Hacking the Electrolux Trilobite

News and information about the Electrolux Pure i9 and the Electrolux Trilobite series Robotic Vacuums. All discussion and troubleshooting questions go here.

Re: Hacking the Electrolux Trilobite

Postby Link » October 9th, 2011, 9:28 am

I did my best in optical tracking down the lines, hopefully this adds some light to it.....
Attachments
bxnbejkbk6pkegdaf.jpg
Link
 
Posts: 23
Joined: April 7th, 2011, 2:41 pm

Re: Hacking the Electrolux Trilobite

Postby Parker » October 18th, 2011, 11:17 am

Thanks for posting this. I guess only a few pins are needed for the serial link and the remainder are for controller diagnostics/debugging.
Parker
Robot Groupie
 
Posts: 58
Joined: November 29th, 2010, 2:08 pm
Location: UK and Europe

Re: Hacking the Electrolux Trilobite

Postby bhylak » October 19th, 2011, 10:40 am

Perhaps you could get a better view if you removed all the components.
Ben

Homemade Telepresence Robot:
http://mayarover.blogspot.com/
http://www.instructables.com/id/MAYA-Te ... nce-Rover/

There are only 10 types of people in the world. Those who understand binary and those who don't
User avatar
bhylak
Robot Addict
 
Posts: 1638
Joined: October 17th, 2009, 7:30 pm

Re: Hacking the Electrolux Trilobite

Postby vespaman » February 7th, 2013, 9:18 am

OK, so I accidently got two Trilobites last week-end. (Could not resist; good price and shape) :)

So:- now I have no excuse; while waiting for new batteries, I decided to take this a step further, and I thought I should check if any of you are still interested in the old Trilobite?

I notice that soon two years has passed since labude made contact with Prof. Henrik I. Christensen - a couple of years no? :) Not sure if labude is still around here, it might be a good idea to try to get hold of the documentation again.

Either way, I am going to document the connector one step further this weekend.
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby vespaman » February 13th, 2013, 5:13 pm

Update:
The mapping of the connector was harder than I anticipated, mainly, because I did not see the signals I expected, and also due the very thick protective paint on the CPU, which makes it hard to measure the signal paths.
The PCB of the Trilobite that I used is a bit updated from the other pictures posted here, but only smaller changes it seams. For reference, my trilobites are ZA2's.
The main pins on the '332 for uart rx/tx seams unconnected, so either the only way to get to the serial protocol is to solder a connector onto them, or I'm on the wrong port. On the '332, it is also possible to program the TPU to do uart comm's, but I would have thought that they used it mainly for step motor control.
I will therefore solder in some cables on the dedicated port, and try to stimulate some response from the CPU by pushing data onto it in different baud rates.

Meanwhile, I decided to send a mail to Ulrik Danestad @Electrolux, and his answer was that they had decided internally not to disclose those documents, so it seams that the only way for us to get them is from someone with ending NDA's.

I''m also trying to get hold of a debugger for this processor, possibly I can get one from my previous employer, but they where not sure if they had them still (or had thrown them away), so only time will tell.
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby vespaman » February 14th, 2013, 12:57 pm

Update:

Connected! :D

9600N81 connected to the '332 primary serial port at pin 75 and 76. Remember this is 5V interface!

Code: Select all
****  O'Tool/CPU32/A  Rel:3.57  SN:0000  T+  Dec 21 1994  CCC68k 1.2  ****

Trilobite TM  (c) Copyright 1995-2004 Electrolux AB
Revision voltage 1106 mV  HW 3  16 bit FPROM
Software revision:
113105401 r05
Software date:
070529 09:57:02
Compiled by Peter Dahl Electrolux FCLA AB (VM)
60 kHz Dual Band 8 Channel Sonar

Power on (batt2): 384 times.
Fan/brush 128:59 hrs. 400 380 charge cycles.
Revision ID 1106  seed 881215
OEM option: 0
RTC option: 1 (1:0)
Previous shut down cause: 18
Map search disabled
Temp batt 1 23.11C
Temp batt 2 22.75C
Motor voltages OFF 19.34 0.02 18.54 5.59 5.57 5.58 5.55
Enter main loop
UBAT: 19.4 V  19.3 V. U_CH: 18.7 V Lifted!


O'Tool is the real time operating system, which I incidently have been working with on a similar processor.
CCC68k is, I think, the Microtek Research C++ compiler.

Now, if we only had the protocol... I'll do some more testing

Unfortunately, on my unit, the Flash memory isn't a PLCC as with the earlier units, so I really need a BDM connection to get the machine code.


I wonder what that "Map search disabled" means... :shock:
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby vic7767 » February 14th, 2013, 1:50 pm

Great effort getting that access and data. I also wonder about the mapping feature.
Roomba and Neato Mods, come visit: http://www.vic7767.com/
User avatar
vic7767
Robot Master
 
Posts: 14942
Joined: January 14th, 2006, 8:31 pm
Location: Haughton Louisiana - USA

Re: Hacking the Electrolux Trilobite

Postby vespaman » February 14th, 2013, 3:08 pm

YES!! :D :D

Another break-through this evening: I found RX/TX on the connector. I think Electrolux deliberately made this tricky!!
The primary serial port on the CPU goes off to a hex inverting schmittrigger all tracks very hidden. This means that we don't have to do any soldering on the board, and infact, everything we need are available on the red connector.

I'm getting a bit low on energy now, but here's the complete mapping of the connector.
'*' is active low/inversion sign in table below.

1. *TX
2. +V Battery through 10R
3. *RX
4. ???
5. *IPIPE/DSO through 220R
6. VDD
7. *IFETCH/DSI throug 220R and 22K Pull down
8. *RESET
9. FREEZE
10. GND
11. *BKPT/DSCLK through 220R and 4K7 Pull up
12. GND
13. *BERR through 220R and 47K Pull up.
14. NC (goes to unpopulated resistor R68)

Numbering as specified in Links excellent picture earlier (helped me a lot!).

As you can see, pin 4 is still a mystery. I goes in an inner layer, so it is impossible to see where. I *think* it might go to the battery/charger area of the board, but I am probably mistaken.

Next task for me is probably to make an interface board, which gives correct rs232 levels and a standard debug connector.
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby vespaman » March 2nd, 2013, 5:36 am

Haven't hapened too much, still waiting to see if I can get hold of a debugger from old job..
While waiting, I have made a cable for serial port and debugger interface which I use, even though it is 5V - not real RS232 levels, but it seams to work fine, the USB-RS232 adapter gets a bit warm though.
Attachments
dbg_cable.JPG
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby vespaman » March 2nd, 2013, 6:06 am

I think the Trilobite debug outputs are quite nice, it always reports what up ahead, and what it is doing;

Code: Select all
Formatting transmitter band:
1472 027 1322 029
Start following wall
Track width 0 0 0 0 mm
Obstacle at -67 deg 2 cm
Starting wall trace (0 s) condition: 0
Batt2 low (3 s)Temp batt 1 20.95C
Temp batt 2 19.85C
, charger exists
Motor voltages OFF 19.72 0.16 18.92 5.76 5.75 5.75 5.73
Motor voltages ON 19.69 10.30 10.12 13.44 13.48 13.47 0.07


and

Code: Select all
Power on (batt1): 400 times.
Fan/brush 129:01 hrs. 400 380 charge cycles.
Revision ID 1107  seed 667468
OEM option: 0
RTC option: 1 (1:0)
Previous shut down cause: 15
Map search disabled
Temp batt 1 21.35C
Temp batt 2 19.86C
Motor voltages OFF 19.59 0.02 18.80 5.76 5.75 5.75 5.72
Enter main loop
UBAT: 19.6 V  19.5 V. U_CH: 19.0 V Lifted!
Motor voltages ON 19.56 10.30 10.03 13.44 13.48 13.47 13.44
Formatting transmitter band:
0344 008 0199 007
Start following wall
Track width 0 0 0 0 mm
Obstacle at -50 deg 5 cm
Starting wall trace (0 s) condition: 0
Found fence, following it


Especially reporting stuff like "Obstacle at -82 deg 10 cm" is very useful. It seams that it always reports the nearest obstacle, "Obstacle at 55 deg 107 cm" etc. It will be interesting to see how far the sonar reaches, it obviously pics up small items, so special setup needs to be done, since it has a very wide view ~180 degrees.

I have realized that I either need to make a treadmill for the trilobite, or get a wireless connection. I'm considering setting up a linux computer on/in the Trilobite, with a WiFi USB dongle.

Oh, and my last thoughts about the mysterious "pin 4" might be a way of starting up the trilobite when it is powered off.
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby Link » June 9th, 2013, 4:43 am

Wow what an advance!

Haven't been here around for years and my disassembled Trilobite was just resting in pieces in the cellar.
Glad to see that my efforts in PCB tracking weren't a complete waste of time.
Just last week I got myself a neato XV21 and was totally pleased with the LIDAR navigation(this is clearly
the way to go). And that remembered me of my old Trilobite and its misery.


The Trilobite is pretty useless to me only because of two things:

1. Meander Navigation, this is is just a pain in the ass and LIDAR navigation is a must-have.
I'm aware that a LIDAR hack on the Trilobite would probably need some sort of complete
replacement of the motherboard for some neato linux like board.......in a few years there
will be some kind of "raspberry 2" that will do the trick, and for the meantime the neatos
work fine for me(with their excellent performance/€ balance).

2. The attrition of the vacuum motor bearings and its noise:
I had once bought a replacement from electrolux and if I remeber right is was about 150-200,- €.
The point is that only two small ball bearings do wear out. The bearings are 1,- € each at ebay.
But the problem is to disassemble the motor by not destroying it. EBM Pabst is the manufacturer
and they did a great job to design a powerful wear-free brushless motor and cripple its durability
by preventing its disassembling for replacing the ball bearings. The cheapest brushless PC fan
out there is able to do that..........so screw you!
However I have managed to do it on one of the two motors and I can tell you this was a hell of a
job to do but it can be done. Just the last two days I'm testing the reassembled motor in the trilobite.
So far it works with a small less optimal imbalance on the ventilation rotor.

The point is that the motor bearings would last far longer and what is also important for me that
it would be far less noisy if the vacuum motor would spin with less rpm.

So would it be possible to hack in the firmware and slow down rpm of the vacuum motor?
Link
 
Posts: 23
Joined: April 7th, 2011, 2:41 pm

Postby vespaman » June 9th, 2013, 7:11 am

Good to hear from some fellow trilobite owners! :)

Well, at the moment I am not spending too much time on the Trilobites (because of the summer), but I have now got a BDM interface, so if I can only mate it with proper software, I'll be able to pull the binary. Once I have that, I'd like to try to find out how to control the Trilobites. As it is now, it is a one way communication from the Trilo, while nice, it give us no opportunity to do more advanced navigation.
I have bought a tp-link router http://wiki.openwrt.org/toh/tp-link/tl-mr3020#serial.console and installed OpenWRT on it, the internal serial port are connected to the trilo, and it is also powered from the trilo. All through the red connector. It can easily be tucked away inside the trilo, but for now it lies on top on it.

So at the moment I am using ser2net to the trilo from my desktop. But no control.

Once we have control, I hope the manual control still uses the obsticle detection of the trilobite, because it is very good imo. Then adding, say a Beaglebone Black, for more powerful linux board to do the better navigation should be easy. (Well, maybe not the navigation, have no experience in this, but the control anyway). Or, if navigation does not need too much power, I have the RPi with the new camera on my desk, maybe it will do?

Leaving the the mainboard is probably the only realistic way forward, since it takes care of all low level stuff, and does it good. Also means that mapping can use 100% CPU without having to bother about obstacle detection and stepper motor control etc.
Not sure if it is possible to control the vacuum motor more than on/off.
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby Link » June 10th, 2013, 1:33 pm

That sounds awesome, can't wait for a possible firmware hack. If I can help you out in one way or another let me know!

So your model 2.0 doesn't have the Flash memory: Am29F040B Chip? So where is the firmware on model 2.0 stored?

For the debugging or BDM Mode, have you already checked the X14 Pins(see in my pic)?

And for jacking up the trilobite for wired debugging you probably only need to block the two drive wheels pressure Sensors.

And for the vacuum Motor I can definitely hear that the motor spins higher when the Trilobite finished the "following wall" routine and starts "meandering". Whats causing this if its a software signal or some other reason I don't know.
Link
 
Posts: 23
Joined: April 7th, 2011, 2:41 pm

Re: Hacking the Electrolux Trilobite

Postby vespaman » June 18th, 2013, 2:47 am

Yes, my version 2 has a FLASH, but it is a TSSOP, which are much harder to desolder and read off board. Don't remember off hand what kind.

BDM is already mapped out, and I have made the connector, I only need to find a suitable windows/linux software to pull the image from the Trilobite. I think I read somewhere that linux GDB dropped support for the 68K. There's a demo version of Freescale C compiler/debugger suite that I'm thinking of using, but I am not 100% sure it allows downloading binary from target. Have to check this out. (Which might sound easy, but the hurdle is that I have to find a box to install windows in, that has a parallel port - I'm a linux guy...)

And:- You are correct! The Vacuum motor does change speed, I forgot that it already does this.

Maybe X14 does something to control the serial control interface, but I don't really think so, I was not able to understand where the X14 traces goes.
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby vespaman » April 6th, 2014, 4:33 am

Sorry to report that not much has happened, but to not just shamelessly bump, 8) I am enclosing some pics of the current set-up. I have left the wrt wifi router externally, so I can easily just disconnect it should I need to.

This simple set-up is using power and everything straight from the red connector, and lets med logon to the router to get direct view of the serial output from the trilobite over wifi.

The NDA should be lifted now, but I have not been able to locate any of the people that had it.I might try to ask Electrolux once again, but perhaps if someone else would try (so it is not as much just *one* person nagging them :D ) send me a PM for the email address of the responsible manager.
Attachments
IMG_20140406_101408.jpg
IMG_20140406_101336.jpg
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby Miek » August 9th, 2014, 4:49 pm

Is there still any interest in this project?

I recently got hold of a Trilobite as a donation as it didn't work (error #11), I got annoyed at the lack of error info and dumped the firmware from the PLCC flash. I found the string "Compiled by Peter Dahl Electrolux AB (VM)", searched his name and came across this thread :)
Looks like a lot of good info here, I'll try to post some updates if I get anywhere from looking at the firmware side. If anyone else is interested in looking at it, get in contact.

http://imgur.com/a/syMEX
http://i.imgur.com/3COQVtU.png :P
Miek
 
Posts: 6
Joined: August 9th, 2014, 4:41 pm

Re: Hacking the Electrolux Trilobite

Postby vespaman » August 10th, 2014, 7:18 am

Excellent! I looked at your string dump, and I suppose some of those strings are the serial port commands!
Now if I could only get how to get into command mode. I'm going to double check my setup...

I guess you have the first model (red one), seeing the flash is a PLCC?
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

Re: Hacking the Electrolux Trilobite

Postby Miek » August 10th, 2014, 7:47 am

Yep, it's a red one.

There's definitely lots of strings that look like serial commands. There's also reference to pin codes, a service menu, calibration type stuff, etc. I was surprised to find this much ascii in an embedded device :D
Miek
 
Posts: 6
Joined: August 9th, 2014, 4:41 pm

Re: Hacking the Electrolux Trilobite

Postby Miek » August 10th, 2014, 1:27 pm

So.

Image

Code: Select all
   

    ****  O'Tool/CPU32/A  Rel:3.57  SN:0000  T+  Dec 21 1994  CCC68k 1.2  ****
    Trilobite TM  (c) Copyright 1995-2002 Electrolux AB
    Revision voltage 966 mV  HW 1
    Software revision:
    112860501 r15
    Software date:
    020903 13:35:38
    Compiled by Peter Dahl Electrolux‚     ¡²j•¤¨È Ò-)/$Q]X[¡and 8 ChannelSonar
    Production Test Monitor Sep  3 2002 13:34:47
    >



Hit 'Z' on your serial console during device bootup, timing might be difficult but keep trying. :)

I haven't managed any commands yet, I get replies back when I type things (with a carriage return for line ending), but it's all garbled. Doesn't seem to be baud rate, I think I need more delay between bytes.
Miek
 
Posts: 6
Joined: August 9th, 2014, 4:41 pm

Re: Hacking the Electrolux Trilobite

Postby vespaman » August 10th, 2014, 2:56 pm

Great find!

Let me ask you a question; if you don't press 'Z', will you get a similar startup as the one I described above?
If so, does anything happen at that time, when you press anything on the serial console?
vespaman
 
Posts: 38
Joined: January 6th, 2011, 1:25 pm
Location: Sundbyberg/SE

PreviousNext

Return to Electrolux Robots

Who is online

Users browsing this forum: ASTMedic, BrettS, bytemaster0, fergambo, fufu, instrukcije, jdong, johnnyh, KeldBroe, mobzd, plex, RockinRay, tre and 410 guests

cron