Hacking A Brushless Motor Controller

Electronicus Digitalis

Hi folks. I am an electric bikes enthusiast. I have recently chased down a supplier of BLDC controllers, but, whilst the supplier is programming the controllers as part of the sale agreement {Block-Time, Throttle Percentages, Reverse Speeds, LVC, Amperage etc} they won't give up the code and persist in telling us that the controllers cannot be programmed.

The controllers are pretty basic BLDC's, 24 Mosfet.

I have a few photos of the chipset.



There are 5 pads in front of the chip where the programming cable would be wired in. I have seen this done on "Infineon" controllers. All of these controllers are capable of being programmed- we know because they are programmed by the seller/re-seller to suit customer demands. But they won't share the software.:mad:

dalta5billion

Electronicus Digitalis wrote: »

Hi folks. I am an electric bikes enthusiast. I have recently chased down a supplier of BLDC controllers, but, whilst the supplier is programming the controllers as part of the sale agreement {Block-Time, Throttle Percentages, Reverse Speeds, LVC, Amperage etc} they won't give up the code and persist in telling us that the controllers cannot be programmed.

The controllers are pretty basic BLDC's, 24 Mosfet.

I have a few photos of the chipset.



There are 5 pads in front of the chip where the programming cable would be wired in. I have seen this done on "Infineon" controllers. All of these controllers are capable of being programmed- we know because they are programmed by the seller/re-seller to suit customer demands. But they won't share the software.:mad:

I know there is a DEFCON talk on YouTube regarding wimax card hacking, there's an interesting section on how they hacked the firmware using a needle-reader-thingy(for want of a better word ). It might be of help to you, but it sounds like a lot of work.

I don't really know much about this field, but a JTAG port seems to be a gateway for hardware hacking.

Hope it helps.

Electronicus Digitalis

Thanks for your reply Dalta5Billion....the thing is, strictly speaking, we aren't even hacking the controller, because we won't be doing anything it wasn't already intended for. Instead, we would just be trying to find out how to get it to work.

Capt'n Midnight

Don't know the specs , you could follow the points to the pins on the chip and look up it's spec sheet to see if you can replay the memory

re the physical connections also look up jtag unlikely to be I2C ?

or if all else fails bus pirate

http://endless-sphere.com/forums/viewtopic.php?f=30&t=33636&start=90
- yeah they are all linked together , so check the contacts aren't shorted together , they may not be I/O , check both sides in case they are just through holes , or they could be for optional extra's

try to find a pdf datasheet for the chip

this is probably spam http://407.13ic.com/seller/X8M06-C.html

Capt'n Midnight

BTW if they are PROM's or ASIC's then it's probably truer to say they can't be reprogrammed.



NB check the legal issues of chipping an electric bike, for instance if you override the necessity to pedal then it needs tax and insurance