#startergenerator — Public Fediverse posts

Sooo. Before I procrastinate it any longer (because my perfectionism claims that it's not finished enough), I've decided to finally publish the current, unfinished state of the firmware and some accompanying documentation for the #startergenerator

https://github.com/RainbowLabsDE/BSG-Driver

I hope it helps ;)

Also have a bonus video of the #startergenerator spinning up to 4500 RPM under 20 Nm of load without ramp-up.

Finally got to doing some dyno runs with the #startergenerator this week.

As I'm able to vary many factors (target drive torque, generating torque, RPM and time), I tested many variations.

tl;dr: They definitely deliver on their 12.5 kW promise, but the stator gets hot quickly, especially at low RPMs and high torque.
I couldn't test the full 55 Nm, only up to 36.6 Nm, as that's the generating limit.

I'm still amazed by the engineering of those things. So much data and protections :D

I've also built a Grafana dashboard for this test setup.
Each #startergenerator is connected to a STM32F072 via CAN which are then connected to the PC via USB serial.
A script then forwards control commands to the STM32s and also receives the telemetry data and publishes them to an InfluxDB.

Here you can see the data of the first video and also a more zoomed out view of the test runs with increasing torque target and slow RPM ramp up.

Because they report voltage, current, torque and RPM (and I trust those values reasonably), I'm able to calculate the kinetic power and electrical power. The difference between those two values should approximate the efficiency of the #startergenerator.
So I quickly threw together a plot of the efficiencies at various RPM and torque levels. Both for the driving and generating mode.
I honestly expected a bit more, but I guess they are more optimized for torque and other factors :D

Today, I've built a "temporary" test stand, so I can hopefully test the (thermal) performance of the #startergenerator in the coming days.

It was a welcome excuse to finally dabble in some metalworking again :D

Also, those belt tensioners really need quite some force.

- Built the (shitposty) #USB2Speakon adapter
- Designed a new revision of the #SSD1303 breakout PCB
- Developed a small ESP-NOW telemetry and logging framework for a model rocket #jfzhn project
- Finished reverse engineering the #startergenerator. It spins now! \o/
- Built #TheLAEMPAN together with @techbeard and @Toble_Miner (RGB replacement PCBs for IKEA LAMPANs, more info coming sometime™)

#GoodOf2024 2/3

- Built the (shitposty) #USB2Speakon adapter
- Designed a new revision of the #SSD1303 breakout PCB
- Developed a small ESP-NOW telemetry and logging framework for a model rocket #jfzhn project
- Finished reverse engineering the #startergenerator. It spins now! \o/
- Built #TheLAEMPAN together with @techbeard and @Toble_Miner (RGB replacement PCBs for IKEA LAMPANs, more info coming sometime™)

#GoodOf2024 2/3

- Built the (shitposty) #USB2Speakon adapter
- Designed a new revision of the #SSD1303 breakout PCB
- Developed a small ESP-NOW telemetry and logging framework for a model rocket #jfzhn project
- Finished reverse engineering the #startergenerator. It spins now! \o/
- Built #TheLAEMPAN together with @techbeard and @Toble_Miner (RGB replacement PCBs for IKEA LAMPANs, more info coming sometime™)

#GoodOf2024 2/3

- Built the (shitposty) #USB2Speakon adapter
- Designed a new revision of the #SSD1303 breakout PCB
- Developed a small ESP-NOW telemetry and logging framework for a model rocket #jfzhn project
- Finished reverse engineering the #startergenerator. It spins now! \o/
- Built #TheLAEMPAN together with @techbeard and @Toble_Miner (RGB replacement PCBs for IKEA LAMPANs, more info coming sometime™)

#GoodOf2024 2/3

- Built the (shitposty) #USB2Speakon adapter
- Designed a new revision of the #SSD1303 breakout PCB
- Developed a small ESP-NOW telemetry and logging framework for a model rocket #jfzhn project
- Finished reverse engineering the #startergenerator. It spins now! \o/
- Built #TheLAEMPAN together with @techbeard and @Toble_Miner (RGB replacement PCBs for IKEA LAMPANs, more info coming sometime™)

#GoodOf2024 2/3

The general control loop is also pretty impressive, the engineers at #Bosch SEG definitely did their job well.

The lowest limit I can set is 6 RPM and it runs buttery smooth.

And it has insane amounts of torque. If you hold the pulley really tightly, it slips out of most strong hands at around 6-7 Nm (as reported via the CAN status messages).

This will be really fun once put into some small vehicle :D

(It can also recuperate really well, but can't run in reverse at all)

#startergenerator

We also did a max RPM test of the #startergenerator using one of @patagona's rescued Pylontech batteries, because the 20A of my 1kW lab PSU weren't enough :D

I set the torque limit to 0.7 Nm (out of 55), no RPM limit and let it rip :D
It reached a peak of 43A (~2kW) at the end of the acceleration, settled at 25A (~1.2kW) and reached a peak RPM of 13400.

It was a bit scary tbh :D
(Not sure if the video accurately captured the sound it made)

(Pylontech thread: https://chaos.social/@patagona/113149877881417810 )

There's still a lot left to do.
I need to implement the #XCP stuff into the STM32 firmware, so it can run the #startergenerator stand-alone.
Stuff like:
- Checking the firmware version on the ECU, so it doesn't poke the wrong memory address
- Reading and parsing the status of the motor
- And actually controlling the motor properly instead of just sending it a hardcoded 1 Nm torque request :D

And then also cleaning it up enough, documenting and testing it thoroughly, so it can be published.

I spent many dozens of hours losing track of time in #Ghidra (I swear, it's worse than #Factorio)

Until I had figured out the #CAN message handling, signal parsing and where and when which #DTC codes get set.
With that knowledge I could figure out, slowly but surely, what the #startergenerator needs to run.
Even #FBS4 was pretty trivial to circumvent (a single 1 written to the right memory location via #XCP)

And after implementing the ~25 CAN messages in my STM32 code I finally got this today:

I spent many dozens of hours losing track of time in #Ghidra (I swear, it's worse than #Factorio)

Until I had figured out the #CAN message handling, signal parsing and where and when which #DTC codes get set.
With that knowledge I could figure out, slowly but surely, what the #startergenerator needs to run.
Even #FBS4 was pretty trivial to circumvent (a single 1 written to the right memory location via #XCP)

And after implementing the ~25 CAN messages in my STM32 code I finally got this today:

I spent many dozens of hours losing track of time in #Ghidra (I swear, it's worse than #Factorio)

Until I had figured out the #CAN message handling, signal parsing and where and when which #DTC codes get set.
With that knowledge I could figure out, slowly but surely, what the #startergenerator needs to run.
Even #FBS4 was pretty trivial to circumvent (a single 1 written to the right memory location via #XCP)

And after implementing the ~25 CAN messages in my STM32 code I finally got this today:

I spent many dozens of hours losing track of time in #Ghidra (I swear, it's worse than #Factorio)

Until I had figured out the #CAN message handling, signal parsing and where and when which #DTC codes get set.
With that knowledge I could figure out, slowly but surely, what the #startergenerator needs to run.
Even #FBS4 was pretty trivial to circumvent (a single 1 written to the right memory location via #XCP)

And after implementing the ~25 CAN messages in my STM32 code I finally got this today:

I spent many dozens of hours losing track of time in #Ghidra (I swear, it's worse than #Factorio)

Until I had figured out the #CAN message handling, signal parsing and where and when which #DTC codes get set.
With that knowledge I could figure out, slowly but surely, what the #startergenerator needs to run.
Even #FBS4 was pretty trivial to circumvent (a single 1 written to the right memory location via #XCP)

And after implementing the ~25 CAN messages in my STM32 code I finally got this today:

Update time:
At the end of December I implemented most of the messages the #startergenerator wants to see.
I knew I got it right enough because the 7 DTC codes it was previously spitting out shrank to just 1. The ones that went away were something like "communication failure power train controller", but the one remaining DTC was a bit disheartening...

"P143468: Imob_E_LOCKED - The driving authorization has not been released."

- Helped @crexodon a bit with the #Unterland badge
- Quickly hacked together some Art-Net support for @twizzarak's tail
- "Fixed" the water-damaged motor #ECU of my car
- Finally got CAN communication with the #startergenerator
- @patagona and I took a look at some cheap #BK7231N based string lights and built a #ESPHome firmware
- Attended a number of repair cafés and helped repair a handful of devices
3/3

- Bought a Mercedes #startergenerator and started reverse-engineering it
- Implemented gamma correction for #PixelBridge
- Built a control board and instrument display for the #ePocketBike
- Dabbled in upholstry and built a new seat for the #ePocketBike
- Acquired some big #SSD1303 OLEDs and desgined a breakout board + Arduino library for it.
- Released the #PawConnect (Tag-Connect #TC2030 compatible f̶o̶o̶t̶ pawprint)
- Built the now famous #PDBrick together with @techbeard
2/3

- Bought a Mercedes #startergenerator and started reverse-engineering it
- Implemented gamma correction for #PixelBridge
- Built a control board and instrument display for the #ePocketBike
- Dabbled in upholstry and built a new seat for the #ePocketBike
- Acquired some big #SSD1303 OLEDs and desgined a breakout board + Arduino library for it.
- Released the #PawConnect (Tag-Connect #TC2030 compatible f̶o̶o̶t̶ pawprint)
- Built the now famous #PDBrick together with @techbeard
2/3

- Bought a Mercedes #startergenerator and started reverse-engineering it
- Implemented gamma correction for #PixelBridge
- Built a control board and instrument display for the #ePocketBike
- Dabbled in upholstry and built a new seat for the #ePocketBike
- Acquired some big #SSD1303 OLEDs and desgined a breakout board + Arduino library for it.
- Released the #PawConnect (Tag-Connect #TC2030 compatible f̶o̶o̶t̶ pawprint)
- Built the now famous #PDBrick together with @techbeard
2/3

- Bought a Mercedes #startergenerator and started reverse-engineering it
- Implemented gamma correction for #PixelBridge
- Built a control board and instrument display for the #ePocketBike
- Dabbled in upholstry and built a new seat for the #ePocketBike
- Acquired some big #SSD1303 OLEDs and desgined a breakout board + Arduino library for it.
- Released the #PawConnect (Tag-Connect #TC2030 compatible f̶o̶o̶t̶ pawprint)
- Built the now famous #PDBrick together with @techbeard
2/3

- Bought a Mercedes #startergenerator and started reverse-engineering it
- Implemented gamma correction for #PixelBridge
- Built a control board and instrument display for the #ePocketBike
- Dabbled in upholstry and built a new seat for the #ePocketBike
- Acquired some big #SSD1303 OLEDs and desgined a breakout board + Arduino library for it.
- Released the #PawConnect (Tag-Connect #TC2030 compatible f̶o̶o̶t̶ pawprint)
- Built the now famous #PDBrick together with @techbeard
2/3

Got out the #startergenerator again today.
But (destructively) removing the back cover of the #BSG revealed even less than I had feared...

Just a big welded(!) copper distribution plate and more plastic and silicon.

Only a hint of ceramic PCB can be seen through a tiny little hole, that's it.

Going any further than that really needs some effort and would very likely lead to damage of the power electronics, so I'll probably stick to the #CAN fuzzing / information digging approach for now...

Habe auch zusammen mit @techbeard ein gebrauchtes (zerbasteltes) #PocketQuad aus Nürnberg abgeholt, damit er daraus ein Camp Fahrzeug basteln kann.

Die originalen Warnhinweise und die hinteren "Kotflügel" sind auch super xD

Es wurde zerlegt und der Verbrenner rausgeschmissen.
Der #Startergenerator würde da super reinpassen. (Auf den Bildern einfach nur reingelegt)

Trying to send some #CAN messages to the #startergenerator didn't prove successful either.
I'm not well versed in CAN, but the dongle just kept trying to send the single message on repeat.
So I guess it didn't receive a CAN ACK?
Afaik, all transceivers in a bus should ACK a frame, no matter if they're addressed or not.

Not sure why it didn't work. Maybe I was on the wrong baud rate or this device behaves weirdly and only sends ACKs after getting a magic message?

#CANhacking #carhacking

Trying to send some #CAN messages to the #startergenerator didn't prove successful either.
I'm not well versed in CAN, but the dongle just kept trying to send the single message on repeat.
So I guess it didn't receive a CAN ACK?
Afaik, all transceivers in a bus should ACK a frame, no matter if they're addressed or not.

Not sure why it didn't work. Maybe I was on the wrong baud rate or this device behaves weirdly and only sends ACKs after getting a magic message?

#CANhacking #carhacking

Trying to send some #CAN messages to the #startergenerator didn't prove successful either.
I'm not well versed in CAN, but the dongle just kept trying to send the single message on repeat.
So I guess it didn't receive a CAN ACK?
Afaik, all transceivers in a bus should ACK a frame, no matter if they're addressed or not.

Not sure why it didn't work. Maybe I was on the wrong baud rate or this device behaves weirdly and only sends ACKs after getting a magic message?

#CANhacking #carhacking

Trying to send some #CAN messages to the #startergenerator didn't prove successful either.
I'm not well versed in CAN, but the dongle just kept trying to send the single message on repeat.
So I guess it didn't receive a CAN ACK?
Afaik, all transceivers in a bus should ACK a frame, no matter if they're addressed or not.

Not sure why it didn't work. Maybe I was on the wrong baud rate or this device behaves weirdly and only sends ACKs after getting a magic message?

#CANhacking #carhacking

Trying to send some #CAN messages to the #startergenerator didn't prove successful either.
I'm not well versed in CAN, but the dongle just kept trying to send the single message on repeat.
So I guess it didn't receive a CAN ACK?
Afaik, all transceivers in a bus should ACK a frame, no matter if they're addressed or not.

Not sure why it didn't work. Maybe I was on the wrong baud rate or this device behaves weirdly and only sends ACKs after getting a magic message?

#CANhacking #carhacking

After much digging I at least found the pinout in some Mercedes shop software.

But unsurprisingly the #startergenerator didn't send any messages on its own on the #CAN bus when hooked up to 12V.
It did draw 11 mA tho, so at least the pinout seems correct and the controller appears awake.

Bought a #Mercedes #48V #MHEV #startergenerator for #reverseengineering.
The specs are impressive, especially for the price point of a few hundred euros.

- 48V / ~200A
- 12.5 kW peak
- 165 Nm peak

The main difficulty lies in finding out the #CAN commands for initialization and control.

I don't have access to a Mercedes E200 EQ Boost (or similar), so "just sniffing" is out.
Maybe somebody could help me with that tho? ^^'

#CANhacking #carhacking #BSG

Bought a #Mercedes #48V #MHEV #startergenerator for #reverseengineering.
The specs are impressive, especially for the price point of a few hundred euros.

- 48V / ~200A
- 12.5 kW peak
- 165 Nm peak

The main difficulty lies in finding out the #CAN commands for initialization and control.

I don't have access to a Mercedes E200 EQ Boost (or similar), so "just sniffing" is out.
Maybe somebody could help me with that tho? ^^'

#CANhacking #carhacking #BSG

Bought a #Mercedes #48V #MHEV #startergenerator for #reverseengineering.
The specs are impressive, especially for the price point of a few hundred euros.

- 48V / ~200A
- 12.5 kW peak
- 165 Nm peak

The main difficulty lies in finding out the #CAN commands for initialization and control.

I don't have access to a Mercedes E200 EQ Boost (or similar), so "just sniffing" is out.
Maybe somebody could help me with that tho? ^^'

#CANhacking #carhacking #BSG

Bought a #Mercedes #48V #MHEV #startergenerator for #reverseengineering.
The specs are impressive, especially for the price point of a few hundred euros.

- 48V / ~200A
- 12.5 kW peak
- 165 Nm peak

The main difficulty lies in finding out the #CAN commands for initialization and control.

I don't have access to a Mercedes E200 EQ Boost (or similar), so "just sniffing" is out.
Maybe somebody could help me with that tho? ^^'

#CANhacking #carhacking #BSG

Bought a #Mercedes #48V #MHEV #startergenerator for #reverseengineering.
The specs are impressive, especially for the price point of a few hundred euros.

- 48V / ~200A
- 12.5 kW peak
- 165 Nm peak

The main difficulty lies in finding out the #CAN commands for initialization and control.

I don't have access to a Mercedes E200 EQ Boost (or similar), so "just sniffing" is out.
Maybe somebody could help me with that tho? ^^'

#CANhacking #carhacking #BSG