Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: TL1000R Joins the 16 bit BDM Denso Club


Guru

Status: Offline
Posts: 963
Date:
TL1000R Joins the 16 bit BDM Denso Club


Here is a photo of a TLR ECU showing the standard 8 pin BDM port that we all know and love.

tlr_ecu.jpg

More details as they become available.

__________________


Member

Status: Offline
Posts: 15
Date:

And the same ECU stripped down to the circuit card.



__________________


Member

Status: Offline
Posts: 15
Date:

So to Connect via the BDM port I require the following:
P&E: Cable 16/32 and Prog16Z
Enginuity Map editing software
Interface cable 8pin to 10pin (From Bikeland.info)
As this is all very new to me any tips wpould be appreciated.
My main goal with this is to raise the rev limit and anything else I can learn a long the way will be a plus

__________________


Guru

Status: Offline
Posts: 963
Date:

That about covers most of what you will need except for a power supply. To just read the chip all you will need is any old 12V supply or 12V battery. To program it however you need a very accurate 11.6 to 12.4 V supply

You might be able to buy the parts to build the interface cable locally. The ZX-12 thread as detailed instructions on how to make it.

If you have any questions at all just ask. Better safe than sorry. If you want you can email me at info@bikeland.info

-- Edited by RidgeRacer at 19:45, 2007-12-09

__________________


Member

Status: Offline
Posts: 15
Date:

Thanks
the power supply is the easy part the rest I will work on
Now best I go and do an intro

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 10:36:31 AM

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 10:38:20 AM

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 10:37:48 AM

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 10:39:58 AM

__________________


Member

Status: Offline
Posts: 15
Date:

Well I followed RidgeRacers "How-TO Program an ECU using PROG16Z" to the letter and uploaded the 2 files. I'll email them to RidgeRacer and get him to post them.
Now I should go back and do step one and get the inputs before rushing of to step 4   

__________________


Member

Status: Offline
Posts: 15
Date:

Any one have info or specs on the following IC
8 leg PM27M2 and it looks like it has a TI logo on it


__________________


Guru

Status: Offline
Posts: 963
Date:

It looks like a dual op amp

http://www.ortodoxism.ro/datasheets/texasinstruments/tlc27m2.pdf

I would check the pinout to what your seeing to be sure.

__________________


Member

Status: Offline
Posts: 15
Date:

RR thanks for that
I'll check
Now back to tracing the input and out puts on this board

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 10:40:37 AM

__________________


Guru

Status: Offline
Posts: 963
Date:

Good job.

BTW, just for the record did you use pin 29 of the wire harness connector to apply programming voltage?



__________________


Veteran Member

Status: Offline
Posts: 74
Date:

Yes, pin 29 just like the Busa...

-- Edited by ffaspector on Saturday 17th of October 2009 10:41:50 AM

__________________


Member

Status: Offline
Posts: 15
Date:

I have finally finished the pin in/out for the ECU I stripped (Pn 32920-02FA0, 112100-0290, 12V NEP021). ECU pin numbers are as per the TL1000R service manual,

CPU pins are as per Drawing MC68HC916R1. If any of the pin in/outs dont make sense against the code let me know as I have a book of hand sketches. This is definitely not my forte but it was interesting.   

 

ECU pin           Bike Loom Connection             Board label       CPU pin-label

34 Pin Plug

1                      Ignition Coil 1                                   IG1                  5     CTS10A

2                      Ignition Coil 2                                   IG2                  6     CTS10B

-                       Ignition Coil Fault                                                     10   CTD5

3                      Not Connected                                _                      No Circuit
4                      Not Connected                                _                      No Circuit

5                      Front (1) Primary injector                 #11                  1     CTS14A

-                       Front (1) Primary injector Fault                                128 CTS16A

6                      Rear (2) Primary injector                  #21                  129 CTS14B

-                       Rear (2) Primary injector Fault                                 127 CTS16B

7                      Tachometer signal                             TAC                86   SIZ0/PE6

8                      Vacuum Solenoid Valve                    SOL                 102 DATA8/PG0

9                      Fuel Pump Relay                               FP                    87   AS/PE5

10                    Ground connection                            E01                  -

11                    Not Connected                                 _                      No Circuit

12                    Not Connected                                 _                      No Circuit

13                    Not Connected Comps not inst      SOL1               101 DATA9/PG1

14                    Front (1) Secondary injector              #12                  7    CTS8A

-                       Front (1) Secondary injector Fault                            43  ADDR14/PA3

15                    Rear (2) Secondary injector               #22                  6    CTS8B

-                       Rear (2) Secondary injector Fault                             44  ADDR15/PA4

16                    Clutch Lever                                      CLT                 31  ADDR3/PB0

17                    +12v                                                  +B                   -

18                    Ground connection                             E02                  -

19                    Not Connected                                  _                      No Circuit

20                    Not Connected                                  _                      No Circuit

21                    Not Connected                                  _                      No Circuit

22                    Not Connected Comps not inst       SSW                 No Circuit

23                    Start input                                          STA                 33  ADDR5/PB2

24                    Dealer Mode Select                           TS                    35  ADDR6/PB3

25                    External ground (MapAB select?)      MS                  36  ADDR7?PB4

26                    Ground connection Coil 1&2              E03                  -

27                    Not Connected                                  _                      No Circuit

28                    Not Connected                                  _                      No Circuit

29                    Not Connected Vpp                          VFP                

30                    Not Connected                                  FCCP              88  DS/PE4

31                    Not Connected                                  ST                    52  TXDA/PMC7 &

                                                                                                          53  RXDA/PMC6

32                    Not Connected                                 _                      No Circuit

33                    Not Connected                                 _                      No Circuit

34                    Neutral                                              NT                   37  ADDR8/PB5

 

26 Pin Plug

35                    Ground Connection                            E1                    -

36                    Crank Position Sensor                        N+                   8   CTS6B

37                    Camshaft Position Sensor                   G+                   9   CTS6A

38                    Injector Voltage Compensation           VM                  20  AN4/PADA4

39                    Throttle Position Sensor                      VTA                24  AN0/PADA0

40                    Intake Air Pressure                             PM                  23  AN1/PADA1

41                    VCC                                                  VCC                _

42                    Not Connected                                  _                      No Circuit

43                    Crank Position Sensor                         N-                  8   CTS6B

44                    Camshaft Position Sensor                    G-                    9   CTS6A

45                    Intake Air Temp                                  THA                21  AN3/PADA3

46                    Engine Coolant Temp                          THW               See IC301

47                    Ambient Air Pressure                          PA                   See IC301

48                    Not Connected Comps not inst        CS3                 81  IRQ2/PF2

49                    Yoshi Box Connector                          CS1                 38  ADDR9/PB6

50                    Yoshi Box Connector                          CS2                 39  ADDR10/PB7

51                    Not Connected Comps not installed  KNK               32  ADDR4/PB1

52                    To Instrument Cluster                          TECH             54  TXDB/PMC5 &

                                                                                                          55  RXDB/PMC4

53                    Gear Position                                       GP                   19  AN5/PADA5

54                    Ground Connection                              E2                    -

55                    Yoshi Box Connector                           COV1              See IC301

56                    Yoshi Box Connector                           COV2              See IC301

57                    Yoshi Box Connector                           COV3              22  AN2/PADA2

58                    Not Connected Comps not installed  COV4              See IC301

59                    Tip over Sensor                                     DON               See IC301

60                    Ignition Switch (Immobilizer?)                AT                   See IC301

 

IC301 Pin in/out

IC301 is a Toshiba 4052BF

Pin       Connection

1          ECU 46 THW Engine Coolant Temp

2          ECU 47 PA Ambient Air Pressure

3          CPU 15 AN7/PADA7

4          ECU 59 DON Tip over Sensor

5          ECU 60 AT Ignition Switch

9          CPU 89 PE3

10        CPU 90 AVEC/PE2

11        ECU 59 COV4 Not Connected

12        No circuit

13        CPU 16 AN6/PADA6

14        ECU 55 COV1 Yoshi Box

15        ECU 56 COV2 Yoshi Box

 

 

Now I need a crash course on reading code.


__________________


Guru

Status: Offline
Posts: 963
Date:

ffaspector wrote:

Also, do you have a part number for the connector to solder on the BDM port so I can use your cable on the other two ECUs?


DigiKey.com partnumber is 1 - 609-2415-ND

mfg is FCI
mfg # is
69167-108HLF

 



__________________


Guru

Status: Offline
Posts: 963
Date:

Gjim, thanks for the pinout. Looks like you've been busy. After a casual read it looks good given what I know about the other ECUs.

BTW guys feel free to start a new thread like "ECU pinouts" etc. with this kind of information. You have a whole forum all to yourselves and it will make it easier for someone (or me given my memory) who comes along six months from now to dig up info.

As for reading code do you have access to something like IDApro? All you really need is a text editor like Notepad++ but IDApro would make it go a lot faster.

Your first step now that you have traced out all the CPU pins is to define them in software. Each CPU pin has one or more address locations associated with it. For example you traced out Ignition Coil 1 to CTS10A on the CPU. If you look that up in the datasheet you'll see that CTS10A's data register is at address 0xF950.

Now if you search out the code for that value you can put a comment next to every place you find it that says. "Ignition coil 1" Same is true for all the CTS timer pins and all the AN analog input pins. Of course in reality it is a little more complicated than that but if your serious about learning to read the code let me know. If you have IDA I already have all the pin addresses defined and can send you an idc file you can import with that info. They are named by their CPU names; AN1, AN2, CTS10B, etc. but given the info you have above you could quickly rename them to their ECU specific function



__________________


Guru

Status: Offline
Posts: 963
Date:

See this thread for info on the operation of IC301

-- Edited by RidgeRacer at 15:20, 2007-12-29

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 10:43:31 AM

__________________


Member

Status: Offline
Posts: 15
Date:

RR good point on new threads it will make it easier to find info later if we arrange it a little better as we go.
I do intend to have a go at trying to read the code as there are some traits in this ECU that show on the dyno as real timing/fueling issues. In all its not an overly bad Map taking into account the constraints of local regulations and the need for reliability that the original maps would have had to meet. (Remember its a production item so its really just a compromise)

I have IDA 4.9 (freeware) I baulked at the cost of the commercial version as I didnt know if it was really necessary. I stopped my self from looking further into the code side of this project or I would have never finished the pin in/outs.


__________________


Guru

Status: Offline
Posts: 963
Date:

I don't think the freeware version 4.9 supports the ECU's 68hc16 processor.

You might be able to find cracked version on the net somewhere, not that I condone that kind of behavior ;)

__________________


Member

Status: Offline
Posts: 15
Date:

Slightly off track for the current stage of this project but food for thought never the less

This a dyno chart of a TLR from a few years back, if you ignore the horrible dip in 5000 to 5500 rpm range the thing I find most interesting is the way the power plateaus out at about 9000 and continues until it hits the limiter at around 9800. In my experience this engine should make power far in excess of 9000rpm. (it was quite a good overall stock package for its day) I think when we identify the Ignition timing maps we'll find they retard the timing from 9000rpm. This means just raising the rev limiter won't help this engine without some work on the timing as well.
From a production/manufacturing point of view putting, this type of timing advance map will give the rider the feeling that the bike is running out of puff prior to it bouncing of the limiter and therefore encourages earlier gear changes.
Note Bouncing of an engine limiter (soft=fuel or hard=spark) is bad for it's health.

__________________
pad


Member

Status: Offline
Posts: 12
Date:


Rasing the rev limiter has a drastic effect on engine life for a TL.
ECU pin 25 can be disconnected to disable the soft rev limiter and give you another 500 rpm.
Beyond that you should take a close look at your valve springs, and start replacing a few engine components
Litre pistons.
Stronger rods
And a willingness to rebuild the motor frequently
The cases are reported to fail at around 11700


25 External ground Soft Rev Limiter Disable 36 ADDR7?PB4



__________________


Guru

Status: Offline
Posts: 963
Date:

I checked it out in the software and pin 25 is indeed a classic MS or Map select. It even sets the exact same byte and bit flag as the Busa and ZX-12 ECUs  (5,Z,#4)


ROM:00003528                 brclr   5, Z, #4, loc_3534
ROM:0000352E                 ldx     #8C1Ah
ROM:00003532                 bra     loc_3538
ROM:00003534 ; ---------------------------------------------------------------------------
ROM:00003534
ROM:00003534 loc_3534:                               ; CODE XREF: ROM:00003528j
ROM:00003534                 ldx     #8058h
ROM:00003538
ROM:00003538 loc_3538:                               ; CODE XREF: ROM:00003532j
ROM:00003538                 ldd     66h, Z
ROM:0000353C                 jsr     sub_7920



As I said this is classic map select. This segment of code uses map at 8C1A or 8058 depending on pin 25. However I also found a section of code with a pin 25 selectable Ignition limit that works as you described...

ROM:00002DAE                 ldd     11Ch, Z         ; Crank pulse period; Lower = Faster
ROM:00002DB2                 cpd     word_AB82       ; 11,200 rpm
ROM:00002DB6                 bls     RevLimit6       ; brif crank faster than 11,200; disable ign and ??
ROM:00002DB8                 cpd     word_AB80       ; 11,000 rpm
ROM:00002DBC                 bls     RevLimit7       ; brif crank faster than 11,000; disable ign
ROM:00002DBE                 brset   SysStat_5, Z, #SysStat5_Use_B_Map, RevLimit3 ; brif Map Select B
ROM:00002DBE                                         ;
ROM:00002DC4
ROM:00002DC4         Map Select A
ROM:00002DC4
ROM:00002DC4                 cpd     word_AB7E       ; 10,000 rpm
ROM:00002DC8                 bhi     RevLimit1       ; brif crank slower than 10,000
ROM:00002DC8                                         ;
ROM:00002DCA                 bclr    6, Z, #1        ; enable ??
ROM:00002DCE                 bset    6, Z, #2        ; disable ign
ROM:00002DD2                 bra     loc_2E0C        ; done
ROM:00002DD4 ; ---------------------------------------------------------------------------
ROM:00002DD4
ROM:00002DD4 RevLimit1:                              ; CODE XREF: ROM:00002DC8j
ROM:00002DD4                 cpd     word_AB7C       ; 9800 rpm
ROM:00002DD8                 bls     RevLimit2       ; brif faster than 9800
ROM:00002DD8                                         ;
ROM:00002DDA                 bclr    6, Z, #2        ; enable ign
ROM:00002DDE
ROM:00002DDE RevLimit2:                              ; CODE XREF: ROM:00002DD8j
ROM:00002DDE                 bclr    6, Z, #1        ; enable ??
ROM:00002DE2                 bra     loc_2E0C        ; done
ROM:00002DE4 ; ---------------------------------------------------------------------------
ROM:00002DE4
ROM:00002DE4         Map Select B
ROM:00002DE4
ROM:00002DE4
ROM:00002DE4 RevLimit3:                              ; CODE XREF: ROM:00002DBEj
ROM:00002DE4                 cpd     word_ABE8       ; 10,400 rpm
ROM:00002DE8                 bhi     RevLimit4       ; brif crank slower than 10,400 rpm
ROM:00002DE8                                         ;
ROM:00002DEA                 bclr    6, Z, #1        ; enable ??
ROM:00002DEE                 bset    6, Z, #2        ; diable ign
ROM:00002DF2                 bra     loc_2E0C        ; done
ROM:00002DF4 ; ---------------------------------------------------------------------------
ROM:00002DF4
ROM:00002DF4 RevLimit4:                              ; CODE XREF: ROM:00002DE8j
ROM:00002DF4                 cpd     word_ABE6       ; 10,200 rpm
ROM:00002DF8                 bls     RevLimit5       ; brif crank faster than 10,200
ROM:00002DF8                                         ;
ROM:00002DFA                 bclr    6, Z, #2        ; enable ign
ROM:00002DFE
ROM:00002DFE RevLimit5:                              ; CODE XREF: ROM:00002DF8j
ROM:00002DFE                 bclr    6, Z, #1        ; enable ??
ROM:00002E02                 bra     loc_2E0C        ; done
ROM:00002E04 ; ---------------------------------------------------------------------------
ROM:00002E04
ROM:00002E04 RevLimit6:                              ; CODE XREF: ROM:00002DB6j
ROM:00002E04                 bset    6, Z, #1        ; disable ??
ROM:00002E08
ROM:00002E08 RevLimit7:                              ; CODE XREF: ROM:00002DBCj
ROM:00002E08                 bset    6, Z, #2        ; disable ign
ROM:00002E0C
ROM:00002E0C loc_2E0C:                               ; CODE XREF: ROM:00002DD2j


For those of you who don't read code for fun what it says is  


crankspeed > 11,200 ignition disabled
11,000 < crankspeed < 11,200 no change
crankspeed < 11,000 ignition enabled

If map A (pin 25 grounded)
crankspeed > 10,000 ignition diabled
9800 < crankspeed < 10,000 no change
crankspeed < 9800 ignition enabled

If map B (pin 25 open)
crankspeed > 10,400 ignition diabled
10,200 < crankspeed < 10,400 no change
crankspeed < 10,200 ignition enabled

So pin 25 is the Map Select Pin, its just that there is an A/B ign limit. You'll still be able to use the A/B map feature for maps, you'll just have to set both the A and B rev limit values the same.

I'll update the Enginuity definitions to reflect this new info


Technical note: While the above limit routine modifies 6, Z, #1 I could find no other code in the ECU that ever test that bit flag so it's function is undefined ??



-- Edited by RidgeRacer at 21:42, 2007-12-30

__________________


Veteran Member

Status: Offline
Posts: 74
Date:



-- Edited by ffaspector on Saturday 17th of October 2009 10:48:56 AM

__________________


Guru

Status: Offline
Posts: 963
Date:

Sorry to hear your having problems with the BDM. I've never really had any problems like that. On the other hand come to thing of it I do all my printing off of network printers and don't have anything connected to my LPT port or an printer drivers installed.

Good news on the successful rev limit test

__________________
pad


Member

Status: Offline
Posts: 12
Date:

6, Z, #1 should be the soft limiter which reportedly cuts fuel .

Pin 25 is going to be handy for  bikes that need to pass a yearly tests or as a granny mode switch

This Motorola assembler is doing my head in , to many years on other architectures.

 



__________________
pad


Member

Status: Offline
Posts: 12
Date:

Hi
Im trying to work out what baud rate SCIB is running at , doze anyone now what the system clock frequency is

Thanks



__________________


Guru

Status: Offline
Posts: 963
Date:

That is a good question. All these 16 bit densos have a 4Mhz crystal but as I'm sure you've found out the CPU has a PLL clock synthesizer and can be programmed for a number of freqs above that.

I followed the clock setup and compared it to the 68hc916R3 datasheet and came up with 24.5MHz which seemed really odd and didn't seem to work with anything else like calculating RPM and baud rates.

The only thing I could figure out is that the chip is very close, but not exactly like the R3. During the PLL clock setup it has you set some bytes that in the data sheet are labeled Reserved.

The system frequency that gave me nice round RPM values and an even baud rate of 600 was 32Mhz.

BTW the zx-12 actually set the SCIB baud rate twice. Once at reset to 600 then later to 19,200

Hope that helps



__________________
pad


Member

Status: Offline
Posts: 12
Date:

I have had a data analyzer on SCIB temp and ECU fault codes on taco
And it looks like 7200 bps.
Il hook up a cro and take sum readings .
And see if I can confirm your system clock speed.


__________________
pad


Member

Status: Offline
Posts: 12
Date:

I may be barking up the wrong tree hear so could sumone pleas chk this.

Looking at SCIB I am seeing it setup as 7200 bps 8 data bits 1 stop bit.
If I work backwards from that I det a system clock frequency of 14.75mhz
On a cro im seeing a bit as .1425 ms witch would give me 7018 bps and a system clock of 14.37 mhz.

So will 14.5 mhz work with other parts of the code


__________________


Newbie

Status: Offline
Posts: 1
Date:

Hi Gjim,

What is this cleaner fluid that you were using?

I've tried several varieties of cleaner fluid, but no effect.



__________________
Oszi
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard