An Electric Scooter Community on a Mission to Stamp out Transportation Mediocrity.

Changing mobility one trip at a time.
#18951
I did some more research today with more equipment.

Im sure now that the battery doesn't has any role in this locking / unlocking mechanism. I recorded the traffic between the ESC and BMS. Don't know what "language" they are talking but doesn't look like UART or CAN. When disconnecting the cable that is sending from the ESC to the BMS, nothing happens and everything still works. The other way round it generated an error, of cause, because the ESC can't read the battery level.

So now im pretty sure the ESC really need the code send on every 20th tick. If it doesn't receive it, it will turn off at about 2:06 minutes.

This are the options to solve this problem:
  • Decode the code that is sent every 20th and be able to regenerate it
  • Reprogram the ESC (Found out its a STM32F103C8T6 Chip and will try this)
  • Buy a new ESC and be able to connect it to the original components like Display, SpeedControl, Brake, Motor
  • Dirty solution: "Reboot" the ESC just before the 2:06 Minutes and use relays on the 3 motor cables to block the wheelblocking just while rebooting. ( Will test this)
What im doing now: I reboot the ESC just before the 2:06 Minutes and programmed it, so that the lights will flash 5 seconds before the reboot, so i have time to stop, let it reboot and continue. Not great, but better than paying money :D
#18952
bigredrobot wrote:
Sat Jan 11, 2020 2:30 pm
Interesting discovery this morning. I still am not able to start either scooter using previously known working code. The new speed unlock code displays mph when attempting to ‘jump start’ with wall power. When I re-soldered my Arduino wires and put old code back on it, it still shows the mph rather than kph.

Previous reports of unlocked speed suggested the current speed for personal scooters is whatever the last speed was for the rental scooter.

This could mean that some settings are ‘stickier’ than I previously thought. This might not be a revelation for anyone who knows what they are doing.

I am now at a loss for what to try. I am 4 days with no scoot time and looking for a fix. Any ideas?
Did you unplug the ESC from the battery or just charged?
#18965
Hi, thanks to all who replied to my posts. Now I found out that i killed something in the scooter because of a burned buck converter. Now nothing happens when i try to connect a 'working solution' with a connected 5v-powerpack. Is there a fuse in the scooter or the scooters controller which could be burned? How to fix it and/or find out whats broken?
#18966
Here is the exact copy of the arduino .Hex sold 65euro by scooterunlock for ES100 bird :D
He uses arduino nano3 atmega328P , 57600baud.

We will be able to recover information to improve es200 / es400 and also make ES100 work.

Option : code 2121 , light on/off , vmax 41 km/h , bridle 25km/h or no limit ,sound R2D2.
Touch plate or button.

NO USE TO ES200 ES400 , only with ES100 BIRD

-initiate unlock attempt by single long touch
you’ll hear the *electric sound*, vehicle is expecting code now, so:
2 touches, 1 touch, 2 touches , 1 touch – stands for code ”2121”
if entered code was correct, you’ll hear the *sound* effect
scooter will blink the front light few times and dashboard will turn up
at this time, vehicle is ready to roll and further testing.
-To turn off scooter:
sequence of 4 long presses should be performed
-To limit and no limit max speed:
sequence of 10 touches should be performed (works both way)
you’ll hear the *sound*
-Turn headlight on and off:
double tap
you’ll hear the *sound*
-Sound R2D2 :
3 tap
you’ll hear the *sound*

wiring it plugs it like that :
Green TX1 , yellow RX0 , brown GND , orange D9 , red VIN , black GND , blue 3V3 , pink A0 , pink A1
Pink and pink to button or touch plate , brown and orange to Speakers.

Image
Attachments
(13.02 KiB) Downloaded 230 times
Last edited by draculauto on Wed Jan 15, 2020 12:21 pm, edited 1 time in total.
#18967
@Biingobom Biingobom
I have ripped these scooters to the bone and there are no replaceable fuses. Pull the plug on the battery, use a meter and see if there is voltage there. Maybe the battery protected itself. If and only if there is no voltage from the battery the way to reset it is to ground the hot line. If there is voltage on the hot line "DONT GROUND IT!" Battery go zap. If I wasn't clear. Unplugging the battery might bring it back from the dead.
Next up. The battery is 42V well over the input voltage for most buck converters. If you review the submissions from @Rick Sanchez on this forum. He gave instruction on how to use a zener diode to bring the voltage down to a usable level.
Good Luck
Mr.Spriggs
#18969
Finally, good job I knew someone could get the code off those machines. Ill start looking into reversing these guys code. What we really going to need to find is the list of Hex Commands. Which should be to hard since we know what the commands look like. The firmwares are so small, we can just look through it with text editor and look for anything that looks like a list of commands.
:lol:
Big thanks @draculauto for taking your new toy apart and getting out the goods.
draculauto wrote:
Sun Jan 12, 2020 7:07 am
Here is the exact copy of the arduino .Hex sold 65euro by scooterunlock for ES100 bird :D
He uses arduino nano3 atmega328P , 57600baud.

We will be able to recover information to improve es200 / es400 and also make ES100 work.

Option : code 2121 , light on/off , vmax 47 km/h , bridle 25km/h or no limit ,sound R2D2.
Touch plate or button.

NO USE TO ES200 ES400 , only with ES100 BIRD

-initiate unlock attempt by single long touch
you’ll hear the *electric sound*, vehicle is expecting code now, so:
2 touches, 1 touch, 2 touches , 1 touch – stands for code ”2121”
if entered code was correct, you’ll hear the *sound* effect
scooter will blink the front light few times and dashboard will turn up
at this time, vehicle is ready to roll and further testing.
-To turn off scooter:
sequence of 4 long presses should be performed
-To limit and no limit max speed:
sequence of 10 touches should be performed (works both way)
you’ll hear the *sound*
-Turn headlight on and off:
double tap
you’ll hear the *sound*
-Sound R2D2 :
3 tap
you’ll hear the *sound*

wiring it plugs it like that :
Green TX1 , yellow RX0 , brown GND , orange D9 , red VIN , black GND , blue 3V3 , pink A0 , pink A1
Pink and pink to button or touch plate , brown and orange to Speakers.

Image
#18973
@draculauto
Sadly something isn't right. It doesn't look like a hex file. I even did a test with just a HEX from a basic Blinky example and they look totally different. Here is what a snippet from a .hex file should look like opened from text editor. This is the start of Arduino's Blinky.ino
:100000000C945C000C946E000C946E000C946E00CA
:100010000C946E000C946E000C946E000C946E00A8
:100020000C946E000C946E000C946E000C946E0098
:100030000C946E000C946E000C946E000C946E0088
:100040000C9413010C946E000C946E000C946E00D2
:100050000C946E000C946E000C946E000C946E0068
:100060000C946E000C946E00000000002400270029
:100070002A0000000000250028002B0004040404CE
:100080000404040402020202020203030303030342
:10009000010204081020408001020408102001021F
:1000A00004081020000000080002010000030407FB
:1000B000000000000000000011241FBECFEFD8E0B8
This is what the file I downloaded looks like
0xc,0x94,0x5e,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x1a,0xa,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0xd0,0x9,0xc,0x94,0x86,0x0,0xc,0x94,0x9e,0x9,0xc,0x94,0x78,0x9,0xc,0x94,0x86,0x0,0xc,0x94,0x41,0xa,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,0x94,0x86,0x0,0xc,

The best test is to try and upload it to a new Atmega and see what happens
Good Luck
Mr.Spriggs
  • 1
  • 41
  • 42
  • 43
  • 44
  • 45
  • 80

As this was a rental version whos overstock was […]

Any one got any info on beryl bikes I seen a few[…]

LH/ TF-100 Style Display.

Hi I recently converted a Bird Zero to a personal […]

How do you operate dash without button? I have[…]