BBSHD Voltage Problem Firmware Update & Instructions

[BeachRider2016]

here's the data after I tried flashing once more with 311 file
After flashing it no longer connect to Bafang Configuration Tool as well.
"Checking target MCU ...
MCU type: STC15W4K56S4
F/W version: 7.3.4T

Current H/W Option:
. Current system clock source is internal IRC oscillator
. IRC frequency: 18.427MHz
. Oscillator gain is HIGH
. Wakeup Timer frequency: 36.891KHz
. Do not detect the level of P3.2 and P3.3 next download
. Power-on reset, use the extra power-on delay
. RESET pin behaves as I/O pin
. Reset while detect a Low-Voltage
. Thresh voltage level of the built-in LVD : 2.78 V
. Inhibit EEPROM operation under Low-Voltage
. CPU-Core supply level : 2.78 V
. Hardware do not enable Watch-Dog-Timer
. Watch-Dog-Timer pre-scalar : 256
. Watch-Dog-Timer stop count in idle mode
. Program can modify the Watch-Dog-Timer scalar
. Do not erase user EEPROM area at next download
. Do not control 485 at next download
. Do not check user password next download
. TXD is independent IO
. TXD pin as quasi-bidirectional mode after reset
. P2.0 output HIGH level after reset
. Testing time: 2015-12-16

. MCU type: STC15W4K56S4
F/W version: 7.3.4T

Adjusting frequency ... [1.484"]
Adjusted frequency: 18.427MHz (-0.026%)

Re-handshaking ... Successful [0.110"]
Current Baudrate: 57600
Erasing MCU flash ... OK ! [2.703"]
MCU ID : F5280000007829
Programming user code ... OK ! [14.813"]
Programming OPTIONS ... OK ! [0.032"]

H/W Option upgrade to:
. Current system clock source is internal IRC oscillator
. IRC frequency: 18.427MHz
. Oscillator gain is HIGH
. Do not detect the level of P3.2 and P3.3 next download
. Power-on reset, use the extra power-on delay
. RESET pin behaves as I/O pin
. Reset while detect a Low-Voltage
. Thresh voltage level of the built-in LVD : 2.78 V
. Inhibit EEPROM operation under Low-Voltage
. CPU-Core supply level : 2.78 V
. Hardware do not enable Watch-Dog-Timer
. Watch-Dog-Timer pre-scalar : 256
. Watch-Dog-Timer stop count in idle mode
. Program can modify the Watch-Dog-Timer scalar
. Do not erase user EEPROM area at next download
. Do not control 485 at next download
. Do not check user password next download
. TXD is independent IO
. TXD pin as quasi-bidirectional mode after reset
. P2.0 output HIGH level after reset

. MCU ID : F5280000007829
. MCU type: STC15W4K56S4
F/W version: 7.3.4T

. Set frequency: 18.432MHz
. Adjusted frequency: 18.427MHz
. Trim error: -0.026%


Complete !(2019-06-09 19:10:25)

 

[tomjasz]

Sadly the energy that has gone into TSDZ2 motors has seemingly never roused the level of excitement with BBSxx mid drives.

The purported “game changing” largest importer of Bafang mid drives has held fast to a clearly antagonistic attitude with their own customers as well as the general market. Heck no, “we won’t release the 07 overvolt fix.” A bloody secret.

Bafang does what Bafang does with little warning-and miserable vendor support. Frustrating especially when many of us know the reliability and DIY repairs make their drives a great choice. But apparently there’s just not enough profit in supporting DIY. Seems by many sources a narrow, what can we get TODAY, view by the bosses.

I’m a dolt at eBike tech. Everything I know comes from building at least one bike with the top ten kits and vendors.

I’m still a fan of BBSxx builds. But completely confused by their responses to their customers.


buy a new controller from a trusted source.



.

 

[BeachRider2016]

I’m looking at Luna cycle, they have version A that I need. I guess I was a volunteer lab rat in this experiment!
Don’t program unless you have the exact chip as instructed.
Somewhere down the road, I hope someone smart enough to figure all this out.

Sadly the energy that has gone into TSDZ2 motors has seemingly never roused the level of excitement with BBSxx mid drives.

The purported “game changing” largest importer of Bafang mid drives has held fast to a clearly antagonistic attitude with their own customers as well as the general market. Heck no, “we won’t release the 07 overvolt fix.” A bloody secret.

Bafang does what Bafang does with little warning-and miserable vendor support. Frustrating especially when many of us know the reliability and DIY repairs make their drives a great choice. But apparently there’s just not enough profit in supporting DIY. Seems by many sources a narrow, what can we get TODAY, view by the bosses.

I’m a dolt at eBike tech. Everything I know comes from building at least one bike with the top ten kits and vendors.

I’m still a fan of BBSxx builds. But completely confused by their responses to their customers.


buy a new controller from a trusted source.



.

 

[fechter]

I’m looking at Luna cycle, they have version A that I need. I guess I was a volunteer lab rat in this experiment!
Don’t program unless you have the exact chip as instructed.
Somewhere down the road, I hope someone smart enough to figure all this out.

Bummer. You've earned the fried guinea pig award.

It seems not even Bafang has this all sorted out. It would be nice to know exactly how to load the right firmware and not brick the controller, but easier said than done. I guess this is why I like hardware hacks but we shouldn't have to resort to that.

 

[BeachRider2016]

Lol, I was bored and figured I’d volunteered. Anyway, there’s some coding lost in the programming process, maybe it’s not the right bin file for the correct chip.
The successful programmed units probably the newer, version B of the bbshd (mine is from 2017)
I’ll do a check after I get a replacement from Luna to see which chipset it is.

I’m looking at Luna cycle, they have version A that I need. I guess I was a volunteer lab rat in this experiment!
Don’t program unless you have the exact chip as instructed.
Somewhere down the road, I hope someone smart enough to figure all this out.

Bummer. You've earned the fried guinea pig award.

It seems not even Bafang has this all sorted out. It would be nice to know exactly how to load the right firmware and not brick the controller, but easier said than done. I guess this is why I like hardware hacks but we shouldn't have to resort to that.

 

[Bersekz]

Lol, I was bored and figured I’d volunteered. Anyway, there’s some coding lost in the programming process, maybe it’s not the right bin file for the correct chip.
The successful programmed units probably the older, version B of the bbshd (mine is from 2017)
I’ll do a check after I get a replacement from Luna to see which chipset it is.

All the firmwares contained in this thread are for the latest controller hardware V1.5, which uses IAP15W4K61S4 MCU. It's obvious that if you try to write any of these firmwares to a different hardware, you will most likely brick it. That said, you could still recover your controller, provided that you can get access to a firmware compatible with your hardware version.

 

[tomjasz]

2017

Wait! A 2017 model had the 07 overvolt code?

 

[BeachRider2016]

I messed up Tom, I didn’t do my search nor ever charged my 14s battery full. My charger stopped at 4.1v/cell. But the whole time I had it thinking it would throw an 07 code thus why I reflash firmware.

2017

Wait! A 2017 model had the 07 overvolt code?

 

[tomjasz]

Got it. I'm sorry to read that. We've only flashed the most recent motors that flagged with the 07 error. Up until a month or two, there was no problem.

 

[gatorsean]

Hello!

I am able to program the updated firmware files successfully, but it does not resolve the 07H problem for me. I get 07H with my battery charged to 58.1V The display shows 58.4V most of the time but bounces around a little bit.

I downloaded the files from the google drive link here: https://drive.google.com/drive/folders/1gbn-wSymmHbiSqT4ZZO6lU-D223AIwEc

I tried CRR10E5228E105221_190418.bin first. This firmware did seem to fix 07h, but it also limited the drive current to 28A instead of 30A.

Next, i tried CRR10E4830E105001.1_190413-1.bin. This is the FW i currently have installed and I still get the 07H error.

I have not tried the CRR10E4830E105001.1_APP_190311.bin yet as I am not sure it is compatible.

Can anyone confirm these results on their end or advise how to get rid of the 07H error and keep the 30A current limit?

Thanks!

 

[gatorsean]

I just noticed something interesting in the firmware file names:

They all start with CRR10E which I assume is for the BBSHD products
Next, the string between the E's - 5228 or 4830 seems to correlate with the max voltage/current setpoints. This explains why in my previous post, the 5228 firmware fixes my 07H, but limits my current to 28A. Also explains why I can set 30A but get 07H with the 4830 versions
The next part of the string indicates the BBSHD hardware revision the firmware is compatible with. 105*** in our examples.
Finally, the suffix appears to be a date code with format YYMMDD.

At this point it looks like the only way to get 52V and 30A is with hardware modification as discussed here: https://endless-sphere.com/forums/viewtopic.php?f=3&t=83778&start=75

Hope this helps others! I have some wire cutting and diodes to solder now...

 

[fechter]

It may be possible to compare the two firmware files and look for the differences and figure out a way to edit it to make a "5230" version.

 

[gatorsean]

It may be possible to compare the two firmware files and look for the differences and figure out a way to edit it to make a "5230" version.

It is absolutely possible, but highly unlikely that you could find the specific byte or bytes in the FW files.

If one was so inclined: first, convert the bin files to hex. It is likely the constant for the max current is declared as an 8 bit int (byte), so you would change one or more of the occurrences of 0x1C to 0x1E. The problem is it could take quite a crazy amount of time to figure out which bytes to change. If we knew it was declared as a short or a full 32 bit int by mistake, it could be easier to find.

We need a Bafang insider that can get us to source, or better yet, make a proper build for us! :lol:

 

[fechter]

If one was so inclined: first, convert the bin files to hex. It is likely the constant for the max current is declared as an 8 bit int (byte), so you would change one or more of the occurrences of 0x1C to 0x1E. The problem is it could take quite a crazy amount of time to figure out which bytes to change. If we knew it was declared as a short or a full 32 bit int by mistake, it could be easier to find.

We need a Bafang insider that can get us to source, or better yet, make a proper build for us! :lol:

I've done something like this before and you are correct. It makes things harder that you can't read the file, only write it.

 

[BeachRider2016]

Wonder if there’s a way to extract/read/save the .bin file from an existing controller ? I have another bbshd with the same controller chip, i’m hoping to use its bin file to resurrect the messed up one. Has anyone tried/know how to extract .bin files?

 

[gatorsean]

Wonder if there’s a way to extract/read/save the .bin file from an existing controller ? I have another bbshd with the same controller chip, i’m hoping to use its bin file to resurrect the messed up one. Has anyone tried/know how to extract .bin files?

Most microcontrollers offer a security mechanism known as code read back protection which prevents dumping the flash from the device. Whether Bafang implements this or if there is a hack to work around it, I do not know, but someone else might.

 

[amberwolf]

As Fechter noted in the post just above yours, you can't read the controller's fw, due to protections in the MCU.

(This is typical of every controller I've ever dealt with--no reading, only writing. Even the opensource and other self-developed controllers around the forum generally can't read back anything that was inside the controller, which seems very surprising to me that developers don't want to add this capability, even to read back *settings* that are in the controller. I'm sure there's exceptions...but I haven't had one)

If you had the right equipment, and didn't mind destroying a perfectly good controller, you could take the MCU off the PCB, mill off the plastic chip casing, and potentially be able to "read" what is written in each cell of the eeprom inside it...but then you'd have to find out how data is addressed in there, and how that translates to the file format that's sent to the controller. :/

It *might* be possible to use a JTAG (or whatever the MCU supports) programmer to read back stuff that can't be read by a bootloader (like that used to talk to USB-serial stuff on a computer). But I have no idea how to do that.

 

[BotoXbz]

You could probably order one of the compatible ICs from China and solder that instead.
Then you could program it with the software here.
Or maybe try to ask bafang support for the correct firmware while explaining your situation.

 

[fechter]

Or maybe try to ask bafang support for the correct firmware while explaining your situation.

Luna cycle, arguably their largest single customer has been trying to do this for a long time without success. It's like Bafang doesn't even know or doesn't care.

There is no way to read the firmware from the chip as far as I can tell. This is done to prevent people from copying it. There is a sticker on the top of the chip with some numbers that would give you a clue about which FW version was originally installed but not sure if you have to dig the potting out to read it.

 

[BeachRider2016]

Got a new one from Luna cycle and it’s purring again. But I’m still hanging on to the old one hoping to get it fixed one day.

 

[Rydon]

Hello!

I am able to program the updated firmware files successfully, but it does not resolve the 07H problem for me. I get 07H with my battery charged to 58.1V The display shows 58.4V most of the time but bounces around a little bit.

I downloaded the files from the google drive link here: https://drive.google.com/drive/folders/1gbn-wSymmHbiSqT4ZZO6lU-D223AIwEc

I tried CRR10E5228E105221_190418.bin first. This firmware did seem to fix 07h, but it also limited the drive current to 28A instead of 30A.

Next, i tried CRR10E4830E105001.1_190413-1.bin. This is the FW i currently have installed and I still get the 07H error.

I have not tried the CRR10E4830E105001.1_APP_190311.bin yet as I am not sure it is compatible.

Can anyone confirm these results on their end or advise how to get rid of the 07H error and keep the 30A current limit?

Thanks!

I think you may be seeing some variability in the hardware. On older hardware I know some guys that were getting 07h errors on some controllers and not on others. They were using tool batteries in series that were charging to around 61-62 volts and the controllers were right on the hairy edge. Some worked and some didn't.

As for my own experience flashing controllers with the voltage problem they have all worked with no 07h errors except one. Before flashing, it gave the 07h error above 55 volts. Now it errors above 58 volts. The guy that got that one just puts it on another bike for a few minutes to get the voltage down and doesn't mind living with it.

 

[BeachRider2016]

I realized that my Luna display 850P that I bought from them 2yrs ago had a voltage reduce/limit built in. With my 14s pack fully charged, it still only display 56.4v.

On my new display 850C from Aliexpress, newer model, it showed a full 58.8v.

 

[Rydon]

I realized that my Luna display 850P that I bought from them 2yrs ago had a voltage reduce/limit built in. With my 14s pack fully charged, it still only display 56.4v.

On my new display 850C from Aliexpress, newer model, it showed a full 58.8v.

Those old 850C displays don't actually reduce/limit the voltage. They just pin the displayed voltage at 56.4 for all voltages higher than that. I am glad they fixed it in later versions.

 

[BeachRider2016]

Oh gotcha. Thanks for clarifying. I thought it’d be the easiest solution for overvoltage on the newer bbshd, guess not.

 

[fechter]

Oh gotcha. Thanks for clarifying. I thought it’d be the easiest solution for overvoltage on the newer bbshd, guess not.

I have the display voltage issue on mine. While everything else works ok, I still find it annoying. Good to know how things work.