Reverse engineering a hoverboard (with wheels) accelerometer

Discussion in 'Microcontrollers and Programming' started by Jaimesg, May 21, 2016.

  1. Jaimesg

    Jaimesg

    Joined:
    May 21, 2016
    Messages:
    7
    Likes Received:
    0
    Hi I'm trying to transform a hoverboard into something more useful. I'm trying to understand the signal that comes out of the accelerometer board, in order to simulate the same with an arduino and create a throttle. It's a one wire communication only. To understand how the device works, take a look here:



    And the communication coming from the board is this one:

    Capture waves.PNG

    And this the the gyro-accelerometer: http://www.invensense.com/products/motion-tracking/6-axis/mpu-6050/

    But the signal is passing through another micro first.
    Does it look like something you ever seen?
    - There are always 4 full cycles, maybe it's the start of a new cycle?
    - There could be 6 axis. There are 60+ bits between "starting" signals, could it be 10 per axis?

    Any idea is very appreciated.

    Regards
     
    Jaimesg, May 21, 2016
    #1
    1. Advertisements

  2. Jaimesg

    Jaimesg

    Joined:
    May 21, 2016
    Messages:
    7
    Likes Received:
    0
    I successfully copied the sequence into an arduino, but i cannot understand it. Maybe some encryption? Makes no sense to be honest. These are some of the values at the same position that make it move forward:

    0101010100111000000000111110101101100111010100000011110101101100111111101010000001111
    010101010011111110000000001110000101110110111000000111000010111011101110000001111
    01010101001110000000001111100001011101110111000000111000010111011110111000000111
    010101010011110000000001111111100001011101101110000001100001011101110111000000111
    010101010011110000000001111000010111011110111000000111000010111011110111000000111
    010101010011110000000001111000010111011111110111000000110000101110110111000000111
    010101010011100000000011111000010111011101110000001111000010111011101110000001111
    010101010011100000000011111000010111011101110000001111111000010111011011100000011
    01010101001110000000001111100001011101110111000000111100001011101110111000000111

    I also tried to change bit by bit, and in most of the cases it's not working, maybe some parity bits?

    Cheers
     
    Jaimesg, May 22, 2016
    #2
    1. Advertisements

  3. Jaimesg

    NorthGuy

    Joined:
    Mar 24, 2016
    Messages:
    53
    Likes Received:
    16
    Location:
    Northern Canada
    Is there just one wire communication or there are other wires carrying signals? If there are other wires, what do you see on them?
     
    NorthGuy, May 22, 2016
    #3
  4. Jaimesg

    Jaimesg

    Joined:
    May 21, 2016
    Messages:
    7
    Likes Received:
    0
    Hi, thanks for answering!
    Only 1 wire carrying the signal. It's an asynchronous communication, no clock.

    Regards
     
    Jaimesg, May 22, 2016
    #4
  5. Jaimesg

    NorthGuy

    Joined:
    Mar 24, 2016
    Messages:
    53
    Likes Received:
    16
    Location:
    Northern Canada
    The datasheet for the accelerometer you quoted says it supports I2C and SPI. These would require 2 wires.

    If it's one wire, it's either UART or something proprietary. It doesn't seem to be UART, as UART would typically be 1 start bit (always low) then 8 bits of data then 1 stop bit (always high), which also could be reversed, but I don't see this pattern here (doesn't mean it's not there :)
     
    NorthGuy, May 22, 2016
    #5
  6. Jaimesg

    Jaimesg

    Joined:
    May 21, 2016
    Messages:
    7
    Likes Received:
    0
    Very strange huh?
    I forgot to clarify that this is the signal coming out from a micro in the board, which only takes the signal from accelerometer. In this board there are only two components the accelerometer and the micro I was talking about.
     
    Jaimesg, May 22, 2016
    #6
  7. Jaimesg

    NorthGuy

    Joined:
    Mar 24, 2016
    Messages:
    53
    Likes Received:
    16
    Location:
    Northern Canada
    If you just want to emulate the signal, it shouldn't be difficult to simply reproduce what you see without paying much attention to what it is.
     
    NorthGuy, May 22, 2016
    #7
  8. Jaimesg

    Jaimesg

    Joined:
    May 21, 2016
    Messages:
    7
    Likes Received:
    0
    Yeah, the problem here is that I can emulate the accelerometer signal by placing it in the angle I want, but the gyroscope is a bigger problem. The main processor of the hoverboard has some type of PID inside and only with the accelerometer position it's not delivering the power to the motor it can deliver.

    I successfully emulated the accelerometer signal with an Arduino.

    Maybe I can attack directly the mosfet from the arduino with a PWMSINE, but that would be making a new full motor controller and I prefer to avoid it.

    What do you think?
     
    Jaimesg, May 23, 2016
    #8
  9. Jaimesg

    Amar Dhore

    Joined:
    Dec 2, 2015
    Messages:
    129
    Likes Received:
    12
    Location:
    New York
    If its a one wire communication, and there is no clock, it could be a PWM signal.
     
    Amar Dhore, May 23, 2016
    #9
  10. Jaimesg

    NorthGuy

    Joined:
    Mar 24, 2016
    Messages:
    53
    Likes Received:
    16
    Location:
    Northern Canada
    Another option is to re-program microcontroller. It all depends on the level of complexity. Something which looks very complex may happen to be really simple once you understand what's going on.
     
    NorthGuy, May 23, 2016
    #10
  11. Jaimesg

    Jaimesg

    Joined:
    May 21, 2016
    Messages:
    7
    Likes Received:
    0
    That would be a normal scenario, but changing only 1 bit in the data, it won't work, it might have some parity bit or if these chinese designers are crazy enough, some encryption? it looks very very random.

    Yeah this could be a possibility but I would like to avoid it, too much time to set it up and probably will burn something in the process.

    Regards
     
    Jaimesg, May 23, 2016
    #11
  12. Jaimesg

    smitthhyy

    Joined:
    Apr 16, 2013
    Messages:
    11
    Likes Received:
    0
    Location:
    Adelaide, South Australia
    What is the accelerometer board connected to?

    Could you post a couple of close up pics of both sides of the accelerometer board and any other board that it connects to?

    Is the signal a constant stream of data when the device is on or are there periods of flat line?

    My suspicion is (subject to more info like pics of the electronics and better understanding of the signals you show) you have an accelerometer, then you have a micro-controller then you have motor control which has some high current drivers then motors. The signal you are showing I suspect (great if you can mark on the pictures you upload) is between the micro-controller and the motor control part of the whole circuit. If that's the case, the information would be left motor direction, left motor speed, right motor direction, right motor speed or some order of that. If I was designing it, there would be 4 groups of interger data (8, 16 or 32 bit) for each change. This is probably correct by your statement 'There are always 4 full cycles' and 'These are some of the values at the same position that make it move forward'.

    As to encryption, highly unlikely.

    Look forward to seeing some detailed pics.
     
    smitthhyy, Jun 8, 2016
    #12
  13. Jaimesg

    Jaimesg

    Joined:
    May 21, 2016
    Messages:
    7
    Likes Received:
    0
    Hi, thanks for answering.

    There are 2 microelectronics: the main one, whichs is managing the motor control and processing all the data from 2 accelerometer boards. And a small micro in the boards that it taking the signal from the ACC, doing something with it and sending it to the main micro. These small micros don't do much, they just pay attention to some switches and maybe doing something with the LEDs too. But the main purpose is to take care of the ACC.
    If i would design this thing i would have get rid of them, why? It's a bit sense less, the ACC is sending in SPI, this is only one wire, but the added effort and complexity of the added components... very difficult to understand.

    Regards!
     
    Jaimesg, Jun 19, 2016
    #13
  14. Jaimesg

    Lah

    Joined:
    Sep 2, 2016
    Messages:
    2
    Likes Received:
    3
    Hi,
    I've done same work... with :
    * motherboard : http://gyro-service.com/cirquit-carte-mere-smart-self-balancing-wheel/17-carte-mere.html
    * daughterboard : http://gyro-service.com/accueil/23-plaquette-contacteur-semelle.html
    * and some hoverboard motors

    I've sniffed frame between motherboard and daughterboard. I've discovered it is a 9 bit UART communication at 26300kbps (1 stop bit, no parity). After I discovered frame includes an angle image that is sent (in a 16 bit signed int value ) to motherboard. I will write a readme later on github repo given below.

    Here https://github.com/OpHaCo/hoverbot/...tware/teensy_hoverboard/teensy_hoverboard.ino you will find some code to control hoverboard from an arduino (without any daughterboard if you want).
    Now I'm facing a strange issue when moving in forward direction... If you are interested we can discuss about it.

    lah
     
    Lah, Sep 2, 2016
    #14
    Kevinplaridel and PAGE like this.
  15. Jaimesg

    PAGE

    Joined:
    Sep 20, 2016
    Messages:
    2
    Likes Received:
    0
    I am very interesting in this post I try to understand the protocol between the mother board and the board with the gyroscope and I think that is I2C protocol but I suppose you are right with USART 9 bit exchange.
    Would you explain how to connect the Arduino (MEGA) and the mother board without the daughterboard.
    thanks for reply

    E PAGE
     
    PAGE, Sep 20, 2016
    #15
  16. Jaimesg

    Lah

    Joined:
    Sep 2, 2016
    Messages:
    2
    Likes Received:
    3
    Lah, Sep 21, 2016
    #16
    PAGE likes this.
  17. Jaimesg

    PAGE

    Joined:
    Sep 20, 2016
    Messages:
    2
    Likes Received:
    0
    Thanks a lot !
    But it seems to be a problem because I have no result, The signal generate with the ARDUINO and the original signal from the doughterboard seems quite different...
    My ARDUINO is a MEGA but I think it's not a question because we emulate the USART with your library..
    so I have no solution (for the moment)
    comme je suis français il est peut etre plus commode d'échanger directement ds cette langue ...
    as you like
     
    PAGE, Sep 23, 2016
    #17
  18. Jaimesg

    wayne mason

    Joined:
    Oct 3, 2016
    Messages:
    1
    Likes Received:
    0
    i have a wheelchair converted to use hoverboard wheels, it works fantastic with joystick and arduino only problem is going faster by itself, ive tryied but it stiill overspeeds, HELP
     
    wayne mason, Oct 3, 2016
    #18
  19. Jaimesg

    Kevinplaridel

    Joined:
    Dec 5, 2016
    Messages:
    2
    Likes Received:
    0

    You need a teensy 3,2 microcontroller for this. not the mega. because we need to achieve 3V for the communication. arduino mega has an output of 5V.
    Check your taotao motor control board if it is still working or fried
     
    Kevinplaridel, Dec 5, 2016
    #19
  20. Jaimesg

    Kevinplaridel

    Joined:
    Dec 5, 2016
    Messages:
    2
    Likes Received:
    0

    Hello lah, can I ask your email? I have questions in the wiring of the teensy to the motor board. You've said in your article is yellow and green, while here is red, blue, green, black. hope you can reply
     
    Kevinplaridel, Dec 5, 2016
    #20
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.