ESP32 as ECU

[stprograms]

Hi @stprograms ,

I've recently been analyzing the communication protocol of Super Soco, and this project has been incredibly helpful to me.

Here are some of my findings and questions:

It’s known that the communication is based on a 2-wire RS485. From my tests, I’ve identified the following components in the system that actively send signals: ECU MCU (Motor Control Unit) Speed Meter Battery The Charger should also participate, but I haven’t tested it yet.

Observations: ECU: Acts as the Master and sends requests (REQ). MCU: Responds with RESP(B6 6B AA DA....). I think referring to byte 5 as the "ECU state" is inaccurate; it might be better described as the "Drive state." Battery: Responds with RESP(B6 6B AA 5A...). Speed Meter: Responds with RESP(B6 6B AA BA....). Interestingly, if it doesn’t receive a REQ (C5 5C BA AA) for some time, it becomes the Master and starts sending REQ. Additional Notes: The interpretation of byte2 = src and byte3 = dest is incorrect. It should be: byte2 = dest byte3 = src From the above information, the address mappings are as follows:

Master Address = AA MCU Address = DA Battery Address = 5A Speed Meter Address = BA

In the REQ (C5 5C BA AA...), the following observations are noted: Byte 5: Represents the Battery State of Charge (SoC). Byte 11: Contains an Error State. When the Battery is disconnected, this value becomes 20.

Hello and thank you so much for sharing your findings. I have been using esp32s to send data to a SuperSoco TS1200r and TS Street Hunter Pro for more than an year now and I can emulate battery 1, battery 2 and controller without issues. However I don't have the original GSM (ECU) module and I am trying to emulate it and even with your latest findings I have no luck in doing so. I cannot make the esp32 act as a master. I try sending "C5 5C BA AA 0E 64 00 00 01 05 24 00 00 01 01 00 00 00 8C C6 0D" every 100,200,300 ms but no luck, the display takes command as master. Do you have any idea what I might be doing wrong? Thanks.

Ursprünglich gepostet von @valy84 in #10 (comment)

[stprograms]

Hi @valy84!
I think emulating the original Ecu is an interesting project, good luck on that :) I have moved your question to a new issue.
Regarding your question, I cannot help you at the moment. I assume that either there is 1 special telegram sent that is not yet found / covered, or we have a special bit in a telegram of the Ecu that is not yet decoded.

@linshuweitw: Maybe you have an idea what makes the master role switch back to the Ecu

As you may have seen in the issues, I plan on adding timing to the traces, so the data communication can be analyzed and replayed with the same timing as it is recorded. Maybe I will share a recording of my bike when finished as an example

[valy84]

Hi @stprograms and thanks for the reply. You putting all this information together has been super helpful as my Socos both run Fardriver controllers and JBD/JK BMS' and I am able to comunicate with the display and send all my data (well, most of it, except for the clock and real range). Regarding the ECU emulation, I even tried having the ESP running with the bike off, so that there is no delay in the sent packages when the display turns on, but the results are the same. I know it's not that big of a deal and probably emulating that is not of much interest to most people, but it would be nice to have 100% control on that display with full functionality. Thanks again!