Is it possible to Backup installed Firmware before ? Or aren't there any differences added from the bike manufacturer? Is it just to check what "stock" Firmware Version is installed ? (Especially when bike comes with 48V 13S configuration shipped ?)
-
Hello ES! We could use some help to get us past the finish line on building the new knowledgebase for the forum.
Can you donate? Please see our fundraising page. Thank you!
"FAKE TAXI Project" - the modified original firmware for Bafang M820 motor
- Thread starter rekrezeb
- Start date
Waynemarlow
Regular
Guys, a very good upgrade for our little motors, thanks for the time and effort. I'm using the E version running on 52 volts as I'm not sure whether you have kept the 12A max across the 48 and 52V firmwares. Very Bosch like low cadence rpm torque curves will suit a lot of users I would suspect.
Couple of feedback comments ( not important but desirable )
The initial startup at 0 rpm is just on the verge of being too sensitive. We have to go through a number of small gates on our routes which entails standing the bike up on its back wheel. If you knock the pedals or slightly rotate them, the motor will start ( my Fazua engine did the same ). A fraction less sensitivity would be safer in my opinion. Hill starting where you need almost instant power its very good, I guess there's a balance there somewhere in between.
At higher cadences and speeds ( unrestricted ) in higher power ( Boost and + ) if you momentarily decrease the cadence ever so slightly, the power ramps down too quickly and takes approx. 1 full revolution before getting back to the same level of power. It gives a not very smooth power output whilst say riding on flat roads with mid torque on the peddles. Perhaps slow the ramp down a tad at higher cadences / speed ?
Thanks.
Couple of feedback comments ( not important but desirable )
The initial startup at 0 rpm is just on the verge of being too sensitive. We have to go through a number of small gates on our routes which entails standing the bike up on its back wheel. If you knock the pedals or slightly rotate them, the motor will start ( my Fazua engine did the same ). A fraction less sensitivity would be safer in my opinion. Hill starting where you need almost instant power its very good, I guess there's a balance there somewhere in between.
At higher cadences and speeds ( unrestricted ) in higher power ( Boost and + ) if you momentarily decrease the cadence ever so slightly, the power ramps down too quickly and takes approx. 1 full revolution before getting back to the same level of power. It gives a not very smooth power output whilst say riding on flat roads with mid torque on the peddles. Perhaps slow the ramp down a tad at higher cadences / speed ?
Thanks.
Coolspot
New here
Assist Ratio multiplier adjusment would be wonderfull, I think this is the most missing feature of the M820, at least for me. Thank you for your work on these firmwares!
Hallyster61
New here
I totally agree...
I just can't wait to have this upgrade.
Your custom FW is awesome, thank you.
When passing through a gate, turn off the assistance and be happy.
Waynemarlow
Regular
Does the Bafang Go App not do this already offering I think up to 350% extra assistance ( I think BESST offers 400% ). The big problem will be the max watts the motor can handle, there is no point having a 1000 % extra assistance range when the motor maxs out at say 650 Watts due to the possibility of over heating.
Talking of over heating what would help us testing these firmwares is the ability to display the motor internal temperature. On the CAN output I believe this is sent and yet we cannot display this on say a DPC245 display. Any solutions to this would be appreciated ?
Hallyster61
New here
From the K1 FLASH site: K1 eBikes – Bafang Tuning and Services
it is stated that with the BBR you can do that and also a lot more.
...
– 3 Service modes: Show Motor Temperature, Current in Amps, Battery Voltage (will be shown instead of speed reading)
...
Thinking of buying one to try it out.
Waynemarlow
Regular
Sadly the KI widget won't display the temp on the M820 engines ( I have one connected ). It will on the M510 engines though.
Hallyster61
New here
That's bad new...
Waynemarlow
Regular
Seems the motor itself has no temp sensor only the controller ?
FOC Open Source Firmware for Bafang CAN bus controllers with GD32F303 processor
is it sent over the CAN in a different format ? It's send as controler temperatue, motor temperature is empty.
endless-sphere.com
RideStar24
New here
I delved into the topic of reverse engineering, and decided to break down by "atom" the hard-coded parameters in the original firmware and compared them in your modification, and I had questions: Tell me, what is the battery capacity parameter for? If you take the original version. 2.5 I did not find where in the code this parameter is written, if viewing it through canable it equals 10000mAh (hex 2710 (big)), I have a standard battery for another capacity 14.5Ah, and if other users have batteries with other parameters, do they affect the calculations on the voltage map?
Waynemarlow
Regular
Might just have found the limits of the M820 motor. Seems 52volts @12A's is a tad too much. Dreaded ERR09 tonight with the motor hard to turn in reverse ( phase wire problem ). Aaaagh had enough of these sort of problems.
stancecoke
Minor legend
@rekrezeb: There is a second checksum in the header of the M820 bin files in byte 14 and 15. Is there any information, how it is calculated? The firmware upload doesn't work if this two bytes are wrong, obviously. The bootloader 3 and 38 don't use this bytes, but the bootloader of the M820 works differently obviously. 
Last edited:
stancecoke
Minor legend
Great, thank you!
stancecoke
Minor legend
The calculation works, but I think it will be a Modulo 65536 (=2^16), it's just the last two bytes of the code size.
But sadly this does not the job, the bootloader sends no acknoledge on the last data chunk in the update procedure. There must be something else "magic" in the firmware bin files. Do you know what and are willing to share the trick?
Last edited:
stancecoke
Minor legend
Then I'll try RevEng to find the right algorithm
GitHub - dimmykar/stm32-crc32-calculator: STM32 CRC32 software calculation utility
STM32 CRC32 software calculation utility. Contribute to dimmykar/stm32-crc32-calculator development by creating an account on GitHub.
github.com
stancecoke
Minor legend
I hope I can inlude it in a python script somehow, as I don't want to modify my files by hand
Ah, there seems to be a python solution also:
stackoverflow.com
Ah, there seems to be a python solution also:
Make CRC on stm32 match with software implementation
Upd. See the end of post for working code I'm already mad with this. How can I make checksum from CRC unit on stm32f103 match with software implementation? Stm has polynom 0x04C11DB7 and reset value
I think this might also be useful for you:
At first, we also had issues getting the modified SW onto the controller. I was almost certain it had something to do with the last four bytes, but none of the known algorithms matched the pattern. I even tried brute-forcing the CRC polynomial and other parameters, but no luck. AI wasn't much help either - as usual. After a couple of days, I figured it might be something STM32-related, and that turned out to be the case. At the time, I didn't have a control board, so I couldn't dump or reverse-engineer the bootloader.
- The M820 firmware base address is 0x08005000.
- The M820 has 48 pulses per crank revolution, which equals 7.5° per pulse. As far as I know, the M510 has 32 pulses, so that's 11.25° per pulse.
- The M820 doesn't have a motor temperature sensor, only a controller one. Byte 7 of CAN frame ID 0x3201 is hardcoded to 0xFF (-1).
At first, we also had issues getting the modified SW onto the controller. I was almost certain it had something to do with the last four bytes, but none of the known algorithms matched the pattern. I even tried brute-forcing the CRC polynomial and other parameters, but no luck. AI wasn't much help either - as usual. After a couple of days, I figured it might be something STM32-related, and that turned out to be the case. At the time, I didn't have a control board, so I couldn't dump or reverse-engineer the bootloader.
stancecoke
Minor legend
@rekrezeb: Do you have the information, which processor pin switches the 5V supply? I've tested hundreds of combinations, but I can't get the 5V supply remain, when the on/off button is released on the M820.
The bootloader on the M510/M560 leaves the controller switched on, if it jumps to the main code, the bootloader of the M820 behaves different...
The bootloader on the M510/M560 leaves the controller switched on, if it jumps to the main code, the bootloader of the M820 behaves different...
stancecoke
Minor legend
I did the flash dump already and got some help on Mikrocontroller.net, but it still doesn't work, see the very last posts in this thread
GD32F303: Bootloader der Originalfirmware für Open Source Projekt nutzen
I'm not familiar with decompiling.
If you have any idea, I will try it...
Similar threads
