Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: CPU16 Serial BDM interface


Veteran Member

Status: Offline
Posts: 66
Date:
CPU16 Serial BDM interface


Not sure if there's much interest out there, but for anybody who's been frustrated with the CPU16 PD parallel port BDM interface, or simply doesn't want to spend $500 for a P&E USB BDM, there is an alternative... A serial BDM interface.

This particular interface uses a 14pin PIC 16f1825 MCU to interface the BDM port to a USB/TTL UART, so you can easily get all the parts for under $10. The serial port runs at 115k and can dump a 68HC16R3 96k rom in IntelHex format in just over a minute. The 16f1825 also has a bootloader, so the firmware can easily be upgraded anytime...

The PIC MCU does all the real work, so the only other software you really need to get started is an ANSI compatible terminal program like Putty.

Full BDM transaction error checking is also implemented, so you know if you're getting valid data. This initial version does not yet offer write capability per se, but does have the ability to manually send any BDM command.

The use of PIC hardware in the interface design is an interim step, as the software will eventually be ported to the  Arduino UNO for a more universal availability. Here are some pics of what it looks like...

 



Attachments
__________________


Veteran Member

Status: Offline
Posts: 66
Date:

In an effort to simplify building the PIC BDM interface, this latest "mini-BDM" version uses a pre-made SOIC/DIP adapter. No more PCBs to make; just solder and you're done. This version's also a lot smaller. Here are a couple of pics:



-- Edited by mr_hollywood on Friday 21st of February 2014 03:03:25 PM

Attachments
__________________


Guru

Status: Offline
Posts: 963
Date:

Cool project. It would be nice if you get it to flash the MCU. Besides being expensive the P&E Micro units have a tendency to fail. They have a Gate Array Logic (GAL) chip in them that seems susceptible to static shock or something. I'm on my fourth GAL chip but I use mine more than the average person.

__________________


Newbie

Status: Offline
Posts: 3
Date:

Nice project! I'm interested in this as I was planning to do something similar myself. I just bought a spare ECU for my TL1000R and I don't have a BDM interface at the moment. I am happy to assist in the development (maybe porting to Arduino?) if it's possible, my daily job is software/embedded systems in the heavy automotive industry.

__________________


Senior Member

Status: Offline
Posts: 144
Date:

Hi NatoN,

I already sell a BDM solution for arduino. But since you own a TL1000R, as i do, i have a solution that enables you to reflash it from the main connector without opening the ECU.

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Newbie

Status: Offline
Posts: 3
Date:

Hello psyche, I have previously followed your progress in the ECU thread at TLZone. I checked your website recently but could only see Arduino AUD software package for Renesas MCUs. Could you provide more info about the software you have for the 16-bit TLR ECUs?

__________________


Senior Member

Status: Offline
Posts: 144
Date:

I havent put that in my site because i never believed that there was a big demand for it.
The BDM Arduino software works just like the AUD Arduino software.
But i also have a serial programmer software for the TL1000R. With that you can read/reflash the maps from the YoshBox connector of your bike. Just like in the newer bikes.
If you want further info you can send me an email. There is no reason to "hijack" this thread with my products.

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Veteran Member

Status: Offline
Posts: 66
Date:

But you just did...



-- Edited by mr_hollywood on Saturday 8th of March 2014 12:51:42 AM

__________________


Newbie

Status: Offline
Posts: 3
Date:

Well, lets get back on topic then. Are you planning to implement full write functionality on the PIC or are you soon moving over to Arduino? Is this going to be a product that you will be selling or are you making the code available?

__________________


Veteran Member

Status: Offline
Posts: 66
Date:

Hi NatoN,

Looks like the Arduino port will be on the backburner for a while. I haven't had time to work on it and the PIC mini-BDM hardware is just so inexpensive...

I'm not looking to sell these per se; I just wanted to give the community a decent and affordable set of tools for working with the CPU16 MCUs. The initial mini-BDM 'Reader' firmware is complete at version 1.1 with the addition of self-test diagnostics and some minor changes to the 'Manual BDM command' user interface. Code for the 1825 bootloader and CPU16 firmware will be shared, but can't be uploaded to the forum (images only)...  

That being said, work has already started on firmware for a MC68HC916R tool that will provide full read/erase/write functionality to the 32k flash modules and the 2k BE flash. Here's a screen shot of the UI:

68HC916R mini-BDM.jpg

As you can tell, this software isn't designed for the average rider who just wants to upload maps and tweaks at the click of a button, but rather as a tool for those with a better understanding the MCU and its internals. This version is still a work in progress, as I haven't yet received a flashable ECU to test with...

Not sure what version MCU your bike has, bit I'd be happy to help you out if I can. Just drop me an email...


Regards,



Attachments
__________________


Senior Member

Status: Offline
Posts: 144
Date:

There is no reason to reflash the beflash module, only the modules that contain maps.

I am not trying to show off or anything like that, but there is no need to add "more than necessary" in your BDM implementation, refering to the reflash of the Beflash module. Keep it simple because even if the mini-BDM is targeted for those with better understanding of MCUs, ECUs and all that, people that dont have the technical knowledge on that, will also buy it and construct it. People keep doing that.

Just a small advice... :)

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Veteran Member

Status: Offline
Posts: 66
Date:

Hi Psyche,

We've had this discussion before have we not? Well I guess I'm on formal notice not to complain when the hoards of inept 16bit hackers stone me to death with bricked ECUs...

In the meantime, we'll have to agree to disagree. There are a multitude of ways to fry an ECU and the BDM programmer is at the end of the list. It is not my job to protect people from themselves. That's the work of government (sorry, I just had to)!!! Just because some fool finds a way to set himself on fire with gasoline (petrol for our friends across the pond), doesn't mean we have to stop selling it!!!

Seriously though, there is a very good reason for being able to rewrite the BE Flash. I'm sure you've noticed that the K1 GSX-R actually boots into that area. I wouldn't be at all surprised to find a bootloader in there. It's actually the perfect place!!! Some generous soul in the community might want to find and improve that code, or rewrite it with a more universal protocol, but you can't do that if you don't have the tools. That's what I'm trying to help with...

These MCUs are fast becoming obsolete, and there aren't that many of us left using them. In the meantime, it would be nice if we could all continue to foster the spirit of sharing and cooperation on which the forum was founded.

And that's all I have to say about that...   

 
 
 
 


__________________


Senior Member

Status: Offline
Posts: 144
Date:

mr_hollywood wrote:

Hi Psyche,

We've had this discussion before have we not? Well I guess I'm on formal notice not to complain when the hoards of inept 16bit hackers stone me to death with bricked ECUs...

In the meantime, we'll have to agree to disagree. There are a multitude of ways to fry an ECU and the BDM programmer is at the end of the list. It is not my job to protect people from themselves. That's the work of government (sorry, I just had to)!!! Just because some fool finds a way to set himself on fire with gasoline (petrol for our friends across the pond), doesn't mean we have to stop selling it!!!

Seriously though, there is a very good reason for being able to rewrite the BE Flash. I'm sure you've noticed that the K1 GSX-R actually boots into that area. I wouldn't be at all surprised to find a bootloader in there. It's actually the perfect place!!! Some generous soul in the community might want to find and improve that code, or rewrite it with a more universal protocol, but you can't do that if you don't have the tools. That's what I'm trying to help with...

These MCUs are fast becoming obsolete, and there aren't that many of us left using them. In the meantime, it would be nice if we could all continue to foster the spirit of sharing and cooperation on which the forum was founded.

And that's all I have to say about that...   

 
 
 
 

 

You mentioned gasoline and fire, and a couple hours ago i found out that there is a leak in my car! Scary!!!

As i said before there is no reason to reflash the beflash. The beflash indeed contains the bootloader as i have mentioned in another thread in this forum.
I know that it is going to sound like i am advertising... but my product is based on that OEM bootloader. All the 16 bit reflashable ECUs boot from the bootloader, the issue is which ECUs support the bootloader hardware-wise. For example the zx12 and a version of the Hayabusa doesnt support it, meaning that the bootloader is in there and actually works but the pcb doesnt have the required components populated. 
Rewriting the beflash module is not a solution. Reflash it with a different bootloader? That sounds like reinventing the wheel, notch the ECU, reflash a different bootloader and then use it! Why? I believe that it is a lot better to spend the time to reverse engineer the OEM bootloader and protocol, write the slave bootloader in asm and make it work with all these ECUs. At least this is what i did. The hours i spent on this cant be counted and i stopped being a generous soul by the time that i saw people gaining money from mine and others' generousity. I dont know if there is anyone generous enough on this forum to do this work. I know that i sound bad but there is a reason that a few people say that this forum is dead...
Not meaning to offend anyone here. :)



__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Member

Status: Offline
Posts: 21
Date:

I'd like to see a show of hands who is actually still playing with these 16 bit ecu's these days. I'd be surprised if the list was double figures.

I feel that even though at this point in time these old ecu's might not be popular, I can see things coming back around full circle eventually and there will be renewed interest just like there is with classic cars.
It would be nice if when that day comes around people can stumble across the forum and find all the information they need.





__________________


Guru

Status: Offline
Posts: 963
Date:

I flash between 10-20 a year, though it has been dropping off. The problem with these bikes is they aren't making them any more and there are a finite number of them out there. The guys I flash for are using salvage engines and putting them in micro sprint race cars.

If you need any help with this project let me know. My P&E Micro cable just crapped out again only this time it took out the LPT port on my computer as well.

I have a box load of 16 bit ZX-12 and Busa ECUs if you need one to test flash with.



-- Edited by RidgeRacer on Friday 14th of March 2014 03:47:07 PM

__________________


Veteran Member

Status: Offline
Posts: 66
Date:

Thanks for the kind offer RidgeRacer!!! I've got a 35F30 coming in any day now and if it turns out to not have a 916, I may just take you up on the offer...

In the meantime, let me know if you think of any functionality that might be nice to have in the interface. I thought of adding a feature to allow loading BDM command word macros. This would make it much easier to preconfigure the MCU for any specific test/config scenario...

Didn't have as much time as expected to work on the project this week, but did manage to make the R/W byte and Manual BDM commands a little more user friendly. I'll keep at it...

 

PS: Does P&E have a decent guarantee or do you have to keep buying these?



-- Edited by mr_hollywood on Friday 14th of March 2014 08:15:10 PM

__________________


Guru

Status: Offline
Posts: 963
Date:

I've had it for 5 years so its out of any warranty. It is actually a Gate Array Logic (GAL) chip that keeps crapping out from static electricity or something. Its socketed so its easy to replace just a little pricey at $30 each. Plus it always seems to fail when I'm doing an ecu for a racer who I promised one day turn around.

I don't know how your dump / read commands are formatted but what I've found useful is a dump to the display of 16 bytes from the same address every second or so. I will point it to the Analog channels RAM address then as I apply voltage to the various harness pins for TPS IAT, IAP, etc I can see which analog ram values change for which pin and determine which address is assigned to which analog pin. Saves a lot of time.



__________________


Veteran Member

Status: Offline
Posts: 66
Date:

How about something like this? This is an actual screen shot of 'monitoring' the ADC module. The top line is the address LSB and the bottom line is the actual data. The display is a little busy, but the data's all there...

 

  68HC916R mini-BDM monitor.jpg          68HC916R mini-BDM manual.jpg

Also added a shot of the revamped Manual BDM command send screen. The first 4 digits are the BDM command sent, and the 5 digits following the slash are the 'reply' from the MCU...

 



Attachments
__________________


Veteran Member

Status: Offline
Posts: 66
Date:

Hi gents,

Any recommendations on a decent 68HC(9)16 assembler? Anyone out there seen any 916 code for memory-resident flash/erase routines?

 

Thanks!



__________________


Senior Member

Status: Offline
Posts: 144
Date:

Cosmic IDEA is nice, but i had the best results with the original Metrowerks HC16 Suite. Not sold anymore though....
For the routines i doubt that you will find something that might work out there. I had to write my own from scratch.

__________________

For your DIY or Professional tuning needs be sure to check out
PVTech ECU Research & Development



Guru

Status: Offline
Posts: 963
Date:

mr_hollywood wrote:

Hi gents,

Any recommendations on a decent 68HC(9)16 assembler? Anyone out there seen any 916 code for memory-resident flash/erase routines?

 

Thanks!


 Yeah CosmicSoftware.com. Actually I believe their evaluation version (free!) is good forever as long as your resulting bin is not larger than 4k which should be plenty for a flash kernel.

For a flash example if you can find someone with prog16z it has an 'algorithms' folder which has files (.16p) for each hc16 variant. Each file contains a list of commands and an  s19 section which is a flash kernel.



__________________


Veteran Member

Status: Offline
Posts: 66
Date:

Thanks for the recommendations gents!!!

Two quick questions:

    Do you gents typically reset the serial eeprom (yoshbox) settings when flashing?

    Are all the bike ECUs you've seen so far all encased in epoxy? I'm considering the possibility of swapping MCUs as a last resort...

I'm currently working on a front-end for the mini-BDM to offload the more complex tasks to the PC. I'll be posting pics soon.  

 

Thanks!!!   



-- Edited by mr_hollywood on Sunday 30th of March 2014 03:59:23 PM

__________________


Guru

Status: Offline
Posts: 963
Date:

The ECUs I flash are going back on the same bike they came off of so I do not reset the factory trim values in the NVRAM. The only reason I would reset them is if I were putting the ECU on a different bike.

All the Denso ECUs with 6816 MCUs that I have seen are epoxied to the PCB. I don't see any way to remove the old MCU with out destroying the ecu.



__________________


Veteran Member

Status: Offline
Posts: 66
Date:
Denso 16bit 68HC916 OBD interface


Hi guys,

I've been way overdue in updating this thread, but better late than never...

All work on the USB/serial mini-BDM was suspended in late 2014 following the discovery that most of the Denso 69HC916 based motorcycle ECUs were equipped with MCU bootloaders and OBD K-line circuitry...

This interface did away with the need to "notch" the ECU, purchase expensive BDM interfaces and re-assemble ROM segments into one 96k bin file. It also opened the door to a quick and easy method of uploading custom code to the ECU for testing and development. You can read more about this in the "OBD (bootloader) utilities" section of my site:
     https://sites.google.com/site/mrhollywoodk3/home

Since the initial release the OBD flash tool for the GSX-R 750, its use has extended to the 16bit GSX-R600, GSX-R1000 and Hayabusas. The tool has also been ported to the 16bit Yamaha TDM900 and testing is underway with the TL1000R...

In order to facilitate a non-intrusive (no "notching") method of testing other Denso 16bit ECUs, development has now begun on a tool that can scan an ECU for the necessary parameters via the OBD port. Here's sneak peek of the GUI:

            idHack.jpg

Looks familiar eh?


Cheers!!!     



-- Edited by mr_hollywood on Friday 18th of March 2016 09:03:37 PM

__________________


Veteran Member

Status: Offline
Posts: 26
Date:
RE: CPU16 Serial BDM interface


very nice work

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard