jcrews
Top Post Dawg
NB: This applies to ALH. BEW has the same pickup, but a different waveform, and I haven't checked to see if its controller has any active monitors for this circuit. If I get a chance to test a BEW, I will update with waveform and self-diagnosis information.
Short version:
* Symptoms: Car fires, but quits running. No fault codes are set, not immobilized.
* Coil resistance (new) 1.2Kohm
* Waveform (new): Sine pulses, f=RPM/15, Vpp=~19V, ~4ms pulses at idle speed.
* Measure pins 1-2 (white, brown).
* Check continuity to ECM with wire chart (1->T121/102, 2->T121/110 05/99+).
Long version for inquiring minds:
I recently diagnosed and repaired a problem with an ALH that started and died, almost like an immobilizer lockout, but without the codes. In the end, it was the G28 that had a microscopic break in it. This particular one was intermittent, making it initially much to isolate with certainty. The car would run just fine once it fired up.
It was only after an adventure in reverse engineering the entire G28 circuit all the way down to the processor inside the controller, that I found the real fault. Here's what I learned along the way:
1. The ALH controllers, through MY 2003, will *not* set a fault code for G28 open circuit. I found a small DC bias across the solenoid on the '03, but having it completely unplugged set no codes. It will only set an implausible signal code when it drops out while the engine is running. When G28 is unplugged, the car will usually fire, but will not continue running due to lack of speed signal to feed into the quantity control logic.
2. A new G28 will be about 1.2K ohms across the solenoid (white, brown conductors). The faulty one measured about 150K, but had reasonable looking output.
3. The speed signal on a new G28 is about 19Vpp. The faulty one output about 8Vpp. Internally, the ECM is blind to this, as it is only set up to detect pulses on a binary input pin. The sine pulses are conditioned by a simple rectifier diode and a Schmitt trigger IC.
This image shows a *BAD* G28 in action, but it shows, accurately, what its raw output looks like (pink), and the conditioned signal that is fed into the CPU's input pin. It basically is routed through a half-wave rectifier (diode), and drives a Schmitt trigger IC to produce a uniform square wave (yellow). The pulses are just counted by the controller software to derive angular velocity. There are 4 windows, and thus 4 pulses per revolution. The good signal is the same, but the pink trace would have a little more than 2x amplitude.
How I finally confirmed the G28 was dead and that replacing it would with 100% certainty fix the problem, I just grabbed a 3/8" ratchet and tapped the sender. These were light taps, just enough to produce a little impact, like (politely) knocking on a door. The engine stumbled, and another tap was enough to make it quit. I had the ECM on a static discharge map and probed to show what was going on. Sure enough, the controller shut down even with 1-2 missing pulses, i.e., it would latch and not try to recover, even if the signal immediately returned. I was able to reproduce the start-quit-start-run, and after a couple more tap-restart rounds, the sender measured well into the megohm range, i.e., completely open.
Another factor that made this diagnosis painful was that the signal didn't look unreasonable when the car wouldn't start. There were clean pulses coming out of the G28, and it's not easy to spot the missing one in a sequence of more than 100. I might have been able to find it with a dropout trigger, but at the time I didn't know to look for that. I suspected, up until the problem happened while the ECM was probed internally (and confirmed by percussive maintenance), that it had a faulty solder joint or other internal fault that prevented the signal from reaching the CPU.
This G28 was just barely hanging on, and the initial start shock was enough to get that momentary dropout, but because the engine was only just starting up, the controller did *not* set an implausible signal code. Counter-intuitively, normal running vibrations were not enough to cause a signal dropout. I was able to drive trouble free for at least 10 miles at a time. There's also an evident waiting period or latch in the controller that delays monitoring at least this signal, as no implausible codes were set until the percussive maintenance test.
This sensor is just like a guitar pickup. It's a permanent magnet core solenoid, and is either physically broken, or it's not. All the signal conditioning is inside the ECM, so an ohm meter can give you a good idea if you have a G28 that's at risk to fail, or is dead.
I hope this helps someone save some time some day.
Short version:
* Symptoms: Car fires, but quits running. No fault codes are set, not immobilized.
* Coil resistance (new) 1.2Kohm
* Waveform (new): Sine pulses, f=RPM/15, Vpp=~19V, ~4ms pulses at idle speed.
* Measure pins 1-2 (white, brown).
* Check continuity to ECM with wire chart (1->T121/102, 2->T121/110 05/99+).
Long version for inquiring minds:
I recently diagnosed and repaired a problem with an ALH that started and died, almost like an immobilizer lockout, but without the codes. In the end, it was the G28 that had a microscopic break in it. This particular one was intermittent, making it initially much to isolate with certainty. The car would run just fine once it fired up.
It was only after an adventure in reverse engineering the entire G28 circuit all the way down to the processor inside the controller, that I found the real fault. Here's what I learned along the way:
1. The ALH controllers, through MY 2003, will *not* set a fault code for G28 open circuit. I found a small DC bias across the solenoid on the '03, but having it completely unplugged set no codes. It will only set an implausible signal code when it drops out while the engine is running. When G28 is unplugged, the car will usually fire, but will not continue running due to lack of speed signal to feed into the quantity control logic.
2. A new G28 will be about 1.2K ohms across the solenoid (white, brown conductors). The faulty one measured about 150K, but had reasonable looking output.
3. The speed signal on a new G28 is about 19Vpp. The faulty one output about 8Vpp. Internally, the ECM is blind to this, as it is only set up to detect pulses on a binary input pin. The sine pulses are conditioned by a simple rectifier diode and a Schmitt trigger IC.
This image shows a *BAD* G28 in action, but it shows, accurately, what its raw output looks like (pink), and the conditioned signal that is fed into the CPU's input pin. It basically is routed through a half-wave rectifier (diode), and drives a Schmitt trigger IC to produce a uniform square wave (yellow). The pulses are just counted by the controller software to derive angular velocity. There are 4 windows, and thus 4 pulses per revolution. The good signal is the same, but the pink trace would have a little more than 2x amplitude.
How I finally confirmed the G28 was dead and that replacing it would with 100% certainty fix the problem, I just grabbed a 3/8" ratchet and tapped the sender. These were light taps, just enough to produce a little impact, like (politely) knocking on a door. The engine stumbled, and another tap was enough to make it quit. I had the ECM on a static discharge map and probed to show what was going on. Sure enough, the controller shut down even with 1-2 missing pulses, i.e., it would latch and not try to recover, even if the signal immediately returned. I was able to reproduce the start-quit-start-run, and after a couple more tap-restart rounds, the sender measured well into the megohm range, i.e., completely open.
Another factor that made this diagnosis painful was that the signal didn't look unreasonable when the car wouldn't start. There were clean pulses coming out of the G28, and it's not easy to spot the missing one in a sequence of more than 100. I might have been able to find it with a dropout trigger, but at the time I didn't know to look for that. I suspected, up until the problem happened while the ECM was probed internally (and confirmed by percussive maintenance), that it had a faulty solder joint or other internal fault that prevented the signal from reaching the CPU.
This G28 was just barely hanging on, and the initial start shock was enough to get that momentary dropout, but because the engine was only just starting up, the controller did *not* set an implausible signal code. Counter-intuitively, normal running vibrations were not enough to cause a signal dropout. I was able to drive trouble free for at least 10 miles at a time. There's also an evident waiting period or latch in the controller that delays monitoring at least this signal, as no implausible codes were set until the percussive maintenance test.
This sensor is just like a guitar pickup. It's a permanent magnet core solenoid, and is either physically broken, or it's not. All the signal conditioning is inside the ECM, so an ohm meter can give you a good idea if you have a G28 that's at risk to fail, or is dead.
I hope this helps someone save some time some day.
Last edited:
