Results from hacking the KTM SuperDuke 1290 CAN bus

Discussion in 'Ridiculous streetbikes with 6 CPUs and too much HP' started by Dan Plastina, Jan 22, 2017.

  1. Dan Plastina

    Dan Plastina Been here awhile

    Joined:
    Mar 3, 2005
    Oddometer:
    146
    Location:
    Seattle, WA
    This is a longish post about getting inside the CAN BUS protocol. I had searched far and wide but failed to find what I needed so I dug in and am taking the time to share what I found. No warranties expressed or implied – reading this means you agree that you may blow up your bike on your time, and on your dime.

    My Goals:
    I want access to race data. I have a SpeedAngle (http://www.speedangle.com) but it lacks access to key data I wanted: throttle position, gearbox position, braking forces, shifting efficiency, tyre slip, ABS/traction control intervention, and bike lean and tilt. This said, don’t get the idea that I’m a hard core racer… can’t be further from the truth. I simply wanted to learn quickly, make cool RaceRender videos, and geek out. I can’t leave good enough alone regardless of my hobby (or job).

    Getting Started

    • You need a cable to ‘read’ the data. Get the CANABLE cable for $25. https://www.tindie.com/products/protofusion/canable-usb-to-can-bus-adapter/
      Get your Sumitomo connectors here for $ 3.26 a set. Get a set for the data logger project too. http://www.corsa-technic.com/item.php?item_id=230
      Solder up the connectors as follows. The connector is facing you, with tab on top (per Corsa site image). Be sure NOT to connect power – the CANABLE is powered by the USB port, not the bike.
      1 (N/C) 2 (CAN-H) 3 (CAN-L)
      4 (N/C) 5 (N/C) 6 (GROUND)
      Screw this new cable to the CANABLE matching the pins. Note that the CANABLE as exposed metal pins below the circuit board – don’t short them out on your bike frame.
      Prepare your laptop with the right software. Get CANTACT-APP from https://github.com/linklayer/cantact-app. It’s based on Java so get that too. https://java.com
      Plug the cable into the bike and into the PC. Turn the key on your bike.
      Start the app. In the CONFIG WINDOW tab, pick your port (likely COM3) and then Bitrate of 500KB. Press START
      You’re now seeing CANBUS traffic. It’s intense. Congrats.
      In CANTACT-APP you can save data to disc but I found that it grinds to a halt around the 500 second mark so save smaller CSVs. Reverse Engineering
      Here's what i found via tedious sleuthing and math modelling:

      • Throttle – it’s provided by ID 288, in the 3rd byte position. Turn it and see how it goes from 00 (off) to FF (fully on).
        Gearbox – it’s provided by ID 297, in the 1st byte position. The upper nibble (hex digit) is 0 for Neutral, 1-6 for gears. When you pull in the clutch the lower nibble goes from 0 to 8 and back.
        Front Brake Force – it’s provided by ID 656, in the 1st word (2 bytes) position. No pressure is 0x0000 (off) and a fistful of brake registers to about 0x3500 on my bike.
        RPM – it’s provided by ID 288, in the 1st word position, right before throttle. Start the engine and you’ll see it warm up around 2000 rpm and then settle in around 1500 rpm.
        Front Wheel Speed – it’s provided by ID 299. Front wheel is first word. The wheel has to move at a certain minimal speed to get it to register. I’ve not totally figured out the scale but expect it to be pulses off of the 48 tooth hall effect sensor.
        Rear Wheel Speed – it’s also provided by ID 299. Rear wheel is second word.
        Lean Angle – it’s provided by ID 299. The last 3 bytes (6,7,8) split into two 12bit counters. The last 0x000 is for lean. I’ve tested the lean extensively. 0x000 is neutral, 0x001 starts leaning to the right. 0xFFF starts leaning to the left. I *believe* the first 0x000 are tilt but I’ve yet to validate.
        Traction Control – its provided by ID 1104. I’ve more testing to do here while on the road. I have figured out that the byte 1, 3, 5 express changes to ABS, MTC, and MODE settings respectively. I expect byte 2 to be ABS intervention intensity, byte 4 to be MTC intervention intensity.
        Oil temperature – I think it is provided by ID 1344, byte 7/8. Yet to fully validate.
        Water temperature – I think it is provided by ID 1360, byte 2. Yet to fully validate.
        Fuel level – I think it is provided by ID 1361, byte 1, as a percentage. Yet to fully validate.
        Date Time - I don’t know where this is yet. Can’t find it anywhere. It’s important to me for logging so if you happen to find it, please PM me!
        Forward looking stuff...

        Logging – baseline edition
        Per above, the real reason for this work was to have a data logger. To do that, one can’t (should not) ride with a laptop taped to their race suit (unless they use 4+ wraps of tape). This being the goal, I ordered a few of these for a very reasonable $24.
        https://www.tindie.com/products/akpc806a/can-bus-logger-with-sd-card
        https://github.com/akpc806a/CAN_Logger/blob/master/Doc/CAN Logger (manual).pdf
        I don’t have it yet but it seems like the perfect starting point for data logging. The wheel speed and brake data above comes in at 100 samples per second. The throttle data comes in at 50 samples per second so you can do the math on file size pretty quick. Right now I see the biggest problem being data sync across my CAN bus logs, my SPEEDANGLE data (GPS, speed, lean) and my GoPro video streams. I need to find the DATE TIME data in the CAN bus feed unless I can get time another way…

        Logging – deluxe edition
        The ultimate logger may well be this one. The design is based on a Teensy 3.2 and leverages some cool stuff FUSION (handle of the Tindie maker whose name is Paul) offers:
        The amazing Teensy 3.2 unit ($20):
        https://www.pjrc.com/store/teensy32.html
        Killer shield for the Teensy ($95) that adds GPS for tracking (and data/time!), a GSM tracker for pushing data out to cloud service (e.g.: IoT into Azure cloud; 3D motion tracking for your spouse on long rides, etc.), a CAN bus transceiver, and a regulated power supply that can be powered from your motorcycle.
        https://www.tindie.com/products/Fusion/tinytracker-gpsgsmcan-for-teensy-3132/
        Another killer shield ($28) that mounts to the above shield to offer a 3-axis accelerometer, a 3-axis gyroscope, a 3-axis compass and an altimeter (height above sea level).
        https://www.tindie.com/products/Fusion/10dof-mpu9250ms5637-sensor-addon-teensy-30-32/
        Lastly, we need to write all this crazy cool data to storage via a shield for Micro SD ($8)
        https://www.tindie.com/products/Fusion/teensy-slim-micro-sd-card-adapter
        Unfortunately, this particular logger will require a lot of software to be written… and I’ve yet to start. But it sure does seems like the ultimate data logger suitable to both Super Duke’n on the track and for riding my 1200 GSA to Deadhorse, AK!

        That’s in for now. I mostly wanted to share all that I had to return value to the group. Enjoy!
    #1
    TwedyMoto, Kiss, PDarnall and 20 others like this.
  2. MX Engineer

    MX Engineer MX Racer

    Joined:
    Dec 22, 2015
    Oddometer:
    1,350
    Location:
    Ann Arbor, MI; Lake Havasu City, AZ
    Geeky! Super cool too!

    What are you goimg to do with all the data once you have it?

    I used to use Bosch LapSim back in 2005 for auto racing. It could tell me where exactly the driver or the car were losing lap time on the track. LapSim works for motorcycles too. ;-)
    #2
  3. llamapacker

    llamapacker Mr. Conservative

    Joined:
    Oct 4, 2007
    Oddometer:
    1,655
    Location:
    Bossier City, Louisiana
    Probably too early for me to sell my PCV and start modifying my map with tuneedit, but I am so looking forward to someone bringing the ability to modify our maps. This may be the beginning of great things for our 1190!
    #3
    EUBikeDude and geez996 like this.
  4. Dan Plastina

    Dan Plastina Been here awhile

    Joined:
    Mar 3, 2005
    Oddometer:
    146
    Location:
    Seattle, WA
    Here's more data (I shared with my SuperDuke forum friends).

    @llamapacker: Everything I'm doing here is about listening. Cracking the EFI reprogramming is a whole other domain that I've not started... The superduke with akra pipes does plenty to giggle my innards around. No more HP needed... well, wanted anyway ;)

    -----
    It turns out that the repair manual has a detailed electronic guide... 11 or so pages of "which sensors connect to which devices". From there I was able to derive all the devices and their logical IDs. From there a few PDF searches and one can learn a lot about the outputs. e.g.: The BOSCH 9M Plus spec calls out that the unit "measures the motorcycle’s longitudinal, lateral, and vertical acceleration, as well as yaw, pitch, and roll rate during the ride and uses this information to calculate its lean and tilt angle". Given this has to be done a lot to be useful, I searched all messages with updates of 100 times per second first. With engine off, tilted the bike left/right and so on. I found another counter bobbling (fuel level) but it was only being updated only 20x/sec.

    The challenge with (absolute) time is that it does not seem to be output to the bus. The Byte 8 values of many 100hz IDs end with a timer that monotonically increases but never says the date/time.

    Other messages toggle between two states: 1344/1345 are updated at 20hz but one transmission starts with 02, the next starts with 04. The last 2 bytes of the 04 series is oil temperature. I think this is derived from the fact the EFI controller has most of its inputs in pairs but oil temp, coolant temp, oil pressure, oil levels are all singletons. Also, the message IDs groupings (288,89,296,297,299 vs 1104) does not reflect controllers. Instead they seems to be use to sort the data. e.g.: I think that 299, 656 and 1104 come from the same ABS unit.

    Since I have this data in an XLS, here it is. You'll note that the computed outputs are not always offered by the device called out. e.g.: Lean angle (Angle sensor) is said to come from gauges -- it does not. It comes from ABS messages (given the need for a much higher data rate).

    e.g.:
    EFI Control Unit (A11)
    Crankshaft position sensor (RPM)
    Gear Position Sensor
    Throttle position sensor (A/B)
    Coolant Temperature, cyl1
    Side Stand Switch
    Throttle stepper motor (A/B)
    Quickshifter (optional)
    Rollover sensor (?)
    Intake Air temperature
    Ambient Air Pressure Sensor
    Manifold pressure sensor, cylinder 1
    Manifold pressure sensor, cylinder 2
    Injector Cylinder 1
    Injector Cylinder 2
    Lambda Sensor, Cylinder 1
    Lambda Sensor, Cylinder 2
    Ignition Coil 1, cylinder 1
    Ignition Coil 2, cylinder 1
    Ignition Coil 1, cylinder 2
    Ignition Coil 2, cylinder 2
    Secondary Air Valve (?)

    Central Electronic Control Unit (A10)
    Front Brake Light Switch
    Rear brake Light Switch
    Clutch Switch
    Start button
    Oil temperature Sensor
    Oil Pressure Sensor
    Oil Level Sensor
    Fuel Level Sensor
    Fuel Evaporation Valve (optional)
    Fuel Pump
    Hi beam button
    Left signal button
    Right signal button
    Cancel signal button
    Harzard button
    Horn button
    Low Beam output
    High Beam output
    Parking Light output
    Daytime Running Light
    Horn output
    Emergency off button
    Heated Grip output
    Radiator Fan Motor 1
    Radiator Fan Motor 2
    License plate light
    Brake/tail light
    Front, Left turn
    Front, Right turn
    Rear, Left turn
    Rear, Right turn

    ABS Control Unit (A30)
    Front wheel speed sensor
    Rear wheel speed sensor

    Combination Instrutment (P10)
    Angle Sensor
    Tilt
    << Time??>>
    Ambient Air temperature sensor
    keypad - Up
    keypad - Down
    keypad - Return
    keypad - Enter

    Alarm System (A50)
    Alarm system switch

    Ignition (S11)
    Key switch
    #4
    Kiss, thirsty 1, peter_tux and 7 others like this.
  5. Dan Plastina

    Dan Plastina Been here awhile

    Joined:
    Mar 3, 2005
    Oddometer:
    146
    Location:
    Seattle, WA
    Sweet. For me, the desire was making a better 'SpeedAngle' by getting CAN data + data correlation for learning + making killer RaceRender videos (actual lean, throttle, gear, angle gauges).

    In all the pre-made loggers that correlation was not possible; associating all the data together, in full sync. e.g.: Fast cornering is about proper throttle control, good braking, proper entry position, limiting lean, etc. Having a logger that has a 10hz GPS collection, throttle position, braking, forces, gear changes, duration of clutch hold, lean angles, tilt angle, RPM (blipping), tire slip, ABS interference on entry, MTC interference on exit, and so on is the goal of this science experiment. Learning Teensy 3.2 programming and Python was too ;)
    #5
  6. llamapacker

    llamapacker Mr. Conservative

    Joined:
    Oct 4, 2007
    Oddometer:
    1,655
    Location:
    Bossier City, Louisiana
    Great info for sure! I don't need more power either, just some tuning under my control. I found that my old 2012 Griso was retarded below 3800 rpm which produced a huge flat spot in the throttle. Fixed with modding the map. I miss being able to change my maps on the Moto Guzzi, look forward to being able to use the same tools on the 1190.
    #6
    Dan Plastina likes this.
  7. northwestsupra

    northwestsupra that guy

    Joined:
    Feb 20, 2015
    Oddometer:
    472
    Location:
    Washington, Arlington
    Do not give up on this! I beg you. You're doing the community a great favor
    #7
  8. BrightSight

    BrightSight Been here awhile

    Joined:
    Dec 14, 2013
    Oddometer:
    166
    Location:
    Colorado Spring, CO USA
    So many interesting projects become possible once you have the skills to connect a microcontroller to a bike's CAN bus. Bravo to you for doing this. I have a few questions if you are willing to tell us a bit more about your efforts.

    Did you learn to program the Teensy 3.2 from scratch, or did you have prior experience with Arduino or some other microcontroller board?

    Do you do your software development on a Linux, Windows or Mac computer? I use a Mac, and would hate to have to deal with Linux or Windows just to program the Teensy.

    I know Python. Is that the only computer language you need to know to program the Teensy?

    Which CAN bus transceiver do you use?

    Are you willing to share your CAN-bus-related source code with other biker nerds? I would be willing to get into this if folks like you were to provide the community with examples of working code.

    Thanks for posting. I will be following this thread with great interest.
    #8
  9. northwestsupra

    northwestsupra that guy

    Joined:
    Feb 20, 2015
    Oddometer:
    472
    Location:
    Washington, Arlington
    I'd recommend if you had a source code and want to make a project out of it to use GitHub so anyone who comes across this and knows anything about coding might be able to contribute and help produce a solid final product.
    #9
  10. MX Engineer

    MX Engineer MX Racer

    Joined:
    Dec 22, 2015
    Oddometer:
    1,350
    Location:
    Ann Arbor, MI; Lake Havasu City, AZ
    I have a final product idea. I want a black box with a red button for wheelie control. I want to push the button, and for the bike to pop the wheelie and control it with the throttle and the ABS. This would be a cool product!
    #10
  11. northwestsupra

    northwestsupra that guy

    Joined:
    Feb 20, 2015
    Oddometer:
    472
    Location:
    Washington, Arlington
    I agree OEM traction control is lame. Sport should allow the front off the ground without a requiring a hill crest.

    #11
  12. MX Engineer

    MX Engineer MX Racer

    Joined:
    Dec 22, 2015
    Oddometer:
    1,350
    Location:
    Ann Arbor, MI; Lake Havasu City, AZ
    I pop medium wheelies off of every stop light with the TC in the Sport mode. I am not sure whether it is limiting me though, I am too scared to disable it, lol.
    #12
  13. northwestsupra

    northwestsupra that guy

    Joined:
    Feb 20, 2015
    Oddometer:
    472
    Location:
    Washington, Arlington
    As long as it's dry I turn mine off. The problem is that medium wheelie doesn't hold itself.
    #13
  14. MX Engineer

    MX Engineer MX Racer

    Joined:
    Dec 22, 2015
    Oddometer:
    1,350
    Location:
    Ann Arbor, MI; Lake Havasu City, AZ
    So you are saying I could just keep opening the throttle wider and count on TC to save me from looping over?
    #14
  15. northwestsupra

    northwestsupra that guy

    Joined:
    Feb 20, 2015
    Oddometer:
    472
    Location:
    Washington, Arlington
    If it's turned on yes. It'll lift off from the start, might even pop up in 2nd but only like 2 feet. You can even pop the clutch and hold it wide open and it'll intervene and drop you back down. That's sport mode. Street doesn't do jack. Off it'll come up in first and flip you, 2nd will power up or clutch up with medium risk of flipping. 3rd gear is totally safe unless your like me with a 47 tooth rear, exhaust, and Rottweiler filter lol
    #15
  16. Dan Plastina

    Dan Plastina Been here awhile

    Joined:
    Mar 3, 2005
    Oddometer:
    146
    Location:
    Seattle, WA
    #16
  17. Dan Plastina

    Dan Plastina Been here awhile

    Joined:
    Mar 3, 2005
    Oddometer:
    146
    Location:
    Seattle, WA
    I'm all in.
    #17
  18. DrtSqtr

    DrtSqtr Been here awhile

    Joined:
    Apr 11, 2008
    Oddometer:
    223
    Location:
    Ponchatoula,LA
    Good day Dan... great job!!! btw have you looked into Vector indigo software for the ktm? They have videos up on youtube . Looks like they have full access to the ecu . Just thought it might help.
    #18
    llamapacker, Dan Plastina and geez996 like this.
  19. Dan Plastina

    Dan Plastina Been here awhile

    Joined:
    Mar 3, 2005
    Oddometer:
    146
    Location:
    Seattle, WA
    For sake of readability, here's my current table:

    [​IMG]
    #19
  20. BrightSight

    BrightSight Been here awhile

    Joined:
    Dec 14, 2013
    Oddometer:
    166
    Location:
    Colorado Spring, CO USA
    First of all, I would like to thank Dan Plastina in general for creating this thread, and in particular for finding Alex Borisevich's CAN Bus Logger with SD card. Dan provided a link to this CAN Bus Logger in the original post of this thread.

    I have been considering purchasing an expensive CAN bus logger to better understand the electronics within my KTM 1190 Adventure, but Alex's $30 device is all I needed to get started. I purchased this CAN Bus Logger and got it working with absolutely no drama. I wired the CAN Bus Logger to a Sumitomo plug that mates to the bike's Diagnostic connector. That plug kit can be found here:

    https://www.corsa-technic.com/item.php?item_id=230&category_id=107

    I also got two of these inserts to fill in the two unused connector openings.

    https://www.corsa-technic.com/item.php?item_id=382

    The wiring on the connector and device sides of the cable looks like this:
    connector side of the cable assembly.jpg device side of the cable assemply.jpg

    The wires are defined as follows:
    red – Vcc (12 volt power)
    black – Ground
    blue – CAN high signal
    white – CAN low signal

    You can use either of the two Ground solder connections provided on Alex's board, since they are internally connected. I choose to not use the one next to Vcc (red wire) to reduce the possibility of a short between power and ground.

    A simple text file on the SD card (named Config.txt) governs the operation of the CAN Bus logger. To passively capture all CAN bus data frames with time stamps on a 1190 or 1290 , the contents of the Config.txt file should be as follows:
    baud 500
    ack_en 0
    id_filter_mask 0
    id_filter_value 0
    log_std 1
    log_ext 0
    timestamp 1

    The User Manual for the CAN Bus Logger explains how to modify this text file for other data capture options. The only values that make sense to change are: ack_en, id_filter_mask, id_filter_value and timestamp. The CAN Bus Logger will not operate properly on the 1190 or 1290 models if the other values (baud, log_std and log_ext) are modified, since these pertain to the basic characteristics that KTM has chosen for its CAN bus implementation.

    With the knowledge gained from this thread and the surprising ease of using the CAN Bus Logger, I feel emboldened to attempt to connect this relatively-easy-to-program micro-controller to my bike's CAN bus, and let the fun begin:
    https://www.digikey.ca/catalog/en/partgroup/micropython-pyboard-v1-1/58809

    I have many projects in mind to farkle-up my 1190 (e.g., an OLED display to rival the TFT display on the new 2017 1290 Adventure models).

    Cheers
    #20