I got a Renault Zoe engine cooler blower (Part No. 290924004R) and want to control it. It has an integrated ECU, 12V power connector and a addtional 3 pin interface. Opening the plastic cover of the ECU just reveals a rubber coated PCB, no chance removing it without breaking something. Measuring the pins against each other and metal parts leads to nothing as well.

First, find polarity: Most car ECUs are kind of reverse polarity protected, so set your PSU to very low current and just try out the polarity. One way just pulls current, the other way around saturated at 40mA. Continue at the right polarity with more current setting, aaand the fan spins up (at full speed)

Second, find control pin: The propability some simple hardware like this uses a LIN oder CAN interface is very low. So I checkt the voltage of the 3 control pins while spinning and found a ~9V level on one of them (the most outside one). Next I took a 1K resistor and pulled the pins to ground. If I connect the one wirh the 9V level, the fan spins down and stops. If I release the pulldown, it spins up again. Nice, found it.

Third, find control frequency: The chance of beeing PWM controlled is pretty hight. We just need to find the frequency the controller is looking for. So I took a Teensy and an optocoupler and smashed a few lines of code on it:

void setup(){
Serial.begin(115200);
analogWriteResolution(8); // 255
analogWriteFrequency(0, 100); // 100 hz
}

// Set PWM frequency: send "F1000" for 1kHz
// Set PWM duty cycle: just send a number like "200"


void loop(){
    int a = read_serial();
    analogWrite(0, a);
}

int read_serial(){
    static int p = 210;
    String z = Serial.readStringUntil('\n');
    if(z.length() > 0){
        if(z[0] == 'F'){
            int f = z.substring(1).toInt();
            Serial.printf("Freq: %i\n", f);
            analogWriteFrequency(0, f);
        } else {
            p = z.toInt();
            Serial.println(p);
        }
    }
    return p;
}

With this I can easily generate a PWM signal with any frequency and duty cycle from serial command line.

Next steps was to try different settings. I additionally hooked my oscilloscope to the PWM input of the fan. This helped to find out the pullup inside the fan controller is to weak for frequencys over 1kHz (it does not reach the high level anymore) so I tried different settings below 1 KHz.

And baam. 100Hz was the only setting I was able to set the speed, all other just let me turn on/off the fan. 210 (of 255) is the lowest setting the fan is spinning, everything above stops it. 0 is the fastest one.

It draws 25W at lowest speed. I was ablet to test it up to 140W, then my 15A PSU limited out. The fan is power controlled, so changing the input voltage does not increase RPM