ZT3 support, ideas

[MacintoshKeyboardHacking]

ZT3 is different from other x3s because the VCU and BLE are on the same pcb and with a more limited display.

my idea for the "ultimate" F3/G3/GT3 mod is an all-in-1 ESP32S3 touchscreen LCD that can completely replace the stock display, fit within the existing waterproofing, and found on Amazon for ~$30. If not replacing the stock display, user data can still be shown on the TFT by modifying communications. For inputs, spare GPIOs could parallel existing button connections on VCU, or software can parse BLE messages like "cruise control not allowed"

the module should constantly poll various ECU registers and an IMU/accelerometer, track min/max/average values per trip; storing detailed (time stamped) values of the last 5-10 rides as well as long-term average statistics. This data could be fed realtime to a more capable display device over wifi, bluetooth, or hardwire SPI. myBLEv4 already serves an HTML page and pushes realtime speed, voltage and temperature values to it; I'm sure a talented web css/javascript dev could make something beautiful. https://github.com/MacintoshKeyboardHacking/segMod/blob/main/myBLE4/example/myBLEv4-BMS.png https://raw.githubusercontent.com/MacintoshKeyboardHacking/segMod/refs/heads/main/myBLE4/example/segMod-BMS.html

I see a definite application for a 'second box' (raspberry Pi) doing video capture with telemetry overlay > h264 compression, gps track with ecu parameter logging, perhaps also some mobile entertainment like an SDR, ota TV tuner and media storage available through WiFi hotspot. If the box has a display, I think 'rearview camera' would generally be the most useful - though I would primarily want to record a high-quality front camera footage (gopro via hdmi).

---

In the case of the ZT3, where a display would be a big upgrade, you really could do it all with a single Pi... at least on the other x3s, the BLE has nothing to do with actually driving the scooter - so performance is never 'critical'. I'm running my ESP32 underclocked to 80MHz and I still get like 2000 loop()s a second

if we don't want the stock display we probably don't need the BLE at all; this guy claims to have fully re-implemented the Segway bluetooth crypto in python - https://codeberg.org/NootNooot/ I haven't gotten it working yet, all my good Linux boxen have been too old software. He's working on an eMoped in the EU so some of his descriptions don't apply to us

[hamed-ta]

That's interesting. Does that mean we still need to sniff the communication between the BLE and VCU, or are they both implemented in the same ARM microcontroller, making that impossible?

What if we sniff the communication between the motor controller and the VCU (is that UART?) Would there be any useful data to intercept, or is it too low-level?

Regarding the BLE being already re-implemented: I tested other apps that can connect to the ZT3 BLE. They don't do much, just setting speeds for different modes and adjusting the location. There might not be much data communicated between the BLE and the app over Bluetooth that we can intercept for useful functionality.

I like the idea of a single Pi and a rich display; however, I would like to keep the existing functionality intact as much as possible.

[MacintoshKeyboardHacking]

The VCU (an Artery AT32 chip) speaks to the BLE (a BesTech 2600 module) via serial which is what I've been working with. On the ZT3 both are on the same board, other x3 models the BLE is a separate board plugged in.

The VCU speaks to the motor controller via CANbus. I was able to monitor this with a Raspberry Pi and a MCP2515 module but it was a little over my head ;) There are 'speed unlimit' cables sold on AliExpress that bypass limits; but reports I've seen say they work by hacks like dividing the actual speed by 2 and side-effects like constant "over speed" alarm beeping.

[hamed-ta]

In that case, it should be easy to sniff both at the same time with an ESP32. We can use BLE communication for most tasks and intercept the CAN bus for anything not visible via BLE. I will give it a try as soon as I find some time.

[MacintoshKeyboardHacking]

My ZT3 dashboard arrived, I've been searching where to access the UART.

The (1.8 volt !) NB-100 "console" UART is labeled TX/RX along the edge of the board, but on other models that only provides access to the 'NBOS' console; Interesting to see the boot process, but I didn't find anything useful there on my GT3. It looks like the VCU UART might be module pins 8 and 12 but I haven't verified yet.

The CANbus is where all the action is! If you can read/modify/write in real time, you can unlock any performance option. I connected first to it on my scooter; the file https://github.com/MacintoshKeyboardHacking/segMod/blob/main/logs/cancap-1755982298.pcap.gz was captured with tcpdump but I didn't know how to parse it.

[hamed-ta]

I agree that CANBus is the primary source for the highest control, but also intercepting BLE-VCU UART at the same time provides more control, I have planned to add the second thumb throttle to control regen brake, similar to Apollo scooters, the regen brake messages should be injected into BLE-VCU bus. I’ve ordered an ESP32-C6 because it has two TWAI/CAN controllers. I’m creating a basic app to enable sniffing and intercepting both buses. Will get to the parsing later.

The TX and RX pins appear to be just the debug ports? It’s strange that it operates at 1.8 volts, while the Artery MCU uses 3.3 volts.

[MacintoshKeyboardHacking]

found the UART @3v: remove the 120 ohm resistors indicated on the display side of the board to separate the BLE/VCU. You can find the UART @1.8v on the NB-BT100 module pins 8 (TX) and 12 (RX)

After disconnecting the BLE I was surprised to find that the display still worked- I guess the VCU handles that.

I ordered some TJA1051 transceivers to try monitoring from the ESP32, previously I had used an MCP2515 SPI interface on the Pi. A single interface should be enough to monitor and control, you'd only need the second to mitm.

[hamed-ta]

That's a good finding about the UART bus between the BLE and the VCU. I will start from there, though I am not sure I will get much out of it. It is probably good for monitoring, but not that good for configuration. Have you tried to see what is being sent on the UART bus? I have also ordered a few TJA1051/3 transceivers for a CAN MITM.

[MacintoshKeyboardHacking]

an update; it works! Specific pinout:
ESP32 BLE UART2 TX (5) ----- ESP32 BLE UART2 RX (6)
ESP32 VCU UART1 RX (4) ----- ESP32 VCU UART1 TX (3)

Some notes on the LED display connection... you can see in the picture I installed 2.0mm headers: a 5pin + 2x 2pins. But the display seemed to work fine after when reconnecting only the 5pin connection.

I de-soldered everything from the VCU board, but next time I think I'd just cut (or desolder) the 2x 2pin connection pins, bend the display up to make the UART connection and then bend it back.

regarding changing the regen braking, I added some code that monitors the selected drive-mode and turns regen off in Eco and on in drive/sport/race modes; it seems to work on my F3/GT3. A different technique will be needed to ZT3 though; because the VCU drives the LED display directly, the same speed/gear information is not subscribed by the BLE. I think disabling the BLE entirely (remove power or hold in reset) should be a goal for this platform, then it should be possible to parallel the existing UART connection without removing the display.

[hamed-ta]

As for regen, I think the BLE still subscribes to drive-mode because when we configure it using the handlebar buttons, it reflects in the app in real-time. However, what I meant for regen braking is adding a new throttle to push and control how much the scooter activates the regenerative power so that we can use it as a brake. I think I won't be able to do that using only the BLE/VCU UART given the ZT3 architecture; I should intercept the CAN bus for that purpose.

[MacintoshKeyboardHacking]

In my use-case I have an F3; it goes 20 mph and the single front brake feels dangerous. I ordered another brake lever; the same VCU is used with dual-brake F3, I wonder if connecting the sensor will be enough to activate any engine brakeing or I will need to do something similar to your CAN bus idea.

I also wonder if something could be done in analog; removing the sensor cable from the existing brake, using a secondary lever, but adjusting the voltage or resistance to increase the regen braking effect...? Similar, I've wondered about adding a parallel capacitor to my GT3 Pro throttle to ease the drag when suddenly releasing it.

Anyway I wish there was an easier way to interface ZT3 then under the LED display... If you only want to monitor you could use two 1.8v capable serial ports on the BLE pins 8 and 12, that might be enough if you're able to transmit CAN commands.

It may be easiest just to disable the stock BLE anyway, I've gotten the ESP32 detected and receiving data from the Segway app; should be fully working soon, although I haven't tested firmware updates.

[hamed-ta]

As for F3 brake, as far as I know, Segway handles regenerative braking differently from other brands. It appears that when the brake sensor is activated, the VCU, depending on the level of regenerative braking configured in the app, activates the regenerative braking system. I’m considering reading the new level analog voltage with an ESP32 and sending the proportional regenerative values to the motor controller. This should precisely produce smooth braking without using mechanical brakes. It should work the same way for F3.

I believe the sensor in the mechanical brake level is simply an on/off switch. The voltage level or resistance doesn’t matter for it.

[markovicmilosmk-bot]

The brake levers use a hall since i know when i was installing hydraulics i byppased that and made it just an off/on switch bassically with few resistore and a trimpot for adjusting the engine brake intensity when i clicked the hydraulic levers.

[MacintoshKeyboardHacking]

excellent idea! I planned to try connecting ESP32 analog inputs in parallel with the 3wire hall sensor; they're fed 5V but I read somewhere their output is limited to 3.3v levels.

I did some test today with my F3, disconnecting the mechanical brake cable from the handle. There is certainly a jolt when the e-brake first engages, especially with the KERS regen disabled, but the braking power is definitely variable.

[markovicmilosmk-bot]

This project amazed me i would love to try anything on my zt3 since i do have spare displays in my shop and would like to make some esp32 display with a better ui and much more info then the stock lcd

[MacintoshKeyboardHacking]

an enhanced ZT3 display could offer so much! On my F3, I've found seeing the realtime motor wattage is pretty cool, and there are a lot of temperature sensors too. The ZT3 is hard though... the UART connection points are under the LED, and the stock LED display is driven by the VCU instead of the BLE as in other models. There seems to be a lot of space though; if someone could design a complete ESP32 display replacement it would be awesome.

Software wise, the other x3 scooters have the BLE subscribe to realtime updates of speed, battery, indicators, etc., from the VCU; presumably the ZT3 still includes this functionality, I'm planning to test this soon