Other Boosted Stuff Boosted App | Test Page | Boosted Board App for Android

Repairs

How to send your stuff in for service

North America: contact me on reddit at u/venutech

Europe: contact user #efsfed8756 on discord

Mail to
You must first open contact via reddit and send your tracking number once you get it
Venutech
911-4460 Tucana Crt
Mississauga, Ontario
L5R 3K9
Canada
Phone: 514-513-7501
eMail: This email address is being protected from spambots. You need JavaScript enabled to view it.
Shipping instructions
UPS.com
The following information is a suggestion, feel free to ship any way you want.
This is the most effiecient way to ship a battery from US and the procedure is required in order to avoid paying a customs fee for shipping over electronics because this is a service, not a product.
I've had many inquiries about claiming the XR as a battery. Claim it as a computer, because thats exactly what it is. All computers and cellphones have the same type of batteries inside and the XR battery should be classified as the same. The XR battery is a special computer designed as power management, but no need to go into detail, its a computer.

UPS will ask for a "commercial invoice." Thats just what they call an invoice. Its a UPS term.
Use the promo code EASY
if that promo code doesn't work, try INTERNATIONAL or VETERAN

Say it's a gift to residential. No transaction happening. It's a broken computer. Don't mention battery, every computer has a battery inside $10 maximum total value.
Make sure you print and drop off your commercial invoice (4 copies) as well as the shipping label when you drop off your parcel at UPS
When you print it at ups.com and drop it off at the store the store doesn't make any money and will give you a hard time.
To avoid them asking for a 4th copy of the commercial invoice when they know it only prints 3, I'm letting you know ahead of time.
You print the copies at home
One shipping label and 4 commercial invoices
Here's a link to the commercial invoice if you wnt to just write it out by hand after printing a shipping label.
Ignore the sales and tax stuff, doesnt apply here
https://www.ups.com/us/en/shipping/international/commercial-invoice.page

If you've opened the battery you need to advise Venutech/Efsfed because we need to do some changes with shipping
All batteries and ESCs must be clean! No exceptions.
Write your reddit/discord username and the type of service you want on a piece of paper and tack it on your device.
Use chopsticks to remove your battery or watch this tutorial if you dont have them
Venutech/Efsfed is both the customer service representative and technician supreme
Send out the tracking as soon as you get it.

1-2 days turn around
Paypal email for Venutech: This email address is being protected from spambots. You need JavaScript enabled to view it.
Payment must be complete prior to return shipping

https://www.ups.com/assets/resources/media/en_US/CB2_US.pdf
40% off UPS.com to Canada

XR Battery Repair

RLOD Xr Battery Repair Service -$100
RLOD Xr Battery repair service with v2.5.1 update -$150
XR battery service, only has lights when charger plugged in -$175
XR battery works but doesnt charge -$45
2.5.1 XR battery firmware update -$150
XR battery modchip -TBD

ESC repair

ESC Stealth upgrade (unlock hyper mode) -$125
2.7.2 ESC Firmware update (XR, hyper mode and beams support) -$150
Lost ride modes repair -$175
ESC Remote Bluetooth Connection Repair -TBD

Remote repair

Remote battery replacement -$45
2.3.3 Remote Firmware update -$25
*Prices are in USD for all of North America

Progress Updates

08-21-20 - RLOD issue resolved. Firmware update for ESC, XR Battery and remote. Joined forces with efsfed and jonataubert; with our powers combined... We are Captain Boosted!

08-13-20 - Made a diagnostics ESC, turned my V2 into a live diagnostics board, cracked SPI flash with help of debug data, can now copy original ESC odometer during stealth upgrades, started a couple discord channels, found how to extract and upgrade the remote firmware, still finishing up the Leaf (but holy crap, its going to be awesome), bought a bunch of boosted board parts and decks, but dont have time to put them together cause I need to find a way to keep these XR batteries balanced.

07-25-20 - Still short on sleep and time. I made a custom XR battery pack, repaired a ton of batteries, found out how to upgrade all V2 and V3 boards to have hyper mode, discovered what causes lost ride modes, confirmed all V2 and V3 ESCs are exactly the same circuits, and I'm finishing up my leaf with a solid way to connect it to my controller and add the ability to change pulley teeth.

06-28-20 - Holy shit, where do I begin? RLOD fix, balancing, modding, Leaf device, UM232H modules, CAN bus decoders, firmware discovery and ESP32s boards.

05-27-20 - I've made a working Boosted Board Odometer and battery tracker. It works like the boosted app did, in that it takes the odometer readings from the ESC motor revolution count. I've been posting most of my updates on reddit/BoostedBoards

How to care for your Boosted battery

-Never leave it in storage at 0% charge
-Never leave it in hot or cold storage
-Wait at least 30 min after a ride before plugging it in to charge
-Wait at least 10 min after charging before going for a ride
-When taking it out of storage, charge it for a minimum of 14 consecutive days
-Error codes need to be taken seriously and you should never ride while one is flashing
-When the battery says 0%, do not throttle at all
-If the power drops out, stop your ride and check your board
-If the controller is beeping, stop your ride and check your board
-At a stoplight, reach down and feel the motor/battery sidewall temperature; if its uncomfortably hot then stand in the shade (~1hr for climatization, but ANGTFD)
-For batteries with FW <v2.5.1, you need to charge it even if its green/yellow for 2-3 weeks, once per year simply because there is nothing to indicate when it is critically off balance
-For batteries with FW v2.5.1, charge it until its green
-FW v2.5.1 will begin the balance routine when Δ >100mV and max cell voltage is 3.950V
-FW <v2.5.1 does not have a balance routine and just needs to be left plugged in
Repairing an XR battery yourself

I would first like to stress the importance of not trying to repair your battery if you have no experience in soldering. Completely put it out of your mind to attempt to remove the screws on the bottom. PS. that plastic nut is a vent, you'll break it off.
Here is the unofficial documentation for XR RLOD repair, but first, here are some examples of what not to do:

Firmware Update information

ESC Firmware change log
-2.1.9 : added XR battery support
-2.3.3 : added hyper mode
-2.7.x : added beams support
Remote firmware change log

-2.3.3 : added hypermode and beams support (Serial R2820+, check firmware here or with the lightblue for android or iPhone/iOS)
Battery firmware change log

-2.x.x : introduced permanent lockout (RLOD) at delta 0.5V
-2.5.1 : removed RLOD due to imbalance, improved balance routine

SR Battery Firmware:1.4.1, 1.5.6, 1.6.3(dustin lieu)
XR Battery Firmware:1.4.1, 2.0.4(@Khrastal on BL Discord), 2.1.2 , 2.1.5, 2.1.7, 2.5.1
ESC Firmware:1.3.0, 1.5.2, 1.6.5(u/ExtraGlutenPlzz), 2.1.8, 2.1.9, 2.3.2, 2.3.3, 2.5.1, 2.7.0, 2.7.1, 2.7.2
Remote Firmware:1.3.0, 1.4.3, 2.2.0, 2.3.0, 2.3.3(only known FW w/Hyper Mode)

XR Battery RLOD Notes

-Max and min voltage cutoff is 3.9v (or 3.95v) and 3.0v, respectively
-0% is when the lowest cell reaches <3.0v
-100% is when Δ <100mV and average cell voltage during charge is 3.950V for FW v2.5.1. The voltage drop brings the min cell voltage down to ~3.915v when the charging cuts out via software. It will continue to balance by periodically charging the pack and draining alternating cells.
-100% is when the average cell voltage is 3.925v during charge on FW <v2.5.1. The voltage drop brings the min cell voltage down to ~3.90v when the charging cuts out via software. It will continue to balance by periodically charging the pack and draining alternating cells.
-RLOD can be tripped when difference in min/max cell voltage is >0.5v on FW <v2.5.1
-RLOD will not be tripped because of typical imbalance on FW v2.5.1
-RLOD will be tripped if cell voltage is less than 2.5V on FW v2.5.1
-30%, 40%, 50% and 60% SoC have an average cell voltage of about 3.4, 3.5, 3.6 and 3.7 V, respectively
-Voltage spike during charge is ~0.035v per cell
-Voltage drop during load is ~0.035v per cell

-FW v2.5.1 can exceed a Δ >1V without RLOD (I didn't test more than that, but 1V is more than enough because you'd need to actively be trying to get your board off balance by more than 1V and I cant see a way to do that since power cuts out when a cell is <3.0v and full charge is 3.9v, there isnt a possibility for Δ >1V in a real life scenario)

Early Experiments:
I'm using an Arduino Mega 2560 because I have a couple lying on my desk, also, it has 3.3v and accepts as low as 2.7v for logic. I'm just making notes in the event that I forget.
download the frser-duino mega1280 branch
$sudo git clone --recursive git://github.com/urjaman/frser-duino -b arduino-mega-1280
open directory
$cd frser-duino
make it happen
$sudo make u2 && sudo make flash-u2
Edit the Makefile :change the mcu from 1280 to 2560 and use this for the AVRDUDE settings a couple lines below
$sudo nano Makefile
change to the following, leave everything else for avrdude as is
avrdude -p m2560 -c wiring
I'm on version 6.something of avrdue, btw

MCLR gets tied to ground. Both are on the debug headder so I could probably bridge those to groung on the arduino (I could do that but then I'd need to desolder MCLR or readFlash to check if the battery was flashed)

==========================================================
Alright, after speaking with u/Jonataubert, I have been informed that the data lines on the batt mobo are pulled up to high (i thnk he said 10k to 3.3v).
Essentially, using an arduino with 5v logic and a volt reduction circuit will give messy results, if any. If I had an arduino with 3.3v logic, maybe this method would fly. I think the Arduino Due and Arduino mini might have 3.3v logic.
I've given up and will use an FT323H device when I get it and post the results.
==========================================================
Back in the game with a UM232H!
Cells are already balanced to 4.2v (Instrument error, real value was probably closer to 3.4 v)
Full pack voltage is 44.4
Hooked up wires as in diagram
Read, verify, erase, reset =GOLD!
Removed wires, plugged in to charge, everything looks good
Unplugged BMS, restarted battery, RLOD, redid process
Firmware v2.5.1
Took it for a solid 10 km ride, charged and balanced to 3.90 V
Sealed with extra strength caulking, with some advice from a pro handyman
Returning battery to donor

Second battery has dead cells, cell #11 was at 0.5v, the rest around 2v
Battery level lights show 1 flashing
Read, verify, erase, reset=RLOD, not able to charge before or after flashing
Found out I can just plug in the charger instead of holding the button
Using a Nitecore battery charger
Broke my Nitecore battery charger
Using a Yihua 853D to charge the cells with an analog ampmeter
Going cell by cell, bringing them each to a nominal voltage
Charging each cell at around 500 mA, never going higher than that
Balanced levels so far: 3.47, 3.48, 3.44, 3.44, 3.55, 3.46, 2.xx, 2.xx, 2.xx, 2.xx, 3.80, 3.88, 3.57
Tested again in order: 3.42, 3.46, 3.44, 3.42, 3.54, 3.45, 3.43, 3.46, 3.41, 3.20, 3.79, 3.88, 3.56
Battery level lights show 2+1flashing, still RLOD without flashing
Bent three pins in the BMS connector, somehow, straightened them before jamming things together
Read flash(dump0), verify, Erase, RLOD
Balance charge lowest cell: 3.37, 3.88
Read flash(dump1), verify, Erase, RLOD
Balance charge lowest cell: 3.38, 3.88
Read flash(dump2), verify, Erase, RLOD
Balance charge lowest cell: 3.39, 3.88
Read flash(dump3), verify, Erase,...
Power on, OK
Read flash(dump4), verify, OK
Connected to board and powered on, RLOD
Charge lowest cell, read flash(dump5), verify, Erase, RLOD, charge more, read flash(dump6), verify, Erase, OK
Charge battery to 100% [2 minutes from 50%-full]
Connected to charger second time, RLOD after a couple seconds
Charge lowest cell, read flash(dump7), verify, Erase, OK
Despite saying 100%, cells remain unbalanced (one cell is at 3.90, the rest are close to 3.4)
Firmware v2.1.7
BMS was not fuly plugged in and RLODed
Read flash(dump8), verify, Erase, OK
[Read Cells: unbalanced] - When balanced to 3.90, continue >>
[Read Cells: unbalanced] - When balanced to 3.90, continue >>
Seal, done
Repaired XR batteries undergo stringent testing which includes riding in real life from 100% to 0%. For my route thats more than 16km (about 10 miles).
Upon return I check for consistency in the cells. Take any note of possible differences/similarities wrt firmware.
If a cell exhibits any characteristics different from the other cells, further testing is performed and consider replacing the problematic cell.
I've also successfully replaced a full set of 26 cells to 26 Sony VTC6 cells. Same range since they have the same capacity as LG HG2s.
I've now got all kinds of crazy equipment, doing all kinds of mad science tests, I'm always wearing safety goggles, a 3M 100p gasmask and a red triple 8 skate helmet with a shredlight so I can see what I'm soldering at 1:50 am (current time).

XR Error Codes

Primary Power light indicates severity of issue and the battery charge level lights indicate the location of the issue.
On, connected to ESC
On, not connected to ESC
On, charging
On, pairing mode
Not responding to button=Burnt fuse
Overheating? General error?
Charger issue
Battery charging issue
Possible Battery and ESC Overheating
Motor Overheating
Battery issue
Battery check failure
Battery communication error with ESC
RLOD: Battery Lockout. BMS issue (cell imbalance, temperature issue, current issue, etc)

Status Legend:
= Warning = Failure = Lockout
SoC Legend: ||||
Charger | Battery | Deck | ESC | Motors

SR Error Codes

Battery communication error with ESC
Check foreverboosted.co

XR Battery Balance Check w/Arduino

Source Code for Arduino Mega 2650. Download the MCP_CAN_lib, get a MCP2515 CAN bus decoder module and any kind of Arduino, and check your XR battery health on a serial monitor. I'll post instructions for the pins, but for now go see BeamBreak's XR Health Check if you havent already. Video demonstation w/OLED

Bluetooth R&D

ESC and Battery

DescriptionTypeAddressExample Value
Service Change ServiceService00001801-0000-1000-8000-00805f9b34fb
Service Change CharacteristicNotify00002a05-0000-1000-8000-00805f9b34fb
Device ServiceService00001800-0000-1000-8000-00805f9b34fb
Board NickNameReadable00002a00-0000-1000-8000-00805f9b34fbMyBoard
Device AppearanceReadable00002a01-0000-1000-8000-00805f9b34fb0xC303
Device PPC parametersReadable00002a04-0000-1000-8000-00805f9b34fb0x0800100000009001
Device Info ServiceService0000180a-0000-1000-8000-00805f9b34fb
ESC Model NameReadable00002a24-0000-1000-8000-00805f9b34fb00005678
ESC Hardware NameReadable00002a27-0000-1000-8000-00805f9b34fb0x3031384234414031
ESC Firmware ValueReadable00002a26-0000-1000-8000-00805f9b34fbv2.1.9
Manufacturer NameReadable00002a29-0000-1000-8000-00805f9b34fbBoosted, Inc.
Device PnP IDReadable00002a50-0000-1000-8000-00805f9b34fb0x01000A004C010001
OTA Update ServiceService00001016-d102-11e1-9b23-00025b00a5a5
OTA Current AppReadable, Writable00001013-d102-11e1-9b23-00025b00a5a50x01 (0x00 = Update Mode)
OTA Read CS BlockWritable00001018-d102-11e1-9b23-00025b00a5a5
OTA Data TransferReadable, Notify00001014-d102-11e1-9b23-00025b00a5a5Null
OTA VersionReadable00001011-d102-11e1-9b23-00025b00a5a50x07
Battery ServiceService65a8eaa8-c61f-11e5-9912-ba0be0483c18
Battery Level CharacteristicReadable, Notify65a8eeae-c61f-11e5-9912-ba0be0483c180x64 (0x00-0x64)
Battery Firmware ValueReadable65a8f833-c61f-11e5-9912-ba0be0483c180x02010200 (v2.1.20)
Battery ModelNameReadable65a8f831-c61f-11e5-9912-ba0be0483c180x02=XR (0x01=SR battery)
Battery ChargingReadable, Notify65a8f5d4-c61f-11e5-9912-ba0be0483c180x00 (0x01=Charging)
Battery Unknown 1Readable65a8f832-c61f-11e5-9912-ba0be0483c180x01
Battery Serial NumberReadable65a8f834-c61f-11e5-9912-ba0be0483c180x08BFDC12 (XR), 0xDE5F0000 (SR)
Battery CapacityReadable65a8f3c2-c61f-11e5-9912-ba0be0483c180xD0103D00 (XR), 0x0A0252600 (SR)
Battery RTCReadable, Writable65a8f835-c61f-11e5-9912-ba0be0483c180x00000000000000
Serial ServiceService588560e2-0065-11e6-8d22-5e5517507c66
Serial R/W StateReadable58856526-0065-11e6-8d22-5e5517507c660x00 (0x01 for God Mode)
Serial KeyReadable, Writable, Notify58856524-0065-11e6-8d22-5e5517507c660x0A61B9AFDA6669559F2F9BA13E99BB6
Odometer ServiceService7dc55a86-c61f-11e5-9912-ba0be0483c18
Odometer ValueReadable, Notify7dc56594-c61f-11e5-9912-ba0be0483c180x259f4f01
ESC ModelReadable7dc59643-c61f-11e5-9912-ba0be0483c180x01 (V2 Dual)
Available Ride ModesReadable7dc55dec-c61f-11e5-9912-ba0be0483c180x03 (Max is Expert)
Current Ride ModeReadable, Writable, Notify7dc55f22-c61f-11e5-9912-ba0be0483c180x02(Expert), (0x00=Beginner)
Motor SpeedReadable, Notify7dc56b34-c61f-11e5-9912-ba0be0483c180x0000 at rest max~0x001c? (7000)/td>
ESC Unknown 1Readable7dc56666-c61f-11e5-9912-ba0be0483c18None
ESC Unknown 2Readable7dc56986-c61f-11e5-9912-ba0be0483c18None [what does that mean?]
ESC PowerReadable, Notify7dc56bfc-c61f-11e5-9912-ba0be0483c180x00000000
ESC OTA UpdateWritable7dc573ec-c61f-11e5-9912-ba0be0483c18
ESC NameReadable, Writable7dc5bb39-c61f-11e5-9912-ba0be0483c18BoostedBoard00005678 (write Nickname)

Controler

DescriptionTypeAddressExample Value
Service Changed ServiceService00001801-0000-1000-8000-00805f9b34fb
Service Change CharacteristicNotify00002a05-0000-1000-8000-00805f9b34fb
Device Info ServiceService00001800-0000-1000-8000-00805f9b34fb
Device NameReadable00002a00-0000-1000-8000-00805f9b34fbBoostedRmt12345678
Device AppearnceReadable00002a01-0000-1000-8000-00805f9b34fb0xC303
Device PPC parametersReadable00002a04-0000-1000-8000-00805f9b34fb0x0800100000009001
Device Properties ServiceService0000180a-0000-1000-8000-00805f9b34fb
Model NumberReadable00002a24-0000-1000-8000-00805f9b34fb0x3030303030303030
Hardware RevisionReadable00002a27-0000-1000-8000-00805f9b34fb0x30303030 (v2.3.3:0x0189C741)
Firmware RevisionReadable00002a26-0000-1000-8000-00805f9b34fbv1.4.3
Manufacturer NameReadable00002a29-0000-1000-8000-00805f9b34fbBoosted, Inc.
PnP IDReadable00002a50-0000-1000-8000-00805f9b34fb0x01000A004C010001
Trigger ServiceServiceAFC05dA0-0cd4-11e6-a148-3e1d05defe78
Trigger ValueReadable, NotifyAFC0653E-0cd4-11e6-a148-3e1d05defe780x2000000 @idle
v2.3.3 OnlyReadableAFC063F4-0cd4-11e6-a148-3e1d05defe780x00000000
v2.3.3 OnlyWritableAFC0653F-0cd4-11e6-a148-3e1d05defe78-
v2.3.3 OnlyReadableAFC06540-0cd4-11e6-a148-3e1d05defe780x0103010000003F37000045360000
LED/Buzzer ServiceAdvertised ServiceF4C4772C-0056-11E6-8D22-5E5517507C66
LED Value 1WritableF4C47A4C-0056-11E6-8D22-5E5517507C66writing 1 dims blue light cycles orange lights
writing 2 starts beeping,0xF steady blue flash
LED Value 2WritableF4C47D8A-0056-11E6-8D22-5E5517507C66Writing 1 or 2 Disconnects
LED Value 3WritableF4C47E66-0056-11E6-8D22-5E5517507C660x01=1flashing light
LED Value 4WritableF4C429F3-0056-11E6-8D22-5E5517507C660x01=1flashing light 0x02=beeping
LED Value 5WritableF4C48032-0056-11E6-8D22-5E5517507C66Disconnect with anything
LED Value 6Readable, WritableF4C4293F-0056-11E6-8D22-5E5517507C66?
OTA Update ServiceService00001016-d102-11e1-9b23-00025b00a5a5
OTA Current AppReadable, Writable00001013-d102-11e1-9b23-00025b00a5a50x01 (0x00 = Update Mode)
OTA Read CS BlockWritable00001018-d102-11e1-9b23-00025b00a5a5
OTA Data TransferReadable, Notify00001014-d102-11e1-9b23-00025b00a5a5Null
OTA VersionReadable00001011-d102-11e1-9b23-00025b00a5a50x07

Background info

I got my Boosted Board V2 Dual with both XR and SR batteries in 2018. I've changed a number of belts and did some maintenance with the bearings and pulleys. The simplicity of the construction brings me alot of joy when I work with it, more so when I ride. The Boosted company is unfortunately dead, however they created a culture of high tech, good support, great communication and good times all the time around these LM vehicles. This culture is alive and strong.
I was riding near SQ1 and going about 25km/h past the bus station and my board stopped dead; the road was smooth, there weren't any rocks, I was going down a decline and I was throttling maybe 50%. I stopped to look around and analyze the belt and pulleys, the road, I even thought to look around to see if anyone was pranking me with a bluetooth scrambler. I remembered the video of those two guys who tried to hack his board after something similar happened to him in Australia. Wired Article, Defcon Video
I wanted to continue that research using my own board now that these products are not offically supported. I've come a long way in doing research on these boards. They're great and they always impress me. To this day, Boosted Boards are still the market standard. ie. "oh look at this flex"

While I had it open I cleaned things up. Here I added a water seal around the button. There are larger holes where liquids can get to the battery, but I did it anyways because I just felt it needed it. Used a balloon as a rubber seal and glued it with that clear rubbery stuff with the chinese writing on it. I pay $3 for it locally.
I damaged the piezo speaker, but I was alrady thinking of replacing it with a small vibrating motor. I'm sure the vibrator will be more noticable than the sound of the beeps. The vibrator is from some old Blackberry phone parts.

I read a post on r/BoostedBoards about packet sniffing in order to send a signal to the ESC, so I installed the latest Kali Live onto USB and booted up my Surface Pro 4, but I didn't get a signal from the controller. I probably did something wrong using bettercap since I didn't get a signal from a number of other devices in the area and I actually couldn't connect to them.

Using LightBlue, I was able to get the required BLE information. I've reverse engineered the logicboard and found that the firmware can be extraced so that I can update any remote to be compatible with hyper mode and beams.

Deconstructing My Board

The board was dirty up in places of the circuitry and shit. Kindof lacking on the sealing, but I'll address that later. The mainboard was luckily fully coated with latex. I was pleasantly surprised with that. Hey, Samsung and crApple, thats how you waterproof something! So dirty I wish I could be doing this outside with a hose.

Have you ever seen that episode where Kramer makes salad in the shower? I was careful not to let water in the crevices and dried everything right away.

Deconstructing the Android App

I decompiled the Android app, looking for goodies. I found some pictures and values used in odometer conversion. Things are written in smali and koltin. I have a small sense of whats going on here and there, but I really cannot make sense of the overall picture. I hope someone else can take a crack at it and find out about the OTA updates and how they work.

Deconstructing My Controller

After reading the twitter post about getting a debug dump from the XR battery I wanted to see if I could get a similar debug port on the controller. There isn't a debug port, but there is a port for programming. Not really useful unless I have a firmware file. So I wanted to continue digging to see if I can get more insight. I checked some pics of some one else who took their controller apart. Great pics, but I wanted to know the types of ICs. On further inspection, in order to see all the traces I had to remove piezo speaker and I also removed the battery to play it safe.

Notable websites