20 July, 2017

Motorola MC68705R3P EPROM Copier / Reader

I needed to copy a MC68705R3P chip and needed to build some hardware capable of doing this.  There is an old project around dedicated to that, but the design is old and after looking at it, I decided it'd be easier to accomplish more modern electronics.

Below you will find information regarding my copier, which also doubles as a programmer, but it's still a bit clunky and needs refinement.  That said, if you're interested in the firmware for it, the source code can be provided.  Once someone shows some interest in the project, I'll probably devote a day or so to making up the schematic diagram.  That said, analysis of the firmware would likely give you enough information to make your own.

If you happen to be into MCU glitching, specifically for the purposes of firmware recovery, I'd be happy to hear from you.  Even if you'd just like to share your experiences, that would be appreciated, as I'm rather interested in the subject and would like to get into it somewhat.

My copier is based on an Atmel ATMEGA1284P.  Using the method that was discovered and documented by Peter Ihnat, I went about creating a copier using more modern technology than the copier I found here.

To understand roughly what my copier hardware does, please refer to Peter Ihnat's documentation regarding the method he found based on timing clock pulses.

My firmware for the Atmel ATMEGA1284P MCU is licensed under the BSD license.  You're free to do pretty much whatever you want with it.

Before we get started, below is an image of the first revision of my copier.  Using the schematic for the programmer circuit designed by Motorola and the information provided by Peter Ihnat, this is what I've come up with.

The circuit itself is fairly simple.  There is an 8-bit data bus running between the M68K MCU and the Atmel MCU.  There are 100ohm resistors inserted in this bus.  The reason for these was to provide some current limiting in the case that the M68K MCU didn't boot into programming mode and instead started to run its pre-programmed firmware.  I wanted to ensure that neither chip would be damaged in this case, as the Atmel chip will drain current and the M68K chip could potentially source current.  In the case where the M68K chip fails to boot into programming mode, the behaviour of that chip is somewhat undefined and unpredictable.  The circuit needs to take this into account to avoid damage to either chip.

The Atmel MCU is running at 20MHz, which provides it ample time to react to anything that the M68K chip needs.  An off-the-shelf Serial<->USB converter board is also used.  This helps with debugging and also provides a method to get information out of the Atmel chip, such as a firmware dump of the M68K MCU.

The disconnected wire you can see is a 1MHz clock signal that was intended to be connected to the M68K MCU EXTAL pin.  I'd disconnected the clock wire and replaced it with a 1MHz ceramic resonator as I was having problems getting my chips to boot into their programming mode.  It turned out that this had nothing to do with the problem.


Above: The M68705 MCU being copied is on the left, the Atmel ATMEGA1284P is in the centre.  You can also see that I have the ISP for the Atmel AVR connected to the board for easy firmware updates, and the USB<->Serial converter is also connected to another computer.

Regarding the problem getting the chips to go into programming mode, the problem was that the first chip I attempted to use was too defective (damaged) to boot into its programming mode.  The second chip I used contained the same firmware but was a mask ROM version and it wouldn't boot into its programming mode either.  This is probably because it's a mark ROM chip and likely doesn't have the bootloader code in it to activate the programming mode, since it would never need it.

Eventually, I got a third M68K chip and it went into programming mode first try.  I wasted quite a lot of time on this issue (days) but eventually got it figured out.  The main problem was that I was blaming myself and my hardware for the problem, convinced I'd somehow done something wrong.

Then there was another problem.  I could see that for the most part at least, my code was finally working.  I was able to see firmware data.  I was able to see some text in that data that identified the person who wrote the firmware I was trying to copy and the company that the firmware was written for.  At this point, I knew that I was mostly there, but just couldn't get the M68K MCU to verify that the code I'd retrieved from its EPROM was correct.

Resolving this issue, again, took days.  The main problem in this case was an assumption I'd made.

I'd assumed that it was very improbable that an engineer would design a chip like this and then require 4097 bytes of data to program the chip.  4096 bytes made much more sense, and I'd assumed that the documentation was wrong.  One night, I decided that I should figure out if I was wrong or if the documentation was wrong.  I changed my code to work up to the 4097th byte, not expecting it to reveal anything or even work for that matter.  To my surprise, it did work and another problem was solved.

That night, I finally got it.  The verified LED turned on.  The M68K MCU agreed that the firmware I'd fed it was the same as the firmware it was programmed with.  Finally, I had succeeded.  It took me much more time than I'd like to admit to get to this point.  All up, probably a solid 2-3 weeks of work.

Here it is, the green LED is the Verified LED.  The yellow LED is the Programmed LED.  All those other wires you can see are connected to a logic analyser.


This was a great moment.  Finally, things worked.  Better yet, the results were reproducible.  This was a small personal milestone for me, as I've been interested in "glitching" MCUs to reveal their code, and this, to me, is a small step in that direction.  This project will also bring a small financial benefit to me, being that it will enable to me repair some products that currently retail for $350.00 AUD or more.  Personal gain isn't the goal here, it's more about learning and a bit of geeky fun.

Overclocking:

Going by the datasheet, the maximum programming clock speed is 1.1MHz, the minimum being 0.9MHz.  As an experiment, I removed the 1MHz ceramic resonator and re-connected the clock wire to the EXTAL pin of the M68K MCU.  I've been able to get the M68K MCU to work correctly at 5MHz, which means that getting a copy of its EPROM only took 5 minutes.  Unfortunately, running the chip at 10MHz didn't work out, but I was pushing the limits as it were.

The firmware contains pre-tested timing values for 1MHz, 3.33MHz, 5MHz and 10MHz operation.  At this time, the code will need to be re-compiled and re-flashed to the Atmel MCU if you wish to try out these alternative clock speeds.

The default build runs at 1MHz.  This is in order to give you the best chance of success and to conform to the limitations of the M68K MCU specified in the datasheet.  It would be trivial to change the code to allow a simple DIP switch selection for the clock speeds, should you wish to do something like that.

Alternative methods:

Something else that I've been thinking about is the fact that since I have control over the clock for the M68K MCU, I should be able to eliminate the timing-based code and instead count clock ticks to determine if the bytes are correct or incorrect.  Since incorrect guesses take more clock cycles than correct guesses do, it should be trivial.  It would also mean that I'd be able to eradicate the timing values from the code and work solely on clock pulses, at any frequency capable of being produced by the Atmel MCU and that also works with the M68K MCU.

If you are interested in the code or the schematic for this project, please leave a comment below.  I will publish that information if there is demand for it.

03 October, 2014

SUH DER SD83-A AC Synchronous Motor Teardown

In an earlier blog post I did a teardown of a TYC synchronous motor.  We found that it was made of entirely plastic gears and was a little lacking in the quality.

Today I received a new batch of SUH DER SD83-A synchronous motors.  I purchased them directly from the manufacturer in Taiwan.  I also had an immediate need to replace a faulty one.

What follows is the teardown of the faulty motor.  The motor itself and its gears were all in perfect condition.  Its not pictured, but the failure occurred due to dirt and dust getting caught between the motor output shaft and the bushing on the front of the motor.

The bushing is pressed into the front metal panel of the motor.  In my case, when the output shaft had seized against the bushing, the bushing itself started to turn.  So the motor still worked.  That is, until the hole in the front panel of the motor became unevenly worn and the motor could then seize up again.

You may notice evidence of tampering to the motor in the picture below.  I had opened this motor previously in order to get it going again.  Brute force was involved, and it did work again, but it was time to find a new motor.

Let the teardown begin!


Motor with front cover removed.  We can see a mix of plastic and brass gears.  The large plastic gear appears to have a steel gear that mates with the brass gear.  It seems they have decided that plastic gears are good enough for the low torque part of the motor:




Close up of the output shaft gear.  It looks like a brass gear with the steel output shaft pressed into it:




All gears have been removed, the motor output shaft is seen here, along with its plastic gear:




Metal cover removed.  The metal cover is pressed into the exterior motor housing:




Close up of the motor's rotor:




Motor stator (the purple thing - it contains the winding for the motor) and the remaining shell that the stator was sitting in:




Motor stator, insulating tape still installed:




Motor stator, insulation tape removed.  Beneath the wires appears to be masking tape:




All of the bits and pieces that made up the motor:




You can compare the construction of this motor with a cheap eBay motor here:


All trademarks are the property of their respective owners.


23 September, 2014

TYC Synchronous AC Motor Teardown

I recently ordered a couple of TYC branded geared synchronous motors, from an online seller based in China.

The plan was to see if they would be suitable for use in repairing Breezair dump valve assemblies.  It turns out that they are somewhat suitable, but really far from perfect for the application and the quality isn't great.

Long story short, I modified the motors that were shipped to me and tested them out.  At first, no problems.  One of the motors was too weak (not enough torque) and the other was looking good until the output shaft came out.

The shaft wasn't held in by anything at all.  It appears that it's just pressed 2.8mm into a hole in a plastic gear, as you can see in the images below.

While modifying the shaft was the cause of the failure, it prompted me to open one of these motors up and check out how it was made.  So, here are the teardown photos for anyone who's interested:

Motor, after the output shaft was modified:


This wasn't supposed to happen...


The teardown begins.  Top cover removed.  As you can see, this motor uses plastic gears.  I expected it would and as such I tried not to heat up the motor shaft too much when I was modifying it.  It appears though I wasn't careful enough.


Close-up of the gear assembly.  The large white gear is the one that the output shaft was pressed into.:


Gears removed.  You can now see the actual motor:


Metal plate removed:


Motor Stator (electromagnetic coil).  Under the tape there are two knots, one in each of the blue wires, to stop you pulling them out of the motor.  Under the tape is just a coil of magnet wire:


Motor Rotor (the bit that spins/rotates):


The rotor has been removed, teardown complete:


All of the bits and pieces that made up the geared synchronous motor:


Motor specifications:



TYC
AC 12V
50/60Hz 4W
2.5 ~ 3R/MIN
CCW/CW

Which basically means, its a high torque motor, moves very slowly (approx. 2.5 revolutions per minute), and can rotate counter-clockwise (CCW) or clockwise (CW).  This mode is also known as "free", I guess since the motor is free to turn in either direction when power is applied.  The direction can usually be influenced by applying a pressure to the output shaft in one direction or another.  The motor should then rotate in the direction that is easiest for it to move.

The motor in this teardown cost $8.40 AUD inc. shipping.

For comparison, below is a link to a better quality (mostly metal geared) synchronous AC motor:


All trademarks are the property of their respective owners.

10 August, 2014

Suzuki Alto NSCR-06 Amplifier Specifications

A while back I was looking for the amplifier output specifications for the NSCR-06 radio/stereo used in the later model Suzuki Alto's (also sold as a Nissan Pixo), but couldn't find them.

The amplifier in this radio is a Toshiba TB2926BHQ.  It's apparently a 4x45W audio amplifier.

That means there are 4 channels and each channel is capable of delivering about 45 Watts.

Suzuki seems to use the same stereo in all of their later model Alto's, even in the cars with a 6-speaker sound system.  In vehicles with the 6-speaker sound system, the front right dash speaker and front right door speaker will be wired in parallel, and the same applies for the left speakers.  In the 6-speaker configuration, the speakers in the dash are only tweeters.

The factory tweeters look reasonable, but the speakers in the doors are junk (paper cone speakers).

In the models with the 2-speaker sound system, the dash has two paper cone speakers and no speakers in the doors.  Suzuki didn't even bother putting in the wiring for the door speakers, which is annoying.

As you've probably guessed, one of my cars is a Suzuki Alto (I own 3 of them).  The one I drive daily is a 2010 model, and it's the cheap model without any extra features.  I've installed some Sony Xplod 4" 3-way speakers into the dash.  No modifications to the dash were required.

The sound is much better.  I can set the radio on Max volume and there is very little clipping or distortion.  It can be quite loud and the music still sounds crisp.  The speakers cost around $50.00 AUD (model: XS-GT1038F) for the pair.  They were easy to install and no vehicle modifications were necessary.

On another note, I have my doubts that the power wiring in the car will be able to supply the stereo with all the power is needs to drive 4 speakers @ 45 watts per channel.  I might test it soon and update this article with my findings.

During another mission to improve the sound quality in the vehicle,  I installed Sony Xplod speakers into the front and rear doors.  The front speakers are wired in parallel and I decided to keep the Sony speakers I'd previously installed in the dash connected as well.  As such, the load on the amplifier in the stereo is probably about 2 ohms instead of 4 ohms on the front speaker channels.  I decided to take the risk.  If you read the datasheet for the power amplifier IC, it's a pretty rugged amplifier and it should be able to handle overload conditions as its own built-in safety circuits should kick in to prevent damage.

The additional speakers were a good improvement and overall it was worth doing.  The stereo will clip at about volume 42 when playing music from a CD, radio stations can be turned up louder before clipping sets in.  The type of music you're listing to also has an impact on the volume it'll be happy to run at.  If there is little bass, then louder volumes will be OK.  For instance, classical music can be listened to quite loudly, where as normal pop music will clip at about volume 42 due to the bass.

26 May, 2014

Amped Wireless AP600EX / SR600EX Backdoor

Today I purchased an Indoor / Outdoor WiFi Range Extender.  It's a re-branded Amped Wireless SR600EX which I picked up brand new for AUD $39.99 (bargain!!)

These devices run Linux, have 4MB SPI flash and 16MB of RAM.  Mine came branded as "Bauhn", which is one of the Aldi brands.  I re-flashed it with the original Amped Wireless firmware, and even though it was released back in 2012, the Amped Wireless firmware seems to work better than the Bauhn-branded firmware.  The features are the same and the layout is almost identical.  It's just a rebranded product.

I opened up the SR600EX and connected a serial console to it.  While looking through the contents of the filesystem, I came across some suspicious looking text in the contents of the flash.  Sure enough, it was a backdoor username and password which allows you to login to the web interface as an admin.

Username: super
Password: super
Firmware version of affected device: 1.2f.05

If you've set your own custom username and password like I have, the credentials above will still let you login as an admin.

I also tried changing the username/password using "super" as the username and a different password. This was rejected by the firmware with the message: "ERROR: Cannot use same user name as supervisor.", so it appears that not only is there a backdoor, but you can't easily change its password either.

Manufacturers should have learnt long ago that backdoors in network hardware are not acceptable and often end up being discovered and made public.  Oops, its just happened again ;)

I should make it clear that this backdoor was in the original firmware that came with the range extender, but continued working once the unit was flashed with the official Amped Wireless SR600EX firmware (v1.2f.05).

To be thorough, I cross-flashed my SR600EX with the AP600EX firmware, turning my range extender into an Access Point.  The same backdoor also works with the AP600EX firmware (version 1.2f.04).

All tested firmwares were the latest versions available from the Amped Wireless website.

Remote Command Execution (as root):


I've just discovered how you can run Linux commands on these devices via the web interface.  It works fairly well, but just note that these devices don't have the 'ls' command available, so if you want to see a directory listing, you need to run "echo *" or "echo /*" or "echo /bin/*" for instance.

To access the remote command execution feature, you can use the following URL:

http://x.x.x.x/syscmd.asp

Replace the x.x.x.x with the IP address of your device.

Example Usage:

This was tested on the SR600EX.  It will probably work on the AP600EX as well.

Alternative Web Interface:


http://x.x.x.x/oemhome.asp

Screenshot:



02 November, 2013

Breezair Icon EXH-130 Problems

Last Update: 16 December, 2017.


Index:

Repairs to my EXH-130:

Repair 1: The Motor
Repair 2: The Water Pump
Repair 3: Tripping Circuit Breaker
Repair 4: Another Motor Fault
Repair 5: Drain Valve

Other Repairs (not a complete list):

550 Watt Direct Drive Motor
750 Watt Direct Drive Motor
DD Control Box for 1500 Watt Motor
DD Control Box 750 Watt Motor
Remote Control

Repairs for Others:

DD Control
DD Control Low Power (P/N: 110547)

Other Useful Information:

Fault/Error/Service Codes
Breezair Direct Drive Diagnostic Procedures
Cleaning Remote Control Battery Terminals
Video of a buzzing Breezair 550W Motor (internal short circuit)

Introduction

I'm writing about my personal experience, having owned a Breezair EXH-130 that had numerous problems.

This page contains a lot of technical information relating to the EXH series coolers, but also applies to the EZH, and to a slightly lesser extent, the EXQ, EZQ and EXS model range.  The information here should help you if you're looking to troubleshoot your cooler.  While the information is technical in nature, efforts have been made to make it fairly easy to understand.

My original Breezair unit, an EXH-130, had a troubling history of failures and this was the motivation for publishing the information here.  I'm not the only person that's having trouble with these coolers.

Unfortunately, the newer EXQ series of coolers probably aren't going to be much better.  I've already had some faulty control modules from those coolers come in for repair, and can tell you that they haven't changed much.  They've added some token surge protection to the motor drive circuitry and changed the communication circuitry to accommodate their new MagIQtouch controller, but that's about all.  The rest of the circuitry within the control module appears almost identical to the earlier EXH/EZH control modules.

Another caveat, is that replacement parts for these coolers are generally expensive.  A new motor or control module is going to set you back around $600.00 or a little more.  The drain valve assembly costs around $300.00, a new pump is usually around $130.00, and a new wireless remote, around $350.00.  These prices don't include installation.

As of late 2017, the cooler that this blog page focuses on is no longer with us.  Most of the parts found new homes, and the rest went out in this year's hard rubbish.  It has been replaced with a newer Breezair EXH-210, but thats already needed a new drain valve and water inlet solenoid valve.

During the time I owned the EXH-130, I had to conduct a number of repairs:
  • Repair 1: The motor wouldn't run.  When turned on it would just buzz/groan and wouldn't move.  The motor had developed a short circuit in the windings.
  • Repair 2: The water pump stopped running.  A little percussive maintenance got it going again, but its probably going to die more permanently soon.
  • Repair 3: The cooler started tripping the circuit breaker randomly.  It would work fine for a few days and then all of a sudden the circuit breaker trips.  Resetting the circuit breaker a couple times usually "fixed" it for a few days, then it'd do it again.
  • Repair 4: The motor developed another short circuit and damaged the motor controller IC as well.  The controller IC needed to be replaced, which I've done.  I also managed to get hold of another similar blown up motor (from an EXH-150) and repaired that.  If I wasn't repairing the faults myself, a new motor and new controller would cost around $1200.00 + installation.
  • Repair 5: The drain valve couldn't make up its mind if it wanted to be open or closed (it would repeatedly open and close again).  This is a known issue and replacing the two microswitches inside the drain valve assembly sometimes cures this issue.  In my case, that was not the problem.  The synchronous motor inside the drain valve was the problem.
All of this occurred within 13 months.

In case anyone is interested in knowing more about the faults described above, I'll go over some of the details in a moment.  It would be nice to purchase a new motor and other parts, but the prices of the parts are prohibitive.

Due to these prices and my background in electronics, I've been repairing all of the faults myself.  I also do repairs for others.  You will find my business and contact details below:



Repair Details:

Repair 1: The Motor

The motor used in the direct drive coolers (EXD, EZD, EXH, EZH, EXQ) is a brushless DC motor (BLDC).  The motors are electrically similar to a 3-phase motor, internally wired in a "star" configuration.

The motor had developed what I'll call a "phase-to-phase" short, meaning that there was a short circuit between 2 of the 3 windings in the motor.  Upon opening the motor for the first time, the first thing I was concerned about was the way in which it had been designed.  There are 3 windings in the motor, each winding consists of 20 electromagnet windings in series.  The 3 windings are all offset slightly from each other, and are all wound on top of each other.

There is no insulation, other than the very thin enamel coating on the magnet wire inside the motor to prevent a phase-to-phase short.  In addition to this, I've read various documents from electric motor manufacturers that clearly state that this style of motor should not be used in humid or dusty environments.  Further more, the motor in the cooler is not sealed, and as such, the windings are exposed to both humidity and dust.

I think these motors would be much more reliable if they just had a layer of insulation between the 3 windings.  It'd be even better if the coils weren't wound on top of each other.  The short circuits generally develop close to where the power enters and exits the motor, and this is also where the voltage differential between the windings is at its greatest.  The design of the motor means that the enamel on the wire within the motor needs to be able to withstand a voltage differential of approximately 430V DC.  That isn't a big ask, but it also needs to withstand having dust collecting on the enamel and being exposed to moisture/humidity.

Initially, I was a little unsure about how to go about repairing this motor.  The obvious answer was to re-wind the entire motor, but I could see that'd be a lot of work.  The other option was to locate the fault and either isolate it or render it harmless.  I chose the latter.

To do this, I used a multimeter to determine which two phases had shorted.  The next thing I did was break the internal connection inside the motor where all 3 windings are bonded (connected) together.

After doing that, I took a 12V power supply and a 50W halogen downlight and connected it up in series with the shorted turns of the motor.  The idea of the lamp was to limit the current passing through the motor windings.  Without the downlight or some other current-limiting device in series with the motor, a lot of current would have been drawn and this could have caused further damage to the motor windings as they would have gotten quite hot.

I ran the light in series with the shorted motor windings for a little while and the windings on the motor started heating up.  I then used a laser non-contact thermometer to find where the motor windings were hottest.  This seemed to roughly point to the spot where the short was.

In an attempt to further verify the location of the short, I used a small fridge magnet (thin, rectangular shape) and moved it over the motor windings while still running power through them via the downlight.  This allowed me to feel where the magnetic pull of the motor was strongest and also seemed to help confirm the rough location of the short circuit.

The next bit gets tricky, and I don't know of a good method of doing it.  As I said earlier, the motor is a 3-phase style motor, and each phase consists of 20 electromagnet windings in series.  My plan was to isolate the fault and bypass it.  I figured that if I lose about 1 electromagnet out of 20, it probably wouldn't matter much.  After determining how the motor was wound and which direction the current was travelling around the motor, I randomly cut one wire in two electromagnets in the same phase winding (read that a few times, it should make sense.  In total, I made 2 cuts).  This allowed me to bridge over the fault, meaning that I've probably lost about 1 electromagnet from the second phase.  The short is still there, but it's semi-isolated and sort of harmless.

This got the motor going again, and it worked for about 10 months, until the motor developed another short.

Below are some photos of the motor internals.  As you can see, the 3 sets of windings are all wound on top of each other, with nothing but the enamel on the wire preventing short circuits.  These motors would probably be much more reliable if an additional layer of insulation was placed between each phase.  The phase-to-phase shorts that this motor has developed all seem to develop at the top or bottom of the motor windings, not on the side.  They also tend to develop where the motor collects dust in the windings.

Here is a picture of the top of the motor.  The small PCB contains the following:
  • 3 Hall Effect Sensors.  These are used by the motor control circuitry to determine the current position of the motor.  This information is then used to determine which coils (phases) to turn on next, in order to make the motor move.
  • A voltage divider network.  This is used to set a unique voltage level on one of the pins in the sensor cable.  This signal can then be analysed by the motor control circuity to determine the wattage of the motor connected to it.
  • Two connection points for an external thermostat switch located to the right of the PCB.  The switch is used to shut down the motor if it overheats.
In the picture below, you can see the PCB I've described above, as well as the way the 3 phases are wound on top of each other:


The side of the motor.  Each electromagnet is 3 notches wide, and each phase is offset by 1 notch:



Repair 2: The Water Pump

One day for no apparent reason, the water pump stopped running.  I gave the pump a "smack" and it was off and running again.  The pump lasted until the cooler was de-commissioned and now gets used for testing control modules.  It has become quite noisy.

Repair 3: Tripping Circuit Breaker

Initially it was just a weird event, I reset the circuit breaker and everything seemed fine.  A week or so later, it did it again, so I reset the breaker again.  Over time, it started getting worse, randomly tripping the breaker every 2-3 days.

I pulled the control box out of the air conditioner and examined it.  I couldn't see any problems, and couldn't find any faults.  I re-assembled the unit and put it back into service.

Predictably, it did it again.  This time the fault remained after the circuit breaker tripped.  Usually, after the breaker tripped, I'd measure the resistance between the active and neutral pins of the plug and the reading would be acceptable.  This time, though, I measured just a few ohms.  I initially suspected some of the X2 filter capacitors across the mains, but after disconnecting those (about 3 of them) the short was still there.

I then decided to begin isolating sections of the controller circuitry by removing various common-mode chokes (pictured below).  These components basically filter noise and help reduce interference.  It turned out that the first choke I removed was the culprit.  I suspect that the windings on the choke may have been vibrating slightly and had worn through the insulation on the toroidal core.  This caused a short circuit inside the controller, hence tripping the circuit breaker.

I found a second-hand choke among my scavenged components and re-constructed the below component, then replaced the below component with my newly made one.  The circuit breaker hasn't tripped since.

Here is a picture of the faulty part.  If you look closely you can see where it failed.  On the left, it failed about 4 turns down from the top.  On the right, it failed about 7-8 turns from the top:



This type of failure has turned out to be a fairly common fault.

Repair 4: Another Motor Fault

It's this fault that gave me the motivation to write about the problems with my evaporative cooler in the first place.  The motor developed another inter-phase short circuit, close to where the power enters and exits the motor windings.

I used a different method to find the fault this time.  Instead of running power through the motor and using the non-contact thermometer or a magnet to help locate the approximate location of the fault, I used pressure.  The fault this time was intermittent, the motor would buzz/groan, wouldn't move, but when I tested the resistance of the internal windings with a multimeter (before removing the motor from the cooler), it measured about 20 ohms between any two pins on the motor power connector.  So, I re-connected it, powered it up again... buzz/groan.  Measured it again, this time I had 1.8 ohms between two of the phases.  This confirmed a short in the motor.

I took note of which two pins had the 1.8 ohm resistance and then proceeded to remove the motor.

Once I'd disassembled the motor, I figured out which pins on the motor power connector were connected to which windings.  Once I'd figured that out, I knew which two phases were shorted.

At some point during the diagnosis, the short just disappeared.  In an effort to find it again, I started applying moderate pressure to the coils and eventually located a spot where I could apply pressure and I'd get a short circuit.  So, I knew roughly where the fault was and went about isolating it using the same method as last time, which is basically just cut some random wires and hope for the best.  It seemed to work and I was able to (after a lot of testing & re-confirming my findings) figure out where to isolate the failed winding.

Pictures of the motor on my work bench:



With the fault isolated, I re-tested the motor resistance at the power connector and it seemed to be normal, around 20 ohms.  So I re-assembled the motor and put it back in the cooler.  Buzz, groan.. Urrrggghhh.

I removed the motor again and using the pressure technique, found another inter-phase short.  Then, while messing with the motor again, the short disappeared.  I'd pinpointed where it seemed to be but all of a sudden I couldn't use pressure to make the short re-appear.

Applying pressure to the windings (pinching them):



So, since the short circuit just "fixed itself", I re-assembled the motor and put it back in the cooler (in a very temporary manner), and powered it back up.  Buzz, groan.  I figured that would happen.  So that re-confirmed that there was still a problem.

Further investigation of the motor windings under a magnifying glass and in good light revealed a small section of windings where the enamel had been burnt.  Applying some light pressure to that burnt area resulted in the short circuit coming back.

Here is a photo taken through a small magnifying glass of the burnt area.  That blue mark was supposed to be an arrow pointing to the burnt section:



I've isolated the above short by bridging across the coil on the outer phase rather than isolating the burnt section (which is in the centre phase).  The reason I did that was because I'd already lost a coil from the centre phase in a previous repair, so I chose to even it up a little by isolating the outer coil.

After re-assembling the motor and putting it back into the cooler, it just buzzed.   It wasn't as loud as before and with a bit of encouragement the motor started running but would occasionally jolt or make clunking noises and then go back to normal.

I contacted Breezair/Seeley International to see if they'd be willing to test the control module.  I ended up getting a call from the "Victorian/Tasmanian State Service Manager", but he basically just said that the components of the cooler aren't designed to be repaired and that they have field service technicians that can come out and test the parts to determine the fault.

Since they weren't much help, I continued troubleshooting.  The power to run the motor goes through an IRAMS10UP60B hybrid module.  This module has a high voltage side and a low voltage control interface which also contains some additional smarts.  Due to the motor having had short circuits in the windings, I figured it'd be possible that this module may have been damaged due to that, so I ordered some and replaced it.

This cured the problem.  The hybrid module contains 6 IGBT's.  They're like switches that can turn on and off very quickly.  One of the known failure modes for an IGBT is "latch-up", which means that the IGBT can turn on but can't be turned off reliably, or at all.  My suspicion is that the last motor short caused damage to at least one of the IGBT's, and this in turn caused incorrect commutation of the motor.

Repair 5: Drain Valve

The drain valve developed a fault whereby it would repeatedly open and close.

I bench-tested the drain valve with a 24V AC power supply and re-produced the constant open/closing problem that it had.  I double-checked the microswitches inside the drain valve assembly and they were working fine.  They had been replaced previously, since I was hoping for a quick fix.

The motor inside the drain valve turned out to be the problem.  It's a synchronous motor which has the ability to run clockwise or counter-clockwise at its own will.  The problem seemed to be that, on occasion, the bushing around the shaft that comes out of the motor would catch and seize up, causing the motor to reverse direction.  Hence the constant opening and closing of the valve.

After further investigation, it turned out that the output shaft of the motor and the bushing around the shaft had seized, as the bushing was rotating.  The bushing isn't supposed to rotate with the shaft and would occasionally catch and seize up.  This in turn caused the drain valve to continuously open and close as when the motor seized up, it would reverse direction.

I replaced the motor with a brand new one and the drain valve now works again.  I also re-installed the original microswitches, since they were still functional and were of better quality than my substitutes.

If you are interested in seeing the guts of the synchronous motor, I pulled apart the faulty one and took pictures throughout the process.  Here's the link:

SUH DER SD83-A Synchronous Motor Teardown

My first temporary fix (this unit isn't on the roof, so I can drain the water manually):



That's one of the pad frame clips jammed into the drain valve to keep it closed.  At this point I will mention that this is overall a bad idea.  Salt and other minerals will build up in the water as time goes on.  This will cause white deposits on your cooling pads, shortening their life expectancy.  At some point, the cooler will want to drain the water and it'll be unable to.  This will cause fault code 4 to be reported.  If you're stuck and want the cooler running, you should be able to loosen the base of the drain valve so that it leaks slightly.  This will help keep the water fresh.

After getting sick of opening up the cooler each time I wanted to drain the water, I decided that putting a tap on the drain pipe would be a better solution.  I got the tap and PVC pipe from a hardware store, in the garden section:




The problem with this solution is that it drains rather slowly in comparison to how it would without the tap interfering with the water flow.  Generally, I can't be bothered waiting for the tank to drain through that tap, so I just unscrew the whole assembly at the base of the cooler and let the water flow out rapidly.

The above has been a summary of all of the repairs my first Breezair cooler needed.

Other Breezair-related Repairs:

I'm often repairing evaporative cooler and heater control boards of all brands.  In addition to that, I'm often given faulty items or buy them from people who don't want them.

Below is an incomplete list of predominantly faulty Breezair components I've purchased or been given:
  • 550 Watt Direct Drive Motor (P/N: 822396)
  • 750 Watt Direct Drive Motor (P/N: 822426)
  • 1500 Watt Direct Drive Motor (P/N: 822440)
  • DD Control Box - High Power (P/N: 110554)
  • DD Control Box - Low Power (P/N: 110547)
  • DD Control Box - Low Power (P/N: 110066)
  • DD CPMD (P/N: 108988)
  • Motor Control DD (P/N: 109138)
  • Sensortouch Remote Control 1
  • Sensortouch Remote Control 2

Most of these parts were purchased knowing they were faulty, others were donated.
Repair Details:

550 Watt Direct Drive Motor:

This motor was repaired exactly the same way as documented above.  The motor had an inter-phase short.  The shorted section of the motor was isolated and bypassed.  After the repair, the motor was put back into service and worked for approximately 3 months.  It failed again just after the summer of 2013-2014.

Because this motor is now basically junk, I decided to experiment with it.

Firstly, I did something fairly insane and against my better judgement.  I pressure washed the motor stator (the windings) with normal tap water and a pressure washer.  That got it nice and clean.  The motor was then left to dry a little, wrapped in a towel.  It was a hot and windy day and I didn't want debris getting into the nice clean motor, hence the towel.

I then finished drying out the motor by connecting the 3 phases in parallel and running 12V AC through the windings from a heavy duty transformer (12V AC @ 13 Amps).  This heated the motor windings up to about 65c.  It was left to dry like this overnight.

Experimenting further, I purchased the necessary items to build a small vacuum chamber.  It basically consists of a high-vacuum pump, a 50 litre stockpot, a 20mm thick piece of perspex (the lid) and some internal bracing rings to strengthen the pot and prevent it from imploding when under vacuum.  The lid is sealed to the pot by a rubber gasket made of 3mm thick rubber sheet.  The vacuum in the chamber holds the lid on and forms an excellent seal.

What I'm doing here is partially "potting" the motor windings, using an epoxy-based compound designed for this purpose.  It has very high dielectric strength (it's a good insulating material) and it provides good thermal conductivity, which helps with heat dissipation.  It's also somewhat flame retardant.  Once dry, it becomes rigid and will prevent movement in the windings.  It will also prevent moisture and dust from coming in contact with the motor windings in the potted area.

The motor windings are potted under vacuum, hence the need for a small vacuum chamber.  The idea is to make any trapped air bubbles as small as possible, as well as helping to draw the potting compound (the black stuff) into the motor windings.

What I'm hoping to achieve by potting the motor in this way is a reduction in the failure rate.  This motor has already failed twice, so under normal circumstances, it should fail again very soon.  By potting the part of the motor where the shorts tend to occur, I'm hoping that any vibration in the motor windings will be eliminated and that dust and moisture will be kept out and the repair to the motor will last longer.

Unfortunately, this is pretty much a one-way process.  There's no way that I know of to remove the cured potting compound without damaging the motor windings.  If the motor does fail again, it's basically junk at that point.

Due to the experimental nature of this, I also took the opportunity to embed a K-type thermocouple into one of the potted sections of the motor windings.  I did this so that I could measure how hot the potted part of the motor was getting during operation, but I needn't have bothered, as it doesn't get hot at all.





Since doing the initial potting of this motor, I have improved the vacuum chamber slightly by adding four banana plugs to the lid, which will allow me to feed power into the chamber and also give me the ability to monitor the temperature of the motor windings while doing so.

The idea is to feed power to the motor while it's under vacuum and being potted so that I can speed up the potting process by heating the motor windings and in turn the potting compound.  I've also purchased a digital thermostat that can take a K-type thermocouple input to turn a relay on/off at a set temperature.  My plan is to use this to keep the motor windings at a pre-set temperature while they are undergoing the potting process.

This motor hasn't failed yet, but it's not being used in a cooler either.  I currently use it to test control modules.


750 Watt Direct Drive Motor:

This motor failed the same way as the others, and was on its way to developing its next failure.  You could technically say this motor has failed in two locations.  The first location I found and repaired.  I then tested the motor and discovered seemingly random incorrect commutation.

I had my doubts about the controller I was testing the motor with, so I swapped it for another known-good one.  The problem persisted, and upon further examination of the motor, I found a second area where the enamel wire had been burnt.

This motor has been repaired and potted also.  Neither of the potted motors have failed yet.  One of them sees frequent use during the warmer months as a test motor.


DD Control Box for 1500W Motor:

This control module needs a new IRAMS10UP60B hybrid module, since it has failed rather explosively.

Here is a picture of two of the hybrid modules.  The top one has failed explosively.  The one below it is physically in-tact, but internally has one or more failed IGBT's:




DD Control Box 750 Watt Motor:

This one might scare you.  To be honest, it worries me.

It's another case of a common-mode choke failing.  The failure is similar to the one documented above, which occurred in my cooler.  Fortunately for me, mine didn't catch fire, but this one did!

I've repaired this board by using the choke from another board that was damaged beyond reasonable repair.  The common-mode choke failed, causing a short circuit from mains active to neutral, via the toroidal core.  The short circuit/arcing caused the plastic cable tie to get hot and catch fire, dripping flaming plastic drops onto the components and parts of the controller casing below.

The collateral damage was the two wires that go to the circuit breaker and the mains power socket.  I decided to replace the damaged wires with ones from a parts controller.  The power socket wasn't damaged enough to warrant replacing it.

Here are a few pictures from the insides of the controller.  First up, the choke that caught fire:



Burnt spots inside the controller casing.  This appears to be where flaming drops of melted plastic from the cable tie around the base of the choke have dripped down onto the bottom of the plastic casing:



The image below shows cosmetic damage to a capacitor close to the common-mode choke that caught fire.  It also shows damage to the two brown cables that go to the circuit breaker, as well as minor damage to the mains power connector (the pitting around the edge is not supposed to be there):



The scary thing is that this failure could happen at any time.  The common-mode choke that failed in this case is continuously powered up by the mains.  It doesn't matter if your cooler is turned on or off at the wall control/remote.

Here is a close-up of the damaged area:



In the picture below, which is otherwise the same as above, I've highlighted where the copper turns of the common-mode choke have melted away and gone open-circuit:



Remote Control:

I recently purchased a faulty Breezair Sensortouch remote control.  It was advertised as "New" and the description said that it would freeze after the first command.

I purchased it not being sure what its problem would be, but I had my suspicions.  I was hopeful that it wasn't a fault in the microcontroller inside the remote control, since I couldn't replace that if it was damaged.

There was no evidence of battery electrolyte leaking onto the circuit board, however, one of the pads for the buttons on the front of the remote was measuring as low impedance (about 100 ohms) while all the others were measuring about 700K.

As there was no evidence of any sort of contamination on the circuit board, I traced what the pad was connected to.  One side of the pad was connected to battery negative, while the other side of the pad was connected to a HEF4021 IC and another component in a SOT-457 package labelled as "B2" (which I suspect is an NXP PMEM4010PD).

Since I had the HEF4021 chips in stock and they're easy enough to replace, I did that, suspecting that the chip had possibly been damaged by static discharge or something like that.  It made no difference.

Not having the "B2" part in stock, I de-soldered it and then re-checked the resistance across the pad.  It changed, but not much, so there was still a low impedance short somewhere, and the only place left was the pad itself.

Here is a close-up of a couple of pads.  They are gold-plated contacts, in a fork configuration:



Somehow, one of the pads had become conductive and this was telling the remote control that someone was pressing and holding the economy button.

I cleaned the circuit board with PCB cleaner multiple times and it didn't fix it.  Since the obvious failed, I decided to use a clothes pin to dig shallow trenches in the gaps between the gold fingers on the pad in question.  This resulted in the resistance of the pad increasing substantially and cured the problem.  The remote control is now fully functional.

As a precaution, I also cleaned the button membrane with dishwashing detergent and an old toothbrush, washed it off and then thoroughly dried it.  For completeness, here is what the back of the button membrane looks like.  When you press the buttons on the remote, the conductive pads make contact with the gold fingers and this lowers the resistance of the pad.  This in turn is detected by the remote as someone pressing a button:




Repairs for Others - DD Control (P/N: 110066):

I was contacted by someone who had a faulty control module.  He provided me some high-resolution pictures of the visibly burnt parts of the unit and I basically did a remote diagnosis of the problem from the photos I'd been provided.  Obviously, I couldn't check everything or poke around at all the components I wanted/needed to.  He was in Perth and I'm in Melbourne.

The person in question ended up sending me his control module.  My plan was to take a look at it, do a proper diagnosis and attempt a repair.  If the repair failed I was prepared to cover the cost, even though I didn't really want to.  I figured that if the repair failed and the controller went up in smoke when I tested it, then really, I'd failed in my attempt to repair the unit and the customer shouldn't be expected to pay for that.

So I did the diagnosis, ordered parts, waited in excess of a week for them to arrive, kept the customer informed throughout and eventually did the repair.   Unfortunately, I was hit by a power company screw-up at this time and I wasn't able to test the repairs to my own satisfaction.  I ran his repaired control module from a pure sine wave inverter for 5 minutes to test it.  Normally, I'd have run it for much longer, an hour or more.

I've since found out that the repaired controller is working well.  I'm happy that I've managed to save someone $600 or more.


DD Control Low Power (P/N: 110547):

This control module suffered a failure in the Power Factor Correction part of the board.  There was evidence of arcing across the PCB beneath the MOSFET, however there was no trace of what caused it.

The MOSFET still tested OK, but was replaced as a precaution.  Ceramic capacitor C151 was replaced as it had been permanently discoloured on one side by the arcing.  The two surface mount transistors were also replaced, mostly as a precautionary measure but motivated by the fact that I couldn't test one of them in-circuit.

Below is a picture of some of the damage.  To the left you can see R102 and R103.  In the centre is the location of the MOSFET and you can see something nasty has happened.  I suspect that the arcing (tracking as it's known) occurred due to the PCB having become contaminated, or maybe it was just a spider in the wrong spot at the wrong time.  Death by spider seems to be a fairly common occurrence in these control modules.



Other Useful Information:


Fault/Error/Service Codes:


Below is a list of the fault codes and briefly what they mean:

Fault Code 1: Communications problem - check communication cable between wall control and cooler for damage.

Fault Code 2: Water not detected at salinity probes (usually within 8 minutes) - water turned off, solenoid valve faulty, no power to solenoid valve (should be around 24V AC at solenoid valve terminals when cooler is in cool mode) or faulty (open-circuit) salinity probes.

If you receive fault code 2 within 10-15 seconds of turning the cooler on, then you likely have an EEPROM corruption problem (see fault code 3).

Fault Code 3: EEPROM Failure or Corruption.  The control board stores a small amount of data related to settings for the operation of the cooler in an EEPROM chip.  If this data becomes corrupt, you will often receive fault code 3.  This fault code isn't documented but it is repairable by replacing and/or re-programming the EEPROM.

Fault Code 4: The cooler wanted to drain the water from the "tank" at the bottom of the cooler but after waiting 4 minutes, water was still detected by the salinity probes.  This suggests either a faulty drain valve (not opening) or a blockage in the drain pipe.

Fault Codes 5 & 6 aren't documented and I'm not sure if they're even possible.  If you have either of these fault codes then please get in contact with me.

Fault Code 7: Mains power supply frequency is incorrect.  In Australia, we have a nominal 50Hz power supply frequency.  Fault code 7 will be produced if the mains frequency is outside the limits of 46-54Hz.  This can be caused by contamination to the circuit board in the control module (eg. spiders and other insects), generators, loose/bad connection at the power entry IEC connector or other internal faults (eg. dry/cracked solder joints or electronic component failure).

Fault Code 8: A brief power failure has been detected.  Nothing to worry about in general.


Breezair Direct Drive Diagnostic Procedures:

I've written a short document detailing some procedures that can be used to diagnose your Breezair evaporative cooler.  This document applies to direct drive models only, such as the EXH/EZH/EXQ/EZQ series.

The goal of the document is to establish that you have communication between the wall control or remote control and the cooler on the roof and then to determine if you have a defective motor or control module.  The document is aimed at coolers that have motor or fan-related faults, as these can be difficult to diagnose correctly.

You can download the document from the following link:

Breezair DD CTRL Motor Test Procedures.pdf


Cleaning Remote Control Battery Terminals:

I've just had to clean the battery terminals of my original remote control.  One of them in particular had turned completely green.  This was caused by the leaking alkaline batteries.

Normally I'd take a rotary tool and carefully grind it off and make the terminals look pretty again. 

This time I tried vinegar.  It may have worked a little, but it wasn't good enough.

Next, I thought I'd try a different acid.  I got a small amount of Ranex Rust Buster (phosphoric acid) and drowned the terminal in that.  It immediately started fizzing and ate away the corrosion.  The contact it left behind (on the left) is pictured below:



While I was soaking the terminal in Ranex, I started wondering if the Ranex would do any harm to the plastic case of the remote.  So I put some on a cotton bud and rubbed it on the plastic where the old batteries had left a rust stain.  It cleaned up well.  Here are the before and after photos:

Before:



After:




Video of a buzzing Breezair 550W Motor

Below is a video of a Breezair 550W Direct Drive motor with an inter-phase (or phase-to-phase) short circuit.  It's the common type of short circuit that the older green coloured direct drive motors tend to develop.

This motor has since been repaired (for the second time) and seems to be running fine again.  Running the motor, knowing its got a short circuit in it is a risky thing to do as it could damage the control module, but I did it anyway for the sake of making the video and potentially helping someone diagnose their cooler in the future.





All trademarks are the property of their respective owners.


A Quick Note About Comments

Firstly and most importantly, make sure you check the "Notify me" check-box before submitting your comment if you want to be notified when I reply to you.  If you choose "Notify me", you'll get a copy of my reply to your comment e-mailed to you.

I do my best to promptly reply to all comments left below.  I'll delete comments that don't provide any value to the general audience, just know that it's not personal.  I read every comment and will generally reply to every comment.  I often delete my own replies if they provide little value to other readers as well.

05 October, 2011

How to install a modified Camshaft Angle Sensor in a Vectra B

Diverging from computers and Linux, I'm going to explain how to install one of the modified/updated Camshaft Angle Sensors in a Vectra B with an Ecotec 2.0L engine (my car has the C20SEL engine, but this should apply to the C22SEL, X20XEV and various others).

You can buy the original and modified (aka. revised, hopefully improved) camshaft sensors on eBay.  I personally went for the genuine items made by Siemens.  My Vectra is a Holden branded Vectra, but they are also branded as Opel and Vauxhall in other parts of the world.

I bought both an original sensor and a "modified" sensor.  The original sensor has a rectangle socket and the modified one has an oval socket.  The water seal on the oval socket is much better than the original, but thats about the only visible difference.  Apparently the modified sensor was made to reduce the number of failing camshaft sensors in these engines.

This post will explain the easy way to remove your old camshaft sensor and install the new one, and I'll also explain how to wire up the modified camshaft sensor, as this information wasn't available when I had to do mine.

YOU DO THIS AT YOUR OWN RISK.  I WILL NOT BE RESPONSIBLE FOR ANY DAMAGE YOU MAY DO TO YOUR ENGINE, ENGINE COMPUTER, VEHICLE OR ANY OTHER DAMAGE.

The easy removal & installation method:

You will need these items:
  1. E-Torx E8 Socket or 6mm Double-Hex Socket
  2. Magnetic pick-up tool (they look like a telescopic aerial with a small magnet on the end)
  3. 20mm - 25mm Hole Saw & Drill.
The camshaft sensor is held in by a bolt, and it's not the bolt you want it to be.  The bolt is behind the timing belt cover (the black plastic cover on the front of the engine) and that cover is not trivial to remove.

Instead of removing the timing belt cover, you will notice that there is a bolt that holds the cover on near the top of the engine.  The bolt is recessed into the camshaft cover and is in the middle, directly in line with the camshaft sensor.  This bolt doesn't need to be removed, but the camshaft sensor sits on this bolt and is used to position the sensor correctly.

You need to drill a small hole in the timing belt cover approximately 20mm above this bolt.  Do this with a holesaw, not a drill bit as this plastic will be brittle from the heat over the years.  You can safely drill a good sized hole with a hole saw.  I recommend a hole about 20mm-25mm in diameter.

Before you drill the hole you probably want to know what your drill might hit, and fair enough!  If you do this carefully you shouldn't hit anything, because you'll do this slowly and you won't be pushing hard on the drill, so as soon as the hole saw breaks through to the other side of the plastic cover you can pull it out.  Should you not be careful, the drill bit that guides the holesaw will hit the camshaft sensor, possibly get jammed between the sensor and the bolt holding it onto the head of the engine, which could possibly snap your drill bit, but not likely.  You could also hit the camshaft gears with the hole saw, but that shouldn't do much in the way of damage (they're quite sturdy steel gears).  You won't hit your timing belt, so don't worry too much about that, its well out of the way!

Now that you've drilled the hole, you'll be able to see the camshaft sensor and the bolt (you'll probably need a small mirror to see them).  The bolt is a weird looking thing, called an E-Torx bolt, and I was able to get an E-Torx socket set from my local hardware store for about AUD $25 (in the tool section with the socket sets).  You need an E-Torx E8 socket, its fairly small.

Don't worry too much if you can't find a set of E-Torx sockets, another socket that fits the bolt very well is a double-hex 6mm socket (must be double hex/12-sided, not standard).

Ok, so now you're going to be undoing a bolt that you can't really see and certainly can't get a grip on.  My suggestions are as follows:
  • Put some bluetack or similar on and in your socket so that the bolt will be somewhat jammed into the socket.  Apply moderate force when undoing the bolt that holds the camshaft sensor.
  • If possible, use a magnetic socket, magnetise your socket, or get a small earth magnet and glue it into your socket.  (I didn't do any of this but I was willing to take the risk that I'd lose the bolt).
While you're undoing the bolt that holds the camshaft sensor in place, push the top of the camshaft sensor toward the back of the engine.  Should your bluetack fail you, the angle of the camshaft sensor should stop the bolt falling down into the bottom of the timing belt cover (and if it did I have no idea where it might end up and what damage it might do if you left it in there).

If the bolt doesn't come out with your socket, then use the magnetic pickup tool to grab the bolt.

Once you have that bolt out, the camshaft sensor will be loose.  Just lift it out by its cable and then disconnect the sensor from the cable by pushing the metal clip in toward the sensor.

At this point, if you're installing a sensor with the same connector as the one you just pulled out, then installation is the opposite of removal.  Otherwise, continue reading about how to convert your vehicle wiring to use the modified sensor like I did.

How to wire up the modified camshaft sensor:

You will need or want the following items:
  • Soldering Iron & Solder (this is a must)
  • A small piece of aluminium foil - as used in cooking (recommended)
  • Electrical tape (must)
  • Heat-shrink Tubing (2mm diameter) (optional - you can use electrical tape)
If you're not good at soldering two wires together neatly then have some practice with some spare wire before you do this.  You can read up on good methods of splicing cables.

When you buy your modified camshaft sensor, make sure you get one that includes the conversion kit if your car hasn't already been converted.  The conversion kit is just a new connector with a cable coming out of it.

The procedure from here is pretty simple.

Disconnect the battery negative as a precaution, to help prevent damaging your engine ECU.

Perform the following steps:
  • Cut the old connector off the camshaft angle sensor cable. 
  • Strip the outer insulation of this cable to expose the wires.  You will have 3 insulated wires and 1 non-insulated wire (if you also have some aluminium wrapping around these wires just discard it, we'll deal with that later). 
  • Match up the colours of the wires in the original cable with the new cable supplied with the sensor. Pay attention to the colours on the wires.  You should have two grey wires, one with a red stripe and the other with a black stripe and one wire which is green and brown.  The 4th wire is a shielding/earth wire for the cable as these cables have a thin aluminium shielding inside them.  Connect these wires together also, but leave the unshielded wire bare (don't put heat-shrink tubing or electrical tape over that connection).  All other connections must be insulated with either heat-shrink tubing or electrical tape.
By now you should have the following arrangement:
  • The "Grey / Red Stripe" wire in the original camshaft sensor cable connected to the "Grey / Red Stripe" wire in the new cable.
  • The "Grey / Black Stripe" wire in the original camshaft sensor cable connected to the "Grey / Black Stripe" wire in the new cable.
  • The "Green / Brown Stripe" wire in the original camshaft sensor cable connected to the "Green / Brown Stripe" wire in the new cable.
  • The non-insulated wire in the original cable connected to the 100% black (or possibly non-insulated) wire in the new cable.
  • All wires except for the non-insulated wire in the original cable must be insulated with either heat-shrink tubing or electrical tape.
Once you have this step completed, wrap a small amount of aluminium foil over the wires so that you can no longer see the wires you just soldered together.  The aluminium foil is supposed to be in contact with the non-insulated wire.  This will help prevent unwanted interference from entering the camshaft signal cabling and possibly causing problems.

Use heat-shrink tubing or electrical tape to cover the aluminium foil and hold it in place.  The aluminium foil must be completely covered by electrical tape or heat-shrink tubing.

Install your modified camshaft sensor as per the previous section if you haven't already, and then firmly push the connector on to the top of the sensor.  The cable should click in.  Note that the connector will only fit one way around.

Job complete.  If you have any questions please ask before you start this procedure.  Again, YOU DO THIS AT YOUR OWN RISK.