Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: How the CPU handles the outputs?


Senior Member

Status: Offline
Posts: 144
Date:
How the CPU handles the outputs?


Hi there,

I am disassembling some bins from 600/750 newer and older bikes. These use the SH7052 and SH7054 CPUs. 

I have come to a point that i need to find out in the disassembly how the CPU hanldes the outputs of the ECU. Not ignition coils and injectors but STVA, EXCVA, pair valves and stuff like that! I need to learn these for my own knowledge and for a project that i am going to do! I am going to put one of these ECUs on an oilcooled suzuki bike. Currently i have done major progress on a 02H10 ecu. I have found compensation maps for fuel and ignition and trying to figure out the other outputs in order to disable them!

So are there any idc files from any 7052 cpus? I can use them for reference. The GSXR 1000 is a good reference point! I can figure out unknown maps on that ECU also but if anyone has a working idc file i would like to have it. I dont want to reinvent the wheel!

 

Thank you in advance!

 

P.S.: Petrik or Ridgeracer are here?



__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Guru

Status: Offline
Posts: 963
Date:

The STVA and EXCVA are both closed loop systems. They have sensors that feed back their position to the ECU. Figure out which analog channels are used by each then track down every instance of those analog channels and you will find the associated software. The way they work is there are 3D maps that are target positions. This is compared with the current position as measured by the analog sensor. The ecu determines which direction the motor has to move to get closer to the target and pulses the motor.

Of course the easiest way to do all this is to totally strip the potting off the circuit board and trace out each output to a particular cpu port pin. Once you have the port pin for the PAIR valve it is no problem to find every instance of it in the software and how the ecu uses it.

__________________


Senior Member

Status: Offline
Posts: 144
Date:

Hey RR,

I know that if i remove the potting i will find the pins of the CPU, but i was hoping if anyone had done that already and could provide some info like what ports are used to read the sensors. Then i can trace them on the software and emulate the code on HEW! Photos are good too but a list with the CPU pins would be great! I want to use the ECUs on a project and i dont want to remove all the potting! :/

Thank you RR, you are the one who started all this!
Padelis

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Guru

Status: Offline
Posts: 963
Date:

The 7052 only has one set of analog inputs. (Check the datasheet for the addresses).
Use IDA to find where they are stored in RAM.
Use the AUD port to read those addresses to get a baseline.
Now twist two 1k resistors together. Hook one end to sensor 5V supply and the other end to ground. The twisted center will be 2.5V. Connect that to TPS pin on the harness connector.
Rescan the analog ram addresses with AUD.
The bytes that changed are the TPS channel.
You now have the addr for TPS and can search for every instance of TPS in IDA

Here is an example


            AN_0 TPS  BATT IAT  AN_4 ECT  AN_6 AN_7 AN_8  02  SAP  AN11 IAP  AN13 AN14 AN15 
Idle        0201 0002 0001 03FF 03FF 03FF 01FC 026A 0001 0002 03FF 03FF 03FF 03FB 0200 0200
TPS(2.5V)     0200 01FE 0001 03FF 03FF 03FF 01FC 0264 0001 0002 03FF 03FF 03FF 03FB 0200 0200
IAP(2.5V)    0200 0002 0000 03FF 03FF 03FF 01FC 0264 0000 0002 03FF 03FF 0210 03FB 0200 0200
SAP(2.617)    0200 0002 0001 03FF 03FF 03FF 01FC 0263 0000 0002 0210 03FF 03FF 03FB 0200 0200
02 (2.52)    0200 0003 0001 03FF 03FF 03FF 01FC 0261 0000 01FE 03FF 03FF 03FF 03FB 0200 0200
IAT (4.39)    0200 0002 0000 0376 03FF 03FF 01FC 0261 0000 0002 03FF 03FF 03FF 03FB 0200 0200
ECT (4.39)    0200 0002 0000 03FF 03FF 0376 01FC 0261 0001 0002 03FF 03FF 03FF 03FB 0200 0200




__________________


Senior Member

Status: Offline
Posts: 144
Date:

You are a god!!!

Thank you RR! I will find all the instances and then i have to figure out how i will disable some outputs and their FI errors! It is getting more and more interesting!

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Senior Member

Status: Offline
Posts: 350
Date:

Thanks Ridge, most helpfull. Thougt to give PAIR/STVA/LAMDA/EXCVA a try to find switches and mapping. (7054 02H00)
Managed to find Immobilizer function and turn it off working 100% on EU bike. It's gettin fun when you starting to understand :)

__________________


Senior Member

Status: Offline
Posts: 144
Date:

Twice, we are working on the same ecu at the moment! ;) I found that switch also! It is getting more and more interesting! I have found maps for STVA and EXCVA and i think that i am pretty close to the Lambda maps!

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Senior Member

Status: Offline
Posts: 350
Date:

Great news, i will get to it soon again. Gonna give M16C Keihin some more tries first... Will probably have some questions for you :)
Bike i got ran with Yosh system and no lambda, owner had cut pin "30 - HO2 Sensor control selector" and resistor in plug.
Also without EXCVA valve, and no fault codes. So some stuff to start with when i get back to it :)

Have not looked into that deeper but the selector wire, might be where lambda switch is set...

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard