HOW I HACKED SELF BALANCING SCOOTER

I'm a touch of a hardware fan; I want to assemble little circuits with sensors and microcontrollers. I've
assembled a remotely-oversaw garden, cooler/icebox temperature controller, LED world guide
incorporated with Nagios, a daisy-wheel that prints ASCII craft of photographs tweeted to it, and a lot of
different toys. I'm additionally a colossal motorsports fan, so I was quite energized when I found the
Power Racing Series at Maker Faire. It's an electric kart race where groups apparently begin with a
Power Wheels-type toy electric vehicle and soup it up. Hoverboards for Kids UK The financial limit for
vehicles is really low, however, just $500. So I set out to locate the most dominant and propelled
engines accessible at the least expense.

Ferdinand Porsche, the elite car constructor, once said "The ideal dashing vehicle crosses the end goal
first and thusly falls into its segment parts." The end product in electric vehicle hustling ought to be "The
ideal electric hustling vehicle crosses the end goal first and hence blasts into blazes." Enter the Self-
Balancing Scooter, some of the time called a "Hoverboard." Official Hoverboards for KidsThey have two
350-watt 3-stage DC engines (as far as possible in the challenge is 1440 watts, so 4 engines will just not
wear out the circuit!) with lobby impact sensors, an engine controller with 12 control MOSFETS (most
likely designed as 6 half-H spans; 3 for every wheel), two gyrator loads up, a few LEDs, and a Bluetooth
sound module and little speaker for your tunes. Here's an intriguing application note about how a
comparative 3 stage DC engine controller works.

I prowled on Craigslist for half a month until I found a shabby utilized 10" model with 1 punctured tire
and "doesn't adjust" yet the two engines work for 90 bucks. I decided on the 10" model for two reasons.
Initially, it has pneumatic tires, which will go about as a small piece of suspension to improve tire
contact during cornering and retain knocks. Second, I accept that the hardware are the equivalent
between the 6.5", 8", and 10" model so if the emptied top speed is the equivalent regarding revolutions
every second, the 10" model, having a bigger wheel measurement, will have a higher top speed. I
HOW I HACKED SELF BALANCING SCOOTER
affirmed the hypothetical top speed by account a moderate movement video on my iPhone and
checking the turns. I tallied 12 pivots for every second, which converts into a top speed of generally 21.4
MPH. Brilliant!

Dismantling is very simple; there are a lot of other teardown aides out there so I'll save the insight
concerning this part. What I'm keen on is what the gadgets in there resemble and how they speak with
one another, so I can figure out how to control the engines with my own product.

Close-up of the snooper for the correspondence.

Tests go to the degree, jumper wires go to

either the rationale analyzer or the Arduino

Here's an explained photograph of my test seat with the parts revealed. The one we are keen on is from
the engine control board to the detachable gyro sheets; the associations from the mainboard are 4-wire
JST connectors. So as to snoop on the correspondence, I wired the engine control board to one of the
gyro sheets through a breadbord, and took advantage of each stick with my 'scope. The external wires -
dark and red - are typically ground and voltage supply. +14.4V is provided from the engine control board
to the detachable, The internal two wires uncovered a computerized example at 3.3V.

I put in a couple of hours flatulating around on the oscilloscope attempting to interpret what was
happening, however likewise with numerous occupations, there is a reason fabricated apparatus that
makes the undertaking of translating a paired sign a whole lot simpler. Segways for Kids UK I found a
Logic Analyzer for under $12. Furnished with the phenomenal, free, and open Sigrok devices and the
PulseView GUI, I got the opportunity to work attempting to decipher the convention.
HOW I HACKED SELF BALANCING SCOOTER

Top follow demonstrates transmission from gyro board, base follow indicates transmission from engine
control board.

First to make sense of the encircling convention before attempting to comprehend the information
inside it. Since it's just 2 wires, my essential up-and-comers are i2c, servo engine control (PWM), and
nonconcurrent sequential (UART). As a matter of first importance, we should take a gander at our bit
lengths. As a matter of course, on both advanced channels, all sign are products of 38 microseconds.
That standards out Pulse-Width Modulation, so it is anything but a servo/stepper type controller. In the
event that it were I2C, one of the lines would demonstrate a wavering clock signal during information
transmission on the other, however the two lines appear to have signal in lumps of up to 10 38-
microsecond bits, neither of which are a clock. So it's not I2C. How about we check whether we can
make sense of if it's a UART.

A case of equality blunders in 8E1 setup

In the event that each piece time is 38 microseconds, that gives a bitrate of ~26315 BPS, which is
exceptional; more often than not you'll see 9600, 19200, 115200, or something to that Official Segways
for Kids

effect. There are 9 bits between the begin and stop bits, so it must be either 8 bit with equality or 9 bits.
I attempt each

mode (even, odd, mark/one, space/zero) in the decoder and they all outcome in countless equality
mistakes. So it's presumably 9-bit with no equality. To affirm that this microcontroller can do that mode,
a speedy take a gander at some STM32 preparing materials about their USART demonstrates that they
HOW I HACKED SELF BALANCING SCOOTER

have programmab le baud rate

and 9-bit sequential. In the wake of fixing a bug in the sigrok UART decoder to make 9-bit unraveling
work, I can see the estimations of the bits being sent in the two headings!

The UART decoder setup menu

Razor IMU

Since I am truly certain that I know what the confining is, how am I going to speak with the engine
control board? For my first pass, I choose to attempt to parody the gyro board - simply send back the
majority of the information that I caught in my first follow, and check whether it controls the engine the
equivalent. I burrow around for a board that I can use to send 3.3v UART, and locate a 3.3V FTDI USB
converter appended to a Razor IMU from an old destroyed bike telemetry venture. Immaculate, the
FTDI is a UART and perhaps I can utilize it to speak with the engine control board! So I update pyserial on
my PC and get to hacking. I realize I have to send 9-bit sequential at a peculiar baud rate, so first I check
the baud rate capacity - Apple incorporated a FTDI driver with their more current Mac OS forms that
doesn't bolster odd baud rates, however the FTDI rendition does. Simple fix. Next issue; POSIX doesn't
bolster 9-bit sequential, yet this sharp individual made sense of that the MARK and SPACE equality
modes can send a ninth piece based on your personal preference; 1 while in MARK mode and 0 while in
SPACE mode. Sadly, the tcsetattr() call to set this parameter isn't executed on Mac OS and on Linux it
HOW I HACKED SELF BALANCING SCOOTER
appears to take several milliseconds - I don't know how the board will respond to a hole that enormous -
the vast majority of the holes in

correspondence on my follow are on the request of 100 microseconds. So I will require another
arrangement.

FTDI USB-Serial

Maybe the least difficult path is to bit-blast the port utilizing the SoftwareSerial Arduino library. The
main 3.3V Arduino board I had was the Razor IMU, which is fundamentally an Arduino Pro Mini 3.3v
with a gyro, accelerometer, and magnetometer, and two or three free sticks presented for me to
connect to the engine control board. I made some snappy adjustments to SoftwareSerial to send and get
9 bits and tried the yield on the degree. It worked, I see a begin bit, 9 information bits, and after that a
stop bit!

The following test is to stack the bit information from the follow onto the Arduino so as to play it back to
the engine control board. To do that, I expected to make a variety of 16-bit ints to store the 9 bit
numbers. I utilized this straightforward shell order:

$ sigrok-cli - I trace1.sr - P uart:baudrate=26315:num_data_bits=9:format=dec - A uart=rx-information |

tr '\n' ','

0,508,0,0,0,0,170,256,70,0,70,0,170,256,70,0,70,0,170,256,72,0,72,0,170,256,72,0,72,0,170,256,71,0,71
,0,170,256...

This gave me a pleasant comma-isolated rundown of 9-bit numbers that I could just glue into the
Arduino code and include props when it and dole out it to a cluster. It was too huge to even consider
fitting into RAM (around 10,000 16-bit digits) so I advised the Arduino to compose it to streak just with
the PROGMEM mandate. I had Hoverboards for Kids the option to play back the recorded bits utilizing
this technique. I controlled on the bike and began the program with bedeviled breath. Loads of blaring
and.. a touch of turning! Not actually the fiery revolution that I had recorded the hints of, yet the
engines were unmistakably getting *some* directions.

A follow demonstrating gatherings of 13 9-bit outlines

HOW I HACKED SELF BALANCING SCOOTER
My response when it didn't work

Now I'm scratching my head. For what reason isn't playing back the information yielding
indistinguishable outcomes from when it was recorded in any case? I can find in my 'scope that the
confining looks right, however I don't have any thought what the direction arrangements are. Possibly
there is a basic planning segment to the dividing of the directions? So I spend kids Segways UK some
time taking a gander at the holes between the edges in PulseView. I see a 300us hole each thirteenth
casing. Possibly this is what I'm searching for! I change my Arduino code to delay a couple of hundred
microseconds after the each thirteenth casing. It looks directly on the degree, however no
improvement.

Nothing is working the manner in which I figure it ought to be. I'm totally flummoxed. My hypothesis is
that the photograph interruptors send a lock or open order so the engines won't turn when somebody
isn't remaining on it, and I'm not catching that code appropriately. So I choose to take another follow
with the rationale analyzer, under quite certain conditions - photograph interruptors obstructed the
entire time, engine forward and invert for just a couple of moments. On the off chance that there's an
open code from the photograph interruptor, it should play at the earliest reference point. When I take a
gander at the new follow, I see an example that I didn't see previously. After the primary couple of
casing - which seem, by all accounts, to be a test/instatement example of 010101010 (note: I attempted,
this isn't the open succession I was searching for), there is a plainly rehashed 6-outline arrangement

with a constantly ind istinguishable first and last

edge. There I