Error Codes:
error_1 Sensor of motor or driver error
error_13 Other malfunctions of the motor driver
error_20 Posture sensor of vehicle error
error_30 Internal communication of vehicle error
error_35 Switch battery circuit error
error_36 @string/error_battery1_output
error_37 @string/error_battery2_output
error_38 @string/error_battery1_temperature
error_39 @string/error_battery2_temperature
error_40 Human foot sensor error
error_41 12VDC or 6VDC low voltage power output inside the vehicle body error
error_43 Charger error
error_44 Reserved for delivery test
error_45 Dip angle of the vehicle is too large during your driving
error_9 Driver's high power output switch is damaged
error_battery1_output Output of battery 1 error
error_battery1_temperature Temperature of battery 1 error
error_battery2_output Output of battery 2 error
error_battery2_temperature Temperature of battery 2 error
error_escooter_10 Dashboard communication error. Please check the dashboard or related cables.
error_escooter_11 Motor A phase current error. Please check the controller.
error_escooter_12 Motor B phase current error. Please check the controller.
error_escooter_13 Motor C phase current error. Please check the controller.
error_escooter_14 Throttle hall sensor error. Please check the sensor and its cables.
error_escooter_15 Brake hall sensor error. Please check the brake lever and its cables.
error_escooter_18 Motor hall sensor error. Please check the throttle and its cables.
error_escooter_21 BMS communication error. Please check the battery or its wiring.
error_escooter_22 BMS password is wrong. Please contact after-sales service.
error_escooter_23 BMS serial is abnormal. Please contact after-sales service.
error_escooter_24 System voltage error. Please check the controller.
error_escooter_26 Flash save error. Please check the controller.
error_escooter_27 Master control password is incorrect. Please contact after-sales service.
error_escooter_28 MOS lower bridge error. Please check the controller.
error_escooter_29 MOS higher bridge error. Please check the controller.
error_escooter_31 Program jumping error. Please check the controller.
error_escooter_35 The serial No. of the scooter is incorrect Please contact after-sales service.
error_escooter_39 Battery temperature sensor abnormality. Please make sure the temperature is between-10℃-50℃, or contact after-sales service.
error_escooter_40 Master control temperature sensor error. Please check the controller.
error_mini_11 Left motor current sensor error. Please check master control.
error_mini_14 Right motor current sensor error. Please check master control.
error_mini_17 Battery firmware is outdated. Please update battery firmware.
error_mini_18 The left foot switch shows an abnormality and it's necessary to check whether the foot switch, plastic fender and the foot pedal wiring are normal.
error_mini_19 The right foot switch shows an abnormality and it's necessary to check whether the foot switch, plastic fender and the foot pedal wiring are normal.
error_mini_21 The foot-controlled steering sensor has detected an abnormality. It is necessary to check if the foot control sensor is loose and the wiring is normal.
error_mini_22 Gravity sensor error.
error_mini_23 Battery connection error. Please check the battery connection.
error_mini_24 Battery password is incorrect. Please replace with ordinary battery.
error_mini_26 Driver voltage error. Please check control board and battery voltage.
error_mini_27 Cannot power off.
error_mini_31 Left motor drive error. Please check master control.
error_mini_32 Right motor drive error. Please check master control.
error_mini_33 Over lean protection.
error_mini_34 Firmware download error. Please update firmware.
error_mini_35 Gyroscope error. Please check master control.
error_mini_36 Left motor hall sensor error. Please check motor wiring or replace motor.
error_mini_39 Right motor hall sensor error. Please check motor wiring or replace motor.
error_mini_5 12V voltage error. Please check master control.
error_mini_51 Battery temperature error. Please make sure the temperature is between -10℃~50℃.
error_mini_52 Battery cell's voltage error. Please contact after-sales service.
error_mini_53 The battery's Serial No. is invalid.
error_mini_6 5V voltage error. Please check master control.
error_mini_7 3.3V voltage error. Please check master control.
error_mini_9 CPU initialization error. Please check master control.
error_mk2_1 Motor hall sensor abnormal or motor is not connected.
error_mk2_10 Battery 1: communication error.
error_mk2_11 Battery 2: communication error.
error_mk2_12 Gyroscope initialization error
error_mk2_13 Gyroscope calibration failed
error_mk2_14 @string/error_battery1_output
error_mk2_15 @string/error_battery2_output
error_mk2_16 @string/error_battery1_temperature
error_mk2_17 @string/error_battery2_temperature
error_mk2_2 motor A current error.
error_mk2_24 General voltage error
error_mk2_25 Voltage update error
error_mk2_26 System clock error
error_mk2_27 Current calibration error
error_mk2_28 Power supply of battery 1 error
error_mk2_29 Power supply of battery 2 error
error_mk2_3 motor B current error
error_mk2_30 Temperature sensor open circuit
error_mk2_31 Temperature sensor short circuit.
error_mk2_32 Battery 1 password incorrect
error_mk2_33 Battery 2 password incorrect
error_mk2_34 Voltage difference is too big in battery cells of battery 1
error_mk2_35 Voltage difference is too big in battery cells of battery 2
error_mk2_36 Battery 1 comes into testing mode
error_mk2_37 Battery 2 comes into testing mode
error_mk2_4 motor C current error.
error_mk2_6 Vehicle S/N is the initial S/N

Probably you already have this, if not by any chance, here it is. Extracted from the android app. Hope it could be useful.

I did a btsnoop on the android app and seems the messages start with 5aa5,
e.g.
5a:a5:80:3e:20:08:00 + new firmware (firmware update)
5a:a5:01:3e:20:01:23 :06:76:ff (not yet sure what dose this do)

I read your code and seems the message starts with "\x55\xAA". Mine is ninebot es1. Is yours xiaomi m365?

Trying to read registers on a Ninebot G30:

python2 readregs.py -i ble -p ninebot -a D8:48:9C:4E:01:86 esc esc.bin

I can hear the beep as it connects, then about 5 seconds later, it errors out with this:

Connected 
0% 
Traceback (most recent call last):                                                                                                                                                                                                             |
  File "readregs.py", line 111, in <module>
    raise
  File "/tmp/py9b/py9b/link/ble.py", line 50, in __exit__
    self.close()
  File "/tmp/py9b/py9b/link/ble.py", line 79, in close
    self._dev.disconnect()
  File "/home/pi/.local/lib/python2.7/site-packages/pygatt/backends/gatttool/device.py", line 17, in wrapper
    return func(self, *args, **kwargs)
  File "/home/pi/.local/lib/python2.7/site-packages/pygatt/backends/gatttool/device.py", line 52, in disconnect
    self._backend.disconnect(self)
  File "/home/pi/.local/lib/python2.7/site-packages/pygatt/backends/gatttool/gatttool.py", line 49, in wrapper
    raise NotConnectedError()
pygatt.exceptions.NotConnectedError

Any chance you could locate/obtain tools for the SJ35?

Hey guys,

first of all thanks for the great work!

I got myself a external Ninebot (ES2) battery for my own DIY scooter.
So far this works kind off, but with some drawbacks.

My problem is, that I can't charge it through the charging port. When I apply the charging voltage to the battery, the blue flashing (heartbeat) LED flashes red and current only flows in short pulses (so no charging).
As you are quite experienced with this hardware, do you know what is required to make it charge with the charging port? Does it need the rest of the scooter and how does it sense its presence?

Nevertheless, I can charge the battery trough the P+/- connection (normally going to the scooter). But this might not be the intended way, so I'd be glad to get the other port working.

Then I also tried to communicate with the BMS using a FDTI breakout (I checked everything with the scope, so I'm very sure the electrical side is fine).

But this also doesn't work...
I tried several of your "readbms"-scrips but they get no response.

Scanning...
[(u'COM4 0403:6001', u'COM4')]
Connected
> 5AA5013E230100108CFF
< 00
> 5AA5013E230100108CFF
> 5AA5013E230100108CFF
> 5AA5013E230100108CFF
> 5AA5013E230100108CFF
No response !

When I send commands to the BMS the blue LED starts flashing very fast but nothing else happens.
The only response I always get is a 0x00 in sync with the heartbeat (this stops when the LED flashes fast).

I would be very thankful for any advice!

Andreas