Index

About Tongsheng TSDZ2 mid drive motors

  1. Motor controller
    1. log
  2. LCD - VLCD5
  3. Motor
  4. Torque sensor and PAS

Datasheets and application notes

  1. STM8S105S4T6

Development tools

Various

  1. 2018.04.18 - original firmware and debug session using OpenOCD
  2. 2018.04.19 - First code runs: Hello world
  3. Math operations CPU time

2018.04.18 - original firmware and debug session using OpenOCD

The connection for firmware programming and debug are available on the connector for the speed sensor -- see below more details.

The original firmware was not read protected. I was able to read the option bytes, firmware, EEPROM and finally connect with OpenOCD for a debug session.

TSDZ2 motor controller:
images/3-1.png

Connection of STLinkV2 clone to the controller, on the wires available on the speed sensor connector:
images/3-2.png

The connections to STLinkV2 clone:
Purple wire: RST
Orange: GND
Black: SWIM
images/3-3.png

Reading Option Bytes and original firmware with stm8flash and connect a debug session using OpenOCD:
images/3-4.png

Reading EEPROM:
images/3-5.png

Original Option Bytes and Firmware:
•
Linked file: TSDZ2_original_firmware_protected_option_bytes.bin


Contents of the option bytes of the read file:
images/3-6.png

Read original firmware file:
•
Linked file: TSDZ2_original_firmware.bin


Disassembled firmware
The firmware was disassembled using Naken ASM, using the following command:
./naken_util -disasm -stm8 -address 0x8000 ./TSDZ2_original_firmware.bin > ./TSDZ2_original_firmware.asm

•
Linked file: TSDZ2_original_firmware.asm


EEPROM:
•
Linked file: TSDZ2_original_firmware_eeprom.bin