G oog le BadWeB | Login/out | Topics | Search | Custodians | Register | Edit Profile


Buell Motorcycle Forum » Quick Board Archives » Archive 0210 (October 2002) » ECM Hacking? Grease Monkeys meet the Geeks! » Archive through May 31, 2002 « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Steveshakeshaft
Posted on Monday, May 06, 2002 - 12:55 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

This thread is starting to look interesting! Nice 1 guys.

Steve.
http://ukbeg.com
Top of pagePrevious messageNext messageBottom of page Link to this message

Sparky
Posted on Monday, May 06, 2002 - 01:18 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Jim,

Here's a little more info on Apple's website regarding Honda race bikes & Macs, Apple HotNews.

Sparky
96S1, 98S3
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Monday, May 13, 2002 - 05:27 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Doof-

Are there any other markings on the EEPROM? If there aren't, what's the packaging like?

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Doof
Posted on Monday, May 13, 2002 - 10:09 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Sarodude,

Right beneath the part #, is the Motorola symbol; "M", inside circle. Following the Motorola symbol is "I/SN". EEPROM packaging is a 8-pin DIP. I've tried communicating with the ECM thru the serial port using an OBDII scantool with the VPW, PWM and ISO-9141 protocols. The only response I get is an "Initializing ECU" on the scantool display; it remains in this state for 5 minutes, then times out and turns off. I then tried a RS232-to-OBDII serial converter with pcAnywhere; no luck.

I've also tried Walbro TDD's SuiteUsr27 software thru the serial port on my computer; the response I get is "Checksum Error".

Maybe an attempt should be made using OBDI or a hack box for a Marelli system. We need an expert on embedded systems hacking. Anyone?



Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Friday, May 17, 2002 - 01:47 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Two comments:

First, post some pictures of the disassembled ECM and I will be happy to do some research. I am an engineer although not a EE. I too would like to be able to reprogram it.

Second, have you seen the new ACCEL system (This months 5.0 mag)? It is awesome. I don't know if it would work for bikes, but I can't afford $1500 anyway.
Top of pagePrevious messageNext messageBottom of page Link to this message

Doof
Posted on Tuesday, May 21, 2002 - 11:57 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

I'll post pictures as soon as I can find a good deal on a digital camera. Any recommendations in the $100-$200 price range?
Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Wednesday, May 22, 2002 - 01:14 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Even without pictures, can you decode what the interface plug is (the four pin service port)? If it is a serial connection, which wires are TX, RC, etc? At least then I can create a cable and hook my computer up to start hacking away.
Top of pagePrevious messageNext messageBottom of page Link to this message

Pilot
Posted on Wednesday, May 22, 2002 - 05:56 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Dave your fax machine has a new diagram waiting for you. Cut and Paste old style.
Ross
Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Saturday, May 25, 2002 - 12:17 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Anyone have a scanalyzer? It occurs to me that I will be able to hack a lot faster if I can record the output of the scanalyzer while in use. At least we could develop what signals are being sent for TPS reset and make a lot of happy Buellers!!!
Top of pagePrevious messageNext messageBottom of page Link to this message

Doof
Posted on Sunday, May 26, 2002 - 03:47 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

The HD Lifestyle...er...I mean... Motor Company restricts the sale & use of the Scanalyzer to HD/Buell dealerships only; they can't be sold to the general public. Same goes for the Buell diagnostics cartridge. I wonder how some of the independent shops acquire the scanalyzer? If anyone knows of a dealership that DOES sell them to the general public, ping me offline with their name & ph.# & I'll buy it!!
Top of pagePrevious messageNext messageBottom of page Link to this message

Doof
Posted on Sunday, May 26, 2002 - 03:57 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

One last thing. Has anyone ever noticed the amazing resemblance between the Scanalyzer & the OTC-4000 scantool?Hmmm.
Top of pagePrevious messageNext messageBottom of page Link to this message

Anonymous
Posted on Sunday, May 26, 2002 - 07:41 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Doof,

That is not correct. Anyone can buy the scan tool from any dealer. All you have to do is convince the dealer to sell you one. There are no restrictions on its sale or on the sale of the software.
Top of pagePrevious messageNext messageBottom of page Link to this message

Anonymous
Posted on Sunday, May 26, 2002 - 10:15 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Doof is right. U.S. law states that manufacturers must make all service tools available to the public. Small independent shops were who they had in mind. This is to prevent monopolizing by the dealers/factory.

If the dealer says NO, they are breaking federal law.
Top of pagePrevious messageNext messageBottom of page Link to this message

José_Quiñones
Posted on Sunday, May 26, 2002 - 10:24 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Doesn't it cost something like $3,000!
Top of pagePrevious messageNext messageBottom of page Link to this message

Doof
Posted on Monday, May 27, 2002 - 04:08 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Anonymous-

This has been my experience with trying to buy the Scanalyzer from HD/Buell Dealerships so far: I call them up, ask for the parts department, and place the order for the Scanalyzer & Buell cartridge. The parts person says they'll call me back with a price & availability. Later, I'll get a call back from the parts person telling me those tools are "restricted" for dealer use only, as mandated by HD corporate. I've already called the HD Customer Service ph.#, and spoke to a Customer Service "legal" rep., and was told that HD Corporate doesn't "mandate", but "recommends", that their dealers prohibit the sale of HD tools to the general public. The excuse I got was "Tools such as the Scanalyzer require highly-specialized training and certification. We therefore recommend that customers have all required service work done by certified technicians at their local dealers." I've gone back to the dealers I tried to order the Scanalyzer from and relayed what HD Customer Service told me; they still maintain "there's nothing they can do" because of the HDC restriction mandate. In other words, I keep getting the f@#!&n runaround!!

The federal law you mention, called "The Fair Trade Act", the dealers are in violation of, and I have mentioned this to all of the ones I've dealt with so far. They respond to me like I'm blowin' smoke, and literally don't care what law or set of laws they're breaking. I guess they figure I won't do anything about it. Well, I've already filed a formal complaint with the FTC. I've also spoken to a few business attorneys willing to take my case. According to them, I would "most likely" win, but all legal expenses incurred I would be responsible for. Furthermore, my local State Attorney General refers me back to the FTC. So that's all the farther I've gotten on the legal front; just waitin' for the FTC's response, for now.

Jose, the average price I've been quoted for the Scanalyzer & Buell cartridge is $1800.00 for the scantool, & $450.00 for the cartridge.

FYI, the reason I'm so hellbent on acquiring a Scanalyzer for working on my two Buells is because the nearest Buell dealer is approx. 350 miles away; and they're a joke when it comes to servicing Buells anyway.
Top of pagePrevious messageNext messageBottom of page Link to this message

José_Quiñones
Posted on Monday, May 27, 2002 - 10:14 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

This is getting interesting.........
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Monday, May 27, 2002 - 11:57 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Maybe it needs to be renamed ScaMalyzer...

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Hoser
Posted on Tuesday, May 28, 2002 - 12:41 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Fella's:

The OTC 4000 "ENHANCED" scan tool can be used on Buell HD products , as a matter of fact many auto repair shops are upgrading to more sophisticated diagnostic tools and used OTC scan tools are available cheap now . Last year I picked one up from my MAC dealer for $500 Cdn( $250 US ) and it included all the cables and software for domestic vehicles up to 99 , manuals too. The software for HD / Buell is quite expensive though as are the cables , the Buell cable is over $500 Cdn , the cartridge is $ 1035 Cdn . The cable can be made up with out too much trouble , the software is another matter . Does any one know how to hack into an OTC / Kent moore cartridge ?? perhaps with the intent of making a copy ?? , hey wait a minute , ... this is starting to sound illegal ! ? ! ?.
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Tuesday, May 28, 2002 - 09:16 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Something I'm not clear on...

How does one re-flash the ROMs in the ECM with the Scanalyzer? Is there another SPECIAL re-flashing cartridge for a given ECM / fuel map combo? If so, what good will the Scanalyzer be for those trying to re-map a stock ECM?

I'm still on the reverse engineer side of this. Find a donor ECM, yank the precious ICs off the PCB, have someone read 'em into a PC, and begin disaasembling the code.

Fuel maps will be found. Protocols will be discovered. Nothing will really be trial and error after that. We'd know EXACTLY what the ECM wants and does.

Anyway...

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Tuesday, May 28, 2002 - 01:11 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Doof - You kick ass.

Sarodude - You have a good point. I am making the assumption that Buell uses the Scanalyzer to download a new MAP and flash the ROM's. That still won't address the issue of having to software necessary to create a new map. Yet another piece of the puzzle that Buell likely has.

Anyone know any factory racers that may be willing to lend us a hand? Surely there is someone out there racing with FI.
Top of pagePrevious messageNext messageBottom of page Link to this message

Doof
Posted on Tuesday, May 28, 2002 - 08:23 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Hoser-

Will the latest revision of the OTC-4000, dubbed the "Monitor Elite", work with the HD/Buell cartridges? The reason I ask is because a friend of mine just bought one from www.ontool.com, in a kit with a bunch of cables and some cartridges, for around $850.00.

As far as re-flashing the ECM, I would assume it requires a seperate scanalyzer cartridge apart from the regular diagnostics cartridge. That's how HD's older Marelli and newer Delphi EFI systems are re-flashed with the various Screamin' Beagle "stage" hop-up kits for big twins; the Scanalyzer re-flashing cartridges come with the kits.

Re-mapping software:

I can't find the ph.# at the moment, but try Rich Cronwrath @ Innovative Motorcycle Research. He claimed to have the software necessary for re-mapping stock and race ECMs w/ a PC. When I asked him how he acquired the software, he replied he got it from Buell under a "special license agreement". Unfortunately, he can't sell the software to the public because of the agreement.
Top of pagePrevious messageNext messageBottom of page Link to this message

José_Quiñones
Posted on Tuesday, May 28, 2002 - 08:59 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Rich's webpage is

www.racingmotorcycles.com


His F.I. X1 Racing bike runs fine
Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Tuesday, May 28, 2002 - 10:37 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

It appears that the signal from the ECM is SAE J1850 PWM (That's a guess because both Ford and GM use it on OBD-II). That doesn't mean much to me yet, but I will do some research. B&B electronics sells a cable that converts this signal to RS-232 or just plain serial port of a PC (Several hunderd bucks). Once I get it there, I can write the VB code to read and display the data. I would still need to know how to write back to the ECM.

This is starting to get cool. Too bad there aren't any factory guys willing to help. I promise not to tell who gave me the info :-)
Top of pagePrevious messageNext messageBottom of page Link to this message

Hoser
Posted on Tuesday, May 28, 2002 - 11:01 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Doof:

I have not used the OTC "monitor elite" so cannot confirm that it will work on our Buells . The latest on doing a reflash with HD stage kits is multi use cartridges , some have five uses , some have ten depending on the model of bike being programmed once they are used up they are toast. The older cartridges were one use only and came with the Screamin eagle kit being installed or could be purchased seperatly to suit different configurations. The screamin eagle product range has been vastly expanded in the last couple of years so to make the reflash process more simple a variety of multi use cartridges have been developed. I have several of the old single use cartridges lying around , hoping some day they may be of some use but "reburning" them is waaaay beyond my ability. In 99 when D.D.F.I. was introduced the earlier bikes had to be reflashed to make them run properly , that cartridge is a multi use ( unlimited ) and is the only " reprograming" cartridge for Buells that I know of . That was revision 06 , I believe there have been at least a dozen revisions since on 1200 ddfi bikes alone , who knows how many one the firebolt ??
Top of pagePrevious messageNext messageBottom of page Link to this message

Reepicheep
Posted on Thursday, May 30, 2002 - 09:07 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

I had a brainstorm last night about 2 am... glad I was able to remember it this morning...

I think we are taking the wrong approach here, and instead should be doing what the newer Power Commanders are doing.

Leave the original ECM unmolested, and let it do its normal job with its normal programming.

Add another controller between the ECM and the fuel injectors, and tweak the pulses as we see fit given the current state of the engine running. It could be done by a pretty simple embedded controller, and could need as few as three inputs (one for each injector and one for throttle position sensor) and two outputs (one for each injector).

The hardware would probably be less then $100 or so and be reasonably simple, and we could build our own tools to modify the maps on the fly.

A lot of this would be reinventing the wheel (trying to build our own 3d maps), but on the other hand, we have the original ECM doing its job normally so we can always get hints from that, and just layer a set of "adjustments" on top of the existing map... fill in the midrange hole, etc.

As I am sure it's a closed loop system, we may have to massage the inputs to the ECM as well (O2 sensor input maybe). Heck, maybe we can just find one particular input that we can "massage" and our hardware needs only one input and one output.

As no Buell that I know of will ever be firing at more then 20,000 sparks per second (10,000 rpm), even a simple CPU could probably handle it. Heck, a tweaked Palm III might be able to do it, I think the dragonball in there has some unused analog inputs and outputs.

Bill
Top of pagePrevious messageNext messageBottom of page Link to this message

José_Quiñones
Posted on Thursday, May 30, 2002 - 09:12 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Bill,

Somebody is ahead of you on that thought.

Those Cool Canadians at CMG Racing are using a product by a Nevada company called Techlusion. here's what it looks like:

Top of pagePrevious messageNext messageBottom of page Link to this message

Snowdave
Posted on Friday, May 31, 2002 - 01:11 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

I for one am not interested in "fooling" the stock system into behaving differently. It is probably just the engineer in me, but I would like to use the built in functionality of the stock system to adjust fuel injection maps, tweak ingition curves, monitor sensor outputs, and even perform some data logging (this will likely take an add on piece to do the recording). If my only goal was to improve the DDFI performance, I would agree with you, but I am way past that.

Go ahead, let the flood of engineer jokes begin.

BTW, has anyone had a heart-to-heart conversation with Erik on this topic? I read a quote somewhere that he used DDFI on a 140HP bike, said it was his company so he could do that and he was surprised someone hadn't hacked the system yet. Do we know why Buell refuses to release the software and ability to modify the settings? Maybe we would then have some leverage in trying to convince them to share. Just a thought.
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Friday, May 31, 2002 - 01:27 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

I yaked with one of my buddies about popping the ICs off the PCB and reading them into a PC. He's asking some people some questions. One of 'em actually has a boss with an FI Buell.

Anyway, someone STILL needs to give up their ECM to the cause. It's POSSIBLE - and LIKELY - that the ECM could be returned to active duty. It's also equally possible and likely that someone will bugger up the de-solder / re-solder operation and render some stuff useless.

Who's REALLY in this? Do any anons care to ask for a shipping address? maybe the factory has some warranty returns that have good ICs but bad somethingelses

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Sarodude
Posted on Friday, May 31, 2002 - 01:35 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

One more thing...

Aside from different maps, what's different about the Race ECM? Is it the same hardware just with different firmware? Same firmware with different map? Different hardware? How different?

-Saro
Top of pagePrevious messageNext messageBottom of page Link to this message

Rempss
Posted on Friday, May 31, 2002 - 02:44 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only)

Where do I ship? The housing is taken off, but the board and connectors are still intact. I will also send a copy of the wiring diagram so you can identify the diagnostic link ports.

I think the Race ECM is the same with different programming. Something about the EPA and a distinct unit for "Racing Use Only", not just re-programming the stock ECM. Could just be my imagination though.


Jeff
« Previous Next »

Topics | Last Day | Tree View | Search | User List | Help/Instructions | Rules | Program Credits Administration