Reverse Engineering

OSSA ECU Exerciser

It is pretty straightforward to build an ECU exerciser.  The 34-pin MX32A mating connector, manufactured by JAE (Japan Aviation Electronics), is available from Joe Scavone at Cycle Terminal.  A mating connector for the Kokusan Denki communications interface is also available from Cycle Terminal.  It is a 4-position Sumitomo HM090 series.

Simulating Sensors and Inputs

By far the most difficult part of the task is generating the flywheel pickup signal.  An arbitrary waveform generator is required.  These devices are sometimes called ARBs.  I used an Agilent 33120A.  More on this later.

Potentiometers are used to simulate signals from the barometric pressure sensor, throttle position sensor (TPS), and thermistor temperature sensors.  A single-turn pot works fine for the TPS (and would probably be fine for the barometric pressure sensor as well).  However, the thermistor temperature sensors are highly non-linear and operate over a wide resistance range.  I used parts I had on hand – a 50k, 10-turn pot for the coarse adjustments with a 1k, 10-turn unit in series for the fine adjustments.  A complete table of temperature versus thermistor resistances is available in my section on Electrics under Sensors.

The next two photos show the actual waveform produced by the flywheel pickup at 1400 rpm, followed by the waveform I programmed into the ARB.  The ARB waveform is not exact but is close enough.  The minimum waveform voltage needed to trigger the ECU is only about 1.5V p-p.  The actual voltage generated by the bike is closer to 25V p-p at idle and likely increases somewhat with rpm.

When the repetition rate for the arb is set to 10 Hz, the corresponding engine speed is 600 RPM.  Engine speed scales linearly with frequency.  This may vary by map, but there seems to be a rev limiter at a bit over 5600 rpm.  This is lower than I would have guessed, but I do not use more than about 5000 rpm while riding according to my Trail Tech TTO, which has a telltale peak-recording function.  A different ECU map gave a maximum engine speed of about 7000 rpm.

A test point has been provided to monitor the precision 5-volt reference.  As on the bike, this reference is used to power the TPS, the barometric pressure sensor, and the diagnostic interface.

Similarly, a test point marked “Switched” allows monitoring the 12-volt power out of the ECU.

The default map (in a dual map) is active when the map input is floating.  Pulling that map switch to ground enables the alternate map. This map changeover occurs in real time – there is no need to stop/restart the engine.  If a dual map is loaded, the map wire (pin 12) will be tied to 5V through a pull-up resistor.  (On some older bikes the map input wire was incorrectly positioned at ECU pin 32.)

I used a spare fuel injector in the circuit, but a dummy approximately 12-ohm resistor would work as well.  The nice thing about an actual fuel injector is that you can hear it pulsing.  I expect fuel passing through the injector helps keep it cool, so I do not run it for long periods at a high frequency.

Below is a typical waveform as seen across the injector.  The approximately 5ms pulse width shown is at the top end of the range.  1000 to 5000 microseconds is typical.  Of course, the turn-off inductive spike would not be seen with a purely resistive load in place of an injector.

I used LEDs to indicate when the fan relay and fuel pump are activated.  The ECU has circuitry on those outputs to detect opens (and probably shorts).  The LEDs obviously do not draw the same current as the actual hardware, so an open-circuit fault is reported by K-Scan. Regardless, the ECU continues to respond properly.  A 40-ohm resistor from the “Switched” terminal to ground silences the fault.  At 13.8 volts, the resistor will dissipate nearly 5W.

Communication with the ECU's diagnostic port is via a TTL-level serial interface.  I have stripped short (3mm) lengths of the TXD and RXD wires to attach a snooping device.  The protocol is 38,400 baud, 8 data bits, 1 stop bit, and no parity.  K-Scan communicates using uppercase ASCII strings terminated with a carriage return (0x0D).

For example, to issue the command Read Software Version Number you would send “CD3”.  The reply would be “DEOC17001”.  Here I am assuming the leading “D” may mean “data,” as the actual response presented by K-Scan is “EOC17001”.

In the future, I may describe the results of my ongoing reverse-engineering efforts.  I have de-potted a dead ECU and have some partial schematics drawn.  It is a time-consuming labor of love. 

It is possible to pull pins out of the ECU's mating connector with a Cycle Terminal's ET120 tool for small terminals (0.040" and up).

To remove a pin, insert the tool via the backside of the connector on the “outboard” side of the wire.  Pull on the wire.

This procedure may be needed to relocate the wrongly positioned map wire or to remove unused wires for the Explorer's display.

Easy Start

This is a placeholder for a discussion of the Easy-Start unit I repaired and reverse-engineered.  It is an unusual, but clever, design.  The potting compound was very soft and sticky, yet crumbly.  I accelerated the de-potting process with alcohol (figuring acetone would melt the plastic enclosure).  There was also a conformal coating over the PCB.  The PCB was well-marked with silkscreened component placements.

It uses a Microchip MCP1623 step-up regulator.  A Microchip PIC16F1824 controls timing and sequencing.