ES-200 Electric Scooter Unlocker

Description

This project is intended to share all that has been discovered from the ES-200b scooter that was found in the river by my house. Their high tech trash, becoming a tool for the everyone.The most current versions of my firmware are available on Github @ https://github.com/chappy1978/ES200-Scooter-Unlocker
There is two versions Master and Final. Master is a working version that is not being currently updated and Final is a production version that I am working to create extra features like flashing lights But it looks so much prettier. At this time I would us the Final version it has a speed increase not available on the master.

Details

https://github.com/chappy1978/ES200-Scooter-Unlocker

The system that the Electisan F350 e-scooter is built on a basic STM32 platform. The motor controller is based on a the venerable STM32F103C and the display controller is a STM8. Sadly the manufacture in china locked up the firmware. The GPS tracker is based on the nRF52840 and was not locked. So the firmware is included below. The tracker is manufatured by Comodule and the FCC was so kind to include some great photos.

https://fccid.io/2AQHSF0010003/Internal-Photos/Internal-Photos-4348312

Once the potting is removed there is pads exposed for the SWD nRF52 (six pins) and the SPI flash chip. (four tiny pins) ISSI IS25WP064A Pinout to be included later. On the GPS tracker there is a SARA-R412M cellular modem. That I have been told is a real pain to use.

Diagnostic Codes
01E ~ High current protect
02E ~ Low voltage protect (battery or cHigh current protect)
03E ~ High voltage protect (controller problem)
04E ~ Locked motor protect
05E ~ Controller problem (MOS burned)
06E ~ Controller problem
07E ~ Motor problem
08E ~ Motor OT
09E ~ Throttle problem
10E ~ Brake problem (Usually broken brake lever)
11E ~ Signal transmission problem (controller problem)
12E ~ Signal transmission problem (controller problem)
13E ~ Cannot communicate with BMS

15E ~ Unknown

Files

ES200_ESP32_Mod.zip

Updated version based on C++

Zip Archive - 35.52 MB - 12/10/2021 at 10:59

Download

CM Sharing 2.1.pdf

Adobe Portable Document Format - 379.27 kB - 12/01/2019 at 22:27

Preview

IMG_0440.jpeg

JPEG Image - 1.90 MB - 12/01/2019 at 22:26

Preview

Working scooter.jpeg

JPEG Image - 296.43 kB - 12/01/2019 at 22:26

Preview

Scooter_Starter.ino

This is the Basic Arduino Nano project to start the ES200 scooter

ino - 575.00 bytes - 12/01/2019 at 22:03

Download

Components

1 × ESP32 Adafruit Huzzah32 but any one would do.

1 × DC/DC Buck Convertor LM2596 Module

1 × Julet Plug Aliexpress

Project Logs

Collapse

Modified Version
Mr. Spriggs • 12/10/2021 at 11:13 • 2 comments

I added a modified version that has a lot of extra things going. Its written in C++.
New Speed increase
Mr. Spriggs • 01/09/2020 at 14:26 • 1 comment

A new speed increase has been finally uncovered for the ES-200. This command has been applied to the Final version of the Scooter Unlocker for the ESP32. https://github.com/chappy1978/ES200-Scooter-Unlocker/tree/Final Happy hunting
And a Big Thanks to Wileok for doing the hard work and finding the command.
Production Version
Mr. Spriggs • 01/06/2020 at 13:56 • 0 comments

I have branched of the GitHub library to two versions. The master branch is a stable version not being updated and Final is going to be the production version with all the extra options to make it as simple to use a possible. Hope everyone enjoys.
Github Repository
Mr. Spriggs • 01/01/2020 at 13:44 • 2 comments

So this project has been migrated to a Github repository. Hope everyone will enjoy.
Going to Github
Mr. Spriggs • 12/30/2019 at 22:39 • 0 comments

The project is getting difficult to maintain with just using Hackaday.io Im going to migrate the project to Github. So I can share the newest versions.
Low Power Mode Here we come.
Mr. Spriggs • 12/30/2019 at 01:35 • 0 comments

Ok The Holidays are suck. Oh ya Im not here to bitch. So Ive got an updated ESP32 with bluetooth that can code select any and all known codes. So you can ride along on the fly and switch from granny mode to a whooping 13 mph with flashing headlights and all. Just need to type in a decimal number from 0-255 on the smartphone of your choosing and test to you hearts content. Im going to put it on Hackaday. For all the cool kids in the know. If you don't read the ten thousand time I put the link in the forum. Still no luck on the speed. I think a more complex solution will be required. Something along the lines of reprogramming the STM8 in the headstock and adding bluetooth which is cool and a pain in the ass.
So nexts is a couple of lessons learn. The ESP32 sucks the mA hard. 100 ma running full power. So when compiling use the 80 mhz setting, set the flash to 40 mhz. And if there is a tech savvy soul to be found, kill one of the cores. Ive gotten mine down to about 50-60mA with a low power of 20mA. That not including the draw on the buck convertor.
My next goal is to have a low power mode. But that it won't be a problem much longer. The low power needs a way to wake it up to turn on the bluetooth radio. Im trying to decide if it will be a touch pad to wake it up like all the new kids toys or have it wake up every so often and look for a BLE connection. Or even a little mix of the two.
Also for the nano diehards that want to build something similar to my code. You can use a HM-05 Bluetooth module and the RemoteXY website to make your own forked version. It can work I just don't have the time to do it. It will need a SoftSerial setup for the bluetooth. It should not be much more than a cut and paste job.
Testing on a moving scooter today.
Mr. Spriggs • 12/20/2019 at 22:53 • 0 comments

Now that I have the bluetooth working and Im pretty sure that this code won't break the scooter. I got to tested out the controls in motion. Which it is lots of fun running around with a iPhone in my brake hand. Trying to get a scooter going as fast as I can. It starting to seem like the top speed for this motor controller is 13 mph. I found out I can make the headlight turn on/off and even flash. Make the scooter go slow as dirt. And some even make the MPH on the LCD turn on and off. Not sure what the point of that is, maybe something to do with MPH/ KPH. What the best news is that 0xFF is the fastest accelerating setting. The little wheel even squeaked off the line.
Command Structure Testing
Mr. Spriggs • 12/20/2019 at 13:53 • 0 comments

Today I got the code working to send test commands to the scooter motor controller. This is some of the rules the command system seem to follow.
- It looks like the commands need to be sent twice for them to take effect.
- The keep alive command/ Kill will over write all other commands.
- The commands you want to keep working need to be sent repeatedly to keep working, every 10 sec is OK.
None of this has been tested on a running scooter. (i.e. don't want to kill my ride) So I can't tell you if the motor is operational.

As for the commands Ive gotten something to happen
0x02 Causes headlight to flash and a loss of the LCD
0x03 Causes headlight to flash and LCD is still working
0x04 None
0x05 Turns on Scooter
0x06 Causes headlight to flash and a loss of the LCD
0x07 Causes headlight to flash, LCD is still working, MPH is lit.
0x08 None
0x09 Causes headlight to turn off, LCD is still working, MPH is lit.
0x0A Causes headlight to flash and a loss of the LCD
0x0B Causes headlight to flash and a loss of the LCD
0x0C None
0x0D Causes headlight to turn off, LCD is still working, MPH is lit.
0x0E Causes headlight to flash and a loss of the LCD
0x0F Causes headlight to flash, LCD is still working, MPH is lit.
Interesting Data Output
Mr. Spriggs • 12/19/2019 at 17:20 • 0 comments

So when I type in commands into my remote for ESP32 the motor controller spits back hex data. It easier on the eyes in decimal so here a little to look at
Keep alive command
19 38 20 0 44 213 0 82 0 0 80 0 0 7 0 0 255 1 153 186 0 158 0 0 0 0 0 0 32 0 2 100 17 16 16 18 255 255 255 148 127
Turn off
19 38 20 0 44 213 0 82 0 0 80 0 0 16 0 0 255 1 153 186 0 158 0 0 0 0 0 0 32 0 2 100 17 16 16 18 255 255 255 148 1
Notice the highlighted numbers is on and off. Other commands seem to change the last third fourth and fifth digits. Also adds a bunch more data to the response.
19 38 20 0 44 213 0 82 0 0 80 0 0 16 0 0 255 1 153 186 0 158 0 0 0 0 0 0 32 0 2 100 17 16 16 18 255 255 255 202 197 255 255 255 255 255 255 3 255 0 154 36 255 20 162 51 255
The last digit in the string is the checksum Im guessing.
BLE Remote Commands
Mr. Spriggs • 12/18/2019 at 20:47 • 0 comments

The remote commands software is working. I can send commands to the motor controller from my iPhone which is pretty cool. I haven't yet figured out any interesting commands that I can figure. The keep alive command keeps stepping on the commands I send. For example I send a command to the motor controller the LCD flashes the response. But as soon a the keep alive timer send a command the last command is over written. I really need a working GPS to monitor and see how commands are sent over a long period of time. Ahh a project for another day.

View all 18 project logs

Build Instructions

Collapse

How to connect an Arduino Nano to the ES-200B

To get the ES-200b working you need to cut the exposed wires from the GPS tracker. Warning these wires have different color codes depending if you are going to cut it before or after the waterproof plug. For my scooter I cut it on the GPS tracker side. On the other side the Black and Red wires are still the same. the BTN wire is yellow and the TX is blue I believe.

The Black is ground (GND) The red wire is the VIN 42 volt from the battery. The Blue is called the BTN and this is just to turn on the motor controller. It requires a constant 3.3v. The yellow is TX and will need to be connected to the RX of the Nano. The green is the RX line and is not required but I hooked it up anyways just in case you want some input from the motor controller.

So the first step is to hook up a Buck convertor to the Red (VIN) and black wires (GND) this will step down the relatively high voltage from the battery to something the Arduino can use. Because the battery is 42v you will need a special Buck Convertor that can handle all that voltage. I used an LM2596 based convertor board from amazon. A XL7015 type break out might be a better choice. Make sure to adjust the voltage below 5v. Now connect the Arduino ground to the buck convertor and the buck's + to the Arduino's VIN

Next connect the yellow TX of the tracker to the Arduino's RX pin. Now connect the Blue (BTN) wire to pin number 5 on the arduino or more simply to the Arduino 3.3v out. Last upload the included arduino .ino file to the nano and away you go.

If you cant get a hold of buck convertor right away its OK to connect the arduino to a USB battery. That will do the trick.

Discussions

Martin wrote 03/25/2024 at 06:14

Hello,

Thank you for your good work. Now I can ejoy my ride.

Little difference I had to connect green wire to TX too.

But there is one little problem. Can you help me with charging? I have 42V 1500mA charger from old howerboard. If I connect it directly to battery output, it charges, but I believe it is not OK. But if I connect it to charging port, nothing is happening.

There are two bigger and two smaller pins in connector, but only the two bigger are connected.

I think at least one of smaller ones have to be connected. Isn't it? But how?

Help if you can, please.

Are you sure? yes | no

frederick wrote 11/11/2023 at 21:54

Hi there) I have a new Okai es 200d, but it is blocked by the manufacturer. Please tell me, is it possible to revive him? Or throw it in the trash? Thanks with gratitude)))

Are you sure? yes | no

ComputerIlliterate23 wrote 11/07/2023 at 13:22

update: I figured out how to get the updated code for esp32 on GitHub loaded onto the chip, ( atleast I think…Arduino IDE says finished loading) unfortunately RemoteXY won’t connect to the esp32. It won’t even show up as BLE device.

The scooter deck lights have not shut off still???? And the wheel is still unlocked.

Even after connecting the esp32 again with the updated code.

I’m ordering security torx bits so I can get to the controller and battery to try unplugging it. See if there is a reset button???

I tried plugging in charger and the charger shows it’s charging but the scooter screen is not indicating that it’s charging.

Omg!!! I really hope nothing is messed up beyond repair…

Are you sure? yes | no

ComputerIlliterate23 wrote 11/05/2023 at 23:53

hi, to be blunt and to the point I know almost nothing about coding/ programming etc. and I’m only ok at wiring/ the hardware side of things.

I came across a Bird Zero and took on this project, I finally figured out how to connect my generic ESP32 Wroom to my computer and am pretty sure I got the basic Arduino ino. File loaded onto it. I had to use a multimeter to figure out the pins on the female Julet plug, cus the gps was removed prior to me getting it and I’m not sure of the wire colors because pin outs I’ve found online are contradicting so I have to guess.
With the position tab at 12 o’clock when I connect the pin at the 7 O’clock (Blue ? BTN) to 3.3v and the pin at 5 O’clock (Yellow? Tx) to Rx0 the deck lights turn on and will stay on as long as I hold the wires on the esp32 breakout. The screen does not turn on and nothing else happens. I tried different combinations when connecting wires and there is no effect when I do that.

Tried original orientation on wires now deck lights stuck on even after unplugging esp32

Do I need to try the other RX Pin??? Is the code I loaded onto the chip bad? Please help!!!

Are you sure? yes | no

yacyd wrote 10/27/2023 at 08:22

Hello,

does this Mod work on es-100 boards?

Are you sure? yes | no

Howdoken wrote 09/04/2023 at 08:18

I need the step by step for the esp32 route if anyone?

Are you sure? yes | no

Howdoken wrote 09/04/2023 at 08:17

green to tx blue to rx yellow to a5 worked for me

Are you sure? yes | no

Janek wrote 09/02/2023 at 17:46

Hi! I tried to run by Bird scooters with STM32F controller (checked). I compiled the scooter_starter.ino with error, so I changed "Serial1" to "Serial" and it helped. So as instruction tells, I connected the arduino nano to scooter in GPS plug, power it with external battery and succefully sent ".ino". But nothing happends... Only when I disconnect and connected again arduino, ligts blinked for less than 1 second and that's all...

Once, when I connected arduino, the motor lock released for ±10 seconds and lights were lighting, but screen was't working. After 10 seconds lights turned off and motor lock turn on again.

I found in comments here other vesrion of code, so I sent it to arduino, but again, nothing happends, only lights blinked once shortly.

I also tried to change the colors of wires (RX, TX, BTN), but it not helped too.

You can see my scooters "tanks" in profile and background photo.

If it's imporant, I'm using copy of arduino uno - NANO V3 ATMEGA328PB CH340.

Thanks for any hlep!

Are you sure? yes | no

Janek wrote 09/02/2023 at 17:59

Scooters are saved from scrapping. The seller said they were withdrawn from use and blocked by the operator.

Are you sure? yes | no

Howdoken wrote 09/04/2023 at 08:15

green to tx blue to rx and yellow to a5 worked for me

Are you sure? yes | no

Janek wrote 09/09/2023 at 08:16

I tried all combinations, none helped...

What type and brand of scooter do you have? Was it locked by operator?

Are you sure? yes | no

Janek wrote 09/10/2023 at 15:00

Okay, problem solved! I conected to the wrong pins in arduino...

TX must be TX1 on the long side of the Arduino. I connected it to TX on the shorter side and it serves something else. When I corrected it, the scooter started immediately!

Are you sure? yes | no

Michal wrote 01/29/2023 at 00:01

ahoj scháním LCD panel

Are you sure? yes | no

crabcakes wrote 08/28/2022 at 01:31

Anyone know where to get a charger for the scooter itself?

Are you sure? yes | no

Mr. Spriggs wrote 08/28/2022 at 01:37

amazon. https://www.amazon.com/gp/product/B07SJF1ZFX/ref=ppx_yo_dt_b_search_asin_title?ie=UTF8&psc=1 They stopped selling this one but these are the specs

Are you sure? yes | no

crabcakes wrote 08/28/2022 at 01:59

Awesome, thanks!

Are you sure? yes | no

Steven wrote 08/19/2022 at 18:44

So I have a es200B and i have gotten the ardunio nano script to work and successfully turn on the scooter. I went ahead and tried the esp32 route and got the script to load and remote xy to work but i am stuck there. The scooter will not turn on when given the unlock command. When i plug it into the charger and send the unlock command, i get error code 10e and 12e. Any ideas as to what i am doing wrong?

Are you sure? yes | no

fabriziodeagostini20 wrote 08/20/2022 at 17:59

ciao stefano sto lavorando su un es 200 d script per nano piu sblocco velocita come te vorrei passare alla soluzione finale tramite esp 32 ho scaricato i file di github ma non riesco ha capire come caricarli su esp 32 potresti aiutarmi a capire come

Are you sure? yes | no

mountainman2992 wrote 09/24/2022 at 23:47

did you overcome this?

Are you sure? yes | no

holec.g wrote 06/10/2022 at 09:06

Hello, very nice job.

I have a quesion, i have Buck convertor to the Red (VIN) and black wires (GND)

https://fr.aliexpress.com/item/33025917509.html?spm=a2g0s.9042311.0.0.27426c372oO2Zs

I connect it on an ESP32 whithin RemoteXY code. All done ! The ES200 D is running very well.

The problem appear after 3 weeks. The red wire dont have any voltage between black and red...

I have a second scooter for spare, the same issue on some weeks... 2 controllers KO whith

this connection. I suspect the Buck conertor. But i don't know why?? Have tou an idea? when i charge the scooter,

the display shows the load and no error but whatever I communicate with the RX pin of the controller like before nothing happens, the scooter don't turn on. :-(

thx for reading and may be helping.

Are you sure? yes | no

Mr. Spriggs wrote 06/10/2022 at 13:25

Hmm, Send me some photos of the wiring job and I will look at it. If there is no voltage from the Juliet plug on the VIN & GND then there is a real problem. Maybe the Buck Convertor is damaging the scooters motor controller.

Are you sure? yes | no

holec.g wrote 06/22/2022 at 21:41

Hello,

Thx for your reply.

I posted my wiring job as a profile picture.

In the meantime I found on a forum a person who reprogrammed the STM32 of the controller. so I disked the box and removed the silicon and flashed the microcontroller without error (https://www.scooterhacking.org/forum/viewtopic.php?f=10&t=655). the red wire on the box don't have 38v ;-(

Mains charging still works without errors on the screen but no ignition of the scooter

Are you sure? yes | no

Datacorp Technology wrote 06/04/2022 at 20:08

Good evening everyone my name is Patrick and I have been looking for the speed mod for the Augment es210 scooter for a long time, could you help me? kind enough to send me the instructions, thank you very much everyone, wish everyone a good evening.

Are you sure? yes | no

fzudema wrote 05/25/2022 at 08:24

Anyone know where to access the battery on an ES-200G?

Are you sure? yes | no

Mr. Spriggs wrote 05/25/2022 at 12:59

Getting to the battery is a really b$#@. You have the take the scooter completely apart to get at it. Are you trying to remove it? Because the best way to control it is thru the GPS box wires.

Are you sure? yes | no

fzudema wrote 05/25/2022 at 13:19

Thanks for your response my man. I am trying to "reset" the scooter as I am getting errors 09 and 10 as you can see in my first post a few comments down..No idea if this would work but I thought unplugging and reconnecting the battery might be worth a try. I managed to wake the scooter and the wheel unlocked, but then the lights went out after 2 minutes or so and these errors appeared for the first time and are now staying. Do you have another idea? The history of the scooter is that its my personal MyTier which stopped working suddenly (probably bluetooth issue since I can't connect my phone to unlock it) even though it is mechanically in perfect shape. Tier, the shitty company that it is, is giving me the finger saying they don't repair nor send out replacement parts, so I have a 650€ piece of high tech junk that has a tiny bluetooth error thus ready for the trash..

Are you sure? yes | no

fzudema wrote 05/28/2022 at 14:23

I am actually trying to do what you recommended this guy on here: https://scootertalk.org/forum/viewtopic.php?t=6284&start=470 ("pull the battery to the ESC"

Are you sure? yes | no

fzudema wrote 06/15/2022 at 07:35

I could really use your input..

Are you sure? yes | no

Roman Beránek wrote 02/28/2023 at 12:26

Errors 09 and 10 indicate a broken connection between one of the levers (its Hall effect sensor) and the LCD controller. Unplugging a battery won't do a thing.

Are you sure? yes | no

lupindawulf wrote 05/21/2022 at 01:12

Anyone here on discord working on one of these scooters projects? Add me LupinWulf#4719

Are you sure? yes | no

Denis73d wrote 05/21/2022 at 05:33

the theme is dead

Are you sure? yes | no

Denis73d wrote 05/19/2022 at 04:42

Remove the digit 1 after Serial in all lines

Are you sure? yes | no

tommicek69 wrote 05/18/2022 at 13:00

Hello gentlemen,
I have a problem loading the Scooter_Starter.ino code into Arduino nano. Unfortunately, the original records are not available with us and I only have a clone of Arduino nano. The PC finds my Arduino, but writes me an error when compiling the code: Serial1.write (0xA6); Serial1 'was not declared in this scope
Does anyone know where the buried dog is?

Thank you

Are you sure? yes | no

fzudema wrote 05/16/2022 at 20:57

OK so I just almost popped some champagne after trying out the "simple Arduino Starter" script on my ES-200G and my scooter actually turned on! This was the first script that did it (I have no idea what I'm doing). Anyway after a minute or so the lights on my scooter turned off and won't turn on again. Plugging in the power supply it first showed error code 09E, now it shows 10E. Any idea how I can proceed? This is greatly appreciated!

Are you sure? yes | no

Denis73d wrote 05/16/2022 at 08:51

how to overcome error 05E

Are you sure? yes | no

lupindawulf wrote 05/11/2022 at 05:38

If there is anyone willing to help me out with this, I would appreciate it, I am not the most tech savy but I am a quick learner. We can do discord Voice chat and screen share, message me if you would be willing to help

Are you sure? yes | no

ES-200 Electric Scooter Unlocker

Description

Details