Needs a life
Full throttle!
Posts: One MEEEEEELLION
posted September 04, 2006 06:02 AM
Pretty cool stuff. Think about it, you are doing what hypertek, etc., do for automobile ECUs all by yourself. You could, in fact, be hatching the next cottage industry, one that will displace Dynojet's power commander business. After all, if you can reprogram the ECU to account for the new pipe and filter, why bother with a power commander? Want another 500 rpm? No problem? Want a 'wet weather' map for winter? Can do!
____________
82 Gpz750, 84 Ninja 900, 2000 ZX12R (Muzzy Big Bore Kit), *another* 2000 ZX12R (Muzzy custom stroke crank 1341cc motor), 2004 ZZR1200, 2005 ZX10R, 2007 ZX14, 2008 Concours 14, 2014 Versys 650, 2014 Yamaha WR450F, 2015 Ninja H2
posted September 05, 2006 07:54 AM
Edited By: fish_antlers on 3 Dec 2006 18:38
UPDATE:
No good news bad news today, just bad.
In my list of reasons why I believe the ECU is reprogrammable I need to scratch off
quote:The pins listed in the manual as Unused are actually wired to traces including one wired to the Flash Voltage pin of the CPU.
I started tracing the code out from the beginning and after setting up the stack and clearing all the RAM it jumps to a series of subroutines that initialize the CPU modules. The first sets all the ports to Input or Output and loads initial output values. The next initializes all the Timer and Input Capture ports. The third Initializes the Multi-Channel-Communications Interface or MCCI
This CPU has two SCI (serial) ports and one SPI port. All the MCCI pins do double duty as they can be set to act as general purpose IO or as communications pins. For the SCI B port the MCCI initialization subroutine sets a baud rate, sets an interrupt vector, selects the appropriate pins to be serial pins, not IO, and sets the SCI B to wakeup on receive.
This was a pretty exciting find. My next step was to trace down the SCI B RXD pin to the connector. I was guessing it would go to one of the 'Unused' pins as the manual doesn't list the ECU having any pins marked Serial Port Receive.
I traced it from CPU pin 55, to resistor 801. Only problem there is no R801 they didn't stuff it. The other end of R801 goes to D801 a dual diode array, also not stuffed, from there to 826, also missing. In fact a whole bunch of 800 series resistors, diodes, and transistors were not stuffed. If you trace them out they eventually end up at the Unused Pins on the main connector.
When I first found R801 missing I thought maybe I had knocked it off clearing away the potting. But when I looked around I noticed that the vast majority of the unstuffed parts are all 800s. When you design a board it is not uncommon to number parts belonging to a certain function with a certain series. For instance on the ECU all the injector circuitry is 600s, Ignition 700s, Power supply 900s, etc.
The sad thing about the R801, D801 etc circuit is that it looks like a classic RS232 - TTL level converter. A series current limiting resistor followed by two diodes one to 5V the other to ground. RS-232C uses +10V to -10V logic levels. One diode would pull any voltage above 5 down to 5, the other any voltage below 0 up to 0.
The ECU was designed with a serial port that included a Flash Voltage pin but it is now Unused
My test ECU is a later B model. It could be that by 2002 they had enough confidence in the design and units in the field that they decided to save a $1.09 and not stuff the serial parts. Perhaps the 2000 and/or 2001 bikes have the parts installed. A simple test with an ohmmeter on the connector pins would tell if the parts were installed or not. You wouldn't have to open it up. Or maybe it was only used on prototypes and not stuffed on any of the production units.
We aren't out of the ball game yet, but it's definitely strike 2.
Even if the reprogramming is not possible perhaps there are other secrets the ECU has such as this
Also I still haven't figured out what the Memory Input Signals are used for. Perhaps they are used at the factory to tweak the motors. No two motors coming off the assembly line are going to run exactly the same. Maybe we can tweak them post production. If we find out one thing about the ECU we didn't know then I will feel the effort was worth it.
As for reprogramming, well there is always plan B.
I think I have determined what the function of the Input Signal to Memory terminals are for. These terminals are connected to the wire harness and end in a connector under the seat. Some models of the bike require a plug with a jumper be installed for the bike to run correctly.
Last week I traced these lines out and found that two were digital inputs and three were analog inputs. In the previous post I suggested they were used at the factory to tweak the motors. I now have evidence to support that conclusion.
Last month my wife and I went to a small family get together. My Uncle and cousin were there and we spent a lot of time talking about cars. You see they are from the Detroit area and my cousin is a fourth generation autoworker. We were talking about how they adjust the engines via their ECUs on the assembly line the first time they start them up. Of course a little lightbulb went off in my head. They must have to do the same thing to the bike motors with an ECU.
While the ECU has sensors to measure rpm, air pressure, temp, etc. that all is for the engine as a whole. What about minor tolerance differences between cylinders? As anyone who has ever had to sync the carbs on an older bike can tell you no two cylinders flow exactly the same. Of course back then you were adjusting as much for the differences between carbs as you were cylinders but you get the idea.
Some of you may remember that at the beginning of this thread when I first uncovered the board I mentioned I had found an Atmel 93c66 serial eeprom on the board. This is a small 4k bit (512 x 8) memory device usually used on system for storing configuration information or serial numbers etc.
Why if the CPU has its own flash does it need an external serial eeprom? Well one reason is that in order to write to the CPU Flash you must first erase it, all of it. If the power were to glitch during this process the ECU would become a brick. Also you would have to have a complete copy of the code stored somewhere and write it all back just to save one little FI error code. Fine for the garage, but not when you want to record an air sensor error while the bike is screaming down the road at a 100mph
The 93c66 on the other hand allows to you to just write a single byte of data over the top of the existing byte any where in its memory space. And once written you could unplug the ECU from power or remove the bikes battery and plug it in a 100 years later (literally that's what the data sheet says, 100 years retention. Don't ask me how they know) and the data would still be there.
I traced out some of the code for the Input Signal to Memory analog lines and found they end up stored in the 93c66. On startup the ECU checks to see it the 93c66 is blank. If it is the ECU writes a set of default values into it. The default values are written in 4 groups (one per cylinder?) plus a few extra (engine wide?) values. Then all these values are copied to RAM for faster access.
These 93c66 values can be changed via the Input Signal to Memory lines. It appears one of the analog inputs is used as a selector switch. Its value is checked for certain ranges and then a function is performed accordingly. For instance if the value is between 1-20 do this, 21-40 do that. etc. Another analog line is stored in memory. Which location in the 93c66 it ends up in depends on the first value.
It looks like one value picks which cylinder you want to tweak and the next one how much you want to tweak it.
This raises several obvious questions:
Could you 'tweak' it enough to richen it up across all cylinders to adjust for an after market exhaust?
How do the tweak numbers effect the A/F calculations across the RPM range?
Also what is the tweak feedback mechanism? Maybe they just stick some vacuum gauges on it at the factory and tweak it to balance the four cylinders. Maybe they stick a special pipe on it at some engine test stand with an oxygen sensor in each cylinders header pipe.
On one hand these signals could be an inexpensive non invasive means of adjusting the A/F ratio of the ECU. On the other hand it may be useless unless you own the proper test equipment.
On the bright side the ECU also has a Diagnostic output I haven't checked out yet. Perhaps it outputs the current setting of the factory tweak so you could add or subtract a set amount from the factory setting. Then some one with the test equipment could figure out what the best offset is for say a Muzzy pipe and share it with the rest of us.
At this point all I know for sure is that the Input Signal to Memory values are saved in the 93c66 so they will be there forever even if you remove the ECU from the bike.
This also brings up a question about ECU swapping and what happens when you buy a replacement ECU. Do the guys at the local Kawi Shop have a little black box for balancing the engines?
And here is a stupid question. Does the power commander allow you to add an offset to each cylinder to balance them out?
Apparently many of the Suzuki models, which also use a Denso ECU can use a Yoshimura R421 or a Teka SFI box to adjust their air fuel maps. Someone who took one of the boxes apart a traced it out so people could make their own found that it had two digital outputs and three analog channels.
If you compare the schematic and the functional description of the Yosh R421 to what I believe the ZX-12 ECU does with the Input Signals to Memory it looks to me very likely you can use these tuning devices on the ZX-12. That is the conclusion the person who wrote me came to and I agree with him.
posted September 12, 2006 08:55 AM
with all this work you doing would it not be easyier to build from new ecu.. or i live a few miles from motorola i get head flunky drunk and find secret to ecu
____________ http://www.youtube.com/watch?v=S06nIz4scvI
quote:Do you know someone who has already tried using the Yoshbox on a ZX-12r?
Zhooligan traded his PC for a Yoshbox on his 1361. I know he liked it. Multiple Maps, More tuning options, and a hotter system.... Maybe Swft can chime in?
____________
We First make our habits and then our habits make us.
posted September 12, 2006 03:48 PM
I think I may be confusing the issues.
I used the term 'Yosh box' to refer to the the Yoshimura R-421 pictured above which can be used to adjust the injector timing on a stock ECU.
It sounds like you are talking about the aftermarket replacement ECU made by Yoshimura.
I'll try to be more specific in the future.
I guess my question for ninja12 is are you saying that you heard the Suzuki ECUs loose their Yoshimura R-421 settings when removed from power or you heard someone who tried it on a ZX-12r ECU lost his settings when removing power?
posted September 15, 2006 10:47 AM
Edited By: ninja12 on 15 Sep 2006 11:48
quote:Do you know someone who has already tried using the Yoshbox on a ZX-12r?
No, but they use it regularly on suzuki's.
Usually hear busa riders say they add +5+5+5 to their ECU with a pipe.
The one tuner that I know to have used both the Yosh box and PC#
to tune says "HE" like the PC better.
quote:I guess my question for ninja12 is are you saying that you heard the Suzuki ECUs loose their Yoshimura R-421 settings when removed from power or you heard someone who tried it on a ZX-12r ECU lost his settings when removing power?
quote:It sounds like you are talking about the aftermarket replacement ECU made by Yoshimura.
not quite. he's talking about Yosh's version of the PC, the core of which is actually made by dynojet. it is (was?) just a more capable version of the PC.
posted September 18, 2006 09:02 AM
No i was refering to the programmer the the dealers have to "turn up" the ecu.
I have never actually seen the unit but have heard about it for years. So i do believe
it the same unit mentioned above.
Can anyone confirm the changes are lost when power removed?
posted September 18, 2006 09:23 PM
Edited By: ridgeracer on 18 Sep 2006 22:28
UPDATE:
First the Yoshimura box used on the Suzuki's will not work on the ZX-12r. It is similar but differs slightly in function.
The Yosh has two modes, A and B. In A mode you can set the idle mixture for each cylinder and in B mode set the mixture of all cylinders simultaneously for Low, Med, and Hi RPMs.
What I have found so far in the ZX-12r ECU is different There is a lot of code dealing with these Input Signals to Memory lines (ISM). So far more than 12% of the total code and I find more all the time.
I have mapped the 93c66 Serial EEPROM locations. There are 3 groups of 4 values. These are cylinders 1-4 low, 1-4 med, 1-4 hi.
The BR/BK wire is Sensor circuit ground
The BL/W wire is Sensor circuit power (+5V)
COS1 is the ENABLE line when switched to ground
COS2 is the WRITE line when switched to ground
COV1 is mixture setting, any value between 0.5V and 4.5V is valid. A middle setting of 2.5V is 0 change to stock. One side of center is richer, the other side of center leaner, I haven't figured out which way is which yet.
COV2 is Cylinder select:
0.85V < Cylinder A < 1.45V
1.45V < Cylinder B < 2.15V
2.15V < Cylinder C < 2.90V
2.90V < Cylinder D < 3.45V
I call them A-D because I have not actually followed the code to the point I can say that Cylinder A value is associated with injector/coil 1. It could be 4.
COV3 is Lo, Med, Hi Select and ??
This input has six valid settings but they seem to work in pairs. I call them Near, Middle, Far indicating their distance from the center setting of 2.5V
1.60V < Near < 2.20V OR 2.80V < Near < 3.45V
0.95V < Mid < 1.60V -OR- 3.45V < Mid < 4.10V
0.30V < Far < 0.95V - OR- 4.10V < Far < 4.70V
Near appears to be LOW rpm range, Mid medium rpm range, and Far, Hi rpm but I need to confirm that. I also don't know what the bounds of the RPM ranges are.
The other thing I found is that it appears when the ENABLE line is grounded you can use these inputs to tweak the mixture while the bike is running. All these values will remain until you reset the ECU (turn the key off)
If the WRITE line is grounded the current COV1 value (mixture) is written to the Serial EEPROM. Where in the map it is written is determined by the settings of COV2 (Cylinder) and COV3 ( lo/med/hi)
I have to say I would prefer the Suzuki system. Here it appears you have to do everything 4 times, once for each cylinder.
BTW, every time a value is written to the Serial EEPROM a corresponding counter value is incremented and written to the Serial EEPROM. When that value gets to 10,001 you are not allowed to write changes to that mixture value anymore. In other words you only get to push the write button 10,000 times for any particular cylinder / L M H combo.
The quickest way to answer most of the above questions would be to build a box to interface with a bike and try it out. You would quickly learn which is richer and which is leaner. and by putting a scope on the injector which setting was which cylinder.
Of course the biggest question is what am I going to call it. KawiBox? No, to generic. I wish I knew what the CO in COS and COV stood for. CO-Box. Of course if I was the Egomaniacal kind of person Blueford thinks I am I would name it after myself, especially since my last name starts with B.
...for all you tuner guys with a dyno in your garage who are man enough to be the first to try a totally theoretical device on someone else's early model ZX-12r
LEDs D1,D2 and their resistors are optional, but whats a project box without some flashing lights.
I show a 2 pole 6 position rotary switch for SW3 and SW4 because you can get them at radio shack for $3 and thats about 1/4 the price you'll pay for a 1 pole 4 position or a 1 pole 6 position ordered off line.
I forgot to note in the schematic. It will only work if you put it in a Blue project box and slap a Ford sticker on the bottom.
Needs a life
Full throttle!
Posts: One MEEEEEELLION
posted September 21, 2006 07:26 AM
And seriously, congrats and thanks for all your hard work! Have you considered contacting muzzy and seeing if they would be interested in a licensing deal? Ie; you do the manufacture, they resell?
posted September 21, 2006 08:00 AM
Interesting idea, maybe Doug Meyer could hook me up with a name.
Of course It would need a little more work before its a production item. Of course for all I know they've already been following this thread and will come out with one next week
I always found it interesting how similar their Bonneville Box was to the speed derestricter device I came up with and posted on the board back in 2002
The CTS pins are output compare timer pins. In other words you stick a calculated value in the associated data register and it turns the pin on for a certian amount of time. (Injector on duration)
I then went through a whole bunch of code, blah blah blah. and to make a long story short I confirmed that the values changed when the BlueFordBox Cylinder Select knob is turned to 'A' modify the duration of Injector 1
My next task is to trace out the TACH out and crank, cam inputs to figure out how the RPM is derived and then figure out which settings on the box FAR, MID, NEAR are used at which rpms LO, MED, HI (I'm sure we would all like to know exactly what the difference between LO and MED etc. are.)
However my wife talked me into one last camping weekend so don't hold your breath for it.
posted September 26, 2006 08:02 AM
Edited By: fish_antlers on 3 Dec 2006 18:45
UPDATE:
The Tach output is simply toggled every other crank pulse and wasn't very helpful in trying to find the RPM ranges of L,M,H settings on the BlueFordBox.
...and found that the signal is tied to the CPU capture timer CTS6B, pin 8. Every crank pulse generates an interrupt and latches the timer data so that the software knows how long its been since the last pulse. The shorter the time the faster the engine is spinning.
So far I have not been able to link this value to the values that are used to decide wether the hi, med, or lo box data is used. Even when I do find that I will still need to convert the timer number to a real world time value in seconds so I can calculate the rpm.
BTW I saw something strange on the kawasaki parts page. It shows an 8 lobe ignition rotor 21007B, (crank sensor wheel) and a many lobed rotor (21007C). But they only list the part number for the 8 lobe version. I'm only familiar with the 2001 A model. Did they actually change to the hi resolution rotor at some point or do all you guys with B models have 8 lobe rotors?
posted September 26, 2006 05:45 PM
Edited By: fish_antlers on 3 Dec 2006 18:38
The BlueFordBox will adjust the injector pulse by about plus or minus 10% and only in limited RPM ranges.
The rev limiter, timing etc. would require reprogramming the CPU flash. As I stated above the ECUs while having this potential were not manufactured with the needed parts soldered to the board.
Of course if you have been following along closely you may have heard me mention plan B.
The B stands for Breakpoint Debugging Mode port. This is the port I discovered and have been using to read out all the code of the CPU. It could be used to reprogram the Flash in the CPU.
As shown in the photo above it would require cutting a small notch out of the back of the ECU just big enough to solder in a connector plug. The potting would still protect the rest of the board from dirt and moisture just as it does in the front opening of the ECU shell.
People could either do it themselves or send it somewhere and have it done. Once done they would be able reprogram any aspect of the ECU. There would be a small converter box that would connect between the BDM port and the PC.
Obviously the most desireable way to reprogram the ECU would have been through the front connectors. But this is an alternative for the determined tuner. I don't know how many people would actually be interested in this option. But I know of people who have sent their ECUs away to have them drilled into to have a crystal replaced and paid hundreds of dollars for the 'privledge'
As Swft would say someone could set up a nice little business modifying the ECUs and selling the BDM to PC converter box. If it was me I would offer to do a free one to anyone who sent me a version of ECU I hadn't done yet so that I could grab a copy of the code to build up a library.
Plan B.2.9.a would be to open the case just enough to get to the BDM plug, reprogram the ECU so that the end user can use a BlueFordBox like device through existing connectors to save mods into the unused portions of the Serial EEPROM, then reseal the ECU and ship it back to the user. There are over 400 unused bytes of data in that EEPROM that could be set up like the PCIII to add or subtract from the existing map every 500 rpm via the existing wire harness plug under the seat.
posted September 27, 2006 08:56 AM
hot damn that plan B is cool. if you figured out a few current model ECUs you may have a substantial business on your hands. the 12R would be a good test bed, but likely not much of a business.
What ide like to do is program the injector pulse every 250rpm's from idle all the way to the limiter. Also advance the ignition curve 5 degrees as the bike seems to like ignition. Id'e also like to add 1000 rpms to the current rev limiter.. Are you going to be able to solder the ecu flash parts to the board so I can change the ignition rev limiter and timing?
All times are America/Va [ This thread is 39 pages long: 1 - 78910111213 - 10> - 39Next» ]
HOME
NEW TOPIC
posted September 04, 2006 06:02 AM
Edited By: 
