OBD II Bike Connector - Pass via bluetooth

Projects & Topics Device Hacking
#156

Hi, thank you all for a great job! I ride Kawasaki Z250SL'16 and I also wanted to read the data from the ECU. First of all, I tried to reproduce the TriB's project - Arduino UNO (instead of Nano, it doesn't matter) and BT-06. As the first step, I didn't do any wiring to ECU, just wanted to check if Torque will recognize my adapter, and somewhy it didn't. Later I'll grab a debug output, but I didn't see in the terminal a lot. Maybe the Bluetooth module was the problem. So, just now I have a question: will Torque recognize thу module without a physical connection to the ECU? The chip L9637 I already bought but hadn't time to do the wiring. And, before wiring, I wanted to be sure that it works at all. What I think that I'll take a Mega board because of 2nd hardware serial - at least, for tests. Also, I thought to port it to ESP32 (I've seen already that I'm not the first :)) But I discovered that the BluetoothSerial in the ESP32 is enough spartan so it will take a lot of work meanwhile I didn't succeed with connecting to Torque..

PS if someone is still looking for 4-pin connector, I ordered it here and it fits perfect, but you'll need a crimping tool like this. PPS it seems that I really do something wrong, because I took a demo-sketch from Torque's website and it also didn't work.

UPD: I took a Mega board and connected the BT05 module to its Serial1, changed the reference and it works on the table. Next step - build L9637 adapter and maybe then try to port it to ESP32.

#157

Hi Muzzy,

Torque or any other "ELM327" compatible application will be able to communicate with my solution.

First of all: Bluetooth is not Bluetooth Low Energy (LE). This might be a problem connecting a mobile phone with the BT module. (Older iPhones does not have LE) When connecting the HC-05 / 06 or the ESP32 module successfully, with your phone via settings, it should be available in Torque. I´d recommend using an app like "Serial Bluetooth Terminal" to ensure it works as expected! (It supports BT and BT LE). Just send "ATZ" and see if the Arduino/ESP answers with "ELM327 v1.4". If it doesn´t check your Baudrate. Most bluetooth modules use 9600 right from the start and can be reconfigured to faster baud rates with AT-Commands.

To test torque without any connected Bike, use my stupid HC06 Sniffer-Sketch. It just responds static values and leaves the Serial Port open for debug purposes.

PS: I´m using several ESP´s but haven´t played around with Bluetooth, yet. But as I saw, you just have to include BluetoothSerial.h and use the same name "BT" instead of the SoftwareSerial.

#158

Hi TriB, BLE wasn't a problem in my case and won't be a problem. BT05 and BT06 just don't support it, and my phone (Galaxy S9) supports it. The first time, I'd used a UNO board with BT06 and software serial, and it failed. The second time, I'd used Mega board with BT05 and hardware serial1, and it worked fine. Torque connected, I'd seen random data from your emulator.

PS Wrap it to BluetoothSerial will bring some problems because BluetoothSerial class hasn't methods Print and PrintLn which are used in your project.

#159

BluetoothSerial haswrite(), which is the same as print(), but does not shift the variables to chars.

println() is equal toprint("\r\n") which is equal to write(13); write(10);

Something like that should work:

void setup() {
  Serial.begin(115200);  

  BtPrintln("Hello world");
  BtPrint("Test");
}

void loop() {  
}

void BtPrint(const String &text) {  
  for (uint8_t i = 0; i < text.length(); i++)    
    Serial.write((char)text[i]);
}

void BtPrintln(const String &text) {
  BtPrint(text);
  BtPrint("\r\n");
  //Or:
  //Serial.write(13);
  //Serial.write(10);    
}
#160

I was wrong again.. :) after a few compiler warnings, the code was compiled and even downloaded to ESP32. Torque connects to the chip but doesn't see any parameter (certainly, the module isn't connected). Then I start your ECU emulator and press connect. The application doesn't show any signs of connection and Torque loses the connection. I suppose that ESP32 has problems with simultaneous transmission over 2 ports..

#161

utis82: Good evening everyone.

First thank you all for all those amazing work done one this Global Project. I've tried to read everything to avoid asking stupid question =).

Here is the status of my personal project (getting gear indicator , temperature and angle/accel on my phone) :

My Program is working well, bluetooth connection OK and phone App OK. The remaining is the communication with the bike and there is the reason I'm posting this message. I had few messages on Youtube with Trib (thank you again ! ) , after one twited L9637D, I received a new one and still not working. So I tried to simplify the system at maximum :

One additional thing : The Programme is working very well with the ECU emulator from Trib. We don't see it very well on the picture , but there is 470 Ohms pull up resistance (to +12V) and 100nF capacitor (to GND).

I found the problem : my arduino mega has some issues with 10400 baudrate. I changed it step by step and at 10250 it works !

#162

Greetings All,

I've started reversing the KDS3 software and have got all the Can Bus ID's

What I'm after is someone that has had a KDS USB device installed or has the KDS Device driver installer.

I'm after the driver as above but also the Hardware PID's for a genuine KDS.

My aim is to create a KDS3 Adapter.

If you need anything else from the database please ask.

https://docs.google.com/spreadsheets/d/1cmZ9qkqZiu44qC22-iUCMmEoVLKfta5hkh7P_3nQ8FQ/edit?usp=sharing

Reguards,

Jimmy06

#163

Hi,

I got the same idea to create an own device, which can be used by the original KDS software, several years ago, as well. But like you, I was stopped by the fact, I did not knew anyone owning a KDS Dongle to clone/observe/sniff/whatever.

Another thing was, that it seemed not only to be the HW ID, which indicates an official KDS adapter. But a little hint, if you´d like to investigate this further: Kawasaki likes to hardcode anything into the C binary, which is not included in the KDS database 8)

With the right tool, it might be possible to identify the dongle initialization routine.

From my perspective there is no real need to go this way. The informations are all out there. Except the immobilizer key (KIPASS) update and some ABS tests.

PS: The communication protocol is not CAN! And I´d not recommend to publish copy&pasted information from password protected databases, from licensed software. That´s why I only shared my very own findings on my git and let anyone do the work themselves, to circumvent any copyright issues.

#164

Hello

do you know if on newer bikes ( EURO 4 and 5 ), this still work ?

i have a 2017 Z900 and there is two KDS under the seat , one with 4 pins ( called ABS KDS in the wiring diagram ) and one with 6 pins ( called KDS in the wiring diagram )

from my initial research, the 4 pins seem useless ( specific to the abs system ) and the 6 pins seem to still have a K-Line ( and CAN_H / CAN_L / ground / 12 V )

so the k-line on this 6 pins connector should work the same as the previous one ?

i'm asking that because i have a kds to obd2 connector with a OBDLINK SX ( stn1100 chip not a elm ) ( that support K-LINE, KWP2000 , iso 14230-4 fast init )

i can run the fast bus initialization with no issue ( got the BUS INIT : OK message ) but after when i'm sending the start communication packet ( 81 11 F1 81 04 ) , i'm getting no response , but if i'm sending a OBD 01 command, it work

#165

Hi noext,

currently I can only guess, because I did not have had a hand on a EURO5 bike, yet. But from manufacturer´s perspective, I think they will have the new OBD and old KDS functionality in parallel. At least for a while, because all workshops will have the established diagnostic devices, which won´t work from then on.

As far as I can try it myself (which will happen, when the weather gets better) I cannot give you a reliable answer :confused:

If Kawasaki went full OBD II compatible, you won´t need the unique initialization with 0x81 and 0x10 0x80. The "ATZ" will do everything for you. As well as setting the Format, Sender and Receiver. Even the Checksum will be generated from the ELM327. That´s why you only need to send SID & PID to the OBDLINK. ELM327 or stn1100 should not make a major difference, due to the standardized protocol.

What happens if you send 01 00 -> Should give you all allowed PID´s. Or 01 0C -> RPM.

I´m very interested in those results :)

#166

Hello TriB

yes OBD command work with no issue but it me give very little results.

Here is a picture of all PIDs available ( scanned with torque ) : https://imgur.com/NJRLX38

as you can see it missing many informations from the old KDS ( gear position , Abs Pressure ) , informations that come from the diagnostic session ( 10 80 ) And i'm more interest by those informations than the obd ones that why i'm trying to start the diag mode manually

i'm thinking that kawasaki has left the KDS functionality in parallel because i have found this software : "HealTech OBD Tool for kawasaki" , it come bundle with a obd diag tool from HealTech ( that look like just a fancy kds -> odb adapter ) , this software seems to have access to gear indicator etc and it supposed to be compatible with my z900 2017

sadly i cant try it because it has no macOS version

my goal is the remake a full tft dashboard with only the obd plug , so i need at least 95% ( no need for turn signal and blue light indicator ) of the original cluster information's ( the lcd cluster of the z900 is crappy AF )

#167

Cool, that seems to confirm my expectations to have KDS & OBD in parallel!

This is also how cars diagnostic plugs work. They have K-Line and/or CAN-Bus (And more pins for official and manufacturer dependent features).

OBD2 has just a very small intersection with KDS. For my Z750r from 2012:

  • Freezed DTC
  • Engine coolant
  • Intake manifold absolute pressure
  • Enginge speed
  • Vehicle speed
  • Intake air temperature
  • Mass air flow sensor
  • Throttle position
  • Absolute barometric pressure
  • Control module Voltage
  • Secondary/Relative throttle position

It´s not very much, which was enhanced on your screenshot.

To get the K-Line, some OBD2 adapter can be configurated to use a specific protocol. But then you´d have to change a lot of parameter. Format, Sender, Receiver, Keepalive, and so on. Then make you own initialization and diagnostic sequence. So you need at least a script, which configures the adapter every time. It´s easier to follow my attempt and use an L9637D with an Arduino or ESP rather than an adapter inbetween.

But: To replace the dashbard, why don´t you take that plug, which gives you all the data in a much faster interval? KDS is limited to around 7 Messages per second. That sounds a lot, but using speed and rpm constantly and some other values (temperature, gear, ...) from time to time, you will be way to slow. And KDS does not have the odometer or fuel. That won´t work!

#168

TriB: But: To replace the dashbard, why don´t you take that plug, which gives you all the data in a much faster interval? KDS is limited to around 7 Messages per second. That sounds a lot, but using speed and rpm constantly and some other values (temperature, gear, ...) from time to time, you will be way to slow. And KDS does not have the odometer or fuel. That won´t work!

i'm just a software dev , i can go my way around code and stuff but i dont know anything about electronic. I thought of your solution of plugging directly into the cluster plug but it's out of my skills and I can't find any information about it. At least with the KDS and OBD2 I can find information on the internet about the protocols.

I thought that the kds returned the fuel gauge information because I saw on another forum that it might be available on the zx6r.

edit : and what about the can HIGH and LOW in the plug ? how do they work ? same as the k-line ? or its for other thing ?

edit 2 : i have tried to run the ATMA command that supposed to monitor all CAN output and there is nothing

#169

Same like me :D I just found myself lost in all those electronics. A friend of mine helped me with the hardware a couple of years ago and now I think I got a resonably understanding.

KDS and how I use it, is great for submitting data to my camera. Or to read and delete Diagnostic Trouble Codes. Even testing some actuators is possible. More or less I did exaclty the same, what Kawasaki did with its OBD2 compatibility. They are still using KDS in the background (with mostly untouched hardware) and only put a "translator" on the top of it. I did it with Bluetooth, Kawasaki with CAN. From my understanding (and you somehow prooved it), KDS is still the main protocol/communication/ECU "language". It is put through by K-Line. To be OBD2 compatible, the added a CAN interface, which just responds diagnostic requests, translates it to KDS internally and gave you the result. There is no real CAN-Bus on the bike, so ATMA gives you nothing.

To come back to your project: It might sound more complicated to use the cluster pins, but those are plain signals. The only challange would be to handle 12V to Arduino (or whatever) friendly voltage. RPM and Speed are constand signals. KDS can only give you data on a request. And might be not that consistant, if there is only one byte wrong, you will have a ~5 second outage to reestablishe the diagnostic mode.

On KDS3 I cannot see something related to fuel for any model. But my data about that is ~5 years old. It might be, that they added it in the past years.

#170

Just to be sure, I'm going to buy a can bus reader for my Raspberry in case it's my obdlink that's blocking me with his processing ( i have send a message to Scantool to know if its possible to use the OBDLINK SX at a pure raw can bus reader but they still doesn't reply to me )

I learned during my research that the zx10R 2016+ ( its the first kawasaki bike with EURO4 i think ) has a 2 connectors under the seat ( like the z900 ) and one is a real CAN-Bus with a lot of informations ( see here : https://i.imgur.com/0Romwwh.png ). The zx10r is a wsbk bike so maybe that why kawasaki use a real can-bus on this model ( no wsbk team use the stock dashboard of the zx10r which is worse than the 900 ), but it give me hope that they use this can-bus on all of there euro4-5 bikes

#171

Great idea! A CAN-Bus shield can never be wrong to have :D I´m very exited to understand more about the future of KDS and CAN on Kawasaki bikes! As I told, it was only an educated guess, that they only "fake" the CAN to be OBD2 compatible. And I think for bikes, which were just upgraded, they really did. The Zx10r has a lot of components, which must communicate with each other. But some data might rely on the Kit-ECU.

What I think is, that all sensors (which are quite simple and submit just a linear signal) will still be analog. This is cheap, can easy be repaird, all shops know about those, no firmware needed and so on.

With upcoming IMU systems (KECS on Kawasaki) and upgraded dashboards, which are showing lean angle or even transfer data via bluetooth (yes the stole my idea :P ), they definitly need a bus in between. So at least the ECU, ABS, IMU and dash will communicate over CAN bus.

No IMU, no flowing data on the CAN bus, like you saw with ATMA. But requesting specific data works!

This would be the best solution for Kawasaki. Keeping the most components state of the art. The ECU will still work with KDS and has optional CAN for OBD2. And you can enhance it with an IMU or newer dashboards. Show owners worldwide can still use their diagnostic devices and don´t need trainings or something.

#172

I received my RPI can hat today. for the moment no luck, I don't have any data that goes up when I make a candump at 500kbps ( I just plugged the cables on CAN H and CAN L , init the bus at 500kpbs and run can-utils )

I searched on the internet and I'm pretty sure that this plug is the right one because someone got data from a kawasaki GTR1400 2011 which also has a 6 pin plug and like the ZX10R have a way more complex cluster ( with tyre pressure sensor and traction control mode ) than the z900

On the electrical diagram of the z900 CAN H/L are directly linked to the ecu.

Maybe like you said data can only be requested but i have no idea how to do that

( here is a picture of the 6 pins kds connector on my bike )

edit ( after finding battery for my voltmeter ) : there is activity on the K-line ( port 7 on the odb plug ) when i requested some OBD PID

both CAN H/L are at 2.5V ( with the ignition on ) that indicated there is no communication on the CAN BUS but they seems to be part of a CAN network because there is 60 ohms resistance between them

edit²: in the ecu wiring diagram of the z900 , there is indeed 2 CAN plug (9. CAN Communication Line (High): GY/BL 10. CAN Communication Line (Low): LB)

after searching on internet it seem that is possible that some can network only emit data when "wake up"

edit3 : pretty sure the canbus on the z900 is useless, everthing can be done with the k-line when you enter diag mode ( 0x81 0x11 0xF1 0x81 0x04 ) , but i cant send this message with my obdlink sx , i may have to switch to a arduino and learn electronic , because there is no simple way of doing k-line with a raspberry pi

#173

Thanks a lot for proving my understanding of Kawasakis implementation.

You can "reprogram" the obdlink with ATSP X This will change the protocol from "auto" to your desire:

| 0 | Automatic protocol detection | | - | - | | 1 | SAE J1850 PWM (41.6 kbaud) | | 2 | SAE J1850 VPW (10.4 kbaud) | | 3 | ISO 9141-2 (5 baud init, 10.4 kbaud) | | 4 | ISO 14230-4 KWP (5 baud init, 10.4 kbaud) | | 5 | ISO 14230-4 KWP (fast init, 10.4 kbaud) | | 6 | ISO 15765-4 CAN (11 bit ID, 500 kbaud) | | 7 | ISO 15765-4 CAN (29 bit ID, 500 kbaud) | | 8 | ISO 15765-4 CAN (11 bit ID, 250 kbaud) - used mainly on utility vehicles and Volvo | | 9 | ISO 15765-4 CAN (29 bit ID, 250 kbaud) - used mainly on utility vehicles and Volvo |

So it should be possible to force it to use KWP with ATSP5.

Why not purchasing an L9637D to switch K-Line signal to serial and your desired voltage? This works great for Arduino and should also do the deal with the RasPi. There are plenty SDS & KDS projects out there, which use a Raspberry.

But it´s not that complicated to make an Arduino work with it and understand how the Sketch works. Capacitor, Resistor & L9637D. That´s it :)

#174

TriB: Thanks a lot for proving my understanding of Kawasakis implementation.

You can "reprogram" the obdlink with ATSP X This will change the protocol from "auto" to your desire:

| 0 | Automatic protocol detection | | - | - | | 1 | SAE J1850 PWM (41.6 kbaud) | | 2 | SAE J1850 VPW (10.4 kbaud) | | 3 | ISO 9141-2 (5 baud init, 10.4 kbaud) | | 4 | ISO 14230-4 KWP (5 baud init, 10.4 kbaud) | | 5 | ISO 14230-4 KWP (fast init, 10.4 kbaud) | | 6 | ISO 15765-4 CAN (11 bit ID, 500 kbaud) | | 7 | ISO 15765-4 CAN (29 bit ID, 500 kbaud) | | 8 | ISO 15765-4 CAN (11 bit ID, 250 kbaud) - used mainly on utility vehicles and Volvo | | 9 | ISO 15765-4 CAN (29 bit ID, 250 kbaud) - used mainly on utility vehicles and Volvo |

So it should be possible to force it to use KWP with ATSP5.

Why not purchasing an L9637D to switch K-Line signal to serial and your desired voltage? This works great for Arduino and should also do the deal with the RasPi. There are plenty SDS & KDS projects out there, which use a Raspberry.

But it´s not that complicated to make an Arduino work with it and understand how the Sketch works. Capacitor, Resistor & L9637D. That´s it :)

TriB: Thanks a lot for proving my understanding of Kawasakis implementation.

You can "reprogram" the obdlink with ATSP X This will change the protocol from "auto" to your desire:

| 0 | Automatic protocol detection | | - | - | | 1 | SAE J1850 PWM (41.6 kbaud) | | 2 | SAE J1850 VPW (10.4 kbaud) | | 3 | ISO 9141-2 (5 baud init, 10.4 kbaud) | | 4 | ISO 14230-4 KWP (5 baud init, 10.4 kbaud) | | 5 | ISO 14230-4 KWP (fast init, 10.4 kbaud) | | 6 | ISO 15765-4 CAN (11 bit ID, 500 kbaud) | | 7 | ISO 15765-4 CAN (29 bit ID, 500 kbaud) | | 8 | ISO 15765-4 CAN (11 bit ID, 250 kbaud) - used mainly on utility vehicles and Volvo | | 9 | ISO 15765-4 CAN (29 bit ID, 250 kbaud) - used mainly on utility vehicles and Volvo |

So it should be possible to force it to use KWP with ATSP5.

Why not purchasing an L9637D to switch K-Line signal to serial and your desired voltage? This works great for Arduino and should also do the deal with the RasPi. There are plenty SDS & KDS projects out there, which use a Raspberry.

But it´s not that complicated to make an Arduino work with it and understand how the Sketch works. Capacitor, Resistor & L9637D. That´s it :)

yes you can use use ATSP5 and connect to the kds but every command is refused by the kds because with the obdlink you cannot send "0x81 0x11 0xF1 0x81 0x04 " for it its a invlid message ( no length byte )

yes my next step is try something with a L9637D but i must learn some electronics basic first

#175

noext: yes you can use use ATSP5 and connect to the kds but every command is refused by the kds because with the obdlink you cannot send "0x81 0x11 0xF1 0x81 0x04 " for it its a invlid message ( no length byte )

Sure:

ATSP5
ATWM8011F1013E
ATSH8111F1
ATFI
ATSH8011F1
  • Set Protocol to KWP
  • Set Keepalive (Wakeup) Message to 01 3E.
  • Change Header to 0x81 + Sender + Receiver
  • Fast Init
  • Change Header back to 0x80

That might work for you :)