Skip to content

Ninebot KickScooter E

Property Value
Model scooter
Hardware ID 39 (0x27)
Server ID 55
Commands 106
Default timeout 1000 ms
Default retry 5

Default command types

Type Value
cmd_read 1 (0x01)
cmd_readACK 4 (0x04)
cmd_write 2 (0x02)
cmd_writeACK 5 (0x05)
cmd_writeNR 3 (0x03)

Command reference

System commands

Name Cmd Index Ops Data Description
iapBegin 7 (0x07) 0 cmd 7 —
iapWrite 8 (0x08) 0 cmd 8 —
iapCRC 9 (0x09) 0 cmd 9 —
firmwareReset 10 (0x0A) 0 cmd 10 0B resp idx: 0

bms

Name Index Ops Data Resp Index
rMaxPower 63 (0x3F) read 2B —
setMaxPower 63 (0x3F) write — —
rBmsSn 16 (0x10) read 14B 16
rBatterySN 16 (0x10) read 14B —
rBatteryInfo 49 (0x31) read 10B —
rVerDC 23 (0x17) read 4B —
rBmsV 23 (0x17) read 2B —
rBmsDate 32 (0x20) read 2B —
rBmsInfoLowFrequence 16 (0x10) read 0x12 —
rBmsInfoLowFrequence2 27 (0x1B) read 4B —
rBmsInfoHighFrequence 49 (0x31) read 8B —
rBmsCellVol 64 (0x40) read 0x14 —
rBmsTemp 53 (0x35) read 2B —
rBMSCur 51 (0x33) read 2B —
rBMSVolt 52 (0x34) read 2B —
rBmsMoreInfo 139 (0x8B) read 2B 139
rBmsRemainCapacity 138 (0x8A) read 2B 138
rBmsManufactureDate 32 (0x20) read 2B 32
rBmsEnergyThroughput 128 (0x80) read 4B 128
rBmsCapacityThroughput 130 (0x82) read 4B 130
rBmsCycleCount 27 (0x1B) read 2B 27
rBmsDeepDischargeCount 133 (0x85) read 2B 133
rBmsExtremeUseTime 136 (0x88) read 4B 136
rBmsExtremeChargeTime 134 (0x86) read 4B 134

bms2

Name Index Ops Data Resp Index
rBattery2SN 16 (0x10) read 14B —
rBattery2Info 49 (0x31) read 10B —
rVerDC2 23 (0x17) read 4B —
rBms2Date 32 (0x20) read 2B —
rBms2InfoLowFrequence 16 (0x10) read 0x12 —
rBms2InfoLowFrequence2 27 (0x1B) read 4B —
rBms2InfoHighFrequence 49 (0x31) read 8B —
rBms2CellVol 64 (0x40) read 0x14 —
rBms2Temp 53 (0x35) read 2B —
rBMSCur2 51 (0x33) read 2B —
rBMSVolt2 52 (0x34) read 2B —
rBms2MoreInfo 139 (0x8B) read 2B 139
rBms2RemainCapacity 138 (0x8A) read 2B 138
rBms2ManufactureDate 32 (0x20) read 2B 32
rBms2EnergyThroughput 128 (0x80) read 4B 128
rBms2CapacityThroughput 130 (0x82) read 4B 130
rBms2CycleCount 27 (0x1B) read 2B 27
rBms2DeepDischargeCount 133 (0x85) read 2B 133
rBms2ExtremeUseTime 136 (0x88) read 4B 136
rBms2ExtremeChargeTime 134 (0x86) read 4B 134

ctrl

Name Index Ops Data Resp Index
active 0 cmd 87 (0x57) — —
rActDate 105 (0x69) read 2B 105
rBool 178 (0xB2) read 2B 178
rFunBool 125 (0x7D) read 2B 125
setFunBool 125 (0x7D) writeNR — —
setCruice 124 (0x7C) writeNR — 124
readCruice 124 (0x7C) read 2B 124
setDecMode 123 (0x7B) writeNR 2B 123
readDecMode 123 (0x7B) read 2B 123
lock 112 (0x70) writeNR 1B 112
unlock 113 (0x71) writeNR 1B 113
rLeftMileage 37 (0x25) read 2B 37
rBattery 180 (0xB4) read 2B 180
rSN 16 (0x10) read 14B 16
rMileage 183 (0xB7) read 4B 183
rBodyTemp 62 (0x3E) read 2B —
rCtrlV 26 (0x1A) read 2B —
rBmsV 103 (0x67) read 2B —
rBms2V 102 (0x66) read 2B —
rBleV 104 (0x68) read 2B —
rEbsStrength 115 (0x73) read 2B —
wEbsStrength 115 (0x73) writeNR — —
rStartSpeed 126 (0x7E) read 2B —
wStartSpeed 126 (0x7E) writeNR — —
rPedestrianMode 119 (0x77) read 2B —
wPedestrianMode 119 (0x77) writeNR — —
setHCali 122 (0x7A) writeNR 1B —
rLightMode 122 (0x7A) read 2B 122
setLightMode 122 (0x7A) writeNR — —
rCPUId 218 (0xDA) read 12B 218
rSpeed 181 (0xB5) read 2B —
rSpeedMode 117 (0x75) read 2B 117
setSpeedMode 117 (0x75) writeNR — —
rSpeedLimit 116 (0x74) read 2B 116
setSpeedLimit 116 (0x74) writeNR — —
setLedModel 198 (0xC6) writeNR — 198
readLedModel 198 (0xC6) read 2B 198
setLedColor1 200 (0xC8) writeNR — 200
rLedColor1 200 (0xC8) read 2B 200
setLedColor2 202 (0xCA) writeNR — 202
rLedColor2 202 (0xCA) read 2B 202
setLedColor3 204 (0xCC) writeNR — 204
rLedColor3 204 (0xCC) read 2B 204
setLedColor4 206 (0xCE) writeNR — 206
rLedColor4 206 (0xCE) read 2B 206
setBleName — cmd 80 (0x50) — —
turnOff 121 (0x79) writeNR 1B —
rBlePwd 23 (0x17) read 6B 23
setBlePwdEncrypt 23 (0x17) writeNR 2B 23
rCPUId 218 (0xDA) read 12B 218
rRand 228 (0xE4) read 6B 228
rFlag 231 (0xE7) read 2B 231
rErrorCode 176 (0xB0) read 2B —
rWarnCode 190 (0xBE) read 2B —
rSingleMileage 185 (0xB9) read 2B —
rRunningTime 186 (0xBA) read 2B —
rBatteryLight 96 (0x60) read 2B —
setBatteryLight 96 (0x60) writeNR — 96