Keihin ECU on Honda CBR125R

In this article, I would like to show the analysis which I have done on the ECU installed on Honda CBR125R. One person from France kindly sent me for free this ECU, and I sent him a Fuelino Proto3. Before opening the ECU, it looks as in the following picture.

First of all, the following picture shows the location of the ECU (Engine Control Unit) on a Honda CBR125R motorcycle (Model Year 2011). On the ECU, some info are written: Keihin 38770-KTY-H52 9042-116092. First of all, Keihin is the manufacturer, it is an electronic components company owned by Honda. The second code should be the product number, and the third is the serial number.

The ECU shown in the picture below is the one that I received from France. After opening the cover, the PCB becomes visible. I made a quick analysis of the components mounted on the PCB. Firs of all, the big integrated circuit with many pins, on the upper right side of the board, is the microcontroller. On the surface, it is written "DF 368 7F ZV H8/368". After searching in Google, I found that this microcontroller is manufactured by Renesas. The datasheet is here: DF3687FPV_microcontroller_datasheet. After cross checking the code written on the surface, and Renesas website, I think that the model should be HD64F3687FPV. I was very surprised, because such microcontroller features are comparable with a standard Arduino Uno, which is equipped with Atmel ATmega328p. The main features of the Renesas microcontroller installed on Honda CBR125R are the following:

  • Clock frequency: max 20MHz
  • Program memory: 56kB FLASH
  • RAM: 4kB
  • 16 bits mathematics operation microcontroller

Of course, the amount of functions that it has to perform are not so many, on a 125cc single cylinder engine, but I expected something a bit more powerful. It has some more features if compared to an ATmega328p, for example: instructions can operate on 16 bit instead of 8 bit, and also Renesas microcontroller supports 32 bits operations, and divisions mathematical instructions. But the clock frequency is practically the same (Arduino Uno runs at 16MHz).

On this side, on the low-left side of the PCB, there is also a big transistor ("MN 638 S" written on it). It is the following NPN transistor: Sanken_MN638S_NPN_transistor. It can resist to a voltage up to 380V, and the maximum current rating is 6A. I am not sure 100%, but I think that this transistor is used for the ignition coil primary command, for the spark plug.

The back side looks as below. There is a very big IC, with many pins, and on it it is written "Keihin KT2011SA". I did not find the data-sheet in Google, so I suppose that this is a custom IC which Keihin uses also on other ECUs to manage standard functions, such as crankshaft pulses signals acquisition, voltage regulator for the microcontroller power supply, and so on.

On this side of the PCB, there are also other power components: one PNP transistor (2SA2097_PNP_transistor), on its surface it is written "A 2097", and a N-channel MOSFET (2SK2782_N_MOS), "K 2782" is written on it. These are for sure used for other power functions, such as injector command, fuel pump, 12V protected power supply and so on. By crosschecking with the Honda Service Manual (Honda CBR125R Service Manual), maybe it is possible to make some more assumptions about the purpose of these transistors.

On the PCB, there is also an 8-pins chip, the EEPROM (BR93L56RF_EEPROM). Inside the EEPROM, usually manufacturers store important information, such as the ECU part number, distance run (km), learning data, and so on. Practically, these info are personalized on each vehicle, so they cannot be saved in the FLASH memory.

Some other people tried to perform reverse engineering on this ECU. I found the following pictures on a French forum, however no-one was really able to analyze the details of the functions, neither to extract data from the microcontroller.

For those who were expecting me to hack this ECU, I have to say sorry, I did not do it. The main reason is that it is practically impossible, for a person who does not know anything about this ECU project, to extract useful data from microcontroller FLASH memory. Even if I could extract the data written on the Renesas microcontroller, it would be too hard to try to understand the meaning of each byte. What could be done, theoretically, is to read the content of the EEPROM (it can be done easily since there is no lock), and try to understand the meaning of the bytes, but same as for FLASH memory, this is a very hard work.

Due to the reasons explained above, I think that the best way to "hack" a motorcycle ECU equipped with Fuel Injector (such as this Keihin one for Honda CBR125R) is to do it from outside, as I am doing with Fuelino Project, instead of trying to "penetrate" the microcontroller or the EEPROM. By faking ECU input signals, or control signals (such as the injector command signal) it is possible to act as a "man in the middle" between the Original ECU and the Injector (or any other actuator) and change the behavior of the engine. This approach is less time consuming, and basically valid for many motorcycles, as long as their engine is equipped with an injector.

Author: Davide Cavaliere

I am an Italian Electrical Engineer graduated at Politecnico di Milano. My interests are motorcycles and cars, electronics, programming, Internet of Things, and Japanese culture.

23 thoughts on “Keihin ECU on Honda CBR125R”

  1. Hello Davide !
    The other pics you posted are also from me ! Sorry you could not hack the ECU ( I know it's not an easy job !) and yes, you're right, the best way is using a "man of the middle" as you say.
    Have a nice day
    jmarie

  2. Bonjour! I searched a bit on Google, but I did not find any interesting information. Theoretically, it could be possible to connect the Renesas debug emulator to the microcontroller, and try to read the FLASH memory contents. By performing this operation, it is possible to understand which Assembly instructions are executed by the microcontroller. However, in case you don't have the source code, it is practically impossible to understand what the instructions are doing. Also, it is not possible to understand the meaning of RAM memory addresses.
    The same is valid also for the EEPROM. If you don't know which is the meaning of each address, it is practically impossible to understand the content.
    By the way, doing this activity was interesting, because I understood that Keihin (Japanese company owned by Honda) is using only Japanese suppliers, for the IC components: Renesas, ROHM, Toshiba, Sanken, ... Basically, Japanese electronic market is practically a closed market (Japanese buy from Japanese), it is very hard for foreign suppliers to sell in Japan.

    1. @boonnumngern lachalo i think stock ecu cant be remap/flash easyly. its possible to up your limmiter by piggyback, if you want it try search in google speedspark fuel control uplimit piggyback. .
      that piggyback allow you to set the fuel and raise up the rpm limiter just by the fuel management. the setting is just easy like seting the carb, just need a flat screwdriver ,and you can adjust low, mid , high rpm fuel .

    1. Hi davide, quick question... what do you think the 2 capacitors are responsible for ? I’ve gone through 2 ecu’s on my bike and each gave “false codes” , hard to almost no start situations and zero throttle response. On breaking apart the ecu .... I found the larger capacitor to be blown on both ECUs.

  3. Hi,
    ave you considered the Speeduino project? It would be ideal for this bike.
    (I was building one for a Moto Guzzi racing replica)

    1. Yes, it is a nice project. However, it is more complicated than Fuelino. Fuelino has the main purpose of being simple.
      The target is not to customize all ECU control function, but only the ones related to Fuel Injection, and moreover, add logging capability.

      1. Hi David,

        these ECUs can be read without opening them,from the K-Line. K-Line can easily be located in the red 4pin diagnostic plug

        Then using this https://hondaflasher.webnode.fi/ tool you can extract the MCU data in binary form ( .bin)

        After that you can use tunerpo which is a free software to make a definition for the MCU data.

  4. Hello,
    Kindly i would like to ask you for help. I need to remap ecu keihin yamaha but in yamaha flasher the type bike is not available, so how i can to get bin data from ecu, what pinout to see? Thank you

  5. Yes Davide ! By scratching the "glue" with a needle under a magnifier !! It took rather a long time !!
    Hope all's OK with you since our last messages !
    By the way, do you know haw many holes are in the standard injector of the CBR 125 and how many cc it can deliver by minute ?
    I'm planning to mount a "racing" injector on mine but the bike is actually at 700 kms from my home ...

    jmarie

  6. hello, has someone luck with opening the maps on Tunerpro ? I'm trying to do it on my Honda msx/grom ( it has the same ecu )

    best regards

    Francisco

  7. Hello David,
    What do you think about using Arduino to command it, using only the power drives from the original ECU? Like a "man in the middle" as you said...

  8. Hello Davide!
    Im so happy i found you because i hope you could help me
    I don’t have the ecu for my 2008 cbr 125r and i was checking the internet for one but i cannot find any without the 80km/h limiter or a very expensive one
    Do you think a ecu from 2011-2015 models witch have the same engine, would fit?
    Many thanks!

Leave a Reply

Your email address will not be published. Required fields are marked *