Page 17 of 28

Re: Tier ES400 unlock development

Posted: Tue Nov 29, 2022 4:51 am
by Ennopto
Enough with the secret keeping. The green IoT connector's pinout is as follows:
  1. red - 54.6 V (battery positive supply for IoT module(!), not motor supply etc.)
  2. yellow - CAN low
  3. green - CAN high
  4. blue - main switch
  5. black - 0 V (battery negative)
Be cautious, as the red wire is live 54 volts with a full battery and might easily damage low voltage electronics.

To start the scooter, short the blue wire with GND (black wire) and fire up the 250 kbit/s CAN bus (yellow and green).
The following messages have to be send about every 500ms to keep the scooter active. Thanks go to the logic analyzer dumps provided by @Rick Sanchez .
Code: Select all
02181606#0100140001000000 <- motor. 3rd byte 0x14: 20 km/h max speed, 4th byte 0: kick to start, 1: thumb throttle
02203606#0101000100010000 <- display. 1st byte 0: mph, 1: km/h, 2nd byte = light (0: off, 1: on, 2: blink)
02488600#0000000000000000 <- some other required messages
02213600#

Now to my main question: where to get spare parts for ES400? I nowadays only see as a minimum of ES500 or sometimes some Segway scooters in my area...

Have fun, cheers.

Re: Tier ES400 unlock development

Posted: Tue Nov 29, 2022 12:34 pm
by Chast
MikeSnow wrote:
Mon Nov 28, 2022 10:57 am
To clarify, I'm not interested in open the battery lid, I already have the battery. What I want to do is to enable the BMS in the battery to put out voltage, more than a few amps. For that I need to send CAN messages, as I understood it.
I am informing you about playing with a scooter in general.

As for your question, I need to filter the logs that the battery gets from the motor controller.

At the moment, I managed to get the display and motor controller to work.

At the moment, the start is made by pressing the throttle. However, he drives impulsively. It accelerates to about 12-14 and stops again and again.

Re: Tier ES400 unlock development

Posted: Wed Nov 30, 2022 6:01 am
by Chast
A few data from the next days of analysis.

-Currently reworked battery. I'm looking for a voltage sustain log.
-Desoldered memory from the IOT module. This way I don't have to simulate most CAN frames.
- Every now and then, instructions must be sent to support the display module.
-CAN display frame:
1 Byte - km/mile
2 Byte - LED on/flashing
3 Byte - reservation
ON/OFFf


- engine CAN frame
1 Byte - direct start / push away
2 Byte - soft/fast start
3 Byte - maximum speed
4 Byte - enabling the module

- the state of charge of the battery is measured by the engine module. There is no CAN communication with the battery.

A scooter without an IOT module dies. CAN communication not supported.

Someone wrote that they found a riding scooter without an IOT module. It is not possible.

Re: Tier ES400 unlock development

Posted: Wed Nov 30, 2022 1:30 pm
by Chast
Update
Improved byte description of display and engine frames

I am looking for a frame that does not cut off the power.

I am looking for a frame responsible for the brakes and the stop lights. Now the position lights are on.

-CAN display frame:
1 Byte - 1 km / 0mile
2 Byte - LED 1 ON /2 FLASHING / 0 OFF
3 Byte - reservation 1 ON/ 0 OFF (The remaining bytes must be 00)
4 Byte - 1 ON/ 0 OFF display
5 Byte - 1 test display / 0 normal
6 Byte - 1 Turning on the charger / 0 OFF

01 01 00 01 00 01 00 00

- engine CAN frame
1 Byte - enabling the module
2 Byte - soft/fast start
3 Byte - maximum speed
4 Byte - direct start / push away

01 00 1F 01 00 00 00 00


Image
Image
Image
Image

Re: Tier ES400 unlock development

Posted: Thu Dec 01, 2022 3:00 pm
by blader2
Chast wrote:
Wed Nov 30, 2022 1:30 pm
Update
Improved byte description of display and engine frames

I am looking for a frame that does not cut off the power.

I am looking for a frame responsible for the brakes and the stop lights. Now the position lights are on.

-CAN display frame:
1 Byte - 1 km / 0mile
2 Byte - LED 1 ON /2 FLASHING / 0 OFF
3 Byte - reservation 1 ON/ 0 OFF (The remaining bytes must be 00)
4 Byte - 1 ON/ 0 OFF display
5 Byte - 1 test display / 0 normal
6 Byte - 1 Turning on the charger / 0 OFF

01 01 00 01 00 01 00 00

- engine CAN frame
1 Byte - enabling the module
2 Byte - soft/fast start
3 Byte - maximum speed
4 Byte - direct start / push away

01 00 1F 01 00 00 00 00


Image
Image
Image
Image
I am looking for a frame that does not cut off the power.
What do You mean?

Re: Tier ES400 unlock development

Posted: Thu Dec 01, 2022 5:00 pm
by Chast
I mean that when renting a scooter for 99%, a frame (CANBUS instruction) is sent from the IOT to the module:
- battery
- display
- motor controller.
I assume that the instruction to the battery is sent every few moments the same as to the display.

Re: Tier ES400 unlock development

Posted: Thu Dec 01, 2022 5:42 pm
by blader2
Chast wrote:
Thu Dec 01, 2022 5:00 pm
I mean that when renting a scooter for 99%, a frame (CANBUS instruction) is sent from the IOT to the module:
- battery
- display
- motor controller.
I assume that the instruction to the battery is sent every few moments the same as to the display.
It is exactly as you write, when it is offline, it sends everywhere that it should be in such or such a state, when it is rented, it sends signals to run individual elements

Re: Tier ES400 unlock development

Posted: Mon Dec 05, 2022 2:19 pm
by Chast
Hello.
Can someone provide me with logs of scooter activation? The ones I have are incomplete. At the moment it is based only on logs during IOT startup and modified IOT eeprom batch.

Re: Tier ES400 unlock development

Posted: Fri Dec 09, 2022 3:18 pm
by Marius Petz
Chast wrote:
Wed Nov 30, 2022 6:01 am
Someone wrote that they found a riding scooter without an IOT module. It is not possible.
Actually that was me. I found an unlocked ES400A on the streets. I removed the IoT and the scooter drove around without problems or shutting down. I've tested this for 45 minutes before I dropped the scooter - without any problems. I recognized when the Scooter Rangers come and change the battery they also unlock the scooter. maybe my scooter was in a special service mode so there was no need to send any commands to keep the scooter alive. Besides that I found out when the IoT is removed it sends only GPS Locations - the companies can't send a localization alarm or something like that also with the additional battery in the IoT

Re: Tier ES400 unlock development

Posted: Sat Dec 10, 2022 1:59 am
by Chast
Hello.
With the ES400A version that has CAN, this is impossible.
First, the display module needs a hold signal every 2 minutes or so. If it doesn't get it, it goes out and you can't adjust the speed.
Secondly, the engine module needs a signal every 10 minutes or so. If it does not get it, it shows a decrease in battery capacity and stops driving.
Third, without the IOT module, there is no communication between the display module and the engine module. He is responsible for maintaining communication.
The situation you describe can be compared to a car and removing the computer. No matter what mode it is in, you won't go anywhere and speed indicators won't work.