Sniffing the CAN bus

As GRiSO parts are slowly transmuting into unobtainium, and somewhat inspired by evansnows' urge to remove his dash unit (although I think he is somewhat mad), and given that the air pressure sensor for the fuel injection is actually inside the dash unit, I decided to see if a gizmo could be created to talk to the ECU in CANbus speak, to provide air pressure data. That would allow evansnows to remove his dash and keep it in a safe place, and also allow others to use a 3rd party dash unit in case of catastrophic failure. Yes, the engine will start without the stock dash attached.

My idea is to use an Arduino unit utilising a CAN bus shield and a stand alone barometric pressure sensor to provide the required data.

I acquired a dash unit on the bay of fleas, and retrieved the ECU bench flashing unit I made for Pete some years ago. Did you ever actually bench flash an ECU?

Interestingly, without a dash connection, the ECU pressure value defaults to 1013.

Anyhoo, phase 1 is completed. I've got the ECU and dash unit talking. As you can see here, GuzziDiag shows an air pressure reading of 1002. Next step is to connect up the Arduino and get sniffen'.



[You must be registered and logged in to see this image.]

Oh yes, I used the tool many times. It was very useful.

Love this shit, if I can help in any way Mark, I would love to

May need your coding skills, Tony. I've done some coding in C & C++, and Linux bash scripts, but I've never done any Arduino sketches. A bit of a learning curve ahead...

You guys are soooo far over my head......... But, keep it coming. It's interesting even though I don't understand most of it.

Outstanding!

Forgive my ignorance, but would there not exist some automotive baro sensor that could speak directly to the bus without needing to be translated by the Arduino?

Or is this exercise a step in that direction?

OldMojo wrote:

Forgive my ignorance, but would there not exist some automotive baro sensor that could speak directly to the bus without needing to be translated by the Arduino?

The short answer is "no". My Google-Fu wasn't strong enough to find one. Therefore, make one!

In essence the dash is a "kind of Arduino setup". Though not really an Arduino, but similar technologies. It is a trade secret how the electronics in the dash (and for the ECU for that matter) work, so one must simulate with other, available, tools.

Mark, look up state machine in C, that might be an easy approach. Failing that, getting code dirty will be the go.

Earlier this week I took delivery of a 200 MHz oscilloscope and a 25MHz arbitrary function generator (and a programmable power supply). You probably have similar but in case you don't, more than happy to help out. They saved my bacon already this week, as I no longer have easy access to the equipment at work - COVID lockdown doesn't help - good thing I've got some stuff at home...

I farted about with it for most of the day. I've just given up to enjoy a Tennessee Cordial.

There seems to be a problem when tapping into the CAN bus. The dash seemed to stop sending any data.
With the CAN shield disconnected, the air pressure reading in GuzziDiag was 1002. With it connected, the value went to the default 1013. It may be loading it down. I'll need to check the supply voltage.

I was trying various sniffer sketches, but it was fruitless. With the the dash connected, the loading halts comms. With the dash disconnected, the ECU CAN bus probably goes to sleep without a known node to talk to. Until I can get the dash to stay connected with the shield attached, it's pointless.

There was one discovery. It turns out the Google-Fu is weak with this one. I stumbled upon a guy who makes the very thing I'm trying to construct. Apologies to OldMojo!

There's a guy in the UK who makes air pressure sensors for the Tri-King's running CARC or 8V engines.

D'oh!

And you've reached out?

You may also need a buffer between the CAN bus and your sniffer - some things can be overly sensitive, like moi!

You should be able to look at with an oscilloscope, with the probe set to 1M - 50 Ohm will give it a hissy fit for sure. High impedance is the go.

Not yet. I'm kinda invested now, and might see this through. Depends on the alligators.

Looks like there are isolated CAN bus shields available. I'll acquire one soonest, the Fates willing.

Well I for one am finding this very interesting and a worthy project!
And whilst I understand what you are doing, unlike Tony I don't have the smarts to assist so will have to simply watch your progress.

There's another Tony? A smart one?

beetle wrote:

There was one discovery. It turns out the Google-Fu is weak with this one. I stumbled upon a guy who makes the very thing I'm trying to construct. Apologies to OldMojo!

Ah, it's just part of the process! Sometimes you have to start down the longer path in order to see the shorter one. I just admire the effort.

Definitely good news though. Is the Brit's doohickey plug and play?

Oz1200Guzzi wrote:

And you've reached out?

You may also need a buffer between the CAN bus and your sniffer - some things can be overly sensitive, like moi!

You should be able to look at with an oscilloscope, with the probe set to 1M - 50 Ohm will give it a hissy fit for sure. High impedance is the go.

Hi guys. I've never tried to sniff the bus between the dash and the ECU, but I know the matter (because of my work...). In the past, I talked with a person that produce an external oil temperature indicator for the Stelvio, using the ECU data (you can read the oil temp with GuzziDiag, but unfortunately it's not on the dash). Well, that person told me that the serial bus between the ECU and the dash is not CAN! In fact, his tool was designed to connect to the OBD connector (which is below the seat), but in my opinion it's not a good idea to keep the OBD communication active all the time while riding.
I'm not sure of this (that's could be not CAN, I mean), but this could explain the fact that attaching a CAN sniffer the communication get broken, because of an incorrect load. It should be definitely better to look at the signal with an high impedance scope probe, to understand if on the 2 wire there are CAN messages or, maybe, it's a 485 half-duplex. I can try too (in the next weeks).
I'm interested to the matter (when I'll find the time, my idea is to add a small display with additional information; but also replacing the stock dash would also be interesting).

The pinout of the 5AM notes CAN High & Low on pins V 20 & 29. I'm quite sure the RS485 is only on the OBD k-line for diagnostics.

Hi Beetle, thank you. Do you have maybe the detailed pinout of the 5AM connectors (not only the bike cabling drawing)? thx

Yes.

[You must be registered and logged in to see this link.]

You definitely have to simulate the Dash node to keep communication alive.
I have made a "sniffer" connector on my 1200 Sport in order to program a gear indicator. All other bikes have 5 gear, often forget to use the 6th on the Sport.
Identified speed and rpm on the bus. Oil temp was my next wish, have to try to find it also.
And, yes, it is CAN.

ok, well, this is really good - and open many interesting ways. Do you know he baudrate? thx

Of course I'm mad I ride a GRiSO !

I currently run the original speedo in the tail tidy I fabricated to let the electronics in it do whatever.

What I've always hoped is to be able to do without the original speedo rev counter.
Up the track when they're no longer available then this should be a way of keeping Grisos going.

This is the Acewell unit I use in place of the original unit

[You must be registered and logged in to see this image.]

mdagbro wrote:

Oil temp was my next wish, have to try to find it also.
And, yes, it is CAN.

Not exactly oil temp, but engine temp.


Msg ID = 0x200

albertoge wrote:

ok, well, this is really good - and open many interesting ways. Do you know he baudrate? thx

125Kbps

Hi,

during my 5AM explorations using initially a cheap signal analyzer and Sigrok,


[You must be registered and logged in to see this image.]

then an Arduino (Beard wrote the sketch),

[You must be registered and logged in to see this image.]

and finally a commercial CANBus sniffer to monitor the CANBus below is what was found. This was accompanied by the reverse engineering of the ECU code.

The message IDs vary between the 2230 and 3222 BINs.

[You must be registered and logged in to see this image.]

Cheers
Meinolf

Hi,

the air pressure default values are ROM variables (eg they can be changed w/o touching the actual code).

[You must be registered and logged in to see this image.]

Cheers
Meinolf

Hi,

albertoge wrote:

In the past, I talked with a person that produce an external oil temperature indicator for the Stelvio, using the ECU data (you can read the oil temp with GuzziDiag, but unfortunately it's not on the dash). Well, that person told me that the serial bus between the ECU and the dash is not CAN! In fact, his tool was designed to connect to the OBD connector (which is below the seat), but in my opinion it's not a good idea to keep the OBD communication active all the time while riding.

I'm using an early version of the periscope designed by Gimpo (http://www.gimpogarage.de/epages/81379202.sf/en_GB/?ObjectPath=/Shops/81379202/Categories/Features) on my Norge and John, an experienced EE from the UK (he's the Triking person mentioned earlier in this thread) sniffs and logs the OBD data while driving his Triking to track the engine run-mode states.

I have also logged 100s of hours on my ECU simulator with GuzziDiag running.

[You must be registered and logged in to see this image.]

So I wonder why you suggest that reading OBD data while driving might not be a good idea?

Cheers
Meinolf