Luna M600 Ludicrous V2 reverse engineering and firmware making

[TPEHAK]

Those are TVS diodes so it is protection from voltage spikes in those circuits.

According to this discussion it looks like this controller uses only analogue signal torque sensor output and it does not use cadence sensor data. I do not know how it affects M560 or M600 motors

Luna M600 Ludicrous V2 controller documentation - Electricbike.com Ebike Forum

Proud owner of the amazing M600 Ludicrous V2 controller? Here you will find all the info, software, documentation and support from the engineering team to get the best out of this extreme piece of tech. <<<< DOWNLOAD THE LATEST USER MANUAL...

electricbike.com

 

[DaDo.Bzz]

Usually is another one also against Vcc.

Then is fine if Luna is taking analogue. I can imagine Bafang removed CAN chip from new torque sensors to save some cents.

 

[TPEHAK]

This is how for Innotrace controller the torque sensor is connected. This is for UART torque sensor but I guess it uses the same torque sensor analogue output (and also crank arms direction/speed sensor output). I noticed the pin LJ on the torque sensor is marked the same for M620 UART and M600, I guess this is the same signal on both UART and CAN sensors.

 

[TPEHAK]

Maybe it's designed this way to 'save' the electronics in case of too high controller temperature. The solder would melt breaking the connection?
Or to simplify manufacturing process.

Yo phobos, do you still want to test the VESC for Bafang m620 UART controller? I designed a cheap version of the power stage so making the controller should not be expensive now

Archon X1 Programming Thread (questions and experiences)

The motor with controller CAD model can be downloaded or checked on the GrabCAD https://grabcad.com/library/vesc-for-bafang-m620-uart-1 You can use it for reference to see the cables connections and proper cables routing. The motor controller area is precisely reverse engineered and can...

forums.electricbikereview.com

We still need to figure out the VESC firmware for this controller though. It looks like the folks from VESC discord know something about it or may be able to help. But be careful out there, there is mxleming guy and it looks like he has some power on that server and he is really mad lol

 

[TPEHAK]

The board temperature sensor circuit has been reverse engineered

 

[TPEHAK]

What does that "Front light load switch" do? For some reason the brake signal (SL pin on the Bafang controller) is shortened on the Front Light Load Switch (QD pin on the Bafang controller) on the Luna controller. Is this how it is on the original Bafang M600 controller?

 

[DaDo.Bzz]

Just turning on 6V (or 12V with new controllers) for front light (and rear). Then going to first and 3rd connector on the body.
Maybe Luna has not integrated a light. But why would they shorten SL with QD can not explain.

 

[phobos]

Yo phobos, do you still want to test the VESC for Bafang m620 UART controller? I designed a cheap version of the power stage so making the controller should not be expensive now

I looked into it but currently I prefer riding than tinkering, so I'll continue sometime in autumn.
Great work on both controllers so far though, especially this one, pairing it with m560 should be sweet without the bafang firmware BS.

 

[TPEHAK]

Started reverse engineering the main wiring harness connector. It turned out all 3 receptacles on the Bafang M600 motor case have CANL, CANH, 5V and GNG pins and all those pins are connected to the Luna controller. That means we can connect VESC Express dongle outside of the motor using any of those receptacles and use USB or Bluetooth to calibrate the rotary encoder and do another stuff with the controller using the VESC Tool application. That means we might not need that Bluetooth module on the PCB (that part is obsolete and hard to find).

Innotrace controller does not have 5V output and for the VESC for Bafang m620 UART controller I implemented an additional circuitry for 5V and it also requires the motor harness modification to make the VESC Express works with that controller but it looks like the Luna controller should work with VESC Express out of the box (You still need to make a cable for VESC Express though).

Archon X1 Programming Thread (questions and experiences)

Hello, did you try to contact Krasnodar first for assistance? I would contact him first. Maybe ask him when he is planning to make the online server available again (he promised to make it available soon some time ago). If he does not respond here is the link for the bypassed tool with advanced...

forums.electricbikereview.com

 

[TPEHAK]

The brakes circuit has been reverse engineered. Some other circuits are also updated

 

[TPEHAK]

The throttle circuit has been reverse engineered

 

[DaDo.Bzz]

Good job. Would go higher with R163 and R164. I noticed the throttle halls have soft output. Little better resolution then I guess.

 

[TPEHAK]

Could be just a mistake in Benjamin scheme. Should have been named PC11_TX and PC12_RX. In 300A scheme version it is OK.

What caught my eyes is SWCLK and SWDIO. Does it mean STM32 in VESC can update firmware of the BT module?
I guess we need only Tx and Rx for BT communication.

Also check 300A VESC scheme. I guess this was the source for Luna as they have also 16S, no?

It looks like this motor controller is not capable to update the Bluetooth module firmware. This Bluetooth module should use pins P0.17 and P0.19 for this operation but it looks like those pins are not connected on the Luna controller (I can see no vias under those pins on the opposite side of the board and no extra tracks going around). It looks like it uses the same pins as VESC MK5 except the one dedicated for LED and the one dedicated for the integrated antenna.

 

[TPEHAK]

The speed sensor circuit has been reverse engineered

 

[TPEHAK]

Reverse engineering of the main harness connector is almost complete and another weird circuit has been found

There is an unmarked pin on the connectors PCB (also unmarked on green Bafang controller PCB and marked IO on blue bafang controller PCB) which is not connected to anything on the connectors PCB. But that pin is connected to this weird circuit with transistors controlled by STM32. There is something should be connected to that pin on the connectors PCB to make it functional. It will not work with the stock Bafang connectors PCB.

 

[TPEHAK]

And the main harness connector has been reverse engineered. So all the connectors circuits are complete.

There is another not connected to anything on the connectors PCB pin (not marked on the connectors PCB and on the green Bafang controller, and marked "IO" on blue Bafang controller). That pin is connected to STM32 through another weird circuit.

Those circuits might be something Luna used for the controller development or maybe those circuits have a purpose for actual use (which requires the connectors PCB modification and probably the wiring harness modification)

 

[BikeDev]

Yo phobos, do you still want to test the VESC for Bafang m620 UART controller? I designed a cheap version of the power stage so making the controller should not be expensive now

Archon X1 Programming Thread (questions and experiences)

The motor with controller CAD model can be downloaded or checked on the GrabCAD https://grabcad.com/library/vesc-for-bafang-m620-uart-1 You can use it for reference to see the cables connections and proper cables routing. The motor controller area is precisely reverse engineered and can...

forums.electricbikereview.com

We still need to figure out the VESC firmware for this controller though. It looks like the folks from VESC discord know something about it or may be able to help. But be careful out there, there is mxleming guy and it looks like he has some power on that server and he is really mad lol

Why is this mxleming guy so mad anyway?
You should give the MESC firmware a try — it runs way better on that controller than VESC.

 

[TPEHAK]

Why is this mxleming guy so mad anyway?
You should give the MESC firmware a try — it runs way better on that controller than VESC.

He believes I am Krasnodar and it looks like there is a drama between him and Krasnodar.

I do not know where to take that MESC firmware, but it looks like the guys from the VESC Discord server know how to make VESC firmware works on that controller.

 

[mxlemming]

Why is this mxleming guy so mad anyway?
You should give the MESC firmware a try — it runs way better on that controller than VESC.

The mad Mxlemming is also here unfortunately.

I have no idea wtf the motivation for this reverse engineering is, but tpehak managed to piss off a discord group with me, hackey from 3shul, marcos from luna, Benjamin vedder, tech from team triforce... Loads of people who actively contribute to the VESC or design commercial hardware... With completely bizarre behaviour, repeatedly refusing help with improvements and refusing to share original innotrace firmware he had attained from some mysterious source.

Deleted user is tpehak in the screenshots below. Make your own mind up if I'm mad. You can of course go and find the discord server and see the whole unredacted conversation if anyone is that excited... It doesn't vary much from the examples given.

 

[TPEHAK]

The mad Mxlemming is also here unfortunately.

I have no idea wtf the motivation for this reverse engineering is, but tpehak managed to piss off a discord group with me, hackey from 3shul, marcos from luna, Benjamin vedder, tech from team triforce... Loads of people who actively contribute to the VESC or design commercial hardware... With completely bizarre behaviour, repeatedly refusing help with improvements and refusing to share original innotrace firmware he had attained from some mysterious source.

Deleted user is tpehak in the screenshots below. Make your own mind up if I'm mad. You can of course go and find the discord server and see the whole unredacted conversation if anyone is that excited... It doesn't vary much from the examples given.

It is good to see you are here and I hope you calmed down. I am currently focused on VESC for Bafang M600 controller so I am not able to contribute to your work with VESC for Bafang m620 controller firmware at the moment. But it looks like there are people who would like to try to build this controller and to try the VESC firmware for this controller so feel free to create a dedicated tread here about the VESC firmware for VESC for Bafang m620 controller (also known as Innotrace controller) and post the instructions about how to make it works.

I have no idea why Benjamin Vedder is pissed off, he literally makes money on donations from the VESC firmware and my work sertanly contributed to his welth. I am all about people donating him money for his work and I am sure people will gladly do this if he will make a little effort and post the instructions how to make his firmware works on this controller. Even I will gladly donate him for his work.

 

[amberwolf]

@TPEHAK : Personally, I don't understand why, if you are doing all this publication of reverse engineering, you would not simply publish the requested binary.

Seems a bit petty.

 

[TPEHAK]

@TPEHAK : Personally, I don't understand why, if you are doing all this publication of reverse engineering, you would not simply publish the requested binary.

Seems a bit petty.

That is OK. We need to finish the VESC firmware so we do not need anything else. In regard of what the VESC team thinks about it I would think about it as a motivation factor or a challenge for the VESC team if they can bring something better than the Innotrace firmware. And I can judge them - currently the VESC firmware for the Innotrace controller is not even working (or at least I can not make it works). We need to make it simple to install in the first place - just flash the firmware with ST-Link and start working straight out of the box without dealing with all those configurations and lisp codes. Ideally also it should be able to trigger the rotary encoder calibration procedure just simply pressing some buttons combination on the display without connecting the controller to PC.

 

[TPEHAK]

Alright, the LED indicators circuits have been reverse engineered. We are getting closer guys!

 

[BikeDev]

The mad Mxlemming is also here unfortunately.

I have no idea wtf the motivation for this reverse engineering is, but tpehak managed to piss off a discord group with me, hackey from 3shul, marcos from luna, Benjamin vedder, tech from team triforce... Loads of people who actively contribute to the VESC or design commercial hardware... With completely bizarre behaviour, repeatedly refusing help with improvements and refusing to share original innotrace firmware he had attained from some mysterious source.

Deleted user is tpehak in the screenshots below. Make your own mind up if I'm mad. You can of course go and find the discord server and see the whole unredacted conversation if anyone is that excited... It doesn't vary much from the examples given.

How do I find the server on Discord? Do I need a link?

 

[mxlemming]

For anyone reading this looking into the innotrace saga

bldc/hwconf/itr at master · vedderb/bldc

The VESC motor control firmware. Contribute to vedderb/bldc development by creating an account on GitHub.

github.com

By the grace of Benjamin Vedder, there is the open source firmware for the innotrace x1. Installing it won't be easy, you'll need to access the SWD and it might involve wiring and breaking seals and configuring with the included lisp script, with risk of bricking things, but it's there. I've tested it personally, it works with enough enthusiasm and effort.

Now...

Regarding this saga of "reverse engineering"... There is absolutely no way in hell anyone with the capability of the purported level of engineering is unable to get the firmware working. It's just inconceivable.

This leads to the logical conclusion, with the bizarre behaviour and mysterious firmware supply that the efforts are a ruse to dampen and delay anyone's frustration with being screwed out of a working bike.

This Luna reverse engineering appears to be nothing more than spite at a competitor... Luna have AFAIK honoured GPL requirements (hardware is not covered by GPL and the creator of the luna board is plenty capable of making his own VESC compatible design) and have their firmware pushed to the main VESC repo

bldc/hwconf/luna at master · vedderb/bldc

The VESC motor control firmware. Contribute to vedderb/bldc development by creating an account on GitHub.

github.com

So... If you're an unfortunate x1 customer with a bricked/locked out bike, your primary options seem to be significant personal effort and risk flashing open VESC firmware from the repo linked above or to persue legal action to get the situation sorted.