Zweiter Frühling für ION-Antrieb --- Sparta, Batavus, Koga ...

[Mike747]

The motor should be able to store 2 display codes, the original and an extra one, to be programmed by the dealer. They can probably be erased or replaced by other display codes.

If you want to visit a dealer (to pair a display), you can also ask:
*"update the software" (ride program). The ride programs in the motor may be changed a bit (maybe this replaces all the software in the motor or it wil replace at least a part of it).
*pair a CU3 display with a bike that had a CU2 display before. The communication of the CU3 is slightly more complex and runs on 19200 Baud. In this case the software in the battery needs to be replaced. BUT: this requires a somewhat "newer" banana-battery. It should be PMU2 (from 2005 they all are). Also it could be that the serialnr of the pack should start with G2..... or higher; most packs are G1.
*not sure about this: With an XHP motor and CU3 display, either 3 or 5 supportmodes should be possible. I am not sure if the toprun motor can also support 5 modes. The dealer can switch the whole system between 3 or 5 modes. Probably the software in the motor as well in the battery-pack is replaced or modified.

 

[Hamburch]

Ich finde super was ihr hier macht! Weiterhin viel Erfolg!

 

[Mike747]

Successful again! This time I made a ride outside for 30 minutes (). All three supportmodes worked fine, no hiccups.

This is what my "outdoor-test-setup" looks like:

It is not much more than (a bike and) an ESP-board and a step-down convertor combined with some plug-and-play wiring and way to many tie-wraps .
All power is drawn from the original banana battery ("+" from the fuse-holder and "-" from the AMP-plug).

 

[void-spark]

Didn't die, slowly polishing up the code to be a bit better, and drive the display too, but it's been a period of many interruptions And I found out our central heating has a maintenance protocol over a 9600 baud serial bus

 

[void-spark]

Well, I tried to be clever, there's a log of pairing the display (recorded at 9600 baud) here:
SpartaIonStuff/LOG00003.TXT at master · void-spark/SpartaIonStuff (binary file)
Still analyzing it, there seems to be a new device '04' talking, which I guess is the PC dongle.

There's a lot of interesting stuff going on, not sure if anything will really be useful yet

This might be interesting (display serial is 1332100000001809, and this is a message from 04 to motor with the serial, after first asking the display for it):

tgtP typ:1 src:04 [10-c140-20-d6] [20]
tgt:04 typ:2 srcP [10-42c8-201332100000001809-9b] [201332100000001809]
tgt:BT typ:0 [10-20-68] - HANDOFF
tgt:04 typ:0 [10-40-40] - HANDOFF
tgt:MT typ:1 src:04 [10-014d-09405b0008081332100000001809-33] [09405b0008081332100000001809]
tgt:04 typ:2 src:MT [10-4201-0900-f8] [0900]

I also wonder about this bit:

tgt:BT typ:1 src:04 [10-2140-06-da] [06]
tgt:04 typ:2 src:BT [10-4220-06-5e] [06]
tgt:BT typ:1 src:04 [10-2140-05-2a] [05]
tgt:04 typ:2 src:BT [10-4220-05-ae] [05]

After this there's a whole lot of bytes not following the usual message pattern, I'm not sure if they make sense though, I wonder if the baud rate was changed for that bit

Those bytes start like so:

00000000 00 2a 84 8c 80 fe 2a 08 19 84 84 08 08 f8 38 80 |.*....*.......8.|
00000010 fe 2a 84 94 3a 6a 08 00 c8 80 08 08 32 fe 2a 84 |.*..:j......2.*.|
00000020 08 4c fe 6a 08 08 18 7a 6a 8c 46 08 18 28 cb 28 |.L.j...zj.F..(.(|
00000030 8b 28 cb 28 7b 10 6f 69 a3 7b 10 6f 69 a3 7b 10 |.(.({.oi.{.oi.{.|
00000040 6f 69 a3 2b 04 a3 7b 10 f3 04 a3 3b 28 7b 10 6f |oi.+..{....;({.o|
00000050 69 a3 0b 29 eb a5 6f 69 a3 7b 10 6f 69 a3 7b 10 |i..)..oi.{.oi.{.|
00000060 6f 69 02 20 2c 7b 10 6f 69 e3 bd 18 00 e7 e3 fd |oi. ,{.oi.......|
00000070 fd 3b bf b1 bf b5 ad 65 61 6d 7b 6b 6d 6f 61 3d |.;.....eam{kmoa=|
00000080 6d 77 67 73 67 67 71 73 75 79 7f 79 7d ff 67 7d |mwgsggqsuy.y}.g}|
00000090 67 67 67 67 7f 67 67 67 67 67 67 67 67 67 67 67 |gggg.ggggggggggg|
000000a0 67 67 67 35 e7 2a 08 18 e8 3a 2a 8c 46 18 18 38 |ggg5.*...:*.F..8|
000000b0 67 67 67 67 67 67 67 67 67 67 67 67 67 67 67 67 |gggggggggggggggg|
000000c0 67 67 71 3b 04 0a 0c 0e 1e 18 46 4a 6c 42 48 5a |ggq;......FJlBHZ|
000000d0 54 10 1e 1e 14 16 d6 56 52 8f a9 9d cc 67 e7 80 |T......VR....g..|
000000e0 ff 4b 73 4b 4f 53 63 7f 53 08 4b 99 6a 08 68 29 |.KsKOSc.S.K.j.h)|
000000f0 89 00 08 1b 08 68 08 08 08 08 00 08 08 e6 7a 48 |.....h........zH|
00000100 b0 ad 92 0c 8e 0d 6f 9f 8e 04 1b fd 00 08 28 00 |......o.......(.|
00000110 66 08 88 40 68 a8 30 68 c8 00 68 f4 38 08 c8 10 |[email protected]..h.8...|
00000120 68 e8 10 68 48 fe 2a 08 18 e8 3a 2a 8c 46 08 18 |h..hH.*...:*.F..|
00000130 08 1c 0a 68 a8 58 08 88 40 c8 d4 50 88 e4 58 a8 |[email protected].|

 

[Hochsitzcola]

After this there's a whole lot of bytes not following the usual message pattern

Maybe the dealer did a firmware update to an component on the bus?
This would explain a lot of bytes with an unknown pattern....

regards
hochsitzcola

 

[Mike747]

Maybe the dealer did a firmware update to an component on the bus?
This would explain a lot of bytes with an unknown pattern....

Very possible.
I wondered: dit the motor also give/communicate its own serialnr or maybe the displays-number(s) the are/where programmed in the motor?
Dit the dealer (also) print a status-report of the bike? This would involve retreving several data from the components.
Was the same kind of display (CU2) paired?

 

[void-spark]

Bah, wrote a big reply a while ago, but seems the browser ate it ;.;

Maybe the dealer did a firmware update to an component on the bus?
This would explain a lot of bytes with an unknown pattern....

regards
hochsitzcola

That's what I'm thinking too, there's a message to the BMS before it, so I expect it to be a BMS update.
Just not sure if it looks like assembly to me, would have to be atmega32 if I'm right
There's just bits where the same byte repeats a lot, and similar patterns, that would seem odd to me.
Also you'd expect some kind of header, or framing, or crc's, which I don't recognize either
But who knows

I probably shouldn't be distracted by it anyways, the other commands are more important

Very possible.
I wondered: dit the motor also give/communicate its own serialnr or maybe the displays-number(s) the are/where programmed in the motor?
Dit the dealer (also) print a status-report of the bike? This would involve retreving several data from the components.
Was the same kind of display (CU2) paired?

I believe I saw a message from the motor with the serial, so I think so, but only had a quick look
So might be able to dig out the existing number too, if that's what you where after
My scripts don't decode any of it yet, and there's a lot of traffic. Will take a long time to pick apart
Not sure what the dealer did, my partner actually took it in. We only asked for the new display to be paired though
It's a CU2 (roundish rectangular one), I made a nice one from two broken ones (The front comes loose if you pry it carefully enough, the glue will break eventually, and after you can superglue it back ).
But there's a lot of commands to/from '04' (the pc I expect), so I think the software actually did a lot by the looks of it

 

[void-spark]

See attachment for all messages (that actually have payload) to/from 04.
Note that the display number (as it's sent over the bus) is: 1332100000001809
Messages that include that are:

tgt:04 typ:2 src:DP [10-42c8-201332100000001809-9b] [201332100000001809] // Display sending it in a reply to PC
tgt:04 typ:2 src:DP [10-42c8-201332100000001809-9b] [201332100000001809]
tgt:MT typ:1 src:04 [10-014d-09405b0008081332100000001809-33] [09405b0008081332100000001809] // PC sending it in a message to motor
tgt:04 typ:2 src:DP [10-42c8-201332100000001809-9b] [201332100000001809]
tgt:04 typ:2 src:MT [10-420c-0800405b081332100000001809-20] [0800405b081332100000001809] // Motor sending it in a reply to PC
tgt:04 typ:2 src:DP [10-42c8-201332100000001809-9b] [201332100000001809]
tgt:04 typ:2 src:MT [10-420c-0800405b081332100000001809-20] [0800405b081332100000001809]

 

[Mike747]

The programming of the displayserial into the motor may be somewhat complex. May involve motor or setup specific variables. Would of course be nice if it can be done (on any motor) with a small command-set .

I wondered if this command would work on any motor to retrieve the stored displaynumbers:
tgt:MT typ:1 src:04 [10-0143-08405b00-a8] [08405b00]
tgt:04 typ:2 src:MT [10-420c-0800405b081332100000001809-20] [0800405b081332100000001809]

 

[Hochsitzcola]

The programming of the displayserial into the motor may be somewhat complex.

Maybe, but this essential, if we want to get independent from the ION peripherals and only keep the motor with the motor controller, like we did for the BionX motor.
Then we have to make the motor controller accept a standard fake display serial....

regards
hochsitzcola

 

[Mike747]

The other way around might also be possible: if we can (like the display) read the displaycode from the motor, we can use that code. No need to reprogram the motor.

 

[Hochsitzcola]

The other way around might also be possible

Yes, but is there a way to make the motor controller tell us, which display serial he expects? If yes, then we can emutalte this serial number of course.

regards
hochsitzcola

 

[Mike747]

I couldn't help myself and I had to hook up a CU3 display to the PC . It gives its serial-code with the same command as the CU2 / 2,5 (twist-off) displays. 10 C1 00 20 03.
The baud-rate is different though: 19200. And in this case the display serial starts with a C. C115400000000510

 

[void-spark]

Cool! And surprising! Different baud rate is not something I expected I think we have one or two of those here, will need to look at them later How did you even find out the baudrate?

 

[void-spark]

SInce there's things on the display I guess you're connected to a BMS too? Or does this display show something even without BMS? I really wonder if the whole bus runs at that speed. Or maybe the display auto senses the baud? So many things to figure out..

 

[Mike747]

The CU3 is a different kind. Thi3rryyzz told me about the baudrate (I would have never figured that out myself ). I would like to investigate further, like how the button poll works. The display has it's own menu, and it looks like the menu button itself, does not even respond/communicate over the bow-bus. Maybe only the +, - and light buttons do (somewhat similar to the smaller displays?). The display does turn on without a BMS and stays alive as long as you keep pressing buttons .

Is it possible to run 2 baud rates simultaneously? Like the motor-communication at "standard rate" (9600) and the display can also use the in between rate (19200)?

When sending the presumed "ask-programmed-display-serial-number" to a toprun motor I did get an answer:
10 01 43 08 40 5B 00 A8
10 01 43 08 40 5B 00 A8 10 42 0C 08 00 40 5B 08 07 39 00 00 00 00 13 81 C9

I do not have the corresponding display for this motor, so I have no clou if the display-serial was send.
I will try this again on a working bike!

 

[Hochsitzcola]

This would solve our problem, with using a non ION on an ION Motor! We could read out the expected display serial and emulate this then ....

Regards
hochsitzcola

 

[Mike747]

It works, I got the right diplay-serialnumber from the toprun motor: 06034085.

I personally like the ION displays (especially the CU3) a lot; the screen is nice and they can be removed, this prevents the screens from being stolen or molested.

 

[Hochsitzcola]

I don't know what is the most often reason why a Sparta or Batavus bike gets scrapped actually.
So if the original ION display is still there and is working, there is no need to use a different one. But if the ION display was stolen or is broken, it's much cheaper to use a 30€ Kunteng or Kingmeter display....
But you would have to use two independent UARTs on the ESP32 then, as the Kunteng/Kingmeter use full duplex 2 wire UART with different protocols.

For BionX there are cheap offers for motors without the rest of the bike. I haven't seen such offers for ION motors, but I haven't searched al lot yet. Most offers at eBay Kleinanzeigen are complete bikes with ION system.
I don't know if the situation is similar in the Netherlands....

regards
stancecoke