Airwheel X3 Teardown

Today we’re going to take a peek inside the clever and dangerous Airwheel X3.  We’ll show you how to disassemble the Airwheel, and also what’s inside an Airwheel.  Enjoy!

AW_black

For those who aren’t familiar, the Airwheel is kind of like a minimized Segway:  A motorized, single-wheel, self-balancing transportation unit.  It’s a single tire, hub motor, some control electronics, and a battery.

You stand on the foot platforms and the controller continuously solves the inverted pendulum problem.  You lean forward, it rolls forward to prevent itself from tipping.  You lean back, it rolls backwards.  With a bit of skill and a little practice, you too can zip around on this uber-slick (but heavy as hell) transportation unit like that guy from the old comic BC.

BC_guyClassic.  And nearly equal weight to the original.  Seriously fellas, get a lighter motor for Thor’s sake!

But we’re all here to see what’s inside, so let’s get to it.  Click any of the pics for a larger version.  Here’s the victim.

AW1

The ABS shell is held together by 7 screws on each side.  So yes, you must flip it over halfway to remove the OTHER 7 screws from the other side.

Yeesh, they sure got a good deal on screws!  The first 5 are obvious, as they ring the periphery of the wheel.  Note the scratches from entertaining crashes in many directions!

AW2

The next 2 are a bit less obvious, being tucked back into the handle.  Yank these two and let’s continue

AW3

Next, 6 heavier machine screws on each side hold the ABS shell to the hub/foot stand assembly.  Yup, that’s another 12.  Like I said, they got a good deal on screws.

AW4

Next, pull the non-control side of the shell up and away from the hub to separate the two halves.  They are mated by the (thin) charging and (thick) battery supply wires seen here.  In our case, the plugs were also hot-glued.  This is probably to keep them from rattling apart during use.

AW5

The non-control side of the shell contains the battery, initially hidden by an aluminum sheet.

AW6

Removing the 6 screws holding the plate (and breaking the warranty seals ooooohhh) allows us to take a peek at the battery.  Now that’s a Li-Ion pack!  57V?  Better lick the terminals to make sure it’s charged.

AW7Don’t really lick the battery terminals, fellas.  Or if you do have a camera ready and please realize that we disclaim all liability.  Still, send us the pic.

The control side of the shell is tethered to the hub motor via it’s power cable.  Be careful not to yank it too hard.

AW8

Again, removing the aluminum plate allows us to see the control side of the Airwheel.

AW9

Beautiful.  A teensy little board can crank out 500W of physics-solving rage with 6 mosfets, a micro and a gyroscope chip.  It’s a great age to be alive.

A closer look at the board reveals that the micro and the gyro chip numbers have been milled off in an incredibly clean manner.  Neat!

AW10

But even this advanced obfuscation method falls to the good ‘ol head grease trick.  Swab your sweaty brow with a finger, and quickly wipe across the milled surface: The shine will be removed from all the raised portions, leaving a pretty good contrast in the etched divots of the original part number.  A sideways flashlight and some careful angling will usually reveal what was once missing.

In this case, it looks like an ST ARM Cortex M3 micro and an Invensense gyro.  A couple of what may be op-amps are the only other two chips on the board.  Super minimal, but they did a great job on the control loop – it feels and responds beautifully to the interesting problem of how to keep a fat dumb human upright.

We hope to look a bit more in to this fun little device in the future.  There’s a pesky speed limit which really must be removed, and a couple other possible hacks that are in the idea hopper.  So if anyone wants to collaborate on hacking this bugger, drop us a line using the contact page, and we can swap all those tasty secrets that aren’t yet suitable for public release.

Cheers!

Posted in Uncategorized | Leave a comment

Reversing the USB Block Erupter – Closed

Well you can probably guess by now that this project has been abandoned as we move on to other things.  All in all, it looks like ASICMINER did something similar to Yifu and company, and started with the open source FPGA miner and built from there.  Cool stuff, but since the chip sends back winning hashes as they are generated, there’s no amount of PIC optimization that can speed up the hashing.  So we are off to new adventures, but we wanted to officially wrap this one up with the release of our schematics.

Really, this whole bitcoin ASIC explosion is a great story of some non-professional guys just getting together and taping out homemade SHA256 hash chips.  It’s incredible, and very inspiring.  What other applications could be absolutely commoditized if someone was willing to just sit down and synthesize an ASIC?  In the cases of Yifu (Avalon) and ASICMINER, they made shit tons of money, and when bitcoin exploded their customers made shit tons of money as well.  It’s likely that the manufacturers did way better than the miners, but the people with the 1st batch Avalons got ROI in weeks.  At whatever sub $100 value that bitcoin was at those days.  The amount of money they must have accrued by the $1200 Thanksgiving peak is simply astounding.  Go you!

Attached is our hand-traced schematic of the USB Block Erupter.  We don’t guarantee it’s accurate, but it’s probably pretty close.  Special thanks to all the collaborators that came out of the woodwork to help with this project.  We hope you guys also cashed out in the fall!

PDF Schematic of the USB Block Erupter

Posted in Reviews/Teardowns | 2 Comments

Reversing the USB Block Erupter – Part II

So tracing and schematics are pretty much done.  It’s all very straightforward, and by the use of a few publicly-posted pictures (not ours, go searching for them) most of your questions on connectivity can be answered.

The next phase is snooping the buses while the device is hashing away, and seeing where and when we can match up bus activity with comms to the miner software.  So far, we have a lot of unknown lines doing a lot of unknown things.  But a little of it makes sense.

Here’s a glamor shot of some churning data, because we heard y’all love churning data.

LA-BE

Posted in Reviews/Teardowns | Leave a comment