Independent CAN-bus telemetry · 2024 LiveWire S2 Del Mar

The performance curves LiveWire never published.

Power, torque, field-weakening and all seven ride modes — read off the secondary CAN bus of a stock S2 Del Mar across dozens of real rides. No dyno, no dealer tools, and strictly read-only: we query the diagnostics, but never write a value or actuate anything.

69kW
Peak power · ~92 hp at the pack
~48mph
Base speed · field-weakening onset
~105mph
Top speed observed
7
Ride modes · config decoded

Power & torque, measured from the battery

Fig. 01 — full-throttle envelope

Power is the real thing: pack current × pack voltage, straight from the battery's own current-sense. Below ~48 mph the motor makes flat peak torque; above it, constant-power flux-weakening takes over — torque falls as roughly 1/speed while power holds a ~66–69 kW plateau all the way to redline.

Power (kW, at the pack) Torque (% of peak)

Reading it: the torque trace is flat to ~46 mph (the constant-torque region), then bends down — that bend is the field-weakening knee. Power keeps climbing through the bend and then flattens: that flat top is the machine holding constant power while shedding torque. Below ~20 mph torque tapers because launches in the data are traction/grip-limited, not motor-limited.

Does field-weakening change with ride mode?

Fig. 02 — torque vs speed, per mode

Short answer: the knee doesn't move, the ceiling does. Base speed is set by motor back-EMF meeting the pack voltage — pure hardware, so every mode rolls off at the same ~46 mph. What each mode changes is how high the plateau sits.

Same bend, different height. Sport holds full torque to the knee; Range caps ~25% lower but bends at the same speed; Custom A (unconfigured on this bike) is softer still. A reduced mode simply hits its lower power cap before the motor ever reaches its voltage limit — so it looks like earlier field-weakening, but the motor's real transition point never budges.

Seven modes, seven throttle maps

Fig. 03 — commanded torque vs grip

Same grip position, wildly different torque. This is the throttle curve — how quickly torque arrives as you twist — not a power cap. At 20% grip, Flat Track commands roughly double the torque of Custom A.

Steeper = more eager. Flat Track and Sport pile on torque early; Range and Rain meter it in gently for wet or efficient riding. Every curve still reaches full power at full grip — the map only decides how abruptly you get there.

The ride-mode config, read straight off the bus

Fig. 04 — inverter DID, live

Each mode is three numbers the inverter reports live, 0–100: Power, Regen, and Throttle response. These are the user-facing calibration — the sliders behind the modes. Custom A/B read zero because they're unconfigured on this bike.

ModePowerRegenThrottle
Fixed, not tunable

Continuous & peak discharge limits and the motor phase-amp ceiling are hardware constants — identical in all seven modes. The bike does not expose Surron-style per-mode current limits.

Headroom hiding in Custom

Throttle response tops out at 85 (Flat Track) in the factory presets. A maxed Custom mode could set it to 100 — sharper than anything Harley ships. Both custom slots on this bike sit empty.

The battery, in detail

Fig. 05 — pack, characterized

LiveWire quotes a headline capacity and almost nothing else. Interrogated through its own battery-management system, the pack characterizes cleanly — series count, chemistry, its full voltage window, cooling, and how hard it's actually pushed.

Configuration
96S — 96 cells in series
counted direct count of the per-cell voltage array
Chemistry
NMC / NCA lithium-ion
inferred 4.20 V/cell full charge rules out LFP
Cell voltage window
2.82 – 4.20 V per cell
measured min / max across the ride corpus
Pack voltage
~355 V nominal · 404 V full · ~300 V under hard load
measured BMS + broadcast pack voltage
Capacity
≈10.5 kWh · ≈30 Ah at 355 V
published kWh headlinederived Ah from nominal V
Cooling
Air-cooled
confirmed pack temps track ambient, not a coolant loop, under sustained load
Cell monitoring
96 voltages + 48 temperature channels, live
measured both arrays read over UDS
Peak discharge
~241 A · ~70 kW at the pack
measured dual current-sense, corpus peak
Regen & charge
up to +35 A regen · AC charge ~10 A tapering to 4.20 V (top-up only)
measured bulk-charge rate not yet logged
Manufactured
11 July 2023 (pack module)
read UDS F18B — ECU manufacturing date
State of health
~97% at ~3 years
measured BMS SoH field — held steady, likely coarse

96 battery cells, live

Every cell in the pack, individually — here resting within a 5 mV spread, a tightly balanced pack (vertical scale zoomed to that window to show the per-cell structure). Under load the cells sag and recover in real time; the deepest cell we caught touched 2.82 V at the bottom of a hard, low-charge pull.

Charging — the top-of-charge taper

~80 → 100%, stitched from 5-min sessions
Charge power (kW) Charger heatsink (°C, approx)

Scope first: this is only the top of the charge (~80→100%), already into the constant-voltage taper — not the full curve. Current eases from ~10 A toward zero as the cells hold the 4.20 V ceiling, and the charger's heatsink arcs to ~53 °C then cools as it backs off. Peak power sits lower down the SoC range — even in this window, power runs higher at lower pack voltage — and the bulk of the charge simply wasn't logged, so the true peak rate stays open. Stitched from 5-minute chunks (the bus idles out mid-charge), hence the ragged traces.

Beyond the curves — the rest of the bus

Coverage

The battery is one system of many. Passively, the same bus gives up the whole vehicle — the full motion-sensor suite, brakes, thermal, telematics, and the live fault log.

60broadcast frames
113signals decoded
9UDS modules mapped
~350diagnostic DIDs
806OEM fault codes
CRC-8E2E integrity cracked
Battery / BMS
96 individual cell voltages + per-cell temperatures, dual current-sense (±240 A), live pack voltage, state-of-charge & state-of-health.
Motor / inverter
RPM, live torque command, field-weakening — plus inverter, motor and coolant temperatures (102 °C peak observed).
Chassis / IMU
A full 6-axis inertial unit — lean angle and acceleration resolved at roughly 7,770 counts per g.
Brakes / ABS
Front and rear wheel speeds, brake-line pressure, and ABS / traction-control intervention events.
Telematics
GPS position, serving cellular network and signal strength, eSIM identity — decoded, values withheld here.
Diagnostics
Live fault-code readout decoded against 806 OEM DTC definitions — caught passively, mid-ride.
Ride modes
All seven modes and their live Power / Regen / Throttle-response calibration, charted above.
Keyless / security
Ignition-auth architecture mapped; the 128-bit SecurityAccess challenge–response characterized.

Location, cellular identifiers and vehicle serials are decoded but withheld here for privacy — this page shows only aggregate performance and system data.

How this was measured

Method

A small ESP32 logger tapped onto the S2's secondary CAN bus (500 kbit/s, classical CAN). Power = battery-management current-sense × pack voltage. Torque & RPM = the inverter's own diagnostic (UDS) telemetry. Ride mode = the broadcast mode frame. Everything is aggregated across dozens of real-world rides; the "envelope" curves take the peak observed at each speed. Two layers of traffic: the broadcast signals are captured passively (pure listening); the diagnostic data is read with read-only UDS requests — the logger sends those queries, but never writes a value, runs a routine, or actuates anything.

Torque is shown in the inverter's raw command units (the absolute Nm scale is not yet pinned); power in kW is grounded in the measured pack voltage × current. Curves are empirical envelopes from partial-throttle real riding, not a controlled dyno pull — the shapes are solid, the last few % of absolute magnitude are not.

Full signal inventory

the receipts

Everything decoded, laid bare — 113 broadcast signals across 51 named frames, plus 60 documented UDS diagnostic values across 9 modules (39 confirmed, 14 candidate, 7 refuted-and-recorded so the dead ends don't get re-chased). Scroll each.

Broadcast signals

UDS diagnostic DIDs