RomRaider

From what I read so far I thought I understood the basics of your software but I have run into a wall. I wrote the following XML definition.


<rom>
<romid>
<xmlid>ZZR-T006</xmlid>
<make>Kawasaki</make>
<model>ZX1200B2</model>
<submodel>ZX12</submodel>
<internalidstring>ZZR-T006</internalidstring>
<internalidaddress>0x17F10</internalidaddress>
<filesize>96kb</filesize>
</romid>

<table name="EGT Limit" storageaddress="0x11C9A">
<table type="X Axis" storageaddress="0x11C94" />
<table type="Y Axis" storageaddress="0x11C8F" />
</table>

<table name="(P0031) FRONT O2 SENSOR LOW INPUT" storageaddress="0x11BB9"/>
<table name="(P0032) FRONT O2 SENSOR HIGH INPUT" storageaddress="0x11BB1"/>
<table name="(P0034) TURBO BYPASS VALVE CIRCUIT LOW" storageaddress="0x11B6D"/>


</rom>


When I load my zzr-t006.bin it detects my definition but it doesn't display any table list/info. I started out easy by just cut and pasting some existing definitions and changing the storage definitions to a valid address in my rom.

I get the feeling there is something fundamental I am missing here. Is there a doc on the table tags that I missed somewhere on the site?

I have disassembled the software with IDA Pro and feel confident I can write my own definition. I have located most the table start points. I just need to figure out why tables definitions don't work.

Any help would be appreciated

My rom is from a 2002 Kawasaki ZX-1200B2 which is a Denso unit marked:

21175-1089
112100-1300
12V TBCF14 V

The 21175-1089 is the Kawasaki Part Number for this ECU. The CPU is marked

D151851-4410
sc505407vfc
185

I have identified it as a Motorola 68hc916. The pinout is the same as a 68hc916R1 but this cpu has 96k of flash where the R1 is supposed to have only 48k

zzr-t006.bin is 96kb; the code section is blank the data starts at 0x10000

There's more to tables than just name and address. Look at the 16bitbase and 32bitbase in the definition file.

Ok, I think I have a better handle on this. Making progress but I have a question.

When I use my actual data addresses I get an Error Message during loading:

Storage address for table blah blah is out of bounds.

My data is located between 0x10000 and 0x17FFF

It appears all the suburu values are > 0x20000. I searched the xml for 'bound' and all the 'addr' and found nothing that looked like a bound setting.

What are the valid address bounds?

Can they be changed in the xml or are they hardcoded?

For now I guess I will just pad my bin by 0x10000

You need to change the filesize tag to reflect the size of your rom. This is the reason why you are getting out of bounds errors.

Do you have a filesize attribute in the romid? That may be the problem.

FWIW, in the next release we'll be overhauling the definition format, there's a thread in the dev forum about it. It should fix a lot of the goofiness you're having to deal with right now.

Changing the filesize to 96kb did the trick- Thanks

Here is my first attempt. Its just the rudimentary raw data maps. I'm still going through the code with IDA and am not at the point of being able to convert the data to actual fuel delivered or which dimension is RPM or Throttle etc.

But your software will be great help in that department and I can use it as format to document what I find out as I go along.

(You'll also need the zzr-t006.bin posted upthread)

Neat! "Actual fuel" probably isn't all that important, and really, after some changes, won't be right anyway. We use it for WRX just because it's a unit people are familiar with.

Anyway, I'm glad to see something new! Let us know if you need any more help.

Here is an updated defintion file.

I was able to identify which axes are RPM, Throttle, Inlet Pressure, etc and find their lookup tables.

I'm new to this. What is the technical term for the table you run the engine speed thru to convert it to an integer with the same range as your table dimension?

I'm still kind of guessing on the RPM. I'm using the value's percentage of 0xffff times a theoretical redline. One of these days I'm going to have to figure out the internal clock speed of the CPU, find the prescaler for the timing registers, figure out the individual timer source prescaler then figure out if my crank speed number is a full revolution or a half and maybe I'll have a real world crank speed. But I have to wonder if it will really be all that different than what I have now.

Also the Inlet Air Pressure needs work. I don't even know if the sensor voltage increases or decreases with an increase of air pressure. Need to do some research there.

The most interesting thing I found is that there are two sets of all the major maps and that they are selectable using an external jumper. Unfortunatley for the Nitrous guys the jumper is only read on reset. Still having dual maps to choose from, even if you have to cycle the key is pretty cool.

thanks again for making this software available for guys like me. It has really helped to be able to visualize it. I've made more progress in the last two days than in the last two months.

The number the ECU sees is never a real world number, it's getting the RPM values you see in the table you're looking at directly from the crank position sesnor. Unfortunately they just don't mean anything to real people. The RPM values for Subaru ECUs weren't hard to figure out, it was just multiplied by an integer (4 or something..).

I've made some progress and have some updated files.

I've found an off the shelf BDM device from P&E Micro that I can use with their PROG16Z software to interface with the early ZX-12 ECUs for download and programming.

The included zip includes an updated definition (zzr_def_002.xml) and two ECU map examples:

21175-1079US.bin from a 2001 ZX-1200A2
21175-1089US.bin from a 2002 ZX-1200B1 (same as zzr-t006.bin upthread)

After comparing the two I found that zzr-t006 is not a unique ID. The "21175-1079US" text field is unique between maps and is also the same as the Kawasaki part number for the ECU.

The -1079 rom just has the ignition and fuel maps. I'll have to go thru the code before I'll be able to flesh out the definition with water temp and gear maps etc.

that is awesome!


do you know if the 99 ZX6 or ZX6R uses the same or similar ECUs?
I know it doesn't have fuel injection, but right now my bike is mapped for 87 octane and I'm sure the deadspot right off idle could be fixed with a little more aggressive timing.

The ZX-6R/RR were not injected till 2003 ( -K series) and then they used the newer 32 bit ECUs (21175-00xx)

The BDM ports are only on the older 16 bit ECUs part number series (21175-10xx)

FWIW the exact same D151851-4410 is used in the DBW cars as some sort of coprocessor. I tend to remember Colby saying it was possibly part of a failsafe for the DBW throttle system.

http://freon.shackspace.com/car/ecu%20a ... c_list.jpg

Do you have an MC33186DH? I suspect it is the ETC driver from a quick glance at the datasheet.

It is a pretty sparse design. Besides the CPU there are only 4 coil drivers, 4 injector drivers, an 8 channel Analog Mux, some 74 series glue logic, and a power supply IC

Oh, and a 512 byte I2C serial flash IC for storing post production fine tuning values that are added to the on chip flash fuel maps

Some one sent me a 2000 ECU which I modified and downloaded. I now have the complete US set

21175-1069US 2000 ZX1200A1
21175-1079US 2001 ZX1200A2
21175-1089US 2002/3 ZX1200B1/B2


The new definition file zzr_defs_004.xml defines the basic maps for all the ECUs listed. In addition maps with an intake manifold air pressure axis are now calibrated in cm Hg (cm mercury) and ignition maps are in degrees BTDC.