BMW K1600 Forum banner
  • Hey Everyone! Enter your bike HERE to be a part of this months Bike of the Month Challenge!
1 - 20 of 296 Posts

·
Premium Member
Joined
·
3,733 Posts
Discussion Starter · #1 ·
So, this weekend I finally got around to looking at the CANbus on the K1600. First surprise is that the diagnostics connector under the seat is firewalled; it doesn't see the communication stream from all of the onboard CANbus devices. Second surprise is that all of the handlebar, Nav, Radio, etc. are on a separate single wire bus called a LINbus.

Since the diagnostics plug isn't active without some BMW service computer magic, I had to tap into the twisted-pair CAN lines under the right side panel. So far I have verified that it is standard CAN protocol, 500kbs, no extended message addressing (11-bits, not 29), the full 8 bytes of data always sent, and there's nothing that appears even remotely related to the SAE J1979 message tags used in automobiles. I've never really learned to speak "CAN" until now (last bike project like this was VPW) so I had to come up to speed on the protocol, stuffing bits, etc; pretty straightforward.

Using a homebrew sniffer, I've identified 24 different message headers and done some rough statistics on how often they're used. Since lower number message IDs have bus priority, the combination of the ID and occurrence rate can help me to start to identify the packets that I'm interested in (fueling, RPM, speed, etc.).

Just like my past motorcycles, I want to add some information to the dash with a separate LCD graphic display. For starters, I'm looking for a large digit speedo, coolant temperature, race timing (60', 1/8, and 1/4 mile; off road use only :)), digital battery and charging voltage, etc. Just a little project to keep me off the street at night.

I attached a photo of an interesting (at least to me) collections of notes where I manually deciphered a packet from the digital oscilloscope screen that I'm seeing quite often (message ID 2D0) just to make sure that my sniffer is doing the job correctly. The circled bits are the ones that I finally realized have to be removed from the stream to adhere to CANbus bit stuffing rules. The 24 message codes that I've identified so far are also shown if it is helpful to anyone. The next step is to start filtering for each code, watching the data stream, and trying to correlate changes in the numbers to what's happening on the bike. Major detective work but interesting.

 

Attachments

·
Registered
Joined
·
430 Posts
well, i can kind of follow some of this....

where/how did you learn about the details of the CANbus protocol?

at first i was going to say "what are you, some kind of rocket scientist?"....but then i read your profile and saw that you are a laser scientist.....so that joke was out the window :D
 

·
Premium Member
Joined
·
170 Posts
Ummm, its that all you could get?

WOW!

Great work, hope it materializes to something we can all use. Certainly way ahead of ANY curve I'm on.

Dave...
 

·
Premium Member
Joined
·
2,490 Posts
It would be great to have a speed indicator that was easily seen at a glance. What we now have takes me too much time to actually see and recognize. The GPS is no better because it is too far away.

That's my story officer, I swear!

I've even thought about a bicycle speedometer just for the speed, even though most will tell you several 100 different things and keep a record of them at a cost of less than $50.00!
 

·
Premium Member
Joined
·
2,105 Posts
Just like my past motorcycles, I want to add some information to the dash with a separate LCD graphic display. For starters, I'm looking for a large digit speedo, coolant temperature, race timing (60', 1/8, and 1/4 mile; off road use only :)), digital battery and charging voltage, etc. Just a little project to keep me off the street at night.

I don't have a clue what all this means, but I can appreciate what you do and your knowledge. If you were to offer this for sale I would be one of your first customers. The large digit speedo display would be a big plus for me. Maybe you should talk to Garmin and offer your services. Being able to select various readouts and change the font size would make their unit more useable, especially for me
 

·
Registered
Joined
·
258 Posts
It would be great to have a speed indicator that was easily seen at a glance. What we now have takes me too much time to actually see and recognize. The GPS is no better because it is too far away.


My bike came with a black dot next to 60 mph(thumbnail). Just a quick glance at the speedo gives me a good idea of my speed because I can easily see the pointer relative to 60 mph. Of course, I have my GPS mounted as shown in this thread http://www.k1600forum.com/forum/bmw-k1600-accessories/2980-ram-mount-location-accessories.html and can get my exact speed at a glance too.
 

Attachments

·
Premium Member
Joined
·
3,733 Posts
Discussion Starter · #12 ·
Quick update: this project completely overwhelmed me at first. The stream of data initially appeared completely undecipherable. 26 separate message IDs without a clue what was what (multiple parameters embedded in each message packet). However, once things started falling into place, I've made a lot of progress. The data rate is pretty impressive at around 1000 messages per second (my first post illustrates one message) so half the battle is filtering through the large volume of numbers.

Here's what I have so far:

- RPM
- throttle plate position (needs more confirmation)
- throttle grip position (confirmed)
- rear wheel speed (I suspect where front wheel speed is but need to confirm)
- distance traveled
- fuel consumed (very high resolution, will use this to calc instantaneous fuel economy)
- coolant temperature
- gear position
- fuel injector rail pressure (needs more confirmation)
- rotational sensor data from crankshaft, front wheel, and rear wheel.

Now that I've started getting into the heads of the engineers that laid out the data streams, progress is accelerating. High bits of RPM hidden in the low nibble of fuel pressure? Really guys? :) Low bits of the speed data hidden in the high nibble of the data packet time stamp? Okay, Mr. German engineer; I'm getting the picture. :) There's still a lot of interesting data that I can't yet decipher. Fun code cracking at its very best. :gm

Let me know if anyone would be interested in seeing some of the plots that I used to search for signals.
 

·
Premium Member
Joined
·
3,733 Posts
Discussion Starter · #15 ·
Most of the CAN bus software is written by one company called Vector. The Vector CAN kernal is certainly the basis for the CAN messaging.

Embedded Components for CAN
Correct, but deciphering that part of the protocol is really the easy task. The hard part is how each user of the CAN interface chooses to encode their application specific data using this established data interface. The job wouldn't be any easier if it were VPW, PWM, or another of the serial bus protocols. If it were a car (or a Harley; I have experience there), most data would conform to the OBDII message header and encoding, except for the manufacturer proprietary codes. However, in this case, I'm left to start from scratch by introducing operating conditions on the bike and watching the reaction of 8 x 26 = 206 unique bytes of binary data. For example, per the OBDII vehicle data format, the coolant temperature has a unique command ID (Mode 0x01, PID 0x05) and uses simple two-byte encoding (high/low+40). What I've figured out on the K1600 is that coolant temperature is a single byte in an 8-byte message that also contains time-resolved fuel use and gear position.

The message header (command ID) gives an indication of importance of each packet since it establishes the priority of its transmission on the bus. How often a given header is transmitted gives an indication of how time-sensitive the data is, such as the high bandwidth ABS wheel rotation sensors. All the puzzle pieces start fitting together in the end.

My terminology is probably not up to par since I'm just an enthusiast, not a professional in vehicle diagnostics.
 

·
Registered
Joined
·
86 Posts
Correct, but deciphering that part of the protocol is really the easy task. The hard part is how each user of the CAN interface chooses to encode their application specific data using this established data interface. The job wouldn't be any easier if it were VPW, PWM, or another of the serial bus protocols. If it were a car (or a Harley; I have experience there), most data would conform to the OBDII message header and encoding, except for the manufacturer proprietary codes. However, in this case, I'm left to start from scratch by introducing operating conditions on the bike and watching the reaction of 8 x 26 = 206 unique bytes of binary data. For example, per the OBDII vehicle data format, the coolant temperature has a unique command ID (Mode 0x01, PID 0x05) and uses simple two-byte encoding (high/low+40). What I've figured out on the K1600 is that coolant temperature is a single byte in an 8-byte message that also contains time-resolved fuel use and gear position.

The message header (command ID) gives an indication of importance of each packet since it establishes the priority of its transmission on the bus. How often a given header is transmitted gives an indication of how time-sensitive the data is, such as the high bandwidth ABS wheel rotation sensors. All the puzzle pieces start fitting together in the end.

My terminology is probably not up to par since I'm just an enthusiast, not a professional in vehicle diagnostics.
Holy Crap!
Granted, I didn"t get tapped to become a card carrying member of the Mensa Society, but you guys are just flat out scary on this thread!

I thought I was doing pretty well just working through all the Bluetooth sync all by my big self... short pants and all. Guess that just got shot to ****.

Cheers!


Sent from my Motorcycle iPad app
 

·
Premium Member
Joined
·
923 Posts
I agree.... you guys are sick!!! Smart and great for sharing, but you guys scare me.. Wonder what else you could build,amazing how you have done some much with no reference guide.. Enjoy yourself.... God knows your limits are yet to be reached!!!
 

·
Premium Member
Joined
·
3,733 Posts
Discussion Starter · #18 ·
Wow, this is so much fun. Strapped my laptop to the top of my BMW softbag tonight. Everything so far had been in the garage, spinning the wheels, rev'ing the engine, etc. After banging my head on the new data for the last couple of hours, I just realized that I'm looking at the 2-axis lean sensor data on one of the yet to be unraveled message IDs. I finally saw it in a running snippet in which I did a U-turn at the end of the street. :) I can even see a little dive in the bike as I braked in front of the house.
 

·
Registered
Joined
·
238 Posts
Quick update: this project completely overwhelmed me at first. The stream of data initially appeared completely undecipherable. 26 separate message IDs without a clue what was what (multiple parameters embedded in each message packet). However, once things started falling into place, I've made a lot of progress. The data rate is pretty impressive at around 1000 messages per second (my first post illustrates one message) so half the battle is filtering through the large volume of numbers.

Here's what I have so far:

- RPM
- throttle plate position (needs more confirmation)
- throttle grip position (confirmed)
- rear wheel speed (I suspect where front wheel speed is but need to confirm)
- distance traveled
- fuel consumed (very high resolution, will use this to calc instantaneous fuel economy)
- coolant temperature
- gear position
- fuel injector rail pressure (needs more confirmation)
- rotational sensor data from crankshaft, front wheel, and rear wheel.

Now that I've started getting into the heads of the engineers that laid out the data streams, progress is accelerating. High bits of RPM hidden in the low nibble of fuel pressure? Really guys? :) Low bits of the speed data hidden in the high nibble of the data packet time stamp? Okay, Mr. German engineer; I'm getting the picture. :) There's still a lot of interesting data that I can't yet decipher. Fun code cracking at its very best. :gm

Let me know if anyone would be interested in seeing some of the plots that I used to search for signals.
As a former writer of Embedded Software ( Microchip Consultant), I'm obviously dragged by this thread and thinking to connect my osciloscope or an small pcb with a Microprocessor with CANbus and start to look the commands ID's! I had written a lot of assembler code and I always was a guy trying to use a Byte at a Maximum, but why to mix RPM's and fuel pressure?? Don't make any sense for me..
 

·
Premium Member
Joined
·
170 Posts
Wow, this is so much fun. Strapped my laptop to the top of my BMW softbag tonight. Everything so far had been in the garage, spinning the wheels, rev'ing the engine, etc. After banging my head on the new data for the last couple of hours, I just realized that I'm looking at the 2-axis lean sensor data on one of the yet to be unraveled message IDs. I finally saw it in a running snippet in which I did a U-turn at the end of the street. :) I can even see a little dive in the bike as I braked in front of the house.
That is super cool! It's nice when tough work is also fun. I wonder if the GS-911 guys have gotten this far? They are frustrating in that they don't give any updates on what they heck they are doing. You seem to have gotten quite far within a very reasonable amount of time. I'm sure there is more to the picture than I see, but... just saying.

Dave...
 
1 - 20 of 296 Posts
Top