Skip to content

Segway ZT3 Pro

Property Value
Model scooter
Hardware ID 256 (0x100)
Server ID 10256
Commands 191
Default timeout 1000 ms
Default retry 5

Default command types

Type Value
cmd_read 1 (0x01)
cmd_readACK 4 (0x04)
cmd_write 2 (0x02)
cmd_writeACK 5 (0x05)
cmd_writeNR 3 (0x03)

Command reference

System commands

Name Cmd Index Ops Data Description
iapBegin 7 (0x07) 0 cmd 7
iapWrite 8 (0x08) 0 cmd 8
iapCRC 9 (0x09) 0 cmd 9
firmwareReset 10 (0x0A) 0 cmd 10 0B resp idx: 0

ble

Name Index Ops Data Resp Index
rBleV 1 (0x01) read 2B
rFunSupBool 80 (0x50) read 2B 80
getInfo 1 (0x01) cmd 111 (0x6F) -1B
unlockEnable 2 (0x02) cmd 111 (0x6F) -1B
rssiCali 3 (0x03) cmd 111 (0x6F) -1B
rssiSet 4 (0x04) cmd 111 (0x6F) -1B
rssiGet 5 (0x05) cmd 111 (0x6F) -1B
setConnectMode 12 (0x0C) cmd 111 (0x6F) -1B
getConnectMode 13 (0x0D) cmd 111 (0x6F) -1B
openFindMyPairBroadcast 58 (0x3A) write 1B 58
unbondFindMy 31 (0x1F) write 31
rFindMyPairBroadcast 34 (0x22) cmd 111 (0x6F) 2B 34
rFindMyBondStatus 33 (0x21) cmd 111 (0x6F) 2B 33
rFindMyLocationStatus 36 (0x24) cmd 111 (0x6F) 2B 36
rUUID 37 (0x25) cmd 111 (0x6F) 16B 37
setUUID 38 (0x26) cmd 111 (0x6F) 38
rPPID 39 (0x27) cmd 111 (0x6F) 14B 39
clearAllKeys 0 cmd 128 (0x80) 0
rFindMyStatus 29 (0x1D) read 2B 29
rFindMyEnable 32 (0x20) read 2B 32
mediaEnable 16 (0x10) cmd 111 (0x6F) 16

bms1

Name Index Ops Data Resp Index
rBMSVolt 140 (0x8C) read 2B
rBMSCur 141 (0x8D) read 2B
rBmsVer 14 (0x0E) read 2B
rBmsSOC 143 (0x8F) read 2B
rBmsRB 91 (0x5B) read 2B
rVoltage 140 (0x8C) read 4B
rBmsTmp 150 (0x96) read 4B
rBatterySN 2 (0x02) read 14B
rMaxPower 130 (0x82) read 2B 130
setMaxPower 130 (0x82) write
rBmsMoreInfoLT 234 (0xEA) read 2B 234
rBmsRemainCapacityLT 138 (0x8A) read 2B 138
rBmsManufactureDateLT 10 (0x0A) read 2B 10
rBmsEnergyThroughputLT 227 (0xE3) read 4B 227
rBmsCapacityThroughputLT 225 (0xE1) read 4B 225
rBmsCycleCountLT 89 (0x59) read 2B 89
rBmsDeepDischargeCountLT 137 (0x89) read 2B 137
rBmsExtremeUseTimeLT 245 (0xF5) read 4B 245
rBmsExtremeChargeTimeLT 247 (0xF7) read 4B 247
wSysTime 16 (0x10) cmd 43 (0x2B) 16
rTimeFull 148 (0x94) read 2B 148
setBrownOut 0 cmd 122 (0x7A) 2B 0
rBmsTmp3 249 (0xF9) read 4B 249
rChargeStatus 146 (0x92) read 4B 146
rTimeFull1000 148 (0x94) read 2B 148
rChargeStatus1000 146 (0x92) read 4B 146
rBmsCapacity 19 (0x13) read 2B 19
rBmsPN 2 (0x02) read 16B 2
rBmsTempFrequence 150 (0x96) read 16B 150
rBmsCellVolFrequence 160 (0xA0) read 0x1A 160

bms2

Name Index Ops Data Resp Index
rBMSVolt2 140 (0x8C) read 2B
rBMSCur2 141 (0x8D) read 2B
rBmsVer2 14 (0x0E) read 2B
rBmsSOC2 143 (0x8F) read 2B
rBmsCapacity2 90 (0x5A) read 2B
rBmsRB2 91 (0x5B) read 2B
rVoltage2 140 (0x8C) read 4B
rBmsTmp2 150 (0x96) read 4B
rBatterySN2 2 (0x02) read 14B
rBms2MoreInfoLT 234 (0xEA) read 2B 234
rBms2RemainCapacityLT 138 (0x8A) read 2B 138
rBms2ManufactureDateLT 10 (0x0A) read 2B 10
rBms2EnergyThroughputLT 227 (0xE3) read 4B 227
rBms2CapacityThroughputLT 225 (0xE1) read 4B 225
rBms2CycleCountLT 89 (0x59) read 2B 89
rBms2DeepDischargeCountLT 137 (0x89) read 2B 137
rBms2ExtremeUseTimeLT 245 (0xF5) read 4B 245
rBms2ExtremeChargeTimeLT 247 (0xF7) read 4B 247
rBmsCapacitys2 19 (0x13) read 2B 19
setMaxPower2 130 (0x82) write 130
rMaxPower2 130 (0x82) read 2B 130

mcu

Name Index Ops Data Resp Index
rMCUPN 16 (0x10) read 16B 16

tft

Name Index Ops Data Resp Index
rTftV 1 (0x01) read 2B
setNaviStart 0 cmd 113 (0x71) 0
setNaviInfo 3 (0x03) cmd 113 (0x71) 3
setNaviDistance 1 (0x01) cmd 113 (0x71) 1
setNaviRoad 16 (0x10) cmd 113 (0x71) 16
setNaviRoadNext 36 (0x24) cmd 113 (0x71) 36
setNaviText 56 (0x38) cmd 113 (0x71) 56
setNaviExit 255 (0xFF) cmd 113 (0x71) 255

vcu

Name Index Ops Data Resp Index
rRand 228 (0xE4) read 6B 228
rFlag 231 (0xE7) read 2B 231
rMCUCPUId 192 (0xC0) read 12B 192
rMCURand 199 (0xC7) read 6B 199
rMCUFlag 198 (0xC6) read 2B 198
active 0 cmd 87 (0x57)
rSN 16 (0x10) read 14B 16
rCtrlV 23 (0x17) read 2B 23
rMCUV 24 (0x18) read 2B 24
rBmsV 25 (0x19) read 2B 25
rBms2V 26 (0x1A) read 2B 26
rCPUId 218 (0xDA) read 12B 218
rActDate 64 (0x40) read 2B 64
rFunDisplayBool 27 (0x1B) read 2B
rFunDisplayBool2 48 (0x30) read 2B
rBool 28 (0x1C) read 2B 28
rFunBool 29 (0x1D) read 2B 29
setFunBool 29 (0x1D) writeNR
rFunBool2 30 (0x1E) read 2B 30
setFunBool2 30 (0x1E) writeNR
rFunBool3 31 (0x1F) read 2B 31
setFunBool3 31 (0x1F) writeNR
rStartSpeed 66 (0x42) read 2B
wStartSpeed 66 (0x42) writeNR
rAutoOffTime 73 (0x49) read 2B 73
setAutoOffTime 73 (0x49) writeNR 2B 73
rCustomKey 74 (0x4A) read 2B 74
setCustomKey 74 (0x4A) writeNR 2B 74
rBattery 85 (0x55) read 2B 85
rSpeed 87 (0x57) read 2B 87
rErrorCode 88 (0x58) read 2B
rWarnCode 89 (0x59) read 2B
rGearMode 90 (0x5A) read 2B
setGearMode 90 (0x5A) read 2B
rLedMode 91 (0x5B) read 2B
setLedMode 91 (0x5B) writeNR 2B
rProjectionLightMode 92 (0x5C) read 2B
setProjectionLightMode 92 (0x5C) writeNR 2B
rTailLightMode 93 (0x5D) read 2B
setTailLightMode 93 (0x5D) writeNR 2B
rPreciseMileage 94 (0x5E) read 2B 94
rLeftMileage 95 (0x5F) read 2B 95
rMileage 98 (0x62) read 4B 98
rRuntime 100 (0x64) read 4B 100
rRideTime 102 (0x66) read 4B 102
rSingleMileage 104 (0x68) read 2B
rRunningTime 105 (0x69) read 2B
rSingleRideTime 106 (0x6A) read 2B
rBodyTemp 107 (0x6B) read 2B 107
readDecMode 112 (0x70) read 2B 112
setDecMode 112 (0x70) writeNR 2B 112
openAcc 0 cmd 121 (0x79) 1B 0
closeAcc 0 cmd 121 (0x79) 2B
rChargeStartTime 75 (0x4B) read 2B 75
rChargeEndTime 76 (0x4C) read 2B 76
setChargeStartTime 75 (0x4B) write
setChargeEndTime 76 (0x4C) write
rGearED 71 (0x47) read 2B 71
setGearED 71 (0x47) write 71
rGearEDMin 67 (0x43) read 2B 67
rGearEDMax 69 (0x45) read 2B 69
rGearSR 72 (0x48) read 2B 72
setGearSR 72 (0x48) write 72
rGearSRMin 68 (0x44) read 2B 68
rGearSRMax 70 (0x46) read 2B 70
setPwd 97 (0x61) write 97
rPN 32 (0x20) read 32
setKeyPwd 113 (0x71) writeNR 113
rPwd 97 (0x61) read 97
rFoldShutdown 31 (0x1F) read 2B 31
setFoldShutdown 31 (0x1F) writeNR 31
rSupportFoldShutdown 49 (0x31) read 2B 49
setMaxSpeed 70 (0x46) writeNR 70
rEncryptionFlag 232 (0xE8) read 2B 232
rFunDisplayBool3 49 (0x31) read 2B 49
setTirePressureKnown 1 (0x01) cmd 17 (0x11) 1
rAlarmLevel 116 (0x74) read 2B 116
setAlarmLevel 116 (0x74) writeNR 116
rGearMode1000 90 (0x5A) read 2B 90
fileInfo 0 cmd 118 (0x76) 0
fileWrite 0 cmd 119 (0x77) 0
fileCRC 1 (0x01) cmd 120 (0x78) 1
setBumpyRoad 117 (0x75) write 2B 117
rBumpyRoad 117 (0x75) read 2B 117
playSound 119 (0x77) writeNR 119
setInfoBool2 31 (0x1F) writeNR 31
rInfoBool2 31 (0x1F) read 2B 31
rVoiceVolume 118 (0x76) read 2B 118
setVoiceVolume 118 (0x76) writeNR 118
setInstumentKey 46 (0x2E) writeNR 2B 46
rInstumentKey 46 (0x2E) read 2B 46
wMileage 0 cmd 95 (0x5F) 0
wSN 16 (0x10) cmd 24 (0x18) 1
rFunDisplayBool4 50 (0x32) read 2B 50
setFunBool4 47 (0x2F) writeNR 47
rFunBool4 47 (0x2F) read 2B 47
setSGear 110 (0x6E) write 2B 110
rSGear 110 (0x6E) read 2B 110
setMaintainCode 2 (0x02) cmd 17 (0x11) 2
rMaintainCode 120 (0x78) read 2B 120
rFunDisplayBool5 51 (0x33) read 2B 51
openAccTimeout 0 cmd 121 (0x79) 1B 0
rDGear 122 (0x7A) read 2B 122
setDGear 122 (0x7A) write 2B 122
setEGear 121 (0x79) write 2B 121
rEGear 121 (0x79) read 2B 121