Bafang BBSHD BBS02 mid drive -- Flexible OpenSource firmware

Thanks! I'm now fairly confident that we can succeed with this.

I have hooked up my controller to a spare motor and started analyzing signals.

The protocol seems to be very simple, all messages have a header (0xAA) and a trailing checksum.
There are 11 parameters set during initialization, e.g at power on, each parameter has it's own defined message.

There are three values that are continously read, STC MCU issues requests, NEC MCU responds.

What needs to be done is to figure out what every message corresponds to. Status messages should be fairly simple.

I would belive that most of the initialization parameters are things that can be set by the configuration protocol, I will start changing parameters one by one and see what changes.

Protocol definition:
https://github.com/danielnilsson9/bbshd-fw/blob/master/PROTOCOL.md
 
Alright I think everything (that we can easily figure out) about the protocol is now clear.
Of all the parameters that can be configured in bafang config tool, only low voltage cutoff and current limit is sent to NEC MCU.
The rest of the initialization parameters sent are probably hardcoded in the firmware file.

STC MCU sends "max target current" value to NEC controller when using throttle or activating pedal assists by pedaling.
 
danielnilsson9 said:
Alright I think everything (that we can easily figure out) about the protocol is now clear.
Of all the parameters that can be configured in bafang config tool, only low voltage cutoff and current limit is sent to NEC MCU.
The rest of the initialization parameters sent are probably hardcoded in the firmware file.

STC MCU sends "max target current" value to NEC controller when using throttle or activating pedal assists by pedaling.
That is great, I did read the document.

What would you like to have for yourself, on your EBike, that will be unique provided by your firmware??

What will be your next step?
 
casainho said:
That is great, I did read the document.

What would you like to have for yourself, on your EBike, that will be unique provided by your firmware??

What will be your next step?

I will probably not take this very far, I have too many spare time projects... :confused:

But the goal is to create a basic working firmware to run without speed sensor and display. Similar to my customization of your great TSDZ2 firmware I have made for running without display and speed sensor.

I like to keep the minimal amount of electrical components on my bikes, less stuff that can break... which everything does all the time for some reason... :evil:

I (or someone else) may create a 1:1 replacement firmware for bafangs software compatible with original display if there is any such interest. Then we can fix the throttle/pas bug for all hardware revisions and also fix the 52V 28A issue I believe, possibly also increasing max current a bit further without doing the shunt mod (a bit shady, shunt resistors could get too hot...)

Maybe you or someone else wants to make a version compatible with the Flexible OpenSource firmware eco system you have created? That would be great, it should probably not be too much work once the initial work is done. If someone finds a way to attach a torque sensor that should definitely be possible to integrate into the software.

Currently my problem is that the board I'm working on is hardware version 1.3 and I cannot find any original firmware files out in the open for this version. This means that when I flash my first version of my firmware I cannot go back to the original one if I missed something and need to take more measurements...

I will probably have to get a new controller, or be very lucky, we will see!
 
danielnilsson9 said:
casainho said:
That is great, I did read the document.

What would you like to have for yourself, on your EBike, that will be unique provided by your firmware??

What will be your next step?

I will probably not take this very far, I have too many spare time projects... :confused:

But the goal is to create a basic working firmware to run without speed sensor and display. Similar to my customization of your great TSDZ2 firmware I have made for running without display and speed sensor.

I like to keep the minimal amount of electrical components on my bikes, less stuff that can break... which everything does all the time for some reason... :evil:

I (or someone else) may create a 1:1 replacement firmware for bafangs software compatible with original display if there is any such interest. Then we can fix the throttle/pas bug for all hardware revisions and also fix the 52V 28A issue I believe, possibly also increasing max current a bit further without doing the shunt mod (a bit shady, shunt resistors could get too hot...)

Maybe you or someone else wants to make a version compatible with the Flexible OpenSource firmware eco system you have created? That would be great, it should probably not be too much work once the initial work is done. If someone finds a way to attach a torque sensor that should definitely be possible to integrate into the software.

Currently my problem is that the board I'm working on is hardware version 1.3 and I cannot find any original firmware files out in the open for this version. This means that when I flash my first version of my firmware I cannot go back to the original one if I missed something and need to take more measurements...

I will probably have to get a new controller, or be very lucky, we will see!
Do you know if will be possible to flash the motor firmware just like TSDZ2, without open the motor??

And maybe you should ask for donations, as some users did offer to me motor controllers, even if damaged they may be very useful.

Yes, maybe a wireless torque sensor on the crancks can be used, maybe a DIY using the same wireless board we are using.

About the no speed sensor and display, I also want to make my ebike very minimalist. With our wireless board, with 1 button and 1 RGD LED, user will be able to turn on/off the system and change the assist level - this will make a very clean EBike. And will be very modular because of wireless, at any moment the user can attach to the handle bar his mobile phone to have a big display and full control the motor. Even he can instead or simultaneous, use a cycling GPS to have navigation and record the EBike real time data like cadence and pedal human power as also all other fitness metrics like heart rate, jumps, ride flow, etc. The speed value will be from GPS, but this is optional, some may prefer to install the EBike speed sensor.

And optional is also the wireless remote with the brake sensor signal. Ideally this remote is very small and no wires, for a cleaner EBike. If the remote fails, like battery that will last at least 1 year, the user will also be able to do the same on the wireless board button and RGB LED. And this remote can be bought from a few brands.

Our mobile app would only need to be adapted on the configurations (reduced for sure the number of configuration variables) as also the number of available variables to show to user.
And for the ones that may prefer the Bafang best looking big 860C display, the user would just need to exchange on the display connector the wireless board for the 860C display, as the motor firmware is just the same. But the 860C firmware would need again to be changed on the configurations and number of available variables to show to user.
 
timk said:
It would be interesting to see what happens if you send a command to raise the current limit above 30A...

Will be on my todo list once I get something running.

casainho said:
danielnilsson9 said:
casainho said:
That is great, I did read the document.

What would you like to have for yourself, on your EBike, that will be unique provided by your firmware??

What will be your next step?

I will probably not take this very far, I have too many spare time projects... :confused:

But the goal is to create a basic working firmware to run without speed sensor and display. Similar to my customization of your great TSDZ2 firmware I have made for running without display and speed sensor.

I like to keep the minimal amount of electrical components on my bikes, less stuff that can break... which everything does all the time for some reason... :evil:

I (or someone else) may create a 1:1 replacement firmware for bafangs software compatible with original display if there is any such interest. Then we can fix the throttle/pas bug for all hardware revisions and also fix the 52V 28A issue I believe, possibly also increasing max current a bit further without doing the shunt mod (a bit shady, shunt resistors could get too hot...)

Maybe you or someone else wants to make a version compatible with the Flexible OpenSource firmware eco system you have created? That would be great, it should probably not be too much work once the initial work is done. If someone finds a way to attach a torque sensor that should definitely be possible to integrate into the software.

Currently my problem is that the board I'm working on is hardware version 1.3 and I cannot find any original firmware files out in the open for this version. This means that when I flash my first version of my firmware I cannot go back to the original one if I missed something and need to take more measurements...

I will probably have to get a new controller, or be very lucky, we will see!
Do you know if will be possible to flash the motor firmware just like TSDZ2, without open the motor??

And maybe you should ask for donations, as some users did offer to me motor controllers, even if damaged they may be very useful.

Yes, maybe a wireless torque sensor on the crancks can be used, maybe a DIY using the same wireless board we are using.

About the no speed sensor and display, I also want to make my ebike very minimalist. With our wireless board, with 1 button and 1 RGD LED, user will be able to turn on/off the system and change the assist level - this will make a very clean EBike. And will be very modular because of wireless, at any moment the user can attach to the handle bar his mobile phone to have a big display and full control the motor. Even he can instead or simultaneous, use a cycling GPS to have navigation and record the EBike real time data like cadence and pedal human power as also all other fitness metrics like heart rate, jumps, ride flow, etc. The speed value will be from GPS, but this is optional, some may prefer to install the EBike speed sensor.

And optional is also the wireless remote with the brake sensor signal. Ideally this remote is very small and no wires, for a cleaner EBike. If the remote fails, like battery that will last at least 1 year, the user will also be able to do the same on the wireless board button and RGB LED. And this remote can be bought from a few brands.

Our mobile app would only need to be adapted on the configurations (reduced for sure the number of configuration variables) as also the number of available variables to show to user.
And for the ones that may prefer the Bafang best looking big 860C display, the user would just need to exchange on the display connector the wireless board for the 860C display, as the motor firmware is just the same. But the 860C firmware would need again to be changed on the configurations and number of available variables to show to user.

Yes, that is actually quite a nice solution, could definitely see that useful.

Yes it is possible to flash the controller firmware without opening the motor through the display connector using a standard TTL level serial port.

On another note I find the 79F9211 MCU quite interesting too, I believe it would be possible to have an open source firmware for this MCU too if Bafang has not enabled write/erase protection on it, then we would have full control of the entire board.

As others have noted there is no cheap programmer available, but there is a very detail document on the programming protocol, it must be possible to build one. I think I have also managed to get hold of the proprietary c compiler for it.

However flashing it would require opening the motor, removing the control and depotting the backside of the PCB to access the programming pins... but I might give it a go later on, mostly for fun.
 
danielnilsson9 said:
Yes it is possible to flash the controller firmware without opening the motor through the display connector using a standard TTL level serial port.
Do you think the firmware could be updated by the wireless board?

danielnilsson9 said:
On another note I find the 79F9211 MCU quite interesting too, I believe it would be possible to have an open source firmware for this MCU too if Bafang has not enabled write/erase protection on it, then we would have full control of the entire board.

As others have noted there is no cheap programmer available, but there is a very detail document on the programming protocol, it must be possible to build one. I think I have also managed to get hold of the proprietary c compiler for it.

However flashing it would require opening the motor, removing the control and depotting the backside of the PCB to access the programming pins... but I might give it a go later on, mostly for fun.
The compiler, flasher and depotting seems a big barriers. For the code you have on repo, they may implement FOC in a good way!! The hardware used is similar to TSDZ2 hardware, so, if STM8 had enough processing power, we could implement the FOC on that code. I would say there is no advantage to develop the motor code as it seems very good, right??
 
casainho said:
Do you think the firmware could be updated by the wireless board?

I'm not sure, the tool we have to flash the STC MCU is from STC Micro, a windows binary, no idea if the protocol is publicly documented. If it is (or if it is easy to reverse engineer) then it should be possible since it's just standard UART communication I believe.

casainho said:
The compiler, flasher and depotting seems a big barriers. For the code you have on repo, they may implement FOC in a good way!! The hardware used is similar to TSDZ2 hardware, so, if STM8 had enough processing power, we could implement the FOC on that code. I would say there is no advantage to develop the motor code as it seems very good, right??

Yes, absolutely, you are correct, I see no real value of doing all that at the moment. The motor control seems smooth and runs good, sending a request to set target current is good enough for all we want to do really. More of a fun thing to do for the challenge, but will put that on hold until I have a custom firmware for the STC mcu working.
 
danielnilsson9 said:
I'm not sure, the tool we have to flash the STC MCU is from STC Micro, a windows binary, no idea if the protocol is publicly documented. If it is (or if it is easy to reverse engineer) then it should be possible since it's just standard UART communication I believe.

This open source tool appears to work, I have been using it to interrogate the STC in my BBS02 but have not tried flashing anything yet:

https://github.com/grigorig/stcgal

Other people online seem to have been using it successfully.

Cheers
 
Small update on the progress. I have achived control of the motor with my custom firmware working on both old and new controller revisions.

I also tried increasing the max current but it is limited in the NEC MCU to rougly 32A so that is the maximum we can do without replacing that firmware. Low voltage cutoff is not limited and I'm running my motor of a lab power supply at 30V at the moment.

Motor can be controlled by sending two parameters to the NEC MCU:
- Target RPM %
- Target Current % (of configured max current)
 
Yes, everything is there, check the "src" directory.

https://github.com/danielnilsson9/bbshd-fw

I am currently aiming for creating a full replacement firmware compatible with the original bafang displays along with a custom configuration tool. The use of speed sensor and display will be optional. The work on the firmware has progressed pretty far, a few thing left to do; temperature monitoring, fault detection, speed limiting and storing config on eeprom basically. And the config tool of course.

Killed my V1.3/V1.4 controller while live probing so only have a brand new V1.5 to work on currently. Compatibility with older controllers will therefore be unknown until it can be tested. Had no problem switching from the old to the new though.
 
It is good to have another option for a motor which use open source code that TSDZ2 is not the only one. Thank you very much. :bigthumb:
 
danielnilsson9 said:
As others have noted there is no cheap programmer available, but there is a very detail document on the programming protocol, it must be possible to build one. I think I have also managed to get hold of the proprietary c compiler for it.

It is the same processor that is used in the very cheap "Brainpower" controllers.
https://endless-sphere.com/forums/viewtopic.php?f=2&t=27927&p=1322380&hilit=stancecoke#p1322380

I started to make a programmer, it is able to connect and to read/write blocks, but I never proceeded the work...
https://github.com/stancecoke/Parameter-Setting-Tool-for-EBike-Controller

regards
stancecoke
 
Just want to comment that an open source firmware for this unit + an aftermarket torque sensor = best thing since sliced bread
 
Just FYI:

These are the original Bafang external controllers for gear motors. The hardware, cables and displays are the same as those of the Bafang BBS. Of course, these controllers are configurable and programmed by the Bafang BBS Config Tool (I checked :)

https://www.aliexpress.com/item/32787061101.html


Some internal photos (48V 20A)
 

Attachments

  • 1gxi1t4.jpeg
    1gxi1t4.jpeg
    244.8 KB · Views: 2,175
  • 183v209.jpeg
    183v209.jpeg
    373.7 KB · Views: 2,175
  • 1em8gg4.jpeg
    1em8gg4.jpeg
    312.9 KB · Views: 2,175
kkm said:
Just FYI:

These are the original Bafang external controllers for gear motors. The hardware, cables and displays are the same as those of the Bafang BBS. Of course, these controllers are configurable and programmed by the Bafang BBS Config Tool (I checked :)

https://www.aliexpress.com/item/32787061101.html

Some internal photos (48V 20A)
Great information as that external controllers are much more cheap and easy to use for development!! Although the hardware of that controller are similar, the price of them are much lower probably because there is much more concurrency on the market for that external controllers!!
 
Nice development! Is there any possibility that this would also support BBS02? I read that you got the firmware dump from a chinese website for BBSHD, so BBS02 may be reaching too far
 
That interesting, that controller looks very similar except yet another model of the STC MCU.
Should probably be possible to adapt the firmware for that external controller too with very minor changes.

I have been busy lately but will pick up this project again, goal is to get this into a nice working state once spring hits. My bike with BBSHD which is I intend to use for testing is currently in winter storage.

brone said:
Nice development! Is there any possibility that this would also support BBS02? I read that you got the firmware dump from a chinese website for BBSHD, so BBS02 may be reaching too far

To be clear, this firmware is not based on any code dump, the only code that was found was for the NEC microcontroller but I was confirmed it was not what is running on that NEC MCU on the BBSHD controller.

I suspect it would be quite easy to support the BBS02 controller too but I do not have a BBS02 or controller.
So either someone with access to the hardware can do the modifications needed or I will need access to BBS02 controllers.
If anyone got any partially broken ones, please contact me.
 
.el files
 

Attachments

  • Profile Comparisons.xlsx
    16.2 KB · Views: 133
Are pcb dimensions of bbs02 and bbshd controllers same for both?

I'm looking at designing vesc based controller pcb for both models, shouldn't be too complicated as both motors don't have that much phase amps.

If someone has exact pcb dimensions that would be nice to have info.
 
Erealind said:
If someone has exact pcb dimensions that would be nice to have info.

@danielnilsson9 has very detailed photos of the controller at his github repo.
https://github.com/danielnilsson9/bbshd-fw/tree/master/photos
I guess, you can get the dimensions and the shape of the PCB quite exactly from the photos.

By the way, does anyone know the recent project status? I see that daniel is working on his repo, he has built a GUI already, but I have no information if or how it works already...

regards
stancecoke

index.php
 
stancecoke said:
Erealind said:
If someone has exact pcb dimensions that would be nice to have info.

@danielnilsson9 has very detailed photos of the controller at his github repo.
https://github.com/danielnilsson9/bbshd-fw/tree/master/photos
I guess, you can get the dimensions and the shape of the PCB quite exactly from the photos.

By the way, does anyone know the recent project status? I see that daniel is working on his repo, he has built a GUI already, but I have no information if or how it works already...

regards
stancecoke

index.php
I should receive a BBSHD in next weeks. I hope to at least flash this firmware and I wish to connect a motor (I only have TSDZ2 motors with me) and test it.

Now that we have our EBike fully wireless remote using Bluetooth and with CR2032 battery that works for 2 years, we could use the same technology and try make the wireless torque sensor by adding the strain gauge to the cranks:

ebike_wireless_remote-08.jpg


[youtube]nmabhQ0ZhnU[/youtube]
 
Back
Top