HOME ARTICLES JOIN GALLERY STORE SPONSORS MARKETPLACE CONTACT US  
Register | FAQ | Search | Memberlist
Username:    Password:       Forgot your password?
BIKELAND > FORUMS > ZX12R ZONE.com > Thread: Hacking the Planet one ZX-12 ECU at a time. NEW TOPIC NEW POLL POST REPLY
ridgeracer


Pro
Posts: 1309
posted October 03, 2006 11:10 PM        
It seems you have a misunderstanding of what I proposed with the plan B. The only hardware modification that is needed is to notch the back end of the ECU and add an 8 pin header. This would allow the reprogramming of the ECU.

The user flash needed to hold your injector settings timing and rev limit is already on the board. While the hardware mod is pretty straight forward the software mod is a little more involved. At this point I have probably gone through about 20% of the code. I have identified about 120 variables. I'm fairly confident I know how about half of them are used by the code and have a good guess on the other half, but there are over 2000 memory variables. Likewise I have sussed out the function of several hundred bytes of Map data, those dealing with coolant temp offset, but the map is over 14,000 bytes. I will need to understand it a lot better before I attempt to rewrite it.

I don't know how many of you followed the nitrous coolant resistor thread but I was able to provide some general information about how the ECU handles the water temp input but I could not tell you that a certain temp input adjusted the injector timing by x mS at 5000 RPM. To have that kind of knowledge I need to finish going through the entire code

I'm making steady progress but have a way to go until I know where the rev limit value is in the map or how to change the ignition curve. Given my current progress a conservative estimate to figure out the whole thing would be about 100 hours. If I spend 10 hours a week on it that's 10 weeks. Then more time to test out modifications. I think we are looking at spring 2007 before I have a reprogrammed ECU that anyone could actually install on a bike and use.

The BluefordBox on the other hand is a different story. Someone could build one of those and start using it right now. You could probably figure out all the parameters through trial and error faster than I could going through the code. But I will concentrate on figuring out the BlueFordBox code first.


  Ignore this member    Click here to visit RidgeRacer's homepage. 
blueford


Needs a job
Posts: 2984
posted October 04, 2006 02:30 AM        
Great progress there and thank you for the honor of naming your box after me sweet cheeks.

  Ignore this member   
Ozzy


Needs a job
need guberment cheese
Posts: 3172
posted October 06, 2006 09:11 PM        
Dam, I think RR is far more interested the the challenge of the hunt, then the spoils of success!
  Ignore this member   
ninja12


Needs a job
Posts: 3310
posted October 09, 2006 03:33 AM        
<------info junkie needs a fix.
  Ignore this member   
ridgeracer


Pro
Posts: 1309
posted October 10, 2006 11:59 AM        Edited By: ridgeracer on 10 Oct 2006 20:18
OFF TOPIC:

Sorry Ninja, I spent my discretionary time this weekend on another project. But I do have some info for you.....Don't waste your money on a Mod-Chip for a Sony PSP

http://www.mod-chip.com/en/psp_undiluted_platinum_modchip.php





  Ignore this member    Click here to visit RidgeRacer's homepage. 
ridgeracer


Pro
Posts: 1309
posted October 17, 2006 05:18 AM        Edited By: fish_antlers on 3 Dec 2006 18:50
UPDATE:

I spent several hours this weekend chipping away at the code and found some interesting things, nothing spectacular.

The most interesting thing I found was confirmation of my BlueFordBox (BFB) design methodology.

I traced out the Gear Position inputs and found that they are in fact connected to a voltage divider resistor network inside the ECU similar to the external networks used by the BFB and Yoshbox analog inputs.

Each Gear position input when selected grounds a different value resistor in series with a 1k ohm resistor connected to 5V. This voltage divider is then feed to Analog Input 5 of the CPU. The newer bikes have this resistor network in the external gear position switch.

I searched out all the code using the Analog 5 value to see how the gear position info is used by the ECU. In the process I found the routine that converts the analog value into a gear number 0-6, 0 being neutral. This routine was very similar to those I found when researching the COV inputs of the BFB.

In designing the BFB I guessed that the desired input voltages would be halfway between the range boundaries defined in the software and picked the resistor values accordingly. In the case of the gear position voltage I had the software AND the resistor network values. Using the gear position software I calculated what the gear position resistor values should be using the same method I used in the BFB design. My values were within less than 1% of resistor values actually used inside the ECU.

That gives me confidence that my BFB design is valid even though its design specs were just a guess based on my interpretation of the software.

I also found many different blocks of code that use the Gear position to calculate which MAP data table to use as part of an injector calculation. Again this is raw data and I have not gone thru enough code to tell you exactly how much a particular value effects the final injector pulse but I still find it interesting.

This first chart shows that gear 5 and 6 are treated differently than the other 4



However the next chart shows that 4th gear gets some special compensation the other gears do not.



While the Y axis is MAP data I have no idea if the X axis is RPM, Temp, Air Pressure or ??. Just placing a few more pieces in the puzzle.


  Ignore this member    Click here to visit RidgeRacer's homepage. 
supra5677


Pro
Posts: 1277
posted October 17, 2006 11:24 PM        
WOW!!!
  Ignore this member     
supra5677


Pro
Posts: 1277
posted October 18, 2006 12:45 AM        
does 4th gear get some extra ignition or fuel?
  Ignore this member     
ridgeracer


Pro
Posts: 1309
posted October 18, 2006 02:43 AM        Edited By: fish_antlers on 3 Dec 2006 18:51
I wouldn't even hazard a guess. As I said above this is just a small piece of the puzzle. All I know for a fact is that for any given value of X that Y is derived from a data set that varies by gear. I have found the injector and ignition routines but the calculations used in these routines use dozens of values of which this gear value is just one.

At some point I will have a formula and will be able to tell you exactly how a change in gear, or static pressure, etc changes the ignition or injector timing. But at this point I'm still trying to identify which variables are what ( pressure, temperature, etc).

This weekend I traced out the gears and the speedo signal because of questions in another thread. Awhile back I did the water temp sensor because it was a topic under discussion here. Next weekend who knows. At the end of the day it doesn't really matter what order I put the pieces together.

You seem to be very curious about the timing so maybe I'll look at that next. I've already isolated the code for the crank timing sensor and the camshaft position sensor. To give you an idea of what is involved, here is the Crank Sensor Interrupt service routine; a piece of code run everytime one of those little nubs on the crank timing wheel flies by the sensor.

http://www.olympusnet/personal/mbially/cycleintsrv.pf

Know I know this is greek to most of you but as you look at the code you will see a line like

bset 37h, z, #80

That means set a bit in memory location 37. What does that do? I have no clue. Everywhere in that code you see something like 2AAh, Z or 197h, Z that is a memory location whose function is unknown to me.

Places in the code however where you see lines of code like

ldd CTM_06_SICB, Y ; Crankshaft Sensor Capture timer
or
ldaa zCyl_Count, Z ; Used to calc Tach pulse

those are memory locations I have figured out. As you can see I have a ways to go. That routine is 840 lines out of 30,000 or about 3% of the code in the ECU

BTW at the end of the file is everything I have figured out or 'enumerated' so far. (out of 4096 bytes)

  Ignore this member    Click here to visit RidgeRacer's homepage. 
capt10ed


Expert Class
Posts: 326
posted November 01, 2006 04:48 PM        
I have been watching nthis post with much anticipation....
Would any of you HARD work do anything for us owners of an 04/05?
OR because of the 32 bit processor we are out of luck.




























____________
2014 Loring AFB 14 runs over 200mph
with a best of 208.1 in 1.5 miles
and 204.5 in the mile.

  Ignore this member   
ridgeracer


Pro
Posts: 1309
posted November 01, 2006 10:46 PM        Edited By: ridgeracer on 2 Nov 2006 06:53
Short answer is your out of luck.

I had hoped that if I did find a programming port on the 16 bits that it may have been standardized and carried over into the 32 bits ECUs but things didn't turn out that way. Since we know that kawasaki offers a user programmable version of the 32bit ECUs I would of rather started with one of those, especially since they appear to be the same as the ones used on the -6, -10, and -14, but I guess there aren't as many of those floating around that someone was willing to donate.


BTW I have not updated this in a while because last weekend was my wedding anniversary / Halloween party so I didn't do anywork on the project. I should have an update this weekend tho...

  Ignore this member    Click here to visit RidgeRacer's homepage. 
extremelean


Pro
Posts: 1651
posted November 03, 2006 11:45 AM        
HURRY UP ALREADY!!!!!!!


lmao

anticipation.........



  Ignore this member   
shane661


Needs a life
Posts: 11494
posted November 04, 2006 08:03 AM        
What interests me here is....

I have installed a Muzzy Bonneville Box. I wonder if it makes the ECU think it is in a particular gear all of the time?

  Ignore this member   
ridgeracer


Pro
Posts: 1309
posted November 05, 2006 05:00 AM        
What year is your bike?

The older bikes only require disconnecting the speedo wire from the ecu and connecting a fake periodic signal to the ECU speedo line to prevent the speed restriction. On the old bikes your box is hooked into the Yellow speedo wire.

  Ignore this member    Click here to visit RidgeRacer's homepage. 
supra5677


Pro
Posts: 1277
posted November 05, 2006 06:16 AM        
to RR. I was able to get an ECU for an 05 zx10r. My cousin wrecked it and
didnt need it anymore.. It is the 32bit kind. Can you use it? The Ecu is in
perfect working order..

supra

  Ignore this member     
ridgeracer


Pro
Posts: 1309
posted November 05, 2006 08:29 AM        
When I posted up thread about the 32 bit ECUs I asked myself what am I going to do if someone offers me one? This current project will take months to finish and has already branched into 3 different sub projects:

The Bluefordbox, being able to tweak the injection timing using the existing hardware/software and a cheap little box.

Functional Documentation of the ECU operation. Being able to give detailed answers to questions like what gear gives the most power and why or what water temp gives a 3% increase in fuel.

The BDM mod: being able to reprogram and re-MAP ECUs that have been physically modified by adding a BDM plug.

I am making real although slow progress on these.

However cracking the 32 bits could open up the ECUs of not just one but several different bikes and would be of benefit to a much larger population of owners. Also from what we know so far they are far more likely to be field programmable without modifications.

If I get my hands on one my curiosity will get the better of me and I won't be able to stop from cracking it open to see what is inside and if it looks promising the poor little 16 bit project will be soon forgotten.

So Supra I guess the answer is yes I would love to tear a 32 bit ECU apart. But why don't you hang onto it for awhile. At least until we finish up the BlueFordBox. That way if the 32 bit turns out to be a more valuable project at least we will have accomplished something tangible with the older ECU before shelving it.

  Ignore this member    Click here to visit RidgeRacer's homepage. 
shane661


Needs a life
Posts: 11494
posted November 05, 2006 09:22 AM        
quote:
What year is your bike?

The older bikes only require disconnecting the speedo wire from the ecu and connecting a fake periodic signal to the ECU speedo line to prevent the speed restriction. On the old bikes your box is hooked into the Yellow speedo wire.


Mine is an '02, and that is how I connected the box. I didn't know what the yellow wire did. Thanks.

  Ignore this member   
supra5677


Pro
Posts: 1277
posted November 05, 2006 10:24 AM        
Very good RidgeRacer. I figured as much. I just wanted to let you know
that I had one.BTW I AM GOING to use the Blueford Box on my bike as
soon as you trace the ignition and rev limit codes. So I'll keep it in the
garage until the zx12r 16bit is done....

  Ignore this member     
ridgeracer


Pro
Posts: 1309
posted November 05, 2006 01:49 PM        
UPDATE:

I've traced out all the analog inputs such as Inlet Air Temp, Inlet Air Pressure, TPS, Static Air Pressure, etc. and identified which program variables use their values and which sections of the MAP data are used by each. The routines are starting to become clearer now that the variables are labeled as to what they represent.

A couple of interesting items I found are that the Vehicle Down Sensor is an Analog input. Its threshold value is a MAP data point.

Also the ECU measures the Fuel System (Pump, Injectors) Supply voltage as an analog input and won't let the bike even try to start if the battery voltage is too low.

I'm still waiting for some parts to build a prototype BlueFordBox and I need to do a little more software investigation before I can write up a test plan for it. But it will be interesting to see if it works. The quick and dirty test will be to pick a cylinder and crank the idle mixture all the way to the limits and see if the bike starts running rough. Suppossedly the values arn't written into the ECU unless you press the write button so the bike should revert to normal when you turn it off and restart it.

I need to double check this in the code before I go messing with some poor sucker's, I mean volunteer's bike.

  Ignore this member    Click here to visit RidgeRacer's homepage. 
capt10ed


Expert Class
Posts: 326
posted November 06, 2006 01:32 AM        
Supra5677 send rr the ECU.
I believe he is like a cat!!!
And his curiosity will get the better of him
____________
2014 Loring AFB 14 runs over 200mph
with a best of 208.1 in 1.5 miles
and 204.5 in the mile.

  Ignore this member   
supra5677


Pro
Posts: 1277
posted November 06, 2006 01:36 AM        
No way dude: I want him to finish for all of the 00-03 owners can enjoy the fruits of his hard
work...

  Ignore this member     
ridgeracer


Pro
Posts: 1309
posted November 09, 2006 02:54 PM        Edited By: fish_antlers on 3 Dec 2006 18:51
UPDATE:

I've finished the BlueFordBox prototype except for the final interface plug to the bike. I put a DB9 connector on the box so I could use different interface cables if I need to.





It's a pretty simple device. Just some switches, resistors, and a bunch of wire. I did go hi end on one of the components for the prototype. The Mixture adjustment is a stepped digital readout potentiomenter. Each number increment increases the voltage exactly 0.05V. Its a $24 item that could be replaced with a $2 volume control like knob. But for testing purposes I wanted a very accurate device with repeatable results.

The only hold up now is finding the plug that fits into the stock wire harness. I ordered the end plug from kawasaki in hopes that it would have somekind of mfg markings or part number on it that would help me identify it. No such luck. Second I was hoping that it would have the jumper installed in it so I could get the pin dimensions and make my own pins if necessary. Again no such luck

Any chance any of you recognize this plug and no who makes it or where I could order one from?


  Ignore this member    Click here to visit RidgeRacer's homepage. 
supra5677


Pro
Posts: 1277
posted November 09, 2006 11:15 PM        
ya thats one of the plugs that I think goes to the powercommander
under the tank..Hey 5-0 do you have any plugs like that?

  Ignore this member     
ninja12


Needs a job
Posts: 3310
posted November 10, 2006 02:40 AM        
I'll bet someone on here has an old damaged wire harness.
Who's got one to dedicate to science?

  Ignore this member   
ridgeracer


Pro
Posts: 1309
posted November 10, 2006 03:46 AM        
To be clear this is the mate of a plug in the wire harness. The wire harness has the Female mate to this plug. I bought this Male plug from kawasaki which has no pins and is just intended to plug into the female harness plug to keep it clean and dry.

It may be the wire harness besides having the Femal plug I want to plug into has another 8 terminal male plug that would fit into the Female, but I have no knowledge of that. However if there were any male plugs of the same style I could pull the pins out of them and stick them into the new plug I got from Kawasaki.

  Ignore this member    Click here to visit RidgeRacer's homepage. 
All times are America/Va [ This thread is 39 pages long: 1  -  8  9  10  11  12  13  14  -  10>  -  39   Next» ] < Previous Thread     Next Thread >
Quick Reply:

Email Notification: Send all replies to your email address.
BIKELAND > FORUMS > ZX12R ZONE.com > Thread: Hacking the Planet one ZX-12 ECU at a time. NEW TOPIC NEW POLL POST REPLY

FEATURED NEWS   Bikeland News RSS Feed

HEADLINES   Bikeland News RSS Feed


Copyright 2000-2015 Bikeland Media
Please refer to our terms of service for further information
0.44839787483215 seconds processing time