Open, offline tooling for the Triumph Keihin ECU (2010 Bonneville T100, 865cc, Renesas SH7054, mechanical odometer) — a from-scratch, reverse-engineered alternative to the closed TuneECU app. Read the ECU, decode and view its fuel/ignition maps, understand the device flags, and (eventually) tune it.

Independent interoperability research on hardware I own. Contains no TuneECU source — only original code and documented findings. Proprietary map binaries are never committed (see .gitignore).

What's here

src/tunie/ — a read-only KWP2000 diagnostic tool (K-Line/FTDI or Bluetooth ELM327). Cannot write to the ECU by construction; safety.py refuses every flash service before it hits the wire. pip install -e ., then tunie info --port …. Verified frames in tests/verify_protocol.py.
viewer/tunie-viewer.html — a self-contained page (no server, no deps) that drops in a real map .hex, decrypts and unpacks it, and renders the real fuel/ignition tables with RPM/throttle axes, an A→B diff, and SAI/O2 device checkboxes. Build with viewer/build_viewer.py; download_maps.py + serve.py add a catalogue dropdown.
research/ — the reverse engineering: AES-128 seed/key (keihin_seedkey.py), and the map format — decrypt, flat-ROM unpack, table map, and validated SAI/O2 flags (reference-maps/).
docs/ — start here for the full picture.

Read the docs

docs/CONTEXT.md — everything reverse-engineered and built, with per-finding confidence levels. The one file to read.
docs/ROADMAP.md — open-sourcing plan + the technical path to actually tuning the bike + next steps + risk register.
STATUS.md, viewer/FORMAT.md, research/FINDINGS.md, research/reference-maps/{README,TABLES,DEVICES}.md — deeper per-topic writeups.

Status (short version)

Software + reverse engineering are well along and validated against real map files: the protocol, the AES seed/key, the map decryption, the flat-ROM unpack, the fuel/ignition table locations, and the SAI (confirmed) / O2 (probable) device flags. Nothing has touched the real ECU yet — first contact is blocked on wiring a cable to the Triumph diagnostic connector. The write/flash path is future work (see the roadmap).

Safety

The diagnostic tool is read-only; it can't brick the ECU.
The real risk is electrical: confirm the Triumph connector pinout before plugging any cable in (the 2010 twins don't use a standard OBD-II socket).
Device flags are not a tune on their own — disabling O2 forces open-loop and needs matching fuel enrichment. Prefer flashing a complete, matching delete map over hand-toggling a stock one. See docs/CONTEXT.md §7.