449/511 communication with ECU

Works for my SMR 511 2011

What works?

Accessing my ECU and reading a battery voltage.
https://www.dropbox.com/s/vknwn6y9qeiksng/Selection_747_.jpg

Code breaking works??

Tried to answer but it is still (posted on Wednesday at 10:46 AM) only saying "This message is awaiting moderator approval, and is invisible to normal visitors."

Tha

Thank you anyone. You've proved what I had assumed that the authentication and the secret key(s) I "dug out" are the same for all 449 and 511 engines for huskies and CCM bikes as well. So our community definitely have the know-how to access our ECUs and we are waiting for somebody who can program a preferable mobile diagnostic app with a simple user interface using the command sequences I had published.

I've noticed you were using Python for sending these commands, so may be you have or know somebody who has the skill to do this. Last summer I've been playing some time to develop graphical python apps for Android platform (based on kivy). Although Android native development platform is Java, but I don't like that language so much, and I had successes in this cross-platform Python development. But finally I had not enough time to continue and make our ECU's diagnostic App. However If there is nobody for such a task maybe in next summer I will have some time to continue and make that App. But it will definitely steal my time from riding I wrote an email to TuneECU guys but is has not been answered.

gobtald, huge work! Need good programmer.

I salute your work Gobtald.
Great efforts!

Hey Gotbald!

Very well done!
Would you mind to share the first data bytes for initialization (on K-Line)?
E.g. recorded with you raspberry scope or another logic analyzer.
I try to use an Attiny with open collector circuitry to communicate, but I don't get an answer from the ECU.

BR
Florian

Hi Florian (tMh2),

glad to assist you.

If you begin so low level you should download the following documents (about Keyword Protocol 2000 - Part 2 - Data Link Layer), e.g. from the following link: http://www.alfa145.co.uk/obd/14230-2s.pdf
In this document please find the "Fast initialisation" section. KMSK16 ECU running this protocol needs this initialisation sequence (25ms +/- 1 ms logical low, which if I remember well was 12V high, but please try it), then wait for an other 25 ms (in default logical high), then send the StartCommunication service request sequence:
0x81 0x12 0xF1 0x81 0x05
As I explained in my earlier post 0x81 means you will use physical address (0x80), plus, length of message value is placed into the first byte of header (0x01). 0x12 is the magical and non-standard address of ECU i had found. 0xF1 is the source address of tester (it is standard in BMW or even all OBD2 testers). The next 0x81 is the StartCommunication command. 0x05 is the calculated checksum.
Please be aware that (if I remember well) the bit order in the bytes are "reverse", so low bits go first. All other commands you can find in my earlier post. Naturally you should always repeat the header bytes and also the checksum at the and of sequences. You should always send keep-alive sequences in 4-5 sec at last, failing which ECU drops communication.
It's why I use ELM327 since it is very cheap and provides such convenience functions. But you should be successful with your circuit if you program these basic functions of ELM327 on you microcontroller.
I wish you all the best and please don't hesitate to "ping" me if you need further assistance.

Guys, I have good news. Alain from tuneecu.com has answered and he is interested to build our authentication keys to ECU into his diagnostic software. It was what I hoped that we did not need to develop a new diagnostic SW with graphical user interface from scratch but we can use tuneecu (as the best of its kind) with our SW access keys built into it. Alain needs some time to get our ECU from ebay but then he develops this extension into his Android app.

So, cross our fingers, but I hope that within the foreseeable future we can have a cheap but full-featured diagnostic app for our bikes.

Hello, a beta version is ready for 449 & 511, you can contact me on tuneecu.com if you want test it, it's work with Bluetooth adapter ELM327 (V1.4 or 1.5) and USB cable (FTDI chipset).

Alain

PS: Someone has any news from gobtald ?

Hi Alain,

I'm here -- have been waiting for your notification impatiently but was not brave enough to push you Thank you for your time and development. I'm gladly test your beta version. I've sent a contact message for you on tuneecu.com

I've not tested flashing the ECU yet, but i can read the map from the ECU.


If an USB cable is used it must be a KKL 409.1 cable (not an USB ELM327), in the future the remapping can be done only with the KKL cable.

This is great news for all the bikes out there with no dealer support

Meeou,

We may have some files you would like if you are able to get the upload function working.

Just joined the site, stoked to see this, well done lads.

I'm able to flash the ECU now (original map and modified map).

Dangermouse449 i've send you a mail.

I picked up the TuneECU fom Meeou and I have a bluetooth and usb obd2 adapter. I can't, for the life of me, find the obd2 port on my 2013 TE449.