contrary to the specificationKlicken, um Alternative zu verwendenI recently got a pedelec up to 45km/h with a Brose C97292 electric motor and a 497Wh battery by BMZ. 

The headunit is an old "Bloks Sportive" with a GEN1 connector. All components communicate by CAN (250kbit)

For data aquisition/sniffing an additional CAN connection is required. The easiest is to use the connect-c bluetooth module port (if present) or just cut the wires inside the motor housing and add it yourself. 

Here the wire colors and pinout of the Gen 1 connector:

I took a Teensy 3.2 with a CAN transceiver, flashed it with teensy-slcan, hooked it up and used savvyCAN to inspect the data and  make a DBC file.

The 15 CAN IDs are arranged in groups:

  • 0x20X: motor
  • 0x3XX: display
  • 0x40X: battery
  • 0x6XX: ?

For details see the .DBC file attached

Change support levels

For changing the support level of the 4 stages a well known friend of me is used: UDS - at least kind of. There are some variances in the protocol contrary to the UDS specification. As it is not consistent, they may fucked up the implementation?

Requests are send with ID 0x100, responses have 0x101. Data is written with the Write Data By Identifier Command (0x2E) and read back with Read Data By Identifier (0x22). Unlike the app diplays (mapped to 0-100%), supports levels are from 0 to 300% (2C 01 = 0x012C = 300). The adress/identifier for the support stages is 0C 0X where X is the stage (1-4)

Example: Set stage 4 to 150% support level:

0x100 06 2E 02 0C 04 96 - length 6, write (2E), address 02 0C 04, value 0x96 (=150%)
0x101 03 6E 02 0C - length 3, confirm write (2E+0x40), address 02 0C*

* In confirmation only the 16 bit address - like in UDS spec - is replied. it is not clear, wether 04 is part of the data or address. See read example below, there it is required as part of address.

Example: Read support levels of stage 1 and 2

0x100 04 22 02 0C 01 - length 4, read (22), address 02 0C 01
0x101 06 62 02 0C 01 28 00 - length 6, confirm read (22+0x40), address 02 0C 01*, data 0x28 = 40%

0x100 04 22 02 0C 02 - length 4, read (22), address 02 0C 02
0x101 06 62 02 0C 02 50 00 - length 6, confirm read (22+0x40), address 02 0C 02*, data 0x50 = 80%

Sadly the app can do nothing else.
Still looking for charge-cycle counter and battery temps. Still work in progress. At system startup there are some masseges I haven't checked yet