Recycling Lime Rental Scooters for Personal Use
TL;DR In 2018 I reverse engineered the "brain" of the Lime Gen 2 rental scooter, then built a cheap replacement board that turns a retired scooter into a personal one. I sold 50+ of them as kits through word of mouth. This post is adapted from a talk I gave about it. Slides here.
Backstory: the first rental scooters
Bird was the first company to bring these kick-style rental scooters to market, in 2017. They used a consumer scooter, the Xiaomi Mi M365, and replaced a single part: the controller in the box on the handlebars.
That controller, the "bird brain," has all the smarts. It's basically an Android phone repackaged to fit on a scooter, with GPS, GSM for a mobile connection, and usually Bluetooth and WiFi. Everything that tracks the scooter lives in the brain. The stock Xiaomi controller just ran the scooter itself: motor, speed display, battery health, and so on.
It didn't take long before people learned how to recycle these scooters for their own use. You could replace the bird brain with a $10 controller from AliExpress. It was trivial: peel off a sticker, remove some hex screws, plug in the new brain, and you have a ~$400+ scooter.
The Lime Gen 2
But this project is about the Lime Gen 2 released in early 2018. By then the scooter companies had figured out that they needed tougher, more tamper-resistant hardware. Lime learned from the lessons of Bird and used security Torx among other things.
I found a Lime Gen 2 half submerged in Lake Merrit in Oakland. It had clearly been abandoned by the company. So I decided to take it home for an autopsy. Which started this whole project. The design is basically the same as the Xiaomi, but more customized, and the brain couldn't just be swapped for something off the shelf.
Inside, though, it looked familiar. There was a single cable with four wires that connected the brain to the rest of the scooter: power, ground, TX, and RX. The pink arrow below points to it. If I could figure out what went over those wires, maybe I could make my own replacement Lime brain. And maybe I could stop some of these scooters from ending up in a landfill.
The plan
I'd never done anything like this, and honestly I didn't have much of a plan. It seemed like it should be possible, so I decided to take it one step at a time and worry about making a board later.
The first thing I wanted to know was, what does brain send to the scooter? Unfortunately my water logged scooter was brain dead, so I couldn't use it. However, I knew that with care, I could non-destructively disassemble a working scooter on the street. As shown in the slide my plan was:
- Figure out what the brain does
- Get a scooter (easy)
- Capture the brain-to-scooter communication (medium?)
- Interpret the data (hard??)
- Replay the data to impersonate the brain (???)
- Make a board to replace the brain (?????)
Capturing the data
To see what the brain was saying, I needed a logic analyzer: a device you clip onto the wires that lets you record the signals.
I made a "shim" for the logic analyzer so that I could plug in between the brain and the scooter. The process was physically non-destructive however there was something I hadn't accounted for: if the brain gets unplugged from the scooter, when it is plugged back in, it boots into a different mode. In this mode you can't activate the scooter from the app. It needs to be restarted somehow by Lime. My initial attempt was a failure but educational.
So I tried again. I got some special probes for the signal analyzer, they are designed to grab the wire and poke thin needle through the sheath into the copper. This let me probe the wires without disconnecting them. I and got everything set up as shown in the slide. The scooter had an annoying alarm that would go off every time it was jostled.
I paid for the scooter with the app, and captured signal the power-on signal, braking, throttle, the alarm, and power-off signal. Then the scooter was put back together safely returned to the wild in perfectly functional condition.
Making sense of it
I took the capture to hardware hack night at Sudo Room, a hackerspace in Oakland. I showed someone the picture of the signal and they immediately recognized it as UART, a plain serial protocol.
That made things much easier. I used PulseView to capture the data. It's also able to visualize and decode data. I applied a UART decoder to a capture and export the decoded packets with timestamps. I wrote a Python program that parsed that export and generated another Python program that sent the same messages, with the same timing, over serial. To connect my laptop to the scooter I used an FTDI adapter, which sends serial over USB.
Next I needed another non-waterlogged scooter to test on. I found scooter missing it's brain within 2 days abandoned in a field in West Oakland. I wired this up to the FTDI adapter, and began trying to replay my data. I first just replaying the captured data and it didn't work. I actually tried it twice with the two signal wires switched because I wasn't sure which was TX and which was RX.
Having the replay be a standalone Python program was convenient because I could add and remove parts and test send sending different packets to scooters.
I went back out and captured more data from scooters in the wild a few more times.
After staring at the data long enough a simple pattern emerged.
The messages sent from the brain to the scooter were almost the same every time, and the differences were in bytes the scooter didn't seem to care about.
There was a startup sequence, a keep-alive message that literally contains the string lime_bike (it isn't a bike?), and a shutdown sequence.
Eventually the scooter turned on, but while tethered to my laptop.
Making a board
I can't ride a scooter very well with my tied to it, so I needed a board. r got an Arduino uno, and ported the Python to Arduino code, it was about 300 lines. I got this working, but the Arduino needed a power source. The scooter provides 42 volts, a lot more than the Arduino needs. I did what seemed like the easiest thing and bought an adjustable buck converter from Amazon. This let me step the voltage down to power the Arduino.
I packaged it all up in a container like the ones fresh mozzarella comes in, with a special cable salvaged from another Lime brain (more on cables in a bit).
It worked, but it wasn't great:
- It could be cheaper: The Arduino + buck converter combined were over $20.
- The buck converters were not reliable. They kept burning out while I rode.
- It was bulky.
- It required cutting up a cable from a Lime brain for it's connector.
Bringing my product to market
For the next iteration, I wanted something smaller, cheaper, and that could be reliably powered by the scooter.
Back at Sudo Room, there was a pile of hundreds of unpopulated circuit boards built around an ATtiny85, which is programmable with the Arduino toolchain.
With a lot of help, we sketched out a circuit that could make those boards work.
Power was, to me, the most difficult part: the scooter supplies 42 volts but the ATtiny85 needs 5 volts. With the help of the hackers at Sudo Room we figured out a solution used a blue LED, because blue LEDs drop exactly the voltage we needed. The LED, a capacitor, and a resistor together do the job. I wish I understood how this worked better
The board also needed a button to turn the scooter on and off, wired to one of the chip's pins. The scooter cable's wires connect to pins through the board too. The yellow wire goes unused: it's how the scooter would receive messages, and we only need to send. This worked! My first real circuit board.
I had almost everything I needed for a "kit" that I could give to people. I bought a bunch of buttons, capacitors, LEDs, resistors, ATtiny85 chips, and sockets. The one thing missing was the cable.
The cable
Users could, in theory, make a cable by soldering or splicing wires to the scooter, but that is an annoying and error prone process. Without a cable, the kit would be a lot harder to get working.
The connector is a very specific e-bike cable. I found something almost identical online, but it was only available from China, and I couldn't figure out how to order it.
I was working on this at Sudo Room every Tuesday, and talking to people about it, and the cable problem.
A person who will remain anonymous but was working part time at the Hells Angels warehouse in San Francisco brought in about 300 of the exact cables I needed. The were still in the factory packaging. He said his manager gave them to him them because they knew he was into electronics.
Shipping
With everything I needed now, I made a social media post about the project. I sold the kits for $20 including shipping which just covered my costs. I bundled all the components into a kit and sold about 50 of them. The most annoying thing was programming the chips was annoying.
Many scooters were saved.
Juicers
There was one more problem: you need a charger for when your scooter's battery dies. Fortunately, Lime had a program that paid people to collect scooters to bring home to be charged overnight. They call this "juicing" and a gig-worker who does it is a "Juicer". You could sign up to be a Juicer and they'd ship you two free chargers, usually with next-day shipping.
P.S. Please wear a helmet.
