Members Login
Username 
 
Password 
    Remember Me  
Post Info TOPIC: Preliminary look at the zx-6 ecu


Guru

Status: Offline
Posts: 960
Date:
Preliminary look at the zx-6 ecu


Don posted this in the welcome thread. I thought it would be good to move it over here and start a ZX-6 forum

Right now, I have an ECU from a 2003/2004 Kawasaki ZX636 cut apart and a bunch of the silicone removed. I have found the ECU and the part number.

The 2003/2004 Kawasaki zx636 ECU has a CPU part # of 64F7052F40. There is also an unpopulated surface mount connector pad with 12 pins. It looks like it has a couple traces that go to the CPU. I believe the crystal is 10 MHz.

I'll try to get some decent photos and get them posted.





__________________


Guru

Status: Offline
Posts: 960
Date:

Do these ECUs say Nippon Denso on the outside anywhere? Someone told me they might be Mitsubishi.

The actual part number on the CPU probably won't be much help. They are usually private labeled parts. For instance the ZX-12 CPU has some Denso part number on it that you won't find anywhere on the internet but the CPU is actually a MC68HC16R1 which you can find all kinds of data sheets and info about.

To identify the cpu we will first need to figure out the package type, identify the easy pins like power, and ground, etc. and then start comparing against manufacturers web sites.



-- Edited by RidgeRacer at 16:37, 2006-12-29

__________________
Don


Veteran Member

Status: Offline
Posts: 39
Date:

The 2003 through 2006 Kawasaki 636 ECUs are definately Denso units. They have a label right on them that says Denso. I do have a couple ZX10 ECUs here (1 2005 and 1 2006 ECU). They are definately made by Mitsubishi.


The processor for the 03/04 ZX636 ECU is a square package with 52 pins down each of the four sides. The dimensions of the processor from the outside of the pins is 1.170" square.



__________________


Guru

Status: Offline
Posts: 960
Date:

So 64F7052F40 is the only number on the CPU?

There isn't a number that starts with 'D' ?



__________________


Member

Status: Offline
Posts: 5
Date:

Are there any photo of ZX-6 ECU for upload?
It will be interesting because my ecu has the 64F7052F40 too.





__________________
www.infomayor.com


Guru

Status: Offline
Posts: 960
Date:

I do not have a photo of a ZX-6 ECU board. Maybe Don does.

In case you missed it Don, dgmcan posted a pic of his ECU which he says has the same ECU part number as yours, 64F7052F40.

/download.spark?ID=72592&forumID=99460&abKey=fb7901c961b83461969847507f28e57b

this one also looks like the same physical package as yours, 52 pins per side also know as an FP208A package. This pic also shows a 12 pin unstuffed connector next to the CPU. It looks like if we identify this CPU then we could hack to ECUs for the price of one.

Do either one of you think you could take an ohm meter and use it as a continuity tester and measure each of the 208 pins to ground and record what you find.  If we can identify which pins are ground, which pins are the crystal etc. then we can use that like a fingerprint to compare to all the FP208A CPUs till we find a match. That is how I identified my CPU



Chances are very good that once we identify the chip we can use that 12 pin port to talk to the CPU and download its code and reprogram it.


__________________


Guru

Status: Offline
Posts: 960
Date:

I'm 95% sure I have identified the chip shown above labled 64F7052F40. It is a Hitachi / Renesas  HD64F7052F40.

Why I think that is the chip:

Part numbers are almost identical.
Both are 208 pin quad flat packs
Both are Microcontrollers

Looking at this pin out diagram and comparing it to photo above I find that the crystal in the photo is very close to the crystal pins in the diagram. Also in the diagram where I see power pins Vss Vcc I see bypass filter caps with thick traces leading to the same area.


hd64f7052_pin_out.jpg

Of course it would be nice if one of you could check the black pins marked Vss are connected to ground with an ohm meter to be 100% sure.

Here are the specs...

Series   SH7052
part      HD64F7052F40
ROM/Flash   256k
RAM         12k
Voltage   3.3V
A/D      10bit x 16 channels
package   FP-208


Here is the HD64F7052 Datasheet









__________________


Guru

Status: Offline
Posts: 960
Date:

I forgot to mention the most important part. The 256k of on board flash IS re-programmable in circuit. Which means you can remap it or change the code. smile


The SH7052F/SH7053F/SH7054F is an F-ZTAT (Flexible Zero Turn-Around Time) version
with flash memory as its on-chip ROM. Flash memory programs can be written with a
programmer that supports SH7052F/SH7053F/SH7054F programming, and the flash memory can
also be programmed and erased by software. This allows reprogramming to be carried out by the
user with the chip mounted on a board.


-- Edited by RidgeRacer at 23:00, 2007-04-23

__________________


Member

Status: Offline
Posts: 5
Date:

This Weekend I will check the black pins to be sure that it could be the same CPU.
The photo show with clearity that crystal pins go to the Xtal, and 168 y 169 go to the external port connector.

Thanks for you post Ridgeracer.....


__________________
www.infomayor.com


Member

Status: Offline
Posts: 5
Date:

Hi again.

The CPU is the SH7052 CHIP.
VSS, PVCC2, PVCC1, VCC, and XTAL is confirmed.

VSS PIN 12,21,25,34,44,55,76,81,97,117,125,133,143,160,176,185,196,207 confirmed
PVCC2/PVCC1 pin 10,32,42,74,95,115,141,158,174,194,205 confirmed
VCC pin 19,27,79,123,131,183 confirmed
XTAL pin 24,26 confirmed

The connector CN501 from right to left is:

1.- PVCC
2.- VSS
3.- AUDCK
4.- AUDSYNC
5.- AUDATA3
6.- AUDATA2
7.- AUDATA1
8.- AUDATA0
9.- UBCTRG
10.- AUDMD
11.- HTxD (CAN BUS) I don`t know why there aren`t the HRxD signal too.
12.- AUDRST


Now, I must find the interface to read and write internal flash.



__________________
www.infomayor.com


Guru

Status: Offline
Posts: 2338
Date:

Hi,

Long time since any updates on this thread... I am working to open a Busa 2006 ecu and that seemed to have alike CN501 connector - so its possible that its also a AUD device that could be flashed with www.renesas.com/e8a. That would be nice as some sites in internet indicated that the price for older version of e8 was only around 125e/150usd and the new e8a is supposedly even less expensive.

Any progress from you guys with zx-6 ecu ?

Rgds,PetriK

-- Edited by PetriK at 16:36, 2007-10-24

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 80
Date:

Hi, I've just started work on hacking an ECU for a Suzuki SV1000 ... it too has the Hitachi 7052F40 chip, and it too has 12 connections at CN501 ... so I'm keen to see if you can pull code and data out of it.
Cheers,
MarkW

__________________


Veteran Member

Status: Offline
Posts: 80
Date:

I can confirm that the 12 pins for AUD on the SV1000 ECU connect exactly the same as described above for ZX6.

__________________


Guru

Status: Offline
Posts: 2338
Date:

So far I have found out the following:

There is two ways to access 7052 ecu to flash it.
- AUD connector, but unfortunately the equipment costs around 2000usd and according to the specification one can not read the full flash - its a non supported command according to Renesas. Anyway programming using AUD should be easy. Also debugging and tracing the ram area should be doable. The product for AUD is called Renesas e10e with embedded workshop software.
- Serial connector which I traced to be connected to the harness connector. With renesas CPU you can use serial connector for erasing and flashing in boot mode or reading, erasing and flashing in user mode. Boot mode can be initialized for all the processors, but the user mode can only be initialized if required microcode is installed. We really do not want to start with Boot Mode as the first thing that does is to erase the flash before installing the boot mode microkernel. The Renesas product for serial connectivity is e8a with FDT (flash development toolkit) software. Also one could also use a simple RS232 to TTL hardware signal level converter like MAX232 chip there.

So so far it looks like that its very easy to flash at least the busa ecu, but finding out the way of getting the code out from the 7052 seems to be difficult. Some of the cars (EVO 7) use 7052 too. What I read from one discussion related to those is that they use AUD for transferring the microkernel to the ram(or flash) and then just use the user mode for downloading the software. The required microkernel sourcecode is available as part of the FDT - but that requires hw/sw to access the AUD connection. Well AUD is really for debugging, so maybe it would be possible either to build or otherwise find a cheaper device just for putting the microkernel code in the processor.

I am hoping that someone could find a solution for getting the code out... other than hardwiring the processor to become an EPROM and reading it in 40pin EPROM mode - which really is a last resort to me.

What have you found out ? Do you too have the serial lines connected to the harness wiring ?

Busa32bitPCB-programming_signals.JPG

Busa32BitConnectorPins.jpg

-- Edited by PetriK at 07:24, 2007-11-11

-- Edited by PetriK at 07:27, 2007-11-11

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 80
Date:

section 17 of the datasheet for the 7052 describes the protocols/timing for reading and writing via the AUD ... looks simple enough, for reading you can specify the address to 32 bits ... not sure I see a need to buy anything special here - it should be possible to build something cheap that toggles the sync line, provides a clock, puts addresses on the data lines and reads bits back off the data lines no?

not sure though how the software and hardware protection might interfere with this ... I've only just started to read the 919 page manual ...

__________________


Veteran Member

Status: Offline
Posts: 80
Date:

oops, I see this is RAM monitor mode

__________________


Guru

Status: Offline
Posts: 2338
Date:

Edited this afer reading your 2nd reply...

I read those pages too and it looked fairly simple, but unfortunatly far beyond my skills. The only thing I am concerned with AUD appriache is that at Renesas says that they implemented the e10a to access only ram address area (FFFFxxxx). I hope this to be a software limitation for copyright reasons - but one does not find out unless tries first.

Anyway there may be a way around this - copy the flash block to ram for access. That should be doable. Alternatively we could try to just send the microkernel to the ram area and start the execution from a ram address. That way the FDT software could read the flash memory contents.

E.g. page 184 (Appendix A) onwards on this (alike processor):
http://macmadigan.no-ip.com/Public/ECU/renesas_chip_programming_volume_AUDrelated_e502066_sh7055.pdf

Btw. I have 7086 RSK (experiment board from Renesas) with e8a (150usd/kit includikng programmer). That too is SH-2 processor so maybe that kind of environment could be used for writing the software you suggest.



-- Edited by PetriK at 06:35, 2007-11-12

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Veteran Member

Status: Offline
Posts: 80
Date:

I'm hoping that the limitation to addresses FFFFxxxx with the e10a is purely due to the software.

In the 7052 it looks like RAM is at FFFF8000..FFFFAFFF, so if the e10a can access FFFFxxxx then it can access addresses outside the RAM area (i.e. FFFF0000..FFFF7FFF & FFFFB000...FFFFFFFF) even though there may be nothing there to access.

Further, the datasheet advises against using the AUD to write to a ROM address immediately after an ATU (advanced timer unit) register write cycle ... this would seem to imply that the AUD can be used for writing to ROM (but not after an ATU write), and if it can write then it should also be able to read ...?

I guess the only way to find out is going to be to try it and see.

I'm thinking along the lines of a PIC (or my latest favourite ... the Parallax Propeller) to handle the comms at the AUD ...

__________________


Guru

Status: Offline
Posts: 2338
Date:


I also only started about 1.5 months ago and most of the time went to dig
out relevant documents and understand e.g. programming modes etc. Now I have basic understanding what could work, but far away from finding a solution. The most recent alternative is just to wire the processor as an EPROM to download the code from it in the EPROM mode - but then I can not be sure
that my 2005 ECU code is exactly the same as the 2006 ECU which I have
opened. Anyway according to the information from Renesas that would be the suggested method of reading the flash contents.

The hardware manual, the AUD document and then trying out FDT software tools were the keys for me. Understanding that FDT requires User mode microkernel was really a big discovery - then additionally trying out the boot mode serial programming with FDT with Renesas RSK7086 experimental board was another interesting thing to learn in practise how things work. Watch out with FDT in the boot mode as it really erases the ERPOM.

There is additionally a 7052 based EVO 7 code available in internet. I managed to dissassemble that with IdaPRO just to see what the code looks
like.That especially helped to understand the boot and interrupt vectors table in the beginning of the code.

Reflashing through the serial lines is really easy and supported the
processor 7052 automatically so writing is a no brainer.The biggest problem seems to be to get the flash contents out of the flash.  I see three options to get the contents out (as said already):
- AUD ram mode, copy segments to ram or possibly use the PIC solution you described
- Downloading user mode microkernel and use FDT to read the Flash content
- Find a backdoor in the software as part of the serial protocol for dash
data

My philosophy is to really share everything over internet for everyone to contribute and learn, exept the copyrighted documents and software so maybe all the information exhange could happen on this board ? Lets continue this - should we ask RR to open a separate thread under topic
"7052 based Denso ECUs with AUD" ?



__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom



Guru

Status: Offline
Posts: 960
Date:

That sounds like a good idea considering all the different bike models it would cover. Consider it done.

__________________


Guru

Status: Offline
Posts: 2338
Date:

Posted some documents and initial ideas to this new discussion area:

http://www.activeboard.com/forum.spark?forumID=99460&subForumID=401478&p=2


-- Edited by PetriK at 12:44, 2007-11-12

__________________

When asking a question, you can also consider posting it to facebook:

http://www.facebook.com/ecueditorcom

Don


Veteran Member

Status: Offline
Posts: 39
Date:

RidgeRacer,
Is there any way I can call you to discuss a few things? I have used the 636 Kawasaki Kit Racing ECU many times and I now have 1 or two 05/06 racing ECUs that don't work properly. I also have the programming cable and tuning software. I also have several of the standard 05/06 ECUs that I can open up. I'd like to see what code is different between the 2 units, if any. The racing ECUs don't generally need the antitheft resistors and that sort of stuff to run properly, so I believe there is a difference. I'm not sure that I have the software/programming skills to complete all of the required tasks to do what I have in mind and I wanted to talk to you directly before I even got started with this project. I'm much more in tune with the hardware end of things, but I'd love to learn more about the programming end of things. This project may force me to learn programming, finally. Please email me at don@guhlmotors.com to let me know if/when I can call you. Thanks!

__________________


Guru

Status: Offline
Posts: 960
Date:

Some one pointed out to me that we kind of left this thread hanging. I guess I posting the actual map files from the 03/04 ZX-6 answered the question of IF it could be done but not how.

The 32bit ZX-6 ECUs are just like the 32bit Denso GSXRs and Hayabusa and can be downloaded the same way using the AUD port. See the Hayabusa and 7052 sections for details.

__________________


Member

Status: Offline
Posts: 5
Date:

has anyone managed to map the "unused pins" for use of programming in the 03/04?
Or maybe Petrik you could ask your 'local hacker for the pins he used for his z1000 ecu?

kind regards

gavin

-- Edited by zx6r_gav at 07:42, 2008-11-14

__________________


Newbie

Status: Offline
Posts: 3
Date:

hello I have a little problem i have lost my kawasaki zx6r's (2008) key, and i would like to start it somehow, how can I disable the immo

__________________


Newbie

Status: Offline
Posts: 2
Date:

Please guts help!!!

I bought Kawasaki kit ecu for my 2003 zx-6r and the I/F cable from Kawasaki that is needed to program the ecu. Cant figure out where the god damn wires should to the ecu plug. Does anybody have pinout for the kit ecu (2part no. 21175-0009 or the original ecu 21175-1096). I have to dyno the ecu tomorrow and race on the weekend so im in a lot of hurry. If anybody could help me out and I could get the ecu connected to my PC then I'll put the guys username who helped me out on my bike, take a picture of it and post it here.

Please guys I reallllllyyyy nead it.

Thanks m8s!

__________________


Veteran Member

Status: Offline
Posts: 71
Date:

Tips wrote:

Please guts help!!!

I bought Kawasaki kit ecu for my 2003 zx-6r and the I/F cable from Kawasaki that is needed to program the ecu. Cant figure out where the god damn wires should to the ecu plug. Does anybody have pinout for the kit ecu (2part no. 21175-0009 or the original ecu 21175-1096). I have to dyno the ecu tomorrow and race on the weekend so im in a lot of hurry. If anybody could help me out and I could get the ecu connected to my PC then I'll put the guys username who helped me out on my bike, take a picture of it and post it here.

Please guys I reallllllyyyy nead it.


Please be more clear on your needs, i diden't right understad.
You can add me on skype if you use it.
christian_piasini is my account

Best regards

Christian Piasini
R&D Piasiniengeering


Thanks m8s!




 



__________________
Christian Piasini


Newbie

Status: Offline
Posts: 2
Date:

Here's my problem. I bought 2003 Kawasaki KIT ECU and the I/F cord needed to program the ECU. The stock harness doesn't have the wires that are connected to KIT ECU pins used to communicate (read and flash) the ECU. Now the stock harness has 8 empty holes and I don't know to wich of them the PC cord wires should be connected to. I don't know wich pins on the KIT ECU out of 8 are used to communicate with PC. There should be 2 pins to do that but not sure. Btw. I have 2003 ZX-6R.


-- Edited by Tips on Tuesday 12th of May 2009 04:20:22 PM

__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.

Tweet this page Post to Digg Post to Del.icio.us


Create your own FREE Forum
Report Abuse
Powered by ActiveBoard