Do these ECUs say Nippon Denso on the outside anywhere? Someone told me they might be Mitsubishi.

The actual part number on the CPU probably won't be much help. They are usually private labeled parts. For instance the ZX-12 CPU has some Denso part number on it that you won't find anywhere on the internet but the CPU is actually a MC68HC16R1 which you can find all kinds of data sheets and info about.

To identify the cpu we will first need to figure out the package type, identify the easy pins like power, and ground, etc. and then start comparing against manufacturers web sites.



-- Edited by RidgeRacer at 16:37, 2006-12-29

So 64F7052F40 is the only number on the CPU?

There isn't a number that starts with 'D' ?

I do not have a photo of a ZX-6 ECU board. Maybe Don does.

In case you missed it Don, dgmcan posted a pic of his ECU which he says has the same ECU part number as yours, 64F7052F40.



this one also looks like the same physical package as yours, 52 pins per side also know as an FP208A package. This pic also shows a 12 pin unstuffed connector next to the CPU. It looks like if we identify this CPU then we could hack to ECUs for the price of one.

Do either one of you think you could take an ohm meter and use it as a continuity tester and measure each of the 208 pins to ground and record what you find.  If we can identify which pins are ground, which pins are the crystal etc. then we can use that like a fingerprint to compare to all the FP208A CPUs till we find a match. That is how I identified my CPU



Chances are very good that once we identify the chip we can use that 12 pin port to talk to the CPU and download its code and reprogram it.

I forgot to mention the most important part. The 256k of on board flash IS re-programmable in circuit. Which means you can remap it or change the code.


The SH7052F/SH7053F/SH7054F is an F-ZTAT (Flexible Zero Turn-Around Time) version
with flash memory as its on-chip ROM. Flash memory programs can be written with a
programmer that supports SH7052F/SH7053F/SH7054F programming, and the flash memory can
also be programmed and erased by software. This allows reprogramming to be carried out by the
user with the chip mounted on a board.

-- Edited by RidgeRacer at 23:00, 2007-04-23

Hi again.

The CPU is the SH7052 CHIP.
VSS, PVCC2, PVCC1, VCC, and XTAL is confirmed.

VSS PIN 12,21,25,34,44,55,76,81,97,117,125,133,143,160,176,185,196,207 confirmed
PVCC2/PVCC1 pin 10,32,42,74,95,115,141,158,174,194,205 confirmed
VCC pin 19,27,79,123,131,183 confirmed
XTAL pin 24,26 confirmed

The connector CN501 from right to left is:

1.- PVCC
2.- VSS
3.- AUDCK
4.- AUDSYNC
5.- AUDATA3
6.- AUDATA2
7.- AUDATA1
8.- AUDATA0
9.- UBCTRG
10.- AUDMD
11.- HTxD (CAN BUS) I don`t know why there aren`t the HRxD signal too.
12.- AUDRST


Now, I must find the interface to read and write internal flash.

Hi, I've just started work on hacking an ECU for a Suzuki SV1000 ... it too has the Hitachi 7052F40 chip, and it too has 12 connections at CN501 ... so I'm keen to see if you can pull code and data out of it.
Cheers,
MarkW

So far I have found out the following:

There is two ways to access 7052 ecu to flash it.
- AUD connector, but unfortunately the equipment costs around 2000usd and according to the specification one can not read the full flash - its a non supported command according to Renesas. Anyway programming using AUD should be easy. Also debugging and tracing the ram area should be doable. The product for AUD is called Renesas e10e with embedded workshop software.
- Serial connector which I traced to be connected to the harness connector. With renesas CPU you can use serial connector for erasing and flashing in boot mode or reading, erasing and flashing in user mode. Boot mode can be initialized for all the processors, but the user mode can only be initialized if required microcode is installed. We really do not want to start with Boot Mode as the first thing that does is to erase the flash before installing the boot mode microkernel. The Renesas product for serial connectivity is e8a with FDT (flash development toolkit) software. Also one could also use a simple RS232 to TTL hardware signal level converter like MAX232 chip there.

So so far it looks like that its very easy to flash at least the busa ecu, but finding out the way of getting the code out from the 7052 seems to be difficult. Some of the cars (EVO 7) use 7052 too. What I read from one discussion related to those is that they use AUD for transferring the microkernel to the ram(or flash) and then just use the user mode for downloading the software. The required microkernel sourcecode is available as part of the FDT - but that requires hw/sw to access the AUD connection. Well AUD is really for debugging, so maybe it would be possible either to build or otherwise find a cheaper device just for putting the microkernel code in the processor.

I am hoping that someone could find a solution for getting the code out... other than hardwiring the processor to become an EPROM and reading it in 40pin EPROM mode - which really is a last resort to me.

What have you found out ? Do you too have the serial lines connected to the harness wiring ?





-- Edited by PetriK at 07:24, 2007-11-11

-- Edited by PetriK at 07:27, 2007-11-11

oops, I see this is RAM monitor mode

I'm hoping that the limitation to addresses FFFFxxxx with the e10a is purely due to the software.

In the 7052 it looks like RAM is at FFFF8000..FFFFAFFF, so if the e10a can access FFFFxxxx then it can access addresses outside the RAM area (i.e. FFFF0000..FFFF7FFF & FFFFB000...FFFFFFFF) even though there may be nothing there to access.

Further, the datasheet advises against using the AUD to write to a ROM address immediately after an ATU (advanced timer unit) register write cycle ... this would seem to imply that the AUD can be used for writing to ROM (but not after an ATU write), and if it can write then it should also be able to read ...?

I guess the only way to find out is going to be to try it and see.

I'm thinking along the lines of a PIC (or my latest favourite ... the Parallax Propeller) to handle the comms at the AUD ...

That sounds like a good idea considering all the different bike models it would cover. Consider it done.

RidgeRacer,
Is there any way I can call you to discuss a few things? I have used the 636 Kawasaki Kit Racing ECU many times and I now have 1 or two 05/06 racing ECUs that don't work properly. I also have the programming cable and tuning software. I also have several of the standard 05/06 ECUs that I can open up. I'd like to see what code is different between the 2 units, if any. The racing ECUs don't generally need the antitheft resistors and that sort of stuff to run properly, so I believe there is a difference. I'm not sure that I have the software/programming skills to complete all of the required tasks to do what I have in mind and I wanted to talk to you directly before I even got started with this project. I'm much more in tune with the hardware end of things, but I'd love to learn more about the programming end of things. This project may force me to learn programming, finally. Please email me at don@guhlmotors.com to let me know if/when I can call you. Thanks!

has anyone managed to map the "unused pins" for use of programming in the 03/04?
Or maybe Petrik you could ask your 'local hacker for the pins he used for his z1000 ecu?

kind regards

gavin

-- Edited by zx6r_gav at 07:42, 2008-11-14

Please guts help!!!

I bought Kawasaki kit ecu for my 2003 zx-6r and the I/F cable from Kawasaki that is needed to program the ecu. Cant figure out where the god damn wires should to the ecu plug. Does anybody have pinout for the kit ecu (2part no. 21175-0009 or the original ecu 21175-1096). I have to dyno the ecu tomorrow and race on the weekend so im in a lot of hurry. If anybody could help me out and I could get the ecu connected to my PC then I'll put the guys username who helped me out on my bike, take a picture of it and post it here.

Please guys I reallllllyyyy nead it.

Thanks m8s!