Help reverse engineering electric longboard control logic
ryan wrote 02/02/2020 at 02:43 • 0 pointsI'm not going to mention the brand incase there's any issues with that but a friend recently gave me a beat to hell electric longboard without the charger or controller. I'm not too worried about the charger since I'm probably going to open up the batteries and wire up a BEC anyways.
The board has an ARM GD32F103 as the main logic chip (looks like a drop-in replacement for STM32) and an NRF24L01 transceiver. Referring to this url http://www.datasheetcafe.com/gd32f103-datasheet-pdf-mcu/ the connections are as follows:
The MOSI pin from the NRF is connected to pin 2
The SCK pin from the NRF is connected to pin 3
The CSN pin from the NRF is connected to pin 4
The CE pin from the NRF is connected to pin 8
The circuit uses a 16MHz oscillator and unfortunately I can't tell what the MISO pin is connected to due to the way the PCB is laid out.
There's 4 non-populated pins near/connected to the ARM chip that i'm assuming are used for programming so I soldered some jumper wires onto them, pulled up the arduino IDE and tried connecting to it using a USB to TTL cable I have. I got nothing in the console so I tried hooking up the battery (at 36v now, no idea what it should be), held my multimeter's ground to the battery ground and checked each of the jumpers to see if there was any voltage. Nothing... The power button does light up when I press it and does a bluetooth pairing/scan style blink if i hold it for a second or two and let go so there are signs of life. I haven't tried connecting the TTL cables while the battery was connected for fear of destroying my computer.
I know I could just scrap the whole thing and use an off-the-shelf ESC/Reciever but I'd like to put this engineering degree I just finished to use and learn how to troubleshoot so any pointers would be awesome. This is my first post and I have pics but haven't figured out how to upload them yet
Discussions
Become a Hackaday.io Member
Create an account to leave a comment. Already have an account? Log In.
Sometimes it may be easier to implement a fresh, known solution rather than trying to decode a leftover, unknown problem? Experience will be gained either way so persevere!
Are you sure? yes | no
If it's a debug line it'll go to PA13 and PA14. For STM clones the debugger protocol is SWD. Hook a ST-LINK clone to it. 3.3v, GND should be easy to identify. The other two are SDIO and SWCLK, and I'd hook them up and run st-info --probe, and if I got nothing, reverse. If it's serial, it'll go to one of the serial ports (PA9 is one of the pins).
Are you sure? yes | no
How would I know if it's in the idle state or not? I'm a newb when it comes to these things so I just figured it's a typical GND,5v,TX,RX deal and would be able to get 5v off one of the pins. Should I expect to see continuity between one of the pins and the battery ground?
I was just testing this with a DMM so maybe there's some switching and I need to hook a scope up to it in order to really see what's going on. is there any generic command that I would need to send through the Arduino console in order to get some output? I'm assuming that there should be some sort of output on the console if the power pins are connected last. I guess it's time to look at the datasheet
Are you sure? yes | no
It would be in the idle state if you did not have a JTAG or SWD adaptor hooked up to it.
Are you sure? yes | no
Those 4 pins might be a JTAG port, but I thought the idle state for JTAG pins was logic high.
Are you sure? yes | no