Bosch ebike battery communication protocol

akio123008 · July 5, 2022

I'm trying to repair a bosch ebike battery (specifically a "powerpack 400").

The battery cells are all in perfect condition, but the BMS board has died. so I need a new BMS. (pretty much every single component has been fried)

Here's the problem: the Bosch BMS has an extra 3-pin connection that allows it to communicate with the ebike drive system, so using a normal "dumb" BMS board from Amazon or Aliexpress won't work, since of course the bike will only work if it can communicate with the battery.

I don't think I need to mention that of course, this Bosch BMS cannot be obtained, even by a proper Bosch certified bike shop. I've been trying to hunt one down for weeks now, without success.

Now because I don't want a perfectly good battery to go to waste and a new 500+ euro unit to be bought, I really want to fix this. What I need to do is somehow fake the communication from the BMS with some kind of microcontroller that I can put in the battery. I'm quite experienced with electronics and microcontrollers, but I have no clue what kind of communication protcol the bosch system uses. I've seen some comments online that the battery uses CAN bus, but even if that's true that's still too little information to spoof the BMS. Therefore I'm hoping someone here knows some more details about the communication protocol these battery packs use or where to find this info, so that I can try and rig something up to make the bike think there's a proper Bosch BMS in the battery.

Thanks in advance!

akio123008 · July 12, 2022

Anyone?

Bropane · October 14, 2022

I’ve had the same problem for a while

now and I haven’t solved it. My bike has a dual battery system and I don’t go very far so I’ve been just ignoring it. I’ve thought about doing something similar to what you proposed and I think it’s doable. I’ve also read that Bosch uses CAN for communications. This makes sense because they created the CAN bus system for cars decades ago. If that’s the case, it’s possible they are communicating in a way which is standard for cars also. If there’s a standard message type for battery voltage for cars, they probably send it through the network that way for our bikes. If a CAN bus analyzer we’re to be connected to the com wires, I think the messages would be very similar. I know this thread is old but if you found out anything new about this problem I’d love to hear it. Cheers!

akio123008 · October 17, 2022

On 10/14/2022 at 6:47 AM, Bropane said:

I’ve had the same problem for a while

now and I haven’t solved it. My bike has a dual battery system and I don’t go very far so I’ve been just ignoring it. I’ve thought about doing something similar to what you proposed and I think it’s doable. I’ve also read that Bosch uses CAN for communications. This makes sense because they created the CAN bus system for cars decades ago. If that’s the case, it’s possible they are communicating in a way which is standard for cars also. If there’s a standard message type for battery voltage for cars, they probably send it through the network that way for our bikes. If a CAN bus analyzer we’re to be connected to the com wires, I think the messages would be very similar. I know this thread is old but if you found out anything new about this problem I’d love to hear it. Cheers!

I Ended up fixing this particular problem by getting a whole bunch of dead batteries and managing to find one that had a worling BMS board in it.

I'm also still interested in finding out more on how exactly this communication works though, for future problems. I think it's insane you basically need to discard an entire battery with all cells in good condition because of a dead piece of shitty electronics.

At this point I don't have any CAN bus reading device, but at some point I might get one and hook it up to the ebike bus.

What I'm worried about though, is there may be encryption involved as well. The BMS could contain some kind of private key that it uses to sign the messages so the bike can verify it's "genuine bosch" crap. In that case, crafting a battery message with a DIY setup would be almost impossible, it would require breaking the encryption or obtaining the original private key.