Reverse engineering LIN bus on E-bike system

Question

As a project I am trying to 'hack' an old E-bike. The electronic system of the bike consists of:

• A torque sensor measuring deformation of the rear.
• A 'spin' sensor measuring if the person is pedeling.
• A battery pack with BMS
• A speed controller inside the hub motor.
• A display to control speed, lights and display distance information etc.

From researching I concluded that the sensors, dislay and speed controller are communicating over LIN because they have a ATA6661 LIN transceiver and they are all connected parallel over the VS, LIN and GND wire. When I power up the speed controller on its own I can see some LIN communication on my oscilloscope: LIN communication

I do not have a LIN transceiver to log the data but I attached a USB-TTL transceiver to the uart-side of the LINtransceiver. From my oscilloscope a deduced that the baud rate was 9600. I used termite to listen on my serial port and set it to hex view. This is what I got:

serial communication

I'm not sure if I should change the amount of bits or parity bits.

My goal is to understand the frames that are send and to deduce which frame holds which sensordata or results in a certain activity. When I compare this to an CANbus project I was doing it was fairly easy to for example deduce which command was controlling my car's left window because with can-utils (candump) I could see every packet. I could filter unchanged packets and it colorcoded which bit(s) in each packet recently changed.

Any advice/ideas on how to do this for LINbus?

• chrisl: I know nothing about LIN, but the datasheet of the transceiver should tell you, how it communicates over Serial. Then you should be able to extract the LIN packages from the serial stream.
• jsotola: please post the captured serial communication as text, not as a picture
• Majenko: Where is the Arduino in this?
• jsotola: this may help you ... at 1:32 ... m.youtube.com/watch?feature=youtu.be&t=92&v=tu8Ow6fJm1g
• chrisl: @SvenOnderbeke Mhh, from what I read just now, LIN is at least similar to UART with different voltage levels and a protocol imposed on the data stream. I would try to find individual packages in the data stream, that you captured. Looking at the captured data, the bytes 0xfdfe seem suspicious to me.

Answer 1

As a starter point I would hookup your rigol ds1054z via usb to sigrok https://sigrok.org/wiki/PulseView this will enable you to log dump and analyze your lin frames . It has a frame decoder for LIN protocol. This should give you a great view of what is transiting over the lin bus and which slave PID to call . From there you may use a macchina.cc to comunicate over lin or use https://github.com/macchina/LIN with a arduino due and a lin tranceiver. Cheerz

• Sven Onderbeke: Thanks Bernard! This seems like the exact kind of answer I was hoping for! I will go and try those out. Thanks for your help!

Answer 2

If you are using "go swissdrive" controller (I'm looking at the picture) the bikebus protocol (bulls green mover) was used and in later, linbus (e-technology, Alber etc.) Display is master, motor and bms as slave .. Good luck :)