Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: Yamaha/Moric single cylinder ecus ?? YZF R125 in mind


Guru

Status: Offline
Posts: 2338
Date:
RE: Yamaha/Moric single cylinder ecus ?? YZF R125 in mind


.txt I was referring to .dat that had not realized earlier being a std ascii crlf limited.

Resoldered the reset pin, and dont anymore get "reset line stuck" message, but now the part id is 0x0000 i.e. BDM is not communicating. Getting frustrated.

Do you guys know anyone in e.g. India who could desolder the CPU and put it in an EEPROM reader - that could be faster way in ?

I will try to source an xtal to test that option just for limiters. It has worked on several ecus in the past, this one just is so small that may not be the easiest one to swap.


__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 49
Date:

daytona in japan remap this ecu for racing, so lets hope some guru can do that too.

__________________


Veteran Member

Status: Offline
Posts: 68
Date:

Well, I'm from India...but don't have much experience in what you said...
I have experience in soldering/desoldering normal components. I have experience in programming micrococontrollers using In System interfaces. But this one is different..it's a surface mount quad package. Desoldering is not easy, plus..a reader for the quad package? And even then, the R15 ECU doesn't come cheap here like you guys got R125 ECU on eBay. But, why are you keen about India only? Why cant you do it yourself?



@Mikaspt: Daytona doesn't remap ECUs. It makes differently mapped ECUs which are expensive.

-- Edited by digislayer on Tuesday 31st of August 2010 01:19:46 AM

__________________
Sunny.


Guru

Status: Offline
Posts: 2338
Date:

Equipment mainly, for desoldering usually there is a separate soldering head that can be used. For reading - I think there is a link to a reader earlier in this head. But its soldering the chip to the reader that I see as an issue.

Anyway sometimes there are labs who are doing this kind of things as a service in countries where electronics subcontracting is high around universities. Thats why asking if you guys know any - if not then need to look into this by myself.

I am sure this ecu can be hacked and made tuneable - its just very different to what I have done in the past so its a learning curve which takes time. Like where I am today:
- Reset works
- ECU does not communicate

So after several days when reset was not working, now it suddenly works - but communications is lost. Is the interface reliable ? Have I damaged the board when opening the ecu ? Is the BDM locked out by a security algorithm ?


__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 49
Date:

There are companies that change original ecu for yamaha yzf r125 5d700 ecu in UK there is a rider that spend more them 200 but send to a companie the ecu and they change rpm limit and i think they remove retard from ignition too.
and in youtube you can see people hack this cpu in mercedes ecu.
so this is possible but maybe not with cheap reader.



__________________


Veteran Member

Status: Offline
Posts: 68
Date:

@Petrik: That reminds me! This MCU is secured, isn't it? BDM is blocked when MCU is secured! We missed this simple thing!


So, maybe we should try unsecuring. Try reading in DIAG mode, or else try reading in CO mode.

Parallely, Use the reset pin soldering for your older board(the one that you erased). Then try reading from HCS12mem using -F switch. As a next alternative, try unsecuring this older board using HCS12mem. Since it's already erased, there's nothing that you might loose anyways. If you're then able to communicate, it means unsecuring the ECU is the problem that we have.

__________________
Sunny.


Guru

Status: Offline
Posts: 2338
Date:

OK, shall try... got a spare ecu from uk today so well equipped.

This is doable I am sure, just need to find a way.


__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Newbie

Status: Offline
Posts: 4
Date:

Hello,
I read your research and perhaps i can give a tool name to read and write this MC9S12T64.
This tool called XPROGm for tmt (http://www.tmt.lt/xprogm_en.html)
This device can read and write secured MCU MC9S12D64/DJ64 but i don't know if it can work on MC9S12T64...
If it can help you...
Best regards

Xprogm.jpg

__________________


Veteran Member

Status: Offline
Posts: 68
Date:

Petrik, read this following PDF to know how to solder the wires to a secured MC9S12 board, to read it without having to remove it from the board:

http://www.autonumen.com/uploadfiles/20100408194747428.pdf


It might help you.

If none works, the only option we have is to take the chip out and read it...

__________________
Sunny.


Veteran Member

Status: Offline
Posts: 49
Date:

okey if need i can remove the cpu but this is a very complex operation, i have a friend that have machine for this kind of size chip i will talk to him.
but if the only way is remove cpu from the pcb, the goal of remap ecu for anyone do, is impossible because make this for almost riders may end with a brick ecu.
in youtube they get inside Motorola hc12 secure cpu without remove the chip.
i going to try find someone whit that kind of hardware, to see if they can hack this one with professional tools.



__________________


Newbie

Status: Offline
Posts: 4
Date:

With the XProgm, you can read and write it "in circuit", no need to desolder MCU.
The only thing i don't know is if it can work on MC9S12T64.

__________________


Guru

Status: Offline
Posts: 2338
Date:

One time reading is needed to be able to see what can be changed and give us hints how to reprogram. But lets first investigate what was presented above. The concept of setting the xtal frequency for reading the chip certainly is interesting. Need to look what are the other pins connected on those drawings on R260S manual.

Tried to order R260S - In-Circuit Programmer from resettools.com. 230usd or so, but unfortunately their weight setting was somewhat incorrect leading to 10000usd delivery cost. EMailed them. Additionally could not get the rosfar application started on my computer after trying bot 9.2 and 9.6 versions. But definately a road to investigate.


__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 2338
Date:

When reading schematics XProg looks like setting MODA/MODB and using BKGD as we are trying. Maybe MODA/MODB makes the trick.



__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 49
Date:

read my post here that i say modA and modB must be ground
i think that i put a link to a document that say that.
let me try to find that again

i can't find in this forum the text that i put about MODB and MODA put this is a link for the document.


From a core standpoint there are five pins making up the FBDM
interface. At the chip level these pins will likely be combined with other
pins.
BKGD / SI Background interface pin, which becomes the SI
(Serial data into the BDM) in SPI mode
TAGHI High byte instruction tagging pin
TAGLO Low byte instruction tagging pin
SCKBDM / SPIMODE Selects SPI interface or single wire
interface at rising edge the RESET pin, if SPI mode is select, then
this pin becomes the serial clock input
SO Serial data out of the BDM for SPI mode



-- Edited by mikaspt on Wednesday 1st of September 2010 04:51:55 PM

-- Edited by mikaspt on Wednesday 1st of September 2010 04:54:00 PM

__________________


Veteran Member

Status: Offline
Posts: 49
Date:

a document from freescale that i think help this project
[html/]http://www.freescale.com/files/microcontrollers/doc/data_sheet/9S12T64AF16V1.pdf[/html]

-- Edited by mikaspt on Wednesday 1st of September 2010 05:01:37 PM

__________________


Guru

Status: Offline
Posts: 2338
Date:

XProg MODA,B are optional.

Installed the TMT.lv device programmer software, looks very professional. Sent an email to them about T64. TMT looks a very promising manufacturer for this and alike purposes. Lets wait and hear what they say. Thanks for the link.

R260S seems to be an obsolite product, software for that programmer is not anymore updated and initial developer has closed the company (in Italy). Even though the package is now fixed to normal weight, have decided not to order this one.

Just wondering why both these programmers are using direct connection to XTAL ?



__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 49
Date:

http://www.freescale.com/files/microcontrollers/doc/data_sheet/9S12T64AF16V1.pdf

__________________


Guru

Status: Offline
Posts: 2338
Date:

I think there is something unstable in my environment too. Yesterday I got device 0x0000 but nothing about reset line. Today "reset line is stuck"... on both ecus the same.

Could be the programmer, could be the pc.

Third ecu arrived yesterday - currently unopened.



__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 2338
Date:

Hmmm....

"The resistance of the internal pull-up may be too high depending on the
speed and the load to ensure proper BDM communication. In this case
an additional external pull-up resistor must be provided."



__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 68
Date:

Petrik..yes, R260S is really obsolete. It even uses an external length wire for calbration! I just wanted you to take a look at how they're connecting extra wires to the circuit board at various points. I for one couldn't understand the logic, but thought you might understand it.


BTW, if you're ready to spend 250+ USD on a reader/flasher, why not look at P&E ? I remember seeing some other company's flasher also, one which could read/write even secured MCU. Check out "enigma mileage correction tool" too, it's a standalone reader/flasher for many MCUs including the MC9S12T64..but whatever you buy, think well before spending so much! I'd suggest you to not buy anything as of now and experiment a little more on the already opened ECUs using the tools that you already have. I'm sure it's just the "secured" status of the MCU that's causing us problems communicating via BDM.

__________________
Sunny.


Guru

Status: Offline
Posts: 2338
Date:

Yes - lets talk with our Latvian friends at TMT, they seem to have done some real hacking based on schematics posted. You could install the xprog and see the schematics they show there. Biggest difference really is that they hook something to the XTAL...

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 49
Date:

i read in somewhere that need to use 2k Ohm resistor in reset pin and in some cases in BKG pin too. try to put 2k resistor in reset pin

-- Edited by mikaspt on Wednesday 1st of September 2010 10:18:30 PM

__________________


Veteran Member

Status: Offline
Posts: 68
Date:

Check this info:

BDM is very useful as a debugger, but it takes a bit of thought

Several common possibilities for "sporadic" and "never never land":

1) Are your MODA and MODB pins tied low? BDM only works reliably if the
chip starts in Special Single Chip mode. You code (or your debugger) can
change the mode after reset, but you need to start in Special Single Chip
so that the micro doesn't take off and start executing until you tell it to.

2) Does your code enable the COP? It is disabled when you come up in
Special Single Chip. However, if you enable it and don't service it, a
reset will occur (duh). However, during this reset, the BGND line will
probably NOT be low, so the chip will start in NORMAL Single Chip mode
rather then Special Single Chip. So, BDM won't be enabled, and since you
got a reset, all your hardware breakpoints are gone.

"You may be having communication issues. Are you using a standard
development board, or one of your own design? Ensure that you have
pull-ups on the RESET and BKGD lines."


source: http://www.embeddedrelated.com/groups/68hc12/show/6646.php

__________________
Sunny.


Veteran Member

Status: Offline
Posts: 68
Date:

Petrik, try this modified T64 config file for hcs12mem. Please retry reading the MCU again using all combinations possible, with this config file. delete the old config file before copying this:

http://www.box.net/shared/mfyfoiq8cj



__________________
Sunny.


Member

Status: Offline
Posts: 19
Date:

Hello everybody

I'm an R&D engineer in embedded microprocessors, as I have a YZF 125 I also want to participate to this project.
I have a spare ECU, but as my bank account is not so wealthy theses days I was not able to buy the debug dongle.
I've read the whole thread, so as far I understand, there is some memory protection and weird reset problems.

So I try to help, as far as I can!



__________________


Veteran Member

Status: Offline
Posts: 68
Date:

Welcome splurk! Suppose I buy d ECU and dongle, which dongle do yout hink will surely work? As you can see, not all dongles work for our purpose here..

__________________
Sunny.


Member

Status: Offline
Posts: 19
Date:

Yeah I know, in first place I found the same solution than yours, but I'm definitly not happy with USB debug device, as well as for our own processor than for any other. I usually use JTAG debug port, so I have no information on BDM. I think I'm going to find some documentation on BDM debug. Also reading the full spec of the processor may give some extra information.

__________________


Veteran Member

Status: Offline
Posts: 49
Date:

Welcome dear friend splurk, any help are welcome.


__________________


Guru

Status: Offline
Posts: 2338
Date:

Welcome splurk - I am sure youll enjoy this project. Its very good food for though.

How is JTAG connected usually to a processor - is there something to be learned there ? If you send me your address I can put into a letter for you one BDM device that works with codewarrior but not with the hcs12mem. (ecuhacking@tikkari.net)

I believe that this unstability is something to do with hardware rather than configuration .dat file. This is because I am seeing "reset line stuck" message also with codewarrior. No change to situation with new .dat.



__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 68
Date:

No...I mean, did you try using HCS12mem with the new DAT, on a STOCK ECU? The one whose reset pin was not soldered I mean. Did you try using the -F switch with the new DAT file on that ECU? I changed the INITRM value in the new DAT file actually..hoping it might correct the issue in atleast one way. We can then compare the read flash again, with the old .s19 file. It might read a different area of memory now, with the new DAT.

__________________
Sunny.


Guru

Status: Offline
Posts: 2338
Date:

No - I am not getting throug the "reset pin stuck" at all now. This is the same message as no power on ecu. I can get the ecu to start up though and see that it works on diagnostics too.

There is something ongoing I do not understand...



__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 68
Date:

But you could read something from HCS12MEM before right? Why are you not able to repeat the same now?

If it is the same as ECU not powering up, try the DIAG mode trick once and see if it works...

__________________
Sunny.


Newbie

Status: Offline
Posts: 4
Date:

hi all .

I read this comment since 3 weeks ago .
The first foto of the ecu comes from a yamaha xmax , not yamaha Yzf .

the spi have a mode run or stop or wait . the reset will activate the mode run ?


__________________
hardcore will never die


Member

Status: Offline
Posts: 19
Date:

JTAG is somehow simple, the main difference remains in the lines: TDO (output), TDI (input), TCK (clock).
JTAG is accessing a TAP controller, which is a finite state machine. With TMS you control the FSM, and while you shift in data on TDI, you always get TDO shifted out.

Anyway for what I've read the BDM is something really different, as there is only one pin bidirectional for data. The behavior is more like a single line SPI than a shift in/shift out process.
I'd rather know what kind of BDM dongle you have (reference, docs), so I will try to understand what's going on with the CPU spec, I don't need the dongle if I'm not sure we can really use it with this CPU.

Also, either USB dongle or parallel one, if we find a way to control bits (the dongle may have some SDK, but not sure, or using libusb which will lead us to some reverse enginering and hard work), we are still not sure that the memory remains protected without any possibility to avoid this.
For instance, this product http://www.starchip-ic.com/html/scf320g.html is a chip with a secured mode. The idea is of course to protect the soft IP from any reverse enginering. If this is the case, getting the code may be very very difficult.

Buck67 also mentionned that the injection map was stocked in another chip. Can you please confirm this?

Edit: I'me reading the CPU datasheet. The reset pin, named RESET! (I will call it RESET_N), is a low active pin, which means that 0 state is reseting. But also, this pin is bidirectional, an internal function can put this pin to 0... maybe that explain the reset strange behavior.

For what I understand, to put the device in debug mode, here is the procedure:

RESET_N = 0 -> enables the reset
BKGD = 1 -> enables the Background Debug Mode
RESET_N = 1 -> disables the reset, latch BKGD so the CPU enters the debug mode

Concerning the secured mode: there is one, and surely the designer enabled it in order to protect the content of software. Secured CPU means that it's not possible to read/write the content of the flash. Without the backdoor key, no access is possible, but this key is probably not accessible for us.
Only way to unsecure the CPU: erasing the whole flash through BDM. Doing so will also erase the data we want to retreive.

I'm continuing my readings.



-- Edited by splurk on Friday 3rd of September 2010 10:15:07 AM

__________________


Veteran Member

Status: Offline
Posts: 68
Date:

Excellent interpretation Splurk..thanks! That must explain why the FI Diagnostic Tool(we call it FI tool here) needs an ECU reboot to set it into DIAG mode(one of the three possible modes of DIAG, CO, NORMAL. The Bike doesn't turn on when the ECU is in DIAG mode)

So I guess this is what happens:

1) The reset pin is low when the ECU power supply is turned off.
2)When we connect the FI tool and keep its "MODE" button pressed, the BKGD is probably set to 1.
3)We then have to turn the power supply on, and this is when ECU enters DIAG mode, and then we leave the MODE button of FI tool. Maybe this is when the ECU is latched in BKGD mode until power supply is reset.


And regarding secured mode, it is possible to read a secured ECU. We have dedicated flash readers in the market which can do that for us, but they don't come cheap..they're much expensive than the USB dongles that we're using. The software linked in the above posts, called "HCS12MEM" (an open source command line tool) is also supposed to be able to read secured MCUs of this type, but we need to resolve the other issues before we can confirm its capability and the necessity for the expensive flash readers.

__________________
Sunny.


Guru

Status: Offline
Posts: 2338
Date:

In busa there is external eeprom to store crude fuel map calibration etc information. in yzf r125 ecu there seems to be
- flash, i guess this is what is called calibration ram
- processor eeprom
- ram
(have not looked for external serial eeprom, so it may be there or may not).

what i read above its possible that some of the configurations could be in flash. that would make sense from fi tool point of view. i dont believe that fi tool does full memory reprogramming, rather just write some flash memory addresses.

the funny thing is that currently not even the full erase is not resetting secure state, so its possible that the usb bdm i am using is not really good for this project.

we are in the beginning of the learning curve - the breakthrough will come over the time.

edit - the flash memory backdoor we can most likely find with fi tool protocol hacking.



-- Edited by PetriK on Friday 3rd of September 2010 03:02:23 PM

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 68
Date:

Yes, even I dont think the FI tool does full memory programming. But then, this same FI tool is used for various vehicles of Yamaha, and I dont expect them all to be powered by the same ECU. Even if they're powered with the same ECU, the memory locations of configurations are bound to change, they cannot be exactly the same.

For example, it is even used with Yamaha ATVs, waterboats. So, I think it just uses some form of communication, or fixed variable names. Petrik, why don't you try hooking an oscilloscope to the FI tool's wire, when it is connected to the ECU, and see what actually is happening when it puts the ECU in DIAG mode? I dont expect a big protocol to be there, I really dont expect the MCU and FI tool to be so intelligent to use extensive protocols. Just few init signals maybe,


Also, another thing to think about is, why doesn't the ECU operate normally when it is in DIAG mode? That is, when ECU is on bike, we can start the bike in CO mode and normal mode, but when it's in DIAG mode, bike doesn't start (in case we set it into DIAG mode when the engine is running, it is immediately shut off as soon as ECU enters DIAG mode). The bike won't start until the power supply is reset and the ECU comes back to normal mode. This might probably mean that the ECU's normal routine doesn't running when in DIAG mode,..isn't it? And also, whatever values the FI tool writes in CO mode, they're permanent values..will not be erased or reset even upon switching the power supply off, which means it's written in the NVM section only.

-- Edited by digislayer on Friday 3rd of September 2010 03:20:39 PM

__________________
Sunny.


Guru

Status: Offline
Posts: 2338
Date:

yes - when have time, first need to clear out some space on the desk to set this up. Anyhow I am afraid that fi tool uses an yamaha designed comms protocol to access flash, otherwise fi tool would be a processor family specific tool.



__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 2338
Date:

Our friends at www.tmt.lt answered this about xprog. My question to other ecuhack members is: How different T64 may be to D64 ???

xprog-m work with this secured 9S12 devices :

MC9S12D64/DJ64
Masks: 0L86D, 2L86D, 2L86D, 3L86D,4L86D, 0M89C
EEPROM 1kB RD/WR

MC9S12B128/DB128/DJ128/DG128/DT128
Masks: 1L40K, 3L40K, 4L40K, 0L94R,1L59W,5L40K, 0L58S, 0L85D, 1L85D, 0L80R,1L80R, 2L80R, 3L80R
EEPROM 2kB RD/WR

MC9S12DG256/DP256/DT256/H256
Masks: 1K78X, 2K78X, 0K79X, 1K79X, 2K79X, 0L01Y
EEPROM 4kB RD/WR

MC9S12DP512
Masks: 0L00M, 1L00M, 2L00M, 3L00M, 4L00M
EEPROM 4kB RD/WR



-- Edited by PetriK on Friday 3rd of September 2010 04:19:33 PM

-- Edited by PetriK on Friday 3rd of September 2010 04:20:23 PM

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Member

Status: Offline
Posts: 19
Date:

Ok will have a look on the ECU this weekend, but I think that diag/CO Mode doesn't have anything to do with debug mode. Debug really means "I want to change embedded software or check any problem".

The FI-tool is connected to the ECU with a single pin. Where does this pin go on the board? I don't think this is SPI as SPI requires at least 2 lines (clock and data). But this is kind of asynchronous bidirectionnal serial communication.
Setting the ECU in Diag or CO mode is probably more a software execution rather than hardware, although the fact that maintaining the "diag" button before turning on the bike is doing something, and this thing is making the ECU entering a specific mode, but not debug. Maybe the backdoor key is given at this time.
Best analysis: having an oscilloscope. I want to buy one for me, but my first baby arrives soon and I have to spare all the money I can... so I'll see, if really we are stuck then why not.







__________________


Veteran Member

Status: Offline
Posts: 68
Date:

That is what even i was thinking, the FI tool might be having the backdoor key embedded. This is why I was asking Petrik to try HCS12MEM in DIAG mode. But then, if that's true, then all Moric Single cylinder ECUs of this kind must be protected with the same backdoor key. How possible is that?

And, is this possible?:
IS it possible the ECU has something else on board, additional hardware that takes care of the CLOCK pin for the FI tool? Wont SPI be possible via single wire between FI tool and ECU then?

OT: Goodluck with the baby!


@ Petrik: As far as I know, FI tool is a processor family specific tool. Yamaha uses different tools for different families. I dont expect the FI tool to contain much intelligence. Have you tried reading the FLASH and EEPROM with HCS12MEM using the new DAT file, with the ECU in DIAG mode? I want to know what happens,

__________________
Sunny.


Guru

Status: Offline
Posts: 2338
Date:

This was with new .dat file:

I am not getting throug the "reset pin stuck" at all now. This is the same message as no power on ecu. I can get the ecu to start up though and see that it works on diagnostics too.

There is something ongoing I do not understand...


Like said I have somehing unstable on my system. I am guessing its the BDM unit or something wired differently on the ecu board.

TMT asks for a special version of their unit.


What the id have this mcu? masket ?



Do we know a definitive answer to this question ??




__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Member

Status: Offline
Posts: 19
Date:

The backdoor can be also included in the software itself, I can easily imagine this behavior
Fi-Diag -> Write new CO value
ECU -> receiving command, executing by disabling the secured memory, writing, reenabling secured memory.

In that case no backdoor is needed from the Fi-Diag. And the Fi-Diag gives access to only one location of the memory.
It also means that the Fi-Diag doesn't put the ECU in unsecured mode, as the ECU itself can remove the security, write, then enable again.

I think we have to concentrate on the BDM port. There are also a lot of mode for debug. Petrik I'm going to prepare a test case. In fact the ECU debug mode depends on the state of external pins at startup. All we need is a voltmeter.

__________________


Veteran Member

Status: Offline
Posts: 68
Date:

PetriK wrote:

This was with new .dat file:

I am not getting throug the "reset pin stuck" at all now. This is the same message as no power on ecu. I can get the ecu to start up though and see that it works on diagnostics too.

There is something ongoing I do not understand...


Like said I have somehing unstable on my system. I am guessing its the BDM unit or something wired differently on the ecu board.

TMT asks for a special version of their unit.


What the id have this mcu? masket ?



Do we know a definitive answer to this question ??




So you're not getting the connection using HCS12MEM like before? Are you trying it on the board that you soldered the reset pin by any chance?


ANd for TMT, send this to them:

MC9S12T64MPK16,

Part Number:          MC9S12T64
Mask Set Number:   L42M
PARTID:                   $422X


Also, give them this link: http://www.freescale.com/files/microcontrollers/doc/data_sheet/9S12T64AF16V1.pdf

If possible, I highly recommend all of the members in this discussion to read the above link. It's very informative.

EDIT: Just discovered there's another mask set too for this family of MCUs, "0L24K".
Better check your ECU board to see if these numbers are written/marked anywhere. Try to find atleast an year marking on the board.


-- Edited by digislayer on Saturday 4th of September 2010 06:49:53 PM

__________________
Sunny.


Veteran Member

Status: Offline
Posts: 49
Date:

this is the cpu and masks that i know
MC9S12T64, Mask 1L86C.
MC9S12T64, Mask 0L86C.
MC9S12T64, Mask 0L42M.
MC9S12T64, Mask 0L24K.


__________________


Veteran Member

Status: Offline
Posts: 68
Date:

As per my understanding, mask set changes with with every revision of the board. So Petrik, check the revision number on your board, and look out for any of the above masks on the board..

__________________
Sunny.


Member

Status: Offline
Posts: 19
Date:

I have some news.

A friend just received a modified ECU for his YZF 125. This part is prepared by a professional company, so don't expect them to give us any trick.

But at least, if you take a look at the photo, you see that some new silicon as been put at the rear of the ECU, meaning that they used the BDM port. That a good new.

I think this company is based in Germany. I don't speak german at all. But If we have a spare ECU, what can be easily done is sending the ECU for reprogramming, then open it and get the code out of the board. That would help us a lot, as the only remaining steps for us would be to make a full erase of the ECU (removing the security this way) and then sending this reprogrammed firmware (though we would also reprogram it as we want once we have the code).
Also the Fi-Diag is not working anymore with this ECU, making my assumption that it was software based true. This ECU is removing the limiter.
But before this, we need to get successfull communication with the board, even if we can't read memory, making a full erase in that case will be good.

p1120411.jpg


__________________


Veteran Member

Status: Offline
Posts: 68
Date:

Splurk, if the FI tool isn't working anymore, it's bad news. Because, we can no longer check the working state of the various sensors of the bike, we'll not know if any mechanism in the bike failed, we dont get to read any error codes anymore, we cant even adjust basic settings like CO values.

I think this is not the right way of programming. Because, Yamaha already sells a Daytona race mapped ECU here, with the limiter lifted very high. And as far as I know, the FI tool works with it.


Plus also, one more doubt. Suppose if we get a spare ECU programmed by them also, what is the guarantee that they wont secure the ECU before sending it back to us? How can we be sure the ECU will be unsecured when it reaches us? How can we even be sure that they unsecured the ECU first of all before reprogramming it? There are tools which can read/write flash and EEPROM of even unsecured HCS12 chips, using in circuit programming. The XPROG-m for example! Maybe they used such a tool and thus didn't have to unsecure the ECU?





-- Edited by digislayer on Sunday 5th of September 2010 09:11:56 AM

__________________
Sunny.


Guru

Status: Offline
Posts: 2338
Date:

Removing limiter can sometimes also mean changing the xtal for higher rpm limit. In that case it is possible that the FI tool does not anymore work as the serial frequency is also offset.

I have three ecus for this project:
- completely opened for tracing, erased non functioning
- BDM exposed and wired up, other than that working with FI Diagnostics tool
- Completely original, not opened, no bdm





__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 68
Date:

Petrik, can you verify if the XTAL frequency change can be accomplished by using the area that the Germans opened on the ECU? I think it's better you dont use the 3rd ECU as yet.


Which ECU did you modify the reset pin on? You did some soldering and tinkering with reset pin of some ECU, right? Which one is it? I badly hope you somehow get a connection again using HCS12MEM and read the FLASH again...I think I might have some leads here by converting the S19 file to bin...


Did the talks progress anymore with TMT? I found that there are many clones of TMT available for a lot cheaper with all required authorizations, but they may not work with T64! :(

__________________
Sunny.
«First  <  1 2 3 4 5 6  >  Last»  | Page of 6  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard