Reverse engineering a hoverboard (with wheels) accelerometer

[Jaimesg]

Hi I'm trying to transform a hoverboard into something more useful. I'm trying to understand the signal that comes out of the accelerometer board, in order to simulate the same with an arduino and create a throttle. It's a one wire communication only. To understand how the device works, take a look here:

And the communication coming from the board is this one:



And this the the gyro-accelerometer: http://www.invensense.com/products/motion-tracking/6-axis/mpu-6050/

But the signal is passing through another micro first.
Does it look like something you ever seen?
- There are always 4 full cycles, maybe it's the start of a new cycle?
- There could be 6 axis. There are 60+ bits between "starting" signals, could it be 10 per axis?

Any idea is very appreciated.

Regards

 

[Jaimesg]

I successfully copied the sequence into an arduino, but i cannot understand it. Maybe some encryption? Makes no sense to be honest. These are some of the values at the same position that make it move forward:

0101010100111000000000111110101101100111010100000011110101101100111111101010000001111
010101010011111110000000001110000101110110111000000111000010111011101110000001111
01010101001110000000001111100001011101110111000000111000010111011110111000000111
010101010011110000000001111111100001011101101110000001100001011101110111000000111
010101010011110000000001111000010111011110111000000111000010111011110111000000111
010101010011110000000001111000010111011111110111000000110000101110110111000000111
010101010011100000000011111000010111011101110000001111000010111011101110000001111
010101010011100000000011111000010111011101110000001111111000010111011011100000011
01010101001110000000001111100001011101110111000000111100001011101110111000000111

I also tried to change bit by bit, and in most of the cases it's not working, maybe some parity bits?

Cheers

 

[NorthGuy]

Is there just one wire communication or there are other wires carrying signals? If there are other wires, what do you see on them?

 

[Jaimesg]

Is there just one wire communication or there are other wires carrying signals? If there are other wires, what do you see on them?

Hi, thanks for answering!
Only 1 wire carrying the signal. It's an asynchronous communication, no clock.

Regards

 

[NorthGuy]

The datasheet for the accelerometer you quoted says it supports I2C and SPI. These would require 2 wires.

If it's one wire, it's either UART or something proprietary. It doesn't seem to be UART, as UART would typically be 1 start bit (always low) then 8 bits of data then 1 stop bit (always high), which also could be reversed, but I don't see this pattern here (doesn't mean it's not there

 

[Jaimesg]

The datasheet for the accelerometer you quoted says it supports I2C and SPI. These would require 2 wires.

If it's one wire, it's either UART or something proprietary. It doesn't seem to be UART, as UART would typically be 1 start bit (always low) then 8 bits of data then 1 stop bit (always high), which also could be reversed, but I don't see this pattern here (doesn't mean it's not there

Very strange huh?
I forgot to clarify that this is the signal coming out from a micro in the board, which only takes the signal from accelerometer. In this board there are only two components the accelerometer and the micro I was talking about.

 

[NorthGuy]

If you just want to emulate the signal, it shouldn't be difficult to simply reproduce what you see without paying much attention to what it is.

 

[Jaimesg]

If you just want to emulate the signal, it shouldn't be difficult to simply reproduce what you see without paying much attention to what it is.

Yeah, the problem here is that I can emulate the accelerometer signal by placing it in the angle I want, but the gyroscope is a bigger problem. The main processor of the hoverboard has some type of PID inside and only with the accelerometer position it's not delivering the power to the motor it can deliver.

I successfully emulated the accelerometer signal with an Arduino.

Maybe I can attack directly the mosfet from the arduino with a PWMSINE, but that would be making a new full motor controller and I prefer to avoid it.

What do you think?

 

[Amar Dhore]

If its a one wire communication, and there is no clock, it could be a PWM signal.

 

[NorthGuy]

What do you think?

Another option is to re-program microcontroller. It all depends on the level of complexity. Something which looks very complex may happen to be really simple once you understand what's going on.

 

[Jaimesg]

If its a one wire communication, and there is no clock, it could be a PWM signal.

That would be a normal scenario, but changing only 1 bit in the data, it won't work, it might have some parity bit or if these chinese designers are crazy enough, some encryption? it looks very very random.

Another option is to re-program microcontroller. It all depends on the level of complexity. Something which looks very complex may happen to be really simple once you understand what's going on.

Yeah this could be a possibility but I would like to avoid it, too much time to set it up and probably will burn something in the process.

Regards

 

[smitthhyy]

What is the accelerometer board connected to?

Could you post a couple of close up pics of both sides of the accelerometer board and any other board that it connects to?

Is the signal a constant stream of data when the device is on or are there periods of flat line?

My suspicion is (subject to more info like pics of the electronics and better understanding of the signals you show) you have an accelerometer, then you have a micro-controller then you have motor control which has some high current drivers then motors. The signal you are showing I suspect (great if you can mark on the pictures you upload) is between the micro-controller and the motor control part of the whole circuit. If that's the case, the information would be left motor direction, left motor speed, right motor direction, right motor speed or some order of that. If I was designing it, there would be 4 groups of interger data (8, 16 or 32 bit) for each change. This is probably correct by your statement 'There are always 4 full cycles' and 'These are some of the values at the same position that make it move forward'.

As to encryption, highly unlikely.

Look forward to seeing some detailed pics.

 

[Jaimesg]

What is the accelerometer board connected to?

Could you post a couple of close up pics of both sides of the accelerometer board and any other board that it connects to?

Is the signal a constant stream of data when the device is on or are there periods of flat line?

My suspicion is (subject to more info like pics of the electronics and better understanding of the signals you show) you have an accelerometer, then you have a micro-controller then you have motor control which has some high current drivers then motors. The signal you are showing I suspect (great if you can mark on the pictures you upload) is between the micro-controller and the motor control part of the whole circuit. If that's the case, the information would be left motor direction, left motor speed, right motor direction, right motor speed or some order of that. If I was designing it, there would be 4 groups of interger data (8, 16 or 32 bit) for each change. This is probably correct by your statement 'There are always 4 full cycles' and 'These are some of the values at the same position that make it move forward'.

As to encryption, highly unlikely.

Look forward to seeing some detailed pics.

Hi, thanks for answering.

There are 2 microelectronics: the main one, whichs is managing the motor control and processing all the data from 2 accelerometer boards. And a small micro in the boards that it taking the signal from the ACC, doing something with it and sending it to the main micro. These small micros don't do much, they just pay attention to some switches and maybe doing something with the LEDs too. But the main purpose is to take care of the ACC.
If i would design this thing i would have get rid of them, why? It's a bit sense less, the ACC is sending in SPI, this is only one wire, but the added effort and complexity of the added components... very difficult to understand.

Regards!

 

[Lah]

Hi,
I've done same work... with :
* motherboard : http://gyro-service.com/cirquit-carte-mere-smart-self-balancing-wheel/17-carte-mere.html
* daughterboard : http://gyro-service.com/accueil/23-plaquette-contacteur-semelle.html
* and some hoverboard motors

I've sniffed frame between motherboard and daughterboard. I've discovered it is a 9 bit UART communication at 26300kbps (1 stop bit, no parity). After I discovered frame includes an angle image that is sent (in a 16 bit signed int value ) to motherboard. I will write a readme later on github repo given below.

Here https://github.com/OpHaCo/hoverbot/...tware/teensy_hoverboard/teensy_hoverboard.ino you will find some code to control hoverboard from an arduino (without any daughterboard if you want).
Now I'm facing a strange issue when moving in forward direction... If you are interested we can discuss about it.

lah

 

[PAGE]

I am very interesting in this post I try to understand the protocol between the mother board and the board with the gyroscope and I think that is I2C protocol but I suppose you are right with USART 9 bit exchange.
Would you explain how to connect the Arduino (MEGA) and the mother board without the daughterboard.
thanks for reply

E PAGE

 

[Lah]

Hi,
Here is a README about connecting mother board to Teensy 3.1/3.2 without original daughterboard.
https://github.com/OpHaCo/hoverbot
Lah

 

[PAGE]

Hi,
Here is a README about connecting mother board to Teensy 3.1/3.2 without original daughterboard.
https://github.com/OpHaCo/hoverbot
Lah

Thanks a lot !
But it seems to be a problem because I have no result, The signal generate with the ARDUINO and the original signal from the doughterboard seems quite different...
My ARDUINO is a MEGA but I think it's not a question because we emulate the USART with your library..
so I have no solution (for the moment)
comme je suis français il est peut etre plus commode d'échanger directement ds cette langue ...
as you like

 

[wayne mason]

i have a wheelchair converted to use hoverboard wheels, it works fantastic with joystick and arduino only problem is going faster by itself, ive tryied but it stiill overspeeds, HELP

 

[Kevinplaridel]

Thanks a lot !
But it seems to be a problem because I have no result, The signal generate with the ARDUINO and the original signal from the doughterboard seems quite different...
My ARDUINO is a MEGA but I think it's not a question because we emulate the USART with your library..
so I have no solution (for the moment)
comme je suis français il est peut etre plus commode d'échanger directement ds cette langue ...
as you like

You need a teensy 3,2 microcontroller for this. not the mega. because we need to achieve 3V for the communication. arduino mega has an output of 5V.
Check your taotao motor control board if it is still working or fried

 

[Kevinplaridel]

Hi,
I've done same work... with :
* motherboard : http://gyro-service.com/cirquit-carte-mere-smart-self-balancing-wheel/17-carte-mere.html
* daughterboard : http://gyro-service.com/accueil/23-plaquette-contacteur-semelle.html
* and some hoverboard motors

I've sniffed frame between motherboard and daughterboard. I've discovered it is a 9 bit UART communication at 26300kbps (1 stop bit, no parity). After I discovered frame includes an angle image that is sent (in a 16 bit signed int value ) to motherboard. I will write a readme later on github repo given below.

Here https://github.com/OpHaCo/hoverbot/...tware/teensy_hoverboard/teensy_hoverboard.ino you will find some code to control hoverboard from an arduino (without any daughterboard if you want).
Now I'm facing a strange issue when moving in forward direction... If you are interested we can discuss about it.

lah

Hello lah, can I ask your email? I have questions in the wiring of the teensy to the motor board. You've said in your article is yellow and green, while here is red, blue, green, black. hope you can reply