-
Notifications
You must be signed in to change notification settings - Fork 9
Bafang LCD SW102
SW102 LCD is a 64x128 pixels monochrome graphic LCD with Bluetooth.
Our OpenSource firmware repository: https://github.com/OpenSource-EBike-firmware/SW102_LCD_Bluetooth
Although seems it is not possible to open this LCD without breaking/deform it, it is easy to access to the board that has the firmware programming/debug pads:
- Remove Up/Down keypad cover with a cutter by gently levering it out (you can leave the M button lid in place
- Cut in between the cases edge and key pad and repeating this over and over again until you can lift of the key pad by gently levering it out. Don't cut in between LCD and keypad because it is very likely that the glass will break.
- you will find the firmware programming/debug pads under the keypad plastic cover
There are 2 boards. The main board is the smaller one that has the NRF52 microcontroller and the bluetooth antenna. This board connects the the LCD board using a flat cable. The LCD boards seems to have all the circuit for the power and LCD control.
16MHz ARM Cortex-M0, 256 KBytes flash memory and 32 KBytes RAM memory.
Package: QFN48 (48 pins).
Bluetooth Low Energy and 2.4 GHz SoC The nRF51822 is a general purpose, ultra-low power SoC ideally suited for Bluetooth® Low Energy and 2.4 GHz proprietary wireless applications. It is built around the 32-bit ARM® Cortex™-M0 CPU with 256/128 KB flash and 32/16 KB RAM. The flexible 2.4 GHz radio supports Bluetooth Low Energy and 2.4 GHz proprietary protocols, such as Gazell.
It incorporates a rich selection of analog and digital peripherals that can interact directly without CPU intervention through the Programmable Peripheral Interconnect (PPI) system. Flexible GPIOs enables you to connect digital interfaces like SPI Master/slave, TWI Master and UART to any of the 31 GPIOs on the device.
This is a DC-DC converter that converts the battery voltage to 1.32V (maybe to the NRF microcontroller??) and other IC on the board after converts to 3.3V.
Electric signal on the connector of flat cable. From left to right (starting counting near D5):
1 - UART tx (black wire of LCD cable)
2 - UART rx (black wire of LCD cable)
3 - on/off button state (3.3V when pressed and 0V otherwise)
4 - enable/disable power circuit (1 logic to enable)
5 - 1.32V (maybe this is a voltage needed to NRF51)
6 - GND
7 - 3.3V Vcc
8 - LCD data
9 - LCD clock
10 - LCD command/data
11 - 3.3V
12 - LCD chip select
Files recorded with DSLogic logic analyzer, on the LCD data signals. Install DSLogic software and open the files to see the init sequence and regular data/pixels write to LCD: https://github.com/OpenSource-EBike-firmware/Color_LCD/tree/master/Bafang_LCD_SW102/DSLogic_save_files_LCD_data_signals
It is possible that there is a Bluetooth bootloader based on the Nordic bootloader and probably with a custom encryption keys (locked bootloader that we can't use).
Access to the board that has the firmware programming/debug pads doing this:
- use something thin to slide on the sides on the keypad
- force gently to the side the plastic cover until you can remove the keypad plastic cover
- you will find the firmware programming/debug pads under the keypad plastic cover