All right, folks. Welcome today to All Aboard the Can Bus or Motorcycle.
Two wires, two wheels, bikes can do, can too.
In today's talk, we will cover who am I, a little bit about myself,
the bike and brand. I feel to completely understand the essence of this project.
The bike's a little bit on the rarer side, so we'll cover a little bit about that.
Why the project inspiration and purpose. Some of the hurdles that came into play when
working with the motorcycle as opposed to a car. And then the project begins, what I used,
what I built, the hardware involved with the project. I built an engine simulation
and I did quite a bit of CSV parsing and data analyzing with a Python script I made.
And then we'll talk a little bit about what's the future of the project.
So who am I? I'm Derek. I've been riding motorcycles for about 10 years.
I've been a developer and InfoSec hobbyist for about 15 years.
I currently work as director of IT for a food and beverage automation company.
If you're interested in continuing to follow this project after this talk, you can follow me on
Twitter, CanBusDutch. If you have any questions that aren't answered or you don't get a chance
to ask them at the end of the talk, you could email me at CanBusDutch, gmail.com. And all the
code talked about can be found at my github, github.com slash CircuitWorks1.
So this is my bike, an EBR 1190 RX. Those of you not familiar with EBR or the Buell brand,
Eric Buell, the founder, was a Harley engineer who liked racing motorcycles.
They make the only, or they, yeah, they're the only production sport bike made and designed in
the USA. They're the only American-made motorcycle to ever score points in World Superbike. And they
won the 2009 Daytona Superbike Championship without a single DNF. Those not into power sports,
it stands for did not finish, which means no engine failures, and more importantly,
no accidents. They manufactured nearly 140,000 motorcycles in 15 years when acting as a Harley
subsidiary. And in 2009, after Harley-Davidson axed Buell, they came back as Eric Buell Racing
and sold 65 bikes in 18 months, garnering $3 million in revenue as a startup. And sadly,
now it's a company teetering on the edge of existence.
So here's a few Buells and EBRs, some a face only a mom could love. But that top bike there in the
top left is the bike that helped them fund EBR. It's the EBR 1190 RS. And then you'll see the
same bike I have, the EBR 1190 RX. And then the EBR 1190 SX, which is the same as the RX,
just in a different trim. And then down here, we take a look at the Buell XB9S, which utilizes a
Harley-Davidson Sportster power plant. And then the EBR XB9R, or sorry, the Buell XB9R. And then
finally, the Buell 1125R. And we can't forget, that is the 2010 Buell Blast, which is kind of
an inside joke amongst the Buell community. So now let's get into it. So after about six months of
owning my EBR 1190 RX, I was on a large group ride where I did about 100 miles in a day.
And on my way back home, my dash fell apart. Luckily, I didn't lose anything.
My screen there held on by the ribbon to the rest of the display. And when I got back home,
I reassembled it. But sadly, I started receiving a comm error. And after about a few months of
you know, surfing around the Buell Facebook groups and forums, I started to realize I wasn't the only
one. There was this guy, and this guy, and this guy, and this guy. Well, you get the point.
So sadly, apart from these comm errors, there was also individuals who
had their dash rattle to pieces, just as mine did. And at the time, the future of EBR was being
decided by the courts as they had filed for receivership, which is a similar process to
bankruptcy. And there was zero parts availability. So because I'm not only stupid, but also ambitious,
I decided to look into designing an aftermarket dash. And that's when I realized it probably
wouldn't be as easy as I thought. The main issue I ran into is that there is no diagnostics
standard in the motorcycle industry. OBD2 is kind of a large plug, hard to fit on a small vehicle,
and not really ideal for motorcycles. Although we will see the OBD2 standard is used on a few
manufacturers. And from what I've been told, that it is becoming a standard in Europe.
So there are universal diagnostic tools, although the bite offset, scaling factor,
all of that good stuff is different for every manufacturer. And in order for these universal
tools to obtain that information, the manufacturers charge a lot of money. So these tools
are very expensive. Not only that, but the likelihood of finding a universal diagnostics tool
that works with a bike with only about a thousand of them manufactured in the world
is slim to none. You aren't going to find. So let's take a look at the...
we'll take a peek into the motorcycle diagnostics port world. In this slide alone,
we have two Kawasaki, two Hondas, two Suzuki connectors. And there we go. There we have a
four pin Harley diagnostics cable. And we could see there that Piaggio, Triumph, and Victory
all use the vehicle standard OBD2. And then here we see another Kawasaki connector.
And here we have the Buell diagnostics port. And then we have another Kawasaki cable.
And this is one of my favorites. So this MV Agusta four pin cable down here
is actually the same connector used on Hondas, but it has a separate pinout. So if you accidentally
use the MV Agusta connector on your Honda, you will fry your ECM. And then here's another one
that kind of grabs my attention. Down in the left hand corner there, we have the Harley Davidson
CAN six pin cable. If you remember, I just mentioned they had a four pin diagnostics cable
and a six pin CAN cable. And as we all know, CAN is a two wire signal. So why couldn't they
have just jammed the diagnostics and CAN into one cable? Who knows? And last but not least,
we have the Benelli cable there. But overall, that's 37 different connectors for about 25
different manufacturers. Kind of a headache. But luckily, we have CAN.
Most European and Japanese manufacturers began implementing a CAN bus system on
their bikes around 2003. This includes Ducati, BMW, Honda, Kawasaki. And the American manufacturers,
as with most things when it comes to automotive, were a little bit late to the CAN party.
Buell first implemented a CAN system on the 2008 release of their 1125. And Harley's first
CAN based bike wasn't until 2011. And it wasn't until 2014, that all Harleys were equipped with
CAN bus. Information was a little bit lacking when it came to the Polaris brands Indian and
the now defunct Victory. But I believe they started using CAN around 2013. So let's hop
into what exactly my ECM comprises of. The microcontroller is a microtechnology PIC device.
The diagnostics protocol is a single wire variable pulse width, J1850. And the CAN protocol
is 500 kilobits a second, 11-bit IDs, 20-ohm termination, and least significant bit first.
When it came to hardware for my project, I started out with this Seed Studio device.
But after the second one failed me, I navigated over to using the the Cannibal device, which
was much more reliable. And software-wise, I started off using the Seed Studio software, but
ended up converting over to Busmaster after I purchased the Cannibal device.
So, after doing quite a few CAN capture sessions and figuring out some of the CAN definitions from
reading CAN packets directly from the bike, I was kind of over the idea of spending hours in
the hot garage huffing exhaust fumes. So I thought, why not try some engine simulation?
The most important part for my bike when simulating the engine sensor data is the
crankshaft sensor output. The ECM won't really acknowledge some of the other data if the crankshaft
sensor output is not reading correctly. On my bike, the crankshaft sensor produces two waves,
180 degrees at a phase with each other. The wave is generated using a Hall sensor and a stepped
rotor tone ring surrounding the stator magneto. There are 34 steps and a timing gap the equivalent
to two wavelengths, or two steps. So, it's essentially 36 steps. And there we have a
picture of it. You can see the timing gap there, pretty common. And now let's take a look at it.
There we go. A few oscilloscope readings of the output, so I know exactly what I'm recreating.
And so, how do we simulate it? There's 36 steps, one full step every 10 degrees, 360 degrees in a
circle. We pick an RPM. For math's sake, we'll do 6,000 RPMs. And then, since we all know RPM is a
measurement of minutes and Hertz is a measurement by seconds, we'll have a math equation that looks
something like the following. RPM divided by 60 seconds times 36 steps. And we get a wavelength
of 3.6 kilohertz to simulate the 6,000 RPMs. So, the code. What we do is we take the frequency
input by the user through the serial monitor. I did all this using an Arduino Teensy. And
we calculate the time to execute both a 34-wave cycle and a 36-wave cycle in microseconds.
So, we set our variables there, RPM time and RPM restart. And then, our code logic
looks something like this. If the wave start time is greater than RPM time,
then we stop the wave. And if wave start time greater than RPM restart, we restart the wave.
So, basically, what's happening here is we produce a wave for 34 seconds.
And then, once the time hits greater than 34 seconds, we stop it.
And then, we turn it back on once the time hits greater than 36 seconds. So,
we have those 34 steps with a two-step pause. And now, let's take a look at what we got. And
there's our oscilloscope output. We got the 34 steps and then the blank spot, the equivalent
two steps. Now, we'll look into doing the mile per hour, the speed. The speed sensor simulation
is a bit more basic because there's no timing gap. So, simulate our speed sensor. We
will take a given frequency that was input by the user, again, through the serial monitor.
And we'll turn on and off one of the pins rapidly to generate a square wave. So,
we first calculate the period to complete one wave cycle in microseconds.
And then, we divide that by two to find out how long the pin needs to stay in each state
to complete the entire waveform. And we control it with a non-blocking delay here.
So, you can see there, if the delay timer is less than the speed time divided by two,
pin off. And if it's greater, then pin on. And if it's greater than... and once we created two,
a full waveform there, then we restart the timer and go to town again. So,
there we have it. And again, this code for the TNC can all be found in my
GitHub repository that I gave at the beginning of the talk. So, now that we got our two waves
looking good, we'll play with it a little bit. So, aside from the speed and RPM, I also programmed
in a few switches so that I could pop back forth the things such as the neutral switch and
the gas light and a few other things. So, we'll watch it and give it a try here.
So, oil pressure true. And you could see up there, sorry, I forgot to point it out,
but the oil pressure light went there. And now we'll change our neutral switch to false. Boom.
And then low fuel set to true.
And one thing about the low fuel, as it says right here, it has to remain true for 20 seconds
before the ECM flips the low fuel bit to true. So, it'll pop on any second there.
And there we go. Low fuel. You see the fuel trip flipped over there.
And here's the fun part. RPM frequency 1001.
And we got a little bit of RPM going there and speed frequency 300.
And now we got a little bit of speed going there. And if you'll notice in a second,
the fuel trip odometer goes up to one, the end. So, success. What the heck happened here?
Okay. So, let me switch back into presentation mode. So, I...
once I did that, I started capturing sessions like crazy. I was capturing everything to a CSV.
And, you know, clearly, they, you know, all this data in only one set of eyes.
You know, you don't want to go through all that without some software analyzing it. So,
I created a Python script that compares two CSVs that were created using the CAN software.
In the example I'm about to show, I have two CSVs. One is where I set the oil pressure to true.
And the second is where I set the oil pressure to false. So, oops. So, a little bit about
my parser here, my Python script. Out of the 15 populated columns used by my software,
we only use nine of them. It's the frame ID and then the eight bytes. So,
basically, what the Python script does is it looks at the number of times each ID appears and
the number of times a hex value appears in each given ID. And then compares that to allow us to
have in our outputs the difference in hex value appearances, the increase and decrease percentage
of hex value appearances, and appearance of a new hex value in a given ID. And I also programmed it
to convert the hex value to binary. So, if we take a look here,
this output shows the number of times a hex value appears in a given ID. If its appearance
account was zero in either of the CAN capture session, the line will be highlighted in red.
The line will be highlighted in red if the number of hex value appearances is equal to
the number of appearances of its given ID. So, meaning that in one CAN capture session,
the hex value appeared zero times and in the other one it appeared 100% of the time. So,
if we take a look here, we have that happen four times in this one. There is hex value 19
and 99 which appeared in ID 202 100% of the time while appearing in one CAN capture session while
appearing zero times in the other one. And then we have down here hex value 20 and hex value 60
which appeared in ID 451 100% of the time in one file and zero percent of the time in the other.
And I can confirm that after figuring this out, I was able to verify that
an ID 202 byte A bit 7 is the low oil warning light and ID 451 byte H bit 6 is an oil pressure
True, false, bit. So, we can see... so, let's go on. Again, this, which we'll call it, this
Python script is available at my GitHub account to take a look at and analyze your own CSVs.
And now we'll look. Now that I have the... now that I've reversed a whole bunch using the Python script
and, you know, I was able to trigger all types of ECM settings to reverse,
I developed my first prototype here. This project was used with a... I'll wait and let it go.
All right. So, that was developed using a Nextion display and a ESP32 with some... with a CAN input on it.
And, you know, originally I was going to make this from the ground up, but, I don't know, I just
decided when everything's exposed to the elements, like on a motorcycle, it probably wasn't the
best route to go. So, I ended up purchasing an AIM MXS 1.2 Strata, which so far I've loved
and highly recommend. I haven't actually put it on the bike yet, but here's a little video of
what I got going. We're going to let the bike warm up. You'll see the light over here
for the engine temperature. We'll go from blue to green
when the engine is warm, and then I'll give it a few revs to show off.
All right, there we go. So, what's next for the project? Aside from finishing the development of
the dash, you know, I'd really like to stretch my Python script a little bit further. Right now,
all the IDs to my bike are hard programmed into the Python script. Ideally, you know,
this Python script would be able to look at the ID column, grab all the individual IDs that are in
it, and then start analyzing then. You know, I spend a lot of time as a front-end developer,
and I'd also like to make the Python script output a little bit prettier. I think some
data visualization that I've started playing with, you know, would really spice things up a bit and
kind of make things easier to point out. Some byte annotation. Right now, the Python script
only parses data based on the hex values and the IDs. So, you could end up with some confusion on,
you know, if you're getting hex value changes in different bytes in the same ID and stuff like
that. And then, I'd also like to implement some bit flip search, which, you know, would help
things with, like, the ground triggers or ground switches and stuff like that that are in the
dash and stuff. So, you know, so anyways, that's about it. You know, I want to give some shout-outs
and some thanks. Thanks to the Buell community. There's really nothing like it. Thanks to the
man, the myth, the legend himself, Eric Buell, and those involved with Buell Motorcycles and EBR.
And, you know, even though you guys probably hate me, I want to say thanks to Tim Blumenberg at IDS,
who is the company that developed the ECM, and Bill Melvin, who currently owns EBR. And then,
some of my gearhead friends that I wouldn't have been able to do this without. Jacob,
Zach, Rob Weaver, Leland. You know, it couldn't have been done without everyone. Thanks.
you