Results from hacking the KTM SuperDuke 1290 CAN bus

This is a longish post about getting inside the CAN BUS protocol. I had searched far and wide but failed to find what I needed so I dug in and am taking the time to share what I found. No warranties expressed or implied – reading this means you agree that you may blow up your bike on your time, and on your dime.

My Goals:
I want access to race data. I have a SpeedAngle (http://www.speedangle.com) but it lacks access to key data I wanted: throttle position, gearbox position, braking forces, shifting efficiency, tyre slip, ABS/traction control intervention, and bike lean and tilt. This said, don’t get the idea that I’m a hard core racer… can’t be further from the truth. I simply wanted to learn quickly, make cool RaceRender videos, and geek out. I can’t leave good enough alone regardless of my hobby (or job).

Getting Started

• 
  You need a cable to ‘read’ the data. Get the CANABLE cable for $25. https://www.tindie.com/products/protofusion/canable-usb-to-can-bus-adapter/
  Get your Sumitomo connectors here for $ 3.26 a set. Get a set for the data logger project too. http://www.corsa-technic.com/item.php?item_id=230
  Solder up the connectors as follows. The connector is facing you, with tab on top (per Corsa site image). Be sure NOT to connect power – the CANABLE is powered by the USB port, not the bike.
  1 (N/C) 2 (CAN-H) 3 (CAN-L)
  4 (N/C) 5 (N/C) 6 (GROUND)
  Screw this new cable to the CANABLE matching the pins. Note that the CANABLE as exposed metal pins below the circuit board – don’t short them out on your bike frame.
  Prepare your laptop with the right software. Get CANTACT-APP from https://github.com/linklayer/cantact-app. It’s based on Java so get that too. https://java.com
  Plug the cable into the bike and into the PC. Turn the key on your bike.
  Start the app. In the CONFIG WINDOW tab, pick your port (likely COM3) and then Bitrate of 500KB. Press START
  You’re now seeing CANBUS traffic. It’s intense. Congrats.
  In CANTACT-APP you can save data to disc but I found that it grinds to a halt around the 500 second mark so save smaller CSVs. Reverse Engineering
  Here's what i found via tedious sleuthing and math modelling:
  • 
    Throttle – it’s provided by ID 288, in the 3rd byte position. Turn it and see how it goes from 00 (off) to FF (fully on).
    Gearbox – it’s provided by ID 297, in the 1st byte position. The upper nibble (hex digit) is 0 for Neutral, 1-6 for gears. When you pull in the clutch the lower nibble goes from 0 to 8 and back.
    Front Brake Force – it’s provided by ID 656, in the 1st word (2 bytes) position. No pressure is 0x0000 (off) and a fistful of brake registers to about 0x3500 on my bike.
    RPM – it’s provided by ID 288, in the 1st word position, right before throttle. Start the engine and you’ll see it warm up around 2000 rpm and then settle in around 1500 rpm.
    Front Wheel Speed – it’s provided by ID 299. Front wheel is first word. The wheel has to move at a certain minimal speed to get it to register. I’ve not totally figured out the scale but expect it to be pulses off of the 48 tooth hall effect sensor.
    Rear Wheel Speed – it’s also provided by ID 299. Rear wheel is second word.
    Lean Angle – it’s provided by ID 299. The last 3 bytes (6,7,8) split into two 12bit counters. The last 0x000 is for lean. I’ve tested the lean extensively. 0x000 is neutral, 0x001 starts leaning to the right. 0xFFF starts leaning to the left. I *believe* the first 0x000 are tilt but I’ve yet to validate.
    Traction Control – its provided by ID 1104. I’ve more testing to do here while on the road. I have figured out that the byte 1, 3, 5 express changes to ABS, MTC, and MODE settings respectively. I expect byte 2 to be ABS intervention intensity, byte 4 to be MTC intervention intensity.
    Oil temperature – I think it is provided by ID 1344, byte 7/8. Yet to fully validate.
    Water temperature – I think it is provided by ID 1360, byte 2. Yet to fully validate.
    Fuel level – I think it is provided by ID 1361, byte 1, as a percentage. Yet to fully validate.
    Date Time - I don’t know where this is yet. Can’t find it anywhere. It’s important to me for logging so if you happen to find it, please PM me!
    Forward looking stuff...
    
    Logging – baseline edition
    Per above, the real reason for this work was to have a data logger. To do that, one can’t (should not) ride with a laptop taped to their race suit (unless they use 4+ wraps of tape). This being the goal, I ordered a few of these for a very reasonable $24.
    https://www.tindie.com/products/akpc806a/can-bus-logger-with-sd-card
    https://github.com/akpc806a/CAN_Logger/blob/master/Doc/CAN Logger (manual).pdf
    I don’t have it yet but it seems like the perfect starting point for data logging. The wheel speed and brake data above comes in at 100 samples per second. The throttle data comes in at 50 samples per second so you can do the math on file size pretty quick. Right now I see the biggest problem being data sync across my CAN bus logs, my SPEEDANGLE data (GPS, speed, lean) and my GoPro video streams. I need to find the DATE TIME data in the CAN bus feed unless I can get time another way…
    
    Logging – deluxe edition
    The ultimate logger may well be this one. The design is based on a Teensy 3.2 and leverages some cool stuff FUSION (handle of the Tindie maker whose name is Paul) offers:
    The amazing Teensy 3.2 unit ($20):
    https://www.pjrc.com/store/teensy32.html
    Killer shield for the Teensy ($95) that adds GPS for tracking (and data/time!), a GSM tracker for pushing data out to cloud service (e.g.: IoT into Azure cloud; 3D motion tracking for your spouse on long rides, etc.), a CAN bus transceiver, and a regulated power supply that can be powered from your motorcycle.
    https://www.tindie.com/products/Fusion/tinytracker-gpsgsmcan-for-teensy-3132/
    Another killer shield ($28) that mounts to the above shield to offer a 3-axis accelerometer, a 3-axis gyroscope, a 3-axis compass and an altimeter (height above sea level).
    https://www.tindie.com/products/Fusion/10dof-mpu9250ms5637-sensor-addon-teensy-30-32/
    Lastly, we need to write all this crazy cool data to storage via a shield for Micro SD ($8)
    https://www.tindie.com/products/Fusion/teensy-slim-micro-sd-card-adapter
    Unfortunately, this particular logger will require a lot of software to be written… and I’ve yet to start. But it sure does seems like the ultimate data logger suitable to both Super Duke’n on the track and for riding my 1200 GSA to Deadhorse, AK!
    
    That’s in for now. I mostly wanted to share all that I had to return value to the group. Enjoy!

Geeky! Super cool too!

What are you goimg to do with all the data once you have it?

I used to use Bosch LapSim back in 2005 for auto racing. It could tell me where exactly the driver or the car were losing lap time on the track. LapSim works for motorcycles too. ;-)

Probably too early for me to sell my PCV and start modifying my map with tuneedit, but I am so looking forward to someone bringing the ability to modify our maps. This may be the beginning of great things for our 1190!

Here's more data (I shared with my SuperDuke forum friends).

@llamapacker: Everything I'm doing here is about listening. Cracking the EFI reprogramming is a whole other domain that I've not started... The superduke with akra pipes does plenty to giggle my innards around. No more HP needed... well, wanted anyway

-----
It turns out that the repair manual has a detailed electronic guide... 11 or so pages of "which sensors connect to which devices". From there I was able to derive all the devices and their logical IDs. From there a few PDF searches and one can learn a lot about the outputs. e.g.: The BOSCH 9M Plus spec calls out that the unit "measures the motorcycle’s longitudinal, lateral, and vertical acceleration, as well as yaw, pitch, and roll rate during the ride and uses this information to calculate its lean and tilt angle". Given this has to be done a lot to be useful, I searched all messages with updates of 100 times per second first. With engine off, tilted the bike left/right and so on. I found another counter bobbling (fuel level) but it was only being updated only 20x/sec.

The challenge with (absolute) time is that it does not seem to be output to the bus. The Byte 8 values of many 100hz IDs end with a timer that monotonically increases but never says the date/time.

Other messages toggle between two states: 1344/1345 are updated at 20hz but one transmission starts with 02, the next starts with 04. The last 2 bytes of the 04 series is oil temperature. I think this is derived from the fact the EFI controller has most of its inputs in pairs but oil temp, coolant temp, oil pressure, oil levels are all singletons. Also, the message IDs groupings (288,89,296,297,299 vs 1104) does not reflect controllers. Instead they seems to be use to sort the data. e.g.: I think that 299, 656 and 1104 come from the same ABS unit.

Since I have this data in an XLS, here it is. You'll note that the computed outputs are not always offered by the device called out. e.g.: Lean angle (Angle sensor) is said to come from gauges -- it does not. It comes from ABS messages (given the need for a much higher data rate).

e.g.:
EFI Control Unit (A11)
Crankshaft position sensor (RPM)
Gear Position Sensor
Throttle position sensor (A/B)
Coolant Temperature, cyl1
Side Stand Switch
Throttle stepper motor (A/B)
Quickshifter (optional)
Rollover sensor (?)
Intake Air temperature
Ambient Air Pressure Sensor
Manifold pressure sensor, cylinder 1
Manifold pressure sensor, cylinder 2
Injector Cylinder 1
Injector Cylinder 2
Lambda Sensor, Cylinder 1
Lambda Sensor, Cylinder 2
Ignition Coil 1, cylinder 1
Ignition Coil 2, cylinder 1
Ignition Coil 1, cylinder 2
Ignition Coil 2, cylinder 2
Secondary Air Valve (?)

Central Electronic Control Unit (A10)
Front Brake Light Switch
Rear brake Light Switch
Clutch Switch
Start button
Oil temperature Sensor
Oil Pressure Sensor
Oil Level Sensor
Fuel Level Sensor
Fuel Evaporation Valve (optional)
Fuel Pump
Hi beam button
Left signal button
Right signal button
Cancel signal button
Harzard button
Horn button
Low Beam output
High Beam output
Parking Light output
Daytime Running Light
Horn output
Emergency off button
Heated Grip output
Radiator Fan Motor 1
Radiator Fan Motor 2
License plate light
Brake/tail light
Front, Left turn
Front, Right turn
Rear, Left turn
Rear, Right turn

ABS Control Unit (A30)
Front wheel speed sensor
Rear wheel speed sensor

Combination Instrutment (P10)
Angle Sensor
Tilt
<< Time??>>
Ambient Air temperature sensor
keypad - Up
keypad - Down
keypad - Return
keypad - Enter

Alarm System (A50)
Alarm system switch

Ignition (S11)
Key switch

Sweet. For me, the desire was making a better 'SpeedAngle' by getting CAN data + data correlation for learning + making killer RaceRender videos (actual lean, throttle, gear, angle gauges).

In all the pre-made loggers that correlation was not possible; associating all the data together, in full sync. e.g.: Fast cornering is about proper throttle control, good braking, proper entry position, limiting lean, etc. Having a logger that has a 10hz GPS collection, throttle position, braking, forces, gear changes, duration of clutch hold, lean angles, tilt angle, RPM (blipping), tire slip, ABS interference on entry, MTC interference on exit, and so on is the goal of this science experiment. Learning Teensy 3.2 programming and Python was too

Great info for sure! I don't need more power either, just some tuning under my control. I found that my old 2012 Griso was retarded below 3800 rpm which produced a huge flat spot in the throttle. Fixed with modding the map. I miss being able to change my maps on the Moto Guzzi, look forward to being able to use the same tools on the 1190.

Do not give up on this! I beg you. You're doing the community a great favor

So many interesting projects become possible once you have the skills to connect a microcontroller to a bike's CAN bus. Bravo to you for doing this. I have a few questions if you are willing to tell us a bit more about your efforts.

Did you learn to program the Teensy 3.2 from scratch, or did you have prior experience with Arduino or some other microcontroller board?

Do you do your software development on a Linux, Windows or Mac computer? I use a Mac, and would hate to have to deal with Linux or Windows just to program the Teensy.

I know Python. Is that the only computer language you need to know to program the Teensy?

Which CAN bus transceiver do you use?

Are you willing to share your CAN-bus-related source code with other biker nerds? I would be willing to get into this if folks like you were to provide the community with examples of working code.

Thanks for posting. I will be following this thread with great interest.

I'd recommend if you had a source code and want to make a project out of it to use GitHub so anyone who comes across this and knows anything about coding might be able to contribute and help produce a solid final product.

I have a final product idea. I want a black box with a red button for wheelie control. I want to push the button, and for the bike to pop the wheelie and control it with the throttle and the ABS. This would be a cool product!

I agree OEM traction control is lame. Sport should allow the front off the ground without a requiring a hill crest.

I pop medium wheelies off of every stop light with the TC in the Sport mode. I am not sure whether it is limiting me though, I am too scared to disable it, lol.

As long as it's dry I turn mine off. The problem is that medium wheelie doesn't hold itself.

So you are saying I could just keep opening the throttle wider and count on TC to save me from looping over?

If it's turned on yes. It'll lift off from the start, might even pop up in 2nd but only like 2 feet. You can even pop the clutch and hold it wide open and it'll intervene and drop you back down. That's sport mode. Street doesn't do jack. Off it'll come up in first and flip you, 2nd will power up or clutch up with medium risk of flipping. 3rd gear is totally safe unless your like me with a 47 tooth rear, exhaust, and Rottweiler filter lol

I'm all in.

Good day Dan... great job!!! btw have you looked into Vector indigo software for the ktm? They have videos up on youtube . Looks like they have full access to the ecu . Just thought it might help.

For sake of readability, here's my current table:

First of all, I would like to thank Dan Plastina in general for creating this thread, and in particular for finding Alex Borisevich's CAN Bus Logger with SD card. Dan provided a link to this CAN Bus Logger in the original post of this thread.

I have been considering purchasing an expensive CAN bus logger to better understand the electronics within my KTM 1190 Adventure, but Alex's $30 device is all I needed to get started. I purchased this CAN Bus Logger and got it working with absolutely no drama. I wired the CAN Bus Logger to a Sumitomo plug that mates to the bike's Diagnostic connector. That plug kit can be found here:

https://www.corsa-technic.com/item.php?item_id=230&category_id=107

I also got two of these inserts to fill in the two unused connector openings.

https://www.corsa-technic.com/item.php?item_id=382

The wiring on the connector and device sides of the cable looks like this:


The wires are defined as follows:
red – Vcc (12 volt power)
black – Ground
blue – CAN high signal
white – CAN low signal

You can use either of the two Ground solder connections provided on Alex's board, since they are internally connected. I choose to not use the one next to Vcc (red wire) to reduce the possibility of a short between power and ground.

A simple text file on the SD card (named Config.txt) governs the operation of the CAN Bus logger. To passively capture all CAN bus data frames with time stamps on a 1190 or 1290 , the contents of the Config.txt file should be as follows:
baud 500
ack_en 0
id_filter_mask 0
id_filter_value 0
log_std 1
log_ext 0
timestamp 1

The User Manual for the CAN Bus Logger explains how to modify this text file for other data capture options. The only values that make sense to change are: ack_en, id_filter_mask, id_filter_value and timestamp. The CAN Bus Logger will not operate properly on the 1190 or 1290 models if the other values (baud, log_std and log_ext) are modified, since these pertain to the basic characteristics that KTM has chosen for its CAN bus implementation.

With the knowledge gained from this thread and the surprising ease of using the CAN Bus Logger, I feel emboldened to attempt to connect this relatively-easy-to-program micro-controller to my bike's CAN bus, and let the fun begin:
https://www.digikey.ca/catalog/en/partgroup/micropython-pyboard-v1-1/58809

I have many projects in mind to farkle-up my 1190 (e.g., an OLED display to rival the TFT display on the new 2017 1290 Adventure models).

Cheers