Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: Renesas M16C/29 Keihin ECU


Senior Member

Status: Offline
Posts: 350
Date:
Renesas M16C/29 Keihin ECU


Hello.

Got an Keihin ECU with a Renesas M30291FATHP MCU, from what i can see the processor got Serial/Parallel/CAN Interfaces. Hardware Manual is in link below.... 

http://documentation.renesas.com/eng/products/mpumcu/rej09b0101_16c29hm.pdf

K-Line and Serial tested so far.

Appreciate all help i can get!



-- Edited by Twice on Saturday 24th of March 2012 08:41:50 PM

Attachments
__________________


Veteran Member

Status: Offline
Posts: 54
Date:
RE: Help! Renesas M16C Read/Write? K-Line/CAN? Manual inside...


I have probably opened a similar ecu. Iam looking for the same details



__________________

cjsducati@hotmail.co.uk

 



Senior Member

Status: Offline
Posts: 350
Date:
Help! Renesas M16C/29 Keihin ECU


What type of Ecu have you opened? But since there is no other interfaces than CAN/Serial/I2C (as NBD/AUD/BDM) We cannot get password from backdoor. Will be to guess :)



-- Edited by Twice on Saturday 10th of March 2012 11:19:28 PM

__________________


Veteran Member

Status: Offline
Posts: 54
Date:
RE: Help! Renesas M16C Read/Write? Renesas E8a? Manual inside...


Its a suzuki 250 .  Are you saying a tool that can connect to a 32r could possibly connect to this ? If so i have such tool



__________________

cjsducati@hotmail.co.uk

 



Senior Member

Status: Offline
Posts: 350
Date:
Renesas M16C/29 Keihin ECU


Our usual FTDI TTL 232 Cable works with a couple of different flashers for this MCU, given we have the ID Code....

Do you got the M16C ecu still? Willing to do a test with FDT and see what happens? :) Is your ecu from a fuel injected rmz?



-- Edited by Twice on Saturday 24th of March 2012 08:50:00 PM

__________________


Veteran Member

Status: Offline
Posts: 54
Date:
RE: Help! Renesas M16C Read/Write? Renesas E8a? Manual inside...


Twice wrote:

Renesas E8a Interface should be able to read this processor with correct password, same as M32R.
Or any other tool that can connect via Renesas Serial Protocol D/M32R

Do you got the M16C ecu still? Willing to do a test with FDT and see what happens? :)
Is your ecu from a fuel injected rmz?


yes its a fuel injected RMZ. I have the ecu stripped. If you can mail me the connection pins i could hook up my tool for a test.

 



__________________

cjsducati@hotmail.co.uk

 



Senior Member

Status: Offline
Posts: 350
Date:
Renesas M16C/29 Keihin ECU


Send me an e-mail with pictures and model year, 250/450.
Should be same pinout.



-- Edited by Twice on Saturday 24th of March 2012 08:53:01 PM

__________________


Newbie

Status: Offline
Posts: 2
Date:
RE: Help! Renesas M16C Read/Write? Renesas E8a? Manual inside...


step test wrote:

Its a suzuki 250 .  Are you saying a tool that can connect to a 32r could possibly connect to this ? If so i have such tool


 What tool for M32r You have? thank you for ansver my mail audrius.raz(eta)gmail.com



__________________


Senior Member

Status: Offline
Posts: 350
Date:
Renesas M16C/29 Keihin ECU


A competition rider needs this for this spring. If someone can offer some help or password and .xml i gladly pay a resonable sum to get that done.



-- Edited by Twice on Saturday 24th of March 2012 08:52:15 PM

__________________


Senior Member

Status: Offline
Posts: 180
Date:
Help! Renesas M16C Read/Write? Renesas E8a? Manual inside...


According to the description in the data-it should work with a serial interface.
Do you have an open ECU?
Tells you the key?
What kind of bike is it?

 
 
 
 
 


-- Edited by Brix on Sunday 4th of March 2012 08:10:35 PM

__________________

http://motorsport-brix.de/



Senior Member

Status: Offline
Posts: 350
Date:
Renesas M16C/29 Keihin ECU


Thanks for your reply!

Have one stripped/slughtered ECU, did not take power as it should, my supply showed it hardly pulled half power. Told customer he need to order a new test ECU for me asap, now i know whats inside and where the pads are so i can make a small hole without ripping parts off. I cannot use FDT on M16 Version MCU i got without their E8a. So looks like i need some custom stuff here.

And then we have the password offcourse...

I cut the chip of the scrapped ecu though, but way too small for me to solder all stuff for serialprogramming without it done on the PCB....

Customer donor bike is a Suzuki LTR 450 Quadracer, same processors are in RMZ, LTZ, KXF and in Husaberg 570 i think.



-- Edited by Twice on Saturday 24th of March 2012 08:56:06 PM

__________________


Senior Member

Status: Offline
Posts: 180
Date:
Help! Renesas M16C Read/Write? Renesas E8a? Manual inside...


Have you tried the EE interface and access FDT?
If you have pictures, you can send me please.
The MX Tuner of Yoshimura can adjust ignition and injection and at Yoshi-plug-connected but needs extra power the bike.
Did you have a wiring diagram?

send to me

 
 
 
 
 



-- Edited by Brix on Monday 5th of March 2012 01:20:04 PM



-- Edited by Brix on Monday 5th of March 2012 01:20:26 PM



-- Edited by Brix on Tuesday 6th of March 2012 02:10:09 PM

__________________

http://motorsport-brix.de/



Senior Member

Status: Offline
Posts: 350
Date:
Renesas M16C/29 Keihin ECU


Have not had a chance to try with EE interface yet, waiting on new sacrifice ECU :)

The MX Tuner work more like Yoshbox for gsxr's i understand. And many tuner i have asked about it says the range is too low. They max out the limited change range, (set there for people not be able to **** upp their egine totally).

And i am also very curious to if there are fuel and ignition limiters like in gsxr's. Probably not that big but maybe in some gears if they got independant maps.... Dont think MX Tuner can alter that either...



-- Edited by Twice on Saturday 24th of March 2012 08:57:26 PM

__________________


Senior Member

Status: Offline
Posts: 350
Date:

Have now done some more testing.
Connecting K-Line and EE gives me connection and i can view live data, (how correct they are dont know yet)...

Tried with TuneECU, with EE interface. Program accepts interface and com ports. But cannot connect to ECU. Proably no M16C in TuneECU...
So to proceed with K-Line i will need to terminal program the commands myself, cant find any more softwares to try...

Back to serial programming, but i have NOT yet located FWE pin in the connector, anyone have any ideas here? Else it will be cutting down to the CNVss TP on the PCB, but that means that always needs to be done to write also :( But, i have got 10 "unused" pins in Connector.



-- Edited by Twice on Saturday 24th of March 2012 08:59:39 PM

__________________


Senior Member

Status: Offline
Posts: 350
Date:
RE: Help! Renesas M16C/29 Keihin ECU


WTF!

Ripped off the connector and cleaned off the pins/solder points. The 10 unused pins in ecu connector
are in fact not connected to anything. One of them are going about 1cm away then just ends.

And also, when cleaning of more potting i see there are more points on PCB marked for components but they
where never mounted. Get me thinking if this LTR ECU is a (first version) of the RMZ ECU.?
They are interchangeable, Vortex uses same model for both, so pinout and sensors should match, (exept missing yosh etc.)?

When reading through K-Line, how do they set it in "boot mode" without FWE? Or is it not needed?

__________________


Senior Member

Status: Offline
Posts: 180
Date:

By K-Line is FWE NO need.



__________________

http://motorsport-brix.de/



Senior Member

Status: Offline
Posts: 180
Date:

Suzuki say -LT-Z 450 have a 16 bit ECU !



__________________

http://motorsport-brix.de/



Senior Member

Status: Offline
Posts: 350
Date:
Renesas M16C/29 Keihin ECU


M16C Series got both 16/32-bit MCU's, think mine is 16 Indeed. Why? Does it matter?
LTZ450 does not excicst LTZ400 - DRZ model ATV. LTR 450 - RMZ model ATV.



-- Edited by Twice on Saturday 24th of March 2012 09:01:04 PM

__________________


Senior Member

Status: Offline
Posts: 180
Date:
RE: Help! Renesas M16C/29 Keihin ECU


OHHHHHHHHHHH Sorry-LT-R 450 but the same ECU.

 



Attachments
__________________

http://motorsport-brix.de/



Senior Member

Status: Offline
Posts: 350
Date:

Yes man, you are right. LTZ 400 2009- uses same connector and pinout, but on parts diagram they look abit unlike.
You got a picture of an LTZ 400 ECU? Probably just mapping changes that differs...

But problem to read/write still remains :)

__________________


Senior Member

Status: Offline
Posts: 350
Date:

Firstly, big thanks to PSYCHE!


So finally we are making some progress!

With TONS of help from PSYCHE here on the forum. We have been sitting most nights for a week
and testing different circuits and modes pinouts etc. Flashing softwares etc. Cross ref. manuals and so on.

And it now looks like we have found the correct schematic combination for putting ecu in boot mode and connect properly .
So now it accept baud rates and connects for reading, so now its the password left and then we will probably have the complete .bin file.

Attached photo is on test harness and it looks like a pack of noodles before we got there! :)



Attachments
__________________


Senior Member

Status: Offline
Posts: 350
Date:

Anyone knows any Passwords (ID Code) for M32R Keihin ECU, or a bin so i can look it up?

Suzuki Denso did not work, neither blanks etc. hehe:)

__________________


Senior Member

Status: Offline
Posts: 350
Date:
Renesas M16C/29 Keihin ECU


Software is now running about 28 million codes per 24hours. According to some documentation i read hopefully only capitol letters are used. Threw in 00 and FF also...

Has been rolling for about a week now and looks good so far, when hitting correct ID it writes the code to a logfile. Problem is that if its last combination it will take about 350 days if i remember correctly. HAHA. Will let it roll for kicks on an old laptop.

I hope Keihin implemented "security acces" and some kind of reading command in their KWP version of K-Line. But probably not... 



-- Edited by Twice on Monday 9th of April 2012 09:54:55 PM

__________________
Jan


Newbie

Status: Offline
Posts: 1
Date:

Hi twice

Nice work, did you made any progress?
I have the same ecu mcu combination, only my'n is from a ktm 250 dirtbike.
But I'm stuck for the moment, I got my self a galletto v53 to try and reprogram it but I don't seem to get any connection through the serial tx rx port.

Any advice from a more advanced person would be helpfull.

I allready found how to put it in bootmode.


__________________


Senior Member

Status: Offline
Posts: 350
Date:

You can read/write with a simple ftdi usb ttl 5v cable.
Are a couple of softwares out there to read/write with user input password to check connection and negotiate baud etc.
BUT, the password is still a issue, no backdoor like AUD/NDB/BDM on the m16c mcu...
So you will have to get the password from the factory or continue my brute force :)
I just let it run for a couple of weeks, then the rider got another atv landing on him after a jump, so my project ended there...

Happy to help if i can, would be satisfying to see this one cracked finally hehe. My e-mail is on my profile.

__________________


Member

Status: Offline
Posts: 5
Date:

I'm working on cracking this ecu. i sent you an email.

__________________


Senior Member

Status: Offline
Posts: 144
Date:

If you want any advice, let me know!

:)

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Senior Member

Status: Offline
Posts: 350
Date:

suzukiecuhacker wrote:

I'm working on cracking this ecu. i sent you an email.


Back at you :) some software and documentation.

Also, contact Psyche!
He knows more than me about it, he helped me A LOT with that nasty m16c...



__________________


Member

Status: Offline
Posts: 5
Date:

thanks, i could use some help lol. where should i start? i think i know what pins to use but what tools and programs or software should i get?



__________________


Member

Status: Offline
Posts: 5
Date:

did you get my email? 



__________________


Senior Member

Status: Offline
Posts: 144
Date:

suzukiecuhacker are you refering to me or twice?
If it is me, then no i havent received any emails.

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Member

Status: Offline
Posts: 5
Date:

sorry i meant twice



__________________


Senior Member

Status: Offline
Posts: 350
Date:

KTM SX-F 350, 2013 i think.
So if anyone knows how to break into theese ****ers let me know...



-- Edited by Twice on Friday 6th of December 2013 10:03:23 PM

Attachments
__________________
Page 1 of 1  sorted by
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard