The GSX-R ECU bootloader protocol by mr_hollywood@cogeco.

ca (Nov 2014)

The K1 to K3 (2001-2003) GSXR 600 and 750 ECUs equipped with 68HC916R3 16bit microcontrollers (MCU), have a
bootloader program installed in the BE flash (at $90000) that can be executed by grounding of ECU pin 30 during
power-up.

The bootloader will allow you to upload your own CPU16 program into RAM (at address $80100 to $807FF) for execution.

Hardware:

The ECU has an ISO9141 K-Line OBD interface on pin 31 that is OBD compatible with USB cables such as:
● The USB OBD2 II 409 Interface VAG-COM Cable (Tmart SKU: Q00547): <tmart VAG COM Cable>

The interface provides for half-duplex serial connection using 0v for a “mark” and 12v for a “space”.

An adaptor cable (not sold in stores) must be made to connect the OBD to the ECU and a regulated power supply.

Software:

The bootloader is configured for 9600 baud, half-duplex, 8bit, no parity and 1 stop bit operation. The flow of data during
the upload must be constant or the ECU will reset.

The format of the upload is as follows:

RAM address Position Value Description

Discarded Byte1 "S" ; $53

Discarded Byte2-3 $08, $01 ; RAM load & jump address (bit 23 to 8) = $080100 (bits 7-0 are zero).

Discarded Byte 4 0 ;Data length - bits 23-16 (always zero)

Discarded Byte 5-6 $nnnn ;Data length - bits 15-0 (file length -7)

$80100 Byte 7-8 $B0, (Start) ; Short branch instruction to the start of your program
; These are the first bytes stored in RAM (at $80100)

$80102 Byte 9-10 $49, $91 ;Bootloader ID

$80104 Byte 11-12 0, (sum) ; Checksum (8bit sum of the file must = 0)

$80106 Byte 13… ; Start of your data or code

; CPU16 instructions must start at an even RAM address

The first available address in RAM is $80100 because the bootloader stack works backward from $800FF.

Environment:

The ECU Watchdog Timer is active during operation of the bootloader and any subsequent program uploaded. This
cannot be disabled and will reset the ECU if not serviced every ~65ms.

The ECU bootloader enable (ECU pin 30) is monitored during ECU reset and subsequent bootloader operation, but can
be reconfigured once your CPU16 code is loaded and running. This pin is mapped to I/O PortE bit 0 (MCU pin 92). ECU
pin 30 requires a minimum connection of ~1200ohms to ground in order to enable the bootloader.

The ECU OBD K-Line (pin 31) receive circuit connects to the MCU on pin 53, and the transmit connects to MCU pin 52.
These are mapped to SCIA Data Register (SCDRA).
mr_hollywood@cogeco.ca