[miloniko]

Dear all!

I am already reading since 4 weeks, mostly here, how to convert my 2 scooters from circ, this is hopefully my last try

First overall: I legally bought them from a seller here in austria, with invoice. Background: circ has been overtaken by bird (you surly know that). Scooter works properly, currently with an "miniapp" directly from seller, with user and login (already posted here somewhere). My goal is, to remove the IoT System, for private use only, without GPS and sim card.

I disassembled my 2nd scooter to understand better the scooter itself. I made a documentation, hopefully it is understandable for you (pics attached).

What are the steps I thought about:
- flashing firmware - already contacted the manufacturer, seems there is no standard firmware available, meaning the scooter functionality without gps and sim
- read a lot, regarding sniffing serial data, with arduino and other hardware (TX, RX, RS485 serial data etc.). Here I need your help probably.
- read something about a serial string, what the scooter needs, to get enabled, please help here, if possible (wiring etc.)
- about coding: should not be a problem for me, I am software developer especially c and c++
- read something about unlock boxes, but seems there is no one available for my scooter type
- contacted all possible departments, beginning with circ, bird, zhenzen, picasau everyone, if they can help me, no success.

My questions:
- How would you start with this project?
- Please explain me, by telling what pic, I should try what process, especially for:
-- how to connect an arduino, for reading serial data (half duplex?), if necessary or needed
-- what wires are affected or needed?
-- what soldering points I need to consider on the mainboard itself? TX, RX, TXD, RXD, 485_A, 485_B
- Or do you have totally different ideas? I am open for every idea, without buying a new dc converter, I would like to avoid that, especially, because others will not fit refering to their dimensions (checked on aliexpress etc.) on my scooter
- Please explain me, if you can, what wire does what, where can I hook up some data avoid using gps and sim

I really hope, you can give me some advices, as I really don't know how I should go on.
One important thing, as I read some posts from basti: I am definitively a private person, no business use case here, no try to sell something like that, this is really for my personal use!!

Kr
Milo

[miloniko]

here my documentary:

[Teslaguy]

It's an Okai of some sort, very easy to convert! Just order the kit from scootunlock.eu and hook it up to the port the IOT box connects to! Then configure it on the Scootunlock.eu wifi panel and get it going!

[miloniko]

It's an Okai of some sort, very easy to convert! Just order the kit from scootunlock.eu and hook it up to the port the IOT box connects to! Then configure it on the Scootunlock.eu wifi panel and get it going!

That would be great if it would be that easy
I already contacted them, without a solution yet, that why I am pretty sure, I will need to try it by my own (I tought, hopefully you are right )

The response from them was (summarized):
- scooter_unlock: please take a pic of the dc converter (alu box)
- me: send pics of converter
- scooter_unlock: more information needed, the description should start with "ESC", so that they could tell me what unlock box. Description should stand on the side of the box.
- me: after I disassembled whole scooter, no additional sticker on it, only information like I already postet here pic 15 "Zhenzhen" etc. manufacturer.

I think without model description they cannot tell me what I would have to order.
Or do you know exactly what I should order?

Can you explain me, by calling the number of my pics (Pic X), what do you mean with:
"hook it up to the port the IOT box connects to" - where should I connect this box (if exists), for example pic 13?

Thanks man for help, it feels like we have soon a solution, we are pretty excited at home

kr
Milo

[jeppo17]

Hi Milo,

from 1 week I've received just the same model of your scooter and the mainboard are identic, H149!
(buyed from a stockhouse with regular receipt)

For the moment I'm turn around the parts to understand how it work.
The pinout of "10 pin connector" are:

a) speaker
10 SPK+
9 SPK-

b) 4 blue led on top of the steering
8 LED4
7 LED3
6 LED2
5 LED1

c) I/O button on top of the stering (1 press ON, double press light)
4 VIO2B
3 PI5

d) USB charger
2 GND
1 USB 5V

Excluding any active signal from this connector, the 8 pin connector has the bus to turn on the sccoter.
When BPS/BT/GSM are ok and the company says "OK, switch ON !!!" from this board start the signal.

Curious that the "8 pin" connector goes with his RS485 bus to the brushless controller (OK, it seems good) but also to the battery... maybe to speak with the BMS and send info to the central system of the company and undertsand the charging level of the scooter around the city.

Now I'm trying to understand all the "8 connector" pinout, for sure there is the RS485 bus (don't know RS485_V33), the 36V main power IN (+/-) and maybe "acc" is for the throttle? accellerometers? don't know....

Now I would like to sniff the RS485 and try to see what the board says....
Any update or help... is usefull!!!!!!

[miloniko]

It's an Okai of some sort, very easy to convert! Just order the kit from scootunlock.eu and hook it up to the port the IOT box connects to! Then configure it on the Scootunlock.eu wifi panel and get it going!

Why are you so sure, that it is easy to convert?
I do have intensive contact to ScooterUnlock . eu, and they are really kind and trying to help me, but they say by there own: this scooter constellation is not known by us. I should try with TX, RD reading some data, but no direct help, as you said, so again my question: how do you know so confident?

That is why I explained my problem here, in hope, that somebody can help me, or put me on the right way...

KR

[jeppo17]

I'm a newbie, maybe is available the arduino code used on other models?

[miloniko]

Hi Milo,

from 1 week I've received just the same model of your scooter and the mainboard are identic, H149!
(buyed from a stockhouse with regular receipt)

For the moment I'm turn around the parts to understand how it work.
The pinout of "10 pin connector" are:

Hy Jeppo!

Really glad to here, someone is also interested in that project - was pretty lonely here
Thanks for explantion the 10 pin connector, point c) was not clear for me for example, thanks!

Sorry for asking what is BPS? (BT + GSM are clear).

But your suggestions sound pretty logical and clear, I would agree with you totally!
I am also pretty sure, one of these pins is talking to BMS, and checking the state of the battery, and redirecting signal to dashboard showing the numbers of LEDs upside.

To help each other, please tell me, or explain me, how to begin to "sniff" on the RS485 lines, do I have to solder these 2 points A and B to arduino or any other device? The hardware stuff is little bit tricky for me - I do have better skills on software side

May I can sniff too, and lets see what you got compared to my results then.

On the other hand: I wanted to start some sniffing on bluetooth stack, because the miniprogram from the seller (only working on wechat, chinese software), is able to "activate" the scooter and I am riding, everything works great. But I do know:
- that GPS is sending signal
- SIM Card checks position
- Bluetooth connection with smartphone has to be alive, and in short distance to scooter

without these data / connections / or better say: "GO" signals, scooter will not work. and that is reason why I would try to sniff on bluetooth side, to see what signals will be sent to board - maybe then we can understand what is going on.

Hope to hear as soon as possible for you - got really motivated now

KR
Milo

[jeppo17]

Hi Milo,

I make some test with the board and RS485 bus.
With a RS485 USB converter https://www.amazon.it/Haljia-RS485-usb- ... B06Y1JTGZX and a serial analyzer ( from my side this i.e. http://www.javahouse.altervista.org/cro ... lyzer.html# ) I "heard" what the board said.. with the main 36V connected.

I receive some data, but in my case is not possibile to understand how is.
RS485 @Baud rate 9600


this is the string

"55 AA 10 12 20 01 00 00 43 AA 55"

On my side no way to know whats append on the bus.
If the board ask a reply to the battery (we are lucky, in this model tha battery is waked up and not freezed waiting a signal or a specific code as in other models...) or what.
Using the button on the steering (4 VIO2B // 3 PI5) nothing change.

If you have the running app from the chinese producer make sens to try the same thing but also with the system running !
We can check if is it possibile to see something different and if yes, try to send the same data with an external board.

From my side I want to try to use a different controller (i.e. brainpower) but in this way we loose all the onboard system (button, light etc....).

Is it possible from you to make the same test?

[jeppo17]

Hi Milo,

from 1 week I've received just the same model of your scooter and the mainboard are identic, H149!
(buyed from a stockhouse with regular receipt)

For the moment I'm turn around the parts to understand how it work.
The pinout of "10 pin connector" are:

Sorry for asking what is BPS? (BT + GSM are clear).

Gps ... typing error