stiga c300 - electric tractor, ride on lawnmower

[Dave-OLW]

Finnally managed to upload LCD PCB photo, had to reduce it below 1MB, before I uploaded photos of 4MB.
cannot see what model MCU is because it is heavly Lacured.
Checked LCD 14 pin conecction Canbus is the same as going to DBII socket. Did some more Canbus test for Deck movement reduceing the number of messages, so from start recording message press deck, once hear deck change stop receving messages.
The only change is moving position 7 to 6
3ba 5 00 00 1f 00 00
3ba 5 02 00 1f 00 00
The only change is moving position 3 to 2
3ba 5 00 00 1f 00 00
3ba 5 01 00 1f 00 00
Cannot work anything out from this.
Could tap into push buttons and create own sensing.
Other Idea is to move exsisting LCD.

 

[szczur333]

super strange, as I said in mine all LEDs are in that frame

I connected sniffer to CAN2H and CAN2L - (this empty 20 pin connector in my VMS) which in yours is occupied by actuators signal probably
and in mine I got nothing - try to connect there and see


also is there possibility this is not in canbus which you see

for example: I dont see, speed, working hours, angles, serial number and other things in canbus but on stiga diag tool screenshot you can see much more - you have to send extra frames request to receive info

I FOUND one universal message on some forums and got one of frame came up (unfortutnalty this was frame which is normally visible after I press ON button but this time I am not pressed it so it works ,I tried others but this time nothing

goal is to find dealer and ask them to connect while my sniffer will be logging - then probably I will see these messages

 

[Dave-OLW]

super strange, as I said in mine all LEDs are in that frame

I connected sniffer to CAN2H and CAN2L - (this empty 20 pin connector in my VMS) which in yours is occupied by actuators signal probably
and in mine I got nothing - try to connect there and see


also is there possibility this is not in canbus which you see

for example: I dont see, speed, working hours, angles, serial number and other things in canbus but on stiga diag tool screenshot you can see much more - you have to send extra frames request to receive info

I FOUND one universal message on some forums and got one of frame came up (unfortutnalty this was frame which is normally visible after I press ON button but this time I am not pressed it so it works ,I tried others but this time nothing

goal is to find dealer and ask them to connect while my sniffer will be logging - then probably I will see these messages

It must send a signal via the 14 pin wires (only 12 wires connected) and we are assuming it is via Canbus, the other buttons send a signal direct to WMS by connecting to the positive (which only shows 11.88 volts) perhaps it sends a negative on the other buttons?

 

[szczur333]

It must send a signal via the 14 pin wires (only 12 wires connected) and we are assuming it is via Canbus, the other buttons send a signal direct to WMS by connecting to the positive (which only shows 11.88 volts) perhaps it sends a negative on the other buttons?

all buttons in "normal" (lower) models c300 c500 384e 584e) are electrical only, you can use tractor without original keyboard

all LEDs are light up after vms get STATUS CHANGE - so pressing eco button - vms see ECO mode - and sending signal to keyboard to light up LED

you have 4 more to deck and basket - so I dont know really - did you try to connect to CAN2 pins?

 

[Dave-OLW]

all buttons in "normal" (lower) models c300 c500 384e 584e) are electrical only, you can use tractor without original keyboard

all LEDs are light up after vms get STATUS CHANGE - so pressing eco button - vms see ECO mode - and sending signal to keyboard to light up LED

you have 4 more to deck and basket - so I dont know really - did you try to connect to CAN2 pins?

My 798e does not have anything plugged into the VMS 20 pin, even though on wiring diagram it shows
pin 1 Decklift up
pin 2 Baglift up
Pin 11 Decklift Down
pin 12 Baglift Down
The spares diagram for wiring harness only shows one 24 pin connector.
Testing push buttons Deck/Bag have 3.3 volt supply and a 2.2k resistor to ground on other pin.
All other push buttons have 12 volts, so I think the Dec/Bag go to the MCU.
The only data changing enough when cycling the Deck up/down is the ID 19f, do you know what the Data is on ID 19
The first 3 values
19f 8 6e e3 f9 ff 39 38 39 60
19f 8 6c e3 c5 ff 39 38 39 60
19f 8 6c e3 c4 ff 39 38 39 60
19f 8 6a e3 c2 ff 39 38 39 60

 

[szczur333]

19F is only BMS info
amps
voltage
soC
3x TEMP of battery


I bought alpina at3 98li yesterday with overvoltage cell error
I opeded battery and measure cell voltages
13x 4,10V
1X 3,67V

also battery weight (30ah) is around 27kg - steel shell weights more than half of it

I charged up this one 3,67V section of cells to 4,10V and I am gonna leave it for a week and measure voltage of it again

 

[Dave-OLW]

19F is only BMS info
amps
voltage
soC
3x TEMP of battery


I bought alpina at3 98li yesterday with overvoltage cell error
I opeded battery and measure cell voltages
13x 4,10V
1X 3,67V

also battery weight (30ah) is around 27kg - steel shell weights more than half of it

I charged up this one 3,67V section of cells to 4,10V and I am gonna leave it for a week and measure voltage of it again

OK Solved it.
ID is 3ba, it just sends the same info for each step. 01 for Deck up steps, and 02 for Deck down steps.
If sends 6 messages for each button press, if you hold th button down so it travels from top to bottom there is a slight delay wich records where it is. It remembers the position.

04 for Basket up and 08 for Basket down.

Deck up 3ba 5 01 00 1f 00 00
Deck down 3ba 5 02 00 1f 00 00

Basket up 3ba 5 04 00 1f 00 00
Basket down 3ba 5 08 00 1f 00 00

 

[szczur333]

strange thing is that if you low or up deck- you have LED indicator on LCD right? position means 7 green bars and 1 only 1

3ba is for LEDs indicator so if its change there is info about that and canbus know it bcoz it have to know how many bars should show

 

[szczur333]

Not yet. Still struggling with the blown CAN bus. I repalced the transceiver (TJA1042) but CAN bus does not yet get in service correct. I need to investigate further on the electronic side.
Dunno if a dump of a STM32 microcontroller does us get any further - I assume disassambling does not reveal any new information.

I dump software from ESP
but I have no idea what I can do with it, will be great to get dump from higer model and flash it by it
maybe then I will get app running

 

[Dave-OLW]

strange thing is that if you low or up deck- you have LED indicator on LCD right? position means 7 green bars and 1 only 1

3ba is for LEDs indicator so if its change there is info about that and canbus know it bcoz it have to know how many bars should show

No 3ba controls the actuaters via VMS. MCU on Dashboard controls the LEDS. Press a button which is connected to MCU on Dashboard, it checks position stored in memory and then sends instruction 3ba to VMS to moves actuater, and MCU updaes LEDs.

 

[szczur333]

 

[Dave-OLW]

Made up new Indicator for Deck position with bright LEDs which can be seen in daylight/sun.
Unit is controlled by Microsoft 18F47K40 MCU, it connects to Canbus via OBDII and detects the deck movement then turns on approiate LEDs, it saves position in the MCU EPROM so on boot up it displays current position.

 

[szczur333]

minimalistic harness

without any plastic parts no squeaking or creacking

 

[szczur333]

Not yet. Still struggling with the blown CAN bus. I repalced the transceiver (TJA1042) but CAN bus does not yet get in service correct. I need to investigate further on the electronic side.
Dunno if a dump of a STM32 microcontroller does us get any further - I assume disassambling does not reveal any new information.

I have good and bad news for you

I unplug can H and can L wires between battery and VMS and IT WORKS normally - so tractor SHOULD work for you, in my case LEDs is blinking so I got some kind of error but still it works, this means - this is probbably sth with VMS

here is a LOG from working ALPINA
SWITCH ON, PRESS READY/ON button, press BLADES button



EDIT//
Stiga c300 works without battery comms as well

 

[riogrande75]

Thx - good to know. So if you do not insist on a clear battery % display, you can connect any 51V battery. Even cheap 16S LiFePo4 will do it and you can keep charging mechanism. Nice find

Puh... That sounds my VMS board is completely destroyed.
Obviously ESP32 (which handles BT) is alive, but maybe main CPU isn't coming up at all or does not work as long as (1st) CAN bus is dead for all connected devices (blades, etc.).
Anyhow I don't give up - I will try to find a diagnostic interface (UART,etc.) for this microcontroller, maybe I can find a way to get it to work again. I would really like to avoid having to adapt a new, generic VMS here.
Do you have a Idea what the 2nd CAN bus is for? If it woudn't be used on the C300 I might be able to simply exchange the rx/tx from uC to CAN bus/protection circuit and have the CAN bus alive again.

 

[szczur333]

Thx - good to know. So if you do not insist on a clear battery % display, you can connect any 51V battery. Even cheap 16S LiFePo4 will do it and you can keep charging mechanism. Nice find

Puh... That sounds my VMS board is completely destroyed.
Obviously ESP32 (which handles BT) is alive, but maybe main CPU isn't coming up at all or does not work as long as (1st) CAN bus is dead for all connected devices (blades, etc.).
Anyhow I don't give up - I will try to find a diagnostic interface (UART,etc.) for this microcontroller, maybe I can find a way to get it to work again. I would really like to avoid having to adapt a new, generic VMS here.
Do you have a Idea what the 2nd CAN bus is for? If it woudn't be used on the C300 I might be able to simply exchange the rx/tx from uC to CAN bus/protection circuit and have the CAN bus alive again.

yes, any 40-60V battery shoild work 12 -13 s li ion or 16S lfp or 21s lto etc

in your vms bluetooth working and it shouldnt so nothing lock it - like no software booting up
you should get second but fully working one, then you can compare and find out solution for repair original one

I connected to canbus2 but i got nothing - probably its reserved for 798e - on my board it only one CAN transiver


for battery you can always make uart to can transciver then you should get battery info like current, voltage, temp, soc

I made simple emulator with single canbus trasnciver and it work (all data soc, temp, ah are fake which I programmed on ESP)

next step - as I said - just translate them - to unlock full capacity
flashing bms by new capacity will be a super neat and clean (software solution) but this is next level stuff, crc checksum etc -


translator is hardware solution and shoudl cost 20euro then I can unlock these 7 ah of my capacity or make new 40 -50 or 200 ah battery if I want and still get all fail safe features of vms

 

[riogrande75]

Can you pls. send me full highres pictures of your VMS board (both sides) when you've disassambled it again? I just want to compare it with mine.
I g**gled the partno. 118361031/0 of mine and it says it's a "Stiga VMS V3 MP/SD". This seems to be used in different Stiga's and Castelgarden mowers (C300/C500/eRide 700,...).
Same board, maybe with different firmware flavours. Therefor the official Stiga service tool might be helfpul to flash the correct firmware or even a better FW with more functions.
Obviously there were different VMS partnumbers used in the C300 as some older boards have been replaced with successors: 118361031/x => 118361036/x => 118361072/x...

 

[szczur333]

mine is 118361030/0 so maybe older model

if you can try to dump STM32 bin file

then I will try to flash my alpina with it - maybe I will get bluetooth
PS alpina and stiga has different firmware for sure bcoz in alpina I have BASKET wires disconnected and its possible to turn on BLADES so if i flash it with stiga software i WILL HAVE to short these wires to emulate basket

you can flash firmware by only stiga dealer - also then maybe they can you tell whats going on with it

 

[riogrande75]

Thx.
Off course, your board has 2 independant CAN busses as well:

I marked CAN transceiver TJA1042 for bus 1 (left) and 2 (right). CAN pins are on CN15:

Are you able to unplug/isolate pin 5 or 15, so that CAN bus 2 is definetly deactivated and check, if everything is still working?
If yes, I will simply exchange rx/tx from microcontroller from CAN1 to CAN2 and then bridge pin18/8 to 15/5 on CN15. This should bring my CAN1 back into service.
As I did not find any other markings for CAN2 on the schematic in the workshop manual, I guess CAN2 is not used at all on our mowers.
Regarding STM32 dump: I think it should be doable with a cheap STM Link V2, right?

 

[szczur333]

I will try next week
yes, cheap st link is ok

 

[szczur333]

I decoded 99% of BMS canbus

So I have it all
Voltage
Vmin cell
Vmax cell
imabalnce (not in canbus - just math equasion)
tmax cell
tmin cell
(in real there are 3 temp sensors) but tmax and min is enough

in my C300
34,00Ah - real capacity of cells hardcoded
26,06Ah - Ah left NOW - also hardcoded - it counts between 0-27,1Ah
in alpina
i have 30,00Ah
Ah count is about 0-26,2Ah

Cykle = battery cycles - this probably changes after Ah count get full 34Ah (but it has flaw by design i think bcoz if you discharge battery to real 0Ah, Ah count will be 0Ah as well

so if I start charge in my C300 I can achieve max 27,1Ah and real 27,1Ah - then I will continue charging to 34Ah but Ah count will stuck at hardcoded 27,1Ah

so in real life I can have more cycles than real - but in other hand - I think nobody will drain battery below 0,0Ah count - even if this will be very rare case - so cycles count will be 99% precise



from all the frames only one byte is 00 all the time - probably this is reserved for bms errors or something but really dont know - to check it I need to instal new ntc sensor and emulate 90-100*C temp - then this will probably change


I added some indicators at bottom
K - basket in upper position
B - bag full (not in photo)
F - seat upper position
! - doubles ! led from original control panel
E - emergency button pressed
C - config key missing (not on photo)

 

[szczur333]

I dump bms firmware - its from alpina at3 98li (30Ah coded capacity) about 26Ah usable