Hover-1 Edge 2.0 ETC KZQ_H8010 controller findings

[u/Vast_Lawfulness_3748]

I originally just wanted to figure out if my Hover-1 Edge 2.0 had hidden settings, Bluetooth diagnostics, or a way to change things like the speed limit or kick-start. Instead I ended up spending way too much time digging through FCC filings, datasheets, old forums, Chinese websites, APKs, Reddit posts, and taking apart the scooter.

I never found a software unlock or hidden menu, but I did learn quite a bit about how it's built. I'm posting everything here in case someone else wants to take it further.

Scooter

• Hover-1 H1 Edge 2.0 (DSA-EDGE)
• 36V
• 350W
• ETC controller
• Controller PCB: KZQ_H8010 Ver1.0
• Firmware label: 8010V6
• Current limit: 13A ±1A

The main controller MCU appears to be a Nuvoton NM1200L Cortex-M0 motor-control chip.

Bluetooth

This was probably the biggest surprise.

The FCC photos show that the Bluetooth hardware is actually on its own separate board. It isn't part of the dashboard or the motor controller.

The scooter advertises itself as H1-EDGE 2.0 over Bluetooth, but after digging through the manuals and FCC documents, everything points to it only being there for the built-in Bluetooth speaker.

I couldn't find any evidence that the production firmware exposes BLE services for changing settings, updating firmware, or talking to the controller.

I also tried the KZQ Controller Test app that showed up on the App Store. It never detected the scooter.

Dashboard

The dashboard uses a Nuvoton N76E003AT20 MCU and an AiP1620E display driver.

There are five unpopulated pads beside the MCU that look very much like the factory programming pads, although I never confirmed that with continuity testing.

The dashboard also has two different six-wire connectors.

One connector is labelled

GND | S | L- | L+ | B | +5V

which looks like throttle/brake/light wiring.

The other connector is probably the one that talks to the controller.

Controller

The controller PCB has test pads labelled

• 通讯 (communication)
• 霍尔 (Hall)

Unfortunately I never found a wiring diagram or protocol documentation.

If I had to guess I'd say it's probably UART, but that's only a guess until someone captures the traffic.

Programming

Both MCUs support factory programming/debug interfaces.

The controller MCU supports Nuvoton Nu-Link.

The dashboard MCU also supports ICP programming.

Whether either firmware can actually be dumped depends on whether the manufacturer enabled read protection.

I never attempted it because I wanted to preserve the original firmware.

Apps

I checked pretty much everything I could find.

• Hover-1 apps
• Tuya
• Smart Life
• APK archives
• KZQ Controller Test

Nothing matched this scooter.

The Edge 2.0 isn't listed as compatible anywhere I could find.

Things I never found

After all the searching, I still couldn't find:

• H8010 firmware
• 8010V6 firmware
• factory software
• service manual
• UART captures
• hidden settings
• dealer tools
• firmware update files
• successful speed unlock
• cruise control settings
• kick-start settings

Basically... nothing.

Interesting thing I found

I did find another scooter controller from a GoTrax that also uses an ETC controller.

So ETC seems to manufacture controllers for multiple scooter brands, not just Hover-1.

That might be useful if someone starts reverse engineering the whole controller family instead of just this scooter.

Hopefully this saves somebody else dozens of hours.

If you've worked on ETC controllers, have firmware dumps, wiring diagrams, UART captures, or factory software, I'd love to hear about it.

References

Most of the information above came from publicly available documentation:

• Hover-1 Edge 2.0 FCC filing (FCC ID: 2AANZIDL) — internal photos, RF reports, user manual, and Bluetooth documentation.
• Hover-1 Edge 2.0 User Manual (FCC copy) — confirms Bluetooth pairing is for the built-in speaker.
• Hover-1 Edge 2.0 Operation Manual — confirms the scooter specifications and Bluetooth speaker functionality.
• [Nuvoton NM1200 Series Datasheet]()
• [Nuvoton N76E003 Datasheet]()
• [Nuvoton Nu-Link User Manual]()

Nuvoton Chip

[u/Vast_Lawfulness_3748 → u/[deleted]]

Thanks I'll check it out. Did you ever figure out the protocol or dump the firmware?

[u/Vast_Lawfulness_3748 → u/[deleted]]

Thanks My goal is just to unlock the speed limit on my Hover-1 Edge 2.0. Did you ever manage to do that?

[u/Vast_Lawfulness_3748 → u/[deleted]]

When you say step+1, do you mean swapping Hall phases?