STEPS E8000 Motor Service
- Thread starter SmokeyBear
- Start date
Thanks Strindberg, I actually wanted to read what the IC's were but cant do that from these pictures whereas on the one you posted of the tilt sensor it was easy to read the IC part numbers.
None of this is of use to repairing the motor but being a geek I am curious.
Edit:
I just notice that the tilt sensor PCB in your pictures has 2 IC's on it whereas mine and the previous picture of yours has 1 IC on it.
Mine
Yours
Pity I cant read what those IC's are.
And on this picture.
www.emtbforums.com
None of this is of use to repairing the motor but being a geek I am curious.
Edit:
I just notice that the tilt sensor PCB in your pictures has 2 IC's on it whereas mine and the previous picture of yours has 1 IC on it.
Mine
Yours
Pity I cant read what those IC's are.
And on this picture.
STEPS E8000 Motor Service
Updating the list: 1 x 6808 2rs Sealed Ball bearing 40x52x7mm 1 x 6805 2rs Sealed Ball Bearing 25x37x7mm 3 x 6900 ZZ Shielded Ball Bearing 10x22x6mm 1 x 6000 ZZ Shielded Ball Bearing 10x26x8mm 1 x K25x29x10 Needle Roller Cage Assembly 1 x K25x29x17 Needle Roller Cage Assembly Mike: Thanks for...
www.emtbforums.com
Last edited:
Strindberg
Active member
Hej Hej @JimmyBoy
when I opened my E8000 I had a feeling that they weren't quite the same in this place.
I couldn't find metal grinding.
My Husqvarna received its third engine, this E8000, in December 2019, to locate its date of manufacture.
Now, I just asked @ PeterMayer about this IC mystery and I am waiting for his answer.
Normally, he comes back very quickly, even within half an hour.
I ask now the community here, could it be,
that the current success of my E8000 servicing depends on this difference between our PCB:s or more ?
when I opened my E8000 I had a feeling that they weren't quite the same in this place.
I couldn't find metal grinding.
My Husqvarna received its third engine, this E8000, in December 2019, to locate its date of manufacture.
Now, I just asked @ PeterMayer about this IC mystery and I am waiting for his answer.
Normally, he comes back very quickly, even within half an hour.
I ask now the community here, could it be,
that the current success of my E8000 servicing depends on this difference between our PCB:s or more ?
Last edited:
Strindberg
Active member
@JimmyBoy
As always @ PeterMayer answered me very quickly with a very long email which I can summarize as follows:
AMS has been taken over by Osram, and it is possible that the whole PCB has been changed.
This often happens in industry as now in Covid time with the shortage of Chips and components.
-------------------------
I presume, the functionality of the gravity sensor should be the same...
As always @ PeterMayer answered me very quickly with a very long email which I can summarize as follows:
AMS has been taken over by Osram, and it is possible that the whole PCB has been changed.
This often happens in industry as now in Covid time with the shortage of Chips and components.
-------------------------
I presume, the functionality of the gravity sensor should be the same...
Last edited:
Strindberg
Active member
@JimmyBoy and a second big email from @ PeterMayer >>>
These are the main components of the motor control PCB of a DU-E8000 drive unit =>
1) Frontside of the main motor control PCB of a DU-E8000 drive unit:
2) 6 N channel MOSFETs 60V 90A type BSB028N06NN3 from Infineon (see e.g. here) for driving the 3 phase BLDC motor:
3) Custom made communication microcontroller for Shimano proprietary communication system:
4) Backside of the main motor control PCB of a DU-E8000 drive unit:
5) Renesas RX62 microcontroller for motor control:
------------------------------
We would like to know, if after disassembling and reassembling the E8000,
this one works / they work perfectly like mine after my own intervention.
These are the main components of the motor control PCB of a DU-E8000 drive unit =>
1) Frontside of the main motor control PCB of a DU-E8000 drive unit:
2) 6 N channel MOSFETs 60V 90A type BSB028N06NN3 from Infineon (see e.g. here) for driving the 3 phase BLDC motor:
3) Custom made communication microcontroller for Shimano proprietary communication system:
4) Backside of the main motor control PCB of a DU-E8000 drive unit:
5) Renesas RX62 microcontroller for motor control:
------------------------------
We would like to know, if after disassembling and reassembling the E8000,
this one works / they work perfectly like mine after my own intervention.
Last edited:
Thats great @Strindberg , and many thanks to @PeterMayer for feeding my curiosity.
Thanks Strindberg, I actually wanted to read what the IC's were but cant do that from these pictures whereas on the one you posted of the tilt sensor it was easy to read the IC part numbers.
None of this is of use to repairing the motor but being a geek I am curious.
Edit:
I just notice that the tilt sensor PCB in your pictures has 2 IC's on it whereas mine and the previous picture of yours has 1 IC on it.
View attachment 77507
Mine
View attachment 77508
Yours
Pity I cant read what those IC's are.
And on this picture.
STEPS E8000 Motor Service
Updating the list: 1 x 6808 2rs Sealed Ball bearing 40x52x7mm 1 x 6805 2rs Sealed Ball Bearing 25x37x7mm 3 x 6900 ZZ Shielded Ball Bearing 10x22x6mm 1 x 6000 ZZ Shielded Ball Bearing 10x26x8mm 1 x K25x29x10 Needle Roller Cage Assembly 1 x K25x29x17 Needle Roller Cage Assembly Mike: Thanks for...
Sometime ago it was posted this picture. @johnynl was taking parts from a "donor" motor to fix his motor, and he found that these boards had different Revision Number and different ICs, but they were equivalent and he fixed his faulty motor by replacing the electronic PCB from the donor motor.
In the last picture from @Spiff of the older board, DU-E8000-0301, there is an IC on the edge of the board with a number 1335 on it and I think its an Allegro precision Hall-effect angle sensor IC. I cannot read the number on the other IC, perhaps its a tilt sensor.
I see on the newer DU-8000-0301 board a coordinate xyz symbol printed which usualy denote a tilt sensor. Also the IC on the newer board has a number 1624 which closely compares with an ams linear-position sensor number. Perhaps this is a special by ams with a tilt sensor added.
A tilt sensor would be used to determine the inclination at which a particular bike model has the motor mounted in the bike frame and this would be used to correct the pedal rotational position ( determined by the above angle sensor) for applying motor torque at the most efficient point of the riders pedal position.
I see on the newer DU-8000-0301 board a coordinate xyz symbol printed which usualy denote a tilt sensor. Also the IC on the newer board has a number 1624 which closely compares with an ams linear-position sensor number. Perhaps this is a special by ams with a tilt sensor added.
A tilt sensor would be used to determine the inclination at which a particular bike model has the motor mounted in the bike frame and this would be used to correct the pedal rotational position ( determined by the above angle sensor) for applying motor torque at the most efficient point of the riders pedal position.
Glad to know there's some interest in reverse engineering Shimano Steps electronics. Being that the torque sensor used in all steps motors (including ep8) has the same design prone to failure and the fact that there's no such thing as replacement parts, it would be nice to have an alternative of repairing this kind of fault.
I'm new to this forum but I had my fair share of time spent on solving errors regarding to Steps motors. I fixed almost all faults, except some water damage units and of course, the most common, torque sensor failure.
Here are my own findings regarding E8000 inner workings....
Some errors encountered and my description added:
E01020 ---- torque sensor disconnected
E01021 ---- torque sensor (startup values)not plausible
Obs: Can also trigger WS013 when the torque sensor intermittently outputs a signal, but it's outside normal startup value (with no load)
E01041 ---- Motor hall sensor failure/temp sensor failure (check electric motor for damage on the hall sensor/temp sensor pcb, coils)
E01003 ---- Battery voltage monitor failure
E01030, E01031 ---- Cadence sensor fault (check the magnetic ring on the crankshaft or the cadence sensor pcb)
Booting to menu
---------------
E01022----- Possible something related to current sensing
Obs: Boot to menu, walk assist works, only appearing when using power assist, as soon as the motor starts, regardless of assist level.
E020 ---- Motor - > battery communication fault, electrical fault on battery data lines (battery, connection with the motor, motor pcb .
Regarding torque sensor. So many parts and so small factor both on rotary and stationary PCB, not easy to reverse engineer. I found out that the signal that the assembly transmits to the mainboard is digital, possible I2C. The sensors themselves (the ones glued to the metal part) are not simply gauge sensors but they also have a digital part under the black resin, maybe something like an analog front end with the force sensor intergrated in the chip...again, complicated. I've attached some pictures of whats underneath it, but my microscope is not so good.
If there are any calibration, they are stored on the chip directly glued to the crank rotating piece. Replacing only the metal part with the sensors will cure the problem. The rotary and stationary pcb don't fail so easily, the same goes for the mainboard...unless water goes inside.
I've searched a lot about manufacturers for force sensors with digital output, and found something that looked a bit in the right direction manufactured by ALPS but it's just a hunch. All seems surrounded by secrecy. The cip that bridge the communication between display, battery and motor control MCU is something I didn't find any reference to maybe it was overprinted with some Shimano part number.
About main PCB:
Power part--control board
=====================================
MAX17504(IC201)-----> 8v primary output (display, DI2, etc), 5V LDo secondary
8v primary switched through M202 to :
1. Display and other DI2 accessories
//2. IC203---5v LDO-marking D9F 500--->mcu power supply, hall sensor board supply, gyro board supply) trhough a a diode
2. IC204(LDO) marking C4N 561 3.3v v ---> Logic ic SN74LVC07A (IC101) and unknoun chip (IC100, marking G9GXW 710S4d)
MAX17504(IC205)----->lights supply
MAX17502/1(IC202)--->7v primary output, 5v LDO Secondary
primary output to
Power part--motor driver/control
=====================================
MP6530 --- 3 phase gate driver
custom Infineon Directfet MOSFET part numbering 6x
direct replacement: IRF6648TRPBF
ACS723T LLC-45AB (bidirectional curent sensing IC up to 45A) 2x
(for phase current sensing)
EW-610B --- bipolar Hall latch sensor (3x)
(for rotor positioning )
standard NTC for motor temperature sensing (value unknown)
Logic control
============================
Main MCU ?? ---marking F562TADDFM, RX62TA
(https://www.renesas.com/eu/en/produ...ssors/rx/rx600/rx62t/device/R5F562TADDFM.html)
I'm new to this forum but I had my fair share of time spent on solving errors regarding to Steps motors. I fixed almost all faults, except some water damage units and of course, the most common, torque sensor failure.
Here are my own findings regarding E8000 inner workings....
Some errors encountered and my description added:
E01020 ---- torque sensor disconnected
E01021 ---- torque sensor (startup values)not plausible
Obs: Can also trigger WS013 when the torque sensor intermittently outputs a signal, but it's outside normal startup value (with no load)
E01041 ---- Motor hall sensor failure/temp sensor failure (check electric motor for damage on the hall sensor/temp sensor pcb, coils)
E01003 ---- Battery voltage monitor failure
E01030, E01031 ---- Cadence sensor fault (check the magnetic ring on the crankshaft or the cadence sensor pcb)
Booting to menu
---------------
E01022----- Possible something related to current sensing
Obs: Boot to menu, walk assist works, only appearing when using power assist, as soon as the motor starts, regardless of assist level.
E020 ---- Motor - > battery communication fault, electrical fault on battery data lines (battery, connection with the motor, motor pcb .
Regarding torque sensor. So many parts and so small factor both on rotary and stationary PCB, not easy to reverse engineer. I found out that the signal that the assembly transmits to the mainboard is digital, possible I2C. The sensors themselves (the ones glued to the metal part) are not simply gauge sensors but they also have a digital part under the black resin, maybe something like an analog front end with the force sensor intergrated in the chip...again, complicated. I've attached some pictures of whats underneath it, but my microscope is not so good.
If there are any calibration, they are stored on the chip directly glued to the crank rotating piece. Replacing only the metal part with the sensors will cure the problem. The rotary and stationary pcb don't fail so easily, the same goes for the mainboard...unless water goes inside.
I've searched a lot about manufacturers for force sensors with digital output, and found something that looked a bit in the right direction manufactured by ALPS but it's just a hunch. All seems surrounded by secrecy. The cip that bridge the communication between display, battery and motor control MCU is something I didn't find any reference to maybe it was overprinted with some Shimano part number.
About main PCB:
Power part--control board
=====================================
MAX17504(IC201)-----> 8v primary output (display, DI2, etc), 5V LDo secondary
8v primary switched through M202 to :
1. Display and other DI2 accessories
//2. IC203---5v LDO-marking D9F 500--->mcu power supply, hall sensor board supply, gyro board supply) trhough a a diode
2. IC204(LDO) marking C4N 561 3.3v v ---> Logic ic SN74LVC07A (IC101) and unknoun chip (IC100, marking G9GXW 710S4d)
MAX17504(IC205)----->lights supply
MAX17502/1(IC202)--->7v primary output, 5v LDO Secondary
primary output to
Power part--motor driver/control
=====================================
MP6530 --- 3 phase gate driver
custom Infineon Directfet MOSFET part numbering 6x
direct replacement: IRF6648TRPBF
ACS723T LLC-45AB (bidirectional curent sensing IC up to 45A) 2x
(for phase current sensing)
EW-610B --- bipolar Hall latch sensor (3x)
(for rotor positioning )
standard NTC for motor temperature sensing (value unknown)
Logic control
============================
Main MCU ?? ---marking F562TADDFM, RX62TA
(https://www.renesas.com/eu/en/produ...ssors/rx/rx600/rx62t/device/R5F562TADDFM.html)
Strindberg
Active member
I still made 101 km today
and since the 15th XI in 4 winterweeks exactly 1003 km with this E8000 engine that I restored.
Everything is 100% perfect.
Thank you for all the information!
So i guess the next step is to modify the hardware for more torque?
Or perhaps write a custom sw image? Since we know the mcu type and you have figured out the JTAG interface.
Strindberg
Active member
Tack så mycket @Taoplus !
E7000- och E8000-motorerna är lika, men har också skillnader.
Min Husqvarna hade först två E7000, en dog vid 1400 km, den andra vid 2500 km,
varje gång med fel W013 + E010 och på grund av vridmomentsensorn.
Min cykelhandlare satte i en E8000 i stället för E7000 utan att ändra något annat.
Han var tvungen att byta under garantin ... 57 E7000-motorer 2019 !!!
Lärorna från E7000 kan vara användbara för E800O,
men jag tror att du kan/bör öppna en ny tråd, men på engelska.
E7000- och E8000-motorerna är lika, men har också skillnader.
Min Husqvarna hade först två E7000, en dog vid 1400 km, den andra vid 2500 km,
varje gång med fel W013 + E010 och på grund av vridmomentsensorn.
Min cykelhandlare satte i en E8000 i stället för E7000 utan att ändra något annat.
Han var tvungen att byta under garantin ... 57 E7000-motorer 2019 !!!
Lärorna från E7000 kan vara användbara för E800O,
men jag tror att du kan/bör öppna en ny tråd, men på engelska.
Last edited:
pollywaffle
Member
Has anyone narrowed down what the reason is for all the bad noises and bearings?
Is it inexact tolerances on axles or whatever? Cos some motors make bearing creak straight out of the box while others take 5000kms
Is it inexact tolerances on axles or whatever? Cos some motors make bearing creak straight out of the box while others take 5000kms
Nice work!!
Any clue on the battery-motor protocol?
A good question
I don´t know the cause, but my feeling is that there is a lot of variability.
Some motors last 20.000+km, some fail before 3.000
Mine was donde with only 3500Km, and after 100km more had to replace all bearings, not only the ones on the pedal shaft, it was not a problem of water ingress or bad quality of the bearings (NSK)
robbydobs
Member
I've been thinking about this too.
One solution to failing torque sensors could be to change the firmware so it simply relies on cadence with no torque sensing. i.e. just smoothly ramp up the power to 30, 60, or 100% (depending on mode) when you start pedal.
I had a bit of a go at reverse engineering from the software side but haven't got anywhere.
I tried the open source decompiler ghidra
with this rx62 plugin
github.com
but couldn't extract more than a few basic commands. I think most of the firmware is encrypted. I am not sure if it is signed as well.
It is possible to setup the RX62 chip to prevent downgrading firmware, but Shimano haven't done that as it's quite easy to downgrade.
Thought i'd try and search for an encrypyion key in the apk or e-tube windows file.
It's quite easy to decompile these apps using JetBrains or Java decompiler online / APK decompiler - Decompiler.com which is I guess how ST Unlocked and eMax developers got their info.
I found an AES key that is used to encrypt and decrypt DAT files which I successfully pulled out into a small Visual Studio project and decrypted some DAT files included with the APK, but this didn't work on DAT files containing firmware.
I also found an AuthKeyGenerator class which generates keys using the serial number of the motor to send commands I think.
I did a binwalk on firmware. Mostly it comes up blank, but some firmware files show encryption:
C:\ProgramData\E-tube Project\FW>binwalk 2DUE8000-D.4.7.1.dat
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
3116 0xC2C AES Inverse S-Box
4236 0x108C AES S-Box
4492 0x118C AES Inverse S-Box
There are routines in the PC e-tube software to fix broken firmware, might be worth looking at those.
Might be easier to get into the earlier firmware I am not sure. These can all be found embedded in the old e-tube APK packages.
One solution to failing torque sensors could be to change the firmware so it simply relies on cadence with no torque sensing. i.e. just smoothly ramp up the power to 30, 60, or 100% (depending on mode) when you start pedal.
I had a bit of a go at reverse engineering from the software side but haven't got anywhere.
I tried the open source decompiler ghidra
with this rx62 plugin
GitHub - redballoonsecurity/rx-proc-ghidra: Renesas RX processor module for Ghidra
Renesas RX processor module for Ghidra. Contribute to redballoonsecurity/rx-proc-ghidra development by creating an account on GitHub.
github.com
but couldn't extract more than a few basic commands. I think most of the firmware is encrypted. I am not sure if it is signed as well.
It is possible to setup the RX62 chip to prevent downgrading firmware, but Shimano haven't done that as it's quite easy to downgrade.
Thought i'd try and search for an encrypyion key in the apk or e-tube windows file.
It's quite easy to decompile these apps using JetBrains or Java decompiler online / APK decompiler - Decompiler.com which is I guess how ST Unlocked and eMax developers got their info.
I found an AES key that is used to encrypt and decrypt DAT files which I successfully pulled out into a small Visual Studio project and decrypted some DAT files included with the APK, but this didn't work on DAT files containing firmware.
I also found an AuthKeyGenerator class which generates keys using the serial number of the motor to send commands I think.
I did a binwalk on firmware. Mostly it comes up blank, but some firmware files show encryption:
C:\ProgramData\E-tube Project\FW>binwalk 2DUE8000-D.4.7.1.dat
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
3116 0xC2C AES Inverse S-Box
4236 0x108C AES S-Box
4492 0x118C AES Inverse S-Box
There are routines in the PC e-tube software to fix broken firmware, might be worth looking at those.
Might be easier to get into the earlier firmware I am not sure. These can all be found embedded in the old e-tube APK packages.
It's UART based. I don't know the baud rate as I didn't had time to analyze that part. I had a BT-E6010 dismantled because of BMS fault. It seems the mcu used in it it's the same as in Yamaha downtube batteries. The bms manufacturer seems the same judging the PCB design similarity.
@robbydobs Nice work. I'm not so familiar with software debugging, I've tried myself to de compile e-tube app using dnSpy, you could try also if you're experienced on the software side. Modifying original firmware to work without torque sensor would be a big step forward (even if this means bafang BBS feel, more responsive though, because of advanced cadence sensor used in Shimano motor). Also, there's 2x torque sensors glued on the shaft, I guess if one fails, we can use the output from the one that still works.
Regarding firmware, there are 2 parts, one for RX62 motor control MCU and one for comm MCU (unknown type). Maybe different encryption key for each? Starting the system without RX62 connected is possible, the display works, assist switch works. I don't know the firmware update mechanism, if the RX62 firmware is decrypted on the pc/phone or by comm MCU and then sent to RX62 over SPI. There are multiple ways to reflash a RX62 as I've reviewed a bit the datasheet. But having the right file for programming is a challenge to me as embedded software developing is not my area of expertise.
Regarding firmware, there are 2 parts, one for RX62 motor control MCU and one for comm MCU (unknown type). Maybe different encryption key for each? Starting the system without RX62 connected is possible, the display works, assist switch works. I don't know the firmware update mechanism, if the RX62 firmware is decrypted on the pc/phone or by comm MCU and then sent to RX62 over SPI. There are multiple ways to reflash a RX62 as I've reviewed a bit the datasheet. But having the right file for programming is a challenge to me as embedded software developing is not my area of expertise.
Strindberg
Active member
Merci à toi @cream !
What you discovered seems to be a new point of view that did not previously exist
in the world of true connoisseurs, if I understand you correctly.
But it is true that on pedelecforum.de strictly no one has conducted with his own hands and mind a distant or in-depth study
of the mechanical part of the E8000, also in relation to all its electronic components.
Here too we keep telling us that "a servicing may not work"... but nobody tells us what not to do in reality.
Would this be some kind of agreement with Shimano?
I think that this close correlation between mechanics and electronics is not really probed.
The purely mechanical part was not examined at all either.
This is why I migrated partly to EMTB Forums for these essential points of view.
Pix: cadre et le champ des cygnes / frame and field with swans.
This evening I have done 1084 km since my intervention in this E8000,
which still does not display this famous behavior of a black swan with this torque sensor!
That's why we need this vision of a mechanical engineer like yours
in close connection with this embedded electronics, to understand what we do when we repair our E8000.
And so I could understand why my repair seems to be a success.
Only afterwards I could have 100% confidence in this engine again.
This is why I still ordered an E8000 engine from Commencal
because for my next Arctic expedition next covidfree summer 22, this time with a pedelec,
I shall not carry in Lapland in my trailor the slightest doubt!
In the meantime I continue my rides with my new-old Drive Unit E8000 until next spring.
Tomorrow 106 km in the French Elsaßthal and the German Rhein-Talweg, we have sun, no snow and up to 7 °.
------------------------------------------
Edit 17 XII 2021: 1185 km since 16. November
Today 104 km.
Edit 20 XII 2021: 1377 km since 16. November
What you discovered seems to be a new point of view that did not previously exist
in the world of true connoisseurs, if I understand you correctly.
But it is true that on pedelecforum.de strictly no one has conducted with his own hands and mind a distant or in-depth study
of the mechanical part of the E8000, also in relation to all its electronic components.
Here too we keep telling us that "a servicing may not work"... but nobody tells us what not to do in reality.
Would this be some kind of agreement with Shimano?
I think that this close correlation between mechanics and electronics is not really probed.
The purely mechanical part was not examined at all either.
This is why I migrated partly to EMTB Forums for these essential points of view.
Pix: cadre et le champ des cygnes / frame and field with swans.
This evening I have done 1084 km since my intervention in this E8000,
which still does not display this famous behavior of a black swan with this torque sensor!
That's why we need this vision of a mechanical engineer like yours
in close connection with this embedded electronics, to understand what we do when we repair our E8000.
And so I could understand why my repair seems to be a success.
Only afterwards I could have 100% confidence in this engine again.
This is why I still ordered an E8000 engine from Commencal
because for my next Arctic expedition next covidfree summer 22, this time with a pedelec,
I shall not carry in Lapland in my trailor the slightest doubt!
In the meantime I continue my rides with my new-old Drive Unit E8000 until next spring.
Tomorrow 106 km in the French Elsaßthal and the German Rhein-Talweg, we have sun, no snow and up to 7 °.
------------------------------------------
Edit 17 XII 2021: 1185 km since 16. November
Today 104 km.
Edit 20 XII 2021: 1377 km since 16. November
Last edited:
robbydobs
Member
The bluetooth ANT chip is a Nordic nr5x I think nRF5x SoC Overview
Pretty sure it's an nRF51 as the development SDK they used is nRF51_SDK_9.
I know this because it looks like a developer at Shimano tried to save a firmware hex file (encoded using Intel Hex) into the Android app, but instead accidentally saved a copy of the version control webpage they were using! It's even got their name and commit id in. Can't believe that made it out onto the Play Store! Anyway, this commit makes a lot of references to the above SDK (Software Development Kit, will be supplied by Nordic)
I don't actually think the firmware is encrypted, as you can pull out a lot of commands in Ghidra using little-endian and Arm Cortex as the CPU type.
Pretty sure it's an nRF51 as the development SDK they used is nRF51_SDK_9.
I know this because it looks like a developer at Shimano tried to save a firmware hex file (encoded using Intel Hex) into the Android app, but instead accidentally saved a copy of the version control webpage they were using! It's even got their name and commit id in. Can't believe that made it out onto the Play Store! Anyway, this commit makes a lot of references to the above SDK (Software Development Kit, will be supplied by Nordic)
I don't actually think the firmware is encrypted, as you can pull out a lot of commands in Ghidra using little-endian and Arm Cortex as the CPU type.
Have you inspected the 2 clutch mechanisms?
You can disassemble them, if you are careful. Look if the rollers are still ok and free to move.
yes, they are alright and free to move, except one because the ring that holds them, at that point they made it more a piece) ... it was full of white fat and I cleaned it well, I don't know how much and with what to lubricate it before reassembling it (I would like to reassemble it tonight) ...
ah the e7000 is a bit different yes. From your photos it seems it uses a wedge style bearing roller. So not round rollers, but wedge shape rollers.
Im not sure if they could be causing your problem. Perhaps. They could be sticky or something? Perhaps giving them a good cleaning and regreasing is all it takes?
The type of grease used for the E8000 clutches is mentioned a couple of pages back. Its Shell gadus s2 v100 2. But you can also reuse some of the white grease you find in other places of the motor compartment.
Im not sure if they could be causing your problem. Perhaps. They could be sticky or something? Perhaps giving them a good cleaning and regreasing is all it takes?
The type of grease used for the E8000 clutches is mentioned a couple of pages back. Its Shell gadus s2 v100 2. But you can also reuse some of the white grease you find in other places of the motor compartment.
Strindberg
Active member
@Taoplus.
By seeing the clutch of the E7000 with these wedge style bearing rollers
I understand now why I have ever had with my two former E7000, almost 3 or 5 time by a ride, problems whith the clutch.
It got stuck hard and noisy as if I had a very bad ratchet.
And the crank jumped a quarter of a turn or a little more.
By the way, I am only a cool macadam-traveler.
In pre-war cars like Mathis and even in DKWs or SAAB 96s we could have the "freewheel" system in the gearbox.
It is normally a reliable system.
For me this is a very serious design error from Shimano
in addition to the W013 + C010 errors (torque sensor !!! )
which killed the first E7000 at 1200 km and the second E7000 at 2700 during my trip in Sweden in October 2019.
That's why I have got a 3rd engine, the E8000, under warranty.
There was nothing else to change, E8000 fits in place of the E7000.
--------------------
Here the clutch from an E8000
Whith this much simpler clutch may be I have had a very little clutch failure once every 3 or 4 months.
And grease >>> OKS 270 .
I have done now 1377 kilometers since servicing on November 16, 2021 .
By seeing the clutch of the E7000 with these wedge style bearing rollers
I understand now why I have ever had with my two former E7000, almost 3 or 5 time by a ride, problems whith the clutch.
It got stuck hard and noisy as if I had a very bad ratchet.
And the crank jumped a quarter of a turn or a little more.
By the way, I am only a cool macadam-traveler.
In pre-war cars like Mathis and even in DKWs or SAAB 96s we could have the "freewheel" system in the gearbox.
It is normally a reliable system.
For me this is a very serious design error from Shimano
in addition to the W013 + C010 errors (torque sensor !!! )
which killed the first E7000 at 1200 km and the second E7000 at 2700 during my trip in Sweden in October 2019.
That's why I have got a 3rd engine, the E8000, under warranty.
There was nothing else to change, E8000 fits in place of the E7000.
--------------------
Here the clutch from an E8000
Whith this much simpler clutch may be I have had a very little clutch failure once every 3 or 4 months.
And grease >>> OKS 270 .
I have done now 1377 kilometers since servicing on November 16, 2021 .
Last edited:
Wait, did you put the OKS270 on the clutches? On all the rollers?
OKS270 has PTFE in it, which could be too slippery for clutch bearings. At least that is what bearing man is implying i think.
EMTB Forums
Latest articles
-
The most reliable motor brand (in Norway)
A poll was posted on a big Norwegian emtb facebook group. There are...- Knut Nes
- 3 min read
- Views: 821
- Reaction score: 4
- Comments: 2
-
2025 Canyon Spectral:ONfly CF Ltd review
We were quite surprised to read about the new lightweight Canyon...- Knut Nes
- 7 min read
- Views: 911
- Comments: 1