Luna M600 Ludicrous V2 reverse engineering and firmware making

I mean that button could be connected to the battery BMS and turn the battery power ON and OFF, there is no other connection between the controller and the BMS than just the battery power terminals.
 
Yes, this is how it was done since begining on E10. Question is if turning on battery is like main power ON. Will turn on controller and display. Could be done also this way.
 
Anyone knows what this transistor manufacturer and part number are? Maybe someone recognizes the logo or the weird symbol on this transistor and the manufacturer who puts such symbols? I did not find the part with exact markings and did not find the symbol in logo databases.

The package is very close to SOT-23.

1751245062636.png



It looks like this transistor belongs to the controller ON/OFF circuit. I have not complete this circuit yet but I already can see this circuit enables and disables 12V buck convertor and it is part of the voltage divider circuit makes up to 12V on the "ENABLE" pin of the 12V buck convertor chip to turn this convertor ON.

I originally thought this is maybe NPN BJT transistor with 1P marking and the weird symbol and 1A stand for something else (maybe date or manufacturer). But BJT transistor does not make sense in such circuit so it looks like it should be FET transistor working opposite direction.

1751247025590.png

1751247353078.png


1751247771859.png
 
Last edited:
Lets see rest of the circuit. Then we will be more clever.
Transistor will be used to self hold controller powered, I guess. Or turning on over transistor by that switch on the frame.
 
Last edited:
The hardware schematics are proprietary. Don’t you have any concerns about copying something like that publicly?
Will you sue him? You have just grabbed opensource schematics from Benjamin...
 
Last edited:
Anyone knows what this transistor manufacturer and part number are? Maybe someone recognizes the logo or the weird symbol on this transistor and the manufacturer who puts such symbols? I did not find the part with exact markings and did not find the symbol in logo databases.

The package is very close to SOT-23.
If it's ever helpful to anyone passing thru this thread, here's a few reference images, for manufacturer logos (there are many more than are listed in it, however), and for part types.

Your part doesn't seem to be covered in them, but they might help in the future.

Below that are some links to part idenfication resources, gathered from here https://electronics.stackexchange.c...components-or-how-do-i-identify-any-component and other similar links:

Another such page concentrating on logo links is https://electronics.stackexchange.com/questions/7641/identifying-manufacturer-logos-on-components

1751317278282.png
1751317557770.png

1751317341461.png


 
Last edited:
Alright, we might figured out the power ON/OFF circuit.

That " P 1P 1A " marking might belong to this Infineon SOT23 P-channel MOSFET


The first symbol is probably highlighted letter P which means IRLML9301 part number
1 means year 2021
P means week #16

1A is the lot code

The only issue this marking indicated dashes and the part does not have dashes. I did not find same marking codes without dashes.

1751347335719.png


But since it is P-channel MOSFET that circuit might makes sense.

The "KEY" should be shortened to the ground in order to activate the 12V buck convertor and power 5V and then 3.3V and the STM32. Then STM32 should send voltage on "Q102 GATE CONTROL" to keep the controller turned on. So the KEY could be connected to a momentary switch.

The Bafang controller pin connected there marked as "KEY", so I named it KEY. But the same pin is connected to the Bafang motor connectors PCB named VCC. I do no know what is the function of that pin on the Bafang M600 motor and I do not have display harness yet to check it but if you know what it is let me know if it makes sense.


1751347833089.png

1751347893968.png

1751347951078.png

1751348186364.png

1751348090131.png


1751348144532.png

1751348359109.png

1751348815669.png


1751348895761.png
 
Last edited:
Hello.

Do not speculate much about that transistor, just use some, with high voltage to be safe (there is that 13V zenner which is limiting it so also lover voltage is fine). In M620 scheme there was used just bipolar transistor.

They sometimes call it Vcc, sometimes Key.

As I wrote you, Key is connected to 2 buttons on a display, which are then grounding over resistors. PWR over 500 Ohm, button Down over 1500 Ohm. Was first confused, why the hell Bafang also has button Down connected this way. I guess it is because of safety for Walk mode (controller must get this signal also, not just from CAN).

And this is that opposite logic to M620. There is button press connecting Vcc to B+.
 
Last edited:
Unsoldred the wires and the big capacitors. The plan is to capture all the marked components then scrape the conformal coating off and take better pictures for easier tracking and then proceed making the schematics. The pictures with the conformal coating are not good enough. That should help to speedup the process and reduce errors

1751434500146.png

1751438118827.png

I am also thinking about how make it possible to solder it the easy way. Maybe the current sensors resistors only will be stencil+oven soldered first on the first side, then the opposite side with the MOSFETs will be stencil+oven soldered completely with all the components on that side (the hope is the current sensors resistors on the first side will not fall down during the process). Then the rest of the components on the first side will be manually soldered. Some components on that side have bottom pads and might need holes for soldering the bottom pads like those MOSFET drivers

1751438654691.png
 
Identified all the the unique marked components, now I can clean the board real good for crisp images without worrying too much I can erase the markings.

There are still a lot of unmarked components to identify and figure out, but since all the unique marked components were identified it is time to share the milestone files so you can review them if you want to.


1751619819842.png

1751619919815.png

1751619974981.png



1751619684426.png

1751619754708.png
 
Last edited:
The motor stator temperature sensor circuit has been reverse engineered. But there are other circuits connected to the temperature sensor connector on the PCB while the temperature sensor uses just 2 pins. I guess it is some kind of protection in case if somebody will stick the PAS/Torque sensor into the temperature sensor socket. We will figure this out soon.

1751931370005.png

1751931523742.png

1751931590266.png
 
The temperature sensor related circuits have been reverse engineered. There are 3 pins with the same circuits with resistors connected to them and to the STM32. I guess this is protection from connecting the torque sensor to the temperature sensor socket. When you stick torque sensor to the temperature sensor receptacle the circuits became voltage dividers and the MCU senses different than usual voltage on the pins and disables the power on the controller. Normally those 3 unused pins on the temperature sensor connector are open. It also connects +5V to the torque sensor ground pin, I guess this is on purpose to initiate that protection.

1751937652514.png

1751937680378.png

1751937756227.png
 
Hmm thats strange, why they played with temp sensor connector and using unused pins. Could be also prepared for normal 3 stator halls as it goes to STM. If this is the case and was prepared for 3x halls then more just like pull up resistor than voltage divider. Just 10k resistors to STM pins 3,5,6 I find quit high. Lets see if rotary magnet sensor U104 is working.

But you right, was really stupid from Bafang to use same 6 pin connector for temp sensor, which juts brings confusion. Much better would be to use 2 pin connector (or 4pin If they also wanna put there +5V for better than PTC sensors).
You know, no need to order 2 different connector types for production and saving some cents...

R135 does not have much meaning there. Only if some trimmer to calibrate PTC sensor.
 
Last edited:
That's interesting. It looks like Bafang m600 and Bafang M510 are different. Bafang M510 does not use motor stator temperature sensor and uses that receptacle for hall sensor instead? The temperature sensor has 2 black wires and the hall sensor has 2 white wires. But they both go out of the motor stator.


I found some information here


1752003616004.png


What does that hall sensor do and why it still has rotary encoder?

1752003720397.png


1752004482160.png

The torque sensor also looks different than the M600 torque sensor.

 
Last edited:
As far as I know, since M500 there is still this rotary position sensor(MT6816). Also in M510.

Talking about Luna. It could have been they idea and design, to get accessible also input pins for halls (if needed for some testing with other motors...). So could have use free pins in temp connector for this purpose.

That sensor is SPI, or PWM so they have used some other pins on STM.

Usually 5 wire cable for halls needed (+5V, GND ,H1,H2,H3).
 
Or maybe this is an artifact from the Luna Ludicrous V2 for BBSHD motor controller they claim this controller is based on.
 
It looks like they separated grounds between the shunts ground and the rest of the PCB ground. But they did it quite weird. They filled the space under the shunts with copper (top and bottom of the PCB), probably also connected top and bottom with vias and did not connect it to the battery ground wire soldering hole. Then they scraped the masking layer on that copper near the ground wire soldering hole and put a blob of solder to join the ground wire and that copper connecting the shunts ground.

I am not sure why they did it such sloppy way. Maybe they were not able to figure out how to join it in KiCAD properly.

But I do not think it is necessary do do such thing at all according to this discussion




1752027365334.png

1752027501799.png
 
It looks like they separated grounds between the shunts ground and the rest of the PCB ground. But they did it quite weird. They filled the space under the shunts with copper (top and bottom of the PCB), probably also connected top and bottom with vias and did not connect it to the battery ground wire soldering hole. Then they scraped the masking layer on that copper near the ground wire soldering hole and put a blob of solder to join the ground wire and that copper connecting the shunts ground.

I am not sure why they did it such sloppy way. Maybe they were not able to figure out how to join it in KiCAD properly.
Maybe it's designed this way to 'save' the electronics in case of too high controller temperature. The solder would melt breaking the connection?
Or to simplify manufacturing process.
 
Hello

New bafang controllers does not use CAN on torque sensor (that 2 connector pins are not connected to CAN bus any more). Only that analog output. Not sure if new torque sensors still have CAN output.
So if Luna firmware is using CAN from torque sensor, can be a problem.

I see it wont be easy to make it all work. :( Is logical to put this controller into M560, rather then to M600 (with nylon gear and high power could be a problem)

Why that diodes to ground? Some safety against negative voltage?
 
Back
Top