ridgeracer
Pro
Posts: 1309
|
posted May 20, 2006 08:55 AM
 Edited By: fish_antlers on 3 Dec 2006 17:56
Hacking the Planet one ZX-12 ECU at a time.
As some of you may or may not know it has long been my dream to be able to just plug a laptop into a ZX-12r and remap the ECU. Step one of course is to figure out what is inside the mysterious black box that is the ZX-12R ECU, specifically what kind of CPU does it use.
Well we are one day closer to the promised land today thanks to Supra5677. He was able to obtain a couple of damaged ECUs and get them to me. Yesterday I cracked one open, something I've been wanting to do for years, and discovered what kind of CPU it uses. Not an easy task considering the ECU is potted with epoxy.
The bad news is the part is a proprietary Denso D151851-4410. If you google it you get zero, nada, zip. The good news is that a variant, the D151851-3830, is used in the Suburu WRX ECU and the WRX community has determined that it is actually a Motorola part private labeled by Denso. Also the D151851-0710 is used in RX-7 ECUs
Now all I have to do is uncover more of the board and determine which of the 100+ pins of the CPU go to what on the board and then compare that unique pinout with every CPU datasheet, starting with Motorola parts, until I find a match. (Yes I have too much time on my hands.)
BTW if any of you have any super internet search skills beyond those of us mere mortals and think you can find out more about the D151851-4410 than I did feel free to show off and share with the group.
The chewey center of a ZX-12 ECU
After 5 hours of attacking it with assorted dremel tool attachments...
BTW the shinny can near the edge is a 4 MHz crystal. Another clue.
And the winner is....
   
|
fish_antlers
Administrator
The Truth is Out There
Posts: 21871
|
posted May 20, 2006 09:27 AM
 ... this is gonna be good!
very cool!
____________
What business is it of yours where I'm from, Friendo?
|
CrotchRocket
Moderator
Bracket Racing with Betsy
Posts: 8038
|
posted May 20, 2006 10:39 AM
HMMM...I wonder what a Hi-Performance modified ZX12 ECU will actually do for the 12???
____________
Jason Miller StreetBike Seminars
*****DragRacers do it better, because they dont cut Corners*****
|
droid
Expert Class
Posts: 133
|
posted May 20, 2006 11:05 AM
http://www.openecu.org
|
Wideout
Expert Class
Posts: 300
|
posted May 20, 2006 11:20 AM
Nice job droid. I couldn't find anything using conventional search engines.
The number is referenced on this thread:
http://forums.openecu.org/viewtopic.php?t=5&highlight=d1518514410
A portion of it (D151851) is referenced here:
http://forums.openecu.org/viewtopic.php?t=555&highlight=d151851
Not whole lot of info out there...
Anything else that we can search on?
|
blitzkrieg
Needs a job
Road kill = Free lunch.
Posts: 2044
|
posted May 20, 2006 11:45 AM
Edited By: blitzkrieg on 20 May 2006 12:47
Cool thread RR. 
The only thing I know about the 12 ECU is
1) it's a 16 bit processor and that's second hand info.
2) There are two A1 ECU's. Mine is an original Denver bike and has the high Altitude ECU installed after delivery by the dealer.
I was testing an ECU out for a friend that lives in Oklahoma a few years back and my bike even sounded different with the low altitude ECU. Not as "punchy" for lack of better description.
Edit: Also - hopefully FIVE 0 will chime in on this thread. He's into circle track racing (using 12 motors) and has bought and sold more 12 parts than I'll ever see so he may have some insight on the subject.
____________
"BTW....You need to get a girlfriend who's last name isn't .jpg"
|
supra5677
Pro
Posts: 1279
|
posted May 20, 2006 04:55 PM
Five supplied the ecu's
|
osti33
Needs a job
Posts: 2973
|
posted May 20, 2006 05:15 PM
Good stuff! Keep us posted RR.
|
swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted May 20, 2006 07:35 PM
If it's a rebadged Motorola, it's prolly an mc68K imbedded variant. If you had an EXORMACS development box would be easy to get in and pull the code down. When you get the entire board cleaned off, will be interesting to see if there's a programming port.
|
ZXLNT
Needs a job
Kawpuke Extraordinare
Posts: 2853
|
posted May 20, 2006 09:36 PM
Awesome. I would love another 1000 revs on my 1270...
|
aughtsix
Expert Class
Posts: 277
|
posted May 20, 2006 10:31 PM
Sometimes you guys just blow my mind...
:thumbsup
|
aughtsix
Expert Class
Posts: 277
|
posted May 20, 2006 10:33 PM
Wait, let's try this again...
|
ridgeracer
Pro
Posts: 1309
|
posted May 21, 2006 05:50 AM
Edited By: fish_antlers on 3 Dec 2006 17:56
Well given that it is a 132 pin PQFP package that kind of narrows it down, if it is a motorola, to the following;
MC68HC16Z1
MC68HC16Z3
MC68331
MC68332
The first two are 16 bit, the last two are 32 bit. Blitz says he heard it was a 16 bit but swft could be right too.
As for a programming port there is an 8 line unstuffed connector labeled CN3 near the cpu. It could very likely be a pre-production board development and testing port they don't stuff for production. Also remember according to the Kawi shop manual the main external connectors have 5 lines labled INPUT to memory and 16 'unused' lines. Be interesting to trace those and see where they go.
The interesting thing is none of the above parts has any onboard flash ROM. The Z3 has 8K of mask ROM but I really can't believe they would use that on a product like a bike ecu. All if have found on the top side is an ATMEL 93c66 512x8 serial eeprom. This small amount of memory is probably used for saving things like the accumulated FI error codes etc.
So time to do the bottom of the board. So far I have left the bottom outer case plastic intact to provide a flat plane to aid in milling the potting off the board. I'll have to do the rest holding it in my hand. On the other hand its not very thick and I dont expect to find any driver transistors sticking out.
If, as I expect, I do find a large parallel Flash memory chip on the bottom I may just cut it off the board and install it in another platform and read the code out of it that way. The outer case of the ECU Im working on was pretty smashed up and there is some damage on the smashed side of the board so I doubt it is still functional.
By the way in the picture you may notice the black still around the CPU. Well in addition to potting the whole board in a substance with the consistency of a pencil eraser, they also used a very hard epoxy to glue the CPU to the board. Bastards.
|
supra5677
Pro
Posts: 1279
|
posted May 21, 2006 07:06 AM
The later 04/05 zx12r have 32bit ecu's. I head the earlier models were 16 bit. But DO NOT quote me on this..
supra
|
ridgeracer
Pro
Posts: 1309
|
posted May 21, 2006 07:31 AM
If you look at the ECU part numbers
year ecu
2000 21175-1069
2001 21175-1079
2002 21175-1089
2003 21175-1089
2004 21175-0038
2005 21175-0038
It does appear they made a major change in the part number series between 2003 and 2004
|
ridgeracer
Pro
Posts: 1309
|
posted May 21, 2006 07:44 AM
Also if you look at the 10r and 6r ECUs they are also low number parts;
2003 6r 21175-0001 ( first year of FI for that bike )
10r 21175-0029
I would be willing to bet they came out with a newer 32 bit design for the 6r, 10r and migrated it to the ZX-12 starting in 2004
|
blubyu
Expert Class
Posts: 209
|
posted May 21, 2006 07:55 AM
32 bit processor faster? If so, if the code is cracked, can it be reprogrammed to use on 02 models?
|
MadMike
Moderator
FEAR THE BLACK FLAG!!!!!!!!
Posts: 6579
|
posted May 21, 2006 12:41 PM
All right !!! way to go!!
great Job RR!!
____________
200-MPH CLUB MEMBER!
|
Wideout
Expert Class
Posts: 300
|
posted May 21, 2006 01:21 PM
The motorola driven boards I've been exposed to, do use either eprom (or eeprom) or flash to store the actual programming code. When the system is booted up, the code is then transferred from eprom to a ram (or dram)...and then runs the code from ram. I've only seen one motorola system that's stores its code in flash and actually runs from flash...it has been done though. No hint of ram on that pic that I see. My exposure to motorola is not with ecus.
Great investigating. Do you see any jumpers anywhere?
|
Wideout
Expert Class
Posts: 300
|
posted May 21, 2006 01:32 PM
From my exposure, I'd speculate that your config (or settings) is more than likely saved and stored in some sort of nvram (non volatile ram).
|
ridgeracer
Pro
Posts: 1309
|
posted May 21, 2006 03:27 PM
Edited By: fish_antlers on 3 Dec 2006 17:57
Great news!!
I am 99% sure the CPU is an MC68HC916R1 (with 48K of internal Flash EEPROM). I successfully matched all the power and ground pins as well as the crystal pins, a very unique timing circuit external bypass cap and, best of all, the Development Serial Interface pins (DSO,DSI,DSCLK) which go to the unstuffed connector CN3. This means if I can fire it up I should be able to pull out the code.
This does not prove that you can reprogram it from the main plugs but it means we get to go on to the next level. The next priority is to trace out the VFPE1 and VFPE2 pins. These require special voltages to allow programming/erasing the flash. If they are not somehow controlled from the external pins then no reprogramming from outside the ECU box will be possible.
For those of you are interested, or want to help, here is the user manual link
http://www.freescale.com/files/microcontrollers/doc/user_guide/MC68HC16R1UM.pdf
While things look encouraging now I need to remind everyone that at anytime I may find out something that will bring this project crashing into a brick wall.
For now though I have to take a break. I've been working on this since Friday and have been neglecting my other responsibilities, one of the benefits of being self employed, but now its time to play catch up.
I do need something to continue. My kawi 2001 shop manual only covers A1s and A2s. I need to know if the 2002 / 2003 models have the same ECU main connector pin out as the A2 and if not I need someone to send me a copy of the pin assignments. Thanks in advance.
Oh and maybe someone can answer this question. If you change out your ECU with a new one does your odometer reset? In other words is the electronic mileage info stored in the instrument cluster or in the ECU?
Here is a pic of the back side of the board.
Here is a pinout of the cpu pinout. The pins I verified are blacked out. Why post it? Cause I'm felling pretty proud of myself right now 
|
BROOKLYNNYZX12
Zone Head
Posts: 514
|
posted May 21, 2006 03:42 PM
Amazing...
____________
Orient Express Top Street Bike Winner 8-4-07
|
tuusinii
Pro
Posts: 1030
|
posted May 21, 2006 03:42 PM
If I don't remember wrong I recall reading from the service manual that if Your total mileage goes over 199k You'll need to buy a new cluster to make it go back to 0. So that would implicate that the mileage is in the speedometer cluster. And at least on the A1 model where there isn't speed limit there isin't any wires to bring the speedsensor signal to the ECU so it can't be there.
|
tuusinii
Pro
Posts: 1030
|
posted May 21, 2006 03:51 PM
And know I remembered the definitive answer to the mileage question is no. Because I also got the high altitude ECU and nothing than the driveability changed...
|
ridgeracer
Pro
Posts: 1309
|
posted May 21, 2006 03:54 PM
Edited By: fish_antlers on 3 Dec 2006 17:57
Thanks for the info on the mileage.
By the way for the do it yourselfers out there who are wondering....
Drill Press
Lots of Dremel Tool Wire brushes
Shop Vac is optional though recommended.
|
|
|
HOME
NEW TOPIC