Harley Davidson Can Bus

Since last week i started reverse engineering my harley bike and thought it would be cool with a personal dashboard. I got plenty of pids reversed etc…

My question is where do i start to send the can messages to real dash, and where do i setup which packets realdash should look at?

My github project

Best regards

I got it to work and now i can see battery voltage and throttle :slight_smile:

I cant get the correct RPM the bytes 07 B3 in decimal is equal to 1971 which is correct, do i need to specify the value in decimal or what?

Regards

Hex value 0x07B3 is 1971 in decimal as a little endian value. So there should be no additional conversions needed.

When i removed the conversion it was revving 8000 all the time so i had to convert it to ((B0 * 256) +B1) /60

Also im looking to find out how they measure the vehicle run time since start. I had the bike running for 10-11 seconds and got the value 00 2B but thats 43 in decimal ant not close to 10-11 sec. Im thinking if it has something with ticks to do like every 4 seconds it adds one tick

I’d like to help more, but to do that, you would need to share the the actual CAN bus specs. Now this is only speculation from my side.

harley never released any documentation. And the world wide web is quite empty. I managed to reverse many can id’s already…

Decoded Packets

xx = Value of the things in the list.

ID Name Length Data
550 Lowbeam(LOOP) 6 xx 00 00 00 00 00
550 Highbeam 6 xx ** ** ** ** **
550 Clutch Pressed 6 xx ** ** ** ** **
550 Menu/Scroll 8 04 06 00 00 00 B4 00 FF
544 Throttle 8 xx ** ** ** ** ** ** **
542 Jiffystand up 8 xx ** ** ** ** ** ** **
542 Jiffystand down 8 xx ** ** ** ** ** ** **
541 Engine Temp 8 ** ** ** ** ** xx ** **
540 Engine runtime since start 8 ** ** ** ** ** ** xx xx
532 Pin Code 8 ** ** ** ** ** ** ** **
530 Battery voltage 8 ** ** ** ** ** xx ** **
530 Neutral Light 8 ** ** xx ** ** ** ** **
5C1 Clock FF= 12/14H clock 8 SS MM HH ** ** ** ** FF
5C0 Km/miles switch 8 xx ** ** ** ** ** ** **
5C0 Odometer 8 ** ** ** ** ** xx xx xx
521 Speed 7 ** XX ** ** **
520 ABS sensors 5 ** ** ** ** **
7E1 ABS ? ** ** ** ** ** ** ** **
7E9 ABS 2 ? ** ** ** ** ** ** ** **
7E2 BCM ? ** ** ** ** ** ** ** **
7EA BCM 2 ? ** ** ** ** ** ** ** **
7E0 ECU ? ** ** ** ** ** ** ** **
7E8 ECU 2 ? ** ** ** ** ** ** ** **

I did see that list on your github page, but it just does not make full sense to me. For example, you have frame 0x550 set as length of 6 bytes, but then after couple of lines the same 0x550 frame is 8 bytes.

Is the same frame sent sometimes with 6 bytes and sometimes with 8 bytes? I have never encountered such a thing before, and believe it cannot be correct.

Its because i been copying other frames and been to lazy to change it hehe :slight_smile:

Lets start with something simple, say High Beam. Tell me what are the 8 bytes of frame 0x550 with High Beam off and then on. Assuming nothing else changes than High Beam.

low beam 00 00 02 00 00 00
highbeam 08 00 02 00 00 00

its not 8 byte, its only 6 bytes.

best regards

Ok, lets try to analyse this. This should work:

    <frame id="0x550">
      <value targetId="157" units="bit" offset="0" length="1" conversion="V>>3"></value> <!-- High Beam -->
    </frame>

As it seems that info about high beam is on first byte of that frame, we use offset and length to find the correct byte we are working on.

With offset=“0” and length=“1”, our conversion is now applied to only the first byte of the frame.

By setting units=“bit”, we are telling RealDash that this value can only have two possible values, zero or one.

The value 0x08 is in binary 0000 1000, so the indication of high beam is on 4th bit of that byte. The conversion=“V>>3” takes the value (V) 0x80 and shifts all bits to the right by 3 bits. In effect, now we have the indication of High Beam bit as the lowest bit of the byte. That is then interpreted by RealDash as 0 or 1, setting the targetId=“157” to 0 or 1, ID157 being the High Beam in RealDash.

I think that things could get much easier with raw trace files? Something similar to https://github.com/rusefi/rusefi_documentation/tree/master/OEM-Docs/CanAm/maverick-x3-xrs-turbo-rr-max-2021-day-2

See Looking for trace files · Issue #1 · sofresh007/CANHarley · GitHub

RealDash CAN monitor outputs very similar log file as .trc files seen on above link.

Git Hub is outdated.

Have you made any progress?

I’m about to start a sniffing on a HD bike, this HDLAN works on 1000k, 500k or 250k baudrate?

yeah i’ve made big progress but havent had time to update the github.

I’m considering using a standalone engine management on a client HD and I would like to complete remove the OEM ECU.
The instrument cluster needs to receive a start message to receive the following messages (like tach, engine temp and so on)? Or just the specific sensor messages?

I’m also interested on having a standalone ecu in paralell with the oem one and having some sensors broadcasted via can (wheel speed).

I have a Fatboy 92 and I’m designing a central unit to control a speedometer/tachometer like the one shown in the attached link, which according to technical specifications apparently works with SAE J1850 protocol, I deduced this because the one I bought came with a 3-pin connector cable where the information from an old speedometer is downloaded.

I’m using a bluetooth LM327, a HC 05 and an arduino nano to send the frames that connect the speedometer to pins 2, 4 and 16 of OB2 of the LM327 and to be able to simulate speed, RPM, fuel level etc.

Could anyone give me information about the pinout configuration of this speedometer? The pinout is 12 pins.

Thanks and regards

https://serviceinfo.harley-davidson.com/sip/service/document/1874991606269238658?locale=en_GB#HD-48650