About Tongsheng TSDZ2 mid drive motors

  1. Motor controller
    1. log
  2. LCD - VLCD5
  3. Motor
  4. Torque sensor and PAS

Datasheets and application notes

  1. STM8S105S4T6

Development tools


  1. 2018.04.18 - original firmware and debug session using OpenOCD
  2. 2018.04.19 - First code runs: Hello world
  3. Math operations CPU time

2018.04.18 - original firmware and debug session using OpenOCD

The connection for firmware programming and debug are available on the connector for the speed sensor -- see below more details.

The original firmware was not read protected. I was able to read the option bytes, firmware, EEPROM and finally connect with OpenOCD for a debug session.

TSDZ2 motor controller:

Connection of STLinkV2 clone to the controller, on the wires available on the speed sensor connector:

The connections to STLinkV2 clone:
Purple wire: RST
Orange: GND
Black: SWIM

Reading Option Bytes and original firmware with stm8flash and connect a debug session using OpenOCD:

Reading EEPROM:

Original Option Bytes and Firmware:
Linked file: TSDZ2_original_firmware_protected_option_bytes.bin

Contents of the option bytes of the read file:

Read original firmware file:
Linked file: TSDZ2_original_firmware.bin

Disassembled firmware
The firmware was disassembled using Naken ASM, using the following command:
./naken_util -disasm -stm8 -address 0x8000 ./TSDZ2_original_firmware.bin > ./TSDZ2_original_firmware.asm

Linked file: TSDZ2_original_firmware.asm

Linked file: TSDZ2_original_firmware_eeprom.bin