[WIP] StreetScooter Repair and Reverse Engineering

[Heye]

Hey folks,

my name is Heye and this is my current (and also first) EV project. It's not a conversion, but I think it fit's the OpenInverter spirit best since there doesn't seem to be a StreetScooter specific community and I want to learn automotive reverse engineering with this project. In this thread, I want to document my efforts and maybe even enable other people to repair their own absolutely underdocumented StreetScooter.

About me: I'm a German computer science student with a long-time interest in electronics and have been participating in the climate movement for some years. But I also like cars/trucks (and fixing them myself), so buying a broken EV and trying to fix it is basically the perfect project for me.

So what even is a StreetScooter and why did I want one? Briefly summarized: The German postal service wanted a new fleet of EVs at a time where there weren't many utility EVs around. So they bought a startup from a professor at a prestigious German technical university (not mine, sadly), trying to develop just that. The company had its ups and downs (mostly downs) and recently the postal service sold the company (tough it keeps a fleet of a few tens of thousands of their vehicles) again, after which it soon had to declare bankruptcy (StreetScooter, not the Germany postal service). Somewhat recent news said that StreetScooter are trying to move production to Thailand, but it is unclear whether that is actually happening. StreetScooters never sold well outside of the Postal service due to their high sticker price of 40.000€.
Since the StreetScooter became publicly known, I always wanted one. I like utilitarian vehicles, the StreetScooter is made for cities (and I live in a pretty cramped one) and they can be had pretty cheaply (because they don't have all that much in common with modern "nice" EVs). In short, the StreetScooter is the "Slate truck we have at home", which is funny because the Slate truck, which I also like, probably won't be sold in Germany if it even makes it to market.

After scouring the online platforms for some time, I found a StreetScooter in the Netherlands that I absolutely fell in love with on first sight. It had a truck bed (those are around 500€ separately), the largest available battery (40kWh, which is frankly barely adequate) and, best of all, it was listed for 3500€, which I managed to barter down to 2000€. It is one of the few trucks that wasn't used at the postal service and instead was sold to a third party, probably some Dutch municipality It even has nice orange lights on the roof. On the negative side, it was listed as "not charging anymore, drove until the battery was empty". But no risk, no fun, right?

So I lent my fathers bus, rented a trailed and took my brother and my best friend on a Roadtrippy car-buying adventure to the Netherlands.



After getting the car home, I firstly had to charge the 12V battery, which was completely dead. Luckily, after a few days at 14.3V it was mostly fine again. So I tried starting it, only to see it shutting off again. It looked like it was tripping an electronic breaker or something like it. Later, I learned a bit of Dutch: "Sleutel niet gevonden" means "Key not found". The car has a keyless go system, which I wasn't used to. The other key had a working battery, so I was able to activate the 12V system properly. Starting the car wouldn't work, with it just saying "Garage" (meaning "Workshop"). Charging it wouldn't work either, as I was promised, but I got two different errors! The first one was the fault light at the EVSE. I learned that you can't just use a Generator to charge your EV, you actually have to ground it! But the second one was more insidious: The EVSE was showing that it was charging and the light at the charge port was blinking green - but at the wrong frequency! If it's blinking fast, there's an error, if it was blinking slowly, it would be charging fine. 12V charging was working though - you can see the LEDs at the 12V charger through the grill.

It was CAN Bus time! But first, since there was no OBD-II port (at least I didn't find it and I assume there doesn't have to be one, since there are no emissions to be monitored), I had to figure out how to open the hood, since there's no latch and I don't have a service manual. But it's easy! You open the doors and you remove the highest screws you can see. Then you can pull the hood in the direction of travel and then take it off. I didn't find any documentation on any component inside the vehicle or even any connector. But finding the CAN-Buses was easy. I took the connectors off at the inverter, the OBC and the VCU (that one is over the passenger footwell inside the passenger compartment) and looked for twisted pair connections. Measuring them with my multimeter, I wrote down those that had a resistance of either 60 or 120 Ohm between them (depending on whether the connected device terminates the bus) and choose the bus connecting the VCU and the charger for my first experiments. Not knowing the baud rate and other parameters, I guessed at 500.000 baud and 11 bit addresses. And Bingo! I now had so much data to work with in SavvyCAN! This was the point where my great saviours from this board came in. Thanks to a post from LRBen, and Jacobsmess who found it, I had a DBC file that fit my car almost perfectly! I don't think I could have done all the CAN reverse engineering myself at this point. Who knows, I might even have given up the project in frustration! Sadly, I can't contribute much back for now because I actually have a different (probably worse) charger.

After getting the car incredibly cheaply, this was my second incredible stroke of luck, since there is otherwise almost zero technical documentation on the vehicle. I am so very thankful!

Perusing the dumped data, it didn't take long for the problem to present itself to me: The BMS reports an undervoltage error! And yes, the voltages it shows are varying wildly - between 2.35 and 4.1 volts per cell. (Side note: Either the DBC file doesn't quite fit or something else is wrong, but I can only see voltages for 9 from 16 modules. All eight from the first string and only one from the other one).

I also learned that there are many different batteries for the StreetScooter. The one I have is "V6-16M". They are probably (I haven't opened it yet) organized in two strings of 8 modules of 13 prismatic Samsung cells each. So it's a 104S configuration. It is supposed to have battery modules from the BMW i3 inside, but that doesn't work out! All info I found online says that the i3 has 12S modules!

But I will be able to satisfy my (and maybe your) curiosity soon, because I will have to open the battery. I will charge the heavily discharged cells and try to find out what the secret CAN handshake between the battery and the car is, so I can work on both parts separately. I am a little worried about dendrites, but not too much, since I won't be driving the car at first. In the worst case, I will have to take one of the strings out, make the BMS accept it and live with the reduced capacity.

Opening the battery means dropping the battery first. That's easy enough with a lift, but I don't have one. And renting a trailer is expensive, so I had to make do with what I had - three shunting jacks, some wood and 6-Ton car stands. This was my procedure, which worked well:

• Jack up the car and put it on the stands (doesn't need to be too high)
• Remove the 12V battery and wait 10 minutes! The HV battery is not safe otherwise!
• Remove the 2 nuts and 3 screws (10mm spanner) holding the protective plate in the middle at the front of the battery (it has a high voltage sign on it), then remove the plate
• Disconnect the tool-less HV and auxiliary connectors, don't forget the grounding cable (10mm spanner). Especially don't forget it on reassembly!
• Put tape over the receptacles and the plugs to avoid dust entering them.
• Put two long wood bars under the battery as rails to drag it out sideways (you have the most clearance between the jacks there)
• Support the battery with one jack in the front and two in the back (one in each corner)
• Build three wooden cross stacks symmetrically to the points where the jacks are on the battery
• Ensure that the jacks are still solidly supporting the battery, then loosen the screws (13mm hex head) fixing the battery to the frame. Don't put your head beneath the battery!
• Slowly let the battery sink down using the jacks. Remove wood from the cross stacks as you do it.
• When you are almost done, put round wood bars (like broom sticks) beneath the battery so you can roll it like the Egyptians did (dragging it was way harder than anticipated)
• Roll it out and you are done!

How will I get it back in? No idea, that's a problem for future me.

Now closer-future me had a more immediate problem. Working on a battery is necessarily working on live voltage and you need protective equipment for that. To protect against electric shock and arc flash, should you stupidly drop and short something. Don't underestimate arc flash! I learned: That stuff is both heavy-duty and expensive.
And I'm a broke student. So what to do? I wasted a day asking local businesses for old equipment, which was a stupid idea. Broken protective equipments gets thrown away, not given away. You can't do it without thick 1000V rubber gloves, so I bought them from Amazon. Uvex brand, 50€. Too much for a one-time job, but oh well, it's my safety. I wouldn't trust anything worse. The face shield, which you also need, is stupidly expensive as well. My father has a different faceshield made from thicker polycarbonate, which I'm going to use. Alternatively, I would have used a motorcycle helmet, which should also provide at least some protection. Both solutions are not tested against arc flashes, but I'm quite confident here. For the rest of my body, I'm going to wear multiple layers of thick, pure cotton, work jackets and trousers, they are quite flame retardant and should also protect me well.

I will open the battery either tomorrow and the day after and post pictures then. Until then, isn't this just an amazing sight?

[Jacobsmess]

Glad the DBC files has helped. I have a contract with someone one who has a few working SS vehicles who provided the DBC so let me know and I can reach out to them if you need.

[Heye]

Thanks! I’ll definitely reach out if I get stuck.

[ianlighting]

Apparently we have some in the UK aswell used for milk deliveries. I only found this after googling streetscooter because I hadn’t heard of it before.

Good luck!

https://www.milkandmore.co.uk/news/electric-floats

[muehlpower]

I have dismantled an older one and used the technology for a show vehicle. Many of the CAN messages are the same. It no longer looks like a Street Scooter.

[Heye]

Here cometh the promised update!

I opened up the pack today with appropriate gear and was greeted by a few surprises. First of all, I was completely wrong in my assumption about what type of modules I would find inside. The type V6-16M does not contain prismatic cells, but 18650 cells! There doesn't seem to be any relation to BMW, but the actual manufacturer of the battery modules (maybe not of the BMS, more on that later) has a similar name: "BMZ". Searching the web, there are mentions that StreetScooter had batteries produced by BMZ, so that checks out.


The battery and its modules.

Working with these modules was not as easy as expected. They are nice and symmetrical, but stacked two layers high, which has some downsides. More on that later. Here is how I dismantled the battery, with some added optimizations (note that I did all of this with appropriate rubber gloves, thick protective clothing and an appropriate faceshield):

• Remove the bolts that hold down the plastic battery cover and remove the cover. A rattle gun is really nice for this.
• Label the modules on top and take a photograph so you can put them in the same order on reassembly. I don't know if the order actually matters, but I would assume so until proven otherwise.
• Remove all of the visible long metal bolts holding the modules down. There is a lot of them.
• From every balancing cable, remove one plug. I always removed the short side and left the long side in place. You need to push in the latch and don't yank on the cable!
• Now, to split the first string into two parts with 200V each, remove the bridge cover opposite of the HV plugs (don't remove the HV box cover until later!)
  You will notice that you can only do this for the upper string, the lower bridge cover is blocked by the upper modules. In my opinion, this is a stupid and service-unfriendly design. Removing the covers is needlessly difficult. You need a tool for this that is strong enough to bend the hook, but is either non-conductive or well insulated. I used a ground down glas fibre reinforced plastic rod. The hooks are really fragile, I broke a few while removing them. I will see whether I can 3D print replacements. Again, not very service-friendly.
• Remove the bolts holding the bridge down and then the bridge.
  
• With the added safety, now remove the bridges one step closer to the HV plugs.
  
• Now you can remove the first module (labeled 5 in the image above).
• You will see that you can't remove the other module (labeled 4), because it is held down by module 3. But you can lift it up a bit to remove the cover of the middle bridge of the lower string. Split that string now, for added safety.
• Remove all bridges from the top string
• Open the cover of the HV box containing the contactors and the BMS coordinator (I sadly don't have a great picture of this as my phone battery died before I could take one)
• Carefully remove the busbars connecting the upper string to the HV fuse and the ground contactor. You will see that you can't remove the lower busbars yet. Great design, striking again.
• Replace the HV box cover, but don't screw down the bolts
• Remove all modules from the top string
• Label the lower string and remove all bridges
• Remove the lower busbars, then you can also remove the modules of the lower string

With one of the modules at my workbench, I started dismantling it. I found out that you don't need to (and also shouldn't) remove the plastic bolts holding the top and bottom module covers. The threads strip extremely easily. Instead, you can access the BMS board by pressing in one of the plastic clips on the side:


The BMS "slave" board itself is quite an interesting (cost optimized?) design. There are no components on the bottom side and I can't see any transistors, which I would usually expect. But there are some big resistors, so maybe the single chip does all the balancing itself?



This is the text on the chip:

Code: Select all

AA1N14T2A
MC35771ATA1
CTAL1820D

I wasn't able to find a Datasheet for the chip. Volkswagen was mentioned in the search results, so that might be a clue.

That's it for now! At some point, I might post about the insides of the HV box, but for now I want to focus on charging and balancing the modules. Tomorrow, I will start designing a safe connector.

[muehlpower]

my googling has led me to this link.https://tr.aliexpress.com/item/1005008459058700.html. The MC33771ata is sold there, the photo shows a MC35771ata. Further googling shows that it is a BMS chip from NXP. The datasheet at mouser https://www.mouser.de/datasheet/2/302/M ... 517286.pdf. I think the two are at least very similar.

[Jacobsmess]

Dimensions and weights of the cells would be interesting for the wiki. Thanks

[muehlpower]

This description states that the “33” only describes the destination market. The entire type designation is also explained there.

[Heye]

That's great! Thanks for looking it up. Seems like I need to work on my Google-Fu. I have decided that I will not build electronics to interface with the BMS child modules, but I should still find out whether their ordering inside the pack matters. The datasheet says that connecting an external EEPROM is possible and there is an unmarked 5-pin chip on the board that might be an EEPROM. It also lists "Addressable on initialization" as a feature, so maybe the EEPROM does not store the position in the string and order really does not matter? That would be nice.

Jacobsmess, I took these measurements. Are they sufficient?

523mm (including the terminal protrusions) x 282mm (including the side
protrusions) x 76mm (excluding stacking protrusions).

The width between the case sides without the protrusions containing the bolt holes is 257mm.

On the bottom of the module, there are stacking protrusions that increase the
height by 6mm. The distance between the outside of the module case and the
center of the bolt holes is around 6.5mm on both sides.

I can't take very precise measurements right now, so all these numbers are +/-
1mm.

I don't have a scale with an appropriate rating, so I can't really measure the weight right now

[Heye]

Current progress: I made a plug that connects to the side of the battery so I don't have to get 14 connections right 16 times but only once.
You can find the CAD files on Thingiverse: https://www.thingiverse.com/thing:7060814

An active balancer and a BMS should arrive this week and with those I should be able to get these modules charged. My most capable power supply can go up to 50V, so with around 3.84V per cell it should be enough to charge and balance them for now, even if I can't charge them up completely and do a perfect top balance.

[Heye]

Time for another update (and the next one probably won't come earlier than in about a month).

I'm currently charging and balancing the modules one after another. This works fine, but takes lots and lots of time (at least I don't have to actively do anything). I am using these components:

• Two 140W Lenovo laptop PSUs in series. This works fine if you use a plugs without an earth connector (IEC 60320-1 C8) and modify the receptacle (IEC 60320-1 C5) inside the PSUs to accept them
• Ruideng DPH5005 Buck-/Boost module. Usually, this is my lab bench power supply. Now it's being used as a charger at its maximum settings. It's limited to 5.1A, but that's fine. If the whole pack were to be charged with a current of 5.1A, it would consume around 3.8kW, which is the power a normal European circuit can provide. 50V is slightly below the theoretical module voltage of 54.6V, so I can only charge each cell to 3.85V.
• No-name Amazon BMS. I rely on this to stop the charge if any cell reaches 4.2V so the balancer has time to pull it down again. I don't expect that to ever be the case though because I only charge each cell to 3.8V so there is a lot of wiggle room. I'm also monitoring the voltages myself.
• Daly Smart Active Balancer. (1A, the one with the two UART ports. Daly doesn't seem to have real type numbers.) I bought this, because it is relatively cheap, balances much faster than the resistive balancers on most BMS and allows me to read out the voltages using Bluetooth. The Android app (you do need it for setting up the balancer) is utter crap. I have a hard time understanding how you can fail so hard at building a simple app. I didn't manage to get it to run on Lineage OS. The voltage readouts don't always seem quite right, but they move in unison so maybe an internal voltage reference is bad? Anyways, it does the job but buyer beware.
• Raspberry Pi B+ with a Bluetooth dongle

The Pi is the fun part! Standing on the shoulders of giants, I cobbled together a proof of concept Prometheus exporter that reads the cell voltages over Bluetooth. It doesn't work very well, but work it does! Now I can monitor and graph the voltages without the crappy app. Here you can find it: https://github.com/hamadmad/python-daly ... xporter.py

This is one of the better modules beginning to charge (and you can see a finished module that took three whole days to balance).

It's quite interesting to see that on some modules the 5th cell is low, while cell 1 and 13 are usually high. On the previous BMS child-boards, the area around the bleeding resistors showed brown discoloration, while the conformal coating on this board is completely clear. I think it's possible that this is not only due to unmatched cells but also due to bugs in the BMS software.

Finally, a question to you all: Can anybody recommend a better active balancer (or an alternative fully automated and remotely observable solution) that doesn't break the bank? Currently, this is my main bottleneck because I can charge a lot faster than I can balance. I would be fine with paying around 50€ for anything significantly better than what I currently have (and I know that's very little money, I would just like to know whether I missed any much better option).

[johu]

There's this https://openinverter.org/wiki/16-cell_BMS but it balances very slow. Merely meant to keep cells balanced not to balance a very uneven pack

[Proton]

This is what I used to balance one pack at the time. balances with 4Ah. It is very fast.

Same balancer I use on my battery for my solar system. I do not use a BMS but just this balancer and my solar inverter starts and stops the charge based on the pack voltage.

This is the latest 8amp version but the 4 Amp version is cheaper.

https://www.aliexpress.us/item/32568029 ... pt=glo2usa

I would have used this on my car because is very very reliable but you need 6 and they do not communicate together. Also it is bluetooth and no can messages. I have 2 running on 2 different batteries and they are solid as a rock.