is Steve Cole on this forum? what's his handle? maybe if I ask him directly?

thanks again for all the input....just the tinkerer in me... I know it's easier to buy a tuner and just do it...but that's no challenge any more....

Cheers

ps. glad I didn't ride today.. hit a blizzard on my way in to work...

 

he's not on this forum but you can find him on others as Steve Cole

 

Thought I would resurrect this thread- Here it is 2016 and we're still in the same boat generally speaking. No one is going to be able to easily, if at all, obtain general programming information or a complete operational spec on the HD SDEFI Delphi system. Sure, it runs a Delphi piece of hardware. But for the operating system, settings, how it overall operates at the system level, not going to find that and the folks who know are not going to tell you.

Really I'm ok with that- although it would be nice to have an unbiased, non-product-specific reference manual of how the SDEFI system actually works, the list of required tables / settings for engine operation, and what each of them do. Something for general learning knowledge that is complete and correct.

What I'm not ok with is, we do not have a single tuner product that gives you full access to all of the ecm tables and settings to review and tune if needed. Which is why some, like the OP of this thread, were looking to code their own interface.

Some tuning products give more access than others, but all are restricted to the point of needing to replace the actual ECM to gain full tuning access for more complex scenarios.

Basically by now we should be at the same 'full access' and information level that automotive performance tuning products are at for GM Delphi and others.

Jamie / FM is still one of the best sources of tuning information and continues to be very helpful, especially with support for the PV. But he's only one guy.

Any of the current well known tuner products available are great at what they do and will serve the majority of riders perfectly fine. But for those who are true hobbyists, builders and working on the more high performance side of things, you're sorta SOL unless you replace the ECM and go aftermarket. No one is going to give you full access to see / tune all parameters of the HD ecm, or write up a complete set of docs on HD ECM operation and common settings. It's unfortunate and hopefully at some point that will change.

 

Well, you could put a logic analyzer on the two data lines whilst a tuner exercises the system and see what the results are ?

Dave

 

Other than Steve Cole and the group he was a part of in developing the SERT for HD, maybe that's how everyone else developed their products? (I mean there couldn't have been any reverse engineering going on - right?) The story behind how all these products with no access to the device documentation they are interfacing with get built (without crossing DMCA boundaries, of course ) would be interesting.. Where is Drew Industries now - still building tuners or out of that market? - they're big in the RV world today.

 

I believe it is actually Drew Technologies. The product that had the screen is no longer available because it got upgraded to the DashDaq XL.


The only and best way to get this info. Do it yourself and hack the ECM and reverse engineer it. Nobody is going to give it out. Just as Steve was contracted into HD. Drew got contracted into DJ. I am sure there is nondisclosures legal paper work from both companies. Besides who wants to take the time and effort in doing something just to share it for free, just so you have a new competitor on the market tomorrow? There are guys that have hack the DelphiHD code. It is possible.


Just as if you called up Dan Baisley or Hill Side and demand they share their 35 years of obtained knowledge about cylinder heads. I bet you hear some laughter as the phone goes click.

 

I agree 100 % .. I can understand the frustration level of anyone that wants to have complete access, but not at the expense of someone's livelihood (and I suspect from some comments about Steve's experience's , that's happened to him). I actually don't have a dog in this fight, the PV/TT combo on my TG gave me what I wanted for now, although it was enlightening to learn after I started digging that the best I'll get out of it is that it's hopefully making the engine actually match the AFR table, if everything is working right - and that table was set up on somebody else's machine.

 

The actual ECM is made by Delphi and I'm pretty sure it is the MT05 unit, which is used on small efi engines of all types including UTV's and watercraft. there are tools available and documentation on how this ECM works and notes on viewing the raw data. There are direct interface scan tools like PCUHD (made by Delphi, but good luck finding it!), Delphi Scan Tool KF90121, and the ED100 Motorcycle Scan Tool. May be others I do not know about.

This has nothing to do with anyone's proprietary tuning software, which takes that data and through a combination of custom interface hardware and software, allows you to tune your bike, and governs what you are allowed to see and / or tune.

The ECM is designed as an engine management unit (EMU) piece of hardware and has sensor requirements, data output constants that every tuning product must work with.

From what I sort of understand, HD Delphi is its own special variant and has a core set of specially developed operating software. The tuning products must also work with it when modifying it, or, replace it in a way that is equally operable to the ECM and HD application. How that ECM data is interfaced with the tuning product, presented to the user of the tuning product, modified and written back to the ECM is up to the developer of the product and is proprietary.

Below are some reads on the MT05, but in a general way. We don't have anything "HD Delphi" specific like this which would be nice to have. And that has *nothing* to do with anyone's specific tuning product software. It strictly has to do with HD not wanting to publish anything openly.

This shows some ways that others are custom tapping in to the ECM data connector lines and gives some brief info on the MT05 EMU:
http://www.rx3adventure.com/rx3_comp...agnostics.html

Here is a Delphi-provided spec / service manual for the Delphi MT05 which lists core sensor requirements, output constants, pinouts, etc. http://www.huntermotorcycles.com.au/...l%20Manual.pdf

You can rather inexpensively tap into the HD ECM data output and display it in real time on your android via various apps, a Harley to OBD2 adapter cable, and an OBD2 to BT module. this page has the basic info and there are plenty of vids on youtube. There are other OBD2 connectors that interface with usb for connection to a PC.

https://gearheads.in/showthread.php?...Dashboard-Apps

Here is a more expensive version that interfaces the HD ECM with a PC, offers some limited options for tuning and even marrying the ECM with BCM or TSM, assigning security fobs, etc:
http://www.griffintoolsandsupply.com...iles/531HD.htm

A person well versed in hardware and software programming, as well as efi tuning, could gather enough data from the ECM to design their own analyzer, tuner and flash writer product on arduino hardware or similar. will it be easy? not by a long shot. this is why we only have a very limited number of robust tuning products available and it's obvious that each vendor has put a lot of time and effort into making a good product that serves the needs of most HD owners.

So anything I'm saying has nothing to do with hacking anyone's product and I don't believe that was the OP's intention either. All I'm saying is I'd be happy if one of these tuning product vendors decided to lift the veil and give an equal amount of ecm setting tuning access as we see with the good automotive efi performance tuning products. If this is not given out, more than likely eventually someone will take the time, effort and expense to do it and create a new product.

 

hi

really old post but i hope you get an email saying there was a response since i would like to know if you ever made progress.

anyways i am reverse engineer and have just dumped the ecu processor and busy disassembling it to establish and identify what the seed/key algorithm is. i do this alot for cars and happy to talk to you about HD bikes.

 

I spent about a year trying to reverse engineer the protocols and had some success.

The major problem I ran into, is HD security algorithm.

The ECM uses a seed/key combination to "unlock" the ECM for programming, without the algorithm, you cannot "unlock" it and reprogram the ECM.

I was able to use a "sniffer" device to monitor the traffic of one of the "off the shelf" programmers, specifically, Dynojet ProTune

I used Intrepid control Systems NeoVI Fire to log bus traffice.

https://store.intrepidcs.com/neoVI-F...neovi-fire.htm

I was able to easily identify the seed key traffic and the programming packets.

They other challenge is, when reflashing a HD ECM, you need to know the specific memory locations of the fuel map tables, which they also don't share, but I was able to identify in the bus log. Once you know where the values are stored, the next challenge is to know what those number are, what the mean, and how to change them specifically.

I was hired by a company and spend over a year working on this, never to do it successfully. I was able to create a map and reprogram the fuel tables, however, you need to know the seed/key algorithm to unlock it.

As other's have said, I'd buy a " off shelf tuner", they are worth the money. I highly recommend that Dynojet Power Vision. http://www.dynojet.com/powervision/ not only does it allow reflashing memory map, it allows on the fly fuel map adjustments ( best done on a dyno ) to tune your bike. doing this should satisfy most DIYers.

The HD ECM is designed and manufactured by Delphi, or it used to be, it's been a couple years since I've been involved.

Good luck. it's a fun endeavor but very difficult to reverse engineer.

I have also worked on Ford and Chrysler ECMs. They used to use a polynomial algorithm for the seed and key security. I created a spread sheet to help determine the algorithm. I literally tried billions of algorithms and never found the right answer. I used the seed and key found in the bus traffic logs as the root of the experiments to find an algorithm.

My experience with CAN and J1850 communications gave me an advantage to identifying the packets with the seed and key. The problem is, each ECM has a differenty seed.

Seed Key. How it works. As a programming device, you need to unlock the ECM for reflashing. you do this by requesting a seed ( a two byte value 0x0000 to 0xFFFF ) You then run the algorithm on that value, and the result is the "key" ( also a two byte value, same range) You then send this "key" back to the ECM and it unlocks, allowing you to program it's memory.

So here's the rub. I was able to identify the seed and key from one ECM (based on traffic by a known programming device (Dynoject PowerVision ((http://www.dynojet.com/powervision/)) and Screaming Eagle race tuner) I could then substitue that seed and key into my programming sequence and successfully reflash that one ECM. but without the algorithm, I couldn't universally flash all ECM on all bikes, which was our goal)

Then you need to be careful not to reflash any "code" memory, and only the tables (good luck identifying the address and values of that data) if you reflash the code, you will "brick" your ECM, as it fails internal checksum tests and becomes a brick. ( I was able to reflash one back to it's original state and bring it back to life)