ridgeracer
Pro
Posts: 1309
|
posted September 02, 2007 06:55 PM
After looking at your pdf I checked out the code for the 21175-1089 B1/B2 ECU and found a very rudimentary protocol.
The ECU initially sets Serial B into RCV. Upon receipt of a single byte it goes into transmit mode.
The rcvd byte is used to calculate a pointer into a look up table of 256 16 bit addresses. For example if you send the ECU a 0x04 it pulls the fifth entry in the table which is 0x007A. It then grabs the data from address 0x000E007A and transmits the byte back as the reply. After that single byte is sent Serial B goes back into receive mode.
Table entries for 00 - DF return RAM values, E0 - FF return MAP ROM data, specifically the version ID ASCII string you have to make multiple requests to get the whole string, it only sends one byte per query. Undefined table entries return 0xFF always.
Here are the query bytes and the data returned...
00
00
00 dc.w 0000 ; System Status flag
01 dc.w 00Ch ; System Status Flags
02 dc.w 046h ; Throttle Position
03 dc.w 04Ch ; Inlet Air Pressure
04 dc.w 07Ah ; zAdjLiqTemp; Adjusted water temp
05 dc.w 07Bh ; zAdjAirTemp; Adjusted Air Temperature
06 dc.w 052h ; zStaticAP_2; copy of static air pressure
07 dc.w 07Ch ; zCnkSpeed; RPM
08 dc.w 057h ; zCopyAnRslt_4; Fuel Pump Voltage
09 dc.w 36Eh ; Returns 0xFF always
10 dc.w 36Eh
11 dc.w 36Eh
12 dc.w 36Eh
13 dc.w 36Eh
14 dc.w 36Eh
15 dc.w 36Eh
16 dc.w 0CCh ; zInjVar_A2; This is zCOV_offset_1 (Fuel Adjustment Input 1)
17 dc.w 0CDh ; low byte of above
18 dc.w 0D4h ; zCov_offset + zFuelPumpMap (Injector variable)
19 dc.w 0D5h ; low byte of above
20 dc.w 0DCh
21 dc.w 0DDh
22 dc.w 0E4h
23 dc.w 0E5h
24 dc.w 0ECh ; Calculated zCOV offset to Injector for Cylinder 1
25 dc.w 0EDh ; Calculated zCOV offset to Injector for Cylinder 2
26 dc.w 0EEh ; Calculated zCOV offset to Injector for Cylinder 3
27 dc.w 0EFh ; Calculated zCOV offset to Injector for Cylinder 4
28 dc.w 36Eh
29 dc.w 36Eh
30 dc.w 36Eh
31 dc.w 36Eh
32 dc.w 220h ; Calculated Ignition Advance Coil 1
33 dc.w 224h ; Calculated Ignition Advance Coil 2
34 dc.w 228h ; Calculated Ignition Advance Coil 3
35 dc.w 22Ch ; Calculated Ignition Advance Coil 4
36 dc.w 36Fh ; zCnkSpeed_2; RPM
37 dc.w 36Eh
38 dc.w 36Eh
But as I said up thread Denso did not stuff the Serial B Rcv components so you can't request this data. At least not in the B1/B2 model. But maybe it will help someone else.
   
|
PetriK
Parking Attendant
Posts: 30
|
posted September 03, 2007 09:10 AM
 Edited By: PetriK on 3 Sep 2007 10:25
quote:
But as I said up thread Denso did not stuff the Serial B Rcv components so you can't request this data. At least not in the B1/B2 model. But maybe it will help someone else.
If I recall correctly the SIO subroutine is called based on interrupt flags. Maybe the Serial B could be hooked into a Tx mode based on another interrupt? Perhaps the .s19 code could be changed when flashing the ECU to send the control and databytes instead of just one byte? That should make a piece of software, with screens like in the link below possible, to be developed:
http://www.z1motorsports.com/imagemagic.php?img=images/monitoringczlt.jpg&w=640&h=480
|
ridgeracer
Pro
Posts: 1309
|
posted September 03, 2007 11:09 AM
Edited By: ridgeracer on 3 Sep 2007 12:10
quote:
That should make a piece of software, with screens like in the link below possible, to be developed:
Actually the Freeware map editing software, Enginuity, also has a built in logger function that can be customized like the map definition files. The example screenshot shown below is for a Suburu. Besides the format shown it also displays the data graphed over time or in a 'Dashboard' mode.
quote:
If I recall correctly the SIO subroutine is called based on interrupt flags. Maybe the Serial B could be hooked into a Tx mode based on another interrupt?
In the ZX-12 ECU it is not interrupt driven. After system initialization the ECU goes into a periodic main loop with 13 service routines. Some routines get called every loop, others every 2nd or 4th loop etc. The routine that reads the Serial and generates a reply is in an every 8th loop misc service routine that includes things like checking the top speed restriction, diagnostic switch input and other low priority items.
quote:
Perhaps the .s19 code could be changed when flashing the ECU to send the control and databytes instead of just one byte?
This is very possible. There is ~5000 bytes of unused code space in the ECU which would be plenty of room to install some patches. The way I would do it is find a jump in the main loop and change the address to jump into my patch, do what I needed and then jump to the original destination of the main jump. What I would do is just have it continuously dump the parameters I wanted. I would use the existing lookup table in the Map data to create a list of items I wanted dumped and put a null at the end of the list. That way end users could customize the output using the Enginuity map editor.
I'm very tempted to try this. I built a bike emulator so I could measure how changes in the map data effected the fuel, timing etc. But instead of taking a bunch of readings by hand from my scope why not just have the ECU dump the data to my PC. That way I would be able to graph side by side throttle vs fuel vs RPM for example.
Thanks for suggesting it.
|
ridgeracer
Pro
Posts: 1309
|
posted September 08, 2007 08:18 AM
Edited By: ridgeracer on 8 Sep 2007 09:22
It has been an interesting week.
PetriK has uncovered the back end of an early Hayabusa ECU and discovered the same BDM port that the ZX-12 has. It hasn't been confirmed 100% that it can be used to reflash it yet but it looks pretty good. Of course some of you Green blooded, die hard Kawi guys may not see that as good 
I'd bet money that all the turn of the century 16 bit denso products are set up the same way. Including the Gixxer and TL 1000s
In the two steps forward, one step back department I bricked supra's ecu again, for good this time.
I hooked it up to my bike emulator and burned the new map into it. Part of that was increasing the rev limit using the limit table. I hooked it up to the emulator because I wanted to verify the limit worked. I didn't want to send it to him unlimited and have him blow up his engine.
When I powered it up the FI light came on. I pressed the diagnostic button and it came back as water temp out of range. That's not unusual. If one of the knobs gets turned to far left or right it does that. You just turn the knob till the FI light turns off. I started to turn the knob when all of a sudden all the injectors fired at the same time. Then all the coils turned on and stayed on. Then smoke started coming out of my emulator box.
I yanked the power. The ECU itself was very warm. Now if you try to power it up the coils are always on. I disconnected every thing except power and the ECU draws 2 amps which is about 10 times normal idle current. Also the 5V supply only runs at 3.1V. I'm pretty sure I blew up something on the 5V bus. One thing I am sure about, its toast.
I'm not a sure what happened. The most likely thing is that I wired it up wrong to the emulator. I only have the wire harness plugs the entropy sent me for the A1 model. When I hook a A2/B1/B2 up to the emulator I need to remove all the wires from the plugs and then push the 50 wires on to the correct pin of the ECU on at a time. There are some duplicate color/stripe wires and the pins are pretty close together. In other words it would not be hard to end up with the wrong wire on the wrong pin.
I've done this probably half a dozen times successfully and immediately after I smoked it I did a quick recheck of the wiring and didn't see any obvious screw up. But the fact I smoked a pot and it didn't happen till I turned it leads to the obvious conclusion that some how I wired 12V into the pot and at first the resistance protected the circuit but when I turned it down I ended up throwing 12V down a 5V analog sensor input causing it to self destruct and start sucking a lot of current off the 5V bus.
I'm 95% sure this had nothing to do with reflashing the ECU. That it was the emulator that smoked it. I'm not a 100% sure because this was the first time I evern flashed a B2 while "on the bike" (connected to the emulator while flashed) . But it did run after reflashing it. The FI / fuel pump came on at start up. It passed back diagnostic codes when asked. It didn't blow till I turned the potentiometer. This kind of sets me back as far as using the emulator to measure the effect of changes in the fuel maps as I need to do the following first (not necessarily in this order)
Fix the emulator
Find a A2/B1/B2 wire harness somewhere
Modify Supras replacement ECU and put a map in it (while not connected to said emulator)
Put supras map in my test B2 hook it up to the emulator and run it to test the RPM limit
Try reflashing my test B2 while hooked up to the emulator so I'm 100% sure you can do that safely.
Autopsy Supras ECU to find why it died.
On a personal note I have to say that smoking Supra's ecu was really depressing. Its kind of like crashing your bike, a moments carelessness and an instant later your fucked. Actually its more like crashing your friends bike. I'm sure many of you know what I mean. One moment you are all having fun and wham!, somebody goes down and you realize shit this is dangerous. You always knew it was dangerous in the back of your mind, but now its in your face. Suddenly its not fun anymore.
I have a half a dozen guys who have PM'd me and want me to modify and flash their ECUs. Some as far away as New Zealand and Singapore. If it turns out you can flash the Busas as well I'm sure that list will grow even more. That's potentially a lot of ECUs to destroy.
But I didn't quit riding the first time I crashed, or the second, or the third. You take a break, you go over what happened, what you learned and what you'll do different in the future and you get back on the horse.
And you slow down, for a while.
The truth is after all this time we still haven't field tested a single ECU. Not one modified, remapped ECU has actually been installed on an actual bike and run. I will be getting a brand new never been used factory fresh ECU to replace Supra's. I will notch it and flash the map supra wants into and send it to him. When he successfully installs it on the bike and it runs then I'll start thinking about modifiying everyone else's ECU.
|
fish_antlers
Administrator
The Truth is Out There
Posts: 21893
|
posted September 08, 2007 09:24 AM
RidgeRacer... think you have another ECU for donation.... see this topic:
http://www.bikeland.org/board/viewthread.php?TID=34012&FID=45
____________
What business is it of yours where I'm from, Friendo?
|
supra5677
Pro
Posts: 1279
|
posted September 08, 2007 02:59 PM
don't worry about the ECU RR. When embarking on projects like this we always have to consider the oppertunity cost if something goes wrong thats okay. Iv'e just changed my projects from cams and ecu's to building a pond in my backyard, plus it keeps the wife off of my ass 
What is great is how the project is growing to include busas, tl 1000's and probably other bikes. In the end hopefully after folks by there bikes they'll send the ecu to you before they do anything else.. enjoy
supra
|
PetriK
Parking Attendant
Posts: 30
|
posted September 09, 2007 07:55 AM
Edited By: PetriK on 9 Sep 2007 09:01
Pioneers are pioneers because as they face difficulties and then overcome those, the rest are just followers.
One thing I dont understand - that no-one has yet ridden a modified ecu ? If avail I would certainly try it out. Surely a modified ecu is way better than any piggyback units. E.g. the fact that the smooth transition from low load map to high load map can be ensured.... not to mention modifying the MAP sensor map to allow boost or even changing injectors...
If it would be possible I would just give an AFR map to RR and then get in return a fully compiled ECU with proper maps there. E.g. the innovate set gives an excellent ability to log on the AFR map while riding for both TPS/RPM and MAP/RPM maps. And as you can see, I could do with some help on the TPS/RPM map when turning to the full throttle - propably the enrichment is too high for my setup with airbox mod + short throttle bodies (+highly misaligned intake cam when logged below)
I have remapped my car for maybe up to 100 times and have also remapped over 50 other cars - so I know that there is more hp to gain with ECU compared to other units as with ECU one is not dealing with averages - with ECU tuning one is dealing with precise information.
|
ridgeracer
Pro
Posts: 1309
|
posted September 10, 2007 05:42 PM
FYI - I successfully downloaded the software and map out of a 99 Hayabusa ECU today.
It does not have very much in common with the zx-12 and I only have a very primitive definition for enginuity at this point but if you want to take a look at it here it is.
http://www.bikeland.info/downloads/ecu/busa001.zip
|
entropy
Moderator
Posts: 8671
|
posted October 18, 2007 03:12 AM
RR,
the Texas Mile is behind me and i'd like to start playing with the modded ECU on the 1/4 mi.
____________
This moderator uses moderation in moderation
|
ridgeracer
Pro
Posts: 1309
|
posted October 18, 2007 07:53 PM
So what did you want to try first?
Where you going to get your own programmer?
____________
|
entropy
Moderator
Posts: 8671
|
posted October 19, 2007 03:45 AM
quote:
So what did you want to try first?
Where you going to get your own programmer?
RR
I would like to go at this stepwise, slowly.
First put the ECU back on the bike with the PC3r and confirm that the extended ECU works as it should.
If all is fine, i will proceed to getting the SW to program fuel and ign timing.
Does this sound right??
Karl
PS: I will send you $$ to pay for shipment
____________
This moderator uses moderation in moderation
|
ridgeracer
Pro
Posts: 1309
|
posted October 19, 2007 05:05 PM
quote:
First put the ECU back on the bike with the PC3r and confirm that the extended ECU works as it should.
Just to make sure we are on the same page here by extended ECU you are talking about your spare ECU, that I currently have, reflashed with a higher RPM limit and not an ECU with the crystal modification that ups the RPM.
If that is correct what RPM do you want to have it set for?
____________
|
entropy
Moderator
Posts: 8671
|
posted October 19, 2007 07:22 PM
yep, that's what i mean, the one you have reflashed to 12500??? Is that possible??
____________
This moderator uses moderation in moderation
|
ridgeracer
Pro
Posts: 1309
|
posted October 20, 2007 07:38 AM
Edited By: ridgeracer on 20 Oct 2007 08:40
Yes. The way the rpm is expressed as a 16bit number and different math limits in the software the ceiling on the RPMs works out to 12,700. Anything above that and the software will force it to 12,700
So using the stock scheme I will set it to
RPM > 12,500 Injectors off
12,490 < RPM < 12,500 no change
RPM < 12,490 Injectors on
RPM > 12,520 Coils off
12,510 < RPM < 12,520 no change
RPM < 12,510 Coils on
Of course that brings up the question of what to do about the ignition maps. Here is the bottom of the stock map...
The values are pretty much the same from 7200 rpm up to 11,600, just before the stock rev limit of 11,700, then at 12,000 everything above 10% throttle gets retarded back to 32.5. To me that really looks like it was done to make the power fall off as it approached the rev limit, not because the engine design required it.
So I can raise the limit to 12,500 but your ignition is not going to be optimal at anything over 12,000. I know you said you wanted to mess with the ignition / fuel maps later but I think a small change to this might be a good idea.
By changing the RPM values of the last two rows the ignition keeps the same advance values all the way to till just before redline then they would drop off a little in the same way they do now on the stock bike.
What do you think?
BTW the Intake maps already go up to 12,600 rpm and while the fuel maps only go to 12,000 you will still have the PCIII if you need to change the fuel above 12,000 in this 1st step.
____________
|
entropy
Moderator
Posts: 8671
|
posted October 21, 2007 05:08 AM
RR,
because i will be running the ECU on my stroker, i really don't anticipate running it above 12000 (if that). The rest is a cushion in case of missed shifts, loss of traction etc.
Your strategy/set up for timing etc at/near the limiter sounds great
I'll use a PC3r to make sure all is fine with the limiter, then start the real experiment, converting PC3r fuel and ign adv into numbers for the flashable ECU.
This process could be a very good thing for my big injectors. With the PC3r a change of 1 in the fuel makes AF changes of .2 or .3 or so (unlike the small injectors where 1 = .1). Maybe changing numbers in the ECU fuel map will generate smaller AF changes.
____________
This moderator uses moderation in moderation
|
supra5677
Pro
Posts: 1279
|
posted October 21, 2007 06:47 PM
I thought the intake maps went to 12,349?
|
ridgeracer
Pro
Posts: 1309
|
posted October 22, 2007 04:52 PM
quote:
I thought the intake maps went to 12,349?
Actually on the A1s they go to 12,600 on your B1 they only go to 12,000
____________
|
ridgeracer
Pro
Posts: 1309
|
posted October 25, 2007 02:58 PM
For the record I wanted to include a link to this thread
http://www.bikeland.org/board/viewthread.php?FID=1&TID=34987&set_time=
It has some discussion related to this project that we may want to reference at some future point in time and I don't want to have to go hunting for it.
____________
|
PetriK
Parking Attendant
Posts: 30
|
posted October 25, 2007 08:39 PM
Excellent thread.
Regarding excel, I just emailed you a copy of excel with some macros which can be used to modify downloaded maps. So basically you do a paste of the map, copy and save directly to the .bin file, very simple. And of course you could even paste a PC map on it and automatically calculate a new fuel map with simple excel functions.
I believe that for most of the tuning you want to have real life conditions and dynolink is all about dyno conditions. Therefore I particularly like the idea that Innovate motorspors and openecu have introduced. By hooking up a wide band O2 sensor to your bike it will give you some ready made maps after just riding the bike - and not only the maps but full logs also.
The fuel maps are there for steady throttle positions. For the first meters a quarter mile one of the factors one should consider is tuning the throttle enrichment. For me getting that right gave one of the biggest improvements for a car acceleration.To get that right you need logging information what e.g. innovate could provide.
|
ridgeracer
Pro
Posts: 1309
|
posted October 27, 2007 06:30 AM
Thanks for the excel file. It could be very useful once I figure things out.
I got my bike emulator back up and running last night. As some of you may remember I was going to test the changes I made to Supra's ECU when I ended up smoking, literally, the emulator and ruining the ECU. The cause was as I had suspected, I had swapped two wire harness connections that had the same color wires which ended up shorting the 12V power to the 5V power thru the Static Air Pressure Potentiometer. The smoke was from the potentiometer.
So I replaced the burned up parts and I bought another set of ECU connectors on eBay so I can now quickly, and safely, swap between the A1 style ecu and the A2/B1/B2 style with out having to mess with manually inserting 50 some wires into little holes.
I think the first order of business will be to test the A/B map feature. Make sure it works and verify which map is input line open and which is input line grounded. Having the capability to switch between two maps will really help me in measuring the effect changing maps has on the injector output has i will be able to switch back and forth between a stock and a modified map.
____________
|
ridgeracer
Pro
Posts: 1309
|
posted November 02, 2007 06:36 PM
Edited By: ridgeracer on 2 Nov 2007 19:40
Today I verified the A/B map feature works.
I flashed a zero map into the cylinder 1, A fuel map of a 21175-1065 ECU. This is a UK A1 model. I hooked it up to my bike emulator that allows me to bench run the ECUs. Without the jumper the ECU ran normally. I turned off the 'key' shorted the jumper to ground, turned on the 'bike' and ran it again. This time cylinder 1 injector ran dark (the emulator uses 12v bulbs instead of injectors)
The jumper wire is connected to ECU pin 64 on A1 models and pin 34 on A2/B1/B2 models. On both types the pin is connected to the white wire with black stripe of the 8 pin diagnostic (YoshBox) connector located in the bikes tail under the seat. This same connector also has a ground wire, Brown w/ Black stripe, that you could use to jump to.
Actually the shop manual shows that these wires are jumpered with a shorting plug installed on the diagnostic connector on some non-US models. If you could order the part with the jumper wire you would be able to wire in a switch with out hacking up your wire harness. So far every ECU I've looked at the A maps and B maps have exactly the same data. However every ECU I've looked at also is in the manual as not needing a jumper.
White w/ Black stripe wire open selects B Maps (normal operation)
White w/ Black stripe wire grounded selects A Maps
The Maps select jumper setting is only read when key is first turned on. Maps can NOT be switched on the fly while the bike is running.
While I have only physically verified this on an A1 model ECU I have seen the exact same, line for line, map select routine in each version of software. And am assuming it works on all versions.
____________
|
ridgeracer
Pro
Posts: 1309
|
posted November 09, 2007 03:28 PM
Edited By: ridgeracer on 9 Nov 2007 15:39
Here is an updated map definition for Enginuity.
It contains the complete map set for the A1 (21175-1069) model. All the functions of the maps are not known yet but at least they are defined. There are now more than 80 maps.
http://www.bikeland.info/downloads/ecu/zzr_defs_009.zip
(19617)
____________
|
ridgeracer
Pro
Posts: 1309
|
posted November 10, 2007 07:59 AM
I forgot that the 2000 Euro model 21175-1065EU is almost exactly the same as the 2000 US model -1069US that I just did the full maps for.
So a little cut and paste and we have
http://www.bikeland.info/downloads/ecu/zzr_defs_010.zip
I used to think they were exactly the same, but with the expanded map set I did find one small difference. In Gear Map 15198 RPM in the EU map in 3rd gear between 1600 - 2200 rpm the values are 10% less in the EU map than in the US map.
____________
|
entropy
Moderator
Posts: 8671
|
posted November 11, 2007 02:25 AM
On JC's dyno on Sat, i tested:
DaveO modded ECU (5% incr in clock speed), rev limit = 12.200rpm
RR's remapped ECU ( RR magic in hacking), rev limit = 12.500rpm
Kudos to RR!!!!
____________
This moderator uses moderation in moderation
|
Y2KZX12R
Needs a job
CompetitionCNC.com
Posts: 3762
|
posted November 11, 2007 05:13 AM
Edited By: Y2KZX12R on 11 Nov 2007 05:31
--------------------------------------------------------------------------------
RR, whats the prospects of changing the ecu to fire two cylinders at a time? Is there a table that tells the ecu when to fire the injectors and coils besides just the timing map?
For instance if i wanted to fire 1 and 4 together and 2 and 3 together etc.
--------------------------------------------------------------------------------
----------------------------------------------------------------------------------
Depends how many degrees of crank rotation separates the first pair from the second pair.
The system is set up to fire each cylinder only once per 720 degrees or 16 crank sensor pulses.
When the ECU software starts up it loads a number between 0 and 15 into variables for each cylinder's coil and injectors that represent the crank pulse count they are supposed to time off of. For example;
Inj_1 = 0
Inj_2 = 4
Inj_4 = 8
Inj_3 = 12.
It would be very easy to change those numbers to
Inj_1 = 0
Inj_2 = 8
Inj_4 = 0
Inj_3 = 8.
The only problem I see is the system was designed to have to only process one cylinder at a time. If you changed it the way you suggest then each time period it would have to look up and process two fuel maps, two air maps, two throttle maps, etc. At really high RPMs it may not have enough times to calc the first pair before it was time to start the next pair. The only way to know for sure would be to try it and find out.
The short answer is yes you could do it but it would be a lot more involved than just changing some map values like you do to up the rev limit.
-------------------------------------------------------------------------------------
RR,
How about piggy backing the coils and injectors? would that overload the drivers? Or would the signal from cyl 1 and 2 need to be sent to another gizmo to fire the two piggybacked injectors and coils? Maybe that would be easier?
Karl, looks like all is working well !! Time for that big valve head!!!
____________
Y2KZX12R
CompetitionCNC.com
|
|
|
HOME
NEW TOPIC