NEO 29er Controller

[methods]

I have a NEO 29er torn down. Pics elsewhere.

Battery was shot, tore that down... separated the pack electronics from the cells. The only electrical connections between the pack and the bike are

* Power
* Ground
* Yellow Wire (Presumably some sort of enable)

I am dumping the pack and going with Ryobi tool packs in series. Now for a controller...



Be fine with that... only it has a few wires to the dash. I could finger it out, but... it is only 36V@20A and I have other controllers....



Thats the PN
Three wires to the battery, a throttle, a pair of ebrakes, and some crap to a little dash nugget that is broken. Presumably sets power levels or changes mode between assist. I got the bike from a local machinist in a total state of disarray. It sat for years on a dead battery and the lame BMS inside ate the pack.



I have a little 12S over here that I may replace it with.

-methods

 

[methods]

The battery was overengineered.
I fixed that.



I wrote it up elsewhere, but basically the cover is RTV'ed on. When you remove it you will probably break one of the thermistor taps. BMS has 2pcs thermal probe, get those soldered back on



Its an overly complicated 18650 setup with 36V 10Ah
No way in hell can I re-build that setup... (no welder here, and no desire) so at first I was going to re-pack with Pouch cells. All of the electronics is intact, so all I would have to do is

* Hit the taps
* Fix the thermal probe

There is a circuit board that does nothing in the middle. Says "DC-DC for GPS" but is basically non-pop with a linear regulator. I left it on there. Pics elsewhere.



Battery connector is clever, but none of that is used in the bike. On the battery side, plenty of connections to talk with an over-complicated charger. WHY DO PEOPLE DO THAT???

Sigh...
On the bike side you just have those two prongs on the sides (Positive and Negative) then one more pin going to a yellow wire that heads to the controller. Since it is packaged with the Power lines controller side, it looks like a standard power switch.



Meh
I am getting close to throwing all that in the bin and keeping only

* Throttle
* Maybe ebrakes for regen
* Motor

Then for batteries, 2/4/6pcs of Ryobi P197 in a latched but removable setup. Pull them and charge them as per normal on the charger.

For a controller, moving the current limit up from 20A to 40A so I can burn the motor. Motor has a hall connector with a single extra wire... which... I really hope is a TypeK thermocouple, but we will see.

-methods

 

[methods]

The bike came to be thoroughly tweakered. Reason for sale was missing charger.

* Rear brake cable (cable disk) was sheered
* Various parts were removed and in a cup
* Seat was missing

Its value was next to nothing as it had a stone cold dead battery and just made for a very heavy pedaler.



As for bikes, I have my trike running with no chain on 13S of Zero pulldown cells. The Controller and Motor came from a cool cat in SF who is doing full size conversions. He bought it in 20" for a climber but came up short on torque. Like all of us... he went the route of more torque

IIRC he ended up with a 20" bike running 2WD
That will get it done!



So... I have a 12 fet controller from him that I need to go over and re-connector. That will go on the bike above, which has some OK features

* Front Shock (but no rear)
* Hub motor installed (but small)
* Front and rear Disk (but cable)
* Nice and heavy

Like I like all my bikes (sigh)

-methods

 

[methods]

This battery went to the Trike

* All the 6S drone packs went to custom resperators during COVID
* Two 7S Zero Packs went to a The Machinist for other projects

I... am on a wicked tear to source Lithium Local on a challenge to UpCycle a trashed COTS bike in 42hrs or less

NON CONSECUTIVE, but respecting shipping



So
The obvious and only move is to Tool Packs. Those can be had anywhere and always. I intend this time to
* Preserve the BMS
* Preserve their function as tool packs

The... super holly grail of... sharing battery packs across totally different applications.

-methods

 

[methods]

THAT

Is why I get irritated when Manufacturers push complexity over into the Charger. We want ABSOLUTELY NO FRIGGGING COMPLEXITY IN THE DANG NAG CHARGER!

Charger needs to be a CV/CC and that is it!

* Over Temp? Job of the BMS
* Over Voltage? Job of the BMS
* Ballance? Job of the BMS

Sigh... for this to scale... the business guys are going to have to get out of the way for a few minutes and quit fighting amongst themselves. 18V is 18V is 18V. 5S2P is 5S2P is 5S2P. Absolutely no reasonable reason at this point that we cant start swapping parts between machines.

I will leave it to the reader to research, but there are quite a few converters out there now that will allow you to run packs between manufacturers.

-methods

 

[methods]

Anyway, that is what I am doing today.


TO DO
* Get this 12fet checked out for function
* Re-connectorize by cutting all the plugs off of another controller, lap soldering
* Get the COTS motor spinning and the halls sorted out
* Quickly rig 2pcs Ryobi to it and run it around the block

LVC will need to be handled by the Tool Packs, as this controller says 36/48V. To me, that means ... eh... What for LVC?

So...
Controller has a bunch of water tight plugs on it. Going to wack those and go to JST-SM, as that is what the bike is built to. I will accept that the factor controller (potted unit above) is gone to the wind as is the nice tiny spot where it was hidden. If I was on something other than a "methods budget" I would find something that would fit in the hole - Maybe Later, when I am rich.

For now
I am a poor man who lives by the beach and eats garbage out of a can... right?

Build Poor
Have fun

-methods

 

[methods]

Here is a review of the bike on Eric's website
https://electricbikereview.com/easy-motion/neo-29er/

I suppose he has made quite a showing of himself so I should lighten up. Will do. Done.



Going to hodge something like what is shown above to tap the Ryobi packs. That is from a "Ryobi Adapter" Google search that lands on an Etsi page. Cool - but - ... I have to build this NOW with only what I can find in my garage and local.

Ryobi Pack will discharge without any funny business. Should be easy enough to spring load into those taps. I have done all the math (elsewhere) and decided that even 2 of them in series will run the bike well enough on the 20A controller. Now that I am going to a 40A... eh... I will have to go easy on it thru test phase.

* Rig up 2pcs Ryobi
* Rig up some kind of power switch

Ok...
Off to go tear apart the factory controller, and rig up this 12fet

HOLD

-methods

 

[methods]

I have a nice little (underpowered) teeny controller on my Trike that I could probably fit in the stock frame location... sigh... and... I really do need more torque on the trike.

Trouble is - that guys is a matched pair with a motor and I dont want to roach all that wiring

DONE

Do it methods
Less talk, more building ish that works.

We will start by confirming all the mosfets in the 12fet controller.

-methods

 

[methods]

How I check a controller

I am really just looking to see if the mosfets are shot. For this, super easy checks.

* Visual
* Junction

For visual I am just looking for obvious cracks. If a fet blows OPEN then you will likely see some evidence in the body. If the body is intact, and the mosfet is shot, it is likely to be in a SHORT condition.

I prefer to measure the body diode between the Drain and the Source



See the Cathode of the diode on the Drain and the Anode of the diode on the Source? If you dont know what I am saying right now then you have insufficient vocabulary. Go and read about Diodes

* Diode
* Anode
* Cathode

Once you have that, understand the function. It is a Check Valve. Once you have that... realize that a mosfet is nothing more than a really good diode with a magic button. If you press that magic button, then the diode will conduct from the Cathode to the Anode.

... A body diode in a mosfet always conducts from Source to Drain via the body diode, but of course you have a parasitic loss right there of V(forward). This will result in I*V heating and is a bad thing

ANYWAY

I run my meter along the fets under the board. Really you only need to take 3 readings, as they are paired in groups. Put the red probe on the Source and the black probe on the Drain, that should BEEP. The resultant beep is not of all that much interest... (the Vforward) but... it should beep.

Alternately you can take a resistance reading. This should not be short (zero ohms) or close to short.

-methods

 

[methods]

Controller checks out

Now we have to reverse engineer it :x

Let me go take some pictures.
For this, usually I use
* Binocular Microscope
* 40X Loop

For lesser things,
* Magnifying lamp - so a 4" magnifying glass surrounded in LED's. Old units are better than new.
* Android camera set on Zoom***

When I am in the bush, I put the Camera Phone up to the 30X or 40X loop and shoot thru that.

So
That is where the pictures are coming from. My eyes were shot last year (literally, dont ask) so I wear glasses as well. I will try not to take pictures that are ... eh... in focus for me

OoO (Order of Operations)

* Identify Power Rail
* Identify Shunt
(done)

* Identify 3 phase leads
* Identify 5 hall leads
(done)

Now here is the trick*
You have to get into the mind of the PCB designer. This is like translating. Go look at the labels next to these two things that you have surity about... and see how they are marked. If you can translate that into a pattern, you can more easily decode the other connectors without a bunch of reverse engineering.

Doing that now

-methods

 

[methods]

Man, wish I had my mouse. Kid took off with it.

And... OMFG -> 12 accounts of various types, always forgetting my passwords...

Ok
Got the pics sent off

* Take pics with Zoom, try it and you will be surprised
* Compress them ON THE PHONE using a free tool. I use Lit Photo
* Batch-send them or whatever you want to do

I use Google Photo's to open the output folder of Lit Photo and then I "Create Link", from there I email myself the link, pull them down in zip, then use them here on my PC

Alternately
You can transfer all the photos in high resolution and use IrfanView or the like to compress local. All up to you.



Above, we see the BIG RED WIRE (Pack Positive)
It is marked "VB+"
We translated that to "Vbattery Positive"

V is for Voltage
B is for Battery
+ indicates polarity

By contrast, there could be many other things...



Ok, VB-
Makes sense right?

Now WTF is THAT!!!



In isolation I would tell you it was an antenna. In relative terms I would say some designer tried to get equal trace lengths.

* Chip is on the middle of the board
* Long way to phases A and B
* Short way to phase B

To keep all the traces same length, they did a little wiggle. Really quiet silly at the speeds we are running, but - ok - that is actually pretty legit.

Eh?

-methods

 

[methods]

I dont feel like being particularly ... complete... at the moment, so I will skip all the redundant pictures showing that the phases are marked ABC etc.

On to Hall wires
There are 5 of them
RED and BLACK are 5V power
YGB are going to be the toggling halls
Single white wire left over, lets use our ...



I am not getting out Paint - use your imagination. Along the left column we see

* SA
* SB
* SC

Thats Blue, Green, Yellow
So... what the hell does the S stand for?

Sensor?
Sense?
... it is not hall, eh... Sinusoidal? (nope, would be 2 pins or 4 pins)
Uhoh - lets look at the white pin



This is from the top (above)
You might guess that right after the hall pins would be the white pin cabled with them. It is marked TA and you might guess Temperature Ambient.

This is why you need LOTS of clear pics, with the wires pulled away. Not the case! The white wire sent off to the motor actually goes to the next row over and is marked "CR"

sigh... CR?
fuuuuuuuu

We think it is temperature, relative to black wire.
It could be something else, duh know.
Uh...

More will be revealed.

-methods

 

[methods]

Rest of the pics?
Off to the trash. I have to go map some other stuff.



Ok, this hot pile is popular. Two things running to it.
Marked "VK+"

2pin cable leaves the box
Black and White
White goes to VK+
Black goes over to VB-

Ok...

another 8 pin cable with a bunch of shit on it... hits that too. Blue wire. Other wires hit

(OMFG - put on my glasses... I could have sworn this board was invisible... sigh... now I can see it clearly)

P1 green wire
LED yellow wire
GND black wire (that is 5V ground... they ARE different!)
BKL white wire
SP Gray wire
5V+ goes to a Brown wire
Oh shit... red wire goes over to VB+

That makes 8... and... they are running PACK out there (sigh) has to go to some kind of controller-bob thing (again) sigh... these things can run you into trouble as they may require any number of undulations.

* May require a push-button start
* May default to some lame mode...

PAUSE

Some frocker is trying to hack my Amazon account again.

RESUME

Never mind, father in law.

... (have all your devices text and email you*)

-methods

 

[methods]

Ok, so... some pile of wires goes off to some device that is similar to a CA but is lame.

* No shunt

But... who knows, maybe the chip manufacturers have finally figured out that they should add an isolated comms port that spits out the current readings. Whatever.

Ok
So... no help there. I will say that it is asking for it to send internal hv out on little connectors. Eats things up. .. but these are water tight.

Ok
We are solving for VK+
Two wires landing on it
One from a Control Pad, one from a 2-wire deal, where the other is pack negative

What do we know?

* Our reference is Battery Negative (as opposed to 5V negative)
* VK+ goes into the anode of a rather large diode
* Hits "AR-IN, which is a big power resistor

All that looks like the regulator part of the circuit. Ok... fine. In one case we can ground this input. In another, unknown. Notice that we have not looked up the controller, read other threads, asked for help...

because

The point is not to actually solve this. The point is to learn how to solve on your own. You do it by... doing it. It is a different part of your brain that SOLVES than WATCHES OTHERS SOLVE. Youtube will leave you as an f'ing retard if you let it. Just lay down and get f'ed. I am serious man... you have to get in there and keep your brain working in the right way.

* Open your mouth and wait for it to get packed
* Chomp around like PacMan

Right now I am chomping around like PacMan teaching my brain that I have to solve the problem. Nobody else is going to solve the problem. Mixed in?

Random Reward
Right?
... because it is not light I am doing this in a basement. I am doing it public... so... on some level... I know that someone might pop up and just spill the beans. That is a Random Reward situation, and it works.

Third... I know I can go search for answers
Maybe I will.
I usually avoid it because it is a wicked waste of time, usually I find nothing but questions, often I get dissapointed.

So
The old way
Lets mark off the rest of the wires and see if we can decode what the silkscreen means on the important ones.

-methods

 

[methods]

2 pin XT60
Power and Ground

9 pin rubber
To motor
3 phase
5 hall
1 unknown (likely temp)

8 pin rubber
Off to some sort of control pad, no doubt... where we will find how to turn it ON and OFF. I have another brand, similar to this... I will look to that for tips. On that one I have to do TWO things (sigh). Power it on with a press, then move it into a state with another press. Two presses - fine.

2 pin rubber
The Black and White from earlier
One on Battery ground, one on VK+

3 pin rubber
RED
BLACK
WHITE

White goes to TA, in the earlier pics. The one next to the hall signals. Throttle A is what I will call that, since Red goes to 5V and Black goes to 5V ground

We DO NOT
Call 5V ground and Pack ground the same. It is about the way the currents flow thru the board. More on that later.

-methods

 

[methods]

Ok
All wires are accounted for

* Battery Wires
* Phase Wires
* Hall Wires
* Throttle Wires
* Controller Wires

Now... to make sense of it. Figure out the Controller wires better.... as... best to do that now before we start chopping it all up. The wires are pinner and they are going to be problematic. Not like I can easily just cut the cables and tap. They are ... eh... I dont know... much smaller than 22awg, maybe 26, maybe smaller. Going to be Jenkem

https://en.wikipedia.org/wiki/Jenkem

Just in case you did not know the term Jenkem. It was a big deal in the 90's... kids barfing on the streets and such. I made a few batches, did nothing for me. Make you a batch if you like... maybe it has to be someone elses? Dont know, dont care.

-methods

 

[methods]

Here is the meat and potatoes, for those reading in the future

8 pin connector, that is what it will take to light this thing off.

Green, goes to P1
Yellow, goes to LED
Black, goes to digital Ground
Gray, goes to SP
Brown, goes to +5V
Red, goes to Battery Positive
Blue, goes to VK+ over by the regulator... where another pair can presumably apply ground.. if its a button.. or... other feature?
White, goes to TA

now reorder those
Always re-order when you are solving

______________________________
Red, goes to Battery Positive

Blue, goes to VK+

Brown, goes to +5V
Black, goes to digital Ground

Yellow, goes to LED

Green, goes to P1
Gray, goes to SP
White, goes to TA

Ok... sigh... what to do with that.

SP can mean speed and that would make sense.
P1.. sounds like a setting
TA, on this? eh... dont know yet

LED - maybe error codes?

More work to do obviously

-methods

 

[methods]

Now we look into the chip.

-methods

 

[methods]

You can do this. It is not rocket science. To pick off that part number I

* Waited until 1620 (aka 4:20) and did not smoke a bowl (if you are "smoking bowls", well.. there you go)
* Put the unit in direct sunlight
* Set the Pixel XL to full zoom
* Moved it around till I could see it
* Took the picture
* Took a screen shot of that (hopefully to reduce size and strip my location data - who knows)
* Emailed it to myself
* Downloaded it
* Pushed it up here

Lots of steps
Shit does not get done in 5 minutes like the Youtube clowns make you think it does. They may be able to INFORM you in just 5 minutes, but this work takes 5 hours.

-methods

 

[methods]

This is the specific chip
https://www.infineon.com/cms/en/product/microcontroller/legacy-products-c500-c166-xc166-audo1-family/xc800-i-family-industrial-multimarket/xc83x-series-industrial-multimarket/saf-xc836-2fri-ab/

Many uses.
Now we have to track down the pinout, figure out what multiplexed options each pin has, and... how this particular designer used the chip.

Sigh...

-methods

 

[methods]

Here is a 57 page datasheet in English.
The other language is Chinese
Better learn to speak it. . .

https://www.infineon.com/dgdl/Infineon-XC835_XC836-DS-v01_04-cn.pdf?fileId=db3a30432ba3fa6f012baa1500492fd3

-methods

 

[methods]

Normally I do a bunch of photoshop work, (paint really) to call things out and make things clear. Little grom stole my mouse so I am running out of mojo over here. Damn touch pad is making my hands ache.

* Sore hands
* blurry eyes

This is where you are headed. At least I can still poop.

... Now we have to "ring out" our pins of choice using the Fluke Needle Probes. You have to have the needles for these fine tip chips. IF you go fat-finger in there with the full size probes you are just wasting time. Here is a link

https://www.digikey.com/en/products/detail/pomona-electronics/6262-02/737621?

Put those on your meter, stab yourself 42,000 times, then send methods $5 for setting you straight

-methods

 

[methods]

You ring something out by

* One needle probe on the pin of interest
* Go for broke and "rake" all the pins of the chip

If
The pin routes straight there
Then
You can finger out what it is doing

You can measure up to 5V to look for a PullUp resistor, or down to Digital Ground to look for a pull down. Those will be something like 5K or 10k

Watch this

-methods

 

[methods]

Bastards!
Every single pin goes thru some filtering.

Should have known when I saw the equal length traces*

So...
Somewhat professional design. Going to take a bit more. In most cases, these PCB are 2 layer only. In that case you can very easily track where things go. If they went 4 layer (they should NOT have) then it gets a lot more complicated. You may have to permutate and things can go into a middle layer and pop back up ANYWHERE on the board.

Lets pick one, trace it home.

Big, wide, buss of a mess comes from the chip over to the bulk of the wire lands. Those go thru a network of voltage dividers, inline resistors, and a diode or two.

Lets follow P1
Goes to a 1.5K resistor, by labels R14 and R15, my guess is that it is R15
From there, goes to the bottom left of the chip

From this angle, chip pin one is bottom right, so 1 pin across from pin 1
Thats pin 28



that pin can be A LOT of things. . .

-methods

 

[methods]

* Pin0.7
* SCL_3 (the third I2C, SCL line)
* Line7 (have to read the datasheet)
* TSIN7 (have to read the datasheet)
* TXD_5 (that would imply the 5th UART, TX pin)
* COUT63_0 (your guess is as good as mine)
* COL3_1 (again... gonna have to read the FULL datasheet)
* COLA_3 (not one I know of)

Now look here
This datasheet is like 50 something pages. That is not the datasheet :lol:

No.. Not even close.
The real datasheet will be something like 350 pages. . . where... it will explain exactly how to set the function of all these multiplexed pins, program for the core, etc. This is very, very, very complicated. . . and I can do it all day every day. Much harder to reverse engineer than to do from scratch (just FYI)

So
We ... have a 1.5K in series. That should tell us something. I never run series resistance in any of my comms... so... I doubt it is an active coms line. Could be, ... as this IS a high noise environment.

So
What was the pin name again? P1

So... there ya go
That is where P1 goes, for all that it will help you. Goes to pin 28 via a 1.5k resistor and I did not check for other things. IF I did... I bet you the following is true

* You will find a cap to ground
* That makes a single Pole low pass filter (LPF)
* That drains off noise coming from outside (filters)

This is what I do when I want to read something noisy, like a temp sensor in a motor.

So.. P1 heads off to this control board (presumably) that we dont have.
If it DOES have a LPF then it is highly probable that it is in INPUT and not an OUTPUT

THAT
Is how you have to solve...

BY
Breaking things down into binaries...

* Input or Output
* DIO or Comms
* Analog or Digital
* Battery ground or digital ground

Like that
very painful
very slow

... and that is why the earlier controllers were so popular. They could be solved without this level of ... fussing.

...
I
Am going to go look at my other controller. There is a FREAK cHANce that the control board I have will be the same as this one, and in that case, I can just reverse engineer that end, and make this MUCH EASIER

Pieces to the puzzle man
Give me one piece, take me 3 months. Give me 2 pieces, take me 3 hours. Give me 3 pieces, take me 3 minutes.

Simple like that. Keystones.

-methods