9BMetrics

Protocol

The client and the Ninebot One communicate through Bluetooth Low Energy, a service and a characteristic.

The wheel starts a server which offers

• Service FFE0

who has

• Characteristic FFE1

with attributes

• Read
• Write without response
• Notify

Communication is always started by the application writing to the characteristic and answers are "notified" by the wheel varying the value of the characteristic.

The protocol seems to come from a more serial oriented one a defines some structure to commands and answers. Also answers may be spread over various variable changes so as to limit maximum answer size.

Logical structure

The model that implements the Wheel is an array of up to 256 positions which we will call variables. Each one has 16 bit value with interpretation varying according to the meaning.

Look into variables section for meaning and structure of each variable.

Block structure

Each command or answer is a packet(s) with the following structure

where

• ... Are a UInt8 array of l-2 elements
• ck0, ck1 are a checksum computed from the elements from l to the last of ...
• x55 and xAA are fixed and are Beggining of buffer
• len is the size of ... + 2
• x09 and x01 seem fixed for Ninebot One but it is not clear
• com is a command or variable.

When writing data (as when setting riding level) the x09 x01 are changed to x09 x03

To read the value of some variables the application writes a packet to the characteristic with com = number of first variable and ... is the length to read (2 * number of variables to read)

The wheel answers notifying of a variable change with blocks where com is the number of the first variable and every 2 bytes of ... represent a value of the form v = p[i+1] * 256 + p[i].

It is important to understand that answers may be split between different notifications.

An example of the communication follows :

< 55aa0309011708d3ff
> 55aa08090117303030303030b6fe55aa0409011a
> 353171ff
< 55aa0309011708d3ff
> 55aa08090117303030303030b6fe55aa0409011a
> 353171ff
< 55aa030901100ed4ff
< 55aa030901b70437ff
> 55aa080901104e324f45413157fe55aa08090113
> 35333341343595fe55aa04090116313278ff
> 55aa060901b78a18030093fe
< 55aa030901100ed4ff
< 55aa030901b70437ff
> 55aa080901104e324f45413157fe55aa08090113
> 35333341343595fe55aa04090116313278ff
> 55aa060901b78a18030093fe
< 55aa030901b70437ff
< 55aa030901100ed4ff
> 55aa060901b78a18030093fe55aa080901104e32
> 4f45413157fe55aa0809011335333341343595fe
> 55aa04090116313278ff
    

Here the application begins asking for 8 bytes (4 variables) beginning at variable 0x17. First 3 variables correspond to the Pin Code (000000) and the other variable is the version number.

From here the dialog continues.