Brose BH hack
Mapping the pins
- Compared to black: only noise everywhere
- Compared to brown:
- Orange: 9.72V!
- Yellow: CAN signal, but negative!
- Compared to red: lotsa noisy crap
It is a CAN signal, 250 kb/s.
- Yellow: CAN-L
- Brown: CAN-H
Decoding
|
CAN-ID |
Source |
Frequency |
Content |
|
0x200 |
Battery |
Rarely? |
32 00 24 9a 02 00 00 00 |
|
0x201 |
Battery |
100 ms |
00 00 00 00 |
|
0x202 |
Battery |
1000 ms |
1a 19 00 00 c4 b0 30 00 |
|
0x203 |
Battery |
100 ms |
last bytes change |
|
0x300 |
Battery |
100 ms |
03 5a 00 5a |
|
0x400 |
Bike |
100 ms |
00 80 00 00 |
|
0x401 |
Bike |
100 ms |
ef 93 00 00 00 00 00 00 |
|
0x402 |
Bike |
2000 ms?? |
32 00 00 00 24 9a 02 00 |
|
0x403 |
Bike |
3000 ms?? |
51 00 00 00 80 2f 05 00 |
|
0x666 |
Battery |
2000 ms?? |
53 03 06 00 52 00 61 55 |
Significance
Turns out the bike runs perfect so long it gets the 36V on the power terminals. It correctly guesses SOC for the display. However, it cannot estimate range.
Way forward
It does not make sense to finish decoding the CAN system just to get range estimates, especially not to develop a sufficiently small CAN board.
- Can use the usual 36V cell arrangement and housing
- Can use our BH boards for SOC LED driving
- HOWEVER we do NOT need to connect the connector small pins to anything
Caveat
This above only works if the bike has a Brose display:
If is has the 'normal' BH display, it will not work!

No comments to display
No comments to display