I've bought a generic EUC and found the speed limit to be a bit annoying, still being aware there will be any kind of hardware limitation (battery (voltage drop), motor heat, controller heat).
As a software developer being a little into hardware as a hobby I thought it would be great to have the firmware at hand and do any kind of adaptation possible (reading more of this forum also some security aspects like cut off could be tuned).
So I questioned myself whether it may be possible to do it just by owning the hardware as I don't expect to find anybody at all and somebody finally willing to share the code.
When opening it for installing a bicycle computer I had a look at the controller and it uses a STM32 (F103C8T6) controller for which I could find the manual with all information like
Searching for whether the flash can be written 'and' read I found that it's possible as long as there has been no explicit read lock set by the manufacturer. As I hope that this is not the case I diged further and found that the interfaces this STM32 should have for programming is some serial interface and a JTAG (being on the same PINs and automatically switched).
The spec. for the chip clearly states which PINs these are and if somebody every looked into the world of firmwares (e.g. OpenWRT) for wireless routers, it seems standard that some of the programming/debugging interfaces are just left on the board, so it's the same case for my controller board:
Fortunately I still don't own a JTAG adapter, but now one is ordered. I also found an interesting paper from blackhat conference showing available tools, JTAG finding and some more (https://www.blackhat.com/presentations/bh-europe-04/bh-eu-04-dehaas/bh-eu-04-dehaas.pdf)
So this is were I'm currently, quite at the beginning, but I would like to know if anybody has some input or ideas to contribute.
This could fast also be a dead end road but let's see, if the image can be read (I will first try with openOCD) it should be possible to disassemble and decompile, maybe it will be hard to recompile it, but maybe some things can be adjusted by just working on the raw image.
If there is some progress I will add it here.
EDIT (16.09.2015): Replaced image showing debug connector to show now used SWD (Serial Wire Debug) pin out (STM32 also has JTAG but on my board layout two of the JTAG pins are used for the power LEDs, so they are redefined as GPIO, while SWD works fine).
FINALLY I found the bug on my code!! The angle interpolation was wrong... I had to try simulate some code and the hall sensors signal on the board, use bluetooth to get the data, etc, etc, took me a lot of time but I got it :-)
Here a screenshot of the wrong values at left side and just after at right side after being correct: motor_rotor_position going from 259º up to 0º, in loop:
Then I got the motor working the best until now and I really think is very robust!!!
On the next image, I accelerated a few time the motor, very fast, in both directions. Id is controlled to be 0 by FOC and it is, just one fast accelerations it is not but we can see the "correction_value" that is the output of the FOC controller that follows fast on the accelerations. Also we can see values of Iq current of max ~-+5 Amps (current firmware code do not limit the max current).
Motor speed also indicates the direction of the rotation. Positive in one and negative in the other. The duty_cycle is the value that I control with the potentiometer.
Now see the video I recorded on a similar test. Can you see how fast is the acceleration and changing rotation direction?
The power supply is suppling 62V, can you see when I decelerate fast that the power supply shows a max of about 90V?? -- that's the regen voltage, the energy that should flow to battery when we brake!!
And the motor asks for about 0.6 amps at max speed without any load, but when I tired to block with my hand, at some duty_cycle value, the motor asked for about 2.8 amps!!
The motor did run at max speed of 24km/h (voltage power supply = 62.2V). For a battery pack of 60V, 16S = 16*4.2 = 67.2V, motor should run at max speed of 26km/h.
Next, move to the balance controller algorithm!!