Getting John the Ripper working in OpenCL mode in Windows

I recently needed to recover passwords from a Linux system where I had the drive which I could connect to a Windows PC but this presented several issues starting with finding the right file then what tools to use and most importantly how to mate it correctly in OpenCL mode to get the benefit of graphics card processing power!

Firstly the drive was formatted as EXT3 which Windows doesn’t natively support. After a bit of research I found a free program called Ext Volume Manager and gave it a go. It worked perfectly and after giving a list of available drives you can double click and mount the drive as a drive letter in Windows then just browse to it like any other drive. It was simple and worked really well.

Now that problem out the way we needed to find the password file. In Linux passwords were historically stored in a hashed form in root/etc/ in a file named passwd so this is the first place to look. Open it in notepad or similar and it is highly likely you will see a series of lines line this:

root:x:0:0:root:/root:/bin/bash

The X is where the hash would have been found historically but when the security was updated this method was changed and so the X just shows that there is a password configured but it’s stored elsewhere.

That elsewhere is a file in the same location called ‘shadow’. The structure of this file is very similar to ‘passwd’ but in Linux has different permissions. Luckily in windows this doesn’t make much difference so we can just open it.

root:$6$THMmaDC5$k/fXJE/K73OSr3KuXBs.TzBjX6i3kj1dEwrEuV7DvsTxQ0YBDceTpHVQRKSPRTqhMFbdZfZl/lZVfnMCrkFJX1:15726:0:99999:7:::

The data should look more like this (I have cropped out some of the line to avoid it filling the screen. The $6$ in this case identifies the password hash as being sha512crypt format but yours may differ, the options are:

  • $1 = MD5 hashing algorithm.
  •  $2 =Blowfish Algorithm is in use.
  •  $2a=eksblowfish Algorithm
  •  $5 =SHA-256 Algorithm
  •  $6 =SHA-512 Algorithm

The next bit ‘ THMmaDC5 ‘ is the ‘salt’ value which is random data used to encode the password as the hash making it more difficult to guess.

The remainder up to the colon is the hashed password which is what needs to be guessed so now we have the right file.

Next go ahead and download Cygwin ( https://www.cygwin.com/ ) this is basically a miniature Linux platform on Windows which lets you compile Linux programs to run under Windows if they are compiled for it.

When installing Cygwin generally you can just use defaults and whatever local mirror you fancy however when the list of tools is shown search for OpenCL and add this to the installation.

OpenCL Version

Add the highlighted component to the install and continue and you should find you will soon have a Linux installation in a folder on your PC (default location is C:\cygwin64\ ).

Next download the zip of latest version of John the Ripper ( https://www.openwall.com/john/ ) – this is a widely recognised tool for this purpose and seems to work best. I also tried a program called HashCat but this didn’t seem to be able to find the hashes in the file. The version I used was 1.9.0-jumbo-1-64 Bit.

Hopefully the zip will look like this. Copy the all the folders and paste them into the Cygwin folder – there will already be a folders with those names so merge them. This operation adds the descriptors to allow Cygwin to recognise your OpenCL device however on my PC (and from what I’ve been reading online several others the path was incorrect so we’ll fix that.

Browse to the following path C:\cygwin64\etc\OpenCL\vendors\ and open the amd.icd file in notepad.

Next go the the system32 folder as shown and search for ‘amdocl64.dll’ . In my case this wasn’t present in the system32 folder directly but I found a match in System32\DriverStore\FileRepository\ . If that is what you find just copy the file and paste it into system32 itself and this should correct the mismatch.

Next copy your ‘shadow’ file into ‘C:\cygwin64\run’ – technically this isn’t required but it makes life easier. In my case I edited it to have a .txt extension to make testing easier. Now to test it!

Open a command prompt Window and browse to ‘C:\cygwin64\run’ then enter the following command:

john shadow.txt –format=sha512crypt-opencl

Interchanging the format for whatever is relevant to your hash type. If you run john without specifying a hash format it will recognise it correctly but will default to CPU only mode rather than the OpenCL version which comes with a performance hit for most people.

All going well you should see something like this :

That tells us its working fine and has successfully found the graphics card as a processing device. Now take a break and leave it to churn through its options for as long as it takes. It won’t be fast!

Start of 2020 Update

Apologies to anyone who’s been waiting for an update on any of the projects I’ve put on here – I’ve had a lot going on over the last year and writing up all of this information takes me a lot of time so has taken a bit of a back seat. None of that information has been lost and I hope to start catching up on all of this over the next few months.

Where we are right now :

V6 Mazda RX8

The V6 engine has been fully rebuilt and has been sat in my living room next to an engine crane for about 8 months now, Partly this is due to me not currently having a garage to work in and it being winter and partly due to being very busy last summer. But yes, the project is still ongoing and hopefully will make good progress this year.

Six million dollar welder

Is still on my workbench awaiting the last couple of bits. I’ve had to swap out 24V PSU’s a couple times as they couldn’t deal with the current of the new feed motor. It now works but needs the relays mounted to the panel so I need to remember to find 4″ of DIN rail.

DL180 Server

Is still working beautifully after the Arduino fan controller mod. It’s been hosting this blog ever since so something like 12 months now without a problem. It also provides the storage for my CCTV system.

Hikvision CCTV

I’ve got a couple of updates to write about expanding the system beyond the original one camera setup I wrote up last year. Using multiple cameras with network storage seems to be poorly documented and have a few interesting quirks but after some work I got it working fine. The biggest problem I’ve had since is when the local police asked for my footage following a nearby break-in I had to supply them on a 1 Tb hard drive! High resolution digital video takes up a lot of space!

Other Projects

I’ve had various other projects going on as well. I’ve started looking into using NodeMCU WiFi microcontrollers as sensor nodes with their own web servers around my house with NodeRed requesting the page and parsing the HTML to return the information I want. I can read the temperature sensor connected to the nodes and control the LED on the MCU from NodeRed. Currently the data is not stored because I ran out of time trying to get MySQL setup. I’ll write this all up at some point

Raspberry Pi’s – I seem to have collected a selection of Raspberry Pi’s somewhere along the way. I have a Zero, a ZeroW, 1B (which in a different life I turned into a PoE CCTV camera), 2B and 3B plus I think somewhere there’s another 2B. I really should do something cool with them!

Wooden storage box – I started restoring a large wooden box some time ago. The box used to be in my granddad’s workshop as a toolbox for many years and before that I gather it belonged to his uncle so it’s been around for a long time and has suffered a bit with use and age with some areas with woodworm damage and the rope handles badly degraded. It has also been painted brown at some stage so I’ll need to get that cleaned up as well. I intend to restore it to a ‘usable’ condition so rather than trying to make it as new just tidy it up, repair the damage and make it solid enough not to degrade further but still look like the well used item it is.

Subwoofer project – Has been in constant use for ages despite never being technically finished. I really need to actually finish it and write this up!

There will be more but I think that’s enough update for now – rest assured I’ve not stopped! Especially since this morning another turbo arrived in the post, the fourth I now have here….

Upgrading a SIP Migmate 130 Turbo welder – Part 2, The 6m Dollar Welder

So after it had been left abandoned in a cupboard for a couple years I was recently contacted by the guy who actually owns the old SIP Migmate welder saying he had a couple projects to do that would be good for a MIG but aware we’d previously done it serious damage to the torch he’d found a wire feed unit with a euro torch connector on ebay and could we make it fit. Well of course we could, what could possibly go wrong! Before I knew it he’d ordered it to ship to me so I guess we were modding the welder again. We can rebuild it better than it was before!

Upgraded Wire Feed

Wire feeder
The new wire feed motor

So this is what turned up – clearly a different beast entirely to the original plastic rubbish. Don’t be mistaken, it’s a top quality Chinese unit but it is significantly better built than the original – one being mostly metal it doesn’t deflect under load. Add to that the motor is rated at 40W which is probably four times more than the original one it should be able to drive wire through longer torch leads with no problem.

Wire feed drive comparison

You can clearly see the significant difference in the units in this picture. But that isn’t going to stop us!

First off we need to remove the existing feed unit. These are held on with four pop rivets which are quickest removed with a power drill. To extract the drive unit the torch must also be unbolted from it with the one retaining nut.

Migmate 130 of feed removal

So at this point you should be left with this :

At this stage you’re probably wondering how this will work, and if (however unlikely) you’re attached to this welder you probably want to stop reading, this will not be pretty!

If you’re you’re not attached to the welder I suggest finding an angle grinder and getting busy!

The key thing to note here is because the new drive is for a euro torch it is energised by the main supply so no conductive part of the feed drive can be in contact with the casing. Add to this the new unit has an adjustment on the top which needs clearance under the case the feed motor cut out needs to continue much lower down.

Due to the feed mechanism being physically wider the connector for the euro torch connector will sit further out than the original torch outlet. In an ideal world I’d have relocated the the wire feed to the bottom of the welder but the outlet inductor is behind the panel and I didn’t want to go trying to move that enough for that idea to be viable.

First cut for wire feed

The first cut doesn’t look too serious, then hack the front out :

Front first cut

Hmm, yes I’ll work out how to cover that up later!

Next up we make a plate to hold the euro connector. This is to prevent any movement on the euro connector causing it to hit the case which could end very badly. I found a random bit of polycarbonate I had lying about drilled a clearance hole in it then worked out where it needed to sit. The horizontal position here is less critical as we can adjust it on the mounting later. The plate needs mounting holes to fix it to the front plate so drill and bolt this. A trial fit then also identified that when the new feeder was fully forward in position more clearance was required in the internal plate so this needed a little more butchery.

New mounting for replacement wire feeder

The blue wire dangled through the divider in the picture is actually the trigger wire for the welder something we’ll need to sort out later to actually make it work.

Wire feeder trial fit

So here’s the trial fit, nothing touching the case where it shouldn’t and all seeming to fit well. around this time I wanted to get a matching torch for the upgraded welder so I went to my favourite welding shop (Noz-Alls in Cheltenham) to pick one up and while there I explained what I was up to with the welder and he helped me out with some more bits he had. Specifically I wanted to upgrade the welder from using 0.7kg wire spools to 5kg spools so I needed a new mount for the reel and not only did he have something he also mentioned that I’d suitable gas valve (the welder originally had a mechanical one in the torch but I hadn’t even thought about the fact euro torches don’t have this. Again he had just the thing available for a few pounds so I got that as well.

New feed roller

Now that looks more like a proper setup, this new mount just bolts through the divider plate. Next up we need to mount the drive motor itself, it is critical to remember the black plate under the drive must remain to insulate it from the mounting bracket. I originally intended to mount it with a section of angle but in the end I came up with another alternative. I had a short offcut of 40x40mm aluminium profile with a couple angle fixings which by luck was perfectly sized so I decided to use that up.

Mounted new wire feeder

Something I should probably note here is using either durloc or nyloc nuts on everything I can and make sure everything is good and tight. The owner of this welder can be hard on equipment and I want to be sure that when I hand it back it won’t just fall apart!

Fully fitted wire feed and reel holder

That’s the wire feed and 5 kg reel setup all installed. So now back to the problem I mentioned earlier with the gas valve. The black hose coming off the back of the euro connector is the gas line, I need to connect this to a valve. I decided to mount the valve on the electrical side of the welder because my plan was to drill out the original hole the gas hose entered through to take a more standard 3/8″ BSP threaded fitting.

Gas Valve

New gas valve

The valve I bought is a direct fit to the 5mm ID hose off the euro connector. The valve inlet is an 8mm barb so I bought an 8mm to 3/8″ BSP female hose barb and screwed it into the back of an 3/8″ BSP bulkhead fitting. The bit of hose is a section of 8mm fuel hose I had lying about. The valve actually has a nut on one side to allow it to be mounted to a panel, in this case I mounted it to a section of aluminium angle. These valve are available in a range of voltages; usually 6/12/24VDC in welders but others are available. Since the feed motor is 24 VDC and we need this to open when the feed is on it makes sense to use the same then we only need one trigger switched supply for both.

Earth lead

So with the addition of a detachable torch I thought a detachable earth lead might be a good idea. I bought a 10-25 dinse connector off ebay, this comes as a plug and socket pair where the socket fits through a hole in the panel and the plug is bolted onto the end of the cable. To mount the socket I undid the clamp inside the welder where the cable was fixed to the supply transformer. The cable is held in by a plastic clamp so just undo that and pull the cable clear and remove the clamp from the panel. As it turns out the panel hole was fitted with a dinse connector in a different model and so they actually fit the panel perfectly with the anti-rotation key even fitting. Again for the power connection to the socket I used a 10mm re-usable cable lug but had to fold the solid core from the transformer back on itself so the clamp would tighten onto it solidly.

Dinse connector
Make sure it’s all tight; you don’t want this coming loose!

Wire Feed Controller

I decided in the end rather than bothering to improve the existing speed controller which is well documented to have issues I’d simply replace it with a modern PWM DC motor controller. PWM controllers generally allow a very wide range of adjustment and because they apply full voltage the motor retains excellent torque even at low speeds. So I bought another quality Chinese board off ebay and after a couple weeks I had one of these:

These go for about £2.50 and from my initial tests with a 19 VDC laptop supply and the new 40W motor it worked perfectly and it gave very smooth control up through the full range. The only thing that might need adjustment later is that full speed seems excessively fast for a welder but this is something to assess when the motor is loaded. With the smoothness of the range this wouldn’t be a problem but if we don’t need it later it would be better to add a resistor to make the controller only go up say 75% full speed when the dial is at maximum. But we’ll worry about that later.

The next problem is the nut on the potentiometer which would normally hold it in place fits right through the original hole in the panel. So I found a large penny washer which it would tighten up on and drilled two holes in it. This washer was then pop riveted to the front panel. With the knob back on you cant even see the rivets.

New motor controller
Rear view of the new controller
And the front view – you can see the other additions as well

Now, you may notice I’ve taken out the original PCB. This is partly because we needed the spot for the new speed controller but also because that makes about half the PCB redundant. The only other things on the PCB are a small 12V PSU (to drive the main supply relay), a couple line filter capacitors and a 16A relay which switches the main supply. My plan is to replace the relay with a 24V coil one and run all the control off the separate 24 VDC supply.

More to follow in the next update!

Upgrading a SIP Migmate 130 Turbo welder

The story of this upgrade starts with a friend of mine acquiring it about 15 years ago (at which point it was already quite old) and after some use real life got in the way and it was abandoned in a barn for about a decade. At this point I needed a welder for a project and asked to borrow it. Now when I got my hands on it and started trying to use it it became immediately obvious these welders were amazingly basic and poorly constructed and so immediately I started modifying it to make it work a little better.

Factory Wire Feed

First off the standard wire feed is terrible, it’s made of plastic and if you put enough pressure on to push the wire the mounting for the drive (being plastic) actually bends away and just won’t consistently grip. This situation can be improved by changing the plastic torch liner out for a steel one to reduce friction but it’s still dodgy. Bracing the wire feed on the outside helps as well.

Migmate 130 Feed Mod

Here you can see the feed modification. It is simply a bit of scrap metal with a slight bend in it and two holes. The two screws are already in the feed system and hold the parts from the factory so it just picks up on them. This simple mod helps the two feed rollers from deflecting away from each other.

The next issue with the wire feed is the motor is driven off the main transformer output with half wave rectified DC which causes a one main problem, the supply to it isn’t consistent. When the arc is struck the voltage at the motor will drop due to the load change on the transformer which tends to make the motor constantly pulse in operation rather than give a consistent feed so it’ll join metal but not in a particularly convincing way.

To get round this I added a small regulated 24VDC supply for the motor with the help of information I found on the internet such as the wiring diagram for the welder. The was this works is the control board gets its 24V supply from the black wire on the 4 pin connector. If we disconnect this and instead feed it our own 24VDC the supply shouldn’t fluctuate any more. I used the existing supply (the black wire we just intercepted) via a relay (24VAC coil) to turn on the wire feed when the output energises. You should end up with something like this

I’ve not checked the rating on the factory feed motor but I would guess 10W at most. I used a 24VDC 15W PSU module (specifically a Tracopower 15124C that I found on ebay) and it worked well. I managed to fit it behind the main transformer bolted to the outer casing.

Added power supply location

Further to this the motor speed circuit is actually very poorly designed and after a little use can get twitchy and change during use. I didn’t get as far as modifying this but further information can be found here :

Wire speed mod

Or if that should ever go offline also in this PDF :

Earth Lead

Another key usability thing is that these welders have very short leads and the clamp was poor from new and appeared to be a similar thickness to tinfoil and added to that was badly damaged and even rusty and since poor contact causes many issues with consistent welding so I decided to upgrade the cable and clamp to help the situation. For a welder this size you need to be looking at a minimum of 10mm2 cable but this will not allow you to operate at full power consistently (not that this welder is actually capable of that anyway!) 16mm2 would give you plenty of spare capacity.

The clamp itself was just bought off ebay again, they’re about £4 each so difficult to go far wrong. You could go for a different style to the normal clamp if you prefer such as a magnetic one. To connect the cable to the stud on the clamp I used a reusable cable lug which uses two small bolts to tighten to the cable, you could buy crimp lugs but crimping them without the correct tools can be hit and miss. I’ve heard a cold chisel will work but your mileage may vary. I actually used a second reusable cable lug to clamp the new cable onto the transformer outlet inside the welder – not the neatest solution but it worked.

Gas Supply

The standard shielding gas supply on these welders is via a small plastic tube which is intended to be connected to a mini-bottle which sits in two brackets on the back. The brackets aren’t actually fixed to the welder so can be easily knocked off. The standard regulator is rubbish and the one I got with the welder was totally seized shut. I bought a like for like replacement initially and this highlighted the limitation here. The bottle is so small and the regulators so poor that the gas flow actually changes during use and rapidly empties entirely. They have no gauge and so the first you know of having no gas is when your welds go horrible. I looked into it and found a good solution – you can buy regulators that adapt a normal gas bottle to this type of hard line.

I looked into getting gas and found that the time of massive rents on bottles is over. In the UK there are a couple networks of suppliers who will give you weld gas with only a bottle deposit (currently £65 for mine) and no ongoing rental charge. Once the bottle is empty you take the bottle back and get a full one and just pay the gas fill cost (about £30 for the bottle I have) I found a supplier of Hobbyweld gas (Noz-Alls Cheltenham – www.weldingdirect.co.uk) and got their 10L bottle, these are pressurised to 137 Bar giving a total of 1370L of gas. This lasts drastically longer. The shop I went to also sold a standard regulator but with a crimped hose and a push fit to suit this welder off the shelf making this very easy for about £20.

Roll Drag

One other problem I had was the tension spring which is supposed to hold the roll under a little tension to prevent overrunning was actually sharp and biting into the reel. I added a large flat washer under the spring to stop this then added a small washer as a shim to prevent it being over-tightened. This provides friction over a large area to avoid this problem and it seems to work well.

So once I’d done all of this it worked significantly better and we used it for a few projects to good effect right up until we tried to repair and refit the load bed of a pickup truck which involved welding plates onto chassis rails and various other extensive welding work. After burning through multiple contact tips and a couple shrouds we got to the point where the torch died entirely with the wire welding into the inner workings of it and came to the conclusion it was done for. The torch on these being hard wired into the unit finding a replacement wasn’t as simple as a standard euro torch and at this point I wasn’t sure it was worth replacing until we actually needed it again. Some time later I bought a new compact R-Tech MIG which by comparison is a revelation and so the old Migmate got thrown into a cupboard for storage with the expectation it would eventually probably be scrapped.

Though that’s not exactly how the story ends…

How to Set up Hikvision Network Cameras

Recently one of my neighbours told me there had been an incident where someone was seen trying van doors along the street late at night and combined with the habit of numerous people attempting to turn their cars round on my driveway with seemingly no ability to successfully do so or any apparent awareness of their surroundings I decided it was probably a good idea to get security cameras to keep an eye on the place!

I started looking into it and decided that network type cameras were the best idea because I already have a suitable server to store the footage and a long time ago started running substantial amounts of CAT5e cabling all over my house because due to having thick stone walls WiFi from a normal home router really wasn’t an option. Since I needed to install three separate wireless access points to cover all the indoor areas and so needed to run cable across the house anyway. With (at least some!) of the cable run in it sounded like the best solution.

At this point I should probably point out that I know nothing about what is the best camera, I can’t say for sure if what I bought were actually the best option but they seem pretty good so far but your mileage may vary.

So after a bit of searching I found that Hikvision cameras get good reviews and are generally quite well regarded so when a couple came up on eBay for a decent price I went for it. The model I bought was the DS-2CD2055FWD-I.

Hikvision DS-2CD2055FWD-I 5MP Camera

This is a 5MP camera which supports power over ethernet according to the 802.3AF standard but also come with a connector to allow the unit to be powered from a standard 12V wall adapter with a barrel plug. These cameras have an on board micro-SD card slot so can record both internally and to a network drive/DVR.

Because I didn’t have proper POE set up I decided to use a passive POE injector/splitter set from eBay, these are available for a couple of quid and allow power from a barrel connector power adapter to be merged with 100Mbit data onto a standard CAT5e cable. They have limitations but for low power over short distances they’re quite useful and let me keep the power supply safely inside.

Passive POE Injector

These aren’t weatherproof so I suggest if you’re using them tuck them somewhere sheltered or waterproof them. Or just buy a switch with proper POE support!

Ok so once you having network and power to the camera next you need to start configuring it. From a computer attached to the same network you need to install the Hikvision utility SADP which can be downloaded from here:

https://www.hikvision.com/en/Support/Downloads/Tools .

This will scan your network for active cameras and display them in a list. just click the check box on the camera you want to configure and enter a password – make a note of this password – you will need it to make further changes to the camera later on. Then you can set up the IP parameters for the camera. More details on this process can be found here:

SADP Manual

The rest of the camera configuration is generally as per how you want it for your specific use, the interesting bit comes when you try to get it to connect to a network drive as there seem to be a few issues.

Hikvision cameras don’t seem to have a good implementation of network drive access, the main problem being that if presented with a network drive of over a certain size (no-one seems to know what size but it is in the order of 100’s of gigabytes rather than terabytes) the camera fails the initialise the network drive. Creating a network folder with a quota doesn’t work either, windows devices will show the quota limit as the drive space but the Hikvision camera will still show the total volume size. We need to limit it in a more low level way!

The best solution I found under windows was to create a virtual hard disk in the machine you want to be the server. This is done by opening the windows disk management tool and selecting action -> create VHD then you just choose the appropriate size and where you want to save the virtual drive file. If you choose to create a fixed size a file of the full drive size will be created at the chosen location. I created a fixed size VHD of 200 Gb on my storage drive and this seemed to work well but a dynamic would probably work fine. The new drive will be shown in the drive list and should be initialised, right click on the new drive and initialise it as MBR. Do the same again but this time create a new simple volume of the full drive size and format it.

Once the new drive is created it will be shown in windows explorer and look just like any other drive. Next you need to share the drive over the network which in my case involved creating a second account on the server (or whatever PC you’re storing the data to) with limited access to do anything to the PC. Then the new drive is shared under this user account on the network. The username and password are needed to allow the camera to connect so make a note of these.

Next navigate a computer on the network to the IP address you configured for the camera and when prompted log in. Go to the configuration tab and under “advance configuration” select storage. and go to the “NAS” or possible “NET HDD” tab depending on version. Enter the IP address of the server and under file path enter the the network folder you shared earlier but prefix it with a forward slash. For example if you shared the drive under the network name Video then enter “/Video” without the quotes in the box. Mount type will usually be “SMB/CIFS” then username and password as you configured earlier for the user account on the drive.

Not shown in this picture is the “test” button next to the password, click test and hopefully you will get a message telling you testing succeeded.

Next you go across to the “Storage Management” (or possibly “HDD Management”) tab and with any luck the drive you just added will be listed. Click the check box and click format.

Once that completes it now has a network drive to write to!

Other points to note:

The camera will keep as much footage as it can in the space it has but will remove older footage once the space is full. You can have multiple destination drives but the camera will write the most recent data too all of them with the smaller spaces retaining less far back so you can have a camera with say a 16Gb SD card internally and a 200Gb network

5MP footage takes up a lot of storage space so I recommend creating a separate virtual drive for each camera if you spare the space!

You might notice if you use Chrome that you cannot get a preview from the camera – this is due to the camera using old plugins that are no longer compatible but if you search for a Chrome extension called IE Tab and install it adds a new button next to the address bar. Click the new button and go to the camera login again and you should find you get a preview!

There is a guide to get up Hikvision cameras on Synology NAS systems which might also be helpful for other network shares : https://us.hikvision.com/sites/default/files/tb/quick_start_guide_of_hikvision_ip_camera_synology_nas_connection_v1.1_0.pdf

Living with a Scirocco 1.4 TSI 160 (118kW)

So recently I finally decided it was time to retire my previous long suffering car – a 2003 1.4L Mk1 Seat Leon I’ve had for 10 years! When I bought the car in 2009 it had 62,000 miles on the clock, now it has 198,000 miles on it and needs to be run on 10W40 rather than the specified 5W30 just to stop the engine rattling. The Seat did well but it had a hard life including 3 years commuting 400 miles a week and had got to the point where I was fully expecting it to fail sooner or later and wanted something that wasn’t as underpowered.

So I started looking about for another car and the new style Scirocco caught my eye. After looking for a while I found a decent condition version with reasonable mileage, service history and not reaching a high bid. Detail on this car was a little lacking as it was just described as a 1.4 TSI but the car had no engine/spec badges (a factory option from VW) so I wasn’t sure which version it actually was but on the basis it wasn’t advertised as the higher power option it would be the lower power turbo only 122 bhp model. So I went for it and got it for a decent price. When I arrived to collect it having never actually seen it before I checked it and found the identifying sticker in the boot which showed the power as 118kW, this is 160bhp so I’d got the more powerful one.

Image of a 2010 Scirocco
Something like this one.

This is both a blessing and a curse because while obviously it goes better the 160bhp version also have a reputation for unexpectedly experiencing catastrophic engine failure.

That said always take forum posts on the internet with a pinch of salt – people rarely take to the internet as much when their car works perfectly.

By this point its too late to back out so I’m now the owner of a Scirocco with a 1.4L engine! So now I start looking into things I need to watch out for. The engine is the first interesting thing here as it’s both supercharged and turbocharged to give a much better low down grunt than expected from such a small engine with supercharger boost while still having a wider power curve by the turbo taking over at about 3000 rpm and working higher up. The engine peaks out at about 1.5 Bar of boost (22 PSI) from the factory. This system obviously adds complexity and potential points of failure with various valves and clutches to make it all work so a number of things to keep an eye on.

VW Technical guide to this engine available here

Clearly we’re playing with a fairly highly strung engine so my first thought is what the maintenance schedule on these was like. People tend to ignore their cars so long as they keep working and from my previous 1.4 VW engine in my Seat I’m aware they have some issues with oil consumption. On my first look at some of the reports of damage online most seemed to mention failures that could easily be a result of oil starvation. Again, something to keep an eye on.

Moving beyond the engine that car itself is fairly advanced as well. These cars come as standard with adaptive suspension designed to react to road conditions. It has four sports seats which are very comfortable and the boot is quite reasonable for this type of car. Internally the Scirocco is very similar (depending on model year) to either a mark 5 or mark 6 Golf but is a bit less practical due to the style of the vehicle and lower roof line. That said I’ve had four full grown adults in mine and while it’s not hugely roomy it’s comfortable enough.

Now for the the but – I think mine was cheap partly because it has none of the extras. It doesn’t have cruise control, it doesn’t have HID headlights, it doesn’t have the more common 18″ ‘turbine’ wheels (I have the 17″ shown above), no DAB radio and no bluetooth. Other than the twincharged engine its a basic model and for most people that would be all there is to it but that’s not how I work. I will improve it as I go along and hopefully record how I do it all on here!

Solving the DL180 G6 Fan Controller Problem

Some time ago I acquired a DL180-G6 rack mount server for very little money as these go for next to nothing on eBay in most configurations and one version has 12×3.5″ drive bays. Unfortunately there seems to be a bit of a problem with these systems where if you change any of the hardware (such as an unsupported raid card) or a whole variety of other things the on board fan controller defaults to high speed and it will sound like a jet engine. The fans are high flow high speed fans and so while they do work well they really scream at high speeds. Disconnecting the fans won’t help because if you do that the system will refuse to boot entirely.

The Fans

I decided that I needed to come up with a solution to this problem because well…how hard can it be?! Fundamentally these are standard 4 pin PWM type fans which have the following connections:

1 – GND
2 – +12V
3 – Tach
4 – PWM

Unfortunately the ones in the DL180G6 are a special case in that they have 6 pin connectors which follow a slightly different layout:

1 – +12V
2 – GND
3 – Blank
4 – Tach
5 – PWM
6 – Blank

The blank pins on the fan connector may seem a bit pointless at first but they’re like that because the motherboard support redundant pairs of fans in some configurations (I saw this on a Storageworks x1600g2 which shares the same main components). Due to this the motherboard needs a second tach (RPM) signal to monitor the second fan in the redundant pair and presumably due to the high power consumption of these fans a second +12V supply. This means you can either connect a single fan direct to the motherboard or a pair via the splitter which comes in the storage works (HP p/n  534358-001). The motherboard header looks like this:

1 – +12V-1
2 – GND
3 – +12V-2
4 – Tach – 1 (Inlet)
5 – PWM
6 – Tach – 2 (Outlet)

The good news is this means you only need one PWM per pair of fans in this configuration.

Arduino 25kHz PWM

At this point I decided I needed to build something I could fully control and so I decided to try to control it with an Arduino using the on board hardware PWM. This isn’t as easy as it sounds because PWM fans operate on a PWM control frequency of 25kHz which isn’t a standard configurable frequency on an Arduino IDE because it isn’t a direct division of the system clock. Thankfully there is a way round this. Timer 1 on the Arduino nano is a 16 bit timer and by directly manipulating the timer registers we can make the timer reset after a number of cycles so we can basically create a timer of any frequency we need. In this case  rather than being limited to prescalers (divide by 1,8,64,256,1024) from the main clock (16MHz) and 0-255 (0% – 100% duty) by using the 16 bit timer we can set a clock reset every 320 cycles which gives 25kHz at this clock frequency. I found some code which nicely did this on stack exchange and so just went with it.

https://arduino.stackexchange.com/questions/25609/set-pwm-frequency-to-25-khz

The clever bits are shown here:

    // Configure Timer 1 for PWM @ 25 kHz.
    TCCR1A = 0;           // undo the configuration done by...
    TCCR1B = 0;           // ...the Arduino core library
    TCNT1  = 0;           // reset timer
    TCCR1A = _BV(COM1A1)  // non-inverted PWM on ch. A
           | _BV(COM1B1)  // same on ch; B
           | _BV(WGM11);  // mode 10: ph. correct PWM, TOP = ICR1
    TCCR1B = _BV(WGM13)   // ditto
           | _BV(CS10);   // prescaler = 1
    ICR1   = 320;         // TOP = 320
void analogWrite25k(int pin, int value)
{
    switch (pin) {
        case 9:
            OCR1A = value;
            break;
        case 10:
            OCR1B = value;
            break;
        default:
            // no other pin will work
            break;
    }
}

The first bit sets up the timers to run at 25kHz as we need. The second bit is a special analogue write function to make sure we set the time right. We will use this function to update the timer value. We now have two PWM channels on pins 9 and 10 of our Arduino Nano.

Temperature Control

Next up I decided to add temperature control to these fans using a couple old DS18B20 temperature sensors I had lying about. These are good because multiple sensors can be daisy chained to a single data pin and the value doesn’t need scaling or anything unlike an analogue input pin and a thermistor. They cost a little more but for convenience they’re hard to argue with. They usually use +5V, Gnd and one signal pin. The signal pin needs a pullup resistor to work – this is normally specified as 4.7k. Technically these are a “1wire” device which can be run on parasitic power so the +5V isn’t actually required at the device end but if used in parasitic power mode you short it’s Vdd pin to ground. More information can be found here:

https://datasheets.maximintegrated.com/en/ds/DS18B20.pdf

There are specific Arduino libraries for using these devices so they’re really easy to use but they have one issue in this application. To do what I intended and have two separate fan zones we need to know which sensor is which. Thankfully included with the Onewire library is an example function called “DS18x20_Temperature” which will scan for devices on a specified pin. In the example this is called “ds” and it pin 10 by default but for my purposes this won’t work because we specifically need pin 9 and pin 10 for the two PWM outputs so this needs to be relocated somewhere else.

#include <OneWire.h>

// OneWire DS18S20, DS18B20, DS1822 Temperature Example
//
// http://www.pjrc.com/teensy/td_libs_OneWire.html
//
// The DallasTemperature library can do all this work for you!
// http://milesburton.com/Dallas_Temperature_Control_Library

OneWire ds(10); // on pin 10 (a 4.7K resistor is necessary)

void setup(void) {
Serial.begin(9600);
}

The code above isn’t the complete code for this example just an excerpt so you can see yours is the right one – use the one from the library.

Changing the pin to whatever you choose and running the example with serial monitor open you’ll get an output of the devices it finds. If you do this with one device connected at a time you can note down the device address for each. I marked them as #1 and #2 before hand to keep track of these later.

The Circuit

The next bit is bringing it all together electronically. We already looked at the Onewire sensors so these are really easy to connect up, I used two normal 3 pin PC fan connectors to allow these to be disconnectable for easy installation. The next bit is the fans. The PWM on fans are controlled using a pulse signal as described earlier but this isn’t a direct voltage control input. The fans need the PWM pin pulled to ground to control the signal but the output pins on the Arduino aren’t capable of absorbing the current required for direct connection so we need to add a transistor to do this for us. I went for a 2N7000 Mofset for each PWM channel because..well basically I had a bag full of them to hand and they’ll work at the output voltage of the Arduino. These will connect the fan PWM connection to ground when the Arduino output is driven high which unfortunately will reverse our PWM direction but that doesn’t matter because we can flip it back the right way in code. To correctly drive a a mosfet from an arduino you will need a gate drive resistor (to limit inrush to the Mosfet gate capacitance as this could damage the Arduino) and a gate pulldown resistor to make sure the mosfet fully turns off when the Arduino is no driving it. People will suggest all sorts of value for this but I went for a 220Ω for the gate drive and a 10kΩ for the pull down. The capacity of this Mosfet means we can use a single one for a large number of fans.

For simplicity I decided to use another of the eBay 6 pin fan connectors to connect up the cables for the fans. I intend to pass the power and tach signals directly to the motherboard so I’ll come up with a breakout cable to just isolate the PWM signal from the motherboard and allow us to feed in our own. Due to doing this we only actually need 4 pins (+12V, GND, PWM1 and PWM2) running up to the Arduino to control the fan but since I had them anyway why not!

Arduino Nano PWM Fan Breadboard

So this is the result the two connections for the DS18B20’s are on the right and the 6 pins for the fan/motherboard loom in the middle.

The Complete Code

This is where we start to bring everything together:

#include <DallasTemperature.h>
#include <OneWire.h>

// PWM output @ 25 kHz, only on pins 9 and 10.
// Output value should be between 0 and 320, inclusive.

int fanspeed1 = 25;
int fanspeed2 = 25;

float temp1;
float temp2;

#define onewirepin 3
OneWire oneWire(onewirepin);
DallasTemperature sensors(&oneWire);

DeviceAddress TempAdd1 = {0x28, 0x83, 0xC8, 0xE6, 0x3, 0x0, 0x0, 0x15};
DeviceAddress TempAdd2 = {0x28, 0x4A, 0xDE, 0xE6, 0x3, 0x0, 0x0, 0xFC};

void analogWrite25k(int pin, int value)
{
    switch (pin) {
        case 9:
            OCR1A = value;
            break;
        case 10:
            OCR1B = value;
            break;
        default:
            // no other pin will work
            break;
    }
}

void setup()
{

    Serial.begin(9600);    //Start diagnostic serial port
    
    // Configure Timer 1 for PWM @ 25 kHz.
    TCCR1A = 0;           // undo the configuration done by...
    TCCR1B = 0;           // ...the Arduino core library
    TCNT1  = 0;           // reset timer
    TCCR1A = _BV(COM1A1)  // non-inverted PWM on ch. A
           | _BV(COM1B1)  // same on ch; B
           | _BV(WGM11);  // mode 10: ph. correct PWM, TOP = ICR1
    TCCR1B = _BV(WGM13)   // ditto
           | _BV(CS10);   // prescaler = 1
    ICR1   = 320;         // TOP = 320

    // Set the PWM pins as output.
    pinMode( 9, OUTPUT);
    pinMode(10, OUTPUT);

    sensors.begin (); // Initialize the sensor and set resolution level
    sensors.setResolution(TempAdd1, 10);
    delay(1000);
    sensors.setResolution(TempAdd2, 10);
    delay(1000); 
}

void loop()
{

    sensors.requestTemperatures(); // Command all devices on bus to read temperature
    delay(1000);
    temp1 = sensors.getTempC(TempAdd1);             //Read Temp probe 1
    fanspeed1 = constrain(map((int)temp1,20,60,15,100),15,100);   
//Map fan speed for channel 1 to 25% at 30C to 100% at 60C and constrain the values to 25-100% range 
//(prevents fan from either going below 25% or trying to be set to above 100%)
    Serial.print ("Temp 1 is : ");
    Serial.print (temp1);
    Serial.print ("  Speed 1 is : ");
    Serial.println (fanspeed1);
    delay(1000);
    temp2 = sensors.getTempC(TempAdd2);            //Read Temp probe 2
    fanspeed2 = constrain(map((int)temp2,20,75,15,100),10,100);   
//Map fan speed to 25% at 30C to 100% at 75C and constrain the values to 25-100% range
    //(prevents fan from either going below 25% or trying to be set to above 100%)
    Serial.print ("Temp 2 is : ");
    Serial.print (temp2);
    Serial.print ("  Speed 2 is : ");
    Serial.println (fanspeed2);
    delay(1000);
  
    // Update Fan Speeds:
    analogWrite25k( 9, map(fanspeed1,0,100,320,0));         // Scale % fan speed from sensor one to actual PWM value for 25kHz output      
    analogWrite25k(10, map(fanspeed2,0,100,320,0));         // Scale % fan speed from sensor two to actual PWM value for 25kHz output   
    
   
}

Ok, it may not be perfect but it works.  The main bits to note are as follows:

1. The two “DeviceAddress” fields, these are the ID’s for our two DS18B20’s that we identified earlier.

2.  This line – fanspeed1 = constrain(map((int)temp1,20,60,15,100),15,100); which maps a temperature (converted to a float) between 20°C and 60°C to a fan speed of between 15% and 100% which is then constrained to this range so a temperature of 10°C doesn’t cause the fan to be given a 0% demand. You may want to change these constraints to minimise fan noise but I was being cautious and wanted to be sure the fans didn’t even slow down too far that anything overheated or triggered a BIOS warning. You can also tweak the temp vs speed mapping to optimise for a specific volume or temperature.

Map and ConstrainThere is another line like this for fanspeed2 so we can set different scaling ranges for the two sets of fans. You might only need a lower fan speed to maintain a temperature through the raid card area for example.

3. This line : analogWrite25k( 9, map(fanspeed1,0,100,320,0));
It maps our 0-100% fan speed to a value between 320-0 respectively so that we correct the signal inversion caused by using the N channel Mosfet.

The Wiring Loom

This bit is actually really simple but takes ages, buy or borrow a proper crimp tool for fan connectors a soldering iron and a good selection of heat shrink to cover everything up.

With this loom you can actually wire it up to a standard PWM fan controller off eBay or whatever if you just want a quick solution without all the soldering for the breadboard bit since it gives you power, ground and the PWM signals. Just be aware ONLY PWM fan controllers (the 4 pin ones). By doubling up the tach lines you could also take out several fans if that’s what you want so run the tach line from one fan to multiple motherboard headers if thats what you want. Here’s just how to intercept the right signal from the fan headers the way I did it:

DL180G6 Fan Wiring

Here’s what we end up with:

DL180g6 Fan Breakout

The Result

Finished Arduino DL180G6 Fan Controller
As mentioned earlier this will also work with the redundant fan systems because it passes through the tach signal of the second fan in the pair and a single PWM controls both. If doing this be careful, different servers seem to have different fan inputs configured depending on exactly what they are and you need to make sure you connect up to the right ones or the server will error on fan failure. This will probably work OK with other similar servers but can’t guarantee anything so  your mileage may vary. The other good news is that if PWM fans don’t get a PWM signal they default to 100%.

With the settings I have the fans will spin up to 100% briefly as the Arduino powers up but then spin down a few seconds later- this is normal behaviour for these fans. When the system is idling the fans seem to sit at the 15% most of the time occasionally going a little faster and now the power supply is by far the loudest part of the server so I probably wouldn’t bother setting a speed below 15% but the system is drastically quieter overall. You probably still won’t want it in your bedroom but you won’t be able to hear it everywhere in your building any more!

Other developments

When I get a bit more time I’m hoping to wire the Arduino USB connection up to an internal USB header so I can monitor the temperatures and even reprogram it when the server is running to fine tune the settings in operation. Technically its also possible to write a program to monitor CPU load and ramp the fan accordingly but this might just be too much effort.

Hopefully this will help those of you out there who have been having problems with these servers. Good luck

RX8 Project – Part 16, Fitting Piston Cooling Oil Jets

These are something I hadn’t really come across until I started working on this project. While I was researching the work Noble had done developing their twin turbo engines I found the installation of piston cooling oil jets noted as one of the modifications undertaken. On the basis they found it was fine to use the stock pistons but did this mod I started doing research into what exactly they were and why they were used.

The usage of these jets seems to be almost exclusively related to turbocharged engines, both diesel and petrol due to the amount of energy released in these engines. This increased release of energy caused by burning more fuel in pressurised air generates much higher temperatures inside the engine and while the block and head are actively cooled most normal engines rely on incidental oil spray to keep the piston cool. Once you start getting the piston considerably hotter you have a couple options. Either use a piston material which will cope with much higher temperatures without degrading (either due to the temperature affecting the material properties or due to thermal expansion) or somehow cool the piston. Various materials have been used for high performance pistons to help negate the material strength and thermal expansion problems with varying degrees of success but these are generally very expensive made to order parts and well beyond the range of most. This is where the jets come in.

The jet is usually some sort of nozzle drilled into an oil gallery in the block which directs a stream of oil at the underside of each piston. This both cools and lubricates the piston and rod small end/pin.
The original Noble modification is known to have some issues but this was more of a problem with the implementation. Take a look at this : http://noblecars.org/engine.html

The basic problem of the original Noble method is that with such large drillings (probably about 4mm diameter) the cooling will be very effective because the flow rate will be high but the overall engine oil pressure will likely be very low, particularly around the main bearings because that is where they are drilled into the oil supply. Clearly the one place you don’t want low oil pressure!

So me being me I decided to improve on the situation! Firstly I found that most cars that have these fitted (unsurprisingly) use considerably smaller jets, the best example I found was a NASCAR engine using a jet of 0.75mm (I have since tried to find this page again with no luck). Not wanting to risk trying to drill a hole of such a small diameter freehand at the bottom of the cylinder bore from the top I took a slightly different approach and started looking for suitable nozzle inserts that I could use that were available easily and cheap. After a lengthy search trying to find something intended for the purpose (from either a suitable production vehicle or something) I gave up and started just trying to work out what I actually needed and realised that with the rise of home 3D printing small nozzles were actually easy to get – specifically the extruder nozzles used on these printers. These nozzles are usually brass, have an M6 thread and are available in a range of hole sizes, for me the 0.8mm version looked like a good match.

3d printer nozzle

I bought a pack of four nozzles off eBay for a few pounds and decided I should see what sort of spray I actually got from them – I wanted them to produce a fine jet at the normal engine oil pressure rather than a mist as this would assure the oil reached the piston rather than most of it just hitting the inside of the cylinder bore which would achieve nothing. Because I’d decided on the M6 thread it made a test jig quite simple, just a normal M6 nut welded on the end of a bit of 12mm tube. When welding anything threaded it’s a good idea (particularly on smaller threads) to put a suitable mating part in to prevent distortion if you can. In this case I used a standard M6 bolt. After welding the nut the bolt can simply be unscrewed again but if you don’t do this the heat will often distort the thread enough that it is unusable after welding. The 12mm tube just happened to be about right for the nut but also a good size to allow a normal garden hose to fit over it. Water pressure in the UK is nominally about 3 Bar which is at least in about the right area to represent an oil pressure. Also there is the question of viscosity but my logic told me that oil being more viscous than water should not form a mist as easily, so if it worked with water oil should be fine. The test showed a solid jet out to about a meter from the nozzle and beyond that a tight stream of droplets another meter or so. This should certainly be good enough for what I need!

After this test I decided to go for it, so I ordered another set of four nozzles and started trying to work out how to actually machine the block to make them fit. Due to the position the jets need to be installed the oil feeds need to be drilled from the crank bearing housing 60° either side of the centre line to match the cylinder bore angle and also at a slight angle forward or backward (depending on which cylinder it is) so they actually come out into the shoulder at the bottom of the bores rather than just continuing between the cylinders.
First off I marked up the 60° line for each bore so I had something to line the drill up with for the angle and the starting point for the drilling. Next I found a drill bit that nicely fitted into the groove in the bearing housing so as to avoid reducing the supporting area for the bearing which as it turns out is a 3.2mm. This is the area that apparently will crack on the Noble engines – they use a significantly larger drill hole here which breaks into the bearing support lands and I suspect this is part of the issue but that’s purely speculation. There is also no issue with restricting the flow to the jets here because the jets are now significantly smaller than drilling. The next important thing is this involves drilling quite a long, narrow diameter hole through aluminium and that can be quite problematic!

First off let me say this is next bit is a bad idea all round, you either have to be very confident in your abilities with a hand drill or not care if you ruin an engine block. Ideally you want to be both! If not you will want to talk to a machine shop to do this!

Before you start remember to remove the bearing shell itself and put it somewhere safe! Aluminium is a soft material and will stick to drill bits and tend to generate heat due to friction, if it gets hot enough it can actually seize onto the drill bit causing it to break. Firstly a normal length 3.2mm drill won’t be long enough for this job, it will work to an extent but the flutes will eventually be covered by the sides of the drilled hole when you get deeper and there’s nowhere for the chips of aluminium to go. My advice is to buy a long series drill bit and use it. Start the hole with a normal bit because long bits are more flexible and can be harder to get and accurate start with but once you have a dimple that will hold the bit in place swap to the long series. Use plenty of lubricant (go on, guess how I found that out!). You can use WD40 but it can get quite expensive if you have a few holes to do as it tends to vaporise off during cutting. Thicker oils tend to protect the cutting edge more but make cutting slower but in this case aluminium is soft and so drills quickly anyway plus we’re only making a small hole so it will make little difference. Personally I used 3in1 on mine with works well and helps flush the chips out but you will need to reapply the oil to the hole regularly during the process to make sure the drill is well lubricated. You could also use engine oil or even gearbox oil but these would probably slow the process a little more. Go slowly and let the tool do the work, if you push too hard there is a serious risk of flexing the drill bit which at best will give you a hole that wanders and at worst a serious risk of snapping the drill bit.
Once the 3.2mm hole comes through into the shoulder at the bottom of the bore we need to make the M6 nozzle fit, this means tapping a suitable thread into the bore end of the drilling. First clean out all the swarf (drilling debris) from the new hole. At this stage this is just to make sure we get a nice clean thread cut. Now we have the interesting bit, to tap M6 we need a 5mm pilot drill, so we have to drill out the cylinder end of the 3.2mm drilling to 5mm with enough depth for the nozzle to screw in but the only way to do this is to do it from the top of the bore with a really long drill! I went on eBay again and bought and extra long series 5mm drill for the job. This thing is 250mm long and looks absolutely ridiculous in a cordless hand drill.

Extra long Series Drill

It actually looks more like it should be used on masonry but these have the normal tip and are actually for metal. If the one you buy has a flat ceramic insert in the tip you’ve bought the wrong one! 5mm Drill Jet

I suggest you mark the depth you need to drill to accommodate the nozzle thread (with a little extra room for tapping) on the drill bit. The actual depth here isn’t critical as long as there’s enough depth for the nozzle threads at a minimum. Again plenty of lubricant and drill with slow speed and light pressure and be very careful to keep the drill loaded straight otherwise at best your hole will be at a funny angle but at worst you may snap the drill and damage the bore surface.

5mm Drilled hole

Next clean the swarf out again so we can get a good thread tapped. Tapping the holes is another slightly awkward problem for the same reason as drilling the pilot hole, we need to do it from the top of the bore. I suggest going on eBay (or any of a thousand other places online) again and looking for an extra long ratchet tap wrench. These are available under any number of brands but I suspect they’re largely all from the same place. They are available in a small version, which is 250mm long and will tap M3-M10 or a large version which is 300mm long but taps M5-M12. I went for the smaller one because the smaller chuck should allow tapping tighter to the cylinder wall without damaging it and this is likely to be tight for this task. Expect this to be about £10. While you’re at it buy an M6x1 plug (bottoming) tap!

Tapping the Jets

Again proceed slowly with a well lubricated tap, many people will say you need to use proper cutting compound but for a small hole in a soft material this isn’t necessary, 3in1 will be fine. Try to cut forward a bit (maybe a turn at a time or so) and then back the tool off until you feel it turn smoothly. This will help prevent the tap from clogging up and either seizing up or damaging the new thread by material being forced against it. It may be necessary to back the tap out entirely to clean the removed metal from the threads because this is effectively a blind hole. Be careful not to keep going once the tap bottoms out. If you aren’t careful it’s comparatively easy to strip the threads in the aluminium with such a small tap and then it would be awkward to repair. If you’re not confident this really isn’t an ideal job for anyone new to tapping because it relies on having a degree of ‘feel’ about what you need to do and when to stop.

Rinse and repeat five more times and congratulations you now have six neatly drilled and tapped jet positions! Before doing anything else clean everything again, I used a combination of brake clean, compressed air and a scribe. You need to make sure there is no swarf left in the drillings so you don’t risk that jet becoming clogged. Once clean you need to fit the jets. The jets I selected have an external hexagon and so can be tightened up with a socket wrench but you will need sufficient extension to reach the bottom of the cylinder bore with an appropriate sized socket. Clean all the jets with brake clean to degrease them – technically this is not necessary but it helps remove any other grime that has become stuck to the jets in manufacture/transit. Next I recommend you apply a small dab of a suitable thread locker to the jet threads, specifically I went for Loctite 243 which is a medium strength thread locker which will resist oil. You can use others but if you go for anything stronger you’ll need a blowtorch to get it out and trying to do that down a cylinder bore could be interesting! Once you have the dab of Loctite on the jet you need to screw it into the newly tapped hole – I found it easiest to do this carefully from the crank side of the block by fingertip but your mileage may vary! Once you have it in enough to keep it in place tighten it in with the socket wrench. The jets will only need to be nipped up for two important reasons; firstly they are thread locked and so will not vibrate loose and second they are small and made of brass so any more force will likely strip the hex.

Piston Jets Fitted
That’s it, one new set of shiny piston cooling oil jets! More on this project coming soon!

RX8 Project – Part 15, Engine Strip #2

So having removed the timing chain and tensioners (see part 1) next we need to start looking at removing some more major parts of the engine.

Having already removed the cam covers already you should be looking at something like this:

Jag Cams

Thanks to the Jag Motor Project for the image – hopefully they don’t mind me borrowing it! It seems I have misplaced my own photo of this!

You need to remove the cam bearing housings because the design of this engine has the head bolts directly under the cam making it impossible to remove the head with the cams still in place. This is worth remembering and is at least part of the reason stretch bolts are used for the head – it is impossible the re-torque them after an interval of use without removing all the timing gear. As you can see in the photo these are three smaller housings and one larger one at the front each held on with two small bolts. Basically you just need to carefully remove these bearing housings in order. I suggest marking the direction and its position on each one before removal. The position could be achieved by putting each into a small tub which is numbered. However you do this you need to know which is which and which way round they go. Remove them carefully and make sure you don’t drop any bits! Once you have removed the housings you’ll see this:

S-Type V6 Cams Removed

Now we have clear access to the head bolts which as you can see in the photo there are eight of. These are fairly easily removed except for one thing – the bolts are set well down into the head and there is very little room in the recess to put in a socket. You will need a 15mm socket for these bolts and a small breaker bar (or an impact gun) as they will be quite tight.

These bolts are not reusable – I mean you can but it’s a terrible idea particularly in such a critical location because odds are high it will not be up to the job. This is because “stretch” bolts rely on the material of the bolt reaching the yield point of the material at which it begins to exhibit a fairly constant elastic stretch. In effect once they start to deform they behave a bit like a very stiff spring and so if tightened correctly will hold a very accurate load without loosening and so do not need to be re-tightened after a run in period. That said hang onto them for now so you know what to order to replace them!

S-type V6 Head bolt removal

You can see how tight the casting is around the socket! Once all the bolts are gone you can lift the head away. It might take a little persuasion with a mallet. Make sure you have a suitable clear space to put it on once you remove it.

Now you should have this level of grime:

S-type V6 Head removed

Obviously you can just pull off the head gasket now to improve the situation quite a bit and you can have a good look at the state of the engine:

S-type V6 Factory Hone

Here you can see the cylinder bore actually looks in very good condition and even still has the factory honing marks on the bores which is a good sign it’s been working well and shouldn’t have suffered wear issues.

Now do all of that again for the other head and you should have something that looks a bit like this:

S-type V6 Heads Removed

Congratulations now you have an engine with no heads but since my plan was to upgrade the rods I still needed to remove more so flip the engine over and we can get to it.

S-type Oil Pump

In the picture you can see the oil pump is just held on by four small black bolts. I put the crank bolt back in place just so I didn’t lose it but you would have removed this a long time ago. Once the four small bolts are out the oil pump can just be slid off the crank and put aside.

S-type V6 Front Oil Pump Removed

 

Next we need to remove the con rod bolts and this is where having the crank bolt comes in because you can put it back in finger tight and once it snugs up a bit you can turn over the engine to get access to all the rod bolts. Mark up each rod with a cylinder number and arrow for the front of the engine. I put sharpie marks across the split line of the rod to make it easier to match them up later. I had to use something to knock the piston out of the bore use something non metallic otherwise you will likely damage a surface you don’t want to damage. I used a length of wooden dowel. Do these carefully unbolting and removing one at a time. When knocking the piston out don’t forget to catch it before it falls on the floor!

S-Type V6 Oil Pump Removed

So all we have left is the crank. If all you wanted to do was straight swap the rods this is as far as you need to get. Well I wanted to do a few other while I was at it (more on this in another post) so I carried on to remove the crank. This is actually pretty simple at this point, you just take out the 16  main bolts holding the lower block to the upper block along the bearings. The other thing you can see in the picture are the engine mounts, the rubbers here aren’t stock s-type, they’re actually from a V8 Land Rover (Discovery among many others). The reason for this is they’re very strong, extremely cheap (£7 a pair delivered from eBay) and have a stud each side which will fit straight onto the factory cast aluminium mounting arms and also make mounting onto the car really easy when we get to that stage!

S-type V6 Lower Block

It’s worth noting in the above picture not all the bolts are the same. This is because some have small studs on the top to allow the windage plate to be mounted (blue). Note which goes where so this can be put back later! Next you also need to remove the 6 outer bolts (red) before the block will separate.

S-Type V6 Lower Block Bolts

Once all the bolts are out again you might need a gentle tap with a mallet and/or a scraper to get the block apart. Don’t drop the crank bearings!

If you’ve done all of this you should have something a bit like this in front of you:

S-type Stripped 2.5 Block

And a heap of bits you just removed:

S-type Engine Parts

More to come on this project in my next post!

RX8 Project – Part 14, Engine Strip #1

After deciding to turbo the engine (see earlier posts) is became apparent I would have to upgrade the piston rods to make sure the engine wasn’t in danger of these failing and ruining the engine. This meant I needed to extract these from the engine Now bear in mind that this was the first time I’d ever taken the head off and engine before let alone removed a crank so it was likely to be quite a long and delicate process! Also accept that I was making this up as I went along, things may be in a strange order but it seemed to work!

First things first mount the engine to a suitable stand:

Here it is, it’s already upside down but that doesn’t matter! First off I took off the sump. On this engine it’s a cast alloy unit with a large front bulge which makes working around the front of the engine more awkward so I got it out the way early on.

V6 Windage tray

Take off the oil pick up pipe (2xM6 bolts) to get room for the windage tray. The tray is held on by 5 nuts on some special studs on this engine, these are M10 one side to hold the lower block to the upper block but i think M5 on the top just to hold the windage tray.

Duratec V6 Bottom

Now we have exposed the moving parts of the engine and get the first look at the bits we are replacing but there’s a lot more before we get them all out. An interesting thing to note here is the absence of crank bearing caps. On this engine the block is formed in two cast pieces which joint along the crank centre line so the crank bearings are held in place by the substantial cast ribs you can see in the picture and each bearing has four M10 bolts to keep it in place with additional bolts around the outside of the casting.

Next move to the front of the engine and disconnect the hose from the block to  the water pump then unbolt the water pump. On the Ford version of this engine the water pump is driven directly off one of the cams but on this Jaguar one it is a separate unit driven from the back side of the accessory belt and is held on by three small M6 bolts. Next up remove the crank bolt, there are a variety of ways to do this (the easiest probably being a decent impact gun but at this point in the project I’d not yet bought it) but the method I chose was to block the rotation of the crank using a block of wood. This is done by finding a suitable block that fits between the crank and the housing such that as the crank counterweight rotates round it is stopped by the wood. Just remember that the crank bolt undoes anticlockwise so make sure you put the block on the correct side(the bottom in the above image)!

S type V6 front

Now you can flip the engine back up the correct way because we’re moving on to the heads This is because the cam covers need removing to take off the front engine cover.

S-type V6 Black Cam Cover

This bit is again very simple, remove the bolts holding each coil unit in place. Again this being the Jaguar version of the engine is came from the factory with coil on plug. Next remove all the bolts around the cam cover and lift the cover away. Sometimes these get refitted with instant gasket to fix a failed cover gasket cheaply and quickly and so it may require some persuasion, I usually use a putty knife or a wallpaper scraper for this job but it can be easy to damage the faces if you’re not very careful. Alternatively plastic trim removal tools can work well. Obviously repeat the process for the other cover.

Next up we need to remove the front engine cover. This involves removing the bolts all the way round the edge, you can’t miss them, there’s loads and they’re all the same! Make sure you get them all, I think there’s 17 of them but don’t quote me on that, one is under the belt tensioner by the crank! This cover again might require a little help coming away due to the gasket but should be relatively easy. If it isn’t then you’ve missed a bolt so stop prying it!

S-Type V6 No Front Cover

It should look something like this! Now you can see the other feature these jag engines have – variable valve timing on the intake cams. An important point here is the crank timing wheel (the notched wheel on the crank). These have two key positions but only one is correct so carefully mark which position lines up with the key on the crank when you take it off. I recommend something permanent so when you clean all the oil residue off the mark is still visible, a centre punch mark should do it.

Next you need to remove the timing chain tensioners. These are small hydraulic cylinders that use engine oil pressure to maintain tension in the timing chain. They are held on by two bolts each. Just undo the bolts and carefully remove the tensioners from the tension arms.

S-type V6 Timing Tensioner

Once the tension cylinders have been removed the tension arms can be lifted off their dowels and removed as well and then the chains can be lifted off and you should have something that looks a bit like this:

S-type V6 removed tensioner

Now all that is clear the chain runners can be removed. These also hold the VVT solenoids and so are quite a complex bit of metal but are easily removed. I also took of the water hoses at this point just to simplicity.

Now you should be at this stage:

S-type timing gear removed

In the next part the engine strip will continue…