HOME ARTICLES JOIN GALLERY STORE SPONSORS MARKETPLACE CONTACT US  
Register | FAQ | Search | Memberlist
Username:    Password:       Forgot your password?
BIKELAND > FORUMS > ZX12R ZONE.com > Thread: Hacking the Planet one ZX-12 ECU at a time. NEW TOPIC NEW POLL POST REPLY
ridgeracer


Pro
Posts: 1309
posted May 20, 2006 02:55 AM        Edited By: fish_antlers on 3 Dec 2006 17:56
Hacking the Planet one ZX-12 ECU at a time.

As some of you may or may not know it has long been my dream to be able to just plug a laptop into a ZX-12r and remap the ECU. Step one of course is to figure out what is inside the mysterious black box that is the ZX-12R ECU, specifically what kind of CPU does it use.

Well we are one day closer to the promised land today thanks to Supra5677. He was able to obtain a couple of damaged ECUs and get them to me. Yesterday I cracked one open, something I've been wanting to do for years, and discovered what kind of CPU it uses. Not an easy task considering the ECU is potted with epoxy.

The bad news is the part is a proprietary Denso D151851-4410. If you google it you get zero, nada, zip. The good news is that a variant, the D151851-3830, is used in the Suburu WRX ECU and the WRX community has determined that it is actually a Motorola part private labeled by Denso. Also the D151851-0710 is used in RX-7 ECUs

Now all I have to do is uncover more of the board and determine which of the 100+ pins of the CPU go to what on the board and then compare that unique pinout with every CPU datasheet, starting with Motorola parts, until I find a match. (Yes I have too much time on my hands.)

BTW if any of you have any super internet search skills beyond those of us mere mortals and think you can find out more about the D151851-4410 than I did feel free to show off and share with the group.

The chewey center of a ZX-12 ECU



After 5 hours of attacking it with assorted dremel tool attachments...



BTW the shinny can near the edge is a 4 MHz crystal. Another clue.

And the winner is....


  Ignore this member    Click here to visit RidgeRacer's homepage. 
fish_antlers


Administrator
The Truth is Out There
Posts: 21762
posted May 20, 2006 03:27 AM        
... this is gonna be good!

very cool!
____________
What business is it of yours where I'm from, Friendo?


  Ignore this member    Click here to visit fish_antlers's homepage. 
CrotchRocket


Moderator
Bracket Racing with Betsy
Posts: 8038
posted May 20, 2006 04:39 AM        
HMMM...I wonder what a Hi-Performance modified ZX12 ECU will actually do for the 12???
____________
Jason Miller StreetBike Seminars

*****DragRacers do it better, because they dont cut Corners*****

  Ignore this member    Click here to visit CrotchRocket's homepage. 
droid


Expert Class
Posts: 133
posted May 20, 2006 05:05 AM        
http://www.openecu.org
  Ignore this member   
Wideout


Expert Class
Posts: 300
posted May 20, 2006 05:20 AM        
Nice job droid. I couldn't find anything using conventional search engines.

The number is referenced on this thread:
http://forums.openecu.org/viewtopic.php?t=5&highlight=d1518514410

A portion of it (D151851) is referenced here:
http://forums.openecu.org/viewtopic.php?t=555&highlight=d151851

Not whole lot of info out there...

Anything else that we can search on?


  Ignore this member   
blitzkrieg


Needs a job
Road kill = Free lunch.
Posts: 2044
posted May 20, 2006 05:45 AM        Edited By: blitzkrieg on 20 May 2006 12:47
Cool thread RR.

The only thing I know about the 12 ECU is

1) it's a 16 bit processor and that's second hand info.
2) There are two A1 ECU's. Mine is an original Denver bike and has the high Altitude ECU installed after delivery by the dealer.

I was testing an ECU out for a friend that lives in Oklahoma a few years back and my bike even sounded different with the low altitude ECU. Not as "punchy" for lack of better description.

Edit: Also - hopefully FIVE 0 will chime in on this thread. He's into circle track racing (using 12 motors) and has bought and sold more 12 parts than I'll ever see so he may have some insight on the subject.
____________
"BTW....You need to get a girlfriend who's last name isn't .jpg"

  Ignore this member   
supra5677


Pro
Posts: 1277
posted May 20, 2006 10:55 AM        
Five supplied the ecu's
  Ignore this member     
osti33


Needs a job
Posts: 2973
posted May 20, 2006 11:15 AM        
Good stuff! Keep us posted RR.
  Ignore this member   
swft


Needs a life
Full throttle!
Posts: One MEEEEEELLION
posted May 20, 2006 01:35 PM        
If it's a rebadged Motorola, it's prolly an mc68K imbedded variant. If you had an EXORMACS development box would be easy to get in and pull the code down. When you get the entire board cleaned off, will be interesting to see if there's a programming port.

  Ignore this member   
ZXLNT


Needs a job
Kawpuke Extraordinare
Posts: 2851
posted May 20, 2006 03:36 PM        
Awesome. I would love another 1000 revs on my 1270...
  Ignore this member   
aughtsix


Expert Class
Posts: 277
posted May 20, 2006 04:31 PM        
Sometimes you guys just blow my mind...

:thumbsup

  Ignore this member   
aughtsix


Expert Class
Posts: 277
posted May 20, 2006 04:33 PM        
Wait, let's try this again...


  Ignore this member   
ridgeracer


Pro
Posts: 1309
posted May 20, 2006 11:50 PM        Edited By: fish_antlers on 3 Dec 2006 17:56
Well given that it is a 132 pin PQFP package that kind of narrows it down, if it is a motorola, to the following;

MC68HC16Z1
MC68HC16Z3

MC68331
MC68332

The first two are 16 bit, the last two are 32 bit. Blitz says he heard it was a 16 bit but swft could be right too.

As for a programming port there is an 8 line unstuffed connector labeled CN3 near the cpu. It could very likely be a pre-production board development and testing port they don't stuff for production. Also remember according to the Kawi shop manual the main external connectors have 5 lines labled INPUT to memory and 16 'unused' lines. Be interesting to trace those and see where they go.

The interesting thing is none of the above parts has any onboard flash ROM. The Z3 has 8K of mask ROM but I really can't believe they would use that on a product like a bike ecu. All if have found on the top side is an ATMEL 93c66 512x8 serial eeprom. This small amount of memory is probably used for saving things like the accumulated FI error codes etc.

So time to do the bottom of the board. So far I have left the bottom outer case plastic intact to provide a flat plane to aid in milling the potting off the board. I'll have to do the rest holding it in my hand. On the other hand its not very thick and I dont expect to find any driver transistors sticking out.

If, as I expect, I do find a large parallel Flash memory chip on the bottom I may just cut it off the board and install it in another platform and read the code out of it that way. The outer case of the ECU Im working on was pretty smashed up and there is some damage on the smashed side of the board so I doubt it is still functional.

By the way in the picture you may notice the black still around the CPU. Well in addition to potting the whole board in a substance with the consistency of a pencil eraser, they also used a very hard epoxy to glue the CPU to the board. Bastards.


  Ignore this member    Click here to visit RidgeRacer's homepage. 
supra5677


Pro
Posts: 1277
posted May 21, 2006 01:06 AM        
The later 04/05 zx12r have 32bit ecu's. I head the earlier models were 16 bit. But DO NOT quote me on this..

supra

  Ignore this member     
ridgeracer


Pro
Posts: 1309
posted May 21, 2006 01:31 AM        
If you look at the ECU part numbers

year ecu
2000 21175-1069
2001 21175-1079
2002 21175-1089
2003 21175-1089

2004 21175-0038
2005 21175-0038

It does appear they made a major change in the part number series between 2003 and 2004

  Ignore this member    Click here to visit RidgeRacer's homepage. 
ridgeracer


Pro
Posts: 1309
posted May 21, 2006 01:44 AM        
Also if you look at the 10r and 6r ECUs they are also low number parts;

2003 6r 21175-0001 ( first year of FI for that bike )
10r 21175-0029

I would be willing to bet they came out with a newer 32 bit design for the 6r, 10r and migrated it to the ZX-12 starting in 2004

  Ignore this member    Click here to visit RidgeRacer's homepage. 
blubyu


Expert Class
Posts: 209
posted May 21, 2006 01:55 AM        
32 bit processor faster? If so, if the code is cracked, can it be reprogrammed to use on 02 models?
  Ignore this member   
MadMike


Moderator
FEAR THE BLACK FLAG!!!!!!!!
Posts: 6572
posted May 21, 2006 06:41 AM        
All right !!! way to go!!
great Job RR!!

____________
200-MPH CLUB MEMBER!

  Ignore this member    Click here to visit MadMike's homepage. 
Wideout


Expert Class
Posts: 300
posted May 21, 2006 07:21 AM        
The motorola driven boards I've been exposed to, do use either eprom (or eeprom) or flash to store the actual programming code. When the system is booted up, the code is then transferred from eprom to a ram (or dram)...and then runs the code from ram. I've only seen one motorola system that's stores its code in flash and actually runs from flash...it has been done though. No hint of ram on that pic that I see. My exposure to motorola is not with ecus.

Great investigating. Do you see any jumpers anywhere?

  Ignore this member   
Wideout


Expert Class
Posts: 300
posted May 21, 2006 07:32 AM        
From my exposure, I'd speculate that your config (or settings) is more than likely saved and stored in some sort of nvram (non volatile ram).
  Ignore this member   
ridgeracer


Pro
Posts: 1309
posted May 21, 2006 09:27 AM        Edited By: fish_antlers on 3 Dec 2006 17:57
Great news!!

I am 99% sure the CPU is an MC68HC916R1 (with 48K of internal Flash EEPROM). I successfully matched all the power and ground pins as well as the crystal pins, a very unique timing circuit external bypass cap and, best of all, the Development Serial Interface pins (DSO,DSI,DSCLK) which go to the unstuffed connector CN3. This means if I can fire it up I should be able to pull out the code.

This does not prove that you can reprogram it from the main plugs but it means we get to go on to the next level. The next priority is to trace out the VFPE1 and VFPE2 pins. These require special voltages to allow programming/erasing the flash. If they are not somehow controlled from the external pins then no reprogramming from outside the ECU box will be possible.

For those of you are interested, or want to help, here is the user manual link

http://www.freescale.com/files/microcontrollers/doc/user_guide/MC68HC16R1UM.pdf

While things look encouraging now I need to remind everyone that at anytime I may find out something that will bring this project crashing into a brick wall.

For now though I have to take a break. I've been working on this since Friday and have been neglecting my other responsibilities, one of the benefits of being self employed, but now its time to play catch up.

I do need something to continue. My kawi 2001 shop manual only covers A1s and A2s. I need to know if the 2002 / 2003 models have the same ECU main connector pin out as the A2 and if not I need someone to send me a copy of the pin assignments. Thanks in advance.

Oh and maybe someone can answer this question. If you change out your ECU with a new one does your odometer reset? In other words is the electronic mileage info stored in the instrument cluster or in the ECU?

Here is a pic of the back side of the board.



Here is a pinout of the cpu pinout. The pins I verified are blacked out. Why post it? Cause I'm felling pretty proud of myself right now



  Ignore this member    Click here to visit RidgeRacer's homepage. 
BROOKLYNNYZX12


Zone Head
Posts: 514
posted May 21, 2006 09:42 AM        
Amazing...
____________
Orient Express Top Street Bike Winner 8-4-07

  Ignore this member   
tuusinii


Pro
Posts: 1016
posted May 21, 2006 09:42 AM        
If I don't remember wrong I recall reading from the service manual that if Your total mileage goes over 199k You'll need to buy a new cluster to make it go back to 0. So that would implicate that the mileage is in the speedometer cluster. And at least on the A1 model where there isn't speed limit there isin't any wires to bring the speedsensor signal to the ECU so it can't be there.
  Ignore this member    Click here to visit tuusinii's homepage. 
tuusinii


Pro
Posts: 1016
posted May 21, 2006 09:51 AM        
And know I remembered the definitive answer to the mileage question is no. Because I also got the high altitude ECU and nothing than the driveability changed...
  Ignore this member    Click here to visit tuusinii's homepage. 
ridgeracer


Pro
Posts: 1309
posted May 21, 2006 09:54 AM        Edited By: fish_antlers on 3 Dec 2006 17:57
Thanks for the info on the mileage.

By the way for the do it yourselfers out there who are wondering....

Drill Press

Lots of Dremel Tool Wire brushes





Shop Vac is optional though recommended.

  Ignore this member    Click here to visit RidgeRacer's homepage. 
All times are America/Va [ This thread is 39 pages long: 1  2  3  4  5  6  7  8  9  -  10>  -  39   Next» ] < Previous Thread     Next Thread >
Quick Reply:

Email Notification: Send all replies to your email address.
BIKELAND > FORUMS > ZX12R ZONE.com > Thread: Hacking the Planet one ZX-12 ECU at a time. NEW TOPIC NEW POLL POST REPLY

FEATURED NEWS   Bikeland News RSS Feed

HEADLINES   Bikeland News RSS Feed


Copyright 2000-2015 Bikeland Media
Please refer to our terms of service for further information
0.46435904502869 seconds processing time