Kawasaki KDS3 CAN protocol – looking for request/response IDs and frame format

Other Hardware Device Hacking
1

Hi everyone,

I am working on a diagnostic adapter for a 2011 Kawasaki Concours 14 / GTR1400, using an Arduino Nano and an MCP2515 CAN controller.

My goal is to communicate with the FI ECU using the Kawasaki KDS3 diagnostic protocol, and eventually translate the diagnostic data into standard OBD-II / ELM327-style responses for applications such as Torque.

I found an older Arduino Forum discussion in which user jimmy06 mentioned reverse engineering the KDS3 software and obtaining the CAN Bus IDs. He also shared a spreadsheet called “Kawasaki KDS3 CAN Bus Commands.”

Unfortunately, that old thread is now closed, so I am starting a new topic in case anyone here has worked on the same protocol or has preserved information from that project.

From the available KDS3 command table, I have information for diagnostic parameters such as:

  • Water Temperature – command 0x06
  • Engine RPM – command 0x09
  • Battery Voltage – command 0x0A
  • Gear Position – command 0x0B
  • Vehicle Speed – command 0x0C

What I am still missing is the actual CAN transport/protocol information required to send these commands to the FI ECU:

  • KDS3 → ECU CAN request ID
  • ECU → KDS3 CAN response ID
  • Request payload/frame format
  • Response payload/frame format
  • Meaning and use of the “ECU protocol code” in the KDS3 command table
  • Any initialization/session-start sequence required before sending diagnostic commands

I have already connected directly to the motorcycle CAN bus at 500 kbit/s in listen-only mode and have been analyzing the normal communication between the FI ECU and the instrument cluster.

So far, two signals appear to be identified:

  • CAN ID 0x100, bytes 0–1: Engine RPM, apparently a 16-bit big-endian value with approximately 1 rpm/bit
  • CAN ID 0x120, byte 1: Engine coolant temperature, apparently raw - 40 °C

I am now also investigating gear position, vehicle speed and fuel-consumption-related data.

If anyone has reverse engineered KDS3, captured CAN traffic while a genuine KDS3 interface was connected, or has old source code, CAN logs, database information, or notes related to this protocol, I would greatly appreciate any information you can share.

Even a single CAN capture of a KDS3 reading Engine RPM or Water Temperature could be extremely useful for identifying the request/response protocol.

Thank you,

Maxkazoo
Japan

2

Are you aware of the Internet Time Machine?

3

Hi @maxkazoo !

Not sure If this is of assistance

http://zggtr.org/index.php?topic=20461.0

These are the tables that are published in the first post there (sorry for the formatting...)

Table 1. Usage Table for Observed Message IDs
Arbitration ID   Usage
0x010           Front/Rear Wheel Speed
0x011           Timer/Counter
0x018           Brake Status (Brake OFF: Byte0=8, Brake Depressed: Byte0=0)
0x050           KTRC Button Status (See Table 3)
0x058           KACT Button Status (See Table 4)
0x060           Mode Button Status (See Table 5)
0x100           Engine RPM
0x110           Vehicle speed
0x120           Water Temp
0x121           Gear Indicator (data0 = gear, data1 = Neutral indicator)
0x130           Tire Pressure Display
0x205 
0x220           Ignition Status (Key on = 1, Key Off = 0)
0x221 
0x223           Steering Lock Status (Locked = 0, Unlocked = 1)
0x224           KTRC Mode (Enabled = 1, Disabled = 0)
0x225           KACT Mode (Low Combined = 1, High Combined = 2)
0x227           ECO Mode (OFF = 0, ON = 1)
0x230           KTRC Error
0x310 
0x311 
0x318 
0x319 
0x320 
0x321           Engine Status (Cranking/Running = 1, Stopped = 5)
0x328 
0x32f 
0x331 
0x340 
0x695           Front or Unknown Tire Pressure Sensor Message
0x696           Rear Tire Pressure Sensor Message
0x700 – 0x7ff   Reserved for Diagnostic System Requests

 


Table 2. Message Formats for Common Display Parameters

Usage	ID	DLC	Data0	Data1	Data2	Data3	Data4	Data5	Data6	Data7
Engine RPM	0x100	6	MSB RPM	LSB RPM	0	0	0	0
Vehicle Speed	0x110	6	MSB Speed	LSB Speed	0	0	0	0
Water Temp	0x120	6	MSB water temp	LSB water temp	0	0	0	0
Gear Indicator	0x121	2	Gear number 1-6, 0 for neutral	0x01 for neutral, 0x00 otherwise
Tire Pressure Display	0x130	4	Front Pressure in 0.2 PSI increments	Rear Pressure in 0.2 PSI increments	Front pressure warning	Rear Pressure Warning
Front Pressure Sensor	0x695	8	??	??	??	??	Pressure in 0.2 PSI increments	Message counter	Pressure in 0.2 PSI increments	0x00
Rear Pressure Sensor	0x696	8	??	??	??	??	Pressure in 0.2 PSI increments	Message counter	Pressure in 0.2 PSI increments	0x00
Unknown Pressure Sensor	0x695	8	ID:3	ID:2	ID:1	ID:0	??	Pressure in 0.2 PSI increments	??	0xff


Table 3. Message ID 0x050 - KTRC Button Status
Condition 	Data0 Value
KTRC in Self Test Mode   	0x0e
KTRC Mode off, KTRC button not pressed 	0
KTRC Mode off, KTRC button pressed   	2
KTRC Mode off, KTRC button held, mode changed   	3
KTRC Mode on, KTRC button not pressed   	2
KTRC Mode on, KTRC pressed   	3
KTRC Mode on, KTRC button held, mode changed   	1
KTRC Mode off, KTRC button released   	0

Table 4. Message ID 0x060 - Mode Button Status
Condition   	Data0 Value
ECO Mode off, Mode button not pressed   	0
ECO Mode off, Mode button pressed   	1
ECO Mode off, Mode button held, mode changed   	3
ECO Mode on, Mode button not pressed   	2
ECO Mode on, button pressed   	3
ECO Mode on, Mode button held, mode changed   	2
ECO Mode off, Mode button released   	0

Table 5. Message ID 0x58 – KACT Button Status
Condition   	Data0 Value
KACT High Combined mode, KACT button not pressed   	4
KACT High combined mode, KACT button pressed   	5
KACT High combined mode, KACT button held, mode changed   	3
KACT low combined mode, KACT button released   	2
KACT low combined mode, KACT button pressed   	3
KACT low combined mode, KACT button held, mode changed   	5
KACT High combined mode, KACT button released

Hope it's of use ...

Regards
ec2021

4

Maybe something here

5

Nope, this is the predecessor and working over the K-Line, rather than CAN-Bus.

6

Hi @ec2021 san

Thank you for the useful information.
The details provided match the data I have logged.
To start with, I will use this information to try and extract the necessary data from the usual CAN bus traffic.

I'll let you know if there are any developments.

Best Regards,

maxkazoo

8

Hi everyone,

I would like to share an update on my project, and first of all, thank everyone who contributed information to this thread over the years.

I have been working on a 2011 Kawasaki Concours 14 / GTR1400, which is different from the earlier K-Line based bikes discussed in this thread. This motorcycle has the Kawasaki diagnostic connector connected to the vehicle CAN bus (500 kbps).

The project has now reached the point where I have a working prototype using:

  • Arduino Nano (ATmega328P)
  • MCP2515 CAN module
  • HC-06 Bluetooth module
  • Android Torque Pro

My Arduino acts as an ELM327-compatible adapter toward Torque, while communicating with the Kawasaki CAN/KDS3 side.

I have successfully tested it on the actual motorcycle.

Broadcast CAN data identified so far includes:

  • Engine RPM
  • Vehicle speed
  • Coolant temperature
  • Gear position / Neutral

I can also obtain diagnostic parameters from the FI ECU, including:

  • Throttle position
  • Intake manifold pressure
  • Coolant temperature
  • Intake air temperature
  • Atmospheric pressure

Frequently changing broadcast values are cached in RAM, while diagnostic values such as throttle and intake pressure are queried periodically.

One particularly interesting problem was fuel flow.

I initially converted the Kawasaki fuel-flow data to standard OBD-II PID 015E (Engine Fuel Rate). However, changing its calibration had no effect on the "Fuel Flow" value displayed by Torque.

To investigate this, I made a bench-test version of the Arduino adapter, with no motorcycle connected. It advertised PID 5E and was programmed to always return exactly:

41 5E 00 14

which corresponds to 1.00 L/h.

The Bluetooth communication log showed that Torque never requested 015E. Instead, it was requesting MAP, RPM, IAT, etc. It therefore appears that Torque calculates its standard Fuel Flow value internally from those parameters rather than using PID 5E in this configuration.

I therefore implemented Kawasaki-specific Mode 22 custom PIDs:

22F331 = Kawasaki Fuel Flow
22F330 = Kawasaki Instant Fuel Economy
22F321 = Kawasaki Gear Position

Before connecting the motorcycle, I tested these with fixed dummy values.

The Arduino returned:

22F331 -> 2.50 L/h
22F330 -> 20.0 km/L

Torque successfully requested both custom PIDs and displayed exactly 2.50 L/h and 20.0 km/L.

The latest version now connects these custom PIDs to the actual motorcycle CAN data. Gear position is also provided as a custom PID, using the gear information from CAN ID 0x121.

The remaining work is mainly calibration of the Kawasaki fuel-flow data. I can compare the calculated instantaneous fuel economy against the Concours 14 dashboard, which already displays instantaneous km/L, so this should provide a useful reference for determining the correct conversion factor.

I would especially like to thank jimmy06 for the KDS3 information posted earlier in this thread. The KDS3 CAN command information was extremely helpful in getting past the point where I knew CAN was present but did not know how Kawasaki's diagnostic communication worked.

The project has therefore progressed from:

Kawasaki CAN/KDS3 → Arduino → ELM327 emulation → Bluetooth → Torque

and it is now working on the actual motorcycle.

I will report the results of the fuel-flow calibration and further road testing when completed.

Thanks again to everyone who shared information in this thread.

9

If you want to follow the OBD2 standard, you can use the 0xA4 to transmit the gear.

I did that with KDS to OBD2 like that and it worked alright.

case 0xA4: //Transmission current gear
//01: Gear supported, 02 Ratio supported (00 unsupported)
obdResponse = (data.TransmissionGear << 4) +1; //Seems to shift gear >>4 aside and add 1 for "supported"

10

Dear TriB-san,

Thank you for your useful information.

I will apply it in the next version and give it a try.:grinning_face:

11

Hi Everyone,

I have released the source code.
I hope it proves useful to someone.

Maxkazoo/Kawasaki-CAN-Torque-Adapter: Arduino Nano adapter for Kawasaki CAN diagnostics and Torque