 All right, folks, welcome today to all aboard the CAN bus or motorcycle. Two wires, two wheels, bikes can do CAN too. In today's talk, we will cover who am I, a little bit about myself, the bike and brand I feel to completely understand the essence of this project, the bikes a little bit on the rarer side. So we'll cover a little bit about that, why the project inspiration and purpose, some of the hurdles that came into play when working with the motorcycle as opposed to a car. And then the project begins, what I used, what I built, the hardware involved with the project. I built an engine simulation, and I did quite a bit of CSV parsing and data analyzing with a Python script I made. And then we'll talk a little bit about what's the future of the project. So who am I? I'm Derek. I've been riding motorcycles for about 10 years. I've been a developer and infosect hobbyist for about 15 years. I currently work as director of IT for a food and beverage automation company. If you're interested in continuing to follow this project after this talk, you can follow me on Twitter, canbusdutch. If you have any questions that aren't answered or you don't get a chance to ask them at the end of the talk, you can email me at canbusdutchgmail.com and all the code talked about can be found at my github, github.com, slash circuitworks1. So this is my bike, an EBR 1190RX. Those of you not familiar with EBR or the Buel brand, Eric Buel, the founder, was a Harley engineer who liked racing motorcycles. They make the only, or they, yeah, they're the only production sport bike made and designed in the USA. They're the only American-made motorcycle to ever score points on a world superbike. And they won the 2009 Daytona superbike championship without a single DNF, those not into power sports that stands for did not finish, which means no engine failures and more importantly no accidents. They manufactured nearly 140,000 motorcycles in 15 years when acting as a Harley subsidiary. And in 2009, after Harley-Davidson axed Buel, they came back as Eric Buel racing and sold 65 bikes in 18 months, garnering $3 million in revenue as a startup. And sadly, now it's a company teetering on the edge of existence. So here's a few Buels and EBRs, some a face only a mom could love. But that top bike there in the top left is the bikes that help them fund EBR. It's the EBR 1190 RS. And then you'll see the same bike I have, the EBR 1190 RX. And then the EBR 1190 SX, which is the same as the RX just in a different trim. And then down here we take a look at the Buel XB9S, which utilizes a Harley-Davidson Sportster power plant. And then the EBR XB9R, sorry, the Buel XB9R, and then finally the Buel 1125R. And we can't forget that is the 2010 Buel Blast, which is kind of an inside joke amongst the Buel community. So now let's get into it. So after about six months of owning my EBR 1190 RX, I was on a large group ride where I did about 100 miles in a day. And on my way back home, my dash fell apart. Luckily, I didn't lose anything. My screen there held on by the ribbon to the rest of the display. And when I got back home, I reassembled it. But sadly, I started receiving a comm error. And after about a few months of surfing around the Buel Facebook groups and forums, I started to realize I wasn't the only one. There was this guy, and this guy, and this guy, and this guy, well, you get the point. So sadly, apart from these comm errors, there was also individuals who had their dash rattle the pieces just as mine did. And at the time, the future of EBR was being decided by the courts as they had filed for receivership, which is a similar process to bankruptcy. And there was zero parts availability. So because I'm not only stupid, but also ambitious, I decided to look into designing and after market dash. And that's when I realized it probably wouldn't be as easy as I thought. The main issue I ran into is that there is no diagnostics standard in the motorcycle industry. OBD2 is kind of a large plug, hard to fit on a small vehicle and not really ideal for motorcycles. Although we will see the OBD2 standard is used on a few manufacturers. And from what I've been told that it is becoming a standard in Europe. So there are universal diagnostic tools, although the bite offset scaling factor, all that good stuff is different for every manufacturer. And in order for these universal tools to obtain that information, the manufacturers charge a lot of money. So these tools are very expensive, not only that, but the likelihood of finding a universal diagnostics tool that works with a bike with only about a thousand of them manufactured in the world is slim to not. You aren't going to find. So let's take a look at the, we'll take a peek into the motorcycle diagnostics port world. In this slide alone, we have two Kawasaki, two Hondas, two Suzuki connectors. And there we go. There we have a four pin Harley diagnostics cable and we can see there that Piagio triumph in victory all use the vehicle standard OBD2. And then here we see another Kawasaki connector. And here we have the, the Buell diagnostics port. And then we have another Kawasaki cable. And this is one of my favorites. So this envy Augusta four pin cable down here is actually the same connector used on Hondas, but it has a separate pin out. So if you accidentally use the envy Augusta connector on your Honda, you will fry your ECM. And then here's another one that kind of grabs my attention down in the left hand corner there. We have the Harley Davidson can six pin cable. If you remember, I just mentioned they had a four pin diagnostics cable in a six pin can cable. And as we all know, can is a two wire signal. So why couldn't they have just jammed the diagnostics in can into one cable? Who knows. And last but not least, we have the Benelli cable there, but overall that's 37 different connectors for about 25 different manufacturers, kind of a headache. But luckily we have can. Most European and Japanese manufacturers began implementing a can bus system on their bikes around 2003. This includes to Kati, BMW, Honda, Kawasaki, and the American manufacturers as with most things when it comes to automotive were a little bit late to the can party. Buell first implemented a can system on the 2008 release of their 1125 and Harley's first can based bike wasn't until 2011 and it wasn't until 2014 that all Harleys were equipped with can bus information was a little bit lacking when it came to the Polaris brands Indian in the now defunct victory. But I believe they started using can around 2013. So let's hop into what exactly my ECM comprises of the microcontroller is a micro technology pick device. The diagnostics protocol is a single while wire variable pulse with J1850 and the can protocol is 500 kilobits a second, 11 bit IDs, 20 ohm termination and least significant bit first. When it came to hardware for my project, I started out with this seed studio device. But after the second one failed me, I navigated over to using the the cannibal device which was much more reliable. And software wise, I started off using the seed studio software but ended up converting over to bus master after I purchased the cannibal device. So after doing quite a few can capture sessions and figuring out some of the can definitions from reading can packets directly from the bike, I was kind of over the idea of spending hours in the heart hot garage huffing exhaust fumes. So I thought, why not try some engine simulation. The most important part for my bike when simulating the engine sensor data is the crankshaft sensor outputs. The ECM won't really acknowledge some of the other data if the crankshaft sensor outputs is not reading correctly. On my bike crankshaft sensor produces two waves 180 degrees at a phase with each other. The wave is generated using a hull sensor and a stepped rotor tonering surrounding the stator magneto there are 34 steps in a timing gap the equivalent to two wavelengths or two steps. So it's essentially 36 steps and there we have a picture of it. You can see the timing gap there pretty common. And now let's take a look at it and there we go a few oscilloscope readings of the output so I know exactly what I'm recreating. And so how do we simulate it. There's 36 steps one full step every 10 degrees 360 degrees in a circle with pick an RPM for Matt's sake we'll do 6000 RPMs. And then since we all know RPM is a measurement of minutes and Hertz is a measurement by seconds. We'll have a math equation that looks something like the following RPM divided by 60 seconds times 36 steps and we get a wavelength of 3.6 kilohertz to simulate the 6000 RPMs. So the code what we do is we take the frequency input by the user through the serial monitor. I did all this using a Arduino teensy and we calculate the time to execute both a 34 wave cycle and a 36 wave cycle in microseconds. So we set our variables there RPM time and RPM restart and then our code logic looks something like this. If the wave start time is greater than RPM time, then we stop the wave. And if waves start time greater than RPM restart we restart the wave. So basically what's happening here is we produce a wave for 34 seconds. And then once the time hits greater than 34 seconds we stop it. And then we turn it back on once the time hits greater than 36 seconds. So we have those 34 steps with a two step pause. And now let's take a look at what we got. There's our oscilloscope output. We got 34 steps and then the blank spot the equivalent two steps. Now we'll look into doing the mile per hour, the speed. The speed sensor simulation is a bit more basic because there's no timing gap. So simulate our speed sensor. We will take a given frequency that was input by the user again through the serial monitor. And we'll turn on and off one of the pins rapidly to generate a square wave. So we first calculate the period to complete one wave cycle in microseconds. And then we divide that by two to find out how long the pin needs to stay in each state to complete the entire waveform. And we control it with a non-blocking delay here. So you can see there, if the delay timer is less than the speed time divided by two, pin off. And if it's greater, then pin on. And if it's greater than, and once we created two, which will cause a full wave form there, then we restart the timer and go to town again. So there we have it. And again, this code for the TNC can all be found in my GitHub repository that I gave at the beginning of the talk. So now that we got our two waves looking good, we'll play with it a little bit. So aside from the speed in RPM, I also programmed in a few switches so that I could pop back forth the things such as the neutral switch and the gas light and a few other things. So we'll watch it and give it a try here. So oil pressure true. And you could see up there, sorry, I forgot to point it out, but the oil pressure light went there. And now we'll change our neutral switch to false, boom. And then low fuel set to true. And one thing about the low fuel, as it says right here, it has to remain true for 20 seconds before the ECM flips the low fuel bit to true. So it'll pop on any second there. And there we go. Low fuel, you see the fuel trip flipped over there. And here's the fun part. In frequency 1,001, and we got a little bit of RPM going there and speed frequency 300. And now we got a little bit of speed going there. And if you'll notice in a second, the fuel trip odometer goes up to one, the end. So success, oops, it happened here. Okay, so let me switch back into presentation mode. So I, once I did that, I started capturing sessions like crazy, I was capturing everything to a CSV, and, you know, clearly, they, you know, all this data and only one set of eyes, you know, you don't want to go through all that without some software analyzing it. So I created a Python script that compares to CSVs that were created using the can software. In the example I'm about to show, I have two CSVs. One is where I set the oil pressure to true. And the second is where I set the oil pressure to false. So oops. So a little bit about my parser here, my Python script. Out of the 15 populated columns used by my software, we only use nine of them. It's the frame ID and then the 8 bytes. So basically what the Python script does is it looks at the number of times each ID appears and the number of times the hex value appears in each given ID, and then compares that to allow us to have in our outputs the difference in hex value appearances, the increase and decrease percentage of hex value appearances, and appearance of a new hex value in a given ID. And I also programmed it to convert the hex value to binary. So if we take a look here, this output shows the number of times a hex value appears in a given ID. If its appearance account was zero in either of the canned capture session, the line will be highlighted in red. So the line will be highlighted in red if the number of hex value appearances is equal to the number of appearances of its given ID. So meaning that in one canned capture session, the hex value appeared zero times and in the other one it appeared 100% of the time. So if we take a look here, we have that happen four times in this one. There is hex value 19 and 99 which appeared in ID 202 100% of the time while appearing in one canned capture session while appearing zero times in the other one. And then we have down here hex value 20 and hex value 60 which appeared in ID 451 100% of the time in one file and 0% of the time in the other. And I can confirm that after you know, figuring this out, I was able to verify that an ID 202 byte A bit 7 is the low oil warning light and ID 451 byte H bit 6 is an oil pressure true false bit. So we can see so once again this, which we call it this this Python script is available at my GitHub account to take a look at and analyze your own CSVs. And now we'll look now that I have the now that I've reversed a whole bunch using the Python script and you know, I was able to trigger all types of ECM settings to reverse. I developed my first prototype here. This project was used with a, I'll wait and let it go. So that was developed using a Nextion display and a ESP32 with some with a can input on it. And you know, originally I was going to make this from the ground up, but I don't know I just decided when everything's exposed to the elements like on a motorcycle. It probably wasn't the best route to go. So I ended up purchasing a in aim MXS 1.2 strata, which so far I've loved and highly recommend. I haven't actually put it on the bike yet, but here's a little video of what I got going. We're going to let the bike warm up. You'll see the light over here for the engine temperature will go from blue to green when the engine is warm. And then I'll I give it a few revs to show off. All right, there we go. So what's next for the project aside from finishing the development of the dash? You know, I'd really like to stretch my Python script a little bit further right now. All the IDs to my bike are hard programmed into the Python script. Ideally, you know, this Python script will be able to look at the ID column, grab all the individual IDs that are in it, and then start analyzing then, you know, I spent a lot of time as a front end developer. And I'd also like to make Python script output a little bit prettier. I think some data visualization that I've started playing with, you know, would really spice things up a bit and kind of make things easier to point out some bite annotation. Right now, the Python script only parses data based on the hex values in the ID. So you could end up with some some confusion on, you know, if you're getting hex value changes in different bytes in the same ID and stuff like that. And then I also like to implement some bit flip search, which, you know, would help things with like the ground triggers and or ground switches and stuff like that, that's are in the ash and stuff. So you know, so anyways, that's about it. You know, I want to give some shout outs and some thanks. Thanks to the Buell community. There's really nothing like it. Thanks to the man, the myth, the legend himself, Eric Buell, and those involved with Buell motorcycles and EBR. And you know, even though you guys probably hate me, I want to say thanks to Tim Blumenberg at IDS, who is the company that developed the ECM and Bill Melvin who currently owns EBR. And then some of my gearhead friends that I wouldn't have been able to do this without Jacob, Zach, Rob Weaver, Laylin. You know, it couldn't have been done without everyone. Thanks.