search

A-Emile / Lime_Gen3_IoT_Replacement

Custom IoT for Lime Gen 3 E-Scooter and info about serial communication
Apache License 2.0
46 stars 12 forks source link

Max speed #7

Open HenryCavil opened 1 year ago

HenryCavil commented 1 year ago

DE market have 20kmh limit. Unlocked firmware have 27kmh. Maybe there is chance to change max speed of the scooter above this 27kmh?

A-Emile commented 1 year ago

Yeah, it should be possible. We just have to find the command. Maybe we can try bruteforcing..?

Pikokosan commented 1 year ago

It's a internal limit in the firmware. There won't be a command to change the speed limit

A-Emile commented 1 year ago

Yeah, but i think it could be possible to change it over uart because in the main binary of the iot are a few functions that looks like they change the max speed based on location. And I just also heared, that the controller is made by lishui and parameters may can be set by a software called "Lishui Controller FOC parameters adjuster" but i wasnt be able to connect it to my ftdi programmer. It could also be possible to flash the following open source firmware: https://github.com/EBiCS/EBiCS_Firmware

A-Emile commented 1 year ago

I also found this thread, wich could be interesting: https://www.pedelecforum.de/forum/index.php?threads/bagier-sinus-controller-programmierung.25904/page-4#post-756210

Pikokosan commented 1 year ago

I noticed that too when I was working on the 2.5 controller. Never could get it to talk to the software. From the binary I pulled from the 2.5 it looks like a custome flavor. Maybe the white wire is used to enable a bootloader or put it into a configuration code?

A-Emile commented 1 year ago

Im not sure but i think the white wire is ntc

A-Emile commented 1 year ago

And i think the problem with the software is, that its made fur older serial adapters. Since it doesnt even try to speak with my ftdi. There is a newer version of it wich supports ftdi programmers. But it isnt available to download anymore. Maybe someone in the forum still has it..

A-Emile commented 1 year ago

I just had a thought: there is a max speed screen for the display. Maybe there are zones in the city, where speed is even more limited like to 10kmh. We can sniff one and drive in and out such a zone...

Pikokosan commented 1 year ago

Im not sure but i think the white wire is ntc

That makes more since. I just looked at the 2.5 version and it doesn't have that.

MrKris7100 commented 12 months ago

Maxiumum speed is limited by the motor. It's maked in spacific way to have maximum speed of ~30km/h. If you wanna increase maximum speed you need to apply higher voltage to motor or replace motor. I tested 48V on this mottor with generic controller and it's driving around 47km/h.

reuzurq commented 10 months ago

There won't be a command to change the speed limit

There is a speed limit variable, u can edit it both in fw binary and via serial commands. Stock esc can go up to 34kmph (similar to ximi pro2) when fully charged.

mciszdaniel commented 9 months ago

Hi, I give some code for exact max speed setting for the Lishui controller (Lime 2.5)

Can u help me how to work around switch off the only by "pedal assist" starting? I want to start from 0km/h... without assist..

Code | Km/h 4643161100027604C6 | 7,2 464316110002EE0677 | 10,4 464316110002166860 | 12,6 4643161100021008A6 | 13,5 464316110002C5937E | 15,8 464316110002010AB6 | 16,8 464316110002880A17 | 17,1 464316110002320C86 | 18,9 464316110002AA0E37 | 22,7 464316110002DC1066 | 26,4 464316110002CD1276 | 33,2 464316110002023AD5 | 33,7 (40-50 alternatives also there for same speed) >> Edit : its 34,8 ~ 35 Km/h on 100% battery

reuzurq commented 9 months ago

Commands you have provided are a bit wrong. Speed governor needs 2 bytes set. Your commands have specified length of 2 but you are passing only 1 byte and checksum (-2) so these commands would fail.

4643 16 1100 02 02 ?? | 3A D5
HEAD RW ADDR LN DATA2 | CRC16

?? Missing byte

Can u help me how to work around switch off the only by "pedal assist" starting?

I dont think that this is possible on those - dont have time rn to test rest of the addresses that ive found.

Also 2.5 and 3.0 controllers are a bit different - having some functions mapped to same addresses, an lots of other - unique to the model version.

mciszdaniel commented 9 months ago

Yesterday night I check all codes on that address, these are works for sure.

IMG_2602

(its already not on full charge)

I get the working codes from a list from a guy: https://github.com/dani3l0/limesj2.5-stuff/tree/master/bruteforce

mciszdaniel commented 9 months ago

Commands you have provided are a bit wrong. Speed governor needs 2 bytes set. Your commands have specified length of 2 but you are passing only 1 byte and checksum (-2) so these commands would fail.

4643 16 1100 02 02 ?? | 3A D5
HEAD RW ADDR LN DATA2 | CRC16

?? Missing byte

Can u help me how to work around switch off the only by "pedal assist" starting?

I dont think that this is possible on those - dont have time rn to test rest of the addresses that ive found.

Also 2.5 and 3.0 controllers are a bit different - having some functions mapped to same addresses, an lots of other - unique to the model version.

The value could be entered with decimal precision, but it accepts it without I think!

reuzurq commented 9 months ago

The value could be entered with decimal precision, but it accepts it without I think!

From my observations only the 2nd byte changed the speed, first one did nothing for me but it required two of them.

reuzurq commented 9 months ago

If u send me your codes, i will share mines ;)

Im not very interested.

reuzurq commented 9 months ago

I mean, if you want to share something with the community - just do it, thats the point of this website. Dont see any point of this "private exchange" here :3