# tunie

Open, offline tooling for the **Triumph Keihin ECU** (2010 Bonneville T100, 865cc,
Renesas SH7054, mechanical odometer) — a from-scratch, reverse-engineered
alternative to the closed TuneECU app. Read the ECU, decode and view its
fuel/ignition maps, understand the device flags, and (eventually) tune it.

> **Independent interoperability research on hardware I own.** Contains no TuneECU
> source — only original code and documented findings. Proprietary map binaries are
> never committed (see `.gitignore`).

## What's here

- **`src/tunie/`** — a **read-only** KWP2000 diagnostic tool (K-Line/FTDI or
  Bluetooth ELM327). Cannot write to the ECU by construction; `safety.py` refuses
  every flash service before it hits the wire. `pip install -e .`, then `tunie info
  --port …`. Verified frames in `tests/verify_protocol.py`.
- **`viewer/tunie-viewer.html`** — a self-contained page (no server, no deps) that
  drops in a real map `.hex`, **decrypts and unpacks it, and renders the real
  fuel/ignition tables** with RPM/throttle axes, an A→B diff, and SAI/O2 device
  checkboxes. Build with `viewer/build_viewer.py`; `download_maps.py` + `serve.py`
  add a catalogue dropdown.
- **`research/`** — the reverse engineering: AES-128 seed/key
  (`keihin_seedkey.py`), and the map format — decrypt, flat-ROM unpack, table map,
  and validated SAI/O2 flags (`reference-maps/`).
- **`docs/`** — start here for the full picture.

## Read the docs

- **[docs/CONTEXT.md](docs/CONTEXT.md)** — everything reverse-engineered and built,
  with per-finding confidence levels. The one file to read.
- **[docs/ROADMAP.md](docs/ROADMAP.md)** — open-sourcing plan + the technical path to
  actually tuning the bike + next steps + risk register.
- `STATUS.md`, `viewer/FORMAT.md`, `research/FINDINGS.md`,
  `research/reference-maps/{README,TABLES,DEVICES}.md` — deeper per-topic writeups.

## Status (short version)

Software + reverse engineering are well along and **validated against real map
files**: the protocol, the AES seed/key, the map decryption, the flat-ROM unpack,
the fuel/ignition table locations, and the SAI (confirmed) / O2 (probable) device
flags. **Nothing has touched the real ECU yet** — first contact is blocked on
wiring a cable to the Triumph diagnostic connector. The write/flash path is future
work (see the roadmap).

## Safety

- The diagnostic tool is read-only; it can't brick the ECU.
- The **real** risk is electrical: confirm the Triumph connector pinout before
  plugging any cable in (the 2010 twins don't use a standard OBD-II socket).
- Device flags are **not** a tune on their own — disabling O2 forces open-loop and
  needs matching fuel enrichment. Prefer flashing a complete, matching delete map
  over hand-toggling a stock one. See `docs/CONTEXT.md` §7.