ridgeracer
Pro
Posts: 1309
|
posted June 14, 2007 08:55 AM
Freek: Supra was nice enough to get me a copy of the Prog16z software and I will be getting the BDM hardware FedEx today so I should know by the end of this weekend if this scheme is going to work or not.
If it does you understand that you will need to "notch" the ECU and install a plug before you can reprogram it? Were you planning on doing that yourself or ???
I've never notched an A1 but I have a U.K. -A1 sitting here on my desk (21175-1065). It has the two large connectors, not the one large one small of the later ECUs. This is a brand new out of the box unit that I don't think has ever been even used on a bike. At first I was thinking I would notch it to make sure the early ECUs have the same BDM port in the same place as the later ones.
The thought occurred to me that if you were planning to send me your ECU to notch and you didn't want to have your bike unusable I could send you this one to use while I work on yours. That is if your willing to try out this ECU. Who knows maybe your bike will run better with the U.K. version.
   
|
ridgeracer
Pro
Posts: 1309
|
posted June 14, 2007 10:43 AM
 Edited By: ridgeracer on 14 Jun 2007 11:45
OK, maybe I don't have an A1 for you to borrow freek....
All the ECUs I've done so far have looked like this;
So I started in on my UK -A1 and got an unpleasant suprise;
As you can see I cut into the board and across about a dozen traces and since its a 4 layer board god only knows what I did to traces in the internal layers. The good news however is that it does have a BDM connector, just in a different place. Well better mine than yours hey freek? I will finish exposing the board edge and post pics on the connector location later.
On the brighter side while was in the garage kicking myself the FedEx man stopped by to cheer me up by delivering the BDM port adapter.
Hopefully the UK -A1 ECU was my screw up for the day.
I just need to make an adapter cable and plug it in. Stay tuned
|
ridgeracer
Pro
Posts: 1309
|
posted June 14, 2007 09:36 PM
Edited By: ridgeracer on 14 Jun 2007 22:38
Well so far so good. I made an adapter cable and plugged the BDM in and it fired right up. I was able to download the software and compared it to what I already had and it matched.
I hooked it up to the notched -A2 ECU shown above and downloaded its map and code for the first time ever in about two minutes. It took me days and days to do the B1 the first time last year. I wish I would have found this thing back then. I still haven't tried to erase or program either ECU yet. I want to be sure I've got good copies off all the data before I start erasing things.
I tried looking at the A2 map with the Enginuity software and quickly found that it will require a new definition file. Its not that much different than the B1 I've been showing in the thread but different enough to require its own definition. The biggest surprise is that the A2 does not have a special ignition map for first gear like the B1 does. Also the A2 has one less RPM level at the low end of the ignition maps then the B1.
Once I finish the A2 defintion you will be able to compare all the maps side by side.
|
entropy
Moderator
Posts: 8671
|
posted June 14, 2007 09:58 PM
RR,
What you are doing is sooooooooooooooooooooooooooo cool, i am speechless.
Hats off to you and yr continued efforts!
____________
This moderator uses moderation in moderation
|
ridgeracer
Pro
Posts: 1309
|
posted June 15, 2007 08:05 AM
Edited By: ridgeracer on 15 Jun 2007 09:10
Thanks entropy. Hard to believe I started this back in May '06. Time flies when your having fun 
Here is a map file update for those of you have the Enginuity Software.
http://www.bikeland.info/downloads/ecu/zzr_defs_002.zip
It contains:
zzr_def_002.xml (an updated definition file)
21175-1079US.bin (the map for a 2001 ZX1200A2)
21175-1089US.bin (the map for a 2002 ZX1200B1. Same as zzr-t006.bin upthread)
For those of you who don't have the Enginuity software for viewing maps
http://www.bikeland.info/downloads/ecu/Enginuity0.4.0b-win.zip
Ok, I have stalled long enough. Time to try for the big one. Prove that you can Erase and then re-Flash the ECU map with different code.
|
supra5677
Pro
Posts: 1279
|
posted June 15, 2007 09:50 AM
Let us know if it works 
|
ridgeracer
Pro
Posts: 1309
|
posted June 15, 2007 01:00 PM
It works.
By using the BDM port adapter, the PROG16Z software, and applying a programming voltage of +12.6VDC to pin 29 of the large connector I was able to erase, blank check, reprogram, and verify a 32k flash module in the -B1 ECU.
I'll write it up in detail later but right now I need to go camping.
|
supra5677
Pro
Posts: 1279
|
posted June 16, 2007 07:04 AM
Speaking for myself I think congrats are in order for RR. A full 13month project with plenty of hours, set backs and accomplishments. This project is not only unique but useful and informative. It shows what a guy with an idea, motivation, and some grit can do. Cheers to you RR
|
frEEk
Administrator
ummm... yeah
Posts: 9660
|
posted June 19, 2007 10:02 PM
doood! congrats indeed! fruition!!
very, very cool. and really quite exciting, at least to me. and you got it done so quick i may just have time to do it before i head to laguna. of course, that assumes we can determine where the plug is on the A1 (which is what I have) and i can get the thing on a dyno with a sniffer so i can map it. and i gotta remember to order one a them adapters.
man, i leave for a few days and look what i come back to?!?
|
tuusinii
Pro
Posts: 1031
|
posted June 20, 2007 03:32 AM
Yes this is really cool and big thanks to RR. Even if I don't have need for this but it is very nice to know if I'll need it in future. It would be nice to get 2nd ECU and play with it! Good work!
|
entropy
Moderator
Posts: 8671
|
posted June 20, 2007 03:36 AM
quote:
It works.
By using the BDM port adapter, the PROG16Z software, and applying a programming voltage of +12.6VDC to pin 29 of the large connector I was able to erase, blank check, reprogram, and verify a 32k flash module in the -B1 ECU.
I'll write it up in detail later but right now I need to go camping.
HOLY SCHITTTTTTTTT: RR DID IT!!!!! Cracked the 12's ECU!!!!!!!!!!!!!!!!!!!!!!!!!!
____________
This moderator uses moderation in moderation
|
Seth ZX12r UK
Expert Class
Posts: 238
|
posted June 20, 2007 08:06 AM
Excellent work RR.
What difference will this make to tuning the 12r over and above what can be done with a PC3?
|
ninja12
Needs a job
Posts: 3310
|
posted June 20, 2007 08:38 AM
Great news, Congrads!!!
When will you start real road/track test?
|
ridgeracer
Pro
Posts: 1309
|
posted June 20, 2007 02:16 PM
Freek:
Here is an image of the exposed - A1 connector
The connector has the same number of pins, same name (CN3), and same power and ground placement. I'm sure it's the same connector I just can't test it because I buggered the board by cutting into the edge. Soon as I fix it I'll verify that it works the same and let you know.
quote:
What difference will this make to tuning the 12r over and above what can be done with a PC3?
Its more like what CAN'T you do. Here are some things just off the top of my head.
1) I think the biggest find was the A/B map feature. The ECU has two complete sets of Ignition and Fuel maps. Which one is used depends on an existing wire in a plug off the wire harness in the tail.
No more compromise NOS maps. Have one map tweaked for off NOS and the other optimized for on the NOS including custom ignition timing for the complete throttle and rpm range. Choose between the two at the flip of a switch.
Or maybe you do a lot of touring and want a high mileage map and a high performance map.
2) Change the throttle sensitivity. Right now half of the data in the map covers just the first 10% of throttle travel. This makes the bike easier to ride in parking lots or stop and go traffic.
However if your drag racing you need to hold that throttle at just the right spot on the launch and then its wide open Wouldn't it be nice to modify the throttle sensitivity curve to put all the sensitivity centered around the sweet spot. In other words instead of the difference between a perfect launch and a sky high wheelie being just 1 or 2 degrees of throttle travel make it 10 degrees.
3) The obvious get rid of the speed limit and customize the rpm limit.
4) The cost. While buying the device and software needed to program the ECU costs $389 you only need it for programming. It's not installed on the bike. In other words if you can borrow one for you dyno session it's free.
5) The PCIII can't change the fact that the - B1 models have a first gear only ignition map that restricts the bike between 4000 and 6000 rpm in first gear.
quote:
When will you start real road/track test?
Supra is sending me his ECU to notch so he can try it out on his bike.
There is still some work to do on the map definitions. We get the map data from the ECU but it's just a bunch of bytes. You have to analyze it and identify the different map areas and then write a file that says this area is the ignition map, this area is a fuel map etc.
In addition it would be nice to quantify the units. Right now for instance the ignition maps display raw map data. It would be nice if it was displayed in degrees BTDC instead. Like wise it would be nice to translate the Air pressure and air temp map data into millibars and degrees Fahrenheit.
|
ridgeracer
Pro
Posts: 1309
|
posted June 20, 2007 02:55 PM
BTW Thanks for all the praise everyone but it was definitely a group effort and I'd like to take a moment and thank those who helped make this possible
Five and Supra for getting two ECUs to me to tear apart
Supra for getting me a copy of the Flash programming software I needed.
A board member who shall remain nameless for getting me a very expensive piece of Disassembly Software
The guys at Enginuity.com for writing a beautiful piece of Freeware Map editing software
All of you who took the time to scan and post diagrams and schematics I needed and sharing your knowledge about the ZX-12 Every little clue helped.
And of course blueford for motivating me to finish this project just to prove him wrong
|
supra5677
Pro
Posts: 1279
|
posted June 20, 2007 05:08 PM
I'm pretty sure I have the ignition tables figured out in BTDC values.. The stock ignition timing is 10 degreees BTDC at 1,000 RPM.. On the raw data the numeric value is 64. Make the problem a ratio. 64/10 equals 138/X multiply then divide.. The 138 raw value =21.56 degrees BTDC...
Then I used another way but I can't remember the math...
64=10 BTDC; 67=10.45 BTDC; 103= 13.8 BTDC; 121= 14.72 BTDC etc.. It seems to make more since the second way... but I don't know for sure..
supra
|
entropy
Moderator
Posts: 8671
|
posted June 21, 2007 04:46 AM
quote:
.. The stock ignition timing is 10 degreees BTDC at 1,000 RPM..
supra
supra,
where did you get that info, i have been curious about ign timing since day one.
Does ign timing change w/rpm???
____________
This moderator uses moderation in moderation
|
ridgeracer
Pro
Posts: 1309
|
posted June 21, 2007 05:13 AM
Edited By: ridgeracer on 21 Jun 2007 06:16
It changes with both the RPM and Throttle. Here is the Ignition map for coil 1 of a -B1 model ECU. RPM is down the left side, Throttle (TPS) across the top. What supra is talking about is how to convert the numbers in the map from raw data to degrees BTDC.
The manual says it is 10 degrees at 1000 RPM the map shows the value 64 in that area so 64 must be 10 degrees. But it doesn't necessarily follow that doubling 64 to 128 double 10 degrees to 20 degrees. It could be that 64 is added to some minimum number like say 8 degrees in which case 128 would be 12 degrees. The answer to this question down to a thousandth of a degree is in the software. I just need to trace it out.
|
entropy
Moderator
Posts: 8671
|
posted June 21, 2007 06:44 AM
WOW!
RR: this is fabulous stuff!!!!!!
(now get to work and figure out the conversion! )
____________
This moderator uses moderation in moderation
|
supra5677
Pro
Posts: 1279
|
posted June 21, 2007 02:14 PM
I took the 64 number and divided it for example by 103. =.621
1( in this case 10 degrees) -.621 =.379
103 is 37.9% larger than 64
take 64 in the ignition table multiply 10* 1.379 and you get 13.8 degrees BTDC
take the numeric percentage larger than 10 and the raw data numbers give you that percentage. It seems to make sence because the number 142 in the first gear map turned out to be 15.5 degrees BTDC which is advancing the timing 5.5 degrees from stock...
|
ridgeracer
Pro
Posts: 1309
|
posted June 22, 2007 09:21 AM
Edited By: ridgeracer on 22 Jun 2007 10:24
Maybe. But its still just an educated guess. There is no reason to guess. Its alright in the code. It's not unknowable, just not easy. I took some steps down the path to the holy grail yesterday. The system timebase. The unit time by which all real time events are measured.
Lets start with the system clock.
So now we just need to find the value written to SYNCR. So we search the code for a write to register 0xFFA04
So setting is 0xB004 which is 1011000000000100 in binary. Looking at the register bit assignment above that means;
W = 1
X = 0
Y = 110000 binary or 48 decimal
The ECU uses a 4,000,000 Hz crystal so using the fast reference formula above we get
fSys = 4000000 / 128 * 4 * (48 + 1) * (2^((2*1) + 0))
fSys = 31250 * 4 * 49 * 4
fSys = 24,500,00 Hz = 24.5MHz
From there we go to the Prescaler
So we need to find the CPCR register in the software
That value is 8 or 00001000 binary. That sets Div23 to divide by 2 and PSel0:1 Sets PClk5 to divide by 32. Now on to the Free Running Counter Sub Module
We find the FCSMSIC register in the code
The value 0x204 or 0000001000000100 binary. This means a CLK2:0 select of 100 or PCLK 5. So the Free Run counter runs at a rate of fSys / 2 / 32 counts per second.
24.5MHz / 64 = 382812.5 Hz
Which means if it can count 382,812.5 times a second it takes 1/382,812.5 of a second, or 2.612 uS (millionths of a second) to increment the count by 1 or what I call a system TICK.
OK so your asking so what the hell does that all mean? The Free Running Counter is used to measure all real world time events. It just sits there and counts 1, 2, 3, 4, one tick every 2.612uS, forever.
Take the Crankshaft sensor which is triggered by a wheel on the end of the crank with eight tabs. When a tab goes by the ECU reads the counter and saves the value. Its just some random number say 22008. When the next crank timing wheel tab goes flying by the sensor the ECU reads the counter again, lets say 24056.
Now if we subtract the later number from the earlier number we get 24056 - 22008 = 2048 ticks between tabs (The actual numbers aren't important, just how many ticks apart they are.)
As there are 8 tabs on the wheel it would take 2048 * 8 or 16384 ticks for one crank revolution or 16384 * 2.612uS = 0.042795008 seconds for one revolution which equals 1 / 0.042795008 or 23.36 revolutions per seconds or 1402 RPM.
And if it takes 0.042795008 second for one revolution, or 360 degrees then 0.042795008/360 = .000188 seconds per degree or .000188 / 2.612uS = 45.5 ticks per degree of crank revolution.
The point is now knowing that a tick is 2.612uS I can now convert map numbers to real world values like RPM and injector on time or degrees advance.
Now wasn't that easier than guessing BTW that 45.5 tick per degree is only for the example rpm and has nothing to do with the ignition map values discussed above. But now I should be able to figure them out.
Of course I could of screwed up :o 24.5HMz seems like a strange clock frequency to choose. Why not 24 ( 6 times xtal) or 25 which would give you a nice round tick number. So I will have to check it out against some real world value. I would prefer to measure something, not rely on some printed spec. like 10 degrees at 1000rpm.
For instance according to my calculations using that tick value the Rev Limiter for the -B1 model is 11215. Now I have heard all kinds of numbers for the actual redline. What someones tach said, what the dyno said etc.
Does any one have a definitive number and where did you get it?
I think 11215 is in the ballpark. In the drag racing forum they talk about how they set their air shifters to shift at 11200. If they set it to 11400 they hit the rev limiter. That's good enough for me
|
supra5677
Pro
Posts: 1279
|
posted June 22, 2007 10:02 AM
When I had my bike on a Factory and Dynojet dyno the stock rev limit was 11,600 with the tach reading 12,200 to 12,500..
Most posts Iv'e read have the rev limit at 11,600. Of course the internal clock equation sounds more accurate..
Iv'e since had my rev limit extended by fooling with the internal clock, you might find this when you receive my ecu..
I'm sure someone else can weigh in..
|
supra5677
Pro
Posts: 1279
|
posted June 22, 2007 03:24 PM
Did you ever consider teaching at M.I.T.?
|
ridgeracer
Pro
Posts: 1309
|
posted June 22, 2007 04:36 PM
quote:
Did you ever consider teaching at M.I.T.?
I'm smart enough to know what I don't know.
Anyway I got Supra's ECU in the mail today and notched it. It took about 2 hours. I could of probably done it faster but I was trying real hard not to fuck it up
The rubber mounting sleeve does a pretty good job of covering up the notch. But I still think I would throw a piece of duct tape on there to keep the dirt out and moisture out once I got it dialed in. If any of those programming pins get grounded to the chassis while the ECU is powered up you could end up with a, I believe the term in the ECU hacker community is 'BRICK'
I hooked it up to power and ground then to the BDM port on my PC printer port and it work as advertised the first try. I downloaded copies of all the data just in case. The data was exactly the same as my other 21175-1089 (B1) ECU which is a good thing as far as sharing maps.
Now all I have to do is but together a documentation package with instructions and a 'If you blow up your bike or kill yourself don't come crying to me" disclaimer
|
supra5677
Pro
Posts: 1279
|
posted June 22, 2007 06:58 PM
lmfao...RR man you are too much
|
|
|
HOME
NEW TOPIC