SUNRA ROBO-S Battery Lockout and BMS Protocol Help Needed

[Voultepsis]

Hello everyone,

I am the owner of a SUNRA ROBO-S 3kW electric scooter equipped with two independent 72V battery packs, each containing its own BMS.

After approximately 12,500 km of use, both battery packs started showing abnormal behaviour. The dashboard frequently displays flashing 0% battery indications and significant differences in reported state of charge despite similar measured battery voltages.

I have been trying to understand the communication between the scooter and the battery BMS systems.

So far I have:

• Measured voltages on the communication connector.
• Investigated the wiring between battery and scooter.
• Used an RS485-USB interface.
• Performed oscilloscope measurements on the communication lines.
• Attempted to identify the protocol used between the batteries and the scooter.

My main question is:

Does anyone have information regarding the communication protocol used by the SUNRA ROBO-S battery system?

Has anyone successfully identified whether the system uses RS485, UART, CAN bus, or another proprietary protocol?

Has anyone managed to use alternative batteries or replace the original battery packs while maintaining normal scooter operation?

I have attached a detailed report describing the battery issues, communication concerns, measurements and the technical difficulties encountered while trying to diagnose the system.

Any information from SUNRA owners, battery specialists, reverse engineers or BMS experts would be greatly appreciated.

Thank you.

 

[Voultepsis]

Additional BMS photos and controller connection photos.

 

[Zambam]

12,500 km if trouble free on the batteries is pretty good. Can’t help you with the protocols. Have you monitored battery voltage with your own volt meter and a clamp on ammeter to assess the condition of your batteries?

 

[Voultepsis]

12,500 km if trouble free on the batteries is pretty good. Can’t help you with the protocols. Have you monitored battery voltage with your own volt meter and a clamp on ammeter to assess the condition of your batteries?

Thank you my friend for your reply.

The SUNRA app does provide battery voltage and battery status information. However, it does not provide detailed BMS diagnostics such as individual cell-group voltages, balancing status, protection events or fault logs.

To investigate the batteries properly, I measured the individual cell-group voltages directly on the BMS balance connector. These measurements revealed significant imbalance between cell groups.

My concern is therefore not the basic vehicle information shown by the app, but the lack of detailed battery management data and communication protocol information.

 

[Zambam]

Thank you my friend for your reply.

The SUNRA app does provide battery voltage and battery status information. However, it does not provide detailed BMS diagnostics such as individual cell-group voltages, balancing status, protection events or fault logs.

To investigate the batteries properly, I measured the individual cell-group voltages directly on the BMS balance connector. These measurements revealed significant imbalance between cell groups.

My concern is therefore not the basic vehicle information shown by the app, but the lack of detailed battery management data and communication protocol information.

Are both packs operated at the same time (in parallel)? Significant imbalance between cell groups is a problem that must be addressed.

Causes can be
1. Cells went bad
2. Cell spot welds went bad
3. Bms not balancing (less likely than 1 and 2)

 

[Voultepsis]

Are both packs operated at the same time (in parallel)? Significant imbalance between cell groups is a problem that must be addressed.

Causes can be
1. Cells went bad
2. Cell spot welds went bad
3. Bms not balancing (less likely than 1 and 2)

Thank you for your reply.

The two battery packs are not directly connected in parallel. Each pack has its own BMS and controller, and the scooter uses two independent drive systems.

What concerns me is that the SUNRA app does not provide access to individual cell voltages, balancing status, charge/discharge MOSFET status, fault logs, or any detailed BMS information. Therefore, the owner cannot monitor battery health or identify developing cell imbalance before it becomes a safety issue.

When I finally gained access to the battery data through diagnostic work, I found extreme cell-group voltage differences, including values as high as 4.70V and as low as approximately 2.16V.

Another strange observation is that the two battery packs differ by only a few tenths of a volt in total pack voltage, yet the dashboard reports approximately 18% state of charge for one pack and 86% for the other. This suggests that either the state-of-charge estimation is highly inaccurate or that there is a serious battery management issue.

In your opinion, could such extreme imbalance be caused solely by bad cells or spot welds, or would it also indicate a failure of the BMS protection and balancing system?

 

[Zambam]

With cell groups @ 4.7 and 2.16 V, the BMS should have cut power since safe low and high threshold voltages were exceeded.

I have a scooter with similar form factor as your’s. I built a LFP battery for it with a bluetooth BMS that monitors many parameters. You may want to rebuild your batteries with a bluetooth BMS if there is room.

 

[Voultepsis]

With cell groups @ 4.7 and 2.16 V, the BMS should have cut power since safe low and high threshold voltages were exceeded.

I have a scooter with similar form factor as your’s. I built a LFP battery for it with a bluetooth BMS that monitors many parameters. You may want to rebuild your batteries with a bluetooth BMS if there is room.

View attachment 389702

Thank you. I agree that a Bluetooth BMS with cell monitoring would be useful, and I may eventually replace the original BMS. However, my main concern is different. These are the original factory battery packs from a relatively new scooter. I am still waiting for a technical response from SUNRA / KING regarding why such severe cell voltage deviations occurred, whether the original BMS protection operated correctly, and whether an updated BMS or battery monitoring solution exists. So far I have not received any meaningful technical explanation like so many others SUNRA OWNERS........

 

[Zambam]

Thank you. I agree that a Bluetooth BMS with cell monitoring would be useful, and I may eventually replace the original BMS. However, my main concern is different. These are the original factory battery packs from a relatively new scooter. I am still waiting for a technical response from SUNRA / KING regarding why such severe cell voltage deviations occurred, whether the original BMS protection operated correctly, and whether an updated BMS or battery monitoring solution exists. So far I have not received any meaningful technical explanation like so many others SUNRA OWNERS........

Good luck getting answers from them. I searched "Can SUNRA ROBO-S work with non oem battery"

AI overview:
"The short answer is no, it is highly problematic. You cannot easily swap in a non-OEM (aftermarket) battery for the Sunra Robo-S due to strict proprietary digital communications and safety features in the scooter's firmware. [1, 2, 3]
The main hurdles with non-OEM batteries include:

• Battery Management System (BMS) Lockout: The Sunra Robo-S utilizes specific communication protocols (often proprietary or RS485/CAN bus) between the battery and the scooter’s dashboard and controller. If the new battery's BMS does not "speak" this exact language, the scooter's computer will lock out. [1, 2, 3]
• Incorrect LCD Readouts: Even if an aftermarket battery or a custom-built pack (e.g., custom LiFePO4) successfully outputs the correct 72V, the scooter's LCD screen will likely fail to read the voltage, resulting in a blank or incorrect battery percentage indicator. [1]"

edit: Are AI answers to be trusted? You'll have to decide. (this thread was listed as reference in its answer)

 

[Voultepsis]

Good luck getting answers from them. I searched "Can SUNRA ROBO-S work with non oem battery"

AI overview:
"The short answer is no, it is highly problematic. You cannot easily swap in a non-OEM (aftermarket) battery for the Sunra Robo-S due to strict proprietary digital communications and safety features in the scooter's firmware. [1, 2, 3]
The main hurdles with non-OEM batteries include:

• Battery Management System (BMS) Lockout: The Sunra Robo-S utilizes specific communication protocols (often proprietary or RS485/CAN bus) between the battery and the scooter’s dashboard and controller. If the new battery's BMS does not "speak" this exact language, the scooter's computer will lock out. [1, 2, 3]
• Incorrect LCD Readouts: Even if an aftermarket battery or a custom-built pack (e.g., custom LiFePO4) successfully outputs the correct 72V, the scooter's LCD screen will likely fail to read the voltage, resulting in a blank or incorrect battery percentage indicator. [1]"

edit: Are AI answers to be trusted? You'll have to decide. (this thread was listed as reference in its answer)

Thank you very much for the information.

This is exactly the issue I am trying to investigate.

I understand that the ROBO-S may require communication between the battery BMS and the scooter electronics, but I am still looking for technical evidence regarding the actual protocol used.

So far I have measured signals on the communication connector, used an RS485 interface and performed oscilloscope measurements, but I have not yet identified whether the system uses RS485, CAN bus, UART or another proprietary protocol.

My concern is that if the scooter can only operate with SUNRA-approved batteries, owners should at least have access to proper diagnostic information from the original batteries and BMS systems.

At present, the SUNRA app provides only very limited diagnostic information despite the scooter having two batteries, two BMS units, two controllers and two motors.

Any technical information regarding the communication protocol would be greatly appreciated.

 

[Voultepsis]

Good luck getting answers from them. I searched "Can SUNRA ROBO-S work with non oem battery"

AI overview:
"The short answer is no, it is highly problematic. You cannot easily swap in a non-OEM (aftermarket) battery for the Sunra Robo-S due to strict proprietary digital communications and safety features in the scooter's firmware. [1, 2, 3]
The main hurdles with non-OEM batteries include:

• Battery Management System (BMS) Lockout: The Sunra Robo-S utilizes specific communication protocols (often proprietary or RS485/CAN bus) between the battery and the scooter’s dashboard and controller. If the new battery's BMS does not "speak" this exact language, the scooter's computer will lock out. [1, 2, 3]
• Incorrect LCD Readouts: Even if an aftermarket battery or a custom-built pack (e.g., custom LiFePO4) successfully outputs the correct 72V, the scooter's LCD screen will likely fail to read the voltage, resulting in a blank or incorrect battery percentage indicator. [1]"

edit: Are AI answers to be trusted? You'll have to decide. (this thread was listed as reference in its answer)

Thank you.

This is consistent with what I have been investigating.

However, the AI overview does not identify the actual protocol used by the SUNRA ROBO-S. It only suggests that communication between the battery BMS and the scooter may be required.

My measurements indicate that communication does exist between the battery packs and the scooter electronics, but I am still trying to determine whether the protocol is RS485, CAN bus, UART or a proprietary implementation.

If the scooter is indeed locked to specific SUNRA battery packs through digital communication, this raises an important question:

Why does the official SUNRA application provide almost no battery diagnostic information?

The ROBO-S contains:

• Two battery packs
• Two BMS units
• Two controllers
• Two motors

Yet the app only reports:
✔ Battery
✔ Controller
✔ Motor

without identifying which battery, which controller or which motor is being checked.

If battery replacement is restricted by firmware and proprietary communication, owners should at least be provided with professional diagnostic access to the original batteries and BMS systems.

At present, the diagnostic information available to the owner is extremely limited for a scooter in this price range.

 

[Zambam]

• Two controllers
• Two motors

You sure about that? I thought it has 1 rear hub motor. Easily verified by looking at the wheels.

 

[Voultepsis]

You sure about that? I thought it has 1 rear hub motor. Easily verified by looking at the wheels.

What concerns me most is not only the technical issue itself, but the apparent lack of support and transparency.

Many ROBO-S owners are trying to understand and resolve legitimate battery and BMS-related problems, yet obtaining clear technical answers from SUNRA appears extremely difficult.

As customers, we have invested a significant amount of money in these vehicles. When serious battery-related issues arise, owners should not be left relying on guesswork, forum discussions and their own measurements.

This raises a simple question:

What level of technical support should customers reasonably expect from a manufacturer when documented battery and BMS abnormalities are reported?

Consumer protection regulations in many countries require products to be supported adequately and safety-related concerns to be addressed seriously.

I am still waiting for a clear technical explanation regarding the battery imbalance, the BMS behavior and the diagnostic limitations of the official SUNRA application.

Despite repeated requests for technical clarification, so far I have been met with silence.

 

[Voultepsis]

Good luck getting answers from them. I searched "Can SUNRA ROBO-S work with non oem battery"

AI overview:
"The short answer is no, it is highly problematic. You cannot easily swap in a non-OEM (aftermarket) battery for the Sunra Robo-S due to strict proprietary digital communications and safety features in the scooter's firmware. [1, 2, 3]
The main hurdles with non-OEM batteries include:

• Battery Management System (BMS) Lockout: The Sunra Robo-S utilizes specific communication protocols (often proprietary or RS485/CAN bus) between the battery and the scooter’s dashboard and controller. If the new battery's BMS does not "speak" this exact language, the scooter's computer will lock out. [1, 2, 3]
• Incorrect LCD Readouts: Even if an aftermarket battery or a custom-built pack (e.g., custom LiFePO4) successfully outputs the correct 72V, the scooter's LCD screen will likely fail to read the voltage, resulting in a blank or incorrect battery percentage indicator. [1]"

edit: Are AI answers to be trusted? You'll have to decide. (this thread was listed as reference in its answer)

Thank you for taking the time to look into this.

I agree that AI-generated answers should always be treated with caution and verified independently. However, the AI overview is interesting because it is broadly consistent with what I have observed during my own investigation.

My measurements suggest that communication does exist between the battery packs and the scooter electronics, but I have not yet determined whether the protocol is CAN bus, RS485, UART or a proprietary implementation.

My concern is not primarily the use of aftermarket batteries. Rather, I am trying to understand why owners have such limited access to diagnostic information from the original SUNRA batteries and BMS systems.

The ROBO-S contains two battery packs, two BMS units, two controllers and two motors. Yet the official app provides only very basic information and does not identify individual batteries, controllers or motors.

In my case, the two battery packs have reported dramatically different states of charge, while direct measurements revealed severe cell-group voltage imbalance. Despite providing detailed measurements, photographs and technical observations, I am still waiting for a clear technical explanation.

So far, I have been met with silence.

If battery authentication and proprietary communication are required for safety or system integration, then owners should also be provided with adequate diagnostic access to the battery systems they have purchased.

 

[Voultepsis]

With cell groups @ 4.7 and 2.16 V, the BMS should have cut power since safe low and high threshold voltages were exceeded.

I have a scooter with similar form factor as your’s. I built a LFP battery for it with a bluetooth BMS that monitors many parameters. You may want to rebuild your batteries with a bluetooth BMS if there is room.

View attachment 389702

could you sen me your email please?

 

[Voultepsis]

With cell groups @ 4.7 and 2.16 V, the BMS should have cut power since safe low and high threshold voltages were exceeded.

I have a scooter with similar form factor as your’s. I built a LFP battery for it with a bluetooth BMS that monitors many parameters. You may want to rebuild your batteries with a bluetooth BMS if there is room.

View attachment 389702

Did your original scooter battery communicate with the dashboard or controller through CAN Bus or another protocol? After installing the Bluetooth BMS, did the dashboard continue to display battery percentage correctly?

 

[Zambam]

Did your original scooter battery communicate with the dashboard or controller through CAN Bus or another protocol? After installing the Bluetooth BMS, did the dashboard continue to display battery percentage correctly?

The battery has only 2 wires +|- to the controller, which sends SOC of the battery (# of bars) to the display. Battery SOC on display was not affected after installing bluetooth BMS.

 

[Zambam]

could you sen me your email please?

There is a PM feature in the forum you can use.

 

[Voultepsis]

There is a PM feature in the forum you can use.

Thank you for your suggestion. Could you please tell me more about your setup? What brand and model Bluetooth BMS are you using (JK, JBD, Daly, or something else)? Is your scooter a SUNRA ROBO-S or a different model? Does your scooter use CAN bus or RS485 communication between the battery, controller and dashboard, or is the BMS only used for battery monitoring? Also, did you keep the original controller(s) and dashboard, and does the battery percentage display still work correctly? I am trying to understand whether the original scooter electronics still communicate with the battery after the BMS replacement, as this is one of the main concerns with the SUNRA ROBO-S. .if i follow your steps do i have to change dashboard,can i use the same existing controllers? the BMS you placed in yours what lanquage does it use?? CAN UART RS 485 ??Thank you

 

[Zambam]

Thank you for your suggestion. Could you please tell me more about your setup? What brand and model Bluetooth BMS are you using (JK, JBD, Daly, or something else)? Is your scooter a SUNRA ROBO-S or a different model? Does your scooter use CAN bus or RS485 communication between the battery, controller and dashboard, or is the BMS only used for battery monitoring? Also, did you keep the original controller(s) and dashboard, and does the battery percentage display still work correctly? I am trying to understand whether the original scooter electronics still communicate with the battery after the BMS replacement, as this is one of the main concerns with the SUNRA ROBO-S. .if i follow your steps do i have to change dashboard,can i use the same existing controllers? the BMS you placed in yours what lanquage does it use?? CAN UART RS 485 ??Thank you

BMS is JBD SP22S003AL22S40A (model seems to be discontinued)
My scooter is the Fly 7 with lead acid battery bought Dec 2021 for $950. Lead acid battery has been replaced at around 1300 miles with a DIY LFP 30 Ah battery (been working great for 2500 miles now).

 

[Voultepsis]

BMS is JBD SP22S003AL22S40A (model seems to be discontinued)
My scooter is the Fly 7 with lead acid battery bought Dec 2021 for $950. Lead acid battery has been replaced at around 1300 miles with a DIY LFP 30 Ah battery (been working great for 2500 miles now).

Thank you for your upadate.Please tell me .
When you installed your DIY LiFePO4 battery, did you connect only the positive and negative power cables, or were there also communication wires between the battery and controller?


Did the dashboard battery gauge continue to work normally after the battery conversion?

 

[Zambam]

Thank you for your upadate.Please tell me .
When you installed your DIY LiFePO4 battery, did you connect only the positive and negative power cables, or were there also communication wires between the battery and controller?


Did the dashboard battery gauge continue to work normally after the battery conversion?

Didn't I already say the battery has only 2 wires to the controller and the battery gauge continued to work? Are you a bot?

 

[Voultepsis]

Didn't I already say the battery has only 2 wires to the controller and the battery gauge continued to work? Are you a bot?

Dear friend
Thank you for the clarification.


Since your Fly 7 works with only positive and negative battery connections, do you think the same JBD BMS would also work in a SUNRA ROBO-S?


Have you ever seen a ROBO-S battery or know whether it uses any communication between the BMS and the scooter electronics?

 

[castani]

Hello everyone,

Great thread, very interesting — I'm dealing with exactly the same
issue on my SUNRA ROBO-S. About 21,000 km on the odometer, and for
the past few weeks the dashboard shows one of the two batteries
permanently at 0%. The battery itself still works fine (charges,
discharges, no warnings on the BMS when I measure cells directly).

The practical symptom is that the scooter starts every trip already
in "reserve" mode and limits me to about 50 km/h. So the controller
is clearly reacting to whatever the (faulty?) BMS is reporting —
or NOT reporting — over the communication bus.

What I've done so far:
- Multimeter + oscilloscope to identify the communication wires
between BMS and scooter controller. I believe I've mapped them
correctly.
- Just ordered a USB–RS485 adapter to capture and analyze the
protocol exchange.

Now here's the idea I'd like to put on the table, and I'd love
honest feedback — including "this won't work because X" answers:

═══════════════════════════════════════════════════════
THE PLAN: BMS RESPONSE SPOOFING
═══════════════════════════════════════════════════════

Instead of replacing the original BMS (which would mean losing
all integration with the SUNRA dashboard and app), I want to:

1. Keep the original BMS in place for its protection MOSFETs
(charge/discharge cut-off, balancing, etc.).

2. Add a small microcontroller (ESP32) that:
- Reads the actual pack voltage independently (voltage divider
+ isolated ADC, or a dedicated high-voltage sense IC).
- Reads individual cell-group voltages from the balance
connector (optional, for full diagnostic).
- Sniffs the communication bus to learn the protocol.
- Once the protocol is decoded, INTERCEPTS or REPLACES the
BMS response on the bus, sending the scooter controller
synthetic data based on real measurements.

The scooter would then see a "healthy" battery and stop the
limp-home behavior, while I keep accurate, real-time data on
my own ESP32 (with optional MQTT/WiFi telemetry as a bonus).

═══════════════════════════════════════════════════════
OPEN QUESTIONS — feedback welcome
═══════════════════════════════════════════════════════

Q1 — Has anyone here successfully spoofed a BMS response on a
similar Chinese-OEM scooter? Any "gotchas" you ran into?

Q2 — On the SUNRA / Fish20S002 / King.co LI20SN6-3-40A-WH
family, does anyone already have notes on:
- the baud rate used?
- whether it's standard Modbus RTU or a proprietary frame?
- register map (voltage, SOC, current, errors)?

Q3 — For the spoofing itself, the cleanest approach seems to be:
(a) Physically cut the BMS communication line and put the
ESP32 in the middle as a man-in-the-middle, OR
(b) Leave the BMS connected but force the ESP32 to "speak
louder" at the right moment (risky: bus collisions).
Any opinions on which is more reliable long-term?

Q4 — Anyone aware of authentication, checksums, or rolling
counters in these BMS protocols that would make spoofing
hard/impossible? Most Chinese OEM BMS I've seen use simple
CRC-16 with no auth, but I'd love confirmation before I
commit to the work.

I'm aware that another option is to simply replace the BMS
with a smart Bluetooth one (Daly, JBD, JK), which Zambam
already suggested. That's the easier path, but I'd lose the
SUNRA dashboard integration, so I want to explore the spoofing
route first.

I'll share progress and waveform captures as I move forward.
Any pointers, captures from other SUNRA owners, or "don't
bother, it won't work" warnings are very welcome.

Apologies for any rough English — I'm Italian. Cheers!

 

[Voultepsis]

Hello everyone,

Great thread, very interesting — I'm dealing with exactly the same
issue on my SUNRA ROBO-S. About 21,000 km on the odometer, and for
the past few weeks the dashboard shows one of the two batteries
permanently at 0%. The battery itself still works fine (charges,
discharges, no warnings on the BMS when I measure cells directly).

The practical symptom is that the scooter starts every trip already
in "reserve" mode and limits me to about 50 km/h. So the controller
is clearly reacting to whatever the (faulty?) BMS is reporting —
or NOT reporting — over the communication bus.

What I've done so far:
- Multimeter + oscilloscope to identify the communication wires
between BMS and scooter controller. I believe I've mapped them
correctly.
- Just ordered a USB–RS485 adapter to capture and analyze the
protocol exchange.

Now here's the idea I'd like to put on the table, and I'd love
honest feedback — including "this won't work because X" answers:

═══════════════════════════════════════════════════════
THE PLAN: BMS RESPONSE SPOOFING
═══════════════════════════════════════════════════════

Instead of replacing the original BMS (which would mean losing
all integration with the SUNRA dashboard and app), I want to:

1. Keep the original BMS in place for its protection MOSFETs
(charge/discharge cut-off, balancing, etc.).

2. Add a small microcontroller (ESP32) that:
- Reads the actual pack voltage independently (voltage divider
+ isolated ADC, or a dedicated high-voltage sense IC).
- Reads individual cell-group voltages from the balance
connector (optional, for full diagnostic).
- Sniffs the communication bus to learn the protocol.
- Once the protocol is decoded, INTERCEPTS or REPLACES the
BMS response on the bus, sending the scooter controller
synthetic data based on real measurements.

The scooter would then see a "healthy" battery and stop the
limp-home behavior, while I keep accurate, real-time data on
my own ESP32 (with optional MQTT/WiFi telemetry as a bonus).

═══════════════════════════════════════════════════════
OPEN QUESTIONS — feedback welcome
═══════════════════════════════════════════════════════

Q1 — Has anyone here successfully spoofed a BMS response on a
similar Chinese-OEM scooter? Any "gotchas" you ran into?

Q2 — On the SUNRA / Fish20S002 / King.co LI20SN6-3-40A-WH
family, does anyone already have notes on:
- the baud rate used?
- whether it's standard Modbus RTU or a proprietary frame?
- register map (voltage, SOC, current, errors)?

Q3 — For the spoofing itself, the cleanest approach seems to be:
(a) Physically cut the BMS communication line and put the
ESP32 in the middle as a man-in-the-middle, OR
(b) Leave the BMS connected but force the ESP32 to "speak
louder" at the right moment (risky: bus collisions).
Any opinions on which is more reliable long-term?

Q4 — Anyone aware of authentication, checksums, or rolling
counters in these BMS protocols that would make spoofing
hard/impossible? Most Chinese OEM BMS I've seen use simple
CRC-16 with no auth, but I'd love confirmation before I
commit to the work.

I'm aware that another option is to simply replace the BMS
with a smart Bluetooth one (Daly, JBD, JK), which Zambam
already suggested. That's the easier path, but I'd lose the
SUNRA dashboard integration, so I want to explore the spoofing
route first.

I'll share progress and waveform captures as I move forward.
Any pointers, captures from other SUNRA owners, or "don't
bother, it won't work" warnings are very welcome.

Apologies for any rough English — I'm Italian. Cheers!

My friend [amico] Very interesting approach.Bravo......

For many months I've been investigating the SUNRA ROBO-S architecture and I'm slowly reaching the same conclusion: the real mystery may not be the battery cells themselves, but the communication between the BMS and the controller.

My own measurements revealed severe cell-group imbalance and some questionable protection behavior from the original battery system. This raised an important question: is the scooter reacting to actual battery conditions, or to the information reported by the BMS?

Your ESP32 man-in-the-middle idea is therefore extremely interesting. Before replacing hardware, it makes sense to first understand what information is actually exchanged on the communication bus.

I am particularly interested in whether the controller only reads voltage, current and SOC, or whether it also expects specific status flags, error codes, counters, or other proprietary messages from the BMS.

If you manage to capture and decode the protocol, I believe it could answer many questions not only for your scooter but for all of us trying to understand how much of the SUNRA ecosystem depends on BMS-controller communication.

Please keep us updated with any logic analyzer captures, baud rate findings, frame structures, CRC details, or protocol observations. I think many owners are following this topic with great interest.

Greetings from Greece.