valves and the two heat exchangers though.
User avatar
EV_Builder
Posts: 954
Joined: Tue Apr 28, 2020 3:50 pm
Location: The Netherlands
Contact:

Re: IPace Air Con Valve Block

Post by EV_Builder »

Pete9008 wrote: Sun Jul 03, 2022 2:16 pm
EV_Builder wrote: Sun Jul 03, 2022 2:01 pm It's the same sensor Tesla uses. In my vehicle the sensors are different 3 wires.
So i suspected a less sophisticated control.

I have the Thermal controller which with the sensor i planned on reading/figuring out the scaling table of the sensor.
If you already have hardware that interfaces to the sensor then it's probably worth trying to get it working.

Unfortunately I don't so would have to guess the interface (some kind of bridge?), build a prototype interface circuit, build a rig to pressurise the sensor, characterise the sensor and then possibly do it all again if it doesn't work first time! The VW LIN bus sensor just looks like a much easier proposition! I do plan on using the two expansion valves and the two heat exchangers though.
The sensor has 2 resistors which change value; one on temperature the other on pressure.
I googled the types and found a datasheet of the producer of them.
Now tobe sure I will stimulate the thermal controller who will tell me the values then. I then will try to figure out the input circuitry to be able to correlate back to the sensor.

Now in my donor It looks i only have a pressure sensor...
I would prefer to use that signal since it saves me making hoses with sensors who fit an existing car installation but with out knowing temperature I have no clue to stay within the gaseous state...(i fear) i might need to dig deeper or think more easier...
Converting an Porsche Panamera
see http://www.wdrautomatisering.nl for bespoke modules.
User avatar
EV_Builder
Posts: 954
Joined: Tue Apr 28, 2020 3:50 pm
Location: The Netherlands
Contact:

Re: IPace Air Con Valve Block

Post by EV_Builder »

Pete9008 wrote: Sun Jul 03, 2022 11:47 am Just for completeness had a quick look at the sensor on the valve block, this one:
TempSensor.JPG

It looks like a fully passive sensor and just measures as three resistors. One resistor varies with temperature the others appear static. It's possible that one or both of these varies with pressure but I haven't investigated that. Fairly confident that it is used to measure the refrigerant temperature following out of the evaporators to allow the superheat to be accurately controlled via the expansion valves. Not planning on using it so not investigated further.
Found the sheet again..

https://www.sensata.com/sites/default/f ... asheet.pdf
Converting an Porsche Panamera
see http://www.wdrautomatisering.nl for bespoke modules.
Pete9008
Posts: 502
Joined: Sun Apr 03, 2022 1:57 pm

Re: IPace Air Con Valve Block

Post by Pete9008 »

EV_Builder wrote: Fri Jul 08, 2022 5:43 pm Found the sheet again..

https://www.sensata.com/sites/default/f ... asheet.pdf
Thanks for that.

Couldn't get your link to work but searching for 112cp gave this one:
https://www.sensata.com/search?search_a ... &op=Submit

Which do look like the right sensors, the lighter coloured one in particualr looks like an exact match for mine. The data sheet is interesting, based on some quick measurements I had concluded that it was a passive device that would need external electronics, Instead it appears to have internal processing electronics for the pressure giving a simple proportional voltage output - much easier to use. The temperature sensor looks like a 10k NTC which is pretty stright forward too, , shame they don't give the B characteristic for it :(. They do specify the mating connector series though :)

When I have a bit of spare time I'll have another look at it, it shouldn't be too difficult to get it working.
User avatar
EV_Builder
Posts: 954
Joined: Tue Apr 28, 2020 3:50 pm
Location: The Netherlands
Contact:

Re: IPace Air Con Valve Block

Post by EV_Builder »

Yes Tesla uses both. The green and the black one. I need to measure the hardware pull-ups/ pull downs then I can try to get us the graph.
Saying that i would like to use the already available sensors in my donor car it makes plumbing easier I hoped.
Converting an Porsche Panamera
see http://www.wdrautomatisering.nl for bespoke modules.
Post Reply