Motor controllerMotor controller with the “epoxy” removed from the microcontroller.
Although you can find online versions of the controller for 36V, 48V or 52V, the controller is just the same but with different configurations on the firmware.
• Controller can run the motor from 20V battery input up to at least 60V (this values were tested)
◇ 20V will work for a 7S battery (min voltage per cell = 2.86V)
◇ 60V will work for a 14S battery
◇ controller capacitors on input voltage line are rated at 63V
• wheel speed sensor cable
◇ this cable carries the wires for STLinkV2, that is used to program and debug the firmware
◇ this cable carries the wires for the wheel speed sensor
◇ list of the wires and functions:
▪ orange wire | GND | used for: STLinkV2; wheel speed sensor
▪ brown wire | VCC | used for: STLinkV2 (optional); wheel speed sensor
▪ purple wire | RST | used for: STLinkV2
▪ black wire | SWIM | used for: STLinkV2
▪ white wire | wheel speed sensor | used for: wheel speed sensor. This signal is active low, meaning that when magnet is not in front of the sensor, this wire has 5V and with magnet in front, this wire has 0 volts.
▪ green wire | 6V for lights | 6V only when display back light is enabled
• LCD cable
◇ this cable carries the wires to power on/off the motor controller and the wires for UART TX and RX that communicate with the LCD
◇ the motor controller can be enabled by simple connect green wire to white wire and this way there is no need to use LCD
◇ list of the wires and functions:
▪ green | P+ | battery voltage!!
▪ black | GND | ground
▪ white | Vin | ground when LCD disabled and P+ (battery voltage) when LCD is enabled
▪ brown | UART TX motor controller |
▪ orange | UART RX motor controller |
▪ purple | brake | this signal is active low, meaning that when brakes are not active, this wire has 5V and brakes active, this wire has 0 volts.
Note: throttle works on original firmware even if you bought a version without throttle and in this case you just need to connected the throttle wires to the controller board.
Read more here.
Original Option Bytes:
|Linked file: TSDZ2_original_firmware_protected_option_bytes.bin|
Original firmware file:
|Linked file: TSDZ2_original_firmware.bin|
|Linked file: TSDZ2_original_firmware_eeprom.bin|
Disassembled original firmware
The firmware was disassembled using Naken ASM, using the following command:
./naken_util -disasm -stm8 -address 0x8000 ./TSDZ2_original_firmware.bin > ./TSDZ2_original_firmware.asm
|Linked file: TSDZ2_original_firmware.asm|
Torque sensor reading
The torque sensor signal is measured on ADC channel 3. There is a specific circuit to excite the primary coil of the torque sensor and it needs a pulse signal that is generated on PD3 and has a period of 20us and a 2us Ton:
The mosfet driver is the FAN7888 (with a clear label "EBIKE"), from OnSemi:
|Linked file: FAN7888-D.pdf|
|Linked file: FAN7888.pdf|
K80E08K3 Toshiba Mosfets
• mosfet N
• Max drain−source voltage: 75V
• RDS (ON) = 7.5 mΩ
|Linked file: K80E08K3-mosfets_toshiba_datasheet.pdf|
XL7005: seems there are 2 of this ICs being used, one on top of the PCB and other under.
• 150KHz fixed frequency PWM buck (step-down) DC/DC converter, capable of driving a 0.4A
• Wide 5V to 80V Operation Voltage
• Output Adjustable from 1.25V to 20V
• over current protection function is built inside
|Linked file: XL7005A_datasheet.pdf|
LM358: Low-Power, Dual-Operational Amplifiers.
UART communication to LCD
Seems that packages are sent at about every 60ms.
The baudrate is 9600 bps.
Example of data on microcontroller UART TX pin that flows to the LCD:
Original firmware: Example of a log from data on microcontroller UART TX pin that flows to the LCD:
07 07 57 43 06 00 00 00 00 07 07 57 43 07 00 00
00 00 07 07 58 43 07 00 00 00 00 07 07 58 43 07
00 00 00 00 07 07 57 43 07 00 00 00 00 07 07 58
43 07 00 00 00 00 07 07 58 43 06 00 00 00 00 07
07 57 43 07 00 00 00 00 07 07 58 43 07 00 00 00
00 07 07 58 43 07 00 00 00 00 07 07 58 43 07 00
00 00 00 07 07 58 43 06 00 00 00 00 07 07 57 43
06 00 00 00 00 07 07 58 43 06 00 00 00 00 07 07
serial is 9600 baud, messages are for example:
59 40 00 1C 00 1B D0
1. fixed/startbyte = 59?
2. byte contains flags for the selected step,light and 6kmh. 40=01000000=step1. bits from left to right as i know: unknown,step1,6kmh-active,off,step4,step3,step2,headlight
3. not sure
4. wheel size, 1C hex = 28inch
5. not sure
6. max speed, 1B hex = 27(kmh?)
7. 1byte checksum
43 00 01 51 51 00 07 07 F4
1. fixed/startbyte: 0x43
2. battery level, 0=lowest (about 33V if i remember right), 0A=10 is max due to LCD (about 38V) but can be higher
3. motor state, but not sure. 01 was when off and i have seen 0D or 05 when 6kmh mode. 0x0C when motor is running.
4. not sure, seems to keep constant value of 0x59
5. pedal torque sensor value; 51=idle
6. error code, for example 08 like shown in display for low voltage
7.&8. wheel time revolution: see bellow
9. 1byte checksum as described here: https://www.lammertbies.nl/comm/info/crc-calculation.html
The 7.und 8. byte are a 16bit integer, so e.g.:
0707(hex) = 1799(dec)
6C00(hex) = 108(dec)
8901(hex) = 393(dec)
And this is basically the time that one revolution of the wheel takes in ~2,04ms steps.
So for a 28" wheel (~2,24 meters per rotation):
6C00(hex) = 108(dec) = 220,32ms = 36,5km/h
8901(hex) = 393(dec) = 801,72ms = 10,0km/h
But the LCD seems to use another value, so it is a little bit of.
I generated pulses using a AVR/Arduino to simulate speeds and to calculate the 2,04ms. I think that number comes from CPU clock + timer-prescaler or so... correct me if I'm wrong.
It looks like the possible values are from 0 to 1799.
But in reality, the display just accepts values between 30(~131,4km/h) and 1750(~2,2km/h).
Values >1750 or <30 just shown 0,0km/h. And the highest speed value the display shows is 99,9km/h anyway...
(I did send custom messages to the LCD to test this.)
i haven’t installed the motor yet, so my test possibilities are limited.
but i'm thinking about building a data logger.
and i think it is interesting that the magnet count setting at the XH18LCD is not transferred to the motor which decides to reduce its speed alone. so more than one magnet might restrict the max speed.
PWM signals for motor control
PWM frequency of about 16kHz:
Max duty-cycle value:
Dead time of 3.2us, example of PWM channel 1 and PWM inverted channel 1:
Sinewave or SVM PWM scheme:
Example of PWM channel 1 and PWM channel 2, center align PWM: