Reverse engineering the Laotie Ti30 scooter LCD display

One thing about these types of electric vehicles is that there is very limited care for normalisation, when it comes to allow different components to interoperate. Especially in respect to the digital communication between the parts of the system, one cannot expect any baseline currently.

This is not by any means surprising, as manufacturers are by nature resistant to seek normalisation when there is no direct business case to justify it.

As I could not find any information from the vendor regarding how the LCD screen of my scooter communicates with the speed controllers, and because I was curious and interested in knowing how feasible it would be to in the future integrate this LCD with a different speed controller, I decided to do this analysis on my own.

The first step was to remove and open the LCD display. While it is not the same and has no model identification on it other than the reference JPY803B in the PCB  (the only thing that I know is that it belongs to the Jipin manufacturer, sometimes also labelled as J&P or JP), it is externally very similar to the QS-S4 display. Internally the board is different and the micro-controller chip has a different identification on it.

Removing it is quite simple. Only the two upper Allen screws need to be removed, and the unit is released. 

Then it is necessary to pop off the lid in the back. The latter protects the board and hides a 6-pin connector.

Because the throttle is based on a Hall effect sensor, there is no physical connection to the interior of the unit. The lever is just a piece of plastic containing a magnet embedded into it. As the lever is tilted, the magnet is moved away from the sensor. This approach has the advantage that if an external magnetic field is brought into proximity of the sensor, it will have a negative effect on the signal and at most reduce the throttle. On the other hand if the lever would fall off (however unlikely that might be), the resulting signal would be equivalent to applying full throttle.

There is one Allen screw that keeps the throttle lever in place, and under it there is a spring to keep tension and allow the lever to return to the original position when the user releases it.

This lever needs to be removed first, in order to remove the cover of the unit. After removing all of the screws, the board can be separated. 

There aren't many components present. The most notable are the micro-controller (marked as C001G2 - it appears to correspond to the Renesas R7F0C001G 16-bit micro-controller):

And also the DC/DC converter which is based on a XLSEMI XL7026E1:

It is a pretty versatile device, as it is adjustable and tolerates a maximum of 100 Volts of input voltage. Even though this LCD unit is normally powered from the 67.2 Volts battery supply, I was able to run it successfully at 12 Volts. Considering the specs on the electrolytic capacitors at the input, it is likely that this LCD display can be powered from a 72 Volts battery without much of a problem.

Even though the unit has an USB port, it is clear that because of the maximum current of this DC/DC converter, this port should not be used for devices that will draw more than the 500 mA, as it could fry this converter (it is rated for a maximum of 600 mA, and the consumption of the board itself should also be factored in - while running the board from 12 Volts, it consumed about 31 mA, which means that at the 5 Volts output, the current should be very close to 75 mA, leaving only about 525 mA of budget at most, for the USB port).

As "always" there are things to point out in terms of the quality of the assembly. Again, just like the scooter itself, these are parts built on a very tight budget and lead times. The first thing was one of the two parts of the USB socket casing that was left unsoldered:

That was a quick fix.

The second aspect I only spotted after cleaning the board with isopropyl alcohol and figuring out with a magnifier that I had accidentally removed a bodge solder bridge that seems to have been done because of poor PCB etching (which left a trace open). Upon testing the device without putting the bridge back in place, a few segments in one of the digits would not appear on the LCD.

I've soldered back the bridge and protected it with a drop of epoxy resin.

Next, I aimed towards getting more information on the 6-pin connector. Thankfully, the indications on the silkscreen were self-explanatory.

From there I quickly identified the following pinout:

• Red - 60 Volt positive input (P+);
• Orange - 60 Volt output (when turned on) (DMS);
• Black - GND (P-);
• Green - Hall Effect sensor output (HE);
• Yellow - RX;
• Blue - TX;

Next to the connector inputs, I could identify the 3-pin Hall Effect sensor. It is basically a 49E linear position sensor.

I could confirm that its output pin is routed directly to the green HE output wire. This means that in principle, as with other e-Scooter configurations, the throttle signal is sent independently from the digital communication that takes place via the serial port.

While testing the LCD outside of the scooter, I measured the sensor signal varying between 0.7 and 3.8 Volts as I pressed between 0 and full throttle. The measured low value is a slightly more conservative than the value reported by the manufacturer, but the conditions (i.e. strength of the magnet and proximity to the sensor) might contribute to the differences.

The case actually has an open slit in order to minimize the distance between the sensor and the magnet on the throttle lever. This adds another potential water ingress point, which is a shame because the use of the hall effect sensor instead of potentiometers is a good approach for a more reliable and weather proof solution. I would be tempted to seal the slit with epoxy, but there is a slight chance it can cause an offset in the signal range, and I have no idea if these speed controllers have any form of recalibrating the throttle.

Now that I knew the pin assignments, my next objective was to figure out something more about the serial communication. As such I first connected this LCD display to a 12 Volt power supply, and tapped into the TX pin of its serial port (blue wire) with an oscilloscope. I could see that as the device is turned on, it continuously tries to send messages:

Next in order to figure out more about these messages, I tried connecting that TX pin to a USB serial converter set for 5 Volts TTL levels.

Because another user had success with the similar QS-S4 LCD display (more details here), by inspecting the transmission occurring at 1200 bps, I decided to start with the same bit rate (although I could have inferred it from analysing the signal captured on the oscilloscope, I was lazy and tried that first). And, surprisingly the received frames seemed consistent in format with the messages that this user obtained with his QS-S4.

There are 14 bytes of data and 1 byte of checksum in each frame (I could confirm the checksum is correct in each frame). The sequence 0x01 0x03 appears to be a header/preamble (haven't confirmed if on shutdown, in this device a frame starting in 0x00 0x03 is also sent).

The only varying bytes (and here the display was not connected to the scooter) were byte 2, which appears to be the sequence number of the frame, and byte 5 which contains values that vary in a seemingly random pattern. Byte 7 (value 0x46) and byte 10 (value 0x02) don't vary and are consistent (could be a coincidence) with the P08 parameter (0x46 = 70%) and the current speed setting at the time.

In a next iteration I will be tapping the communications while the LCD display is connected to the speed controllers, and try to figure out more information about the communications protocol and the meaning of the fields in each frame.