How I bypassed the speed restriction on my NCM 500W/48V Moscow Plus 29er.

The first thing that came to my mind after my first ride on my 48V/500W NCM Moscow Plus was "How can I make this bike faster?"
Throttle was maxed at 20mph(32km/hr) and the Petal Assist top speed was limited to 23mph.(37km/h)
I knew the motor was capable of much more to stay within the specs of Class 3.
So I made it my mission to try to find a hack or aftermarket hardware that would run my bike at the sweet spot of 28mph/45 kmh (Top end of Class 3)
I took to the internet to figure out my problem. After hours of digging through the interwebs I came across this thread in a german pedelec forum.

Code:
https://www.pedelecforum.de/forum/index.php?threads/kommunikation-zwischen-c7-display-und-motorkontroller-ncm-venice-das-kit.57050/page-1
A member by the name of vspadrva made some interesting advances. He managed to use an oscilloscope and logic analyzer to reverse engineer the Das-Kit C7 Display and create code using a microcontroller (ESP2866) to intercept the data being sent through the bikes data cables.

Here's a translated quote of his OP on that thread.

I have already published my research and results in the 'other' pedelec and E bike forum, but I hope to also reach other interested people here.

First of all, thanks to Arthus Dent who started over a year ago and based on his work.

My NCM Venice + 48V e-bike with Das-Kit C7 display and probably Lishui controller.
On the back of the display is
C600-1705-
B640 V2.7-EN

. After entering the code (8018), the display only allows you to change three support levels (Eco Normal Power) and to select the voltage 36 or 48V. Lockdown speed and wheel diameter are not accessible.
There are very poorly available € 119 tuning displays in which the last two things can also be changed.

So I cut the cable open and found out the function of the cable and the pin assignment using an oscilloscope and logic analyzer


(yellow is thumb gas with the usual about 1 to 4 volts)

Messages with
9600 baud at 3.3Volt TTL levels are exchanged on the data lines so that I could examine the protocol via USB TTL adapter.
At approx. 10 Hz, 12 bytes come from the display to the controller, which responds with 10 bytes.
Without a message from the display, nothing is sent from the controller. If you put the switch-on signal on the supply voltage, the controller uses the last setting and also works without a display.

For better testing, I soldered a pin header into the cable so that I can easily interrupt individual signals:


But now the exciting results:

Display -> Motor controller
b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 b10 b11
3A 2C 0A 46 1A 48 08 06 EC 00 0D 0A

Byte0: always 3A
Byte1: always 2C

Byte2: changes depending on the support level

09 with Eco
0A with Normal
0B on Power

Byte3: changes with drive

level 0x56 pushing aid
0x40 level 0
0x41 level 1
... to 0x46 level 6


Byte4: final speed 0x1A = 26km / h

Byte5:?
Byte6:?
Byte7:?

Byte8: checksum (b1 + b2 + b3 + b4 + b5 + b6 + b7) mod 256

Byte9:?

Byte10 and 11: 0D 0A (CR LF)


* The controller responds accordingly:

Controller -> Display

b0 b1 b2 b3 b4 b5 b6 b7 b8 b9
3A 2C 00 60 EA 00 76 01 0D 0A

b0: always 3A
b1: always 2C

b2: motor current 0x00 to 0x2A
not yet checked but makes sense , when the rear wheel is up and pedaling brings a short 01

b3: cycle time v = 1325 / b3 (at 27.5 ") at standstill always 0x60

b4: b3 and b4 are low byte and high byte of the cycle time.

b5: engine running: 0x00 im Standstill, goes to 0x16 as soon as the motor is switched on

b6: checksum (b1 + b2 + b3 + b4 + b5) mod 256

b7: in stand 0x00 when the rear wheel turns 6km / h + -0.8km / h it goes to 0x01. Even at about 2km / h, in a smaller speed window.

b8 and 9: 0D 0A (CR LF)


Next I grabbed a microcontroller (Teensy) and changed the messages coming from the display to the controller so that when I selected level two, I sent it to controller 6 at 36km / h maximum speed .

With 3D printed housing:

Depending on the battery voltage, the controller regulates at 29 to 32 km / h.
Since the bike is also sold in the USA by Magnumbikes as Metro Plus with 500Watt and 45km / h, I hope there is more. But it may be that another motor is installed there that can turn faster.

If you are interested I can also write more detailed instructions on how to connect and program a 5 Euro microcontroller there. In case someone just wants to replicate it.

You could also build a simple adapter and would have a pluggable solution.

Sebastian
The thread goes on and other smart programmers find a way to change the data values NCM set it place with their custom firmware. Eventually they created an open sourced project on github (which has some cool features)
After reading all of this and checking out the code on github. I had a good understanding what needs to be done to go that route and hack the display.
It wasn't something that I was interested at all to attempt to achieve. Also those german riders had 250W motor kits installed and were only trying to go as fast as my bike already could stock. (Due to speed restrictions in Europe)

So now what?

Something from vspadrva's post stuck with me.
the bike is also sold in the USA by Magnumbikes as Metro Plus with 500Watt and 45km / h, I hope there is more. But it may be that another motor is installed there that can turn faster.
This got me looking at Magnumbikes website.
Low and behold they run the same Das-Kit C7/i5 controller system (data protocol) as my NCM bike but can reach 28MPH!

This brought me to youtube looking up display tuning videos for Das-Kit C7 displays. MagnumBikes has a video posted there.

I watched it and saw the tuning screens (Pedal Assist/Throttle) that my NCM doesn't have in its settings menu. After watching, I starting thinking that maybe the speed restriction data is stored in the Das-Kit i5 Controller firmware. I would be SOL unless I changed the Controller and the Display. But then I saw this image attached on that same german pedelec thread.

displayteardown.JPG


Once I saw those chips, I knew there was firmware in the displays restricting the speed tuning options. I ordered a Magnumbikes C7 - 5 wire display.

disconnected.jpg

45kmh.JPG


Got it today, removed my stock NCM display and installed Magnums. Guess what? I can now go 25mph on assist and 23mph on throttle. :cool:

Here's a YT video of the new Display and the tuning options it gives my NCM Moscow Plus.



Hope this helps some of you out there wanting to go faster or tune the bike to go slower.
 

Attachments

Last edited:

Mike's E-Bikes

Well-Known Member
Interesting. I swapped the Magnum display and controller both onto NCM Aspen+, and it didn't make any difference at all. Did this 4 months ago.
 
I'm going to test the correct speed with a gps app on my phone tomorrow sometime. Also planning to see if changing tire size will affect anything.
 
I stock multiple of their displays as I am a Magnum dealer. Also an NCM dealer.
I can tell you there is a difference in the ride when you have the other on. Maybe not 28mph fast, but faster than a stock NCM display.
The biggest difference is when you have a full battery. With the G660 Display installed its like the bike is on steroids. Acceleration is faster and doesn't lag as much. I was testing on the strip of road out front of my house today. Full battery starts for both tests.

The NCM E694 Display topped out at 37.5 kmh on a full battery. 32km throttle.
The Magnumbikes G660 Display topped out at 43.1 kmh on a full battery. 37km throttle.

There is a noticeable difference in the torque depending on what display unit you have on. I find that the power band is better with the Magnumbikes G660 display on. I get from 0-32Km/h faster than the E694.

As the battery voltage drops, the top speed available on the G660 comes down quite a bit and soon matches up with the NCM E694's top speed (32kmh). I find the power on the motor to be more responsive with the G660 than the E694 as the battery dies out.

IMG_0253.JPG
 
Last edited:
Other things I noticed. The battery meter doesn't work on the G660 when connected to my NCM, only voltage. Changing the tire size does nothing for increasing speed.
 
Last edited:

Burak

New Member
Hello, I am planning on buying Aspen Plus or Moscow Plus. Anyway, could you help me step by step on how to unlock the true potential of this bike please, I am new to ebiking and i have no idea what to do whats so ever lol.
 
Hello, I am planning on buying Aspen Plus or Moscow Plus. Anyway, could you help me step by step on how to unlock the true potential of this bike please, I am new to ebiking and i have no idea what to do whats so ever lol.
Everything you need to know is right here already. Super easy. I’m still going to dig further and maybe try what the Germans are doing with their 250W’s on my 500w now that I have a spare display. See if I can push more out of it.