HUD ECU Hacker can scan all ECU's from all motorbikes, ATV's, cars and trucks if they support the OBD2 protocol.

OBD2 also permits to see and clear the fault codes (DTC = Diagnostic Trouble Codes) that the ECU is reporting.

Additionally HUD ECU Hacker has implemented the vendor specific (proprietary) parameters of the following ECUs.

These give more details than the OBD2 parameters, but they are a secret of each vendor and not published anywhere.

Normally you have to buy an expensive scantool or software from the vendor to see these parameters.

And what concerns flashing: No vendor allows an ordinary vehicle owner (like YOU) to upload calibrations to the ECU.

Flashing is done in the factory and by some workshops which have a special license and pay a lot of money for it.

To avoid that YOU can flash your ECU, they protect the access to the memory by a security key, require a checksum, and more.

 

More ECU models will be added in the future. You can also add your own ECU.

HUD ECU Hacker can be extended by the user by adding XML files.

By defining the commands, parameters and formulas it can be adapted to other ECU's. See below.

The older Delphi MT05 is not OBD 2 compliant.

The newer Delphi MT05.2 implements a basic OBD2 support.

The Delphi MT05 controls 1 or 2 cylinders. It is used mainly in motorbikes, ATV's and UTV's.

The Liteon MC21 is used in Quads from Hercules and Cectec. It has a Motorla MC9S12D64 processor.

 

The Delphi MT05 & MC21 Manual (PDF) shows how these ECU's are connected.

The older Liteon MC21 connects with 9600 baud.

The MC21 diagram can be found in the Delphi Manual. You will not find a pin for the MAP sensor.

The MC21 has the MAP Sensor built into the ECU. The ECU is connected with a hose to the manifold.

Page 76 shows the 6 pin diagnostic plug (ECM connector)

The Delphi MT05 and MT05.2 use the ISO 14230 protocol over K-Line at 10400 baud and Fast Init.

The Delphi MT05.3 uses CAN bus while K-Line is optional and it's functionality is crippled.

I added several missing details to the following MT05 diagram:

Some Benelli motorbikes (QJ600, BN600, TNT600) have two MT05 ECU's, each controlling 2 cylinders in a 4 cylinder engine.

One ECU takes the analog TPS signal and forwards it as a digital signal to the second ECU.

The following table shows the pins of the MT05.3 which may be configured by the manufacturer in the calibrations.

Some pins may also be configured for testing purposes.

HUD ECU Hacker supports the following adapters to connect with the ECU, which are described in the following chapters:

 1. K-Line (VAG KKL) adapter (only K-Line)

 2. VAG K+CAN adapter (K-Line + CAN bus)

 3. J2534 (e.g. Tactrix Openport) adapter (K-Line + CAN bus)

 4. ELM327 / OBDLink (USB, Bluetooth, WIFI) adapter (K-Line + CAN bus)

 5. ZLG (Polaris) UsbCAN adapter (only CAN bus)

 

All these adapters have a standardized plug with 16 pins: The J1962 plug.

ATTENTION: These adapters are never connected directly to the plugs at the ECU.

Motorbikes and ATV's have a separate diagnostic plug which is normally under the seat.

Most motorbikes and ATV's with the Delphi MT05 use the original ECM plug from Delphi (a black / yellow plastic plug with 6 pins).

AJP uses it's proprietary DB9 plug.

You only have to connect 3 wires between the J1962 plug of the adapter and the motorbike: Ground, +12V and K-Line.

There are also 2 pins for CAN bus. But the firmware does not use them. They are only for the Delphi developers.

Normally pin 5 (Diag) is connected to the MT05 pin J1-16 (diagnostic switch) which enables Diagnostic Mode when switched to ground.

You can prove this easily in the dashboard. The blue ball must appear when you connect pin 5 (Diag) and pin 2 (Ground):

The meaning of 'Diagnostic Mode' depends on scalar 'J1-16 Input Usage' in the calibrations:

Some Benelli motorbikes put a dummy plug with a jumper between 4 and 5 onto the ECM plug.

The LCD display in the dashboard is connected to pin 5 and sends commands over K-Line to obtain the coolant temperature from the ECU.

The cheapest option to connect to an ECU with K-Line protocol is using a VAG KKL adapter (approx $5 USD).

Additionally K-Line adapter are faster than J2534 adapters and much faster than ELM327 adapters.

The ISO 14230 fast initialization requires a very precise timing.

K-Line adapters do not have a microprocessor, so the timing depends on the computer.

Windows is not a real-time operating system and delays are normal.

But K-Line adapters work very well on most computers. Only a few users have reported connection problems.

In case of a connection error close all software on your computer which consumes much CPU and try to connect multiple times.

See chapter Trouble Shooting.

The +12V on the diagnostic plug are always present, even when the ignition key is off.

If you don't need the adapter anymore don't let it connected for hours because it permanently draws current from the battery.

In the HUD ECU Hacker toolbar (button Install USB Driver) you can install the drivers for all types of K-Line adapters.

If you live in Iran you can request a free K-Line adapter. Contact EfixMotor in China.

You can also build your own K-Line adapter with a cheap (approx $1 USD) USB to RS232 adapter and 2 transistors.

For a quick testing this can be built on a breadboard.

 

In internet you may find circuits that use an opto-coupler. This is complete nonsense!

There is no need to use any opto-coupler.

IMPORTANT: Build your own adapter ONLY if you have experience with electronics!

I receive emails from beginners who fail to build their own circuit. I will not give you support for this.

Buy a complete adapter if you do not understand how a transistor works.

Simply forget it if you don't even have an oscilloscope.

If you already have an USB to RS232 adapter you can use it.

The signal must be inverted from RS232 to K-Line and back.

The RS232 lines TxD and RxD are low when idle, while K-Line is high when idle.

You can also use a Sparkfun breakout board with the high quality FTDI chip.

In this case the Rx and Tx signals must not be inverted.

The Tx and Rx pins of the FTDI chip are high when idle.

This FTDI board has two LED's which are flashing when data is transferred on Rx and Tx.

If you use another board where the Rx LED is stupidly connected directly to the RX pin of the board you must remove this LED.

K-Line is half duplex, so only the computer or the ECU can send data alternately, but not at the same time.

All data sent from the computer via TxD is then received as echo on RxD.

The computer will always first receive the echo of it's own command and then, after a pause, the response from the ECU.

This allows to easily detect connection problems. If no echo is received, there is always a hardware problem.

HUD ECU Hacker always verifies the echo but it does not show the echo in the Trace pane, except the echo is corrupt.

You can buy a J1962 Female Connector and solder the 3 wires to 3 pin headers which perfectly fit into the ECM plug.

Or you buy the 6 Pin Furukawa FW090 Male Connector FW-C-6M-B at Cycleterminal: here or at Taobao: here or here or here.

Or you search on Google for more companies selling this plug on eBay, Alibaba or AliExpress.

Then you can either use a crimping plier or solder the wires to the contacts and build your cable as shown in this video

If you have time you can also buy a complete cable in China. Shipping may take between 1 and 3 months.

The red cable from Taobao has a very limited support of baudrates.

In the window "Configure Adapter" you must switch to Fast Init Mode 2 otherwise you get a timeout when connecting.

I discovered severe problems with cheap chinese USB to RS232 adpaters containing the widely used CH340 chip.

UPDATE: After many years WinChipHead finally fixed the bugs in the CH340 chip and the driver.

Verify in the Trace pane that you have driver version 3.8 or higher and a chip with firmware version 2.63 or higher.

I implented the Echo Test into HUD ECU Hacker.

It sends data to K-Line, verifies the echo and measures the speed.

Here you see the test result of a faulty CH340 adapter (green = correct response, red = wrong response):

You can execute the echo test after connecting the K-Line / VAG adapter to the motorbike.

The +12V at the ECM plug are connected directly to the battery and are not affected by the ignition key.

J2534 adapters are the recommended choice. They support K-Line and CAN bus.

J2534 (PassThru) is an international standard for communication with ECU's.

If you are interested in the details read the API Documentation (PDF) for programmers.

As J2534 adapters use binary data transfer with USB Full speed (12 MBit) they are by far the fastest of all adapters.

This may be relevant if you connect to a CAN bus with high traffic.

They support many protocols (even simultaneously), can generate a programming voltage up to 20 Volt at some of the pins,

can pull some pins to ground, can measure analog voltages (ADC) and receive RS232 data at the 2.5mm jack on the back side.

The genuine J2534 adapters (for example Tactrix OpenPort or Drewtech Mongoose) are very expensive ($180 ... $500 USD).

Chinese clones are significantly cheaper. See below.

ATTENTION: Do not buy XHorse Mini-VCI adapters. They are Chinese fake garbage. They do NOT work with HUD ECU Hacker!

When you plug in the adapter for the first time Windows installs a default driver and assigns a COM port.

ATTENTION: This is the wrong driver and the COM port will never work.

In the HUD ECU Hacker toolbar (button Install USB Driver) you can install the original Tactrix driver.

After installing the correct driver the COM port will disappear and a J2534 device will show up in Control Panel:

If you get a timout error when connecting to the ECU over K-Line you can execute the echo test.

HUD ECU Hacker will send some data packets to K-Line and verify that the echo is received correctly.

If this test fails you have either a defective adapter or K-Line has a shortcut.

Make sure that K-Line has +12 Volt while the adapter is connected.

Tactrix adapters have a 2.5mm stereo jack at the back side which has an analog input and an RS232 input.

This feature is completely undocumented. You will only find a sparse information how to grab this data to the SIM card.

But there is no command to read these inputs over the USB cable into HUD ECU Hacker.

Users have asked me how to use these inputs to read a wideband O₂ sensor.

This is impossible, but you can use a cheap Arduino UNO to read up to 6 analog inputs into HUD ECU Hacker.

Read the chapter about Dyno Wideband Tuning.

ELM327 / OBDLink / Scantool / vLinker adapters support K-Line and CAN bus.

There are 3 types of ELM327 adapters:

Do NOT buy any of the cheap Chinese ELM327 adapters which are sold on Amazon or eBay!

They are all fake and work only partially. Many ELM327 commands are buggy or even not implemented at all.

If you see one of the following errors in the HUD ECU Hacker Trace pane, the Chinese have betrayed you:

The buffer of the fake adapters is so tiny that it cannot even receive a 128 byte ECU response!

So you can only scan the OBD2 commands which give few information, but not the detailed vendor specific commands.

 

You will see none of the above errors if you use a genuine OBDLink adapter.

 

Some chinese USB adapters use a counterfeit PL2303 chip (right photo) which converts from USB to RS232.

On Windows XP and Windows 7 this works perfectly.

But on Windows 8, 10 and 11 the latest drivers from Prolific detect the counterfeit chip and refuse to work.

The driver returns the undocumented Error 433: "A device which does not exist was specified."

If you connect the adapter and Windows 10 does not find an installed driver it downloads the latest version 3.8

from Windows Update and you will see a yellow exclamation mark or a 'PHASED OUT' error:

Follow these steps on Windows 10 to add a bluetooth adapter: (on Windows 7 it is similar)

If it was successful you see 2 COM ports in the combobox 'Port:' in HUD ECU Hacker:

Select the Outgoing serial port which is connected to the bluetooth device "OBDII".

The Incoming serial port is useless.

On the right photo you see that there are several SMD parts missing (4 transistors and 16 passive components).

This means that the J1850 bus will not work. Only CAN and K-Line are implemented.

If a vendor sells this as a universal ELM327 adapter, this is a fraud.

However, the J1850 bus was used by older GM and Ford vehicles, but is not used in modern cars anymore.

These adapters are the most stupid design because they represent a WIFI access point.

Mostly they respond on the fix IP address 192.168.0.10 and port 35000 without WIFI password.

The problem is that you must disconnect your notebook from your router to connect it to the adapter.

So after connecting to the OBD adapter you lose internet access.

The signal strength and maximum distance between computer and adapter are worse than with Bluetooth adapters.

The adapter uses the most used Wifi Channel 11. So conficts with your or your neighbour's router are probable.

There is absolutely no reason why should buy these adapters.

The CANable 2.0 family are several cheap (from $15 US) adapters only for CAN bus.

They have an ARM Cortex-M4 processor like STM32G431 with 160 MHz clock.

Mostly they have a switch to turn on a 120 Ω termination resistor. Turn this off when you connect to a vehicle.

There are 2 open-source firmware versions available: Slcan and Candlelight.

But the legacy firmwares from Github have several issues:

If CAN bus is not working, you will never know what is wrong because error reporting is not implemented.

The Candlelight firmware is compete crap. Not even the driver is installed correctly.

There is a long list of problems with the legacy firmware.

Therefore I worked 3 months to write a new high quality Slcan and Candlelight firmware.

The new firmware version CANable 2.5 from ElmüSoft fixes a ton of bugs and adds many new useful features.

HUD ECU Hacker fully supports all the new features, however the new firmware is still 100% backwards compatible.

I strongly recommend that you use the firmware updater in HUD ECU Hacker to upgrade your CANable.

Please read the detailed manual about the new CANable 2.5 firmware with CAN FD support.

There you also find the links where to buy these adapters.

But even if you have an old CANable 1.0 adapter you can use it with HUD ECU Hacker.

However you will have to live with the restrictions: limited features, no CAN FD support, no firmware update possible.

If you already have a Chinese ZLG (Polaris) UsbCAN adapter, you can use it with HUD ECU Hacker.

However, do not buy one because it supports only CAN bus and the driver is worst Chinese 'quality' with many bugs.

Most of the pins are fake. Only the uppermost (CAN0H and CAN0L) are connected internally.

The LED's are extremely stupid: Red LED blinking means OK. Green LED illuminated means CAN bus error.

To install the driver click the toolbar button Install USB Driver in HUD ECU Hacker.

Many years the simple open-collector K-Line connection was the standard of communication with the ECU.

A serial protocol is used for a bidrectional data transfer over a single wire which allows speeds up to a maximum of 50 kBaud.

The right screenshot shows the K-Line communication to the Delphi MT05 ECU on an oscilloscope.

KW 1281 is a proprietary Bosch/Volkswagen protocol and the oldest protocol implemented in HUD ECU Hacker.

It was used in old ECU's from Bosch (Made in Germany) in cars from Volkswagen and Opel.

KW 1281 uses K-Line with 5-Baud Init and 9600 baud data transfer.

These are the transferred bytes that you see in the Trace pane when reading an analog ECU input (sensor):

But invisibly in the background the double amount of bytes is transferred.

Blue:   Bytes sent by the tester (HUD ECU Hacker)

Green: Bytes sent by the ECU

As you see the KW 1281 protocol is very stupidly designed:

Each and every received byte is sent back inverted which produces 100% overhead.

Addionally K-Line adapters have a very bad performance when single bytes are transferred one by one over USB.

The result of this inefficent transfer is that KW 1281 is much slower than modern ISO protocols.

IMPORTANT: The Bosch ECU's are extremely primitive. They don't have a mechanism to handle transfer errors.

If anything goes wrong during the transfer the ECU sends 4 garbage bytes and then stops communication.

Timing is very critical. If an expected byte needs longer than 40 ms the ECU blocks itself and does not respond anymore.

To avoid timing problems do not run processes on your computer that consume much CPU.

The ISO 9141 protocol is the oldest of the standardized OBD protocols. It is quite primitive.

The data transfer on K-Line (Pin 7) is like RS-232, sending the least significant bit first, but the voltage is inverted.

ISO 9141 uses the extremely slow 5 Baud Init to wake up the ECU. It takes 2 seconds to transmit the address byte (0x33).

Some ECU's require this 5 Baud Init to be sent additionally on L-Line (Pin 15).

 

Next you see the first OBD2 command 01 00 (Request supported PID's) and the response from the ECU.

The command is embedded into a packet which starts with a header and ends with a checksum.

ISO 9141 does not define error codes.

The ECU simply does not respond when it does not understand a command.

The Keyword 2000 protocol (KWP 2000) is defined in ISO 14230. It offers much more functionality than ISO 9141.

ISO 14230 normally uses Fast Init to wake up the ECU.

Fast Init means that the K-Line goes low for exactly 25 ms and then high for 25 ms. After that the communication starts with 10400 baud.

However, there are a few ECU's which combine the ISO 14230 protocol with 5-Baud Init.

On the left you see the fast init, followed by the command 'Start Communication' and the response from the ECU.

On the right you see long pauses between the bytes which are needed if the ECU is old and very slow.

In detail the command 'Start Communication' (Service = 81) looks like this:

The Delphi MT05 uses the address 11. The application on the PC (the tester) uses the address F1.

The MT05 responds with 2 key bytes EF and 8F which define how the ECU wants the commands to be formatted.

They define how to transmit the packet length and if the source/target addresses are to be sent.

You see the meaning of the key bytes in the Trace pane in magenta when connecting.

The first header byte is called format byte.

It may contain the packet length and it's bits define if addresses are sent and the type of addresses (physical, functional).

To simplify reading the binary data HUD ECU Hacker displays the payload bytes in parenthesis in the Trace pane.

The other bytes (header + checksum) are not really interesting as they are generated automatically.

The following table shows a long response (102 data bytes) which contains an additional length byte (header 4).

HUD ECU Hacker tries first to connect with the physical address defined in the parameter XML file (Default = 0x11).

If this fails it waits 5 seconds and tries again with the functional address 0x33.

A physical address (format byte contains 0x80) means that one specific device on a bus is addressed.

A functional address (format byte contains 0xC0) is like a broadcast address to a group of devices.

There are functional addresses for Steering Controllers, ABS Systems, Air Condition, Audio, Lightning, etc.

The functional address 0x33 is used to address "Engine Controllers" (ECUs).

As normally only one ECU is connected this can be used when the physical ECU address is unknown.

As you see here the ECU responds to the functional address 0x33 with it's physical address 0x11:

The Delphi MT05 does not need functional addressing, but there are strange ECU's which do not respond to their own physical address!

ISO 14230 defines several error codes which the ECU can return.

If the ECU does not understand a command it sends 7F (failure) followed by the service and the error code.

If the ECU does not receive commands it switches to sleep mode after 5 seconds.

While HUD ECU Hacker is polling data this will never happen because polling takes place 3 to 5 times per second.

Only if you switch to manually enter commands (in the Trace pane), polling stops and HUD ECU Hacker sends a Keep-Alive every 3 seconds.

Honda uses an undocumented proprietary protocol over K-Line at 10400 baud.

A pulse of 70 ms similar to the Fast Init of ISO14230 is sent to wake up the ECU before communication starts.

Newer vehicles are equipped with CAN bus which uses 2 wires (CAN Hi and CAN Lo) and runs mostly at 250 or 500 kBaud.

Many controllers and sensors may be connected to the same bus. Each endpoint has at least one unique ID.

The neutral voltage on CAN bus is 2.5 Volt. Each endpoint has a transmitter which pulls CAN Hi up and CAN Lo down.

The receiver measures the difference between CAN Hi and CAN Lo which makes CAN robust against electromagnetic interference.

Additionally an intelligent arbitration system in each endpoint detects if 2 endpoints try to send data at the same time.

In case of such a collision it is clearly defined which enpoint has priority.

The endpoint which loses arbitration must stop transmission and try to send the packet again later.

Below you see a raw CAN frame which contains the identifier (11 bit or 29 bit) and max 8 data bytes.

Data transfer is very robust because a 15 bit CRC assures that each frame is received without error.

If you have to analyze problems with CAN bus and you have an oscilloscope that can connect to a computer over USB,

you can use my open source software Oszi Waveform Analyzer which converts your oscilloscope into a logic analyzer.

After A/D conversion of the analog inputs the CAN bus decoder shows the bits of the CAN packets, as you see here:

The CAN bus Identifier (ID) is similar to the ECU address in the ISO 14230 protocol.

Some motorbike ECU's permanently broadcast data to the CAN bus.

This is mostly engine speed, coolant temperature and MIL lamp status which the dashboard displays to the driver.

In motorbikes with ABS system you may also see the ABS ECU broadcasting the front and rear wheel speed.

As you see in the diagram above there is an ACK Slot in the CAN frame.

The idea is that the receiver of a packet sets the ACK bit to acknowledge that it has received the packet.

If the packet was not acknowledged the sender may send it again.

If you see the same CAN packet beeing sent over and over again within one millisecond the cause may be that nobody has acknowledged it.

But broadcast messages are normally sent in fix intervals and need not necessarily be acknowledged.

ELM327, OBDLink and UsbCAN adapters allow to chose if you want to silently monitor the CAN bus without interfering by not setting the ACK bit.

However J2534 and VAG K+CAN adapters always acknowledge all packets on the bus. You cannot turn this off.

If your ECU uses the CAN Raw protocol you will see completely undocumented and proprietary packets which differ with each vendor.

Mostly these ECU's have one address (CAN ID) on which they receive commands and multiple addresses on which they send responses.

Here you see the CAN Raw traffic of the Deni 1700 ECU which broadcasts data on multiple CAN ID's:

 

CAN FD stands for "Flexible Datarate". CAN FD extends the classic CAN protocol by 2 main features:

HUD ECU Hacker supports CAN FD, but most adapters do not.

If you want to experiment with CAN FD you need a CANable adapter and must upload the CANable 2.5 firmware.

If you sniff the CAN bus traffic in a car or a truck you get a tremendous amount of data.

CAN bus traffic comes from ECU, ABS, air bags, seat belts, multimedia, door sensors, window- and mirror control, and more.

A filter and a mask will be needed to exclude all traffic on the CAN bus except with the ECU.

But even if you only connect one ECU which autonomously sends packets you may want to exlude them from the sniffed data.

The filtering also tells the adapter which packets to acknowledge (set the bit in the ACK slot of the CAN frame).

If HUD ECU Hacker runs in sniff mode it will never modify the ACK bit.

Otherwise, when communicating with the ECU or in Emulator mode the received packets must be ACKnowledged.

If a CAN packet is not ACK'ed by the receiver the sender assumes that it was not received and sends it again.

If a CAN packet is not ACK'ed mutiple times the sender generates an error and stops the communication.

For CAN Raw protocol you must enter RespFilter and RespMask in the parameter XML file.

For ISO 15765 these are not needed. You enter a fix RespID instead.

For Sniffing you can use the following window to define the filter and mask:

All checkboxes have a tooltip which explains the purpose.

In the field 'Response ID' enter an ID on which the ECU responds and the filter and mask will be calculated automatically.

  If you know the ECU ID enter it into the field 'Response ID'.

  If you enter 7E8, the filter and mask will be calculated as 7E8 and 7FF.

  Otherwise use the letter 'X' to specify that a digit does not matter (e.g. 7EX). A digit corresponds to 4 bits.

  If you enter 7EX, the filter and mask will be calculated as 7E0 and 7F0.

  If the precision of 1 digit = 4 bits = 16 matches is not enough you must enter filter and mask manually.

Each bit in the mask which is one defines that the same bit in the filter must match the same bit in the ID of the received CAN frame.

Each bit in the mask which is zero defines that the same bit does not matter, neither in the filter nor in the ID of the received CAN frame.

If you enter ResponseID = XXX or Mask = 000 the filter is turned off and all CAN ID's will pass through.

The ISO 15765 protocol has been developed to overcome the limit of 8 data bytes in CAN bus frames.

ISO 15765 can send messages up to 4095 data bytes in multiple CAN Raw frames.

It occupies the first data byte of each CAN frame as a control byte.

The first byte may define that the frame is a SF (Single Frame) which transmits only 7 data bytes.

Or a FF (First Frame) followed by multiple CF (Consecutive Frames) and FC (Flow Control Frames) transport a larger payload.

You can configure HUD ECU Hacker to show with the ISO 15765 data additionally the CAN Raw frames in the Trace pane:

Above in blue you see a 3 byte ISO 15765 command sent to the Delphi MT05.3

The next line in gray shows this command encoded as a Single Frame in a CAN Raw packet.

The ECU responds with the First Frame.

Then HUD ECU Hacker sends a Flow Control Frame.

The ECU sends two Consecutive Frames.

And finally in green you see the ISO 15765 decoded ECU response.

OBD2 compliant ECU's with 11 bit ID mostly reveive commands on address 7E0 and send responses on 7E8.

If your vehicle has more than one ECU, the second ECU may use the pair 7E1 / 7E9.

OBD2 compliant ECU's may use the range 7E0 ... 7E7 for receiving and 7E8 ... 7EF for responding.

The scantool can send a command to the broadcast address 7DF where all connected ECU's must respond with their own address.

ECU's with 29 bit ID use 18DB33F1 for broadcast and 18DAF1xx for commands and 18DAxxF1 for responses.

ECU's with ISO 15765 protocol may additionally broadcast autonomous CAN Raw packets on other addresses.

Mostly these data packets contain MIL status, engine speed and temperature which are displayed by the dashboard.

The J1939 protocol is widely used in industry and in on-highway, construction, agriculture and forestry vehicles.

Many devices are connected to the CAN bus like ECU, brake and transmission controller, retarder, torque converter, cruise control, even joysticks.

In a truck the CAN bus controls everything from the driver cabin to the back lights of the trailer.

Driver commands are sent over CAN bus, like lowering a lift axle or a ramp in a truck or controlling the air condition in a bus.

In certain intervals most controllers send autonomously data packets with wheel speed, tire pressure, oil pressure or catalyst status.

J1939 is also used in electric vehicles where it gives details of the high voltage and temperature of battery packs, charge current, etc.

J1939 uses two baudrates: either 250 kBaud or 500 kBaud.

For the J1939 CAN bus you need an HD16-9-1939 adapter.

There are two versions: black and green. The pin F has a different diameter so only the correct plug will fit in.

If you buy a cable like on the photo you can connect to both types of plugs.

When HUD ECU Hacker connects to the CAN bus it will not interfere in any way with the J1939 traffic.

One exception is when you click Clear Fault Codes wich will send a command to one CAN controller.

You can also send a broadcast request to get an Address Claim or the Diagnostic Messages from all CAN controllers.

J1939 uses CAN packets with a 29 bit identifier which contains the priority, a PGN and the source address.

The source address defines the CAN controller that sends the packet. Addresses range from 00 to FF.

Some CAN controllers have a fix address, others claim their address in the initialization phase dynamically.

The destination address is mostly broadcast which means no specific destination.

But there are also some PGN's which allow to be sent to a specific controller on the bus.

The PGN (Parameter Group Number) defines how to interpret the 8 data bytes in the packet.

Each parameter in the packet has an SPN (Suspect Parameter Number) assigned.

You find a list of all existing J1939 PGN's and SPN's at IsoBus.net.

The following example shows the controller with source address 02 sending a packet with priority 3 and PGN 61444.

The receiver has a huge database which defines for each PGN how to decode the 64 bits in the 8 data bytes.

Additionally the J1939 database defines thousands of lookup values.

For example SPN 1675 defines 14 values explaining problems why the engine cannot be started:

Over temperature, immobilizer active, inhibited by transmission, engine not ready, engine already running, etc.

Most J1939 messages use the 8 data bytes that are available in a CAN bus packet.

But J1939 also provides a way to transmit messages up to 1785 bytes which consist of multiple 8 byte packets.

Therefore the J1939 Transport Protocol is used which is implemented in PGN 60160 and PGN 60416.

HUD ECU Hacker can decode 1400 messages (J1939 PGN's) with 8500 parameters (J1939 SPN's).

HUD ECU Hacker extracts the available information about each controller on CAN bus and shows it in the dark blue header:

But this works only if the messages "Address Claimed", "Component Identification" and others have appeared on CAN bus.

If you play a logfile HUD ECU Hacker scans the entire file searching these messages before playing back the log data.

If you connect to a CAN bus that is already busy you will probably miss these messages.

Click the button "Request" below in the DataGrid to broadcast a request to all CAN controllers.

The J1939 protocol can also transmit ISO 15765 traffic over the PGN's 0xDA0000 and 0xDB0000 e.g. for ECU flashing.

HUD ECU Hacker will automatically extract ISO 15765 traffic in a J1939 logfile into a separate HTML file.

Normally the NMEA companies sell you expensive PC interfaces to connect to your boat.

For example Digital Yacht iKonvert or Actisense NGT-1 are extremely expensive ($245 US) and slow (only 230 kbaud).

Actisesense NMEA Reader is a very primitive software, full of bugs and hundreds of NMEA parameters are not implemented.

But HUD ECU Hacker allows you to connect with cheap ($20 US) and fast (12 MBaud) adapters: Tactrix Clone or CANable.

And you will see more than ten thousand parameters decoded correctly.

You also don't have to buy expensive CAN bus simlators anymore. HUD ECU Hacker can send any logfile to the CAN bus.

Use Marco "Send Logfile" in the CAN Raw Terminal.

For a Tactrix adapter connect the wires +12V, GND, CAN Hi and CAN Lo of a J1962 cable and a NMEA 2000 cable.

For a CANable adapter you can directly connect GND, CAN Hi and CAN Lo of the NMEA 2000 cable with the

3 screws of the adapter. The J1962 cable and the +12V are not required. Switch off the 120 Ohm resistor in the adapter.

Many cars use CAN bus, but send their proprietary manufacturer specific packets that are not defined by J1939.

If the meaning of the 8 bytes in the CAN packet is unknown it is impossible to decode the data.

But there is the OpenDBC reverse engineering project on Github that is dedicated to decode CAN bus packets of several car models.

They created DBC files (CAN DataBase) which define how to decode the bits and bytes in the CAN data.

You can download DBC files for BMW, Cadillac, Chrysler, Ford, GM, Hyunday, Mazda, Mercedes, Nissan, Opel, Rivian, Tesla, Toyota, Volvo, VW and more.

You can also use a DBC editor and create your own DBC file.

Copy the DBC file into subfolder "ECU\DBC\Parameters" and HUD ECU Hacker will read it with the built-in DBC parser.

If there are errors in the DBC file you will see them in the Trace pane.

The DBC file syntax is extremely old and primtive.

Classic DBC files allow only to define CAN messages with a static content.

But there are many J1939 and NMEA 2000 messages that may contain a dynamic amount of signals.

For example the J1939 message DM1 "Active Diagnostic Trouble Codes" may transfer one or mulitple DTC codes.

With a classic DBC file format it is impossible to define these messages correctly.

Therefore ElmüSoft has extended the DBC file syntax to allow a dynamic count of signals.

Here you see an NMEA 2000 message that may transmit a dynamic amount of PGN's.

The CL_ 1 tells the DBC parser that the last signal 'PGN' may repeat any number of times.

'CL' stands for "Clone Last". The last signal is cloned as long as there are bytes available.

Here the CL_ 2 < 1 means that the last 2 signals are cloned the amount of times defined in signal 1.

The index of the signals is zero-based, so signal 1 is the second signal.

The byte value of CountOfZoneNumbers defines how many ZoneNumber and ZoneName are transmitted.

There are more syntax extensions implemented. Write me an email if you want to create your own DBC file.

In 2020 my Regal Raptor 350 motorbike reported a problem. I searched for OBD2 software which can show me an error code.

But all the programs that I tested were completely uselss. They did not display any data.

The Regal Raptor 350 uses the Delphi MT05 ECU which is not OBD2 compliant.

Then I found a scantool that is made for this ECU.

But it is primitive and expensive ($250 US). It has only 5 buttons and shows only 2 parameters at once.

Finally I found a manual of the Delphi MT05 where they mention a PC software "PCHUD" that can scan this ECU.

PCHUD ('Heads Up Display' for PC) is a very old program from Delco Electronics written in 1993 for Windows 3.

Today it is impossible to find this ancient software in internet.

There are lots of dead links and a fake PCHUD download on a chinese website that is a trojan.

I finally found it in the forum China Riders offered by the (ex)user 'katflap'.

The ancient 16 bit program PCHUD does not run on 64 bit Windows because Microsoft removed support for 16 bit applications.

If running on a 32 bit Windows in the 16 bit emulator it permanently consumes 100% of the CPU.

PCHUD is buggy, clumsy to use, cannot show all parameters at once, cannot clear fault codes, supports only K-Line adapters.

I reverse engineerd PCHUD and implemented the parameters into a my own software. HUD ECU Hacker was born.

The first version of HUD ECU Hacker, released in 2020 during the plandemic, was a modern replacement for the primitive PCHUD.

Another old software Diag Tool for the Delphi / Liteon MC21 has also been reverse engineered and replaced by HUD ECU Hacker.

Previously there was no other software available that could communicate with these proprietary ECU's.

 

Apart from that HUD ECU Hacker has been designed to be community software.

Every user can adapt the program to his needs.

When you have adapted the XML parameter file for another ECU, you are asked to send it to me for publishing it.

 

This is the main window of HDU ECU Hacker.

The button "Clear Fault Codes" clears the historic fault code(s) from the non-volatile ECU memory.

But if a fault is still present it will not be cleared: You click the button and nothing happens.

This button will clear only historic fault codes which are not present anymore.

The MIL / EFI lamp is only on if there is a current fault present. It is off if there are only historic DTC's.

Some current faults disapear immediately when the fault has been fixed (e.g. Oxygen sensor cable disconnected).

Other current faults will disapear alone after driving some minutes.

Some historic fault codes are erased automatically after driving 30 times without further faults.

The ECU can report multiple Current DTC's at once and it can store multiple Historic DTC's.

If there are multiple DTC's present, they are displayed alternating once a second in the Dashboard.

You see all faults at once with their status when you click the button Show Fault Codes.

If you get the fault codes P0171 or P0172 please read the chapter Self-Learning.

This screenshot shows the playback of the logfile Regal Raptor 350 - Starting Motor.xml

For each parameter you see the raw value and it's meaning and the minimum and maximum values.

A gauge displays the value graphically. If the value can also be negative, the gauge starts in the middle.

Values that have changed since the previous sample have a yellow background. You can turn off this highlighting.

On the left screenshot you see a tooltip which appears when you hover the mouse over a parameter.

Some parameters show a wrench icon. You can click on it and modify these values in the ECU. See Data Slewing.

The dashboard can be configured 100% by the user after checking the checkbox Edit Mode below.

You can create, edit and delete groups and assign parameters to them.

You can move around the groups, change the order of parameters and drag and drop them to another group.

In the dialog on the right you can configure a value parameter.

The ignition voltage has a minimum of 0 Volt and a maximum of 32 Volt.

You can restrict the range of the gauge to something more useful like 7 V to 16 V.

When you set an alarm the parameter will be displayed in red if the value exceeds the given limits.

These images are graphs created from the logfile Regal Raptor 350 - Driving.xml

You can chose the parameters that you want to include.

HUD ECU Hacker allows to send commands manually to the ECU and study the response.

For the purpose of hacking you can also enter XX, YY, which will be replaced with all values from 00 to FF.

In the example above entering '21 XX' has sent 256 commands from '21 00' to '21 FF' to the ECU.

Here the ECU (a Delphi MT05) has only answered 4 of the 256 commands, for the others it has returned an error.

Entering '22 XX YY' will send 65536 commands from '22 00 00' to '22 FF FF' to the ECU.

For the CAN Raw protocol you must additionally specify the Tx CAN ID for sending the command and the Rx ID for receiving the response.

Some ECU's send multiple responses on multiple CAN ID's to one command. In this case enter all Rx ID's separated by commas.

The Injector window supports macros that send commands to the ECU and process complex responses.

For more details see Macros

In the pane "Control" you can create logfiles with the button Start Recording after connecting to the ECU.

While recording a logfile HUD ECU Hacker prevents that Windows goes to sleep.

You can also record a log file while you are driving.

Connect the cables and put a notebook into a saddlebag or backpack.

The MT05 allows to manually modify some of the parameter values which have been measured or calculated.

The purpose of data slewing is to analyze an engine which is not running correctly.

Example:

First set all the preset values that you want to change in the list then click 'Send all presets to ECU'.

These changes have effect on the running motor.

All these changes are temporary and only stored in RAM. After turning off the ignition key they will be lost.

When the motor is runing idle and you set Idle RPM Target to 2500 rpm you will hear how it slowly becomes faster.

This graph shows the logfile Regal Raptor 350 - Data Slewing.xml where the engine was running idle with 1400 rpm.

At 00:00:29.806 I have set the slew parameter Idle RPM Target to 2500 rpm. The ECU slowly adapted the idle speed.

At 00:01:12.480 I have clicked the button Reset all presets in ECU.

NOTE: On a Benelli TRK251 (1 cylinder) you can set the idle speed target but the engine speed is not adjusted correctly.

When the engine is off and you set Fuel Pump Duty Cycle to 15% you will hear the fuel pump running quietly.

You can control the Idle Air Control Valve with the slew parameter IACV Target Step.

If you have problems with the idle speed read appendix IACV Calibration.

Data Slewing does not work with my chinese ELM327 adapters. But J2534 and K-Line adapters do work.

The ELM327 Datasheet says (page 31) that the ELM327 limits the bytes that can be sent to the maximum for OBD2.

Therefore HUD ECU Hacker sends the command ATAL which allows longer commands.

My chinese adapter answers ATAL with 'OK', but it still refuses to send more than 4 data bytes.

You will see a timeout error in HUD ECU Hacker.

As there are so many problems with chinese ELM327 fake clones I implemented the ELM327 Terminal.

Here you can test your adapter by sending commands and studying the responses.

The screenshot shows that my ELM327 clone sends commands only up to 4 data bytes.

If I send 5 data bytes or more (like the Slewing commands) there is no response, no error and no prompt.

I verified on the oscilloscope that the adapter indeed does not send anything.

The command ATAL is simply ignored although it was answered with a fake 'OK'.

It is a fraud to sell this crap.

By the way: It is completely irrelevant if a chinese adapter claims to be version 1.5 or 2.1. They are all crap.

And I saw people complaining in internet about ELM327 adapters which have even less functionality than mine.

HUD ECU Hacker can also be used as CAN Bus Analyzer / CAN Bus Debugger / CAN Bus Logger / CAN Bus Terminal.

In Sniff Mode you can see the entire traffic on the CAN Bus (not only to the ECU) in real time.

You can set filters to show only the packets which you are interested in.

And the CAN Raw / ISO 15765 Terminal allows to send commands manually to the CAN bus:

Normally you must buy expensive proprietary adapters for expensive CAN bus analyzer software.

HUD ECU Hacker allows to use a cheap chinese J2534 clone.

The CAN bus Terminals (CAN Raw and ISO 15765) support macros that communicate with the ECU.

For more details see Macros

The Tactrix adapters only implement the basic J2534-1 commands, which do not support new features like CAN FD, CAN FT, CAN SW...

But HUD ECU Hacker fully implements also the new J2534-2 commands which are used by the newer and more expensive J2534 adapters.

HUD ECU Hacker does not need to make any modification on your Windows to spy another software.

Neither is it necessary to modify your registry nor to exchange a DLL file that is used by the spied application.

It works with any J2534 adapter like Tactrix, Drewtech, Mongoose, MaxiTech, VXDiag, Scanmatic, Chipsoft, Xtool, SM2 pro, etc.

In the RS232 Terminal you can manually send TX data to a COM port and see the received RX data.

You can see all RS232 events like CTS, DSR, CD, Ring, Break and set/reset DTR and RTS.

You can optionally use two COM ports simultaneously.

Macros are implemented for very advanced users who have knowledge of programming.

HUD ECU Hacker allows to write macro scripts in the C# language to automate complex tasks.

They will be compiled into native assembler code, so execution is lightning fast.

Macro scripts are supported in:

In case of a macro for the Emulator you simply declare it in the corresponding Emulator XML file:

In the Parameter XML file a macro can be added as:

The function Initialize is executed before starting to poll data.

For all other types of macros you must declare it in the file Macros.xml in a subfolder under 'Macros'.

A macro script must contain at least one public static function that is called when you run the macro.

Each macro function may take any amount of parameters in which user values are passed to the script.

For each script parameter a control (ComboBox, TextBox, CheckBox,...) will be created where the user must enter a value.

The following example shows how a CAN bus communication can be automated with a macro script.

In the XML file you declare the display name, description and the parameters that the user must enter.

Show Full Size

• string Hex = ByteArray.ToHex(int First, int Count)
  Converts some or all bytes from ByteArray into a hex string "5C A4 CC 9F".
  The parameters First and Count are optional.
• string Text = ByteArray.ToAscii(int First, int Count)
  Converts some or all bytes from ByteArray into an ASCII text. Invalid bytes are displayed as '?'.
  The parameters First and Count are optional.
• byte[] New = ByteArray.Extract(int First, int Count)
  Extracts some bytes from ByteArray into a new array.
  The parameter Count is optional.
• byte[] New = ByteArray.Append(byte[] Data, int First, int Count)
  Appends some or all bytes from the array Data to the bytes in ByteArray.
  The parameters First and Count are optional.
• byte[] New = ByteArray.ReplaceAt(int Pos, byte[] Replace)
  Replaces the bytes at position Pos in ByteArray with the bytes in Replace.
• bool ByteArray.Matches(params byte[] Data)
  Returns true if all bytes in both arrays are identical.
• bool ByteArray.StartsWith(params byte[] Data)
  Returns true if the array starts with the bytes in Data.
• int ByteArray.Find(int Start, params byte[] Pattern)
  Returns the position in the array where Pattern was found or -1 if no match.
• int ByteArray.DiffBytes(params byte[] Data)
  Returns the count of bytes that are different in both arrays. Zero means they are identical.
• void ByteArray.Fill(byte Value)
  Fills the entire array with the given byte value.

• Byte[] Array = String.ParseHex()
  Converts a String like "11 22 33" into a Byte Array { 0x11, 0x22, 0x33 }.

• Macros\Send Logfile\SendLogfile.cs
  This script reads the content of a logfile and sends it to the CAN bus.
• Macros\CAN Bomber\CanBomber.cs
  This script sends packets with a fix CAN ID or a range of CAN IDs to CAN bus.
• Macros\Honda Sniff\HondaSniff.cs
  This script for the Sniff Terminal switches the baudrate when a firmware is uploaded to a Honda ECU.
• Macros\Deni E1700\E1700.cs
  This script for the CAN Raw Terminal captures the CAN bus traffic of a DENI software while uploading
  calibration tables over a UsbCAN adpater to the E1700 ECU and writes the calibration tables into an XML file.
• ECU\MT05\Emulator\Flashing.cs
  This script for the Emulator automates the upload and download of flash data for the Delphi MT05 / MT05.2.

Download / Upload Flash Memory (MT05 / MT05.2 only)

1. The Bootloader is required to start up the ECU.
   It will never be overwritten when flashing. This is a protected area.
2. The Configuration Data will always change when you turn off the ignition key.
   The ECU stores non-volatile data here when you turn the ignition key off, like:
   fault codes, ignition counter, statistics, fuel learning (BLM), airflow learning and throttle learning.
   HUD ECU Hacker does not write into this area, but you can erase the content of this erea. See Reset EEPROM.
3. The Calibration Tables are used to calculate the optimal operation of the motor depending on
   factors like speed, engine load and temperature, etc. They control fuel injection, spark timing, etc.
4. The Firmware area contains the executable program code.
   You should normally not overwrite this area except you know exactly what you are doing.

Before flashing for the first time store your original flash file in a secure place! If flashing of only the calibration tables goes wrong your ECU may still communicate over K-Line. But if flashing the firmware area goes wrong your ECU will probably be bricked. See Rescue a bricked MT05.

Tuning (MT05 / MT05.2 only)

Tuning with Commercial Software

Tuning MT05 with HUD ECU Hacker

Download the flash memory of your ECU into a BIN file, go to the tab "Tuning", select your file and HUD ECU Hacker will auto-detect all calibrations.

With the charityware HUD ECU Hacker you save a lot of money by not having to buy commercial software. Flash download, checksum correction and flash upload of the MT05 can also be done with HUD ECU Hacker. Please do not forget to give a donation for using HUD ECU Hacker.

Calibration Editor Show Full Size

3D Editor Show Full Size

Hex Viewer Show Full Size

Hex Viewer

Delphi Calibration Data

Completing Auto-Detection Results

Editing Calibrations

Working with Patches

Dyno Tuning with Wideband Sensor

Connection Diagram Show Full Size

Dashboard Parameters Show Full Size

K-Line Scan Speed Show Full Size

Temp. Sensor Show Full Size

• AFR, TPS and Temperature are transmitted by the Arduino every 25 ms.
• MAP and RPM are transmitted every 35 ms by the ECU (each K-Line command needs approx 17 ms). (See screenshot)

Adapting to other ECU's

Step 1a. Sniff Data internally

Step 1b. Sniff Data externally

Show Full Size

Show Full Size

K-Line Show Full Size

CAN Bus Show Full Size

Step 2. Test the ECU Emulator

K-Line Show Full Size

CAN Bus Show Full Size

Step 3. Simulate the ECU

Step 4. Enter the XML Commands and Parameters

Step 5. Enter the XML Names and Descriptions

Download and Installation

Install USB Drivers

Show Full Size

Trouble Shooting

• The ignition key must be on.
• The kill switch must be in the position where it allows the motor to run.
• Some motorbikes (Benelli) require the side stand to be up otherwise the ECU will not respond.
• It is not necessary to start the motor to establish a connection.
• Check that you have connected the three wires correctly as shown in the connector diagram.
• If you have a MT05 ECU verify that the seven voltages are correct that are marked red in the MT05 diagram.
• The voltage at the K-Line wire MUST be +12 Volt while the adapter is connected to the ECU.
  Some adapters do not enable the pull up resistor when they are in power safe mode.
  Measure the voltage while clicking the "Connect" button in HUD ECU Hacker which will activate the adapter.
• If you use a K-Line or J2534 adapter ecxecute the Echo Test to check the adapter.
• There are 2 types of timeout errors which indicate different errors:
  • Timeout waiting for echo means always that you have a hardware problem or the wrong COM port.
  • Timeout waiting for response (or received garbage characters) with ELM327 adapter may mean that the baudrate is wrong.
    You can change the baudrate in the window "Configure Adapter". Normally ELM327 adapters use 38400 baud or 115200 baud.
  • Timeout waiting for response with K-Line / VAG adapter may happen rarely.
    The reason is that the ISO 14230 protocol is very time critical. It demands 50 ±1 ms for the fast init.
    But Windows as a multitasking OS is not very precise and the interval seen on an oscilloscope may vary from 45 ms up to 70 ms.
    If the interval between fast init and the command 'Start Communication' exceeds the limits the ECU does not respond.
    K-Line adapters are the only adapters where timing depends on the computer. J2534 and ELM327 adapters create a precise timing.
    If you get this type of timeout error, try the following:
    1. Click 'Connect' several times until it works. It may work 8 of 10 times.
    2. Some adapters (e.g. some SiliconLabs chips) do not support the way how HUD ECU normally generates the fast init pulse.
       Try switching Fast Init Mode 1 / Fast Init Mode 2 in the window "Configure Adapter".
    3. For slow computers you can enter in the same window a K-Line timing correction which is added to the 50 ms interval:
       
       ATTENTION: If you enter an invalid value here you may screw up the fast initialization forever.
       If changing this value did not solve your problem, reset the correction to zero otherwise you may never be able to connect.
       To verify the timing you need a digital oscilloscope, otherwise it is pure try and error.
• BUSINIT: ERROR from an ELM327 adapter means that the adapter did not receive a valid response from the ECU.
• You can also change the configuration in "Autodetect OBD2.xml". Some older ECU's use 9600 baud.
• If you have tried everything and the ECU still does not respond, test your adapter: Connect HUD ECU Hacker to it's own emulator.
  Therefore you need a second adapter. See Emulator

Appendix

Delphi MT05.3

HiSun MT05

Delphi MT05.3 Show Full Size

HiSun MT05 Show Full Size

Rongmao MT05 and RM08

Harley Davidson MT05

Delphi MT05 Show Full Size

Rongmao MT05 + RM08 Show Full Size

Harley MT05 Show Full Size

Chinese Fake MT05

Real Delphi MT05 Show Full Size

Fake Delphi MT05 Show Full Size

Chinese MT05 Clones

Overheating Risk

1. The first damaged part will be the cylinder head gasket. As a result coolant will enter into the cylinders and vaporize.
   You will lose coolant through the exaust pipe. A vicious circle accelerating the damage.
   Replacing the gasket is expensive because the motor must be opened.
2. If you drive longer with an overheated motor the cylinders will be ruined and you need a new motor.

IACV Calibration

• The engine cannot be started
• The engine goes off alone while running idle (especially when it is cold)
• The idle speed is irregular
• The ECU may generate fault code P0505.

Position 0	Position 255

• Position 0:    The valve is fully closed. Air can only enter through the throttle into the intake manifold.
• Position 168: The valve is in the parking position for the next cranking. (Defined in the calibration IAC Park Position).
• Position 200: The maximum position that the ECU will use. (Defined in the calibration IAC Position Max).
• Position 255: The valve is fully open.

1. Take the IACV out so you can see the pintle position.
2. Connect HUD ECU Hacker.
3. In the Data Slewing window move the IACV to the absolute position 255.
4. Now disconnect the battery so the ECU cannot store this position in the flash memory.
5. Reconnect the battery. You should hear the fuel pump running. Now the ECU assumes the IACV in parking position.
6. Repeat steps 2 to 5 until the pintle does not move anymore. The spring must be completely compressed.
7. Now you have the pintle in the real mechanical position 255.
8. In the Data Slewing window click Reset all presets in ECU which moves the pintle to the parking position.
9. Turn off the ignition key. Now the ECU stores the correct parking position in flash memory.
10. Mount the IACV back into it's place.
11. When driving the next time the airflow self-learnig will adapt to the new conditions.

Self Learning

Reset EEPROM (NVRAM)

1. Erase the fuel self-learning data (BLM Table). All correction factors will be reset to 1.0 (no correction).
2. Erase the airflow self-learning data (Airflow Table). All correction factors will be reset to 1.0 (no correction).
3. Erase the throttle self-learning data (Auto-Zero). The throttle zero will be set to the default in the scalar 'TPS Raw Intercept'.
4. Erase all statistics. This will reset all time counters (except total runtime), max temperature, max batt voltage, max speed,...
5. Erase all historic DTC fault codes
6. Reset the IACV pintle position

1. Turn the ignition key off while pin 5 of the ECM plug is connected to ground (pin 2), then wait 10 seconds.
   This will only work if the scalar 'J1-16 Input Usage' is 1.
2. Or turn the ignition key off, wait 10 seconds, turn the key 5 times on/off within 5 seconds, then (while off) wait another 10 seconds.
   This will only work if the scalar 'J1-16 Input Usage' is not 1.

Rescue a bricked MT05

Show Full Size

Crankshaft Position Sensor

Show Full Size

Battery

Plugin for Bosch PSG 5 (Injection Pump)

Additional Operations

Connection

• K-Line: All operations over K-Line require a VAG KKL or VAG K+CAN adapter because
  the old KW 1281 protocol is neither supported by J2534 (Tactrix) adapters nor ELM327 / OBDLink adapters.
• CAN bus: All operations over CAN bus require a J2534, CANable or VAG K+CAN adapter.

Fast Reset Ford Immo Key

Show Full Size

Details about the operations

Purchasing the PSG 5 Plugin

High Quality Software  from  ElmüSoft

Desktop Organizer & Event Calendar My program PTBSync (in english + deutsch) has an event calendar / scheduler with lots of features, calculates the holidays of 70 countries, can display multiple gadgets on the desktop (current weather, birthdays, moon phase, menstruation calendar, world clocks,...) pins notes on the desktop, replaces the primitive Windows trayclock and adds a detailed tooltip, synchronizes with an atomic clock, and much more.

ECU Scanner, ECU Hacker, ECU Tuner for motorbikes, cars, trucks, vessels connects to ECU's (Engine Control Units) from motorbikes, cars and trucks, shows parameters, clears DTC's, has tuning for a Delphi ECU, has an ECU emulator, can analyze the CAN bus using cheap adapters, supports many protocols, has a sniffer and manual data injection for K-Line and CAN Bus, allows you to write your own macro scripts that communicate over K-Line and CAN Bus.

Oscilloscope Waveform Logicanalyzer displays oscilloscope waveforms and has A/D converters, noise suppression, precise time measurement, logic analyzer with decoders for UART, SPI, I²C, CAN bus (also CAN FD) and chip-specific decoders. Can split half-duplex communication. Transfers signals over USB (SCPI) from the oscilloscope to the computer and remote controls the oscilloscope. It is open-source and you can extend it with new features.

Subtitle Tuner calculates the display duration of the subtitles based on the count of characters in the text. This avoids that badly created subtitles disappear before you could read them. Can remove deaf texts, lyrics, italic/bold. Can resynchronize a subtile to a movie with different framerate or change the subtitle offset.

Secure Doorlock with RFID Cards is a project with an RFID antenna and a Teensy processor that opens a door with Mifare Desfire cards or NFC smartphones. The RFID cards or smartphone passwords of up to 64 users can be stored in the flash memory. It is extremely secure because it uses strong encryption. A big battery assures that the door can be opened during a power failure.

Remote Control your Computer with Infrared An infrared receiver and a Teensy processor allow to remote control the music player on your computer with any old remote control that you have from a TV, amplifier, DVD player, SAT tuner or whatever. The Teensy simulates a keyboard and sends keystrokes to the music player.

3D Render and Editor Control in C# A .NET control that can be easily implemented into System.Windows.Forms applications to display 3D graphs. The user can move and rotate the graph with the mouse and edit single points. Many display modes are available: 3D surface, 3D shapes, 3D lines, 3D objects, also animated 3D objects.

CAN FD adapter - CANable 2.5 Firmware Update - Candlelight & Slcan I wrote two completely new firmwares for the CANable adapter with the STM32G431 processor (for example from MKS Makerbase). The official Slcan firmware has several issues and the official Candlelight firmware is complete crap. I fixed a ton of bugs and added several new features. HUD ECU Hacker fully supports these new features and comes with a firmware updater.

USB HID Touchscreen A Teensy processor emulates keyboard, mouse and touchscreen at the same time to remote control a computer for automation purposes.

You can write me in english, oder auf deutsch, o en español.