BOSCH WIP

Bosch Battery Packs come in different types and capacities but the current assumption is that they are all based on Component Type BBP250. So far two similar Power Architecture MCU types have been identified:

• NXP MPC5602DPB
• ST SPC560D40L1

The Batteries can be charged with non bosch chargers in the 36V LI-ION regime. A separate 5V supply (DC-DC step down) is needed to trick the BMS into charging mode.

https://www.st.com/en/automotive-microcontrollers/spc56el60l3.html

Bosch Diag Patch 7.5.3.0 https://0x0.st/oH6L.zip Bosch cff2 pull https://0x0.st/oH6z.cff2

id    len period src
    data (big endian, i.e. MSB first)
0x01c: 8,    1 s
    D0-D3 uint: uptime [ms] (rising data with 1000 inc)?
    D4-D7: const 00 00 00 00
0x037: 3,  100ms hmi
    D0: const 00;
    D1 bool: light: 0x80 on, 0x00 off
    D2 bool: walk: 0x01: on, 0x00 off
0x03b: 4,  500ms
    D0 uchar: support 9: off, 1: eco, 2: tour, 3: sport, 4: turbo
    D1 uchar: at boot ff, otherwise 00
    D2-D3: const 00 00
0x03c: 3,  500ms
    D0 uchar: at boot 00, otherwise 01
    D1 uchar: at boot 00, otherwise light: 0x01 on, 0x02 off
    D2 uchar: at boot 00, otherwise walk: 0x02 on, 0x01 off
0x048: 6,   10ms du
    D0-D1 short: torque [1/10 Nm]
    D2-D3 ushort: time [1/10 ms]
0x04a: 1,   10ms bat
    D0: const 00 not fully cyclic: always sent for the first 4000 or 4096ms, then disappears; sometimes reapears ???
0x059: 8,  100ms
    D0-D7 ???: const 01 01 00 1e 00 64 00 00
0x05a: 1,  irreg hmi
    D0: const 00 sent when resetting remaining range on intuvia
0x08c: 1,  200ms bat
    D0: const 00, 23 or 25 (alive from battery? value mostly 0, sometimes same as D0 from previous id 0x352 frame?)
0x09a: 1,  200ms
    D0: const 00 (alive from motor?)
0x09b: 1,  200ms
    D0: const 00 (alive from HMI?)
0x0c5: 3,  irreg, only when in intuvia base settings menu
    D0 uchar: type; D1-D2 ushort: data; D0=01: const 00 00, D0=02: adjusted wheel circumference [mm]
0x0c6: 8,  irreg, only when in intuvia base settings menu
    D0-D1 ushort: mininum; D2-D3 ushort: maxinum; D4-D5 ushort: default; D6-D7 ushort: adjusted wheel circumference [mm]
0x0c7: 8,  100ms
    D0: const 00
    D1 uchar ???: c8 = 200, less when battery runs low, same as 1/100 * 0x111 D2-D3
    D2-D3 ushort: remaining battery charge in Wh, correlating with 0x111 D6, at boot ff ff
    D4: const 00
    D5 uchar: last full battery charge [Ah]; same as 0x111 D5
    D6-D7: const 00 00
0x0d0 (DU SW < 1.6.0.0): 4,  100ms
    D0-D1 short: gforce z [1/100 m/s²]? values around 981
    D2-D3 short: gforce x [1/100 m/s²]? values around 0
0x0d0 (DU SW 1.6.0.0): not sent
0x0d0 (DU SW 1.7.0.0): 8,   20ms;
    D0-D1 short: gforce x [1/100 m/s²] values around 0
    D2-D3 short: gforce z [1/100 m/s²] values around 981
0x0d1: 2,  100ms du
    D0-D1 ushort: speed [1/100 km/h] (0 when pushing bike backwards)
0x0d2: 4,  100ms du
    D0: const 00; D1 uchar: cadence [1/min]
    D2-D3: const 00 00
0x0d3: 6,  100ms du
    D0-D1 short: motor torque at chaindrive actual [1/100 Nm]
        for torque sensor see http://www.pedelecforum.de/forum/index.php?threads/performance-active-motor-innenleben.26492/page-8#post-711856
    D2-D3 ushort: motor torque nominal [1/100 Nm]
        (max eco: 0x0602=1538=38.8Nm, tour: 0x06f9=1785=45.0Nm, sport: 0x08f0=2288=57.7Nm, turbo: 0x0a8c=2700=68.0Nm, official 40/50/60/75)
    D4-D5 short: motor rpm  [1/min], negative when pushing bike backwards
        motor transmission to chaindrive is 16:47 * 19:77 = 304:3619 = 1:11.9
        pedal transmission to chaindrive is 33:14 * 31:29 = 1023:406 = 2.52:1
        motor rpm = (3*11*11*31*47)/(32*19*29) = 528891/17632 = 29.996 times cadence
        see http://www.pedelecforum.de/forum/index.php?threads/performance-active-motor-innenleben.26492: images in post #1
            http://www.pedelecforum.de/forum/index.php?threads/performance-motor-innenleben-so-sollte-es-eigentlich-nicht-aussehen-o.40234/page-5#post-663475
            http://www.enbicielectrica.com/t5229-despiece-y-mantenimiento-motor-bosch-performance-2015-tutorial#94585 (motor shaft [1] 16 against [2] 47)
            http://www.enbicielectrica.com/t5229-despiece-y-mantenimiento-motor-bosch-performance-2015-tutorial#93930 ([2] 19 against [3] 77)
        but: renderings in this video show 16:48 * 25:100 = 1:12, differing from actual version: https://www.youtube.com/watch?v=-5WxMZLqPE8
0x0d4: 4,  100ms du
    D0-D1 ushort: motor power draw [1/10 W] correlating with 0x101 battery power draw (slightly less)
    D2-D3 ushort: const, power draw for max. bar graph display [1/10 W]? OWL active: 0x0d7b = 3451, Gene performance (with Nuvinci?): 0x0dfc = 3580, performance cx: 0x1220 = 4640, at boot 0x0000
0x0f1: 7,   10ms bat
    D0-D3 ???: const 00 00 01 01
    D4 uchar: battery depth of discharge in % (0: battery full, 100: empty), adds up with 0x111 D6 to 100, at boot fe and ff
    D5: const 7f, OWL active 7f, but Gene performance ff ???
    D6 uchar: 98, d8 if battery at or below 20%, at boot 10; OWL active and Gene performance 9a ???
0x101: 8,  500ms bat
    D0-D1 ushort: status, 0:run, 0xffff: charge
    D2-D3 short: current [mA], neg. when charging
    D4-D5 ushort: power [1/10 W]
    D6-D7 ushort: voltage [mV]
0x111: 7,  100ms bat
    D0-D1: const 00 00
    D2-D3 ushort: battery discharge limit indicator: normally 4e 20 = 20000, less when battery runs low
    D4: const 00
    D5 uchar: last full battery charge [Ah]; 8a, 89, 87, 86 changed after charging completely empty battery, OWL active and Gene performance 72 (400Wh battery)
    D6 uchar: battery state of charge in % (0: battery empty, 100: full)
0x131: 8,  irreg hmi and bat
    D0: const 00
    D1 uchar: 01, at boot 02, in settings when entering software versions 05
    D2-D6: const 00 00 00 00 00
    D7 uchar: 00, 01, 02, 03, 08, 09, 0a, 0b: button press/release (controller plus, info, minus, walk, intuvia reset, info, light, intuvia or battery on/off)
0x170: 8,   5 s  bat
    D0-D1 ushort: motor temperature [1/100 K]
    D2-D7: const 00 00 00 00 00 00
0x202: 8,  500ms
    D0-D3 uint: total distance [m]
    D4-D7 uint: remaining range [m]
0x203: 8,  500ms
    D0-D3 uint: total operation time [s]
    D4 uchar: remaining battery charge in % (same as 0x111 D6), at boot 0x80
    D5-D6 short ???: related to speed and support; oversampled, value changes max. once per second
        support off: 0 if speed 0, 0xf424 if speed > 0
        0x0000, 0xf424, 0x0082, 0x01a6, 0x0092, 0x0135, 0x007e, 0x00e6, 0x0e43, 0x0091, 0x03f2, 0x010d, 0x023d, 0x0137, 0xf424, 0x007d, 0x0097, 0x00b9, 0x00bc, ...
    D7 uchar: 80 if support is off due to empty battery, otherwise 00
0x205: 8,  100ms du
    D0: const 00
    D1 uchar: gear shift recommendation? 00: none, 9c: lower gear (cadence below 50 rpm), 64: higher gear (cadence above 120 rpm)
    D2-D7 ???: const 00 00 80 00 00 00
0x210: 6,    1 s hmi
    D0 uchar: year
    D1 uchar: month
    D2 uchar: day
    D3 uchar: hour
    D4 uchar: minute
    D5 uchar: second
0x211: 8, 500ms
    D0-D7: const 00 00 00 00 00 00 00 00
0x220: 8, 100ms
    D0-D3 ???: const 00 00 03 00
    D4 uchar: related to speed sensor: 0x80 at some speed steps when decelerating, 0x00 else (restarts auto-off timer?)
    D5-D7: const 00 00 00
0x221: 8, 100ms
    D0-D3: const 00 00 00 00
    D4-D6: const 00 13 88; 0x1388 = 5000
    D7: const 00
0x2aa (PP SW 1.7.1.0): 8,  500ms bat
    D0-D1 ushort: battery case temperature [1/100 K]
    D2-D3 ushort: voltage [mV] (slightly higher than 0x101 D6-D7)
0x351 (before eMTB): 8, irreg (not from bat)
    D0-D7 ???: const 30 08 14 00 00 00 00 00
0x351 (after eMTB): not sent
0x352 (PP SW 1.5.2.0): 8, irreg bat
    battery statistics, head frames in 1 sec. timegrid, with optional data frames following in 30ms intervals
    for data structure see code of CanState352
0x352 (PP SW 1.7.1.0): not sent

• https://github.com/gregyedlik/handshake
• https://mhhauto.com/Thread-Bosch-E-bike-Diagnostic-Tool-IBD-Software?page=2
• https://cyclurba.fr/forum/702597/logiciel-diagnostic-bosch-ibd-dongle.html
• https://cyclurba.fr/personne/personne_profil.php?personneID=21636&pseudo=Bitslover101
• https://ufile.io/i3nr7xmk Bosch eBike Diagnostic v3.8.1.0.1
• https://ufile.io/hsw70fiy Bosch eBike Diagnostic v6.2.5.0

Or Patreanu Finance