Reverese Engineering the 2007 Yamaha YZF-R1 ECU

[adamsys]

Hi All:

This year Yamaha release the most sophisticated sportbike to date. It has cutting edge electronics on board. The ECU controls the throttle (fly-by-wire), has a servo controlled exhaust butterfly ("EXUP"), and variable length velocity stacks. Unfortunately, it also has a bug/problem where under very specific conditions the fly-by-wire seems to ignore the riders input and stays constant in what feel like a pronounced lag. From the discussion on the R1 forum, Yamaha has no plans to correct it.

So I guess its up to us, the geeks of the proletariat! Besides, it would be great to be able to fine tune the bike when the exhaust is replaced or the intake is modified. Let me start the thread off with the information I've accumulated up to this point:

Nobody makes a system for tuning the maps of a stock ECU. There are data loggers. Therefore, there must be a fairly standard communications protocol which, I assume, is OBDII. Also, Yamaha makes a race version of the ECU. However, it requires a different wiring harness to work and looses most of the street amenities in the process. The race ECU accepts remapping and Yamaha provides the cable/adapter as well as the software.

I've reviewed the wiring diagrams for both the stock and race systems. What I've noticed is there are a couple of comm lines marked DRX and DTX that are in the race ECU that are not in the stock version. Further, I've noticed that the pins exist in the stock ECU but are not populated in the stock wiring harness. Both the race and stock ECUs have a pair of serial lines that communicate to the stock instrument panel. The stock panel works on both systems and is used for reviewing DTC's as well as reviewing sensor readings in realtime. Also, the stock instrument panel seems to be able to shift the entire fuel map by small increments one cylinder at a time in the stock ECU. The service manual refers to "CO Adjustment Mode" for this but doesn't describe how to get into it. (I can probably contact the guys at the last dealership that I worked for. They will give me the scoop, I'm sure.)

Yamaha literature describe the ECU as composed of:

A) ETV main CPU (32-bit) which is connected to the throttle body in the schematic.

B) ETV sub CPU (16 bit) also connects to the throttle bodys.

C) FI CPU (32 bit)

D) Throttle servo driver and sensor

E) A bank of sensors including engine revs, neutral switch, crankshaft position, coolant temperature, and atmospheric pressure sensors. (I also know it has an O2, ambient temperature, EXUP position sensors as well as an EXPU servo driver but they aren't shown in the schematic)

F) Finally the driver for the variable length intake is on board.

Does that sound familiar to the Drive-by-wire systems?

I read in some review that its a Mitsubishi ECU but its is clearly labeled as a Denso unit. Here are a few pictures. It is obviously well potted and not easily disassembled. I'll follow up this posting with more images.

One last thing. I have downloaded the firmware for the latest setting for the race ECU. Can that provide any clues?

(BTW: You won't see the images unless you are registered, sorry.)

[adamsys]

...I'll follow up this posting with more images.

As promised... ...Any help would be appreciated.

[adamsys]

I suppose the first step is to see if adding the pins to the wiring harness that allows communication with the ECU even if it only works in one direction. I guess I'll try the ElmScan 5 Scan Tool unless anyone else has an opinion. I'll also have to make a custom cable (no big deal). Once we know if this works then we can consider obtaining an ECU for dissection.

Of course, everything learned will be posted in this thread.

Anyone have anything to add?

[adamsys]

Here's some research into the ECU Labels for different markets:

1) They are all Denso ECUs

2) The part numbers are:
Australian ECU is 4C8-8591A-00
Canadian ECU is 4C8-8591A-30
US ECU is 4C8-8591A-20-00

So I'd say the Australian/European ECU was developed first then the US followed by the Canadian. The engineers probably tweaked the European code to get the US code and then tweaked it again for the Canadian. If so, the error was introduce in the first tweak and went along for the ride in the second tweak. I'm guessing but it seems logical.

The European and Canadian R1's have chipped keys and security

That will throw a money wrench in the works because it will prevent us from just downloading the European firmware and flashing the US version. We'll have to hack the code at least a little bit before we flash 'em.

[adamsys]

Just ordered the scan tool. Now I have to work out the wiring.

[vic78]

Hello,
I am sorry of my bad English, i speak better French
- which are your conclusions with today?
- You succeeded in reading information?
I am me also interested by an interface ECU <=> PC

Thank you in advance
Victor

[intrawrx]

Where would i be able to obtain an ECU for this so i can wire up a test rig?

Yamaha Dealer ?

[adamsys]

Where would i be able to obtain an ECU for this so i can wire up a test rig?

Yamaha Dealer ?

The Yamaha dealer is always an option but another place to look is eBay. Here is an eBay listing for one in Austria that ran out without any bidders. You might be able to negotiate directly now.

[adamsys]

Hello,
I am sorry of my bad English, i speak better French
- which are your conclusions with today?
- You succeeded in reading information?
I am me also interested by an interface ECU <=> PC

Thank you in advance
Victor

No conclusions yet. I have figured out how to add pins to the connector. This required buying another wiring harness and stealing the pins out of it. Found an '06 R1 on eBay and got that this week. It has a single ECU connector with a high pin count but its an AMP SuperSeal so the pins work!

I have lots of extra pins now so if anybody need a couple, just let me know.

[vic78]

Thank you! I will test me too!

Which are levels?
0 - 0v
1 - 5v
or more?
Or different ?

Thank
Vic

[adamsys]

Thank you! I will test me too!

Which are levels?
0 - 0v
1 - 5v
or more?
Or different ?

Thank
Vic

Honestly, I don't know. If someone out there has a Race Kit PC connection cable, maybe they can remove the cover at take a photo for us?

I was reviewing the manual for the chip in the Elm5 Scan Tool I bought and I'm having second thoughts about the CAN interface. There is an example circuit schematic using the chip which has CAN_Rx and CAD_Tx pins but they go to a CAN phys interface chip. These exit the circuit with CAN_H and CAN_L leads. The wiring diagram for the Race ECU shows Rx and Tx going to the computer cable connection as well as a 12VDC and ground lead. Might be old fashioned RS-232 with full 12V power that is capable of writing to the EEPROM.

Another way to check is to install the pins and wires into the ECU connector and put an oscilloscope on the Tx lead and see what kind of wave for is present (should be polling I think).

[vic78]

Helo!
To summarize
My question is:
Is it well a bus CAN?

Thank
Vic ?

[adamsys]

My question is:
Is it well a bus CAN?

So far, I don't know.

[adamsys]

My initial experiments with a standard RS-232 link didn't yield any results. I found a forum where a guy pulled apart a ZX-12 ECU and found that the communications chip had never been populated. I have to get a used ECU and tear it apart...

http://www.activeboard.com/forum.spark? ... ID=9325284

[vic78]

Thank you for information
I continue my research