stiga c300 - electric tractor, ride on lawnmower

[szczur333]

I disconnected everything but vms CAN - 13 frames only

0x71F is a frame which bms sending request to VMS

one of rest of them is probably an answer to it - but still even if you able co copy this signal - it might work but probably bms need to get other data all the time

as I said before - its only depend how complex stiga system is - if its simple you can figure it out I think in 1-2 days, if its need signals all the time it can take weeks/months

good thing is you get 48V right away after you switch it on - so even if vms or traction controller is completly burned you still can add your own controllers to run it

I hope you can figure sth out and share it with us

 

[Dave-OLW]

I see 10 different numbers in 19fUD.txt file and its only 7 positions - but maybe these logs also between heights

try to make that:
in savvy can choose only ID 19F (as you think this is deck height)

set up deck on position 1 - then SAVE DECODED frames , and do the same with all other heights
one height - one txt file

this will gives you 7 different txt with only one line of hex

to make it simpler - copy all of them to one txt file and next to it write which height is that - then you can compare data - if you saving logs in time as i said this can you tell also height data between postion during chaging

Have made seperate files at each deck postion for only ID 19f but does not show any pattern. Have extracted from files into one file attached.
There is a 6 pin plug/sdcket below LCD I cannot find on wiring diagram via colours or number of w1res. Do you have this, do you know what it is? Have checked all other IDs and no data changes in any of them.

 

[szczur333]

Have made seperate files at each deck postion for only ID 19f but does not show any pattern. Have extracted from files into one file attached.
There is a 6 pin plug/sdcket below LCD I cannot find on wiring diagram via colours or number of w1res. Do you have this, do you know what it is? Have checked all other IDs and no data changes in any of them.

if nothing changed - I will try to sniff CAN2 - as i said before - maybe there is second can only for deck and basket

you can also try disconnect 20pin - and thn power on - while its power on plug 20pin and see what happen in savvy can


also there is another solution to display deck level - in 6pin connector to actuator 3 wires are for potentiometer - depend of retraction level there is specific resistance value - check resistance on each level - then you can code exact reistance value to deck level - totally without CAN, thats how I will do mine

 

[Dave-OLW]

if nothing changed - I will try to sniff CAN2 - as i said before - maybe there is second can only for deck and basket

you can also try disconnect 20pin - and thn power on - while its power on plug 20pin and see what happen in savvy can


also there is another solution to display deck level - in 6pin connector to actuator 3 wires are for potentiometer - depend of retraction level there is specific resistance value - check resistance on each level - then you can code exact reistance value to deck level - totally without CAN, thats how I will do mine

Wiring shows VDD, VSS, S, +, -, are you saying the last three are a potentiometer?
Where is the 6 pin connector? Spares diagram shows wiring loom cable goes from actuator to VMS.

 

[szczur333]

+ and - is main power - VSS is ground , VDD is 5V or 3,3V and S i analog signal

in mine actuator between blue and white i have 3,5k ohm on min position and 6,5k ohm on max postion (or other way around) but doesnt matter - point is this means i got 3k ohm range so for example if i want to set actuator on 50% I need 5k ohm readings - if my controller READ that resistance it will to stop givin power so it end exactly on 50%

I dont know what it looks like in real life - but from diagram its looks like actuator is powered direclty from VMS - probably on 48v max current will be 2A maybe but I think lower than that so thin cable is enough

tractor off
plug multimeter between VSS and VDD - 10k ohm is most popular potentiometer but can be 1 or 5k

then turn tractor on and plug mulitmeter between VSS and S (or VDD or S), adjust a deck and see how resistance are changing - then you will can assign every resistance to exact position of deck

 

[szczur333]

I did some further testing on my broken C300, unfortunately I didn't get usable CAN signals.

So I disassambled the VMS from the traktor and started analyzing it in my lab. The culprit was quickly found:

Some pre-owner obviously killed the CAN bus TVS diode. I removed it completely, so I hope I get valid CAN bus signals now.
I was also able to figure out UART signals from ESP32 on the pin header next to it. So we are obviously able to even flash it (see also attached boot log).
Next step is to find UART or any other debug possibility for the main microcontroller STM32F105VCT6, then I should know what is really missing during bootup of the controller. I still assume that VMS misses bms/battery, I hope with some CAN bus traces from you guys I will be able to create my own bms comms.

@szczur333 As your VMS has the ESP32 addon board as well, I am pretty sure your Stiga should be visible via BT as well.

hey, any update?? are you able to DUMP .bin file from uart ? I have only a little knowledge about it and dont want to dissasemble it again - i dont know for sure - but in hex editor probably you can see TEXT info - so you will see for example - battery_soc and next to it should be can frame ID



I have also quick solution about your problem, instead translating signals from your BMS to CAN system in VMS - just TRY to SEND/WRITE this frame- 0x19F -> 8C D2 F7 FF 40 40 40 38 by your esp32 + transceiver to your VMS

this frame is my frame with 56% soc and normal temps and voltages - i dont know how often you should send these but I assume every ~20-50ms? then vms got tricked and tractor should start

of course translating all singals will be ultimate goal but for test only it should be enough

 

[riogrande75]

Just received the defective parts of my VMS' CAN transceiver (tvs diodes) and soldered them in the circuit together with a new 120 ohm resistor. These parts have been killed, hope that the TJA1042 survived it. I will stuck all parts together and then try to grab anything on the CAN bus. If CAN is ok again I will send the posted command - thx for that.

Update:
Unfortunately CAN transceiver TJA1042 has burned too - so some more days until I get replacement parts.

 

[szczur333]

they release new pro model parts catalogue (only for tornado series), obvious changes was new look front grill and removable batteries + new 5A charger (I think with active cooling)


but this is almost full new machine, new blades and traction motors, new controllers/vms
fuses box, slightly different keyboard

new pro chargers (wallbox) 18 and 30A

PS
at 3% SoC blades stops working, you got traction only

to discharge from 3 to 0% I have to ride for 5min, so I continue riding and after 15min (12-15A consumption) stilll have some Wh/Ah left but I got bored


but 15min with 600-700W consumption is 150-180Wh (which is about 10% of full battery capacity

so stiga 0% is real 10% at least

 

[szczur333]

dash update:
1. new startup screen - instead boring black one i make it colorful + small rat in corner (szczur in my nickname is "rat" in polish)

2. better looking FONTS - before, I used stock one which is probably size 5 so for bigger data like SoC to get 45size font I made "x9" request = pixelation - I found online tool with fonts and I can choose any size I want - now looks great

3. I added indicators like L (lights) or R (cut on reverse) as I have external latched button for it I know exactly when it is pressed

4. added imbalance of cells

 

[riogrande75]

Dunno if you guys are aware of the StigaDiagnosticTool
I assume this could work with other USB-CAN adapters than the Kvaser too, a little playing with drivers would be necessary. Original Kvaser adapters are ~100 EUR.
Anyone with access to the software? This would definitely reveal all secrets from the CAN bus.

 

[szczur333]

Dunno if you guys are aware of the StigaDiagnosticTool
I assume this could work with other USB-CAN adapters than the Kvaser too, a little playing with drivers would be necessary. Original Kvaser adapters are ~100 EUR.
Anyone with access to the software? This would definitely reveal all secrets from the CAN bus.

stiga software requires LOGIN (only dealers has access to it)
if you have good friend which is a dealer you can buy it and try

then you can decode all info in one day i think

 

[riogrande75]

Well, I don't want to buy it - can't afford Stiga prices
But I would be curious in the software itself - did'nt find a "test-version" on the internet.
I guess with some hacking, this could run with my can adapters.

 

[szczur333]

if I have friend with access I probably will buy this kvaser adapter - 100euro is not that bad, original for 400eur dont make sense, even this cheaper one barely have sense - I decoded allmost all info which I want. Temperatures will be nice addition + maybe total hours

 

[szczur333]

new day, new arduino code - I rewrite all of it in LVGL 9 - (graphics mode) instead drawing independend pixels -

NOW fonts are much smoother by default

no artifacts, I still have to work with fonts/ scale and indiviual positions

edit//
cruise control display added - "fun" thing is that after press CC button canbus frame changes immiadately but CC really start works after 0,5-1s. so I have to delay drawing blue CC mode - now I set it up to 0,5s

 

[Dave-OLW]

Dunno if you guys are aware of the StigaDiagnosticTool
I assume this could work with other USB-CAN adapters than the Kvaser too, a little playing with drivers would be necessary. Original Kvaser adapters are ~100 EUR.
Anyone with access to the software? This would definitely reveal all secrets from the CAN bus.

Stiga Support and Dealers do not know anthing about Can Bus data, it is all created and supplied by Kvaser. StigaDiagnosticTool just gives the data/alarm messages or advises which item is faulty. You cannot see any Can bus messages.

 

[szczur333]

Stiga Support and Dealers do not know anthing about Can Bus data, it is all created and supplied by Kvaser. StigaDiagnosticTool just gives the data/alarm messages or advises which item is faulty. You cannot see any Can bus messages.

yes, they dont bcoz they dont have to see bare canbus frames in HEX like 64 - they see output data - "SoC = 100%" right away decoded in their software (my LCD do the same thing)

BUT if you know output data you can compare it to hex values and figure it out and add it to LCD

 

[szczur333]

Just received the defective parts of my VMS' CAN transceiver (tvs diodes) and soldered them in the circuit together with a new 120 ohm resistor. These parts have been killed, hope that the TJA1042 survived it. I will stuck all parts together and then try to grab anything on the CAN bus. If CAN is ok again I will send the posted command - thx for that.

Update:
Unfortunately CAN transceiver TJA1042 has burned too - so some more days until I get replacement parts.

try to send 05 hex value frame on byte 0 to VMS (frame 0x71F) - every 1000ms

probably you wake up vms by that - of course you probably get battery error but still good for first test

Want to access VMS CN15 to connect to Decklift connector, cannot locate any change in canbus data when operating deck up and down. I think it just sends a pulse which moves actuator one step each time and changes + / - for direction.

FRAME 0x3BA is responsible for ALL LEDS indicators in C300/C500
mine C300 have only SIX LEDs ( 5 bars battery " | | | | | " and "!" but I decoded some signals and instead soldering in original panel I have add it to my screen bcoz canbus sends separate messages to leds only

probably in 798e as well - check it

 

[Dave-OLW]

try to send 05 hex value frame on byte 0 to VMS (frame 0x71F) - every 1000ms

probably you wake up vms by that - of course you probably get battery error but still good for first test

FRAME 0x3BA is responsible for ALL LEDS indicators in C300/C500
mine C300 have only SIX LEDs ( 5 bars battery " | | | | | " and "!" but I decoded some signals and instead soldering in original panel I have add it to my screen bcoz canbus sends separate messages to leds only

probably in 798e as well - check it

On the 798e there are no LEDs the LCD901 is connected to a micro ia 24 pins, there is no screen updates on the Canbus. Cannot read Micro details because PCB is very heavely Lacured.
3ba just gives
3ba 5 00 00 1f 00 00 0 0 31 0 0
3ba 5 01 00 1f 00 00 1 0 31 0 0
3ba 5 02 00 1f 00 00 2 0 31 0 0
Have been trying to upload a picture of LCD Dashboard PCB but it keeps failing "Parsing responce failed"
gets to 25%.

 

[szczur333]

yes - - BYTE 3 - 1F is a value for battery LEDs - I am not at home right now so I dont remember correctly but 1F means 4 or 5 bars on battery , probably 5 - so you are on between 81-100% SoC now

try to create error while some leds blinking - you will see chaging values on this byte, for example hold button for reverse cut or try to turn on headlights

As I can see cut deck grass height is on left green incicator so if you moving deck postion from 1 to 7 and nothing changes in this frame then I really dont know

and yes - you send before canbus frames logs but it was 1-2s long - i doubt you can change 7 position deck in that time

 

[szczur333]

Well, I don't want to buy it - can't afford Stiga prices
But I would be curious in the software itself - did'nt find a "test-version" on the internet.
I guess with some hacking, this could run with my can adapters.

config key cost 12-13euro - I thought they use different resistors for each model but this config key is just interlock loop

you can ride without it but blades are disabled

 

[riogrande75]

Any hint on how this should be plugged in and what can be done with that config key?

 

[szczur333]

Any hint on how this should be plugged in and what can be done with that config key?

This is interlock (safety) loop for cutting blades only

 

[szczur333]

Any hint on how this should be plugged in and what can be done with that config key?

did you try to dump firmware from vms ?

 

[riogrande75]

Not yet. Still struggling with the blown CAN bus. I repalced the transceiver (TJA1042) but CAN bus does not yet get in service correct. I need to investigate further on the electronic side.
Dunno if a dump of a STM32 microcontroller does us get any further - I assume disassambling does not reveal any new information.

 

[szczur333]

Today after SoC hits 0% I ride in circles for 40min - I discharge battery to 41,5V (min voltage under load i saw 39,9V). Imbalance was crazy - even 200mV under load.

I used 315Wh on 0% and I think there is 40-60Wh more left
So BUFFER is 20% :O


I charged it two times

1. I plugged i after I just hit 0% to 100% 1320Wh
2. today deep 0% to 100% 1600Wh (1,90kWh from socket)


deep 0-60% 3hours and 0-10min
deepd 0-100% (first 100%) 7hours 20min