FullyCharged
Active Member
The first thing that came to my mind after my first ride on my 48V/500W NCM Moscow Plus was "How can I make this bike faster?"
Throttle was maxed at 20mph(32km/hr) and the Petal Assist top speed was limited to 23mph.(37km/h)
I knew the motor was capable of much more to stay within the specs of Class 3.
So I made it my mission to try to find a hack or aftermarket hardware that would run my bike at the sweet spot of 28mph/45 kmh (Top end of Class 3)
I took to the internet to figure out my problem. After hours of digging through the interwebs I came across this thread in a german pedelec forum.
A member by the name of vspadrva made some interesting advances. He managed to use an oscilloscope and logic analyzer to reverse engineer the Das-Kit C7 Display and create code using a microcontroller (ESP2866) to intercept the data being sent through the bikes data cables.
Here's a translated quote of his OP on that thread.
The thread goes on and other smart programmers find a way to change the data values NCM set it place with their custom firmware. Eventually they created an open sourced project on github (which has some cool features)
After reading all of this and checking out the code on github. I had a good understanding what needs to be done to go that route and hack the display.
It wasn't something that I was interested at all to attempt to achieve. Also those german riders had 250W motor kits installed and were only trying to go as fast as my bike already could stock. (Due to speed restrictions in Europe)
So now what?
Something from vspadrva's post stuck with me.
This got me looking at Magnumbikes website.
Low and behold they run the same Das-Kit C7/i5 controller system (data protocol) as my NCM bike but can reach 28MPH!
This brought me to youtube looking up display tuning videos for Das-Kit C7 displays. MagnumBikes has a video posted there.
I watched it and saw the tuning screens (Pedal Assist/Throttle) that my NCM doesn't have in its settings menu. After watching, I starting thinking that maybe the speed restriction data is stored in the Das-Kit i5 Controller firmware. I would be SOL unless I changed the Controller and the Display. But then I saw this image attached on that same german pedelec thread.
Once I saw those chips, I knew there was firmware in the displays restricting the speed tuning options. I ordered a Magnumbikes C7 - 5 wire display.
Got it today, removed my stock NCM display and installed Magnums. Guess what? I can now go 25mph on assist and 23mph on throttle.
Here's a YT video of the new Display and the tuning options it gives my NCM Moscow Plus.
Hope this helps some of you out there wanting to go faster or tune the bike to go slower.
Throttle was maxed at 20mph(32km/hr) and the Petal Assist top speed was limited to 23mph.(37km/h)
I knew the motor was capable of much more to stay within the specs of Class 3.
So I made it my mission to try to find a hack or aftermarket hardware that would run my bike at the sweet spot of 28mph/45 kmh (Top end of Class 3)
I took to the internet to figure out my problem. After hours of digging through the interwebs I came across this thread in a german pedelec forum.
Kommunikation zwischen C7 Display und Motorkontroller NCM Venice+ Das-Kit
Moin, ich habe bereits im dem 'anderen' pedelec und E bike Forum meine Untersuchung und Ergebnisse veröffentlicht, hoffe aber hier zusätzlich noch weitere interessierte Leute zu erreichen. Zunächst einmal ein Dank an Arthus Dent der schon vor über einem Jahr damit angefangen hat und auf dessen...
www.pedelecforum.de
Code:
https://www.pedelecforum.de/forum/index.php?threads/kommunikation-zwischen-c7-display-und-motorkontroller-ncm-venice-das-kit.57050/page-1
A member by the name of vspadrva made some interesting advances. He managed to use an oscilloscope and logic analyzer to reverse engineer the Das-Kit C7 Display and create code using a microcontroller (ESP2866) to intercept the data being sent through the bikes data cables.
Here's a translated quote of his OP on that thread.
I have already published my research and results in the 'other' pedelec and E bike forum, but I hope to also reach other interested people here.
First of all, thanks to Arthus Dent who started over a year ago and based on his work.
My NCM Venice + 48V e-bike with Das-Kit C7 display and probably Lishui controller.
On the back of the display is
C600-1705-
B640 V2.7-EN
. After entering the code (8018), the display only allows you to change three support levels (Eco Normal Power) and to select the voltage 36 or 48V. Lockdown speed and wheel diameter are not accessible.
There are very poorly available € 119 tuning displays in which the last two things can also be changed.
So I cut the cable open and found out the function of the cable and the pin assignment using an oscilloscope and logic analyzer
(yellow is thumb gas with the usual about 1 to 4 volts)
Messages with
9600 baud at 3.3Volt TTL levels are exchanged on the data lines so that I could examine the protocol via USB TTL adapter.
At approx. 10 Hz, 12 bytes come from the display to the controller, which responds with 10 bytes.
Without a message from the display, nothing is sent from the controller. If you put the switch-on signal on the supply voltage, the controller uses the last setting and also works without a display.
For better testing, I soldered a pin header into the cable so that I can easily interrupt individual signals:
But now the exciting results:
Display -> Motor controller
b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11
3A 2C 0A 46 1A 48 08 06 EC 00 0D 0A
Byte0: always 3A
Byte1: always 2C
Byte2: changes depending on the support level
09 with Eco
0A with Normal
0B on Power
Byte3: changes with drive
level 0x56 pushing aid
0x40 level 0
0x41 level 1
... to 0x46 level 6
Byte4: final speed 0x1A = 26km / h
Byte5:?
Byte6:?
Byte7:?
Byte8: checksum (b1 + b2 + b3 + b4 + b5 + b6 + b7) mod 256
Byte9:?
Byte10 and 11: 0D 0A (CR LF)
* The controller responds accordingly:
Controller -> Display
b0 b1 b2 b3 b4 b5 b6 b7 b8 b9
3A 2C 00 60 EA 00 76 01 0D 0A
b0: always 3A
b1: always 2C
b2: motor current 0x00 to 0x2A
not yet checked but makes sense , when the rear wheel is up and pedaling brings a short 01
b3: cycle time v = 1325 / b3 (at 27.5 ") at standstill always 0x60
b4: b3 and b4 are low byte and high byte of the cycle time.
b5: engine running: 0x00 im Standstill, goes to 0x16 as soon as the motor is switched on
b6: checksum (b1 + b2 + b3 + b4 + b5) mod 256
b7: in stand 0x00 when the rear wheel turns 6km / h + -0.8km / h it goes to 0x01. Even at about 2km / h, in a smaller speed window.
b8 and 9: 0D 0A (CR LF)
Next I grabbed a microcontroller (Teensy) and changed the messages coming from the display to the controller so that when I selected level two, I sent it to controller 6 at 36km / h maximum speed .
With 3D printed housing:
Depending on the battery voltage, the controller regulates at 29 to 32 km / h.
Since the bike is also sold in the USA by Magnumbikes as Metro Plus with 500Watt and 45km / h, I hope there is more. But it may be that another motor is installed there that can turn faster.
If you are interested I can also write more detailed instructions on how to connect and program a 5 Euro microcontroller there. In case someone just wants to replicate it.
You could also build a simple adapter and would have a pluggable solution.
Sebastian
The thread goes on and other smart programmers find a way to change the data values NCM set it place with their custom firmware. Eventually they created an open sourced project on github (which has some cool features)
After reading all of this and checking out the code on github. I had a good understanding what needs to be done to go that route and hack the display.
It wasn't something that I was interested at all to attempt to achieve. Also those german riders had 250W motor kits installed and were only trying to go as fast as my bike already could stock. (Due to speed restrictions in Europe)
So now what?
Something from vspadrva's post stuck with me.
the bike is also sold in the USA by Magnumbikes as Metro Plus with 500Watt and 45km / h, I hope there is more. But it may be that another motor is installed there that can turn faster.
This got me looking at Magnumbikes website.
Low and behold they run the same Das-Kit C7/i5 controller system (data protocol) as my NCM bike but can reach 28MPH!
This brought me to youtube looking up display tuning videos for Das-Kit C7 displays. MagnumBikes has a video posted there.
I watched it and saw the tuning screens (Pedal Assist/Throttle) that my NCM doesn't have in its settings menu. After watching, I starting thinking that maybe the speed restriction data is stored in the Das-Kit i5 Controller firmware. I would be SOL unless I changed the Controller and the Display. But then I saw this image attached on that same german pedelec thread.
Once I saw those chips, I knew there was firmware in the displays restricting the speed tuning options. I ordered a Magnumbikes C7 - 5 wire display.
Got it today, removed my stock NCM display and installed Magnums. Guess what? I can now go 25mph on assist and 23mph on throttle.
Here's a YT video of the new Display and the tuning options it gives my NCM Moscow Plus.
Hope this helps some of you out there wanting to go faster or tune the bike to go slower.
Attachments
Last edited: