[wheels]

Thanx, for posting the info, very interested in building a similar reader. Keep up the good work.
One question I have is can you read all of the info different components like the dash, ecu, bbbs and such are sending on the canbus? Like when you turn on the turn signals, can you see the info being sent to activate the rear turn signals?

 

[nemesis.ie]

Good stuff, great to hear this is possible.

 

[MrCanBus]

Yes, you can see all messages travelling around the can network, e.g. From ecu to dash, from dash to DES etc. Not everything is sent on the CAN network though, for example I can't find any evidence of actual button presses being sent, just the resultant output such as indicator flash or engine mode change (which when you think about it makes sense). I'll post some examples of the raw data, how it is structured and what you can read from it. I still only scratching the surface as There is quite a bit that I haven't decoded yet (I.e. haven't logged anything from a moving bike).


Sent from my iPhone using Motorcycle.com Free App

 

[Derek]

I'm finding this really interesting and hope that it won't be too long before the Ducati can-bus has been sufficiently cracked to enable user access to the onboard variables. Do you think it would be possible access and reset error codes and more usefully rest the service indicator with a generic can-bus reader using a suitable adaptor for the diagnostics socket.
Something like this U480 Universal OBD2 CAN BUS Fault Code Reader Scanner diagnostic scan tool UK | eBay

 

[MrCanBus]

Derek. In theory it would be possible, but without witnessing a message being sent from a Ducati service tool (to be able to see what the required message is) it would just be random guess work/trial and error. I am strictly in 'listen only' mode at the moment, I've not tried sending messages. From what I can see the 'state' of something is always being transmitted, even if just to say it is 'off', e.g. The brake light. I think if I tried to send an 'On' message whilst the dash was sending an 'off' message I'd get some sort of error, but I don't know and am too nervous to try at the moment!


Sent from my iPhone using Motorcycle.com Free App

 

[MrCanBus]

Oh, and I don't think a universal tool will help (as it won't know the required message either). The arduino and canbus shield are probably comparable price wise and significantly more flexible anyway.


Sent from my iPhone using Motorcycle.com Free App

 

[Derek]

Oh, and I don't think a universal tool will help (as it won't know the required message either). The arduino and canbus shield are probably comparable price wise and significantly more flexible anyway.

I'm just guessing but it seems that reader has to establish some sort of 'handshake' by sending code that the ECU will recognise to establish communication.
I will look into the Arduino and Canbus Shield options.

 

[John W]

MrCanBus,
interesting to hear what you've done.

Keep up the good work

 

[MrCanBus]

let's make this a bit more real

Below is a tiny example of some raw CAN data.

-----CAN Data example------

The 'Time' field is simply seconds since the start of that particular extract and as you can see there are hundreds of messages per second (approx 300 in this example).
The fields we are interested in are the ARBID and the B0 to B7 columns. The length (len) always seems to be 8 and the Extended indicator (Ext) always seems to be 0 so ignore them.
The data in the columns B0-B7 is in HEX (which excel can easily converts to decimal). HEX is base 16 as opposed to decimals base 10.

Now for a specific example. Engine Temperature appears to be on ARBID 100 column B3, e.g the value 2A at 0.026 seconds. 2A is HEX and converts to 42 in Decimal. It peaked at 142 (dec). I know It was 2 degrees when I started and had reached 84 degrees when it stopped so you can easily work out that you just need to subtract 40 to get to actual temp in degrees c. ARBID 100 seems to transmit about 7 times per second resulting in a the log below for the engine warming up on idle for a few minutes.

-----Engine temp example------

All i've been doing is changing one variable at a time and then searching for it in the data, e.g. indicator flashes starting 5 seconds into the log and lasting for say 5 flashes. If I know what I am looking for it is not too hard to find a corresponding change in the data.

It gets a bit more difficult when multiple things change at the same time. For example, rev the engine and there may be 5 or more columns of data that all change in some way (may be more) at about the right time in the right way.
In the case of revving the engine there are various sensors that you'd expect to respond, e.g. twist grip position, throttle position sensor, engine revs themselves, possible a lambda signal etc. The multi doubles up on most of the 'ride by wire' sensors (I assume for safety reasons), e.g. APS, TPS etc and I think I can see the pair in the data.

To complicate things further a single variable might be split across two columns (or parts of columns). Rear wheel speed is a good example of something that appears to be split across colmuns, ARBID 18, B5, and the 2nd value from B4 (combined as HEX value and then converted to decimal) seems to be rear wheel speed. You then multiple the decimal result by 0.15 to convert to (true) MPH (indicated is +8% according to the manual).
The 1st value from B4 appears to be the gear position indicator so I'm 99% sure I've got this right.

Logic would suggest that you can start to predict what variables are going to be split across columns as the max resolution of 1 column is 16 x 16 = 256. Any sensor needing an output that will have more than 256 incriments must be split across multiple columns.
I can only assume Wheel speed needs it for the ABS and DTC as it clearly doesn't need it for the dash display. Engine revs are split but use all 4 values from a pair of colums.

--------------- SPEED AND GEAR INDICATOR ---------------------

The data sets get very big (in terms of rows as opposed to MB) very quickly, but the newer versions of excel (2007 onwards) are quite good at working with big data sets. Simply filter the data to a single ARBID value, plot as an XY Scatter chart and look for what you are expecting, e.g. the rise and fall of revs or the on/off flash of an indicator.

I got started as much through curiosity as anything but do seem to have become somewhat obsessed with decoding all of the 'normal' CAN traffic. No idea what I'll do with it other than write a program to log the bit I understand in 'english' instead of raw CAN data.

 

[BR Yankee]

Very cool stuff, I'm sure as you get deeper into it ideas will come on what you want to do with it. I always find that to be the case when I start digging into a project like this at work.

 

[rdougan]

Very interesting indeed.

I'm in the process of creating a simple iPad app that will log (via GPS) where I go on the bike. It would be awesome if I could somehow also link into this and track what is happening on the bike as well as the location.

The problem would be linking into the closed iOS simple. Almost impossible. Bleh.

 

[MrCanBus]

The sparkfun Canbus shield actually has a socket on it to connect a GPS receiver. The GPS would be about another £40. Alternatively you can get Bluetooth adapters (about £15) so in theory you could output serial data over Bluetooth to the iPad (or an android phone). Data rate would be reduced but wouldn't be an issue if you were only logging a handful of parameters. Beyond me a the moment but can't be that hard.

Been studying the wiring diagram for the bike so can now make an educated guess as to what else might be on the bus that I hadn't looked for, e.g. fuel level, a key present signal from the hands-free, ABS on/off etc, ambient temp. etc.

The bit I want to get my head round is the suspension settings. I've done rear preload and I can spot mode changes. it is the rebound and compression that is less straight forward. I can see parameters change but can't yet work out the rules. I need log more data to work out what is going on but making the changes (4 stepper motors x32 clicks ) via the clunky dash menu is painfully boring, and that is before looking through it afterwards.

we could have a phone app to edit suspension setup over Bluetooth ! Pointless I know, but when did that ever matter!

 

[brt]

Hello MrCanBus, impressive stuff! Would you be willing to share your table of decoded CAN bus messages? I have a functioning CAN sniffer now (Beaglebone ARM/Linux board plus Towertech TT-3201 CAN cape). I can see traffic from the CAN bus of my 1198 but I don't know what is what yet. I've started to reverse engineer, cannot find much info online and don't have much yet. Your information would help a lot!

I would like to combine this with GPS data (already works although I need a higher frequency GPS receiver) to create a DIY laptimer / data logger of sorts.

I don't have much experience with CAN or with the way low level messages are organised. Am I right in suspecting that there is often 4 2-word 'channels' of information per message?


A sample of my output here (using Linux socketcan and candump from can-utils):

<0x210> [8] 00 00 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x280> [8] 20 20 44 55 43 41 54 49 
<0x020> [8] 36 d7 00 00 00 00 00 00 
<0x028> [8] bd 54 bc 30 00 00 00 00 
<0x290> [8] 20 20 53 42 4b 20 20 98 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 42 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x029> [8] 00 00 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x300> [8] 51 40 18 08 3c 00 00 00 
<0x018> [8] 00 52 00 00 00 00 00 00 
<0x100> [8] 00 00 00 00 00 60 04 d3 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x020> [8] 36 d7 00 00 00 00 00 00 
<0x028> [8] bd 54 bc 30 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 62 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 72 00 00 00 00 00 00 
<0x100> [8] 00 00 00 00 00 60 04 e3 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x020> [8] 36 d7 00 00 00 00 00 00 
<0x028> [8] be 54 bc 30 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 82 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 92 00 00 00 00 00 00 
<0x100> [8] 00 00 00 00 00 60 04 f3 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x020> [8] 36 d7 00 00 00 00 00 00 
<0x028> [8] bd 54 bc 30 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 a2 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 b2 00 00 00 00 00 00 
<0x100> [8] 00 00 00 00 00 60 04 03 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x020> [8] 36 d7 00 00 00 00 00 00 
<0x028> [8] be 54 bc 30 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 c2 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 d2 00 00 00 00 00 00 
<0x100> [8] 00 00 00 00 00 60 04 13 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x200> [8] 32 7b 34 13 00 00 00 00 
<0x210> [8] 00 00 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x280> [8] 20 20 44 55 43 41 54 49 
<0x020> [8] 35 d8 00 00 00 00 00 00 
<0x028> [8] bd 54 bc 30 00 00 00 00 
<0x290> [8] 20 20 53 42 4b 20 20 98 
<0x080> [8] 00 00 00 00 00 00 c8 00 
<0x018> [8] 00 e2 00 00 00 00 00 00 
<0x080> [8] 00 00 00 00 00 00 c8 00

 

[brt]

Found some additional info at daniduke.bplaced.net:

Ducati 1098
CAN ID 080 ; byte 1 & 2 Velocity ; mapped to Analogue 3
CAN ID 080 ; byte 3 & 4 Speed ; mapped to RPM
CAN ID 080 ; byte 5 Throttle position ; mapped to Analogue 1
CAN ID 020 ; byte 1 Engine temperature ; mapped to Analogue 4
CAN ID 300 ; byte 3 & 4 Mileage ; mapped to Analogue 2

I think I know 1098 and 1198 are compatible, but it seems this might be different for the Multistrada.

 

[gabeschine]

brt -

I also built an arduino/CAN interface much like OP did. There's some code available on github:

https://github.com/MrCanBus/MTS1200-CANBUS/blob/master/MTS1200_decode_v1

and you can get some of the codes/byte positions there. It might make sense for us all to collaborate on a spreadsheet with whatever we discover:

https://docs.google.com/spreadsheet/ccc?key=0Aq9VINL_2hxvdGcxcTVLNER5cWltdURLU2pjaXozYlE&usp=sharing

I've filled in only what I saw for id 0x80. I'm at work so I didn't want to spend much time on it at this moment .

 

[gabeschine]

Oh and code credit goes to MrCanBus - not me . I've only used modified versions of his code so far.

 

[brt]

Hello gabeschine, not a bad idea, we should probably split them by bike type. Thanks!

 

[Mr Sunshine]

Here are two links you might like.

M32R Family Documentation | Renesas Electronics

and the hardware spec....

http://documentation.renesas.com/doc/products/mpumcu/rej09b0123_32192_195_196hm.pdf

 

[MrCanBus]

Sorry about the long absence folks. I've not had much time to play with this until the last week or so. I am now able to decode the suspension settings though. I have formulae to convert to and from so can out put the 1-32 rebound and compression settings front and rear, also preload and preload error.

I've attached a cheap Bluetooth adaptor to the arduino and am in the process of writing an android app to display the data. I've also hooked up a 20x4 LCD and am able to display parameters on that. Bluetooth onto colour screen on phone will be better though. New to writing android apps so be patient.

Still not sure I'm brave enough to send messages back into the bus.

I do have a spread sheet that is be happy to share, just not sure how to share it.