• Hello ES! We could use some help to get us past the finish line on building the new knowledgebase for the forum.
    Can you donate? Please see our fundraising page. Thank you!

Bafang M500/M600 thread

Did you measure if perhaps both* are trying to terminate the bus? If you have 60ohm between
can hi & lo, it is terminated(has 120ohm resistors between them) correctly. I suppose controller
does terminate one end, and so only one device(at the other end) of the bus should "terminate",
unless it is in the wiring harness.

*) display + that VESC Express.
I just noticed the VESC Express has 220 Ohm resistor in between the CANH and CANL pins. So the CAN transceiver on the controller PCB already has 120 Ohm in between CANH an CANL (two 60 Ohm resistors in series soldered on the controller PCB). And now VESC Express adds 220 Ohm parallel reducing the resistance between CANH and CANL. Do you think this is the issue?

Display and Torque sensor are also connecter to that CAN transceiver

1760313778961.png
 
Last edited:
OK, problem solved. It turned out all I need to do is to set baud rate to 250K to make the VESC Express works with the Luna M600 controller

 
Some questions for those into CAN bus logging and decoding. My motor is an M510, FC2.0 (which I think has blown up its controller board, but that's another story)

1. I notice that packets from the torque sensor have been seen (01F83201, every 10 ms). However, I never see these; I only see the torque info as part of a packet from the controller (02F83200, with the battery %) and much less often. Are the torque sensors now not on the CAN bus any more? If not, presumably the cable will have raw sensor values and cadence pulses; has anyone reverse-engineered this?

2. There are packets documented coming from BESST, for calibration of torque sensor (05106101) and position sensor (05116201). To do calibration, is all you have to do to send the packet? Is there any reply saying calibration done? I can't find any logs that show these. If I replace a controller board I'll have to do the position sensor calibration, and I'd rather avoid paying for a BESST...

3. ... which brings me to the last q: does loginbypass.py still work with BESST Pro? Last mention I can find of it was back in 2022.
 
Are the torque sensors now not on the CAN bus any more?
... or perhaps on a dedicated CAN bus new with FC2.0, to save on congestion to the main CAN bus? The packets are said to come every 10ms, much more frequently than anything else to/from the display.

Have just pulled my motor apart and see that the Halls have only two wires to the controller, so they are not the usual 3-phase BLDC Halls - they must just be a pulse once per pole or something. Hence perhaps the need for calibration.

Or they are not Halls at all but a temp sensor instead. (saw a M600 controller board somewhere earlier in this thread with the pins marked out this way) and the motor is actually run sensorless. Greenbikekit advertises a replacement controller that says "Motor hall (2 white wire)" against this socket. Something doesn't make sense.

I see a lot of questions remain, which become moot if I go the VESC route..
 
they must just be a pulse once per pole or something
The controllers are using a MT6816 decoder that is placed directly on the controller PCB. The end of the rotor shaft is magnitized.
 
Last edited:
Some questions for those into CAN bus logging and decoding. My motor is an M510, FC2.0 (which I think has blown up its controller board, but that's another story)

1. I notice that packets from the torque sensor have been seen (01F83201, every 10 ms). However, I never see these; I only see the torque info as part of a packet from the controller (02F83200, with the battery %) and much less often. Are the torque sensors now not on the CAN bus any more? If not, presumably the cable will have raw sensor values and cadence pulses; has anyone reverse-engineered this?

2. There are packets documented coming from BESST, for calibration of torque sensor (05106101) and position sensor (05116201). To do calibration, is all you have to do to send the packet? Is there any reply saying calibration done? I can't find any logs that show these. If I replace a controller board I'll have to do the position sensor calibration, and I'd rather avoid paying for a BESST...

3. ... which brings me to the last q: does loginbypass.py still work with BESST Pro? Last mention I can find of it was back in 2022.

1. M510-V2 and M560 They have the torque sensor not can.

2. You send the command and wait, no response.

3. It works, but I think only on older versions, If you buy the interface they give you an account you can use.
 
Have a look at the ones I've seen here. They pretty much match what has already been documented.
There are a few from the controller (0x02Fxxxxx) that I don't know the functions of (yet) and which always seem to have the same data bytes.
 
Have a look at the ones I've seen here. They pretty much match what has already been documented.
There are a few from the controller (0x02Fxxxxx) that I don't know the functions of (yet) and which always seem to have the same data bytes.
I don't care about proprietary protocols and hardware.

I am building DIY my own basic display, that communicates wireless wifi ESPNow with the motor board, lights boards and power switch board. It also communicates wireless by Bluetooth with my BMS where it reads all data and so can detect when I connect or disconnect the charger and show automatically the charging screen:


I am developing the software in high level Micro Python and this is the schematic for the display:

1761690772869.png
 
Curious that it only happened after charging to 100% (54.something volts). If controller itself is fried then it might be time to move on to a VESC!
Well my switch-on problem only got worse. Replaced the controller board, and it worked OK for about 1 minute, even giving power when pedals turned. Then the same symptoms appeared (flashing battery icon, no response to power button, immediate switch-on). So now I have TWO bricked controller boards.

Has anyone else seen a 48V M510 not take kindly to a fully charged (54+ volts 13S) battery?

Of academic interest to me, as I'm done with Bafang electronics and have pulled the trigger on an over-engineered VESC from Spintend, but others may take some warning to keep that damn battery to 80% or below. I'll be documenting progress here with torque/cadence sensing PAS as I go.
 
Well my switch-on problem only got worse. Replaced the controller board, and it worked OK for about 1 minute, even giving power when pedals turned. Then the same symptoms appeared (flashing battery icon, no response to power button, immediate switch-on). So now I have TWO bricked controller boards.

Has anyone else seen a 48V M510 not take kindly to a fully charged (54+ volts 13S) battery?

Of academic interest to me, as I'm done with Bafang electronics and have pulled the trigger on an over-engineered VESC from Spintend, but others may take some warning to keep that damn battery to 80% or below. I'll be documenting progress here with torque/cadence sensing PAS as I go.
I've been using 58.8V for years on M600 - M510 - M820 without a problem.
 
I don't know, if it is documented somewhere already. I'm recently trying to understand how the bootloader for the firmware update works. I found, that the bin files are copied 1:1 to the flash memory. The firmware itself starts at 0x08004000. The 32 bytes before are carrying some version information obviously, to avoid flashing a wrong firmware. I wonder what the two bytes at the beginning of the last 16 bytes before the firmware itself stand for. It's not the lenght of the firmware, is it a kind of checksum?! Any ideas?
1766688946473.png
 
Does anyone know the nature of the M510 temp sensor? This is on the non-CANbus motor. I assumed it was a NTC of about 10k or 20k, but measurement with a plain old multimeter shows readings in the multi-megohm range, and they jump about all over the place. I could have a busted temp sensor, of course, but just wonder if I can save it and get reliable motor temp readings.
 
Does anyone know the nature of the M510 temp sensor? This is on the non-CANbus motor. I assumed it was a NTC of about 10k or 20k, but measurement with a plain old multimeter shows readings in the multi-megohm range, and they jump about all over the place. I could have a busted temp sensor, of course, but just wonder if I can save it and get reliable motor temp readings.
Here is for M560. I believe both M510 and M560 temperature sensors are 20K NTC thermistors


It might be 1K PTC thermistor also like on M600 if it is early version of M510 and they did not change it.
 
Last edited:
Strange that I can't get any sensible reading at room temp. Will check for bad connections. Failing that I'll get a known NTC and glue it into the motor windings.
 
Dodgy connection it was. Reads 16k at a (rather hot) room temp. Configuring VESC tool to say it's a 20k NTC makes the temp read 34C at room temp while the VESC's internal thermistor reads 29C. So it's still not dialed in yet.
 
Dodgy connection it was. Reads 16k at a (rather hot) room temp. Configuring VESC tool to say it's a 20k NTC makes the temp read 34C at room temp while the VESC's internal thermistor reads 29C. So it's still not dialed in yet.
You need to set custom thermistor in the VESC Tool application and write the settings to the controller. Here are the instructions. Maybe copy the settings I posted on the picture in that post first and test it.

1767212845781.png


If it is still not accurate measure resistance at 25C and set it in the field 5.

Heat up the motor in an oven maybe up to 50-60C and measure the temperature and resistance and calculate the beta value and put in the the field 4

1767212488149.png
 
Last edited:
The M510 thermistor turned out to be an NTC20k with a beta value somewhere in the low 2000's. I have yet to do the heat-up test to get an accurate beta value though, as the motor is now in the bike and running! With the as-detected settings in VESCTool, it is a bit noisier than with the original Bafang controller and is a little hesitant to start up. Some of the sensorless FOC parameters may need tweaking. If anyone has done this process for an M510 I'd love to see their results.
 
I believe M510 and M560 motors are the same (at least I do not see the difference between the M510 and M560 motors stator and rotors according to the pictures I found in the Internet). The only difference is the firmware and the engraved markings on the motor case.

Here you can see the M560RS (and I believe M510 is the same) motor detected setting with the VESC Luna Ludicrous V2 controller for sensorless mode I obtained.


In sensorless mode I had jerk start sometimes. I do not know what you can do about it other than install a rotary encoder. You can see the same issue here.

 
Number of poles confusion... I see in this video at 7:07 that the M510 looks the same as the M560. 10 magnets in the rotor, but it seems there are 12 wound poles in the stator? (I was under the impression (somehow) that it had 18 poles) Anyway, there's some experimentation to do to get the starting more reliable and get the noise down. Will report.
 
Amount of magnets is amount of poles. In this case it is 10. VESC application Encoder ratio is half of the poles so it is 5.
 
Back
Top