Just to update my progress:
I have built a CAN bus datalogger to work with the Connie's CAN system. I chose to use a Arduino Nano microprocessor board, modified to be compatible with my Atmel Dragon ISP programmer/debugger. I also bought a MCP2515 circuit board off Ebay to interface the Nano to the CAN bus. The combined cost for these two parts was about $10. In addition, I ordered a high-speed non-volatile memory from Digikey ($4) to provide storage. Using these three parts, I have been able to log and study the CAN messages going back and forth between the processors.
I wired up this system to the wiring harness of the bike and stored it in the tool storage compartment where it would be out of the way. Last week, I was able to get the bike over to a dealer who successfully programmed the rear sensor ID into the bike's computers. Fortunately, all the commands to do this were logged and saved by the datalogger.
After studying the logged data, it is very apparent that the KDS system first "logs in" with the bike when connected. There is a two part command-response sequence that establishes the initial connection to the bike. Once this is completed, the KDS system then retrieves the part numbers for the three major ECU units on the bike: FI ECU, Steering Lock ECU, and KIPASS ECU. The part numbers are returned by the bike as ASCII encoded strings, and they are readily identified in the data.
That seems to be all that happens until the user issues a command in KDS. In my case, the tech navigated to the menu for TPMS, and the ID numbers for the tire pressure sensors were then retrieved. The command to retrieve the sensor IDs is very straightforward, and I have been able to duplicate this command using my CAN bus interface. The command syntax is as follows:
(front) Arbitration ID = 0x754, DLC = 3, Data0 = 0x02, Data1 = 0x21, Data2 = 0x14.
(rear) Arbitration ID = 0x754, DLC = 3, Data0 = 0x02, Data1 = 0x21, Data2 = 0x15.
The bike will respond with:
Arbitration ID = 0x745, DLC = 8, Data4 - Data7 = 32 bit sensor ID number.
As I said, I have been able to retrieve the sensor IDs from the sensors on my bike using these two commands. I have also been able to retrieve my ECU IDs using similar commands.
Next up is to actually reprogram the rear sensor. The command for that is:
Arbitration ID = 0x754, DLC = 8, Data0 = 0x07, Data1 = 0x31, Data2 = 0x86, Data3 = 0x02, Data4 - Data7 = ID number.
Once I can confirm that I can program the rear sensor reliably, the next step would be to try it on other years to make sure the commands are the same. I feel sure it would be the same on 2011-2014 (the ECU part numbers are the same), but not sure for 2008-2009 models.
I would also like to add the capability to program additional fobs as well. Hopefully, I will be able to find someone with a KDS system that would allow me to record more of the programming sequences. Then we could make a very useful DIY tool, I think.
Sometime soon I plan to post quite a bit more of the technical details of the Kawasaki CAN system, since there is so little publicly available information out on the web.
Incidentally, the sensor ID and sensor readings for all 'unknown' sensors is broadcast on the bus as well using message ID 0x695. Knowing this, one can read the sensor ID from an unknown sensor directly from the bus. This is how I came to figure out the sensor ID for my rear tire sensor (the installer had lost the sticker with the ID number). I gave the dealer the number I had read from the bus, and he programmed it in for me. Now my rear sensor is working like a charm!
RedRambler