Haybusa Parts and Service Member Support

Author Topic: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!  (Read 79785 times)

Offline Busa Quick

  • Post Master
  • *****
  • Posts: 1226
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #25 on: October 27, 2007, 11:33:23 AM »
 

    Where is this RidgeRacers site? Thanks for the info so far.



 Mark
Black and Purple 04, MY MODS: Turbo, .08 spacer, s2000 injectors, yosh cams 7.2 spring, heavy clutch springs, APE valve springs, raised rev limiter to 11,500 rpm with ignition cut only, using only stock ECM with Petrik reprogramming method,

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #26 on: October 27, 2007, 12:23:05 PM »
Here are the two most informative links where the original information resides. Please note that for all practical purposes older generation busa ecus (1999-2002) is basically same as zx12r and newer generation 2004-2007 is same as zx6r amd zx10r.
 
http://www.activeboard.com/forum.spark?forumID=99460&p=1

http://www.bikeland.org/board/viewthread.php?FID=1&TID=23797&set_time=1193495438

Having spent a couple of hours with the newer generation 32bit ecu from 2006 busa I have today found that the newer genration ecu is most likely programmable from the harness connector without notching it. Anyway as you can see from the thread from bikeland.org RidgeRacer has been working on this for more than a year, so all the credits should go to him on putting the time and effort for enabling this.

EDIT - some of you guys might appreciate this ECU Harness Connector pinout:
http://macmadigan.no-ip.com/Public/ECU/Busa32bitECU_harness_connector.mht

« Last Edit: October 27, 2007, 01:00:54 PM by PetriK »

Offline gazza414

  • Mad Post Whore
  • ******
  • Posts: 2024
  • Gender: Male
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #27 on: October 27, 2007, 04:15:59 PM »
Really great work you 2 guys are doing..hope to hear more  progress  :thumb:
1 Fast Hayabusa N/A 217.443mph so far

Offline Shamrock

  • Post Apocalyptic Whore
  • ********
  • Posts: 10171
  • Gender: Male
    • Shamrock Racing
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #28 on: October 28, 2007, 07:22:32 AM »
i have a fried 99-00 ecu if needed  :thumb:

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #29 on: November 04, 2007, 04:57:30 AM »
i have a fried 99-00 ecu if needed  :thumb:

Excellent - thanks. RR is working on BDM ecus (same as Kawi) so he has the primary interest on this.

The status on newer 32 bit ecus (up to 2007) is the following:
- We have traced that all the necessary programming signals are available on the harness connector (FWE, RES, MD1, Tx, Rx).
- Based on initial testing we come to think that the only way to program the flash is first to erase it and then to write full contents at once (needs to be verified in practise.
- Unfortunately looks like the flash memory can not be read from AUD connector due to copyright protection. (at least that is what they say on the renesas web site). Anyhow the processor can be set to EPROM emulation mode to read the content. To test that jumper wires directly to the processor pins must be installed.
- The same dissassembler that RR used for Kawi and Busa ecu support the SH-3/SH-4 which are downwards compatible with SH-2, i.e. the dissassembler supports the processor SH7052 language so it should be possible to dissassembe the contents to understand the programming sequence as well as internal logic.

If anyone has further interest here you are with picture of which pins must be connected for EPROM emulation mode
.
The rest is available on Renesas documents.

The effort from this point to make the programming available for everyone required is quite big so additional help from anyone would be really appreciated. The good thing is anyhow that once accomplished it should be very easy for anyone competent enough to do mapping also to flash the busa 32 bit ecu.


EDIT - Btw, RR has made instructions about how to notch a kawi ecu available. This is directly applicable also to 1999-2002 busa ecu, here is the link to an exellent and detailed document on the topic.
http://www.activeboard.com/forum.spark?forumID=99460&p=3&topicID=14099111



« Last Edit: November 04, 2007, 05:07:56 AM by PetriK »

Offline gnd111

  • Post Apocalyptic Whore
  • ********
  • Posts: 12410
  • Fried Chicken and Gasoline...
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #30 on: November 04, 2007, 06:04:34 AM »
EDIT - Btw, RR has made instructions about how to notch a kawi ecu available. This is directly applicable also to 1999-2002 busa ecu, here is the link to an exellent and detailed document on the topic.
http://www.activeboard.com/forum.spark?forumID=99460&p=3&topicID=14099111


2002 is not the same as the 99-00 or the 01 Busa ECU...

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #31 on: November 24, 2007, 05:46:48 AM »
Here some progress 0f the 32bit busa ECU project:

The downloading of maps or even full ecu software contents can be done using a self made single chip AUD interface. For programming the ecu, the serial line is propably easiest choise. The total cost depending on D.I.Y.parts chosen for a complete programming environment varies from 100 to 200usd depending on components.

For those of you who are interested in of joining and contributing to this kind of project, more information at:
http://www.activeboard.com/forum.spark?forumID=99460&p=1

This is a sample of a map downloaded from K6 busa ecu, usa model.




« Last Edit: November 24, 2007, 05:51:53 AM by PetriK »

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #32 on: November 29, 2007, 08:14:12 AM »
I think that a picture that is from K6 USA model busa tells more than words. Special thanks for RidgeRacer for his support and skills on finding this kind of information.

Anyone interested, the limiters are hysteresis on/off values, ie. the high value shuts off and lower value turns again on the signals from ecu. Please also note for later use that there is another limit at around 11.350 which should not be exceeded without having a lot more values being changed too.



« Last Edit: November 29, 2007, 08:22:35 AM by PetriK »

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #33 on: December 07, 2007, 01:05:06 PM »
The project continues...

Yesterday I succesfully reprogrammed the K6USA ecu, so we can now claim that the 32 bit Busa ECU can be remapped for higher rev limiters or more accurate fuel or ignition mapping.

So we now have:
- orignial K6USA ecu code that can be modified on any personal computer
- Enginuity software to modify the rev limiters and maps from enginiyity.org
- Enginuity map definitions for rpm limiters done and maps defined but not yet named
- Renesas FDT reprogramming software available from www.renesas.com/fdt
- hardware schematics and parts list available from www.activeboard ecu hack forum

All the needed software is available free from internet. The required parts consists of one max232 chip, 6 capasitors three switches and some wiring etc. The total cost of making a reprogramming device for Busa K6 (32 bit ecu) is only around 10USD ;-) too good to be true ?

Additionally RR found a couple of days ago a subroutine that is a strong suspect for a map select switching, i.e. push button for the nitrous usage .

The project is next entering the test phase where we can validata that the theory works in practise ...



Offline Busa Quick

  • Post Master
  • *****
  • Posts: 1226
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #34 on: December 08, 2007, 10:56:36 PM »

  You guys are awesome! The stock ECU is definitely the best choice for stand alone engine control I can't wait to see the results.



 Mark
Black and Purple 04, MY MODS: Turbo, .08 spacer, s2000 injectors, yosh cams 7.2 spring, heavy clutch springs, APE valve springs, raised rev limiter to 11,500 rpm with ignition cut only, using only stock ECM with Petrik reprogramming method,

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #35 on: December 11, 2007, 12:32:05 PM »
Here you are, a reprogrammed Busa K6 ECU keeping the ignition and injection on up to 12000rpm (gauge rpm).




Offline Busa Quick

  • Post Master
  • *****
  • Posts: 1226
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #36 on: December 12, 2007, 03:59:34 PM »

  Can just a small area of the ECU board be cleaned to install the programming plug? Do you think the rev limiter could be changed so that it would only kill spark? With the fuel cut limiter the engine gets leaned out. If only spark were cut it would be safe to bang the engine on the limiter on a engine with mods.

  What did you use to simulate injector and spark coil loads when you tested your ECU?



 12,000 rpms sounds like fun!,
Mark

 
Black and Purple 04, MY MODS: Turbo, .08 spacer, s2000 injectors, yosh cams 7.2 spring, heavy clutch springs, APE valve springs, raised rev limiter to 11,500 rpm with ignition cut only, using only stock ECM with Petrik reprogramming method,

Offline Busa Quick

  • Post Master
  • *****
  • Posts: 1226
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #37 on: December 12, 2007, 04:27:17 PM »

  I am working on reading your posts and I answered the spark and injector questions.

 With 24-1 / 1 the C11 errorcode disappeared. Now all I have is ignition codes C24-C27 which should be easy to tackle, maybe with 10uH coil with 10Ohm resistors. Now I have 10uH with Leds and 470 Ohm resistors.


I can just barely keep up with what you are talking about, it is a little over my head.
Mark
Black and Purple 04, MY MODS: Turbo, .08 spacer, s2000 injectors, yosh cams 7.2 spring, heavy clutch springs, APE valve springs, raised rev limiter to 11,500 rpm with ignition cut only, using only stock ECM with Petrik reprogramming method,

Offline Busa Quick

  • Post Master
  • *****
  • Posts: 1226
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #38 on: December 12, 2007, 04:58:57 PM »

   Petrik...I am not yet a member of the active board so, I am posting here. You said this below:



Also the PAIR valve does not seem to get a signal from USA ecu (understandably) where as vacuum control valve signal is there <2500 gauge rpm.

 I have an O4 model Busa and it had no wiring to the pair pump or on the assemblies. So, you are correct that it receives no signal. Also, you are correct the USA model does have a vacuum cntrol valve for the flapper in the airbox.


 Mark
Black and Purple 04, MY MODS: Turbo, .08 spacer, s2000 injectors, yosh cams 7.2 spring, heavy clutch springs, APE valve springs, raised rev limiter to 11,500 rpm with ignition cut only, using only stock ECM with Petrik reprogramming method,

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #39 on: December 13, 2007, 12:30:49 AM »
Let me try to answer to all of your questions at once.

If the code has already been once uploaded from an ECU with similar typecode then you can use the harness connector to reprogram your ecu. There is a lot of interface products available on free market ranging from 20-200usd. At some point later I will make instructions avail to rewire the renesas e8 programmer to a such a device. That means literally just connecting some harness connector pins to the programmer. You can do that while the ecu is on the bike.

If your ECU has an ID number that has not yet been "opened", then a small area at the back of the ecu must be revealed for you or someone else to upload the prorgram for you. This is easy to do as dyi and also persons like RR do that as a service. To upload the ECU code you need a special hardware interface which costs again around 20Usd, but that is not (yet) publicly available as a consumer product. Anyhow building instructions are there on activeboard forum. At later stages someone should consider start building those devices.

There is both fuel and ignition cut limiters and yes you can set those individually. When exceeding the limiters usually both 2&3 injectors are cut out.

In the engine simulator for testing all the changes I am doing I use some small transformers 32Ohm to simulate the load for injectors and coils. A simple resistor does not fool the ecu to think that everything is ok. Also I learned that one coil for the injectors is not enoug, I need individual coils (which I still need to get for the injector side). The coils have both inductive load 10uH which means that it will release energy which ecu recognizes as a signal of deciding if the coil is good or not.

The 24-1/1 is the crankwheel signal. There is 24 tooth wheel where one tooth is missing, during that missing tooth the ecu receives the cam signal during every second cranksaft revolution.

Yep - its quite interesting to verify that some of the rumours presented on this board and other boards  are true, where as some others are not. E.g. someone has claimed that the fuel shut off happens in cylinder 2, that is not true its both 2&3 when limiters are exceeded. Someone claimed that there is a separate ignition map for gear 5 and gear 6. That is not true (most likely) as all I have seen is that 5th&6th gear share maps where as there is a top speed limiter at around 10050 rpm. The vacuum control valve works from 0-2500rpm (gauge). When revvin the ecu on neutral gear it seems to miss the ignition at 4,6,8&10k points like Suzuki had deceided that otherwise the revs will go up too fast without load.

What is the model number on your K4 USA ecu ?

The ones I have opened and uploaded the code so far are:
32920-24FK0, 112100-1100
32920-24FG0, 112100-1070

It would be interesting to find out that how many ecus must be notched to get all the code variations out of the ecu and found out persons who are willing to start offering the notcing and code uploading service from Busa ECU:s. Whoever is interested I will help him/her to be able to start that.

Like said reprogramming is easy when code is available. Basically just purchase the E8 programmer from renesas, download the software from www.renesas.com/fdt and move the Yoshbox COS&COV wires in your harness to new places and hook the programmer to those and you are ready to go. (Obviously you loose the Yoshbox capability of your bike, but who cares with this stuff ;-) To do that you do not need any special skills. Quite contrary, it is as easy as any other remapping method used.

Offline Busa Quick

  • Post Master
  • *****
  • Posts: 1226
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #40 on: December 13, 2007, 01:11:23 PM »

  Here are the numbers off of my 04 Busa

 32920-24FKO
112100-1100
12V NEP074


Hope that helps
Mark
Black and Purple 04, MY MODS: Turbo, .08 spacer, s2000 injectors, yosh cams 7.2 spring, heavy clutch springs, APE valve springs, raised rev limiter to 11,500 rpm with ignition cut only, using only stock ECM with Petrik reprogramming method,

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #41 on: December 13, 2007, 03:53:55 PM »
Here are the numbers off of my 04 Busa
 32920-24FKO
112100-1100
12V NEP074

Looks like that Suzuki has not changed the part numbers between 2004 - 2006 so its a very good change that the code I already downloaded works on this ecu by just acquiring either renesas e8 or alternatively any RS232 to TTL converter and some swithches. The e8 should cost around 100-150 usd where as a D.I.Y. kit would cost around 20USD. It all depends on how familiar you are with electronics to install a microchip MAX232, 5 capasitors and 3 switches + all required wiring.

Anyhow I recommend to perform a simple test on your ecu to check that all the required components are present to enable programming. All it requires is a digital multimeter to measure some resistor values. (we have learned in the past that in some ecus not all the components are installed).

Here is a link to the testing procedure:
http://macmadigan.no-ip.com/Public/ECU/Busa32bitECU_programability_test.pdf
(Please forgive some typos, I have lost the original file somewhere).

So its starting to look good for being able to remap the Busa ECU's and starting to have things like dual maps (one for street one for nitrous) from the standard ecu by just remapping.



Offline Busa Quick

  • Post Master
  • *****
  • Posts: 1226
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #42 on: December 13, 2007, 04:38:26 PM »

  Sounds good I will try to study this some more and see if I am up to it. I do have electronics experience but, mostly I work on industrial electric equipment.



 Mark
Black and Purple 04, MY MODS: Turbo, .08 spacer, s2000 injectors, yosh cams 7.2 spring, heavy clutch springs, APE valve springs, raised rev limiter to 11,500 rpm with ignition cut only, using only stock ECM with Petrik reprogramming method,

Offline b l u e b u s a 1

  • Rider
  • ***
  • Posts: 451
  • Gender: Male
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #43 on: December 13, 2007, 04:46:54 PM »
did the testing procedure everything is in line with your readings :thumb: 

Offline Busa Quick

  • Post Master
  • *****
  • Posts: 1226
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #44 on: December 13, 2007, 09:34:40 PM »

  I just finished my testing and the readings are in the ballpark of your readings.



  :thumb: +1

 Mark
Black and Purple 04, MY MODS: Turbo, .08 spacer, s2000 injectors, yosh cams 7.2 spring, heavy clutch springs, APE valve springs, raised rev limiter to 11,500 rpm with ignition cut only, using only stock ECM with Petrik reprogramming method,

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #45 on: December 14, 2007, 12:55:01 AM »
OK,I have emailed to you guys instructions how to get the Enginuity mapping tool up and running with the K6 usa binary image.

The same information will be published here on this board too as soon as the initial feedback and answers to any key questions is included.

ps. For those guys who are interested in modifying the earlier busa ECUs I would suggest to check out www.bikeland.info. Ridgeracer may be able to help you with those as it is very much alike to ZX12 earlier ECU.
« Last Edit: December 14, 2007, 12:57:10 AM by PetriK »

Offline Got-Busa?

  • OFF TOPIC
  • Mad Post Whore
  • **********
  • Posts: 3023
  • Gender: Male
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #46 on: December 23, 2007, 10:20:55 AM »
Has the '08 model ECU been hacked yet...?
CLICK-->  *Got-Busa's "STREET BIKE"-project* <--CLICK
"WILMINGTON MILE" - 212.7 MPH!
"ARKANSAS 1/2 MILE" - 202.566 MPH!
"ARKANSAS 2KM" 232.919 MPH!
THANK YOU SHANE STUBBS @ STPI
"TEXAS MILE" -182.265 MPH stock --204.468 MPH "Brock's Performance" basic mods -- 227.2 MPH "RCC TURBO" low boost/half naked!

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #47 on: December 23, 2007, 10:48:06 AM »
Has the '08 model ECU been hacked yet...?

I dont think that anyone is working on that one. The process starts when an eager 08+ owner dremels an ecu open so that all the circuits are visible and finds out what is the processor etc. inside it. During that process the ECU will most likely get damaged so that it can not anymore be reliably used on any bike. Anyhow consider it being a donation for a good cause...

Would you be willing to donate a 08+ ECU for being dremeled open ?

ps. I dont think there is enough easily available information to make it a smooth excersise. The 2004-2007 Busa ECU is good platform for hacking as its in addition to Busa the same is used also for SV1000, Z1000, ZX6... so there is accumulating amount of knowledge about it becoming available.


Offline Got-Busa?

  • OFF TOPIC
  • Mad Post Whore
  • **********
  • Posts: 3023
  • Gender: Male
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #48 on: December 24, 2007, 09:19:07 AM »
My bike hasn't even arrived yet so I'll just have to wait for someone else to have a shot for now. 

Any way to open the ECU without damaging it...?
CLICK-->  *Got-Busa's "STREET BIKE"-project* <--CLICK
"WILMINGTON MILE" - 212.7 MPH!
"ARKANSAS 1/2 MILE" - 202.566 MPH!
"ARKANSAS 2KM" 232.919 MPH!
THANK YOU SHANE STUBBS @ STPI
"TEXAS MILE" -182.265 MPH stock --204.468 MPH "Brock's Performance" basic mods -- 227.2 MPH "RCC TURBO" low boost/half naked!

Offline PetriK

  • ECU Guru
  • Post Master
  • *****
  • Posts: 1035
  • Gender: Male
  • Where am I?
Re: hi tech guys: electronics whiz has hacked into ZX12 ECU!!!
« Reply #49 on: December 28, 2007, 07:25:11 PM »
Here you are with a first  sneakpeak of how Busa K5 and K6 models can be tweaked. To do that you need to have the ECU eprom contents which is in the BUSAK6USA.bin file. Then you need Enginuity software which you can download for free and as the last item you need the Enginuity definitions .xml file which defines the locations of various maps.

You can download the two files needed from here:
http://www.bikeland.info/petrik/Busa/BUSAK6USA.bin  -> This is the actual eprom contents of K6Busa / USA model
http://www.bikeland.info/petrik/Busa/BUSAK5.xml      -> This is the enginuity definitions file
Save both files with mouse right click and save as... to your own hard drive.

Enginuity map editor for you to download you can find from here:
http://sourceforge.net/projects/enginuity/


After installing the enginiuity you first need to make the BUSAK5.xml definition file as the active definition file. First add the BUSAK5.xml (ECU Definitions -> ECU Definitions manager -> ADD) to your active definitions file list. Then remove the other definition files from the list to avoid any confusion.

Then open the image, i.e. the BUSAK6USA.bin file. You do that by going to File -> Open image.

Now after some numbercrunching the computer is performing you should have on the left hand side a list of the maps visible for you.  I will still work on making the maps more self explanatory, but even now with this very first version there is two interesting areas to look at:
1) RPM limiters that can be adjusted well above 12000rpm
2) MSon/MSoff marking on the map names, that means that you can have map switching functionality for you Busa. e.g. one for nitrous other for street.

Have fun...

ps. I will occasionally update new files to the above links when there is significant progress...