Author Topic: Is the diagnostic lead on the 535GT really an OBD2 port in disguise?  (Read 1794 times)

1 Member and 1 Guest are viewing this topic.

Moreirdan

  • Neophyte
  • *
  • Posts: 49
  • Karma: 0
So I am wondering if anyone has done any protocol analysis on the signals from the diagnostic lead on the GT? I would be disappointed but not surprised to learn that RE had put something into the ECU to stop one using a normal OBD2 scanner? If so , does anyone know how to crosswire from their wiring to an OBD2 scanner wiring setup?
Triumph Tiger 2010
Royal Enfield Himalayan 2018
Royal Enfield AVL 2009
Royal Enfield Continental GT 2014
Triumph Bonneville 2006


axman88

  • Bulleteer
  • ***
  • Posts: 239
  • Karma: 0
  • Vintage Motorcycle Fan
I'm interested in this question, and was looking for an answer a few weeks back.  The K-Line port is almost certainly just a serial data port, but I couldn't find any evidence that anybody had hacked it.  I've started to acquire some equipment to let me delve further into activities along those lines.

There is a community of folks working on this sort of thing.  Hacking ECUs seems to be a popular college course activity.  I would think you might find some clues here:  https://ecuhacking.activeboard.com/


Cat3625

  • Neophyte
  • *
  • Posts: 33
  • Karma: 1
  • My need for speed
Tried something similar on my C5 useing this set up.
https://rover.ebay.com/rover/0/0/0?mpre=https%3A%2F%2Fwww.ebay.co.uk%2Fulk%2Fitm%2F323821260328

This fits the diagnostic plug on your bikes loom to enable OBD2 diagnostic equipment to plug in.
I tried with a generic ELM 327 Bluetooth wi-fi set up but the program(Car Scanner)would not recognise the protocol 😡
Tried a hand held scanner as well but it came up with the same---couldn't recognise the protocol.
There is a video of a guy in India on "You Tube" allegedly accessing real time data from the ECU on an efi engined bike.https://youtu.be/Z3r6qcU_kvE Sent an e mail asking what program he used but no reply.
My gut feeling is if it were possible to do this easily it would be on the "net"by now.
« Last Edit: February 16, 2020, 01:10:15 pm by Cat3625 »
1966 Continental 250 GT
2001 Bullet 500 k/s
2002 Bullet 350 Trials
2008 Bullet 500 Classic electric start
2016 C5 Military 500 efi
2019 Interceptor 650
U.K.🇬🇧


kelsoo

  • Neophyte
  • *
  • Posts: 39
  • Karma: 0
From my uneducated view I don't think it is a OBD2 plug. It seems that the OBD2 standard is a 16 pin connector
reading the comments of the first video

Royal Enfield Classic 500 ECU scan vol.1
https://www.youtube.com/watch?v=5pSEhpFZ-ow

point to this kit of which there are many versions

https://www.aliexpress.com/item/32793339541.html

The thing that cought my eye was
"2019 Top Quality motorcycle diagnostic tool for YAMAHA motorcycle scanner SYM KYMCO motor diagnostic tool for suzuki HTF PGO" 

Particulary sym that uses the 36 pin Keihin ecu like the enfield
http://www.sym-center.ru/files/keihin%20EFI.pdf 

I suspect that the setup in the video only allows to view and reset error codes.

A couple more little snippet from the internet.

"It's not possible to Remap the existing ECU on Royal Enfield EFI models. As such, there are no programs to tune the bike."

"The Royal Enfield Indian models run on a open loop system which means that the ECU does not get feedback from the emission output of the vehicle via an oxygen sensor to adjust the fuel-air mixture accordingly. This is standard in export models because of the strict emission norms in export countries. Hence Indian EFI models are prone to running rich and overheating engine."

If this is correct it explains why all the tuning solutions are of the piggy-back type. In effect as you can't change the ecu you lie to it. i.e Tell the ecu all rpm over 5000 even if 6500 are still 5000. Not so much a piggy-back more a man in the middle playing chinese whispers.

Any I find the whole subject interesting and would love to be in control of all aspects of my bike. ECU included so if anyone can shed a bit of light of my guesswork and fact that would be great.
« Last Edit: March 22, 2020, 08:08:37 pm by kelsoo »
2018 Continental GT
2006 Ducati Multistrada 1000s DS
1998 Aprilia Pegaso 650
1985 Kawasaki GPZ1000RX
early US import Kawasaki z550LTD (Bobber)


Adrian II

  • Grand Gearhead
  • *****
  • Posts: 1,780
  • Karma: 0
  • Sharing my ignorance with anyone who needs it
Quote
Any I find the whole subject interesting and would love to be in control of all aspects of my bike.

I think you need a pre-1956 Bullet for that.  ;)

A.
Grumpy Brit still seeking 500 AVL Bullet perfection! Will let you know if I get anywhere near...


axman88

  • Bulleteer
  • ***
  • Posts: 239
  • Karma: 0
  • Vintage Motorcycle Fan
From my uneducated view I don't think it is a OBD2 plug. It seems that the OBD2 standard is a 16 pin connector
OBD II standard is 16 pins, but it also supports at least 3 different protocols for external communication, most of which only use 3 pins.  The RE Keihin controllers only use the K-line, which I think only needs two pins, signal and ground.
https://components101.com/connectors/obd2

"It's not possible to Remap the existing ECU on Royal Enfield EFI models. As such, there are no programs to tune the bike."

There is discussion in other threads about the diagnostic device which was made available to RE dealers, at considerable expense, which does allow remapping the existing Keihin ECUs, but which apparently very few dealers invested in.  I recall hearing that certain early ECU engines were recalled and reburned, in India.  I think this was for better high altitude performance, but I don't recall the details.

"The Royal Enfield Indian models run on a open loop system which means that the ECU does not get feedback from the emission output of the vehicle via an oxygen sensor to adjust the fuel-air mixture accordingly. This is standard in export models because of the strict emission norms in export countries. Hence Indian EFI models are prone to running rich and overheating engine."

If this is correct it explains why all the tuning solutions are of the piggy-back type. In effect as you can't change the ecu you lie to it. i.e Tell the ecu all rpm over 5000 even if 6500 are still 5000.

Any I find the whole subject interesting and would love to be in control of all aspects of my bike. ECU included so if anyone can shed a bit of light of my guesswork and fact that would be great.
A rich running engine runs cooler than a lean running engine.   However, any engine that uses a fixed map and no feedback is very vulnerable to any changes made, like after market exhausts, and air leaks.

It seems that Keihin is very interested in preventing information on accessing the ECU from getting out.  I've read that even the RE factory engineers are not given full access to the internals.

Old school ECU hacking has been done in the past by exposing the Eprom chip, (I think the Keihens are potted), removing it, reading it, then disassembling the software by looking at the individual bytes.  Not something just anyone would want to take on. 

However, if and when the communications protocol is decoded, it should be possible to read internal ECU parameters and even reburn the Eprom.  I'm hopeful that now that EFI is on the 350s, and in the India market mainstream, someone will crack and disseminate the needed information.  The India riders may be less inclined to throw money at piggyback solutions and more willing to do the hard work required to crack the code.


kelsoo

  • Neophyte
  • *
  • Posts: 39
  • Karma: 0
As I'm a free-software person https://www.gnu.org/philosophy/free-sw.html

I only looked for free solutions

The Subaru folks seem to be to most active and use RonRaider
https://github.com/RomRaider/RomRaider

But I suspect it only good as a process/theory observation
 
This seems much more interesting especially as the guy was using a Honda and says Honda own Keihin.

https://www.monocilindro.com/2017/01/23/keihin-ecu-on-honda-cbr125r/

If anyone is in to Arduino boards then there is hope for any Royal Enfield Hackers if like as with the guys Honda. The keihin board microcontroller features are comparable with a standard Arduino Uno.

The fuelino project
https://www.monocilindro.com/fuelino/

lots of  interesting info
https://www.monocilindro.com/
https://www.youtube.com/watch?v=PIgh9fRfjJ8

The code
https://github.com/dadez87/Fuelino-SW-1.0-beta5

Anyway that all I could find.
2018 Continental GT
2006 Ducati Multistrada 1000s DS
1998 Aprilia Pegaso 650
1985 Kawasaki GPZ1000RX
early US import Kawasaki z550LTD (Bobber)