Ninebot ES Communicaton Protocol

Table of Contents
Ninebot ES Communicaton Protocol.............................................................................................. 1
1. Summary of communicaton rotocol.............................................................................2
2. Protocol format............................................................................................................... 2
2.1 Serial bus acket format............................................................................................ 2
2.2 ID definiton.............................................................................................................. 2
2.3 Packet length............................................................................................................. 3
2.4 Command word definiton........................................................................................ 3
2.5 Data index descri ton.............................................................................................. 4
2.6 Data segment descri ton......................................................................................... 4
2.7 Serial ort check and descri ton..............................................................................5
3. Use case of Communicaton Protocol..............................................................................5
3.1 Serial ort reads memory control table.....................................................................5
3.2 Serial ort writes memory control table....................................................................6
4. Descri ton of scooter memory control table..................................................................6
5. Descri ton of batery memory control.........................................................................13
6. A endix1 - Serial ort check code...............................................................................16
7. A endix 2 - Error code meaning and soluton.............................................................17

This document has been released by ScooterHacking.org

Original release URL: https://wiki.scooterhacking.org/koku.phpiikgnbkocs
Original release date: 27/09/2019
U dated: 04/01/2021
1. Summary of communicaton protocol

This rotocol defines the general rotocol format, with which Ninebot electronic control system
realizes mult-node communicaton through hysical serial orts and Bluetooth serial orts.
Configuraton of the serial ort is 115200, 8 bytes, without verificaton and with 1 sto bit.
Informaton query, control and arameter modificaton instructon can be realized through the
read-write o eraton of the “memory control table” stored in the controller. Basic storage unit of
the memory control table is 2 bytes of signed integer data (short).
All data longer than 1 byte is subject to the low- riority transmission and storage form.
Macro definiton related to the scooter communicaton rotocol is stored in the NinebotCmd.h
file based on C rogramming language.
Note: Com ared with the revious communicaton rotocol Bluetooth Serial Port Protocol, ID and
command word definiton are changed greatly and CAN bus rotocol is added in this version.

2. Protocol format

2.1 Serial bus packet format

Byte Frame header Packet Source Target Command Data Data Checksum
(2Byte) length ID ID word index segme (2Byte)
(1Byte) (1Byte) (1Byte) (1Byte) (1Byte) nt [N
Byte]
Value 0x5A 0xA5 N 0~63 0~63 0~255 0~255 Data CSumL CSumH

2.2 ID kefiniton

Point-to- oint communicaton

Name ID
Master control of electric scooter (ES) 0x20
Bluetooth instrument of ES 0x21
Built-in batery of ES 0x22
External batery of ES 0x23
PC u er com uter connected through serial 0x3D
ort / CAN debugger/IoT equi ment
Mobile hone linked through Bluetooth serial 0x3E
ort (BLE)
Broadcast ID
Name ID
Entre network broadcast 0x00

2.3 Packet length

Serial ort data acket

Packet length is equal to the data segment length N

2.4 Commank work kefiniton

Control table access instructons

Definiton of instructon Functon Value
CMD_CMAP_RD Read control table data 0x01
CMD_CMAP_WR Write control table data, with 0x02
re ly.
CMD_CMAP_WR_NR Write control table data, without 0x03
re ly.
CMD_CMAP_ACK_RD Res onse acket to instructon 0x04
reading.
CMD_CMAP_ACK_WR Res onse acket to instructon 0x05
writng

Instructons related to data download

Definiton of instructon Functon Value
CMD_IAP_BEGIN Start frame of firmware download / 0x07
with re ly from scooter.
CMD_IAP_TRANS Data frame of firmware download / 0x08
with re ly from scooter.
CMD_IAP_VERIFY Check frame of firmware download 0x09
/ with re ly from scooter.
CMD_MCU_RESET Chi reset instructon / without 0x0A
re ly from scooter.
CMD_IAP_ACK Res onse frame of firmware 0x0B
download.

Instructons related to external equi ment communicaton

define functon comman
d
 CMD_SCO_HEARTBEA Two-way heartbeatcommand 0x55
T Scooter need to receive a command which index = 0x7c,data
= 0x7c as a heartbeat, if 30 second
The scooter needs to receive the heartbeat command of
index=0x7C and data=0x7C. If the heartbeat is not received
for 30 seconds, it will alarm, and motor will be locked afer 1
minute.
For exam le, IoT sends heartbeat every 4S;
The mainboard of the scooter sends out 13 bytes messages
every 500ms:
#define LOCK_STATUS 0 //lock status
#define CHARGE_STATUS 1 //charge status
#define BAT1_VOLT 2 //batery1 voltage V
#define BAT2_VOLT 3 // batery2 voltage V
#define BAT1_SOC 4 // batery1 State of Charge %
#define BAT2_SOC 5 // batery2 State of Charge %
#define BODY_VOLT_SOC 6 //total State of Charge %
#define DRY_VOLT 7 //Voltage V
#define ES_SPEED 8 //s eed 0.1km/h
#define BAT1_TEMP1 9 //Batery1 tem erature -20CC
#define BAT1_TEMP2 10 // Batery1 tem erature -20CC
#define BAT2_TEMP1 11 // EX. Bat tem erature -20CC
#define BAT2_TEMP2 12 // EX. Bat tem erature -20CC

2.5 Inkex kescripton

In the instructon acket which reads and writes the memory control table and res onse acket
with read o eraton, data index indicates the ofset address of the accessed data in the table; in
the res onse acket (command word 0x05) with res onse writng o eraton, data index 0
indicates successful write. Other values are defined as follows:
Index definiton Value Meaning
No write ermission for the write-in
CMD_CMAP_WRERROR_AUTH 0x01
address.
The control table is under o eraton,
CMD_CMAP_WRERROR_BUSY 0x02
and no write-in is allowed.
CMD_CMAP_WRERROR_SIZE 0x03 Write-in data is out of sco e.
CMD_CMAP_WRERROR_FORM 0x04 Write-in data is in wrong form.

During firmware download (IAP), data index indicates natural number of the data acket under
contnuous data download; when the firmware downloads related instructon res onse ackets,
data index 0 indicates download successful. Other values are defined as follows:
Index definiton Value Meaning
IAPERROR_SIZE 0x01 Firmware is over-sized
IAPERROR_ERASE 0x02 Erase Flash failed
IAPERROR_WRITEFLASH 0x03 Write Flash failed
IAPERROR_UNLOCK 0x04 Scooter is unlocked / firmware can be u dated
IAPERROR_INDEX 0x05 Data index error
IAPERROR_BUSY 0x06 IAP is busy (such as writng in Flash)
Data format error (length of the data sent is not an integer
IAPERROR_FORM 0x07
mult le of 8)
IAPERROR_CRC 0x08 Data verificaton failure
IAPERROR_RESET 0x09 Other errors

2.6 Data segment kescripton

Control table access instructons

Definiton of instructon Data segment content Data segment
length N (byte)
CMD_CMAP_RD Length of data to be read (unit: 1
Byte, a frame of data reads u to
255 bytes)
CMD_CMAP_WR Write data content (maximum 0~N
CMD_CMAP_WR_NR 255 bytes of data for a single
write)
CMD_CMAP_ACK_WR 1- write successfully, 0- write 0
failed
CMD_CMAP_ACK_RD Data read 0~N

Instructons related to firmware/data download

Definiton of Data segment content Data segment length N
instructon (byte)
CMD_IAP_BEGIN 4 bytes (u32 ty e), length of firmware 4
to be transmited
CMD_IAP_TRANS Firmware content 0-N
(integral mult le of 8; 128 if
there is no s ecial
requirement)
CMD_IAP_VERIFY 4 bytes download data checksum 4
 CMD_MCU_RESET N/A 0

2.7 Serial port check ank kescripton

Calculaton method: add all the data exce t the header and then invert the result. The lower 16
bits shall revail.

3. Use case of Communicaton Protocol

3.1 Serial port reaks memory control table

If the u er com uter wans to read current tem erature of the scooter, as the index address of
scooter tem erature in the memory control table is 0x3E (refer to secton 4.1), instructon ty e
shall be “read instructon”, namely 0x01 and the data index is 0x3E. As the basic unit of the
memory control table is a 16-bit integer data, the read length is 2 bytes. Data segment has only
one byte with the value of 2 and the frame length is 1. Source ID is ID of the u er com uter,
0x3D. Target ID is main control anel ID of the scooter, 0x20 (refer to secton 2.3). Instructon
acket sent by the u er com uter is:
5A A5 01 3D 20 01 3E 02 60 FF
U on receiving the data acket, the scooter will return current body tem erature value. The
main control anel will return data to the u er com uter according to the source ID of the
acket. Therefore, the target ID is the u er com uter ID, 0x3D and source ID is main control
anel ID of the scooter, 0x20. Instructon ty e is 0x05 (read res onse) and data index is 0x3E
(body tem erature). Date segment is the body tem erature (as it is a 16-bit data, the data
segment has two bytes with the low order in front. Assume current body tem erature is 31.8℃,
as the tem erature unit is 0.1℃, the value read is 318, namely 0x136 in the hexadecimal system.
Therefore, two bytes of the data segment are 36 01) with the frame length of 2. The res onse
acket returned by the scooter is as follows:
5A A5 02 20 3D 04 3E 36 01 27 FF
In ractcal a licaton, in order to save communicaton bandwidth, mult-data can be read in one
tme, such as:
to read 14-byte scooter serial number in one tme. Start address of the serial number in the
memory table is 0x10, with a size of 14Byte, from 0x10 to 0x16. During reading, data index of the
instructon acket is set as 0x10 and the read length (namely data segment) is set as 14, the
scooter will return contnuous 14byte data segment, namely scooter serial number. Instructon
acket sent by the u er com uter is:
5A A5 01 3D 20 01 10 0E 82 FF
3.2 Serial port writes memory control table

When data is about to be writen to the memory control table, instructon ty e of the instructon
acket shall be set as “write instructon”, namely 0x02 (write instructon with res onse) or 0x03
(write instructon without res onse). For “write instructon with res onse”, the lower com uter
will return a res onse instructon indicatng successful writng u on receiving the “write
instructon”; for “write instructon without res onse”, the lower com uter will not return such
instructon, whether receiving the instructon or not. The former is used for write-in of some
im ortant data and the u er com uter needs to confirm whether the lower com uter receives
the data or not, such as write-in of scooter s eed limit value; the later is used for the occasion
having high requirement on real-tme erformance but aying less atenton to the write-in, such
as write-in of remote control target s eed value under remote control mode.
For exam le: write scooter s eed limit value 10kmeter/h under the s eed limit mode with
res onse.
Index of the s eed limit value is 0x74 with the unit of 0.1km/h. So, the value writen is 100,
namely 0x0064 in the hexadecimal system. As the basic unit of the memory control table is a 16-
bit integer data with the low order in front during writng, the data segment to be writen is 0x64
0x00, and the whole instructon acket is:
5A A5 02 3D 20 03 74 64 00 C5 FE
In case of successful writng, the res onse acket returned by the lower com uter is as follows:
5A A5 01 20 3D 05 74 01 27 FF
Like read o eraton, mult-data can also be writen in the write o eraton, such as writng of
Bluetooth airing code 123456:
5A A5 06 3D 20 03 17 01 02 03 04 05 06 6D FF

4. Descripton of scooter memory control table

Informaton and control arameters of the controller form a one-dimensional control table. The
u er com uter gains scooter status and interacts with the scooter through read-write o eraton
of the memory control table. Control arameters in the control table can be saved in case of
ower of.
“Data index” in the instructon refers to the data index of the memory control table.
Note: 0xb0~0xbd content is the commonly used scooter data, which is the same as artal
content in 0x10~0x6F. For exam le, 0xbb/NB_QUK_BODY_TEMP and 0x3e/NB_INF_BODY_TEMP
have the same content related to the scooter tem erature. In this way, commonly used scooter
informaton is available through one read instructon.
Content definiton of the control table is as follows:
Permis Inital
Address Name Command item Ty e
sion[1] value
0x00~
Reserved Reserved -- -- --
0x0F
0x10~ 7*2
NB_INF_SN Scooter serial number, 14Byte R --
0x16 U8
0x17~ NB_INF_BTPASSWO 3*2
Bluetooth airing code [2], 6Byte R/W 000000
0x19 RD U8
NB_INF_FW_VERSI Firmware version of master control
0x1A U16 R --
ON [3]
0x1B NB_INF_ERROR Error code U16 R 0
0x1C NB_INF_ALERM Alarm code U16 R 0
0x1D NB_INF_BOOL Boolean state word [4] U16 R --
0x1E NB_INF_WORK_SYS Current o eraton system, 1 or 2 --
NB_INF_WORKMO Current o eraton mode, 0 NORMAL;
0x1F U16 R --
DE 1 ECO; 2 SPORT
0x20 NB_INF_BTC_1 Volume of storage batery 1 U16 R --
0x21 NB_INF_BTC_2 Volume of storage batery 2 S16 R --
Batery ercentage of the scooter, 0-
0x22 NB_INF_BTC S16 R --
100
0x23 Reserved S16 R --
NB_INF_ACTUAL_M
0x24 Actual remaining mileage, unit: 10m S16 R --
IL
NB_INF_PRD_RID_
0x25 Predicted remaining mileage, 10m S16 R --
MIL
0x26 NB_INF_SPEED Current s eed, 0.1km/h S16 R --
0x27 Reserved --
0x28 Reserved --
0x29 NB_INF_RID_MIL_L Lower 16 bits of the total mileage, m S16 R --
0x2A NB_INF_RID_MIL_H Higher 16 bits of the total mileage, m S16 R --
0x2B Reserved S16 R --
0x2C Reserved S16 R --
0x2D Reserved S16 R --
0x2E Reserved S16 R --
NB_INF_RID_MIL_S
0x2F Single mileage, 10m S16 R --
IG
0x30 Reserved S16 R --
0x31 Reserved S16 R --
NB_INF_RUN_TIM_ Lower 16 bits of the total o eraton
0x32 S16 R --
L tme, sec
NB_INF_RUN_TIM_ Higher 16 bits of the total o eraton
0x33 S16 R --
H tme, sec
Lower 16 bits of the total riding tme,
0x34 NB_INF_RID_TIM_L S16 R --
sec
 Higher 16 bits of the total riding
0x35 NB_INF_RID_TIM_H S16 R --
tme, sec
0x36 Reserved --
0x37 Reserved --
0x38 Reserved --
0x39 Reserved --
NB_INF_RUN_TIM_
0x3a Single o eraton tme, sec S16 R --
SIG
NB_INF_RID_TIM_SI
0x3b Single riding tme, sec S16 R --
G
0x3c Reserved S16 R --
0x3d Reserved S16 R --
NB_INF_BODY_TEM
0x3e Scooter tem erature, 0.1℃ S16 R --
P
NB_INF_BAT1_TEM
0x3f Batery 1 tem erature, 0.1℃ S16 R --
P
NB_INF_BAT2_TEM
0x40 Batery 2 tem erature, 0.1℃ S16 R
P
NB_INF_MOS_TEM
0x41 MOS i e tem erature S16 R
P
0x42~0x
Reserved
46
System driving voltage, 0.01V, also
0x47 NB_INF_DRV_VOLT S16 R --
su ly voltage of the central control
0x48~0x
Reserved S16 R --
4f
NB_INF_BAT2_TEM
0x50 External batery tem erature 2, 1℃ S16 R
P2
0x51 Reserved S16 R --
0x52 Reserved S16 R --
NB_INF_MOT11_CU
0x53 Motor hase current, 0.01A S16 R --
RT_P
0x54 Reserved S16 R --
0x55~0x
Reserved Reserved -- -- --
60
0x61 Reserved S16 R --
0x62 Reserved S16 R --
0x63 Reserved S16 R --
0x64 Reserved S16 R --
0x65 NB_INF_AVRSPEED Average s eed, 0.1km/h S16 R --
0x66 NB_INF_VER_BMS2 External batery version number [3] U16 R --
0x67 NB_INF_VER_BMS Built-in version number [3] U16 R --
0x68 NB_INF_VER_BLE Instrument anel firmware version U16 R --
 number [3]
0x69~
Reserved Reserved -- -- --
0x6f
Lock [5], send 1 for locking, scooter
0x70 NB_CTL_LOCK S16 R/W 0
reset automatcally
Unlock [5], send 1 for unlocking,
0x71 NB_CTL_UNLOCK S16 R/W 0
scooter reset automatcally
0x72 NB_CTL_LIMIT_SPD S eed limit or s eed limit release S16 R/W 250
NB_CTL_NOMALSPE S eed limit value in normal mode,
0x73 S16 R/W 150
ED 0.1km/h
S eed limit value in s eed limit
0x74 NB_CTL_LITSPEED S16 R/W 60
mode, 0.1km/h
NB_CTL_WORKMO O eratng mode: 0, NORMAL; 1,
0x75 S16 R/W 0
DE ECO; 2, SPORT
0x76 Reserved S16 R/W 0
0x77 NB_CTL_ENGINE Start or shut down the engine S16 R/W 0
0x78 NB_CTL_REBOOT Restart system [6], write 1 for restart S16 R/W 0
NB_CTL_POWEROF
0x79 Shutdown [6], write 1 for shutdown S16 R/W 0
F
0x7a Reserved S16 R/W 0
0x7b Reserved S16 R/W 0
0x7c NB_CTL_CRUICE Cruise control switch: 0 Of, 1 On. S16 R/W 0
0x7d NB_CTL_FUN_BOOL functon setu bool【11】 S16 W 0
0 :of 1:on （ headlight and taillight
0x7e Looking for scooter will fash, and bee ） , work once a S16 W 0
command sent (rental only)
NB_CTL_FUN_BOOL functon setu bool 【 7 】 (rental
0x80 S16 R/W 0
_1 only)
NB_CTL_FUN_BOOL functon setu bool 【 7 】 (rental
0x81 S16 R/W 0
_2 only)
NB_CTL_HEADLIGH headlight control on or of (rental
0x90 S16 R/W 1
T_IOT_SW only)
NB_CTL_BEEP_ALA
0x91 Bee alarm on or of (rental only) S16 R/W 1
RM_SW
NB_CTL_BEEP_TOTA
0x92 Bee control switch (rental only) S16 R/W 1
L_SW
0xb0 NB_QUK_ERROR Error code [10] S16 R 0
0xb1 NB_QUK_ALERM Alarm code [9] S16 R 0
0xb2 NB_QUK_BOOL Boolean state word [4] S16 R 0
Volume of batery 1 and batery 2. S16
NB_QUK_BTC_BAT1
0xb3 Lower 8 bits for batery 1 and higher R 0
_2
8 bits for batery 2, ercentage 0-100
0xb4 NB_QUK_BTC Batery volume of the scooter, 0-100 S16 R 0
0xb5 NB_QUK_SPEED Current s eed, 0.1km/h S16 R 0
0xb6 NB_QUK_AVRSPEED Average s eed, 0.1km/h S16 R 0
NB_QUK_RID_MIL_ S16
0xb7 Lower 16 bits of the total mileage, m R 0
L
NB_QUK_RID_MIL_ S16
0xb8 Higher 16 bits of the total mileage, m R 0
H
NB_QUK_RID_MIL_ S16
0xb9 Single mileage, 10m R 0
SIG
NB_QUK_RUN_TIM S16
0xba Single o eraton tme R 0
_SIG
NB_QUK_BODY_TE S16
0xbb Scooter tem erature, 0.1℃ R 0
MP
Current s eed limit value, with the S16
NB_QUK_CRT_LIT_S lower 8 bits for current s eed limit
0xbc R
PEED value and higher 8 bits for the full
range value, unit: 0.1km/h
NB_QUK_SYS_POW S16
0xbd Scooter ower, unit: W R
ER
NB_QUK_ALERM_D S16
0xbe Alarm code for delay reset R
ELAY
NB_QUK_PRD_RID_ S16
0xbf Predicted remaining mileage, 10m R
MIL
0xc0~0x S16
Reserved R 0
c5
Reserved S16 R 0
NB_ONE_LED_MOD Dis lay mode of chassis lam stri
0xc6
E [8]
0xc7 Reserved Reserved S16 R/W 0
2*S1 0xA0F0
0xc8 NB_LED_COLOR1 Color of chassis lam stri 1 [8] R/W
6 Blue
2*S1 0x50F0
0xca NB_LED_COLOR2 Color of chassis lam stri 2 [8] R/W
6 Green
2*S1 0x00F0
0xcc NB_LED_COLOR3 Color of chassis lam stri 3 [8] R/W
6 Red
2*S1 0xC8F0
0xce NB_LED_COLOR4 Color of chassis lam stri 4 [8] R/W
6 Pur le
0xd0~0x S16
Reserved Reserved R 0
d9
0xda NB_CPUID_A U16 R 0
0xdb NB_CPUID_B U16 R 0
0xdc NB_CPUID_C U16 R 0
0xdd NB_CPUID_D U16 R 0
0xde NB_CPUID_E U16 R 0
 0xdf NB_CPUID_F U16 R 0
0xe0~0x --
Reserved Reserved -- --
f
Note:
[1] Read-write access ermission, with R meaning read only and R/W meaning read-write.
[2] The Bluetooth airing code default is 000000 and there is no need to in ut such airing code
in case of Bluetooth connecton by default. If the airing code is set as non-0 figures, airing code
shall be in ut during Bluetooth connecton (there is no need of in ut in case of Bluetooth Dongle
connecton in PC). Afer successful setng of the airing code, Reinitalize Bluetooth mark (index
0x4D) must be set as 1. On-board Bluetooth will be reinitalized in the next start and the airing
code will work.
[3] Definiton of the firmware version is: 16-bit figures are divided into 4 grou s with 4-bit figures
in each grou . The highest 4 digits are PCB version number internally reserved and the rest 12
digits are firmware version number, such as 0x1101, indicatng PCB version number 1 and
firmware version number V1.0.1.
[4] Each digit of Boolean variable indicates one variable of the scooter status. 1 indicates s ort
status and the s ecific definiton is:

//BOOL variable Mark definiton:

Definiton Bit Positon Instructon
NB_BOOLMARK_LIMITSPEED ((unsigned short)0x0001) S eed limit or not
NB_BOOLMARK_LOCK ((unsigned short)0x0002) Scooter lock or not
NB_BOOLMARK_BEEP ((unsigned short)0x0004) Buzzer alarm or not
Reserved ((unsigned short)0x0008)
Reserved ((unsigned short)0x0010)
Reserved ((unsigned short)0x0020)
Reserved ((unsigned short)0x0040)
Reserved ((unsigned short)0x0080)
Reserved ((unsigned short)0x0100)
NB_BOOLMARK_BAT2_IN ((unsigned short)0x0200) Batery 2 inserted
Reserved ((unsigned short)0x0400)
NB_BOOLMARK_ACT ((unsigned short)0x0800) Scooter actvated or not
Reserved ((unsigned short)0x1000)
Reserved ((unsigned short)0x2000)
Reserved ((unsigned short)0x4000)
Reserved ((unsigned short)0x8000)

[5] Locking or unlocking is available only in non-riding mode. Corres onding mark will be reset
afer locking or unlocking ends.
[6] Restart and shutdown are available only in non-riding mode. Corres onding mark will be reset
afer com leton of the o eraton.
[7] Functon setng bool variables ([0x80-0x81] for rental):
Define Bit Positon Instructon Default
NB_FUN_BOOLMARK_HEADLED_ALWAYS_O ((unsigned Headlight 0
N short)0x0001) always on/of
NB_FUN_BOOLMARK_HEADLED_FLASH ((unsigned Headlight 0
short)0x0002) fash
NB_FUN_BOOLMARK_BACKLED_ALWAYS_ON ((unsigned Taillight 0
short)0x0004) always on/of
NB_FUN_BOOLMARK_BACKLED_FLASH ((unsigned Taillight fash 0
short)0x0008)
NB_FUN_BOOLMARK_BAT2LED_ALWAYS_ON ((unsigned Ex. Batery 1
short)0x0010) light on/of
NB_FUN_BOOLMARK_NO_ALARM_AT_LOCK ((unsigned No alarm 0
short)0x0020) when locked
NB_FUN_BOOLMARK_SPEED_IN_MPH ((unsigned Use m h 0
short)0x0040) units
NB_FUN_BOOLMARK_UNIT_SW ((unsigned Dis lay unit 1
short)0x0080) or not
1：yes 0:no
NB_FUN_BOOLMARK_SPEED_ICON_SW ((unsigned Dis lay 1
short)0x0100) s eed or not
NB_FUN_BOOLMARK_PANNEL_SW ((unsigned Panel dis lay 1
short)0x0200) or not
1:on 0:of
NB_FUN_BOOLMARK_BLUETOOTH_SW ((unsigned Bluetooth 0
short)0x0400) broadcast or
not
When on,bt
icon cannot
control;
When of,bt
icon can
define
status:fash
or always

NB_FUN_BOOLMARK_ ((unsigned Bluetooth 0

BT_ICON_ALWAYS_SW short)0x0800) icon always
on or of
NB_FUN_BOOLMARK_ BT_ICON_FLASH_SW ((unsigned Bluetooth 0
short)0x1000) icon fash or
of
NB_FUN_BOOLMARK_ FAULT_ICON_SW ((unsigned Error icon on 1
 short)0x2000) or of
NB_FUN_BOOLMARK_ TEMP_ICON_SW ((unsigned Tem ture 1
short)0x4000) error icon on
or of
NB_FUN_BOOLMARK_ BAT_ICON_SW ((unsigned Dis lay 1
short)0x8000) batery level
on or of

0x81：
NB_FUN_BOOLMARK_BUTTON_SPDMODE_S ((unsigned Buton can 1
W short)0x0001) change mode
or not
NB_FUN_BOOLMARK_MODE_ICON_SW ((unsigned Dis lay 1
short)0x0002) s eed mode
or not

[8] Chassis lam stri control:

Define Data Mode The number of color
MINI_BLED_MODE_CLOSE 0 Close N/A
MINI_BLED_MODE_1COLOR 1 Single color NB_LED_COLOR1
breathing
MINI_BLED_MODE_ALLCOLOR 2 Full-color Non-adjustable
breathing
MINI_BLED_MODE_2C_APART 3 Double color NB_LED_COLOR1&2
a art
MINI_BLED_MODE_ALLC_APART 4 Full-color a art Non-adjustable
MINI_BLED_MODE_1C_STAR 5 Single color fash NB_LED_COLOR1
MINI_BLED_MODE_ALLC_STAR 6 Full-color fash Non-adjustable
MINI_BLED_MODE_POLICE 7 Alarm mode 1 NB_LED_COLOR1&2
MINI_BLED_MODE_POLICE_2 8 Alarm mode 2 NB_LED_COLOR1&2
MINI_BLED_MODE_POLICE_3 9 Alarm mode 3 NB_LED_COLOR1&2&3&
4

[9] Alarm code definiton:

ALARM_CODE_LOCKED 9 //alarm for being ushed in lock mode
ALARM_CODE_HIGH_VOL 12 // alarm for high recoil energy during brake

[10]Error code: See cha ter 7 for details.

[11] Reg 0x7D boolean table:
Define Bit ositon Instructon Default

NB_FUN_BOOLMARK_BACKLED_ALWAYS_ON 0x2 Taillight always on/of 0

NB_FUN_BOOLMARK_SPEED_IN_MPH 0x10 Use m h units 0

5. Descripton of batery memory control

Permis Inital
Address Name Command item Ty e
sion[1] value
0x00~
Reserved Reserved -- -- --
0x0F
0x10~ 7*2
BAT_SN Batery serial number, 14Byte R --
0x16 U8
Batery hardware and firmware
0x17 BAT_SW_VER U16 R 0
version
0x18 BAT_CAPACITY Design ca acity of the batery, mAh U16 R 0
Full charge ca acity of the batery,
0x19 BAT_TOTAL_CAPACITY U16 R 0
mAh
BAT_DESIGN_VOLTAG
0x1A Design voltage of the batery, 10mV U16 R 0
E
0x1B BAT_CYCLE_TIMES Cycle tmes of the batery U16 R 0
0x1C BAT_CHARGE_TIMES Batery charging tmes U16 R 0
Lower 16 bits of the accumulatve
0x1D BAT_CHARGE_CAP_L charge ca acity of the batery, U16 R 0
10mAh
Higher 16 bits of the accumulatve
0x1E BAT_CHARGE_CAP_H charge ca acity of the batery, U16 R 0
10mAh
Batery overfowing and over-
discharging tmes, with the lower 8
BAT_OVER_DISCHARG
0x1F bits indicatng the overfowing tmes U16 R 0
E_TIMES
and higher 8 bits indicatng over-
discharging tmes
0x20~
Reserved Reserved U16 R --
0x2f
0x30 BAT_FUN_BOOLEAN Boolean variable [1] S16
 0x31 BAT_REMAINING_CAP Current residual ca acity, mAh U16 R --
BAT_REMAINING_CAP Current residual ca acity ercentage,
0x32 S16 R --
_PERCENT 0-100
0x33 BAT_CURRENT_CUR Current current, 10mA S16 R --
0x34 BAT_VOLTAGE_CUR Current voltage, 10mV S16 R --
Tem erature, with the higher 8 bits
and lower 8 bits indicatng
0x35 BAT_TEMP_CUR tem eratures of two tem erature S16 R --
sensors res ectvely, 0-119
corres onding to -20 - 99℃
Balanced o en status of the
0x36 BAT_BALANCE_STATU S16 R --
rotectve late
Undervoltage conditon of batery
0x37 BAT_ODIS_STATE S16 R --
cell
0x38 BAT_OCHG_STATE Overvoltage conditon of batery cell S16 R --
0x39 BAT_CAP_COULO Coulombmeter ca acity S16 R --
0x3A BAT_CAP_VOL Voltmeter ca acity S16 R --
0x3B BAT_HEALTHY Health degree S16 R --
0x3C~
Reserved Reserved S16 R --
3f
0x40~ BAT_CORE_VOLT_1~
Single cell voltage S16 R
0x4f BAT_CORE_VOLT_16

The meanings of Boolean states meaning:

Boolean state Bit Positon Instructon
BMS_BOOLMARK_PASSWORD ((unsigned short)0x0001) Batery check code right
or not
BMS_BOOLMARK_ACT ((unsigned short)0x0002) Batery actvated or not
BMS_BOOLMARK_CHG_PROTECT ((unsigned short)0x0004) Batery charging
rotected or not
BMS_BOOLMARK_CMOS ((unsigned short)0x0008) Charging MOS i e o en
or not
BMS_BOOLMARK_WRITE_CMD ((unsigned short)0x0010) Write lock o en or not
BMS_BOOLMARK_DISCHARGE ((unsigned short)0x0020) Discharging or not
BMS_BOOLMARK_CHARGE ((unsigned short)0x0040) Charging or not
BMS_BOOLMARK_CHARGERIN ((unsigned short)0x0080) Charger inserted or not
BMS_BOOLMARK_DISOVER ((unsigned short)0x0100) Over discharging or not
BMS_BOOLMARK_CHGOVER ((unsigned short)0x0200) Over charging or not
BMS_BOOLMARK_VOERTEMP ((unsigned short)0x0400) Over tem erature or not
BMS_BOOLMARK_TEST_MODE ((unsigned short)0x0800) Test mode or not
Reserved ((unsigned short)0x1000)
Reserved ((unsigned short)0x2000)
Reserved ((unsigned short)0x4000)
Reserved ((unsigned short)0x8000)
6. Appendix1 - Serial port check code

Serial ort check and C code

uint16_t CheckSum1ByteIn2ByteOut(uint8_t* data, int len)
{
uint16_t checksum = 0;
ASSERT(NULL != data);
for (int i = 0; i < len; i++) {
checksum += data[i];
}
checksum = ~checksum;
return checksum;
}
7. Appendix 2 - Error code meaning and soluton

Error code Descri ton and soluton

Abnormal communicaton between instrument anel and main control
10 anel; lease check related wiring.
Abnormal A hase current sam ling of the motor, lease check the main
11 control anel.
Abnormal B hase current sam ling of the motor, lease check the main
12 control anel.
Abnormal C hase current sam ling of the motor, lease check the main
13 control anel.
Abnormal accelerator Hall, lease check accelerator twist gri , instrument
14 anel and related wiring.
Abnormal brake Hall, lease check brake twist gri , instrument anel and
15 related wiring.
Built-in batery abnormality in MOS switch, lease check the main control
16 anel.
External batery abnormality in MOS switch, lease check the main
17 control anel.
Abnormal motor Hall, lease check motor, main control anel and related
18 wiring.
Built-in batery abnormality in voltage detecton, lease check built-in
19 batery, main control anel and related wiring.
External batery abnormality in voltage detecton, lease check external
20 batery, main control anel and related wiring.
Built-in batery abnormality in communicaton, lease check built-in
21 batery, main control anel and related wiring.
22 Built-in batery assword is wrong, lease re lace the batery.
23 Built-in batery is in default serial number, lease re lace the batery.
System voltage detecton abnormality, lease check the main control
24 anel.
25 Undefined.
26 Flash save error, lease check the main control anel.
27 Master control assword is wrong, lease re lace the main control anel.
Short circuit in motor driven u er MOS bridge, lease check the main
28 control anel.
Failure in motor driven botom MOS bridge, lease check the main
29 control anel.
30 Undefined.
31 Program ski error, lease check the main control anel.
32 Undefined.
33 Undefined.
34 Undefined.
35 Vehicle is in default serial number, lease re lace the main control anel.
36 2+4 connector failure or external batery charging wire failure.
37 Charging base failure or built-in batery charging wire failure.
38 Undefined.
Built-in batery tem erature sensor abnormality, lease re lace the
39 batery.
Controller tem erature sensor abnormality, lease check the main
40 control anel.
External batery tem erature sensor abnormality, lease re lace the
41 batery.
External batery abnormality in communicaton, lease check external
42 batery, main control anel and related wiring.
43 External batery assword is wrong, lease re lace the batery.
44 External batery is in default serial number, lease re lace the batery.