Firmware Update Protocol (IAP)¶

Firmware updates use the In-Application Programming (IAP) protocol, a sequence of dedicated commands for transferring firmware data to device modules.

Protocol documentation only

The IAP protocol is part of the BLE communication interface — any software managing Segway-Ninebot devices needs to understand these commands to handle firmware update states correctly. This page documents the protocol for interoperability purposes. No firmware images or binaries are distributed as part of this project.

IAP commands¶

Value	Constant	Description
`0x07` (7)	`CMD_IAP_BEGIN`	Start firmware update session
`0x08` (8)	`CMD_IAP_WR`	Write firmware data chunk
`0x09` (9)	`CMD_IAP_CRC`	Verify firmware CRC
`0x0A` (10)	`CMD_IAP_RESET`	Reset after firmware update
`0x0B` (11)	`CMD_IAP_ACK`	IAP acknowledgment (from device)

Update sequence¶

sequenceDiagram
    participant App
    participant Device

    App->>Device: CMD_IAP_BEGIN (0x07) — firmware metadata
    Device->>App: IAP_ACK (0x0B) — ready

    loop For each data chunk
        App->>Device: CMD_IAP_WR (0x08) — firmware data
        Device->>App: IAP_ACK (0x0B) — chunk OK
    end

    App->>Device: CMD_IAP_CRC (0x09) — verify checksum
    Device->>App: IAP_ACK (0x0B) — CRC match

    App->>Device: CMD_IAP_RESET (0x0A) — apply firmware
    Note over Device: Device reboots

Audio file transfer¶

Audio files (custom sounds) use a similar transfer protocol:

Value	Constant	Description
`0x76` (118)	`CMD_AUDIO_BEGIN`	Start audio upload
`0x77` (119)	`CMD_AUDIO_WR`	Write audio data chunk
`0x78` (120)	`CMD_AUDIO_CRC`	Verify audio CRC

IAP command detection¶

IAP responses are identified by their command byte:

def is_iap_response(cmd: int) -> bool:
    return (7 <= cmd <= 11) or (118 <= cmd <= 120)

Packet reassembly¶

When using Protocol 2 or Encryption2 variants that set needMakeUpIAPPack = true, IAP responses may arrive fragmented across multiple BLE notifications. The protocol layer reassembles them before delivering to the application.

Update priority¶

For devices with multiple updatable modules, firmware updates follow a defined priority order:

Priority	Module	Requires reset?
1	MCU (motor controller)	Yes
2	ABS (anti-lock brakes)	Yes
3	BFG (BLE firmware gateway)	Yes
4	CHG (charger)	Yes
5	BLE (Bluetooth module)	No
6	ECU (engine control)	No
7	DIS (dashboard)	No
8	BMS1 (battery 1)	No
9	BMS2 (battery 2)	No
10	BMS3 (battery 3)	No

Modules that require a reset are updated first. After each reset-requiring update completes, the device reboots and the app reconnects before continuing with the next module.