Bafang M500/M600 thread

[NoFanBoiz]

probably not relevant, but the DP C240 and DP C241 have a USB Charge outlet: 5V 500mA

 

[CiDi]

I checked what happens when the display is switched on:

Off: VCC=0V, P+=Battery+, Can=off

Press the power button for display on: VCC=0V, P+=2.2V, Can=on
Display on: VCC=Battery+, P+=2.2V, Can=on
Release the power button: VCC=Battery+, P+=4.5V, Can=on

Press the power button for display off: VCC=Battery+, P+=2.2V, Can=on
Display off: VCC=0V, P+=2.2V, Can=on
Release the power button: VCC=0V, P+=Battery+, Can=off

For power on, it is probably sufficient to connect P+ to GND, but in this way there would be no voltage to power the display, for this reason it leaves a residual voltage of 2.2V which becomes 4.5V once the phase has taken place.

If i connect the BESST interface, the voltage on P+ remains 0V and the controller turns on.

I am attaching the file of the can telegrams in the power-up phase:

 

[casainho]

I checked what happens when the display is switched on:

Off: VCC=0V, P+=Battery+, Can=off

Press the power button for display on: VCC=0V, P+=2.2V, Can=on
Display on: VCC=Battery+, P+=2.2V, Can=on
Release the power button: VCC=Battery+, P+=4.5V, Can=on

Press the power button for display off: VCC=Battery+, P+=2.2V, Can=on
Display off: VCC=0V, P+=2.2V, Can=on
Release the power button: VCC=0V, P+=Battery+, Can=off

For power on, it is probably sufficient to connect P+ to GND, but in this way there would be no voltage to power the display, for this reason it leaves a residual voltage of 2.2V which becomes 4.5V once the phase has taken place.

If i connect the BESST interface, the voltage on P+ remains 0V and the controller turns on.

I am attaching the file of the can telegrams in the power-up phase:

Great work!!

Still I am confused how all that works to turn on the motor controller as also to get power / voltage to the display...

 

[CiDi]

If it helps, these are photos of the Bafang DP241C display.

Note that 240 is written above the card, while the display is 241.
I assume that actually, 240 or 241 depends on the firmware and the lack of the BT module.

I will take new photos as soon as I can remove the black silicone.
Any suggestions on how to do it without damaging the card?

 

[casainho]

If it helps, these are photos of the Bafang DP241C display.

Thanks. I don´t know if you can add all this information to the repository while you add it to here also.

A developer told this:

I know 2 mechanisms.
- The normal well known UART diplays: the display switches the blue wire to battery +. The blue wire supplies the voltage regulator of the controller.
- On the CAN display I analyzed (Ananda) the on button on the display pulls a wire (blue, it has battery voltage from a pull up resistor) to ground. This is the signal for the controller to switch on a 36V line (red) as supply for the display. If the controller gets no valid CAN messages from the display, it switches off the 36V display supply after a few seconds

CiDi, is there a sequence of CAN messages when turn off the controller?

Maybe you can join this telegram channel for Bafang M500/M600 development:
https://web.telegram.org/z/#-1748500567

 

[CiDi]

If it helps, these are photos of the Bafang DP241C display.

Thanks. I don´t know if you can add all this information to the repository while you add it to here also.

A developer told this:

I know 2 mechanisms.
- The normal well known UART diplays: the display switches the blue wire to battery +. The blue wire supplies the voltage regulator of the controller.
- On the CAN display I analyzed (Ananda) the on button on the display pulls a wire (blue, it has battery voltage from a pull up resistor) to ground. This is the signal for the controller to switch on a 36V line (red) as supply for the display. If the controller gets no valid CAN messages from the display, it switches off the 36V display supply after a few seconds

CiDi, is there a sequence of CAN messages when turn off the controller?

Maybe you can join this telegram channel for Bafang M500/M600 development:
https://web.telegram.org/z/#-1748500567

I attach the can messages file when you turn off the display.

 

[casainho]

I wrote the notes about the sisplay DP C240 / C241. I now understand how the display turns on the motor controller, still I need to understand I can implement that on the circuit of the DIY display - if someone could help, would be really important!!

https://github.com/OpenSourceEBike/Bafang_M500_M600/blob/main/Hardware/display_DP_C241.md

 

[casainho]

I attach the can messages file when you turn off the display.

Would be great if we could write a table with all know CAN IDs... there are a good number of them on the turn on and turn off that are not documented....

 

[CiDi]

I attach the can messages file when you turn off the display.

Would be great if we could write a table with all know CAN IDs... there are a good number of them on the turn on and turn off that are not documented....

We only have to look at the messages starting with 03 which are what the display sends.

It seems to me that these messages are all documented.
We could write how the startup and shutdown procedure happens.

 

[stancecoke]

if someone could help, would be really important!!

For the system of an Ananda Controller and the Bafang Display, I wrote a code some time ago, that emulates the controller communication. You can send speed, power etc to the display with it. Of course you need the other way round, but perhaps it helps a little. I still don't know, if the protocol is the same as the one from the Bafang controllers.
https://github.com/stancecoke/BionX_Minimal_Translator/tree/Sniffer_for_Bafang

regards
stancecoke

 

[patdam]

i'm too bad in soft and i can't help you, but i would say i'm appreciative a lot all yours works. thank you.

 

[Tomblarom]

I recently done CAN reverse engineering of other popular ebike systems. It's mandatory to have a gateway device for this job, because you want to ..
- know which messages came from which side.
- filter certain messages for testing.
- trace/record and play back messages.

Here are a few options I know:
- PEAK PCAN: mighty software, expensive
- CAN-Hacker: basic software, fairly cheap (russian, unfortunately currently offline..)
- Toomoss UTA0402/UTA0403: not tested, fairly cheap
- DIY STM32 CAN-Hacker / FD version: not tested, seems reliable, software may be limited..

 

[casainho]

I recently done CAN reverse engineering of other popular ebike systems. It's mandatory to have a gateway device for this job, because you want to ..
- know which messages came from which side.
- filter certain messages for testing.
- trace/record and play back messages.

Here are a few options I know:
- PEAK PCAN: mighty software, expensive
- CAN-Hacker: basic software, fairly cheap (russian, unfortunately currently offline..)
- Toomoss UTA0402/UTA0403: not tested, fairly cheap
- DIY STM32 CAN-Hacker / FD version: not tested, seems reliable, software may be limited..

Thanks. I use CAN at work and I use Linux CANUTILS softwar. On hardware side, I use the most cheap USB CAN adaptor from the AliExpress. CAN on Linux is straight forward to do that tasks you did mention - and no need to buy any software, including that CANUTILS is OpenSource and you can reuse his source code for your application.

 

[Tomblarom]

Would be great if we could write a table with all know CAN IDs

We can use Vector CANdb++ for this. It's a software to generate and edit .dbc files, a standard for CAN database. OpenSource Software like CANgaroo also supports it!

Maybe you can join this telegram channel for Bafang M500/M600 development:
https://web.telegram.org/z/#-1748500567

Your Telegram link does not work.

 

[casainho]

Maybe you can join this telegram channel for Bafang M500/M600 development:
https://web.telegram.org/z/#-1748500567

Your Telegram link does not work.

Try this one: https://t.me/+O5GciLgdbBc0ZGRk

 

[Tomblarom]

CAN on Linux is straight forward to do that tasks you did mention - and no need to buy any software, including that CANUTILS is OpenSource and you can reuse his source code for your application.

Sure I also have CANable hardware + CANgaroo that's SocketCAN compatible. It costed me a whole day and I wasn't able to properly setup a CAN gateway using cangw + python, wherefore I gave up and bought a CAN-Hacker. - Anyways. Offtopic! Let's have this coversation in Telegram ..

 

[stancecoke]

It's mandatory to have a gateway device for this job

I use a simple bluepill board + CAN transceiver for that purpose. My setup was for emulating the BionX system originally, with just a few changes in the code, I used it for analyzing the Bafang CAN protocol then.

regards
stancecoke

 

[casainho]

Here is the Telegram link: https://t.me/bafang_m500_m600_development

 

[Tomblarom]

Can somebody explain this to me, about the wiring harness of the M500/M600? Why does the brake plug need CAN high!? (I made this layout by measuring)

 

[casainho]

Can somebody explain this to me, about the wiring harness of the M500/M600? Why does the brake plug need CAN high!? (I made this layout by measuring)

I think the idea is to have another option to connect some CAN device, for instance the brakes could also be CAN!! See that the torque sensor is CAN. On the M365, the brake signal connects to the display and then the brake sensor data flows to the motor controller as a digital value (on this case over UART).

 

[CiDi]

Can somebody explain this to me, about the wiring harness of the M500/M600? Why does the brake plug need CAN high!? (I made this layout by measuring)

Where did you get this wiring diagram?
In M500/M600 system the brake cable is separated from the display/throttle/BMS/front light cable.

 

[casainho]

Updated the EasyDIY display schematic.

The CTRL pin is put to GND when pressing the power button on the remote. Then there is a voltage divider with 2 resistors, to change the battery voltage to max of 3.3V (including a 3.3V zener diode as a protection) to avoid that signal to go over 3.3V, that is the limit of the microcontroller pin. The microcontroller will then read the power button state by reading the voltage with an ADC.

I would like to get feedback, does anyone things this is wrong? or suggestions for improving??

 

[CiDi]

Updated the EasyDIY display schematic.

The CTRL pin is put to GND when pressing the power button on the remote. Then there is a voltage divider with 2 resistors, to change the battery voltage to max of 3.3V (including a 3.3V zener diode as a protection) to avoid that signal to go over 3.3V, that is the limit of the microcontroller pin. The microcontroller will then read the power button state by reading the voltage with an ADC.

I would like to get feedback, does anyone things this is wrong? or suggestions for improving??

From what I could see, the P+ terminal that you call ctrl, is the same that is used to power the display, its voltate never drops below 2,2V.
The VCC terminal, has voltage only after switching on and I think it serves to power the usb socket.

 

[Tomblarom]

Where did you get this wiring diagram?

As I said: I measured and got both versions (with/without throttle) for comparison. Programm is Fritzing.
Still, I don't understand how the cut-off works.. Can't imagine the put CAN high only on there.. Why would you?

 

[CiDi]

Where did you get this wiring diagram?

As I said: I measured and got both versions (with/without throttle) for comparison. Programm is Fritzing.
Still, I don't understand how the cut-off works.. Can't imagine the put CAN high only on there.. Why would you?

In my opinion, what you call the brake connector is the battery BMS connector. The brake connector is not in that cable.