(Auto security tales, DeLorean stereos, Yamaha YPVS Controllers...)

So what's on this page? When I started the site it was all about self-help for Wedge owners, but I do other stuff in my life as well :D

For more than the last quarter of a century I've worked in the non-destructive testing industry, but prior to that I was a bank clerk, taxi driver, motor mechanic and undertaker's assistant! I also did various electronic servicing jobs (having been a radio 'ham' in my teens) and in the early 90s I was in automotive security, when vehicle crime was at epidemic proportions. It seems to be on the rise again now, partly because even some thieving scum are techno-savvy and partly because those that aren't are happy to break into your house and threaten you until they get the keys. Here are a couple of episodes that I recall from way back when...

Car and bike security

Back in the 90s, one of the best-rated vehicle immobilisers was the Vecta. It was a 4-circuit device so it could 'cut' up to that many important functions that would prevent the vehicle starting. Unfortunately a number of incidents soon led to the industry playing safe and only breaking circuits that were easy for the thieves to reinstate, but for a while the fitters were quite creative as to the engine sensors, ECUs etc. they would cut. The Vecta's makers were so sure it was unbeatable that it used to come with an 'insurance guarantee'. A local shopkeeper had his house burgled and the spare keys and immobiliser 'jack' for his Nissan 300ZX were taken. He swiftly had Nissan replace all the locks and then brought us the car so we could strip out the Vecta and fit a new one. Whilst eating his lunch, one of the staff idly started poking the scrap Vecta and discovered that the encapsulation of the electronics had been done not with a hard epoxy but with a rubber compound. He was thus able to laboriously dig the circuit board out of its case - and then he lost interest. I picked it up and started tracing the circuit and within an hour I had a full schematic of this 'wondrous' device. In essence the circuit was what's known electronically as a 'window comparator'. A pair of resistors were chosen to provide a voltage into an integrated circuit. The 'key' or 'jack' that the driver inserted into the dashboard contained a matching resistor, so that as long as the values balanced, the IC would do nothing. If there was an imbalance, the IC's output would switch on, activating the relays that 'cut' the vehicle systems when you turned on the ignition (whether by the key or a large screwdriver that had been monkeyed into the switch). There were in fact 4 of these window comparators in the device, each with a delay period so you couldn't simply hang variable resistors off the jack socket and twiddle until you hit the right value, thus the jack contained 4 resistors (they were actually cut using a laser to make the necessarily precise values). All the window comparators fed one transistor and this transistor switched the 4 relays. It immediately occurred to me that if the transistor was to fail, the relays couldn't switch if they wanted to and thus the immobiliser wouldn't immobilise! After a bit more thought it became obvious that because the circuit board was a perfect fit in its rectangular case, then the transistor must be in the same place every time so a carefully-placed cordless drill could be used to rip through the resin filling and shred the transistor. The very next day, the area rep for Vecta turned up with the Vecta Mk2: exactly the same electronics but dropped into a 6" length of black plastic drainpipe - and now it was full of solid epoxy resin. So now the scrotes who'd arrived at the same conclusion we had, couldn't tell how far in, which way up or which way around the circuit board was...

In similar vein and around the same time, a mate of mine worked as a mechanic in a (now-defunct) motorcycle shop in a Durham town. When bikes were traded-in, the shop boss would tell the mechanics to strip off any alarm system because if there were any reliability issues when the bikes were sold on, the shop would have to fix them under warranty. At the time, a popular bike alarm system was the Datatool Mk V (Datatool, unlike Vecta as far as I'm aware, are still in business). Quite a few of the Mk. Vs had gone in the workshop bin before my mate brought one to me and asked if I could figure out what all of the newly-snipped (and all black) wires would need to be connected to, in order to be able to reuse the alarm. To make it weatherproof, the Mk. V PCB was fitted into a plastic box which was then filled with a blue gel to repel water. Once the gel had been messily scraped off I set about tracing the circuit and soon established which wires were earth, power, outputs to indicators and so on and was able to set it up on a bench PSU to test and prove it worked. I extended the snipped wires back to useable lengths and my mate then had a quiet word with one of his customers and the rescued alarm soon found a new home... as did several more over the coming months. The auto security place where I worked didn't fit bike alarms at first but once I suggested it, the boss had us all meet at his house at 0300 hours for a 6 hour drive to attend an installers' course at Datatool's head office in Hampshire. By now I had a full schematic of the Mk. V, spread across an A3 desk pad (if anyone's interested, it used a lot of 4000-series CMOS ICs on a double-sided PCB so if you've ever tried tracing logic circuit tracks that swap PCB sides below other ICs you'll understand how long it took!), here's an excerpt:

I took the schematic along with me and in a coffee break I asked if I could talk to their 'service engineer' who was supposedly responsible for any returns/repairs. When I unrolled my schematic and asked him if it looked about right he stared at it, shrugged and said he didn't know, he'd never seen a diagram or lifted a soldering iron; all he did was wire the suspect unit to a 'test box' that looked like it was built in a shed, press a couple of buttons and if the lights didn't come on in the right order he just threw the alarm in the bin and told despatch to send out a new one. It transpired that Datatool just bought the alarms in from Italy and were little more than box-shifters. Now I don't know if things have changed and I have a perfectly-serviceable modern Datatool on my bike but that was certainly the situation then - in fact the vast majority of car alarms were Italian as well and many of the leading brands were just that: different labels stuck on the same product. Stinger, Foxguard, Sterling were all the same (down to the text and layout of the fitting instructions). From a service techie's viewpoint, the Laserlines and Moss systems were easy to work on down to component level. Here's the Moss 705:

One of the things we discovered with the aforementioned Foxguards et al. was that they all used the same PCBs but omitted various components for the more basic variants, plus the wholesale price varied between the three brands even though they were all identical inside! We soon worked out that it was more profitable to buy the base model of the cheapest brand and add the missing components to create our own hybrids than it was to buy the top-spec version of the swankier brand from the wholesalers! Joe and Jane Public didn't care what the window sticker said as long as their car had a magic cloak fitted so the scum would look elsewhere and if the doors went clunk when you pressed the button, so much the better.

Another thing we discovered was that, despite using encoder/ decoder ICs that in theory offered tens of thousands of code combinations, some of the makers hard-wired some of the pins and only had a few of them programmable, so in practice some brands probably had less than 1000 codes available. Granted, you'd have to be very unfortunate to find your neighbour unlocking your car as well as his, but it seemed a daft thing to me at the time.

Stereo Incognito

As we also fitted car audio gear we used to get asked to do repairs. One day a suspicious-looking character came in and pulled a car stereo out of his jacket. He claimed he'd connected the battery on his Mercedes backwards and now 'the sounds' didn't work. Leaving aside the fact that he had no Mercedes with him - actually he dropped his all-day 'Transit Tripper' bus pass - as soon as we mentioned a £40 'inspection fee' he shrugged and said that we may as well bin it then, he could easily afford another, and off he shuffled. In the general direction of a bus stop. Closer inspection revealed that the head unit was a Pioneer KEX-900, part of their 'centrate' line-up and would have been several hundred pounds new. The KEX-900 won't actually do very much by itself; it's a cassette deck but there's no radio or amplifiers in it, those are separate modules, intended to be concealed around the car. As it turned out it wouldn't power-up but that was probably down to someone poking a car battery into random sockets on the back. By coincidence, one of the other local car alarm places (who specialised in Gemini alarms) was also the local agent for Pioneer and in a bit of quid pro quo they were able to order the workshop manuals from somewhere on loan. I duly whipped them round to my mother's office and she got her boss's permission for me to use their photocopier :D Not only that but the Gemini/Pioneer guy had a think, rummaged in some boxes and turned up the matching tuner module for the KEX900, as well as a couple of random Pioneer power amps and sold me the lot for £30. Armed with the factory manuals I was quickly able to replace one blown transistor in the head unit and the system worked on switch-on. At the time I was driving a Skoda Rapid (the rear-engined 136 coupe); it really was a case of the stereo being worth more than the car. I used to pull the head unit out every night, I was that paranoid. The Skoda, incidentally, had a 'recycled' alarm system fitted that included central locking, ultrasonics, tilt sensor, glass break detector, twin sirens - the works! Didn't stop the local tea-leaves having a crack at it, in the quiet Middlesbrough back street where my then-girlfriend lived - but I bet they got the shock of their lives when a Skoda lit up like christmas and made enough noise to wake the dead :D In fact it was broken into so often the local breakers all ran out of Rapid quarter-lights. As for the KEX-900; it migrated from the Rapid to a box in the loft while I drove around in a Renault 25 luxo-barge for a couple of years before finding its way into my TVR Tasmin. To get round having to extract it every night, I made a fake front for it that made it look like an old 2-knob radio-cassette that no self-respecting twoccer (from Taking Without Owner's Consent) would want. It even included a cassette sticking out of the flap - to give the scum the finger it was an old album by The Police :D You can see the dummy front standing proud of the dash on this picture of my Tasmin from 20-odd years ago - and the Pioneer is still in my loft, somewhere...! :

DeLorean Stereos

Speaking of 2-knob radio-cassettes, I've been working on some Craig W460s. I know, I know, I'd never heard of one either but it turns out they have a bit of a following among originality buffs. So much so that these unassuming old car stereos can command pricetags in the hundreds (of pounds, dollars, Euros, whatever you work in) despite having no DAB, Bluetooth, aux inputs, colour touch-screen or remote control. How can this be, you ask, incredulously? And, Craig who? Here in the UK they're practically unheard of but in the States they were an established company making domestic and vehicle radios, CBs and so on long before one John Zachary DeLorean had the great idea that he could build a sports car to take on Porsche, and even longer before one of the resultant cars ended up in a little-known 1985 film about an American teenager and a mad professor with a time machine. Yes, you've got it: the Craig W460 was the original standard-fit radio in the DeLorean DMC-12. There seem to have been two versions; one had the option of showing the time (but not the year :D) and the other didn't - early cars had a separate clock on the dash and later ones didn't as the time was shown on the stereo. The very late cars had a different radio/cassette made by ASI, but that needn't concern us here. The passage of time has shown up a few issues with the W460 and it's those issues I've been addressing on behalf of a mate, who by chance or wonky decision-tree owns a DeLorean. Or five, but that's not relevant either, other than to provide me with a pool of these damn radios...

So, what are these issues? Well, firstly, the radio has both AM and FM band coverage. However the US and European band allocations have differed slightly over the years so the W460 covers 530 to 1620 kHz AM and 87.9 to 107.9MHz FM. Which is all well and good, but in the US the AM stations were transmitting at 10 kHz intervals and in Europe we use 9kHz - and our coverage is 503 - 1602 kHz. So you can see the chances of landing on a given station are slim - and it gets worse because although the FM band coverage is the same, the US uses 200kHz spacing and Europe uses 100kHz, so the W460 goes 87.9 - 88.1 - 88.3 - 88.5 - 88.7 - 88.9 - 89.1 - and so on, meaning that any UK station that transmits on say .6, or a round number like 105 Mhz, will either not be tuned or will sound distorted because it's 'just off'. It transpires that there's an easy fix for the AM tuning; the set can be adjusted internally to give the European bandwidth and 9kHz spacing, but there's no easy way to fix the FM. There is, however, a way to do it which involves replacing the main tuning IC and if you're reading this and would like it doing, drop me an email via the website front page.

The display is the next problem. The frequency (and clock, where applicable) readout is a three-colour LED installed as the cassette flap. In order for the flap to hinge up when you poke a tape in, the display is powered by a flexible membrane-type ribbon cable. Over the years the printed tracks disintegrate at the point where the ribbon flexes, leading to segments of the display not lighting. The 'traditional' way to repair this involved laboriously soldering fine insulated wires between the display and the main circuit board, but there's now a better option: someone has had replica membranes produced. I've fitted one and have a second to do and can report that the quality of the membrane is absolutely spot on and it's a perfect fit.

The W460 uses a pair of audio amplifier ICs to drive the speakers. It passes the IC output through the front-panel fader and uses a '6-wire' setup where the negative wires from both speakers of one channel go to the same 'earth return' on that channel. It doesn't say so on the radio itself but do not ground any of the speaker wires or you will blow the output ICs. You can still buy them at about a tenner each but it's best avoided.

The cassette mechanism itself is now suffering from a number of maladies: firstly the single rubber drive belt perishes, stretches, drops to bits - take your pick. Luckily it's a common size and freely available (and you don't need to pay the prices charged by some people on Ebay ;o) ). There's a white Nylon linkage that snaps - not if, but when. It affects the ability of the deck to fast wind and auto-reverse. Alas even if you find the snapped-off part, Nylon is one of those plastics that refuses to accept adhesives and it's a nice complicated shape if you fancy copying it. I've devised a repair for that but only time will tell how long it will last. Next, the cassette motor speed controller can suffer from failure of one or more of the capacitors it uses as part of the speed timing circuit. Sometimes the tape will play for a few seconds and then slow to a stop, or else it'll play but at full fast-wind speed, making Blondie sound like The Smurfs. On speed. If all this makes the Craig sound like a crock of crap, well, it's not - or at least it's no worse than any other car audio unit of its time. As far as audio quality is concerned, people are quick to dismiss the Philips Compact Cassette nowadays, but it was a very capable medium when correctly employed - Nakamichi cassette decks, for example. Cleanliness of the head, capstans, pinch rollers and use of high-end tapes is essential anyway, but especially so in a car. The Craig uses a 4-track head and alternates between two capstans for the tape drive. This involves switching between the head poles and the switches can become 'grotty' with inactivity. On the plus side from a service point of view it's all 'traditional' electronics; discrete full-size components rather than surface-mount microprocessory nonsense like everything is now. Even the mechanicals are robust for the most part. In essence this is an almost-40 year old car radio - but given the almost-40 year old car it belongs in, you can see why the owners like to maintain them as standard, and preferably in working order. Now where did I leave that box of new-old-stock flux capacitors...

Yamaha Powervalve Controllers

As evidenced elsewhere on this site, I'm a biker (the nasty, dangerous, antisocial suicidal maniac kind of bike - although the way some cyclists ride I'm sure that description could apply either way) and most of my mates are as well. Some of them have been riding since the days when all you had to do was stay on long enough for the examiner to sign the paperwork and you had a bike licence... and some of them learned their trade riding the noisy, smelly, liable-to-explode-at-any-second variety with two-stroke engines common in the 1970s and 80s. Of course with the onset of middle age and disposable income some of the guys hanker for the old days and search out the two-wheeled heroes of their impecunious youth. Thus it came to pass that a Yamaha RD500 appeared, largely in crates, and was subsequently restored and rebuilt by a die-hard Yamaha fan. Unfortunately, the beast refused to run correctly and the fault was traced to the non-operation of the exhaust 'powervalve'. Yamaha came up with the Yamaha PowerValve System and used it across their range of 2-smokes from the early 80s. Like any other good idea, they tend to work for so long and then fail and they do so in a number of ways, one of which is for the electronics control unit to pack in. So as he was unable to find a replacement at a price worth paying, and as I learned my trade on the electronics of the 1980s, he waved it under my nose and threatened me with beer if I got it working. Cutting a story short, I did, of course, and as a result I have full schematics of the thing and am pretty confident that I could diagnose, if not actually repair other faulty ones as well. I throw in that last caution because this was the 1980s of course, and microprocessors were starting to appear everywhere and take over the world. Although the chip that Yamaha used is still available, it does have proprietary code programmed into it so if the chip itself proves to be duff, one would not only need to find a supplier of the chip but also a copy of the code and the necessary EPROM programmer to poke the magic in. However, it's extremely likely that the majority of faulty units are defective in ways that wouldn't affect the microprocessor so if you have a suspect unit, feel free to contact me and I'll tell you where to send it :D - and of course I have a mate with a known good one to use as a reference. You may well decide that an aftermarket combined CDI/powervalve controller is a better way forward and probably on a race bike or one where you just have to squeeze every last drop of grunt out of it, instead of doing the sensible thing and buying a more powerful bike, you may well be right. But rather like the DeLorean and it's 40 year old radio, anyone wanting an RD350, RD500 or even one of the smaller-engined liquid-cooled Yamahas in near-original condition would probably prefer it to have the proper electronics. It's dinosaurs like me that keep the prehistoric alive :D

...and back to car alarms...! (Oct 2020)

A mate of mine acquired an Aston Martin DB7. It wouldn't start. Apparently the previous owner had also failed to get it to start, which didn't bode well. The car was missing its alarm fob, and the theory was that there was some immobilising circuitry in play. With the aid of the Aston's worshop manual we located the alarm module, a Cobra system that was fitted at the factory and incorporated into the car's wiring loom. It was immediately obvious that someone had been tinkering; almost every wire of the alarm loom seemed to have been cut, soldered and taped, which suggested random twisting-together in the hope of completing a circuit and getting the car running. Clearly, that hadn't worked. About the only wires which hadn't been butchered were the receiving aerial and the feeds going out to flash the indicators, so it looked as though the mystery wire-murderer had access to some information, at least. I started by digging out my ancient file of car alarm stuff, but all I established was that this system shared not one colour-coded wire with the Cobras I'd worked on in the 90s. So it was back to the Aston wiring diagrams, and if you've ever perused them you'll know what fun THAT was! Essentially, it didn't take long to identify all but one of the wires, proving that there were no 'traditional' immobiliser circuits. The one remaining wire is a serial data link to the engine management ECU; when you disarm the alarm it unlocks the doors and as long as you turn the ignition on within a predetermined time, the Cobra sends a digital data stream to the ECU which activates it and allows the car to start - and no, it isn't just a logic high or low. Interestingly, this ECU was built by the same people who did the injection system in the Jaguar XJ220. Later DB7s got a modified Ford unit, but the earlier cars have this type. It's a well-made unit and there's no obvious way to reprogram the 'immobiliser' code, which means that the Cobra alarms were code-matched to the ECUs, so if your early DB7 alarm fails, you may well be up the proverbial creek. Needless to say, I wouldn't be telling you all this if I hadn't worked out a way to beat the system, and of course I did and the car now starts :D You might imagine the quickest solution would be to buy a replacement fob, but apparently they're unobtainable, and anyway it would need coding to match the Cobra unit, which appears to need a cable. If you're very lucky (as my mate was, eventually), you might be able to find a later-model Cobra alarm that was fitted to some, no idea how many, DB7s that has a different fob style but performs the same coding process to the ECU. Of course, most of the wire colours are different...!


(Back to Home)