Bird Scooter battery communication

[stancecoke]

Bird scooters are using Lishui controllers, so it should be quite easy to make them run with the EBiCS firmware.
Is there any information about the communication protocol between the battery and the controller? I've listened to the datastream, it uses a KM5S-like protocol @9600BAUD.
The controller sends a startup sequence and afterwards always the same query. The battery answers with quite long messages, I guess there will be the temperature and the SOC of each cell bank in there, but I was not able to decode the messages yet.

UART communication @ 9600 BAUD, same scheme as KM5S protocol.

Controller to battery:

3A 16 04 00 1A 00 0D 0A
3A 16 05 00 1B 00 0D 0A
3A 16 02 00 18 00 0D 0A
3A 16 02 00 18 00 0D 0A
3A 16 02 00 18 00 0D 0A
3A 16 02 00 18 00 0D 0A
3A 16 02 00 18 00 0D 0A

Battery to controller:

3A 16 04 0E 52 46 30 31 4C 31 39 32 33 33 31 30 31 33 34 03 0D 0A
3A 16 05 02 20 22 5F 00 0D 0A
3A 16 02 10 03 00 00 11 12 1B 9E D7 FF D8 1C CE 28 46 A0 00 AD 05 0D 0A
3A 16 02 10 03 00 00 11 12 1B 9E C8 FF D8 1C CE 28 46 A0 00 9E 05 0D 0A
3A 16 02 10 03 00 00 11 12 1A 9E C8 FF D8 1C CE 28 46 A0 00 9D 05 0D 0A
3A 16 02 10 03 00 00 11 12 18 9E BE FF D8 1C CE 28 46 A0 00 91 05 0D 0A
3A 16 02 10 03 00 00 11 12 1A 9E BE FF D8 1C CE 28 46 A0 00 93 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E BE FF D8 1C CE 28 46 A0 00 90 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E BE FF D8 1C CE 28 46 A0 00 90 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 15 9E B9 FF D8 1C CE 28 46 A0 00 89 05 0D 0A
3A 16 02 10 03 00 00 11 12 17 9E B9 FF D8 1C CE 28 46 A0 00 8B 05 0D 0A
3A 16 02 10 03 00 00 11 12 15 9E B9 FF D8 1C CE 28 46 A0 00 89 05 0D 0A
3A 16 02 10 03 00 00 11 12 15 9E B9 FF D8 1C CE 28 46 A0 00 89 05 0D 0A

Any idea, what can be the meaning of each byte?
The meaning of first four and the last four bytes are well known from the KM5S protocol.

regards
stancecoke

 

[amberwolf]

Well, a hex to decimal converter
https://www.atatus.com/tools/hex-to-decimal
gives these results for the segments between the four end bytes, to make it more "human readable". Does anything pop out?

I added line breaks between "similar" sections; looks like the last 13 are identical. Are they 48v 13s packs? (information on them varies from site to site, so not having one I can't tell for sure)

82 70 48 49 76 49 57 50 51 51 49 48 49 51

58 22 5 2 32 34

3 0 0 17 18 27 158 215 255 216 28 206 40 70 160 0

3 0 0 17 18 27 158 200 255 216 28 206 40 70 160 0
3 0 0 17 18 26 158 200 255 216 28 206 40 70 160 0

3 0 0 17 18 24 158 190 255 216 28 206 40 70 160 0
3 0 0 17 18 26 158 190 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 190 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 190 255 216 28 206 40 70 160 0

3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 21 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 23 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 21 158 185 255 216 28 206 40 70 160 0
3 0 0 17 18 21 158 185 255 216 28 206 40 70 160 0