Archon X1 Programming Thread (questions and experiences)

[dedo]

I played around a little bit and was finally able to connect via VESC Tool to my Innotrace X1!

First I made connection using a simple USB to CAN adapter (e.g. canable) and tried to send common VESC CAN commands (VESC CAN-Bus Communication). I got no response and assumed it has been either completely disabled or hidden.. Its known for manufacturers that they wanna hide the fact, that they are stealing code: Here is another example, where a Torp TC500 controller has been torn apart. I gave it a try and brute-forced, by sending every combination possible... It took a few months, but one day, when I checked for my logs, the controller started talking back, because of one specific message I sent: 00D431FF # 14 78 00 00 00 00 00 00. It appears to be a "magic message", that enables usage with VESC Tool, once sent:

For connecting I used CAN-Forward on a VESC-Express. You can do the same thing with any VESC controller. I used a VESC-Express which is simpler, because it's powered by USB-C. It pops up as secondary CAN-device out of nowhere and it's possible to read and write motor parameters like maximum wattage, motor current, ...

CAN-connection is already available from the outside! Here is the pinout for the black connector (04R-JWPF-VSLE-S) of the M620-motor:

      ╭──╮
╭─────┘══┖─────╮
│ ☐  ☐  ☐  ⨯ │
╰──────────────╯
  │   │   │  ┖> x not used
  │   │   ┖───> H CAN-H ───┐    green
  │   ┖───────> G GND    [120Ω] is already in place!
  ┖───────────> L CAN-L ───┚    yellow

 

[Foxhound68]

I played around a little bit and was finally able to connect via VESC Tool to my Innotrace X1!

First I made connection using a simple USB to CAN adapter (e.g. canable) and tried to send common VESC CAN commands (VESC CAN-Bus Communication). I got no response and assumed it has been either completely disabled or hidden.. Its known for manufacturers that they wanna hide the fact, that they are stealing code: Here is another example, where a Torp TC500 controller has been torn apart. I gave it a try and brute-forced, by sending every combination possible... It took a few months, but one day, when I checked for my logs, the controller started talking back, because of one specific message I sent: 00D431FF # 14 78 00 00 00 00 00 00. It appears to be a "magic message", that enables usage with VESC Tool, once sent:

View attachment 165484

For connecting I used CAN-Forward on a VESC-Express. You can do the same thing with any VESC controller. I used a VESC-Express which is simpler, because it's powered by USB-C. It pops up as secondary CAN-device out of nowhere and it's possible to read and write motor parameters like maximum wattage, motor current, ...

View attachment 165485

CAN-connection is already available from the outside! Here is the pinout for the black connector (04R-JWPF-VSLE-S) of the M620-motor:

      ╭──╮
╭─────┘══┖─────╮
│ ☐  ☐  ☐  ⨯ │
╰──────────────╯
  │   │   │  ┖> x not used
  │   │   ┖───> H CAN-H ───┐    green
  │   ┖───────> G GND    [120Ω] is already in place!
  ┖───────────> L CAN-L ───┚    yellow

That's a huge breakthrough , I suspect krasnador is gunna never show his face again now though !

 

[Limbs]

I played around a little bit and was finally able to connect via VESC Tool to my Innotrace X1!

First I made connection using a simple USB to CAN adapter (e.g. canable) and tried to send common VESC CAN commands (VESC CAN-Bus Communication). I got no response and assumed it has been either completely disabled or hidden.. Its known for manufacturers that they wanna hide the fact, that they are stealing code: Here is another example, where a Torp TC500 controller has been torn apart. I gave it a try and brute-forced, by sending every combination possible... It took a few months, but one day, when I checked for my logs, the controller started talking back, because of one specific message I sent: 00D431FF # 14 78 00 00 00 00 00 00. It appears to be a "magic message", that enables usage with VESC Tool, once sent:

View attachment 165484

For connecting I used CAN-Forward on a VESC-Express. You can do the same thing with any VESC controller. I used a VESC-Express which is simpler, because it's powered by USB-C. It pops up as secondary CAN-device out of nowhere and it's possible to read and write motor parameters like maximum wattage, motor current, ...

View attachment 165485

CAN-connection is already available from the outside! Here is the pinout for the black connector (04R-JWPF-VSLE-S) of the M620-motor:

      ╭──╮
╭─────┘══┖─────╮
│ ☐  ☐  ☐  ⨯ │
╰──────────────╯
  │   │   │  ┖> x not used
  │   │   ┖───> H CAN-H ───┐    green
  │   ┖───────> G GND    [120Ω] is already in place!
  ┖───────────> L CAN-L ───┚    yellow

That's great news, well done! Does this have enough functionality to enable firmware to be copied from one motor to another? I bought one of the last (3000W) motors shipped by Innotrace and it has the firmware, that Krasnodar denied any knowledge of, which shows strange symbols for both motor & controller serial numbers as shown in @TPEHAK's post on page 13 of this thread (#224) & copied below. Krasnodar promised to update my firmware for me once, I'd sorted a cable, but he's not responding to my emails now! The firmware that I have allows me to make changes using the hacked X1 tool, but the controller does not react correctly to some changes, for instance, whatever I do, I cannot restrict power to below 750W. Thanks.

 

[Fast n' Furious]

Hello, did you try to contact Krasnodar first for assistance? I would contact him first. Maybe ask him when he is planning to make the online server available again (he promised to make it available soon some time ago).

If he does not respond here is the link for the bypassed tool with advanced settings

1.0.10 assist+display+motor+controller.zip

drive.google.com

Again: best, Top Dog info.

 

[Fast n' Furious]

Archon is garbage. Everyone who has on EBR forum is asking for remedy.
I have Canbus 52V M620 ultra.
It is perfect.

Bwaaaahahahaha, when "Perfect" = weak kneed power-hog.
Right dude - while you emulsify your motors gears lube w/ detergent laden H2O.
Great solution. Replace what I wreck every year.
Previously it was '52v provides less range, blah blah blah'. Now yer a Fan-boy?
When were you wrong, then or now?
Gotta get yer BS straight.
Canbus blows. Entire planet says so. Barfang market control games. Weak and impossible (as yet) to upgrade.
Really super-dooper if you like 125nm max tho.

Carry on. BS is in. Don't be shy.

Fn'F

 

[TPEHAK]

That's great news, well done! Does this have enough functionality to enable firmware to be copied from one motor to another? I bought one of the last (3000W) motors shipped by Innotrace and it has the firmware, that Krasnodar denied any knowledge of, which shows strange symbols for both motor & controller serial numbers as shown in @TPEHAK's post on page 13 of this thread (#224) & copied below. Krasnodar promised to update my firmware for me once, I'd sorted a cable, but he's not responding to my emails now! The firmware that I have allows me to make changes using the hacked X1 tool, but the controller does not react correctly to some changes, for instance, whatever I do, I cannot restrict power to below 750W. Thanks.

Do you know if it really has 3000W? The motor Innotrace sent me did not have 3000W power while I purchased the 3000W option (it had significantly less power). Krasnodar said the motor was flashed with production firmware. He updated the firmware, adjusted the power and assigned the numbers to the motor.

 

[Limbs]

Do you know if it really has 3000W? The motor Innotrace sent me did not have 3000W power while I purchased the 3000W option (it had significantly less power). Krasnodar said the motor was flashed with production firmware. He updated the firmware, adjusted the power and assigned the numbers to the motor.

It was certainly not producing 3000W when it was delivered; my BMS was reporting that it was using 27 Amps peak (@52v nominal), settling back to 20 Amps continuous. Having played with the hacked X1 tool, I managed to get it to pull 55 Amps peak, but it was definitely not the "wheelie monster" that others have described although, to be fair, my current battery is not capable of delivering 60 Amps continuous, so it could be that that's restricting things.

The reason that I mentioned that it is supposed to be the 3000W version is that, according to the Innotrace website (before it disappeared) the 3000W controller was allegedly different, therefore, possibly running different firmware. Whether or not I actually received what I paid for is anyone's guess at this point, I did notice that, after my order was placed, the 3000W version was no longer available on the website, but whether that indicated that mine was the last one or that they realised that the cupboard was bare when they went to pick the controller for my motor is unknown to me!

As it's now possible for us to use the VESC Tool, I am hoping that it would be possible for me to copy the firmware from someone else's 3000W motor.

 

[TPEHAK]

I played around a little bit and was finally able to connect via VESC Tool to my Innotrace X1!

First I made connection using a simple USB to CAN adapter (e.g. canable) and tried to send common VESC CAN commands (VESC CAN-Bus Communication). I got no response and assumed it has been either completely disabled or hidden.. Its known for manufacturers that they wanna hide the fact, that they are stealing code: Here is another example, where a Torp TC500 controller has been torn apart. I gave it a try and brute-forced, by sending every combination possible... It took a few months, but one day, when I checked for my logs, the controller started talking back, because of one specific message I sent: 00D431FF # 14 78 00 00 00 00 00 00. It appears to be a "magic message", that enables usage with VESC Tool, once sent:

View attachment 165484

For connecting I used CAN-Forward on a VESC-Express. You can do the same thing with any VESC controller. I used a VESC-Express which is simpler, because it's powered by USB-C. It pops up as secondary CAN-device out of nowhere and it's possible to read and write motor parameters like maximum wattage, motor current, ...

View attachment 165485

CAN-connection is already available from the outside! Here is the pinout for the black connector (04R-JWPF-VSLE-S) of the M620-motor:

      ╭──╮
╭─────┘══┖─────╮
│ ☐  ☐  ☐  ⨯ │
╰──────────────╯
  │   │   │  ┖> x not used
  │   │   ┖───> H CAN-H ───┐    green
  │   ┖───────> G GND    [120Ω] is already in place!
  ┖───────────> L CAN-L ───┚    yellow

Hello Dedo. Can VESC tool extract .bin fie firmware from the controller?

The original STM32 chip on my Innotrace X1 controller is dead (internally shortened 3.3v and ground pins). I guess the FET driver failure destroyed the chip.

I soldered new FET driver and STM32 chips and I need binary file firmware copy for STM32 chip to complete the repair. Infortunately I did not copy binary file from my STM chip before it died.

I emailed Krasnodar but he did not respond yet.

Innotrace X1 top board has 6 pads Tag-Connect interface for ST-Link programming dongle to flash .bin file on the STM32 chip.

I purchased a 6pins Tag-Connect with RJ11 plug cable and an RJ11 plug to pins adapter to connect the board to ST-Link. Now I need binary file to flash the new STM32 chip.

Ideally I need firmware adjusted for 3000W 52v 60A (this is what I had), but at the moment any Innotrace X1 firmware will work for me.

 

[TPEHAK]

hi riders,

I am krasnodar from Innotrace. I am sorry that our internal company problems caused a lot of problems for our customers. this should not be the way how internal problems are handled.

in addition I was discredited and some things were reported by our company staff that are not true.

since a while Innotrace sold motors and controllers with controller hardware that was not subject to my quality control and software/firmware unknown to me. if you notice any problems with your motor/controller, please do not hesitate to contact me. our server had to be taken offline due to unauthorized access - making x1tool useless. work is still in progress to bring the server back online as soon as possible. up to this point of time I will be available here for any questions you may have.

please note that hacking x1tool software could lead to unforeseeable consequences, damages and loss of any support. also possibility of any firmware updates and further upcoming exciting features is not available with hacked software.

krasnodar

Hello Krasnodar. I need compiled firmware .bin file to repair my Innotrace X1 controller (please see the post above). I am not sure if you saw my email. Can you please send me a compiled binary file (.bin) for my Innotrace X1 controller adjusted for 3000W motor (52V 60A, 14S lithium battery with 60A continuous current BMS (80A peak current), 27.5" wheel size) so I can flash it on the new STM32 chip. (The top board version is X1_V2B Motorcontrol board (V2B Var02_UART S/N 000522) )

 

[TPEHAK]

If anyone has Innotrace X1 controller laying on the table and willing to try to grab firmware and share it with me is how you can do it (I guess it will work only if the STM32 chip does not set in protection mode though. If it is in protection mode I think this way is not going to work. But maybe that magical message "00D431FF # 14 78 00 00 00 00 00 00" posted earlier here can somehow unlock the STM32 chip so you can read the memory, but I am not an expert here and I do not not how to do it).

Here is the tools list you need:

1) An ST-Link dongle (can be purchased here for example https://www.digikey.com/en/products/detail/adafruit-industries-llc/2548/6827110 )
2) Tag-Connect cable TC2030-MCP-NL (This cable and all further items below are to connect ST-Link dongle to the Innotrace top board 6-pads interface. This cable and all items below are optional, you can solder wires to the pads and connect them to ST-Link dongle. The cable can be purchased here https://www.digikey.com/en/products/detail/tag-connect-llc/TC2030-MCP-NL/2666489)
3) TC2030-CLIP (This clip fasten the Tag-Connect cable to the Innotrace board. This part is obsolete and hard to find. But you can use TC2050-CLIP and re-solder one receptacle to match the TC2030-MCP-NL cable interface. This clip can be purchased here https://www.digikey.com/en/products/detail/tag-connect-llc/TC2050-CLIP-3PACK/12318009 )
4) RJ11 to pins adapter ST-RJ11-R-BB (This adapter is to connect Tag-Connect cable plug and have convenient access to the pins. The adapter can be purchased here https://www.digikey.com/en/products/detail/schmalztech-llc/ST-RJ11-R-BB/23307380 )
5) 5 jumper wires (To connect the ST-Link dongle to ST-RJ11-R-BB. Bulk of such wires can be purchased here https://www.digikey.com/en/products/detail/digikey/DKS-20FF-20/17038802 )

Here is the process:

1) Connect ST-Link to the board following this diagram. You need to connect 5 pads (you can use the same cable and adapter I used or you can connect using different method. If you use the cable with adapter check the cable and adapter pins with multi-meter to make sure you connect the ST-Link dongle correct)

This is the Tag-Connect cable clip TC2050-CLIP I modified to make it works with the cable I used. I just de-soldered the receptacle and soldered to the hole closer to two other recepticles

Then Clipped the Tag-Connect cable to the Innotrace X1 top board and connected it to the adapter and to the ST-Link dongle following the diagram I posted above

2) Download and install ST-Link Utility application for PC. It will offer to install drivers during installation, install those too. Here is the official download of ST-Link Utility application https://www.st.com/en/development-tools/stsw-link004.html

3) Stick ST-Link dongle to USB in your computer

4) Launch ST-Link Utility


5) In the launched ST-Link Utility click "Target-->Connect"

6) Then click "File-->Save As"

7) Select ".bin" file format, name the file and click "Save"

If it can not read the memory then there is protection. Then the only my hope is if Krasnodar will respond and send me the .bin file so I can complete the controller repair.

Or maybe this extreme method can work? https://embedthreads.com/hacking-and-reading-code-from-stm32-microcontrollers/

 

[TPEHAK]

Found another shortage between 3.3v rail and ground. This time in the bottom board. I was thinking the rotary encoder board is bad and detached it but it turned out the phase "U" current sense amplifier AD8418WBRMZ has internal shortage between ground pin and 3.3v Vs pin. Placed order on new current sense amplifiers https://www.digikey.com/en/products/detail/analog-devices-inc/AD8418WBRMZ/4494754

Keep discovering the board.

 

[TPEHAK]

Alright, great news, I think I fixed it. Just soldered a new AD8418WBRMZ chip, and the shortage is gone. Partially assembled the motor and connected the display and turned it on, the Error 30 is gone, the display shows battery level and the 3.3V regulator is not heating now. So it looks like it is going to work. Now I need to repair the motor shaft (the current one wobble and can hit the rotary encoder again). I am planning to use the new 15 teeth rotor with new second gear and hope the motor will work without issues.