These were only installed on the old BMS. The new BMS no longer have fuses.
The 2018 BMS didn’t have fuses.
The 2020 BMS does have fuses.
I don’t have newer than 2020 so can’t comment on those.
I see, will do, thanks for the advice!!
Quick update on my side: I plugged everything back in after balancing the pack properly and nothing, so i plugged the battery into the charger and got a reset, then straight to 2nd and 8th red LED, which according to the above LED status description means “Severe Cell Under-Voltage Fault”. It clearly got under voltage in the past so it means the BMS will not forget severe faults.
I am not even sure we can reset these fault through the CAN bus, even if we decoded it. Ideally we would have a HEX file to flash a new firmware to the ICs but we’ll never get our hands on that.
Regarding fuses, before soldering new ones on, you guys should just remove the blown ones and solder a little piece of wire just for testing purposes. If it comes back to life then order the proper part and solder it back on.
If anyone has a spare BMS I could try out on my battery let me know, I am located in France and the US. Thanks!
I would think, the best solution for this error is, to sniff the can-Bus-communication and simulate it with an microcontroller. Then you can change the BMS or the complete battery. Has someone tried to decode the communication?
I did the work to extract the CAN BUS communications from a working battery and a non working battery, posted all the files I had on hand somewhere above but I don’t really have the skills to decode it and no one took up on it.
I used an Arduino and a MCP2515 to intercept the CAN coms. I got that setup working again yesterday and when I have a bit of spare time I tinker with it. I will soon try to record a battery reset message and then send it from the arduino. Wish me luck!
If someone wants to take a crack at decoding the hex file from the CAN bus here is the link to the files.
Can you tell, which signals are send from the battery and which are send from the controllerbox?
Lithos use can2b, not sure if that helps.
You can work that out from looking at the can files. I took a short look. The best way would probably be to use a script to convert the hex to decimal and then figure out what’s happening.
The basics would be looking for messages about:
- Total voltage
- row voltages
- temperatures
- error messages
- turn on relay
- shut down relay
Hello to every surfer and engineer who is here!
First of all, I want to say that I’m really excited by this community - how smart and original it is.
You are all creating the future of boarding boards, that is really incredible.
Right related to the topic:
I have the Lift battery pack from 2017. The guarantee and other perks of course are already expired. And right now I’m trying to tackle the problem of “Severe Cell Under-Voltage Fault” when the second and the eight lights are red. Unfortunately, I don’t have 3500$ to solve this problem with an order of the new battery, plus I’m the person who like challenges - so I’m here)))))
As I see a lot of people already opened the battery and messed with the cells, but did anyone got the voltage back to the right level? Please, if so, send me some more information. I’m ready for any difficulties, and i really need to try something because there will be soon my father’s birthday and I want to make a present of the fixed surf))))
Hello Roman,
I’m now at my second older gen Lift Battery down… I have opened both, replaced the dead cells in one but was not able to get any of the two BMS to reset, they still display the fault. I tested many hardware systems on the BMS but couldn’t find anything wrong so at this point I assume the microprocessor just stores a hard fault code.
I would need to spend a lot of time decoding and experimenting with the CAN interface, then maybe reset the battery if possible or make my own to interface with the charger and ESC via CAN. Needless to say it would be time consuming. I was hoping to get some help on that front but no one has tackled the project yet.
Sorry I can’t be of any more help.
I spent a bit of time looking at the files I have gathered and I did write a quick HEX to DEC python script. I modified to include only unique codes (no repetition, just makes the file bigger) and here is the result of the good battery file I have:
[1802, 1, 127]
[784, 8, 255, 0, 0, 17, 0, 255, 6, 255]
[770, 4, 0, 0, 0, 0]
[772, 4, 0, 0, 255, 255]
[785, 8, 234, 0, 220, 5, 65, 2, 255, 255]
[786, 8, 255, 255, 255, 255, 0, 0, 63, 1]
[801, 8, 21, 14, 51, 1, 169, 3, 129, 3]
[787, 8, 0, 0, 1, 0, 62, 5, 8, 7]
[802, 8, 6, 0, 0, 0, 222, 15, 230, 15]
[803, 8, 4, 0, 1, 0, 40, 1, 64, 1]
[804, 8, 203, 0, 0, 0, 107, 222, 0, 0]
[820, 8, 0, 0, 0, 0, 0, 0, 0, 0]
[900, 8, 0, 0, 0, 0, 0, 0, 0, 0]
[787, 8, 0, 0, 1, 0, 62, 5, 3, 7]
[804, 8, 149, 160, 0, 0, 107, 222, 0, 0]
[816, 8, 227, 15, 227, 15, 229, 15, 230, 15]
[896, 8, 49, 1, 48, 1, 64, 1, 57, 1]
[787, 8, 0, 0, 1, 0, 172, 5, 17, 7]
[804, 8, 204, 211, 0, 0, 107, 222, 0, 0]
[817, 8, 222, 15, 222, 15, 225, 15, 225, 15]
[897, 8, 57, 1, 49, 1, 48, 1, 40, 1]
[787, 8, 0, 0, 1, 0, 81, 5, 3, 7]
[804, 8, 126, 211, 0, 0, 107, 222, 0, 0]
[818, 8, 227, 15, 228, 15, 226, 15, 226, 15]
[898, 8, 0, 0, 0, 0, 0, 0, 0, 0]
[1022, 4, 52, 9, 0, 255]
[1793, 1, 5]
[138, 8, 0, 0, 0, 0, 0, 0, 0, 0]
[808, 8, 174, 0, 141, 1, 53, 4, 35, 16]
[1020, 8, 8, 0, 14, 0, 14, 0, 255, 255]
[804, 8, 106, 208, 0, 0, 107, 222, 0, 0]
[819, 8, 0, 0, 0, 0, 230, 15, 230, 15]
[899, 8, 0, 0, 0, 0, 0, 0, 0, 0]
[811, 8, 19, 6, 10, 0, 0, 0, 187, 148]
[809, 8, 35, 1, 40, 1, 140, 1, 200, 1]
[976, 8, 0, 0, 0, 0, 0, 0, 0, 0]
[787, 8, 0, 0, 1, 0, 77, 5, 3, 7]
[804, 8, 190, 204, 0, 0, 107, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 110, 5, 8, 7]
[804, 8, 37, 201, 0, 0, 107, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 120, 5, 12, 7]
[804, 8, 162, 197, 0, 0, 107, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 143, 5, 12, 7]
[804, 8, 139, 192, 0, 0, 107, 222, 0, 0]
[804, 8, 224, 186, 0, 0, 107, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 105, 5, 3, 7]
[804, 8, 82, 183, 0, 0, 107, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 67, 5, 8, 7]
[804, 8, 197, 186, 0, 0, 107, 222, 0, 0]
[804, 8, 223, 189, 0, 0, 107, 222, 0, 0]
[804, 8, 75, 192, 0, 0, 107, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 124, 5, 8, 7]
[804, 8, 209, 193, 0, 0, 107, 222, 0, 0]
[811, 8, 18, 6, 10, 0, 0, 0, 187, 148]
[787, 8, 0, 0, 1, 0, 143, 5, 8, 7]
[804, 8, 63, 195, 0, 0, 107, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 105, 5, 8, 7]
[804, 8, 129, 196, 0, 0, 107, 222, 0, 0]
[804, 8, 66, 197, 0, 0, 107, 222, 0, 0]
[804, 8, 17, 198, 0, 0, 107, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 86, 5, 8, 7]
[804, 8, 10, 199, 0, 0, 107, 222, 0, 0]
[0, 2, 1, 10]
[804, 8, 163, 199, 0, 0, 105, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 86, 5, 3, 7]
[804, 8, 28, 200, 0, 0, 105, 222, 0, 0]
[650, 4, 1, 255, 0, 128]
[906, 5, 1, 132, 0, 53, 0]
[786, 8, 255, 255, 255, 255, 0, 0, 62, 1]
[787, 8, 0, 0, 1, 0, 105, 5, 12, 7]
[804, 8, 104, 200, 0, 0, 105, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 120, 5, 8, 7]
[804, 8, 156, 200, 0, 0, 105, 222, 0, 0]
[818, 8, 227, 15, 227, 15, 225, 15, 226, 15]
[804, 8, 202, 200, 0, 0, 105, 222, 0, 0]
[804, 8, 248, 200, 0, 0, 105, 222, 0, 0]
[804, 8, 34, 201, 0, 0, 105, 222, 0, 0]
[804, 8, 96, 201, 0, 0, 105, 222, 0, 0]
[804, 8, 150, 201, 0, 0, 105, 222, 0, 0]
[804, 8, 176, 201, 0, 0, 105, 222, 0, 0]
[811, 8, 17, 6, 10, 0, 0, 0, 187, 148]
[1162, 6, 11, 0, 162, 51, 112, 0]
[1802, 1, 5]
[1034, 7, 0, 0, 0, 0, 0, 0, 0]
[787, 8, 0, 0, 1, 0, 100, 5, 3, 7]
[804, 8, 202, 201, 0, 0, 105, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 72, 5, 3, 7]
[804, 8, 207, 201, 0, 0, 105, 222, 0, 0]
[804, 8, 208, 201, 0, 0, 105, 222, 0, 0]
[804, 8, 239, 201, 0, 0, 105, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 153, 5, 8, 7]
[804, 8, 234, 201, 0, 0, 105, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 58, 5, 3, 7]
[804, 8, 229, 201, 0, 0, 105, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 124, 5, 12, 7]
[804, 8, 227, 201, 0, 0, 105, 222, 0, 0]
[787, 8, 0, 0, 1, 0, 81, 5, 8, 7]
[804, 8, 252, 201, 0, 0, 105, 222, 0, 0]
[804, 8, 235, 201, 0, 0, 105, 222, 0, 0]
[802, 8, 6, 0, 0, 0, 222, 15, 229, 15]
[804, 8, 6, 202, 0, 0, 103, 222, 0, 0]
[819, 8, 0, 0, 0, 0, 229, 15, 229, 15]
[811, 8, 16, 6, 10, 0, 0, 0, 187, 148]
[1162, 6, 11, 0, 189, 51, 112, 0]
[1034, 7, 0, 0, 1, 0, 0, 0, 0]
[787, 8, 0, 0, 1, 0, 62, 5, 254, 6]
[804, 8, 34, 202, 0, 0, 105, 222, 0, 0]
[804, 8, 136, 201, 0, 0, 103, 222, 0, 0]
[816, 8, 227, 15, 227, 15, 229, 15, 229, 15]
[906, 5, 1, 132, 0, 0, 0]
[804, 8, 245, 213, 0, 0, 105, 222, 0, 0]
[906, 5, 1, 0, 0, 0, 0]
[1162, 6, 3, 0, 55, 57, 112, 16]
[138, 8, 48, 129, 1, 32, 128, 0, 0, 0]
[138, 8, 48, 129, 1, 30, 128, 0, 0, 0]
CANOpen has the concept of NMT node control and NMT node monitoring frames, both of which are present in the CAN logs provided earlier in this thread.
NMT node monitoring indicate that two different nodes are sending their “heartbeat” using identifiers: 0x700 + NodeID
node 1(0x701)node A(0x70A)
Both CAN logs start with node A sending the 7F = pre-operational state. In the “good batt” logs we can later see node A transitioning to the 05 = operational state. node 1 is only seen sending 05 = operational state in the logs.
In the provided logs these CAN frames appear as:
70A 1 7F
701 1 5
70A 1 5
- The first value represents the CAN frame standard (11-bit) identifier (as hexadecimal)
- The second value represents the CAN frame DLC (how many data bytes are in the frame)
- The remaining values are the data bytes (0-8 bytes, each as a hexadecimal value)
The NMT node control frame (0x000), seen in the logs as 0 2 1 A, only appears in the “good batt” log with two bytes of data:
1 = command: start deviceA = node A
So potentially node 1 is the eBox and node A is the BMS?
CANOpen also has the concept of Emergency frames (EMCY) utilizing the identifier: 0x080 + NodeID.
They are only to be transmitted once per error event with frame data as per:
- 1 byte: Error register
- 2 bytes: Emergency error code
- Up-to 5 bytes: Manufacturer-specific error information
The logs contain such EMCY frames with id 0x08A from node A, presumably the BMS, but they appear in both “Good batt” and “Bad batt” logs so they are probably not the main cause for one battery to be considered as working and the other one not.
08A 8 [00] [00 00] [00 00 00 00 00]
08A 8 [30] [81 01] [20 80 00 00 00]
08A 8 [30] [81 01] [1E 80 00 00 00]
The emergency error code is in the manufacturer specific range? (if so, probably makes it hard to decipher more)
I’m guessing that the remaining frames in the logs are PDO:s according to a predefined mapping scheme, potentially without any convention between CAN frame identifier and the sending node id. The interesting battery data is likely hiding within these frames.
If we could get CAN logs from only the battery or the eBox on the CAN bus we could maybe figure out more details.
I would like to test some defective Lift Gen 4 batteries. Can anyone tell me the pin assignment for the DeltaQ charging cable Fischer (5-pin)?
Wow, you guys have come a long way since I last posted anything. Anyhow. A friend of mine purchased a Lift e-foil within the last year. After riding he went to charge it. It would not charge. The only indication of life was one little green LED, would flash ON every several seconds. After a few calls and several attempts to revive the battery with tech support, Lift sent him a new battery and said get rid of the old one there is nothing more we can do. So he gave it to me because I had built e-foils. And I don’t think he wanted the hazard around his house. So I got it open. Here are some photos.
I tried to do kind of a master reset by removing the leads at the main relay to drop power to the whole thing. That did not get it working.
My observations. No water inside. all cells measure 3.37. total = 47.24 this was 3 months after the battery stopped working .
Today at least 6 months later all cells measure 3.29. Total 46.10. the green led has stopped flashing.
I’m wondering if its normal for cells to discharge so perfectly over 6 months time. I suspect the BMS is still working???
I currently don’t have a voltage source high enough to attempt to charge the battery. Parts on order.
My plan is to try to use the battery in a new foil build, but first i need to know how to disable all the smart features???
Try first to replace only the master relay, often they Lose contact inside. If you get original charger try it first. maybe all work is done after that. Otherwise use only the cells and put a new bms from daly to it. The Lift bms got its own software that can be crashed totally. If lift support and resetting did fail, rip every cables and electronics of and weld the new bms on to the cells. thats easy and fast to do.
Hey Theocerbo,
I decided to run the “good bad” and “bad batt” files from an earlier post through chat GPT to help decode and identify the differences between the 2 .txt files provided earlier.
The main purpose of this is to REPLACE the lift BMS with any other BMS and emulate an “ok” signal with an Arduino.
Please comment if this is complete garbage or if it makes sense/is correct. I have no experience with can bus to decode myself.
Here is the conversation and response:
I now have both the “healthy” and “not healthy” battery CAN bus logs. I’ll analyze the differences between the two to identify key signals that indicate a healthy battery. I’ll extract and compare the CAN message IDs, data patterns, and any anomalies. Give me a moment to process the data.
Analysis of CAN Bus Differences Between Healthy and Not Healthy Battery Logs
Missing Messages in Not Healthy Battery
These messages are present in the healthy battery but missing in the not healthy one:
028A32838A40A48A
This suggests that these messages might be important for normal battery operation. If they are required by the eFoil system, their absence could be causing the malfunction.
Extra Messages in Not Healthy Battery
These messages are present in the not healthy battery but missing in the healthy one:
327
The presence of this message in the not healthy battery might indicate an error condition or some kind of failure report.
Key Differences in Data for Common Message IDs
Some messages appear in both logs but have different data payloads. Here are some important ones:
-
Message
322- Healthy:
8 6 0 0 0 DE F E6 F - Not Healthy:
8 3 0 C 0 0 0 68 D - Difference: The first byte has changed from
6to3, and other values have changed significantly. This could relate to voltage, temperature, or system status.
- Healthy:
-
Message
380- Healthy:
8 31 1 30 1 40 1 39 1 - Not Healthy:
8 16 1 15 1 10 1 E 1 - Difference: The values have decreased significantly. This might indicate a low voltage or an error state.
- Healthy:
-
Message
321- Healthy:
8 15 E 33 1 A9 3 81 3 - Not Healthy:
8 0 0 0 0 8B 3 0 0 - Difference: The values have been reset to mostly zeros, which could indicate a failure mode or loss of valid sensor data.
- Healthy:
-
Message
312- Healthy:
8 FF FF FF FF 0 0 3F 1 - Not Healthy:
8 FF FF FF FF 0 0 13 1 - Difference: The last byte has changed from
3Fto13. This might be a status or error flag.
- Healthy:
-
Message
329- Healthy:
8 23 1 28 1 8C 1 C8 1 - Not Healthy:
8 10 1 10 1 11 1 12 1 - Difference: The values have dropped significantly, possibly indicating low voltage or a protection mode.
- Healthy:
-
Message
313- Healthy:
8 0 0 1 0 3E 5 8 7 - Not Healthy:
8 0 0 1 0 30 5 F0 6 - Difference: Changes in values, likely affecting power management.
- Healthy:
Next Steps
To emulate a healthy battery signal using an Arduino, you should:
- Ensure missing messages (
0,28A,328, etc.) are included in the Arduino-generated CAN bus traffic. - Modify messages like
322,321,312, etc., to match the healthy battery data. - Investigate the role of message
327, which only appears in the not healthy battery. It might be an error report. - Test different payload values for
313,329,380, etc., and observe the system’s response.
Would you like me to help write an Arduino script to simulate the “healthy” battery signals?
