Engine log diagnosis · how it decides
It reads a spreadsheet of numbers from your engine and says what's wrong with the car. The hard part isn't spotting a weird number. It's knowing that almost no number is weird on its own.
alarms from the obvious version of the knock rule, on a real log
from the shipped version, on the same log — correctly, that engine is fine
The one big idea
A heart rate of 150 is an emergency if the kid is asleep, and completely normal if they're haring around the playground. Same number. You cannot judge it until you know what they were doing.
Engines are exactly like this. Suppose the computer is adding 15% extra fuel. If the car is cruising steadily down a motorway, that's alarming — something is wrong. If it's 200 milliseconds after you stamped on the accelerator, it's completely normal, because adding fuel is precisely what the engine is meant to do when you ask it for power.
So the analyser tags every single moment of your drive with one of nine labels: warming up, idling, cruising steadily, pulling hard, coasting downhill, throttle moving, and so on. A rule about steady-state fuelling simply never gets shown the moments where you were stamping on the pedal. Not filtered out later — never shown at all.
The assembly line · six stages, in order
Your log is a spreadsheet: a row every few milliseconds, a column per sensor. A 35-minute drive is about 32,000 rows. Here's what happens to it.
Every logger names things differently — engine speed (RPM),
RPM, ..RPM (RPM) all mean the same thing. Translate
them all into one vocabulary, once, at the door. That way adding support for a
new logger never means touching a single diagnosis rule.
Readings don't arrive on a neat beat, and different sensors update at wildly different speeds — engine speed many times a second, coolant temperature once every ten seconds. Put everything on a steady 5-per-second drumbeat. Then check each sensor is actually alive.
Tag every moment with what the engine was doing. This is the backbone — the thing the whole analysis rests on.
Throw the individual readings away and keep summaries instead: for each situation, the average, the spread, the worst value. Like keeping a report card rather than every homework sheet. A six-hour drive squashes to exactly the same size as a ten-minute one.
Fourteen rules, each one a small self-contained question — "is there a vacuum leak?", "is the thermostat stuck?". Each declares up front which sensors it needs, which situations it's valid in, and how many seconds of evidence it demands. Those three gates are enforced for it, so no rule author can forget one.
One fault often trips three rules. A vacuum leak shows up as a lean mixture, and a lumpy idle, and an idle valve working flat out. Listing three findings invites three repairs. So findings that share a cause collapse into one diagnosis with three pieces of evidence.
The clever bits
Every one of these exists because the naive version got a real log wrong. They aren't polish — each is the difference between a tool a mechanic trusts and one they stop opening.
Your straw has a tiny hole in it. Sipping gently, you get mostly air — the hole ruins it. Sucking as hard as you can, you barely notice. But if the cup is nearly empty, you struggle no matter how hard you suck. Same complaint, and you can tell which is which by whether it gets better when you suck harder.
A split air hose lets in a roughly fixed amount of extra air. At idle the engine is barely breathing, so that leak is a big slice of the total and the computer adds a lot of fuel to compensate. At full throttle the engine is gulping air and the same leak is a rounding error. So the correction fades as you push harder. A fuel supply problem doesn't fade — the engine is short of fuel everywhere.
You can't tell whether a child is unusually short by standing them next to a grown-up. You have to compare them with other children their own age.
This is the 679 versus 0 from the top of the page, and it's the best story in the whole system.
"Knock" is a destructive rattle inside the engine. When it happens, the computer protects the engine by retarding the spark timing. So: spark timing suddenly dropping looks like a great way to detect knock. Write that rule — "timing fell more than 6° while the engine was working hard" — run it on a real log, and it fires 679 times.
All 679 are wrong. Spark timing is supposed to fall as load rises. That's the shape of every ignition map ever designed. Timing going from 20° at light load to 8° at heavy load isn't a fault; it's the computer reading its own table exactly as intended.
It also means the tool ships with no per-car calibration file to maintain, and the baseline is automatically right for your fuel, your altitude and your state of tune.
One long "aaaaaaah" is one scream, not ten. If you counted every half-second of it separately you'd tell everyone the child screamed ten times.
The analyser looks at five readings per second. Something that goes wrong for two seconds therefore shows up in ten consecutive rows. Reporting "10 knock events" would be a flat lie about how often it happened. So anything that keeps matching within a few seconds is merged into one occurrence, keeping the worst value and how long it lasted.
If the thermometer in the empty spare room reads exactly the same number all week, the room isn't broken. Nobody put a thermometer there — you're reading a wire that isn't connected to anything.
On one real log, five inputs sat at a constant voltage because nothing was wired to them. A rule that just looks for wrong values would confidently report five dead sensors on a perfectly healthy car.
So before any diagnosis runs, every sensor is graded: working, missing entirely, never changes, or reading physical nonsense. A rule that needs a sensor which isn't trustworthy is skipped and reported as skipped — never guessed. That skipped list is part of the output, because "I couldn't check this" and "I checked this and it's fine" are completely different sentences.
The same instinct shows up in a subtler place. On one car the throttle reads
0.0% when closed; on another it reads 14.1%. Hardcode either
number and the other car falls apart — with the wrong constant, one 44-minute drive
registered no idling at all, starving every idle-related check of evidence.
So the analyser learns where your throttle rests, from your log, every time.
The output
Every finding carries two separate judgements, because they genuinely are different questions. How bad is it? — shown with the same language as the warning lamps on your dashboard. And separately, how sure are we? An overheat is severe and certain. A misfire guessed from engine-speed wobble is moderate and shaky. Collapsing those into one number is how diagnostic tools become untrustworthy.
Stop driving and fix it. Sustained overheating lands here.
Something is genuinely wrong and it will get worse.
Worth looking into. Most vacuum leaks and fuel trim faults sit here.
A lead, not a fault. Watch it over the next few drives.
A rule that couldn't run, and exactly why — a missing sensor, or too little of the right kind of driving.
And every finding shows the numbers it reasoned from. A diagnosis a mechanic can't verify is a diagnosis they won't trust.
A quiet report does not mean the engine is healthy. It means nothing matched the rules that were able to run.
That's why the "not checked" list is part of the answer rather than hidden away. Without a knock sensor channel, "knock" is only ever "timing looks low for the conditions". Without per-cylinder data, a misfire is only ever a wobble in engine speed. The tool is built to say which of those it's doing — and log more channels and it will tell you more.