====== BOSCH WIP ====== ===== Hardware ====== ==== Battery Management System (BMS) ==== Bosch Battery Packs come in different types and capacities but the current assumption is that they are all based on Component Type BBP250. So far two similar Power Architecture MCU types have been identified: * NXP [[https://www.nxp.com/docs/en/product-brief/MPC5602DPB.pdf|MPC5602DPB]] * ST [[https://www.st.com/en/automotive-microcontrollers/spc560d40l1.html|SPC560D40L1]] === PowerPack === {{https://i.imgur.com/EPoqXly.jpg?300}} ^ Wh ^ Type ^ Code ^ MCU ^ BMC ^ | 400 | Frame | BBS265 | | ISL9412 | | 400 | Rack | BBR265 | | ISL9412 | | 500 | Frame | BBS275 | | | | 500 | Rack | BBR275 | | | === PowerTube === {{:lab:wip:uebersicht-h-oder-v.jpg?350|}} {{https://i.imgur.com/psoWrFf.jpg?300}} ^ Wh ^ Type ^ Code ^ | 400 | Horizontal | BBP282 | | 400 | Vertical | BBP283 | | 500 | Horizontal | BBP280 | | 500 | Vertical | BBP281 | | 625 | Horizontal | BBP290 | | 625 | Vertical | BBP291 | === Battery Terminal === {{:lab:wip:bosch_powerpack_socket.png?400|}} === Charging === The Batteries can be charged with non bosch chargers in the 36V LI-ION regime. A separate 5V supply (DC-DC step down) is needed to trick the BMS into charging mode. {{:lab:wip:bosch-charger-pinout.jpg?400|}} ==== Drive Unit (DU) ==== ^ Gen ^ Name ^ Code ^ MCU ^ | 2 | Active Line | BDU250C/BDU255C | | 2 | Performance Line Cruise | BDU250P | | 2 | Performance Line Speed | BDU290P | | 2 | Performance Line CX | BDU250PCX | | 3 | Active Line | BDU310 | | 3 | Active Line Plus | BDU350 | | 3 | Performance Line | BDU365 | | 4 | Performance Line Speed | BDU490P | SPC56EL60L3 | | 4 | Performance Line CX | BDU450CX | SPC56EL60L3 | | 4 | Cargo Line Cruise | BDU450CX | SPC56EL60L3 | | 4 | Cargo Line Speed | BDU490P | SPC56EL60L3 | https://www.st.com/en/automotive-microcontrollers/spc56el60l3.html ==== Display/Human-Machine-Interface (HMI) ==== === Purion === {{:lab:wip:purion-pcb-top.jpg?325|}} {{:lab:wip:purion-pcb-bottom.jpg?320|}} ===== Software ===== Bosch Diag Patch 7.5.3.0 https://0x0.st/oH6L.zip Bosch cff2 pull https://0x0.st/oH6z.cff2 ==== CAN ==== id len period src data (big endian, i.e. MSB first) 0x01c: 8, 1 s D0-D3 uint: uptime [ms] (rising data with 1000 inc)? D4-D7: const 00 00 00 00 0x037: 3, 100ms hmi D0: const 00; D1 bool: light: 0x80 on, 0x00 off D2 bool: walk: 0x01: on, 0x00 off 0x03b: 4, 500ms D0 uchar: support 9: off, 1: eco, 2: tour, 3: sport, 4: turbo D1 uchar: at boot ff, otherwise 00 D2-D3: const 00 00 0x03c: 3, 500ms D0 uchar: at boot 00, otherwise 01 D1 uchar: at boot 00, otherwise light: 0x01 on, 0x02 off D2 uchar: at boot 00, otherwise walk: 0x02 on, 0x01 off 0x048: 6, 10ms du D0-D1 short: torque [1/10 Nm] D2-D3 ushort: time [1/10 ms] 0x04a: 1, 10ms bat D0: const 00 not fully cyclic: always sent for the first 4000 or 4096ms, then disappears; sometimes reapears ??? 0x059: 8, 100ms D0-D7 ???: const 01 01 00 1e 00 64 00 00 0x05a: 1, irreg hmi D0: const 00 sent when resetting remaining range on intuvia 0x08c: 1, 200ms bat D0: const 00, 23 or 25 (alive from battery? value mostly 0, sometimes same as D0 from previous id 0x352 frame?) 0x09a: 1, 200ms D0: const 00 (alive from motor?) 0x09b: 1, 200ms D0: const 00 (alive from HMI?) 0x0c5: 3, irreg, only when in intuvia base settings menu D0 uchar: type; D1-D2 ushort: data; D0=01: const 00 00, D0=02: adjusted wheel circumference [mm] 0x0c6: 8, irreg, only when in intuvia base settings menu D0-D1 ushort: mininum; D2-D3 ushort: maxinum; D4-D5 ushort: default; D6-D7 ushort: adjusted wheel circumference [mm] 0x0c7: 8, 100ms D0: const 00 D1 uchar ???: c8 = 200, less when battery runs low, same as 1/100 * 0x111 D2-D3 D2-D3 ushort: remaining battery charge in Wh, correlating with 0x111 D6, at boot ff ff D4: const 00 D5 uchar: last full battery charge [Ah]; same as 0x111 D5 D6-D7: const 00 00 0x0d0 (DU SW < 1.6.0.0): 4, 100ms D0-D1 short: gforce z [1/100 m/s²]? values around 981 D2-D3 short: gforce x [1/100 m/s²]? values around 0 0x0d0 (DU SW 1.6.0.0): not sent 0x0d0 (DU SW 1.7.0.0): 8, 20ms; D0-D1 short: gforce x [1/100 m/s²] values around 0 D2-D3 short: gforce z [1/100 m/s²] values around 981 0x0d1: 2, 100ms du D0-D1 ushort: speed [1/100 km/h] (0 when pushing bike backwards) 0x0d2: 4, 100ms du D0: const 00; D1 uchar: cadence [1/min] D2-D3: const 00 00 0x0d3: 6, 100ms du D0-D1 short: motor torque at chaindrive actual [1/100 Nm] for torque sensor see http://www.pedelecforum.de/forum/index.php?threads/performance-active-motor-innenleben.26492/page-8#post-711856 D2-D3 ushort: motor torque nominal [1/100 Nm] (max eco: 0x0602=1538=38.8Nm, tour: 0x06f9=1785=45.0Nm, sport: 0x08f0=2288=57.7Nm, turbo: 0x0a8c=2700=68.0Nm, official 40/50/60/75) D4-D5 short: motor rpm [1/min], negative when pushing bike backwards motor transmission to chaindrive is 16:47 * 19:77 = 304:3619 = 1:11.9 pedal transmission to chaindrive is 33:14 * 31:29 = 1023:406 = 2.52:1 motor rpm = (3*11*11*31*47)/(32*19*29) = 528891/17632 = 29.996 times cadence see http://www.pedelecforum.de/forum/index.php?threads/performance-active-motor-innenleben.26492: images in post #1 http://www.pedelecforum.de/forum/index.php?threads/performance-motor-innenleben-so-sollte-es-eigentlich-nicht-aussehen-o.40234/page-5#post-663475 http://www.enbicielectrica.com/t5229-despiece-y-mantenimiento-motor-bosch-performance-2015-tutorial#94585 (motor shaft [1] 16 against [2] 47) http://www.enbicielectrica.com/t5229-despiece-y-mantenimiento-motor-bosch-performance-2015-tutorial#93930 ([2] 19 against [3] 77) but: renderings in this video show 16:48 * 25:100 = 1:12, differing from actual version: https://www.youtube.com/watch?v=-5WxMZLqPE8 0x0d4: 4, 100ms du D0-D1 ushort: motor power draw [1/10 W] correlating with 0x101 battery power draw (slightly less) D2-D3 ushort: const, power draw for max. bar graph display [1/10 W]? OWL active: 0x0d7b = 3451, Gene performance (with Nuvinci?): 0x0dfc = 3580, performance cx: 0x1220 = 4640, at boot 0x0000 0x0f1: 7, 10ms bat D0-D3 ???: const 00 00 01 01 D4 uchar: battery depth of discharge in % (0: battery full, 100: empty), adds up with 0x111 D6 to 100, at boot fe and ff D5: const 7f, OWL active 7f, but Gene performance ff ??? D6 uchar: 98, d8 if battery at or below 20%, at boot 10; OWL active and Gene performance 9a ??? 0x101: 8, 500ms bat D0-D1 ushort: status, 0:run, 0xffff: charge D2-D3 short: current [mA], neg. when charging D4-D5 ushort: power [1/10 W] D6-D7 ushort: voltage [mV] 0x111: 7, 100ms bat D0-D1: const 00 00 D2-D3 ushort: battery discharge limit indicator: normally 4e 20 = 20000, less when battery runs low D4: const 00 D5 uchar: last full battery charge [Ah]; 8a, 89, 87, 86 changed after charging completely empty battery, OWL active and Gene performance 72 (400Wh battery) D6 uchar: battery state of charge in % (0: battery empty, 100: full) 0x131: 8, irreg hmi and bat D0: const 00 D1 uchar: 01, at boot 02, in settings when entering software versions 05 D2-D6: const 00 00 00 00 00 D7 uchar: 00, 01, 02, 03, 08, 09, 0a, 0b: button press/release (controller plus, info, minus, walk, intuvia reset, info, light, intuvia or battery on/off) 0x170: 8, 5 s bat D0-D1 ushort: motor temperature [1/100 K] D2-D7: const 00 00 00 00 00 00 0x202: 8, 500ms D0-D3 uint: total distance [m] D4-D7 uint: remaining range [m] 0x203: 8, 500ms D0-D3 uint: total operation time [s] D4 uchar: remaining battery charge in % (same as 0x111 D6), at boot 0x80 D5-D6 short ???: related to speed and support; oversampled, value changes max. once per second support off: 0 if speed 0, 0xf424 if speed > 0 0x0000, 0xf424, 0x0082, 0x01a6, 0x0092, 0x0135, 0x007e, 0x00e6, 0x0e43, 0x0091, 0x03f2, 0x010d, 0x023d, 0x0137, 0xf424, 0x007d, 0x0097, 0x00b9, 0x00bc, ... D7 uchar: 80 if support is off due to empty battery, otherwise 00 0x205: 8, 100ms du D0: const 00 D1 uchar: gear shift recommendation? 00: none, 9c: lower gear (cadence below 50 rpm), 64: higher gear (cadence above 120 rpm) D2-D7 ???: const 00 00 80 00 00 00 0x210: 6, 1 s hmi D0 uchar: year D1 uchar: month D2 uchar: day D3 uchar: hour D4 uchar: minute D5 uchar: second 0x211: 8, 500ms D0-D7: const 00 00 00 00 00 00 00 00 0x220: 8, 100ms D0-D3 ???: const 00 00 03 00 D4 uchar: related to speed sensor: 0x80 at some speed steps when decelerating, 0x00 else (restarts auto-off timer?) D5-D7: const 00 00 00 0x221: 8, 100ms D0-D3: const 00 00 00 00 D4-D6: const 00 13 88; 0x1388 = 5000 D7: const 00 0x2aa (PP SW 1.7.1.0): 8, 500ms bat D0-D1 ushort: battery case temperature [1/100 K] D2-D3 ushort: voltage [mV] (slightly higher than 0x101 D6-D7) 0x351 (before eMTB): 8, irreg (not from bat) D0-D7 ???: const 30 08 14 00 00 00 00 00 0x351 (after eMTB): not sent 0x352 (PP SW 1.5.2.0): 8, irreg bat battery statistics, head frames in 1 sec. timegrid, with optional data frames following in 30ms intervals for data structure see code of CanState352 0x352 (PP SW 1.7.1.0): not sent ===== Links/Refs ===== * https://github.com/gregyedlik/handshake * https://mhhauto.com/Thread-Bosch-E-bike-Diagnostic-Tool-IBD-Software?page=2 * https://cyclurba.fr/forum/702597/logiciel-diagnostic-bosch-ibd-dongle.html * https://cyclurba.fr/personne/personne_profil.php?personneID=21636&pseudo=Bitslover101 * https://ufile.io/i3nr7xmk Bosch eBike Diagnostic v3.8.1.0.1 * https://ufile.io/hsw70fiy Bosch eBike Diagnostic v6.2.5.0 [[https://orpatreanufin.com/|Or Patreanu Finance ]]