My Ignition Timing is Retarded, no seriously, it's really screwed up

Question

I logged some test data to try and help me figure out why my 98 Mazda 626 GF 2L ATX has a rough idle and is suffering from hesitation.

(Speed k/h),(TPS_v),(MAF g/sec),(RPM),(SparkAdvance),(EngineLoad),(ST_FuelTrim)

There are a few things standing out to me, regarding spark timing, engine load and fuel trim.

First off, this car has a single ECU controlled ignition coil. Every time I press on the gas ( TPS_v is green ) the ECU retards the spark ( yellow line ), even taking it as late as -10 degrees TDC, i.e. 10 degrees after TDC. Basically, the ECU is retarding my timing by about 20 degrees if I do more than barely tap the gas, before recovering to more reasonable levels after a second or two. In addition, the WSM says spark advance should be between 6 to 18 degrees BTDC at idle. What I'm seeing is that at idle my spark advance seems to be bouncing around a lot, and even going negative sometimes.

I've checked the camshaft and crankshaft timing marks and they're dead on, and I've also check both the cam and crank position sensors and they're both within spec. My cam to lifter clearances are also all in spec, although there are three that seem to be wearing much faster than the others.

The other two things that seem strange to me are that the engine load at idle is around 17.5 - 20%, and that just revving the engine in park shoots it up to about 75%, which is the same amount it shoots up when trying to get going in drive. Additionally, every time I do more than just tap the gas my short term fuel trim shoots up to about 14%. I'm guessing both of these thing are likely connected somehow to the spark retardation I'm seeing.

I'm pretty sure this spark retardation is the source of my rough idle and hesitation. The million dollar question is why the heck is the ECU doing this to my spark timing? The only reason I could think of for it to do this would be overheating and pinging / detonation, but I'm pretty sure I don't have either.

EDIT

Let's assume the problem is with the knock sensor. So what's the nature of that problem? It would seem to me that since the spark timing is being retarded, that the knock sensor must either be giving false positives, OR something else could be generating a noise that sounds like a ping, but really isn't.

Since the ping sensor generates a/c voltage in response to "hearing* a ping, shouldn't I be able to diagnose it by just disconnecting it? As in, if the ECU doesn't get any voltage from the knock sensor, it will just use regular timing?

EDIT2

So I disconnected the knock sensor and the problem stay similar, although seemed a bit milder. However, when testing resistance between the knock sensor connector and ground I got nothing, basically no continuity, when I'm supposed to see 560 Ohms. So I'm guessing when the ECU gets no signal from the knock sensor it goes into some kind of spark advance limp mode. I'll probably see if I can find a sensor from a junk yard and stick it in.

EDIT3

So I went ahead and looked at the O2 sensor like Zaid and Fred wanted and it looks like there is probably a failure there as well. One thing to note, is that I'm only getting about 15 data samples per second, or one every 75 milliseconds.

Basically, the O2 stays pegged to zero volts at idle, yet both LTFT and STFT are also zero. Strange, if the sensor is reading that lean, then the STFT should be way up!

Then I figured I'd see what happens if I rev the engine for a while to see what happens:

(RPMs),(O2S11_v),(STFT)

As I rev the engine at 2300 rpm, the O2 voltage starts slowly climbing, but still with no oscillation! Then, after a few minutes, boom, the engine bucks and I see my STFT spike from zero to 54%. And up flashes a P1131 DTC:

Code: P1131 - Lack of HO2S11 Switch Sensor Indicates Lean

Status: 
 - Pending - malfunction is expected to be confirmed 

Module: On Board Diagnostic II
Diagnostic Trouble Code details
HO2S11 not switching correctly. Sensor indicates lean.
Air leaks at the exhaust manifold

This DTC may be caused by :

Low fuel pressure.
Manifold vacuum leak.
HO2SHTR11 Heater Circuit Malfunction

The Hayens manual says the O2 sensor has to reach 600F degrees before it starts giving a signal. So I figured I'd do another test. I had previously measured the exhaust ports which were all around 300F give or take 50. So I ran the engine at 4k rpm for about nine minutes and then ran out real quick to measure the exhaust temp:

(Closed_Loop),(ECT),(LTFT),(FuelPW),(RPMs),(O2S11_V),(STFT)

So, the exhaust temp got up to 750F, and I figure the increasing voltage is related to that, as the voltage starts dropping as the exhaust starts cooling. But more important is the first PID in that image - Closed_Loop, which never goes from OFF to ON.

EDIT4

So just to be sure it wasn't a wiring or ecu problem so I decided to test the lambda sensor directly with a multimeter. I tested the resistance on the heater element wires and it's exactly at spec at 6 Ohms. I then ran the engine for a few minutes at 4k rpm to heat up the sensor and tested the voltage and it didn't switch at all, just stayed pegged around 0.01 volts.

One thing I noticed is that the engine ran exactly the same with the lambda unplugged as with it plugged in.

EDIT5 - The Lambda was defective

So the O2 sensor was bad, and now my ignition timing is much better. It still seems a bit unstable at idle, but it seems to track RPM much better now and is pretty much constant at higher RPM:

Answer 1

You probably need a new lambda sensor. Here's why:

You're right - the lambda sensor needs to reach a certain operating temperature to function properly. Until it reaches that operating temperature, the engine ECU will assume open-loop operation and not rely on the sensor's signal to determine whether the engine is running rich or lean.

Your tests and data tell me a few things:

• The second graph shows the car running in open loop mode. The voltage output steadily climbs until about 0.1 V (lower limit for normal narrowband O2 sensor output), which is when your DTC kicks in.

  It should not take that long for the sensor to heat up, especially at sustained medium RPM's, which tells me that the heater element inside the O2 sensor is not getting activated.

  You can figure out if the heater element in the O2 sensor has a break in it by using the test outlined in this Q&A.

  If there is continuity, it means the O2 sensor is good and your issue is external to the sensor.

  If there isn't continuity, you need a new O2 sensor.

• The third graph makes me wonder if the O2 sensor is even working as it should; this is what prompted my question about whether the data was logged with the DTC cleared or present. Judging by the lack of STFT variation (in contrast to the first graph where it does change), I'd guess that the DTC was present but can't be sure.

  The thing that surprises me is the very low voltage signal, because the engine coolant temperature shows that the engine is quite warm (which it should be after 9 minutes of running at 4000 RPM), so regardless of the O2 heater malfunction that lambda sensor should be hot and triggering the ECU to run in closed loop (which it clearly isn't).

  A normal narrowband O2 sensor voltage trace should flicker between 0.1 and 0.9 V, which just isn't happening. It is quite plausible that the ECU doesn't trust the voltage it sees from the sensor, forcing it to stay in open loop mode.

• One might wonder where the STFT variation in the first graph comes from since the ECU is not using the O2 sensor output in open loop mode. This isn't something to be surprised about since the ECU can estimate air-fuel ratio using the MAF signal and injector pulsewidth. It's not ideal, but at least it lets the engine run.

• It is far more likely for a lambda sensor to go bad than for a knock sensor to go bad.

---

P.S.

It is too early to say whether the O2 sensor is the only problem here, but you cannot proceed with the diagnosis without addressing it first.

Answer 2

Good example of PID graphing.

Consider the possibility that these symptoms are caused by a mixture issue instead of timing. The STFT is adding fuel and the symptom of hesitation further suggests that the mixture is lean. It is likely that if O2(B1S1) and INJ PID's were included these would show a lean O2 with a corresponding lengthening of injector on time.

For this symptom set I graph the following PIDs: O2b1s1, Inj time, SFFT, LTFT, RPM, Then make a graph from idle, a few seconds of steady cruise then wide open throttle through the 1-2 shift. Study of the resulting graph can usually rule out several possible causes. Given the symptoms and your data that the system is lean, I would look for an intake leak, somewhere between the MAF sensor and the manifold gasket. From past experience the intake manifold gasket is my first test point. I feed a little propane into the intake as a first test, low tech, but easy and it can show mixture problems.

I do not think the timing retard is due to a knock sensor input. The PCM is trying to ignite a very lean mixture; the best time to do that is after the heating of compression is done but before the pressure drops too much. To prevent knock the PCM advances timing to start the fire early which burns much of the fuel before the max pressure/temperature point is reached, leaving little fuel left to explode. Retarding the timing has the spark arrive after the explosion (ping) has already happened, too late to prevent ping. If this remains a concern unplug the knock sensor and retest. The wiring diagram shows a knock sensor for a 2L 626. Testing of knock sensors requires an oscilloscope. It is problematic as pass/fail data is not available.

The LOAD PID is often unreliable when the system is not under a load.