# Cell pack hybrid scooter no initialisation!



## Josefmifsud1974 (Sep 29, 2017)

Hello friends I hope someone can help me in my dilemma.
I changed the cells in my hybrid scooter battery pack and when im trying to turn on from mosfet switch it remains blinking red.
The battery pack is 10 cells 3.7v at 31Ah.Has and integrated bms and 9 cells have a board between terminals.I removed the pcb chips and installed on the new cells.The bms has a can bus system also which communicates with the main ecu.
But im stuck the voltage is there but the bms is not giving the signal to swith on the battery and turn the led to green.
The battery is installed in the Hybrid scooter MP3 made by Piaggio.
I have more documentation if needed.
Hope I will have some feedback because my hopes are diminishing


----------



## Solarsail (Jul 22, 2017)

Is this LiFePO4 and what is the configuration XsYp? With so little information provided, it is difficult to figure what the issues may be. The boards between terminals can be balancing boards, if this is a 10s, then there should be 10 of them (not 9).

What is a "hybrid scooter"? Does it also have a gas engine? Did you say that you removed the chips on the PCB? Why would you do that? Or is that an inaccurate description? Is the blinking LED on the BMS inside the pack, or is it controlled by the ECU?

I would think that the BMS is not getting the right signals from the balancers - due to a disconnect or a bad board, it cannot see the voltage across a cell, or some other issue with one of the 10 balancers. Looks like you already are suspecting a balancer and testing it, and there may be signs of fire damage on it?


----------



## Josefmifsud1974 (Sep 29, 2017)

thankyou for your reply and feedback i very appreciate your time and help and i will try give more infornation as you request and as possible to my knowledge.
Yest the MP3 Piaggio scooter hybrid has both eletric and gas engine which work in tandem.some time ago it just stopped and the battery died , from there the engine start but stays idle.
the battery pack is sealed so i gave it a try to regenerate the pack.
So i opened the pack and found that all cells were at 0v,there are 10 cells in side the pack KOKAM brandded 3.7v 31AH.
So i managed to find 10 cells of the same capcity to replace them which are 3.7v 30Ah UNITEK.
So i dismatelled the original cells removed the pcb boards from the original cells and installed them on the new cells so all is back to how it was.
Yes there are 9 pcb boards with a chip and the last board is just taking 3.7v from the last cell and supplying the terminal part unit which has a mosfet switch,in fact connecting just the last cell it start blinking red led which states that the battery is disarmed.
my frien technician tested one board and its not fire what looks on the board but there was black silicone between the boards and the bar which connects the batteries in series.My fiend tried to look the software of the chip but its locked so if a chip is gone we cannot overwrite a new one.
The termials on the pcb board one of them shows voltage the other i dont know.


----------



## Josefmifsud1974 (Sep 29, 2017)

Some more data and photos.
The old cells are the wide ones,the pcb boards i removed from the old and installed on the new.I charged the new cells one by one to 4.23v.The third photo is the Kuadro VMS ecu which charges and controls all the electronics in the scooter.


----------



## Josefmifsud1974 (Sep 29, 2017)

This it the hybrid system overview whith some technical data i managed to retrieve from friends has some usefull information for who is more profesional than me and knows more into electronics.


----------



## Josefmifsud1974 (Sep 29, 2017)

Josefmifsud1974 said:


> Some more data and photos.
> The old cells are the wide ones,the pcb boards i removed from the old and installed on the new.I charged the new cells one by one to 4.23v.The third photo is the Kuadro VMS ecu which charges and controls all the electronics in the scooter.


The red button its the intialising switch and next to it there is an led the first photo which shows the terminals,To initialise the battery you switch ignition on and push for a second the button which should turn to green and starts to comunicate with the main vms kuadro.


----------



## Solarsail (Jul 22, 2017)

You are not answering my basic questions. Please read my comment once more and answer ALL questions. Are the 10 cells in parallel or series? I assume series. Are they LiFePO4 with max 3.7V or are they Lico with nominal 3.7V?

If the mosfet switch is in the battery pack and part of the BMS protection, then just do away with all the balancing and protection, and get your scooter going. Then buy a $10 balancer board and use that to charge the pack. So -

Remove all boards and BMS and mosfet switch in the pack.
Connect all 10 cells in series, and charge them externally with a charger.
Put a high amperage diode with heat sink in series with pack so the scooter generator will not charge it. (Or put a voltmeter and continuously check the voltage to make sure it does not over charge.)
Get your scooter to work.
Then get a 10S protection balance board, with the proper current rating, and install that, and remove the diode.

If the ECU expects an OK from the BMS, the above will not work. Maybe you can make the BMS happy without it being connected to the balancer boards, so it tells the ECU all is fine?

The BMS receives a signal from the balancer board that the voltage has not exceeded the threshold (4.2V for li-ion) or the voltage is not below a threshold (3.0V for li-ion). If you remove the balancers, then find a way to send this signal to the BMS and make it happy. Sometimes the signal is sent from one balancer to the next in series, until the last balancer sends that to the BMS.

Since there are 9 boards and not 10, I suspect this is a serial balancer and the signal is sent from one board to the next board and then to the BMS. Is the BMS connected directly to all 9 boards (i.e. parallel balancer) or is the BMS connected just to the last board (serial balancer). If it is serial, you will have to find out the protocol of the signal to make the BMS happy.

If you can make the ECU happy and remove all boards and BMS, then use this board, or many other boards on eBay. Make sure the amperage is sufficient for the scooter. What is the max amperage?

http://www.ebay.com/itm/10S-40A-36V...169897?hash=item41af3217a9:g:R~IAAOSwXeJXc3KJ


----------



## Josefmifsud1974 (Sep 29, 2017)

10 in series to a total of 37v, lion based cells


----------



## Josefmifsud1974 (Sep 29, 2017)

yes the ecu wait an ok from bms threw Can bus sustem.
and yes the boards are connected one to the other wit 2 wires from one to nest till they connect to the terminals part were there is the mosfest switch.
Is it possible that 4.23v blocks the unit.
I will discharge the cells to 4.12 each and recheck.
So your opinion is that these boards if the values are correct will make it work.
is there a way to read the chip


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> You are not answering my basic questions. Please read my comment once more and answer ALL questions. Are the 10 cells in parallel or series? I assume series. Are they LiFePO4 with max 3.7V or are they lithium ion with nominal 3.7V?
> 
> If the mosfet switch is in the battery pack and part of the BMS protection, then just do away with all the balancing and protection, and get your scooter going. Then buy a $10 balancer board and use that to charge the pack. So -
> 
> ...


The continuous discharge is 60A,on the battery it says 37v 31Ah 100A 1/2Kw


----------



## Solarsail (Jul 22, 2017)

Looks like the balancer boards have an Atmega micro controller. So the signal to the BMS is probably a digital signal. Since the BMS sends a Can bus signal to the ECU, you will have to spoof that.

Sorry, I have no idea about the Atmega board and what makes it happy. Maybe there is a break in the signal path to the BMS? Maybe one cell is overcharged? Maybe one board is not functional. You will have to figure out the signalling from one board to the next and see which board is stopping the signal and work on that board.


----------



## Solarsail (Jul 22, 2017)

4.23V is definitely overcharge and is bad for the cell, and reduces the capacity over time. You should never charge over 4.15V or 4.2V. Reduce all charges to below 4.2V.

The Atmega chip may think there is something wrong with the overcharged cell and refuses to OK it. Check the signalling between the boards and see which board alters the round-robin signal.


----------



## Solarsail (Jul 22, 2017)

Is this hybrid a serial hybrid? Is the gas engine connected to the wheels and motor or just to a generator?

The manual says it is not serial hybrid. What a waste.

And the battery is so small. Only 0.5 kWh.

I think you should spoof the signal to the ECU, get rid of this battery and put proper 18650 cell 1.5 kWh battery of same size instead. Just my opinion.


----------



## Solarsail (Jul 22, 2017)

I would reduce each cell to 3.5V and see if the BMS comes up. This is the range of both Lico and LFP.

Could it be that the old cells are LiFePO4 (2.8V - 3.6V) instead of Lico cells? Since the battery is prismatic, it could be LFP. Have you looked up the chemisty of the Kokam cells?


----------



## Josefmifsud1974 (Sep 29, 2017)

I am attaching KOKam specs
I very aprecitate your support


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> Is this hybrid a serial hybrid? Is the gas engine connected to the wheels and motor or just to a generator?
> 
> The manual says it is not serial hybrid. What a waste.
> 
> ...


The engine and electric motor are connected to the wheel as one,during braking it charges the lithium battery and supports the gas engine when needed or vis versa.When the battery shows no com it blocks the engine to only idle and the scooter is stuck cant be driven.


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> I would reduce each cell to 3.5V and see if the BMS comes up. This is the range of both Lico and LFP.
> 
> Could it be that the old cells are LiFePO4 (2.8V - 3.6V) instead of Lico cells? Since the battery is prismatic, it could be LFP. Have you looked up the chemisty of the Kokam cells?


yes i will reduce the voltage in the cells,at present i noticed that the cell is showing 4.23v between terminals and when i check negative and one of the pins on pcb board there is voltage 3.98v on the other pin i dont know what is transmitting,so which voltage i should look to keep in range so that it can activate the mosfet switch?
Thankyou again


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> Is this hybrid a serial hybrid? Is the gas engine connected to the wheels and motor or just to a generator?
> 
> The manual says it is not serial hybrid. What a waste.
> 
> ...


Would be interesting but how to sppof the bms im not that expert to go around it.


----------



## Solarsail (Jul 22, 2017)

It could be that 4.23V is too high and the Atmega thinks this is a bad cell or that the generator or charger are feeding too much voltage, or that the BMS is broken and overcharging the cells. So it sends a fail message to the BMS terminal board, and that refuses to go green light and turn on the Mosfet. 

The spec says the Kokam batteries are LiPoly, so they are Lico, and go up to 4.2V. Do not overcharge. Reduces battery life fast.

Number the balancer boards - #9 sends message to BMS. #8 sends to #9, etc. Then look at board #1. Does it receive a message from BMS or anywhere? Then see what message it passes to board #2. Check the message from #2 to #3 - is it same OK message? Then from #3 to #4, etc. Until you find a board that gets OK message but sends a not-OK message to the next board. Call this board #x. Swap #2 board with #x. Is board #x getting OK from #1 but sending not-OK to #3? If yes, then #x board is bad. If #x is good, then look at board #2 that is now in the original place of #x. Does it get OK, but pass not-OK? If so, then something wrong with the cell, or with the connection to the cell or the connection between cells at this location.

You can also easily force the Mosfet to turn on - just connect source to drain, or put bias on gate. But I am afraid that BMS has already sent a not-OK message to ECU and even if you bypass the mosfet, the ECU will refuse to come on.


----------



## Josefmifsud1974 (Sep 29, 2017)

So 9 boards have 2 wires conecting them together.
From one board to another till they connect to termal board. 
The last cell in the pack at the bottom has two wire which go on a seperat way to the terminals block.when this wire is connected the red led starts to blink so 3.7v from cell 10 .
One terminal of each boards shows voltage the other i dont know.
For which ok signal i should look


----------



## Josefmifsud1974 (Sep 29, 2017)

What i need test , im reducing the cells charge to 3.7v


----------



## Solarsail (Jul 22, 2017)

Please draw the interconnections with proper naming and show the ground wire, and the voltages properly. Is the 2nd wire a digital serial signal? Is one of the cell board sending different voltage or signal? Maybe all cell boards are good and terminal board is bad.

Please draw interconnections with detail and attach. Thanks.


----------



## kennybobby (Aug 10, 2012)

Wow that appears to be a high quality system with lots of engineering and design effort into the circuitry both for the battery pack and the charger and motor inverter shown in the photos.

The little boards that were riveted to each cell appear to perform the balancing function by bleeding down cell voltage thru the 33 Ohm resistor seen in the photo. The little blue wires connect to a thermal sensor to read the cell temperatures. The ATmega48 chip likely does all the local control to read voltage and temperature, control balancing, and provide communication back to the main BMS chip located on the board with the large terminal lugs.

That main board has a couple of large fuses, two rows of large FETs and a 5 or 6-pin connector for the CAN buss to the overall system ECU controller. Those FETs are used to open and close the battery to provide safety features for over-current, over- and under-voltage protection, etc.

Some of the power tool packs (e.g. ryobi, makita, dewalt, milwaukee, etc.) have an internal program that will cause the cells to discharge down to zero as a safety feature to disable the pack in the case of certain conditions, and that may be what happened to your pack. It sounds like you have done all the right things to try to get it going by replacing the cells, but may have over-charged them which would signal a fault back to the main board and prevent the FETs from turning on. At least you have the main board come alive, so you are getting closer to operation.

i'm trying to solve the same problem but have not yet determined how to reset the disable-feature in the power tool packs.

where are you located?

p.s. It would not be easy to do now, but the temperature sensors should have been checked to ensure they were are all functioning properly. If any sensor was bad or open-circuited, then the pack would likely be blocked from operation (FETs stay open).


----------



## Josefmifsud1974 (Sep 29, 2017)

kennybobby said:


> Wow that appears to be a high quality system with lots of engineering and design effort into the circuitry both for the battery pack and the charger and motor inverter shown in the photos.
> 
> The little boards that were riveted to each cell appear to perform the balancing function by bleeding down cell voltage thru the 33 Ohm resistor seen in the photo. The little blue wires connect to a thermal sensor to read the cell temperatures. The ATmega48 chip likely does all the local control to read voltage and temperature, control balancing, and provide communication back to the main BMS chip located on the board with the large terminal lugs.
> 
> ...


I am located in Malta islands close to Italy,I have many italian friends with the same issue and Piaggio only says new battery or new ecu with an extranominal cost of 5000 euro for both.Im not an engineer so im trying my best of knowledge with forum help to solve this issue.Actually one i opend the pack only one cell was at 0.6v all the other 9 were at 3.65v.


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> Please draw the interconnections with proper naming and show the ground wire, and the voltages properly. Is the 2nd wire a digital serial signal? Is one of the cell board sending different voltage or signal? Maybe all cell boards are good and terminal board is bad.
> 
> Please draw interconnections with detail and attach. Thanks.


Im not sure what the signals are as i said cell 1 board transmitts threw the 2 wires the cell voltage thats for sure as it doesnt have a chip embedded, so if the cell is 3.8v that board is sending 3.7v to the main terminal block in fact with cell one only connected to terminal block the led start flashin red.


----------



## kennybobby (Aug 10, 2012)

Josefmifsud1974 said:


> ... opend the pack only one cell was at 0.6v all the other 9 were at 3.65v.


Well that's good news really, that the pack was not drained completely. Was it the cell #10 located next to the main board or which one was it? The balancing for cell #1 with the bare circuit board is controlled thru the main board.

Do you know which board was attached to that lowest cell--it may be a defective part on that board which caused the cell to be drained. It is more likely that a cheap electrical part failed than a bad Kokam cell. That has been the case in dozens of packs that i have examined that failed to charge or operate--it was some little cheap-assed part that caused the problem, the cells were perfectly ok.

Do you have a voltmeter and probe leads where you could try to measure some voltages?

No need to drop all the cells to 3.7, just bring down below 4.2 a bit, like put them all at 4.0


----------



## Josefmifsud1974 (Sep 29, 2017)

The cell with the bare board was the lowest which was located at the end of the pack meaning bottom.


----------



## Josefmifsud1974 (Sep 29, 2017)

Yes i di have a voltmetre and probes and thanks again for advice and helping me out with this issue


----------



## Josefmifsud1974 (Sep 29, 2017)

Josefmifsud1974 said:


> Yes i di have a voltmetre and probes and thanks again for advice and helping me out with this issue


The Atmega chip is locked as my friend electricconics engineer tried to cooy it but its locked.So its kind of difficult if a boardd is gone to repair it.


----------



## Solarsail (Jul 22, 2017)

In your diagram, is the + of one cell connected to the - of the next cell? I wish you had not omitted that. Thanks. The way it is drawn it looks like the 10 cells are in parallel and not series. Please clarify.


----------



## kennybobby (Aug 10, 2012)

Since it was cell #1 that was drained low, then the problem is on the main board related to the balancing of cell #1. There is no need to read the ATmega since that cell doesn't have the balancing board.

Can you get a good photo of the circuitry at the top of the main board around the connectors, especially where the path is for cell#1. Examine that board closely for any signs of thermal distress, overheating, loose or bad solder joints, etc. In addition you could check for continuity across any of those little ceramic chip capacitors--they will fail in a shorted condition due to heat or vibration which cracks the layers. One of those in the path could put a short circuit to ground and bleed the cell down.

If you have any photos of the entire main board that might be helpful.

Does cell #1 have a temperature sensor that connects thru the harness back to the main board?

Did you say that the main board came alive and flashed the red led when only cell #10 or cell #1 was connected?

Maybe your friend traced out the schematic of the little balancer board with the ATmega? If so see if you can post that here on the forum.

edit: looking at the last photo of your first post, there is a powdery residue that is likely leaked electrolyte, and down below that is a cut or torn slit in what appears to be the cell wall. Is this cell#1 that was reading low? Since it doesn't have the bleed-resistor board attached, it may have been overcharged and expanded to the point of bursting.

It is odd that one cell doesn't have the same balancing board as the rest--seems a poor design


----------



## Solarsail (Jul 22, 2017)

Maybe the original cells were in series, but you have connected the new ones in parallel?

Please redraw as series and not as parallel.


----------



## Solarsail (Jul 22, 2017)

Are you sure you have drawn this correct? Each balance board is connected to the + and - of same cell? Then there should be 10 identical boards and not 9 + 1. Could it be that the board connects the + of a cell to the - of the next cell?

Please draw the wire that connects + of one cell to - of another cell. You have drawn all the cells in parallel which is wrong. Also is there a ground wire between the boards?

I believe each board gets a digital packet that says what the max and min voltage of all the cells before it is. So the terminal board finds out the max and min of all 10 cells and then may cut off the charge or discharge. Also the boards tries to bypass a cell with too high a voltage so that the cells come to balance.

Maybe your variation between cell voltage is too much and the terminal board sees a lot of difference between the max and min and decides not to turn on.

Or maybe the wire from board to board is a simple analog +5V = OK, and 0 = not OK. Any of the boards can ground that and send a not-OK message down the pipe.

I still think you should spoof the CAN bus message, and then buy a 10s balancer board and replace all the boards and the terminal board with that. You can keep the cells.


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> In your diagram, is the + of one cell connected to the - of the next cell? I wish you had not omitted that. Thanks. The way it is drawn it looks like the 10 cells are in parallel and not series. Please clarify.


There is an aluminium bar between cells with isolators which connects them in series


----------



## Josefmifsud1974 (Sep 29, 2017)

kennybobby said:


> Since it was cell #1 that was drained low, then the problem is on the main board related to the balancing of cell #1. There is no need to read the ATmega since that cell doesn't have the balancing board.
> 
> Can you get a good photo of the circuitry at the top of the main board around the connectors, especially where the path is for cell#1. Examine that board closely for any signs of thermal distress, overheating, loose or bad solder joints, etc. In addition you could check for continuity across any of those little ceramic chip capacitors--they will fail in a shorted condition due to heat or vibration which cracks the layers. One of those in the path could put a short circuit to ground and bleed the cell down.
> 
> ...


Those are the best photos i got from my friend in Croatia.since the pack was filled eith some green rubbery wax material its poored in the main board and to completley clean it i think will damage someething in orocess.the cell with low volt doesnt have as we said the chip and also doesnt have a tempreature probe.also yes there was som leak in that cell.i will upload some other photos today


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> In your diagram, is the + of one cell connected to the - of the next cell? I wish you had not omitted that. Thanks. The way it is drawn it looks like the 10 cells are in parallel and not series. Please clarify.


the cells are in series connected with aluminium bars and isolators


----------



## Josefmifsud1974 (Sep 29, 2017)

Some more photos added


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> Are you sure you have drawn this correct? Each balance board is connected to the + and - of same cell? Then there should be 10 identical boards and not 9 + 1. Could it be that the board connects the + of a cell to the - of the next cell?
> 
> Please draw the wire that connects + of one cell to - of another cell. You have drawn all the cells in parallel which is wrong. Also is there a ground wire between the boards?
> 
> ...


I already bought a 10\s BMs balancer board it was my idea too but how to sppof the can thats the probem


----------



## Solarsail (Jul 22, 2017)

Will you be uploading a new diagram that shows how the cells are connected?

Your diagram shows all the + terminals are together and all the - terminals are together. So it shows all 10 cells are in parallel. But then you claim you get 37V which is series not parallel. This makes no sense.

If you do not upload the real diagram, how do you expect us to solve the problem? You have communication problem with us.

Bye.


----------



## kennybobby (Aug 10, 2012)

The ATmega appears to have 3 different communication options, UART, SPI, and single-wire serial. Someone would need to trace the little board to determine which pins are used from the 2-pin connector back to the atmega, then a good guess could be made and a method to monitor the traffic. The other benefit of tracing the board is to check the temperature sensors. And to basically check all the components resistors, capacitors, transistors, diodes. There is not many on each board, but if any one were not working properly it could disable the whole pack.

A CAN buss sniffer would be needed to monitor the traffic between the ECU and the battery pack, but unless someone has already done this with a good pack and published their findings, it will be very difficult to decode the messages. 

The FETs on the main board likely function as a switch on the low side (-) of the pack, one row is for charging control, the other for discharge control.

Is there any documentation about the battery pack to identify the 5 terminals of the connector, e.g. CAN-Hi, CAN-Lo, Ground, ???, ???

It may be that carefully removing the green coating would reveal the main board processor and it may have a programming port on the board. The control secrets would be found in that firmware.

If there are many of these scooters and many folks have trouble with the battery packs, then someone will want to solve this issue and hopefully put it out on an open forum to share.

Maybe you can swap out the battery pack with someone else's known-to-be-good pack to see if it works. This would help rule out where the problem is--right now you don't know if it is the pack or the ECU.


----------



## Josefmifsud1974 (Sep 29, 2017)

I will try make a diagramm.
But you can understand that if you look at the photos you can see that the batteries are connected by means of an aluminum bar from one cell to another and isolation blocks are used between the oppisite terminals and continus like that.
I asure you they are in series and there is 39.8v im not dumb.
I hope this explians


----------



## Josefmifsud1974 (Sep 29, 2017)

kennybobby said:


> The ATmega appears to have 3 different communication options, UART, SPI, and single-wire serial. Someone would need to trace the little board to determine which pins are used from the 2-pin connector back to the atmega, then a good guess could be made and a method to monitor the traffic. The other benefit of tracing the board is to check the temperature sensors. And to basically check all the components resistors, capacitors, transistors, diodes. There is not many on each board, but if any one were not working properly it could disable the whole pack.
> 
> A CAN buss sniffer would be needed to monitor the traffic between the ECU and the battery pack, but unless someone has already done this with a good pack and published their findings, it will be very difficult to decode the messages.
> 
> ...


Adding photos


----------



## Josefmifsud1974 (Sep 29, 2017)

I cleaned this board obvious some damage happend so this unit is for parts and view purpose.There are over 1500 units in paris and some 300 in Italy in Malta only 2,


----------



## Josefmifsud1974 (Sep 29, 2017)

kennybobby said:


> The ATmega appears to have 3 different communication options, UART, SPI, and single-wire serial. Someone would need to trace the little board to determine which pins are used from the 2-pin connector back to the atmega, then a good guess could be made and a method to monitor the traffic. The other benefit of tracing the board is to check the temperature sensors. And to basically check all the components resistors, capacitors, transistors, diodes. There is not many on each board, but if any one were not working properly it could disable the whole pack.
> 
> A CAN buss sniffer would be needed to monitor the traffic between the ECU and the battery pack, but unless someone has already done this with a good pack and published their findings, it will be very difficult to decode the messages.
> 
> ...


On the 2 pin on the atmega board one pin when cheking voltmetre negative terminal of cell and 1 oin of board has voltage close to cell voltage.the other terminal doesnt show nothing it might be the serial line.


----------



## kennybobby (Aug 10, 2012)

Somebody spent a lot of time to design all that. 

It looks like there is a 6 terminal header connection next to the red button--that is likely how they load the program and connect for diagnostics and checkout.

i know you are not dumb, but what is the voltage of your 12V battery used to connect for the initialization? Is it a fresh strong battery or is it possibly old and weak. What does the 12V battery voltage do when you connect and go thru the procedure--does it drop heavily from load to switch contactors, etc.?

Can you identify the processor chip on the main board?


----------



## Josefmifsud1974 (Sep 29, 2017)

kennybobby said:


> Somebody spent a lot of time to design all that.
> 
> It looks like there is a 6 terminal header connection next to the red button--that is likely how they load the program and connect for diagnostics and checkout.
> 
> ...


The battery start the scooter fine,its over 3 years old.
I think the processor is in the centre under that square block wit thw 2 blue wires


----------



## Josefmifsud1974 (Sep 29, 2017)

kennybobby said:


> Somebody spent a lot of time to design all that.
> 
> It looks like there is a 6 terminal header connection next to the red button--that is likely how they load the program and connect for diagnostics and checkout.
> 
> ...


I wii check the battery voltage if it fluctuates during the process.


----------



## kennybobby (Aug 10, 2012)

That's a good diagram about the 5 pins and the initialize process. Do you have access to a workshop or service manual for the scooter?

How about posting a list of all the chips, transistors and FETs for which you can read the part numbers, as seen in the first photo of post 4, which shows the top half of the board, and any and all chips on the later photos showing the lower half of the board that was covered with the white material. 

The white 6-pin chips on the daughter board are optocouplers usually used to isolate a high voltage from a lower voltage on a board. Maybe the processor is under that board--it is either pressed on a header block or soldered into place. An assortment of good desoldering tools helps when troubleshooting circuit boards.

Is the white material hard and brittle, or is it somewhat soft and flexible? You might try to touch near it with a hot soldering iron to see if the heat will cause it to discolor and breakdown its composition to allow easier removal. i use a bamboo stick with a pointed end and a flat end to remove conformal coatings.


----------



## Josefmifsud1974 (Sep 29, 2017)

Thankyou again for your support and feed back.
Yes i have the workahop manual but it too large to post on here.I am willing if you would be interested to send you this board and the atmega chip board for you to examine and maybe reverse engineer.
This for to help all the MP3 s owners all over the world which as today if the battery or inverter goes wrong due to cost they scrap the units even at 6000km like mine.


----------



## WolfTronix (Feb 8, 2016)

My guess:

When a single cell over/under volts the BMS disables the battery pack permanently (writes a bit to Flash).

This is what a lot of laptop manufacturers are doing now.
When a single cell goes bad, they don't want the user to replace the bad cell and be back up an running. Most likely for liability reasons, but it gives them added benefit that they can sell you another battery pack.

And since they locked down the microcontroller, you can't read a good micro and flash it over a disabled micro. Which would make replacing cells easy.

To bypass this, you will need to get a good battery module.
Sniff and record the signals from the BMS to the motor controller.

It will probably not be as simple as just sending over the "OK" signal from the BMS...

The BMS probably does not report any cell voltage, temperature, state of charge, sate of health, etc... when it has detected a bad cell.

It probably just sends out the error code "Replace battery".

So I think it would take a bit of reverse engineering to get this back up and running.

I would definitely start with a known working battery.
Then start probing and looking for differences in the signals between the good and repaired battery.


----------



## Josefmifsud1974 (Sep 29, 2017)

Thankyou for your feedback and support very appreciated


----------



## Josefmifsud1974 (Sep 29, 2017)

WolfTronix said:


> My guess:
> 
> When a single cell over/under volts the BMS disables the battery pack permanently (writes a bit to Flash).
> 
> ...


http://www.datasheetspdf.com/PDF/ATmega48PV/1071037/9


----------



## Josefmifsud1974 (Sep 29, 2017)

So what i would need to recover the data from a working powerpack , since im new to this i dont realy know how to do it and what its needed.
All advise and hardare info will be appreciated. 
Thanks for support


----------



## Solarsail (Jul 22, 2017)

@Wolftronix -- that is a good recommendation. 

Once the CAN bus signalling is sniffed, then I think it would be best to spoof it, and just install a regular prismatic or 18650 pack, and do away with this broken battery.

Would you recommend this, or would you think it is best to repair the battery?

If the battery pack is replaced with a non-proprietary pack, then how does one spoof the CAN bus signal to the ECU?


----------



## Josefmifsud1974 (Sep 29, 2017)

This is the BMS after cleaned from compound


----------



## Solarsail (Jul 22, 2017)

Lol - these pictures are useless. Nobody is going to repair this board if there is something wrong with it. Don't waste your time hacking the broken battery pack.  Take your cells and put it together with a 10s balancer $8 and charger $15, and make a new battery pack. Since they are pouch cells, most likely they have to be compressed. So I hope you can adapt the old cell compression to the new cells.

As Wolf says, find a working scooter. Put its battery on this scooter. Get it started. Look at the signalling between the good battery and the ECU. It is sending some packets of information there. Your friend in Croatia should be able to do this.

Then get an Arduino and CAN bus interface, and have the Arduino spoof the packets to the ECU, pretending that it is the original battery and BMS. Do this part of the project first. If you succeed, then building a pack with BMS is very easy, and we can guide you through. Better yet, build a 10s15p 18650 pack, which will probably have 4x the range of the pouch pack, and be no larger.


----------



## Josefmifsud1974 (Sep 29, 2017)

I will get all the setup needed and with your guidiance and help hope to solve this issue,thamks for the support


----------



## Josefmifsud1974 (Sep 29, 2017)

Motor assembly


----------



## Josefmifsud1974 (Sep 29, 2017)

Can Line layout


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> Lol - these pictures are useless. Nobody is going to repair this board if there is something wrong with it. Don't waste your time hacking the broken battery pack.  Take your cells and put it together with a 10s balancer $8 and charger $15, and make a new battery pack. Since they are pouch cells, most likely they have to be compressed. So I hope you can adapt the old cell compression to the new cells.
> 
> As Wolf says, find a working scooter. Put its battery on this scooter. Get it started. Look at the signalling between the good battery and the ECU. It is sending some packets of information there. Your friend in Croatia should be able to do this.
> 
> Then get an Arduino and CAN bus interface, and have the Arduino spoof the packets to the ECU, pretending that it is the original battery and BMS. Do this part of the project first. If you succeed, then building a pack with BMS is very easy, and we can guide you through. Better yet, build a 10s15p 18650 pack, which will probably have 4x the range of the pouch pack, and be no larger.


The photos are from another battery pack for view and information on what it is composed off under the green compound which was in the bms enclosure.


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> Lol - these pictures are useless. Nobody is going to repair this board if there is something wrong with it. Don't waste your time hacking the broken battery pack.  Take your cells and put it together with a 10s balancer $8 and charger $15, and make a new battery pack. Since they are pouch cells, most likely they have to be compressed. So I hope you can adapt the old cell compression to the new cells.
> 
> As Wolf says, find a working scooter. Put its battery on this scooter. Get it started. Look at the signalling between the good battery and the ECU. It is sending some packets of information there. Your friend in Croatia should be able to do this.
> 
> Then get an Arduino and CAN bus interface, and have the Arduino spoof the packets to the ECU, pretending that it is the original battery and BMS. Do this part of the project first. If you succeed, then building a pack with BMS is very easy, and we can guide you through. Better yet, build a 10s15p 18650 pack, which will probably have 4x the range of the pouch pack, and be no larger.


I ordered the Arduino Mega 2560 r3, an intelegent BMS 10s 60A with bluettoth capabilities.


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> Lol - these pictures are useless. Nobody is going to repair this board if there is something wrong with it. Don't waste your time hacking the broken battery pack.  Take your cells and put it together with a 10s balancer $8 and charger $15, and make a new battery pack. Since they are pouch cells, most likely they have to be compressed. So I hope you can adapt the old cell compression to the new cells.
> 
> As Wolf says, find a working scooter. Put its battery on this scooter. Get it started. Look at the signalling between the good battery and the ECU. It is sending some packets of information there. Your friend in Croatia should be able to do this.
> 
> Then get an Arduino and CAN bus interface, and have the Arduino spoof the packets to the ECU, pretending that it is the original battery and BMS. Do this part of the project first. If you succeed, then building a pack with BMS is very easy, and we can guide you through. Better yet, build a 10s15p 18650 pack, which will probably have 4x the range of the pouch pack, and be no larger.


I informed my friend in croatia and he said he is not familiar with can bus sniffing and spoof so i will try myself with your help as i dont have an idea of the process but i will follow the instruction and advise


----------



## Solarsail (Jul 22, 2017)

Josefmifsud1974 said:


> I ordered the Arduino Mega 2560 r3, an intelegent BMS 10s 60A with bluettoth capabilities.


I think this would be an overkill for the small pack and may become confusing. All you need is 

http://www.ebay.com/itm/10S-40A-36V...169897?hash=item41af3217a9:g:R~IAAOSwXeJXc3KJ

edit: In either case, you need a 10s CCCV 36V 15A charger. Which you can find on eBay. Unless the Arduino BMS also includes a charger?

Neither do I have any idea about canbus sniffing and spoofing. But there are others here who do that. Wolf is one of them.


----------



## Josefmifsud1974 (Sep 29, 2017)

New tech drawing


----------



## kennybobby (Aug 10, 2012)

That's a much better diagram, thank you. As you can see there are many components involved in the control system.

Did you happen to check all the fuses on the 12V battery-powered circuits, as shown in the diagram? What about the voltage--did you get readings of the open-circuit voltage and the loaded (key switched to ON, key to START) of the 12V battery? Please post those voltages.

This shows how the BMS is powered from the bottom two cells of the pack, so if for some reason the pack was not maintained and kept charged, then it is very likely that the BMS drained those cells to the point of disabling the pack. i've seen this happen in numerous packs that power up the BMS in such a manner.

Is there any information about the diagnostic connector and how it is used?

What is the Eldor Kubo box?

What is the condition of the HY Tech Button and the Recharge Socket Consent buttons?


----------



## Josefmifsud1974 (Sep 29, 2017)

The Kubo is the throttle body ecu.
Yes infact the last cell of the pack was drained.
There is voltage at ign on on the bms terminals.
positive of the bms terminal 10v
enabling of the bms terminal 8v
The 12 v battery i will replace with new and retest.


----------



## Josefmifsud1974 (Sep 29, 2017)

More detailed info


----------



## Josefmifsud1974 (Sep 29, 2017)

https://www.dropbox.com/s/kf970wfjua3wbjo/Hybrid Overview.pdf?dl=0

Here is an information overview with specs and diagrams of the hybrid system.


----------



## Josefmifsud1974 (Sep 29, 2017)

WolfTronix said:


> My guess:
> 
> When a single cell over/under volts the BMS disables the battery pack permanently (writes a bit to Flash).
> 
> ...


I ordered the arduino mega and a can bus shield.
Can you explain me how to hook up all to the system and what i will be looking for once viewing data.Thanks


----------



## Solarsail (Jul 22, 2017)

Josefmifsud1974 said:


> I ordered the arduino mega and a can bus shield.


Is this the same arduino BMS 10s x 60A that you ordered? Can you please give me a link to the arduino BMS 10s x 60A? Thanks.


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> Is this the same arduino BMS 10s x 60A that you ordered? Can you please give me a link to the arduino BMS 10s x 60A? Thanks.


https://www.aliexpress.com/item/10S...32827750823.html?spm=a2g0s.9042311.0.0.UM48Qe


----------



## kennybobby (Aug 10, 2012)

Josefmifsud1974 said:


> ...
> There is voltage at ign on on the bms terminals.
> positive of the bms terminal 10v
> enabling of the bms terminal 8v


A strong or new 12V battery may solve your problem--it would probably not initialize if the voltage supplied was too low.


----------



## Josefmifsud1974 (Sep 29, 2017)

kennybobby said:


> A strong or new 12V battery may solve your problem--it would probably not initialize if the voltage supplied was too low.


i have good 12v battery 45Ah can i jump to bike battery,or directly?
or i need a small battery?


----------



## kennybobby (Aug 10, 2012)

Just for testing to get the lithium pack initialized it should be okay to just connect a good battery to the terminals (take out the old one as it will just pull voltage down). 

It's not the size but the voltage that matters--a good 12V battery voltage will be 12.8 or higher, and will hold up the voltage even while under load. The 8 volts you were measuring indicates the old battery is weak or worn out.


----------



## Josefmifsud1974 (Sep 29, 2017)

With good battery still no success.
Tommorrow i go puaggio for scan and see what will be


----------



## Josefmifsud1974 (Sep 29, 2017)

After diagnostic at dealer looks like there is an issue with the main ECU not communicating.

So this is a good challenge for who is expert in this .

Have a look at my attachments at the beginning of this thread and look the photos of the main ECU.

Anyone who thinks is capable of looking into this complex unit let me know.

Hope we have many contenders for this project.

BR


----------



## Solarsail (Jul 22, 2017)

What is the power of the electric motor? Let's say at least 1 kW. Then do a revolutionary overhaul. Get rid of the ECU but if possible keep the motor controller. Get rid of the transmission. Instead find an efficient 500W to 1kW generator and connect it to the engine. If there is an existing generator, then it may meet the rating. Get the engine to run the generator, charging the battery pack (you would need a 10s 1.2kW charger). Put in at least 2.5 kWh of power storage. If you use Leaf used modules, that would be just 5 modules which will give you 36V and 2.5 kWh that you need.

In other words, make yourself a serial plugin scooter like the BMW i3. You will probably get about 75 km range on batteries alone, and then if you run out, turn on the engine. (To be very very creative, because you have a lot of sun in Malta, just carry 2 sq. meters of flexible solar panels, and you may even not need the engine and generator.)

IMO, this is easier than trying to figure out that ECU and bringing an outmoded architecture back to life, and because none of the parts are proprietary (except for the engine), you can apply the same technique to other similar scooters.


----------



## Josefmifsud1974 (Sep 29, 2017)

Solarsail said:


> What is the power of the electric motor? Let's say at least 1 kW. Then do a revolutionary overhaul. Get rid of the ECU but if possible keep the motor controller. Get rid of the transmission. Instead find an efficient 500W to 1kW generator and connect it to the engine. If there is an existing generator, then it may meet the rating. Get the engine to run the generator, charging the battery pack (you would need a 10s 1.2kW charger). Put in at least 2.5 kWh of power storage. If you use Leaf used modules, that would be just 5 modules which will give you 36V and 2.5 kWh that you need.
> 
> In other words, make yourself a serial plugin scooter like the BMW i3. You will probably get about 75 km range on batteries alone, and then if you run out, turn on the engine. (To be very very creative, because you have a lot of sun in Malta, just carry 2 sq. meters of flexible solar panels, and you may even not need the engine and generator.)
> 
> IMO, this is easier than trying to figure out that ECU and bringing an outmoded architecture back to life, and because none of the parts are proprietary (except for the engine), you can apply the same technique to other similar scooters.


Engine , transmission and electric motor are all incorporated in one unit.
Its kind of or together or nothing.
I agree for the solar panels hehehhe


----------



## Solarsail (Jul 22, 2017)

What is the power of the electric motor?

Is there a generator, or is the motor used as the generator and starter?

I assume there is no generator, and it is possible to drive the thing purely in electric mode with the engine off. I also assume it is easy to run the engine without the ECU.

Then -
1) put the transmission in electric motor propulsion mode - permanently.
2) get a 500W generator and mechanically connect to engine out, install voltmeter so it generates about 45 to 55V x 10A
3) get rid of ECU, but keep controller, and connect user controls to controller directly, get rid of CANbus
4) install user controls to turn on engine, and run it at constant speed in neutral, to start engine allow for momentary transmission engagement to engine
5) install 5 Leaf used modules 36V x 2.5kWh with cheap (non-ASIC) BMS and charger, connect charger to generator

Creative solution -
1) get rid of engine, ECU, CANbus, keep controller
2) build 18650 3.4Ah pack: 10s32p = 36V x 110Ah = 4 kWh with cheap BMS and charger. this will be smaller than 5 used Leaf modules
3) get 7 quality lightweight flexible solar panels, each made of 3x4 6" solar cells, for a total of 1.9 square meters = 7x3x4 = 84 cells = 42V x 4.8A = 400W peak. Each panel is 45 x 60 cm and weighs 0.8 kg.

At peak solar irradiance and incidence, you are charging at the rate of 15 km/hour.   Carry camping gear in case you run out of juice with no access to power on a cloudy day.


----------



## Josefmifsud1974 (Sep 29, 2017)

Disassembled the main ECU which is made by ELDOR, anyone now this brand and if parts are available. Looks there was some heat issue on the bottom mother board. Attaching photos for your view and feedback.


----------



## Josefmifsud1974 (Sep 29, 2017)

More Photos of the ELDOR KUADRO ECU of the hybrid scooter


----------



## kennybobby (Aug 10, 2012)

Well i found one reason why it's not working--the cell monitoring boards are missing some of the connections to the cell tabs. There are 4 solder bridges that complete an exposed trace, two on front and two on back, that connect the + and - pad to the rest of the circuitry. On two of the boards i looked at the (-) or ground bridge was blown off or missing (maybe these function as fuses?). Need to inspect all the boards to verify that these joints and traces are intact, or make repairs. Let us know what you find from the inspection.


----------



## Josefmifsud1974 (Sep 29, 2017)

Will be cheking all boards for these failures and verify integrity of units.
thanks for your support its good to have your feedback , very well appreciated


----------



## Josefmifsud1974 (Sep 29, 2017)

Hi here is a sketch outlined from our friend Kenny .
A big thankyou for this job well appreciated and hope we will move on with this project.


----------



## Josefmifsud1974 (Sep 29, 2017)

Josefmifsud1974 said:


> Hi here is a sketch outlined from our friend Kenny .
> A big thankyou for this job well appreciated and hope we will move on with this project.


This is a pcb/bms which is found on every cell in the battery pack, which communicates with the main bms and sends data on each cell.


----------



## Josefmifsud1974 (Sep 29, 2017)

Hi we managed to pin out the pcb boards which are on each cell
and the terminal pins are serial bus communication lines tx,rx
Is there a way to get the data what is being transmitted from the chip with arduino???


----------



## Solarsail (Jul 22, 2017)

Josefmifsud1974 said:


> Hi we managed to pin out the pcb boards which are on each cell
> and the terminal pins are serial bus communication lines tx,rx
> Is there a way to get the data what is being transmitted from the chip with arduino???


The schematic is very useful. Thanks. I wonder if D1 is a zener diode?

I don't have the experience - but I am sure you could use a digital analyzer or arduino probe to sniff the packets. Then start from the top (or bottom) balancer board and go down one by one, and see which one is negatively altering the packet, or transmitting an error condition. But then what? If the problem is the MC on the balance board, how are you going to fix that? Hard to believe that bridge solder was missing - then why did it use to work?

If you are going to sniff and spoof, might as well sniff the main battery terminal controller to the ECU, so you can replace the battery pack altogether.

Does the bike normally work in pure electric mode? If so, then get rid of everything except the motor, and put in a 5 kWh pack, and you are flying.


----------



## Drrossio (Mar 29, 2019)

Hi guys is this thread still active ?
Did someone found a solution ?

Cheers Alain


----------



## kennybobby (Aug 10, 2012)

i think Q5 is used for cell balancing thru the 33R resistor.

Is it possible to download or read the firmware for an ATMEGA48PV?


----------



## Max71 (Mar 30, 2020)

Hello, i recently got some Piaggio Liberty Email and it seems the system is similar if not the same with just different software. I did also not sniff the can bus yet but i hope to do that in some days, as a special cable is needed and my can analyser is not here yet. I have a Piaggio Navigator and i have a software button to reprogramm the BMS, i am almost sure it will not work but first i need the cable 020878Y and can sniffer tools.

Is there some process? i am really fascinated about "old" Piaggio Electric/Hybrid tech, it had a ton of problems but i hope to fix this, in the email there are 2 batteries with 40Ah Kokam cells, so 3kWh in total which should be good for 60 km at 45km/h. I have alot of disarmed batteries with only 24-27V, guess they are dead but i need to find it out, of all cells would have equal voltage( which for sure is not the case) they could survive, but main problem will be software...

Also, if batteries cannot be activated or used, it would be cool to make a new battery with suitable can signals to use the original Eldor Kuadro unit.

Somehow i cannot attach pics but small board says 05PGN03BBA000 and the big main PCB is 05PGN03BAB000


----------



## kujtim (Dec 6, 2020)

Hello friends, I wanted to ask a question about the Piaggio MP3 125cc Hybrid Engine.
I faulty the Hybrid Battery and removed it from the engine,
the engine starts to work with gasoline but does not react throtlet whether there is a possibility of battery connection

please help me if you have had the same problem
Thank you very much


----------



## Peter Hem (3 mo ago)

kujtim said:


> Hello friends, I wanted to ask a question about the Piaggio MP3 125cc Hybrid Engine.
> I faulty the Hybrid Battery and removed it from the engine,
> the engine starts to work with gasoline but does not react throtlet whether there is a possibility of battery connection
> 
> ...


Ok I have the same problem:. dead hybrid battery .
Without the 37v battery canbus signal it won't drive. ( immobilized throttle )
So does anybody have the canbus files of this battery ? With a canbus emulator that 
emulate the battery as ok and 30Vcharge it will run as a normal gasoline scooter .
The charging during driving will be blocked because the voltage is lower than 32V .
normal driving is still possible.

A lot of mp3 scooters are standing still because of this problem . ......
Help us all


----------

