Hacking the Electrolux Trilobite
Re: Hacking the Electrolux Trilobite
I did my best in optical tracking down the lines, hopefully this adds some light to it.....
Re: Hacking the Electrolux Trilobite
Thanks for posting this. I guess only a few pins are needed for the serial link and the remainder are for controller diagnostics/debugging.
Re: Hacking the Electrolux Trilobite
Perhaps you could get a better view if you removed all the components.
Ben
Homemade Telepresence Robot:
http://mayarover.blogspot.com/
http://www.instructables.com/id/MAYA-Te ... nce-Rover/
There are only 10 types of people in the world. Those who understand binary and those who don't
Homemade Telepresence Robot:
http://mayarover.blogspot.com/
http://www.instructables.com/id/MAYA-Te ... nce-Rover/
There are only 10 types of people in the world. Those who understand binary and those who don't
Re: Hacking the Electrolux Trilobite
OK, so I accidently got two Trilobites last week-end. (Could not resist; good price and shape)
So:- now I have no excuse; while waiting for new batteries, I decided to take this a step further, and I thought I should check if any of you are still interested in the old Trilobite?
I notice that soon two years has passed since labude made contact with Prof. Henrik I. Christensen - a couple of years no? Not sure if labude is still around here, it might be a good idea to try to get hold of the documentation again.
Either way, I am going to document the connector one step further this weekend.
So:- now I have no excuse; while waiting for new batteries, I decided to take this a step further, and I thought I should check if any of you are still interested in the old Trilobite?
I notice that soon two years has passed since labude made contact with Prof. Henrik I. Christensen - a couple of years no? Not sure if labude is still around here, it might be a good idea to try to get hold of the documentation again.
Either way, I am going to document the connector one step further this weekend.
Re: Hacking the Electrolux Trilobite
Update:
The mapping of the connector was harder than I anticipated, mainly, because I did not see the signals I expected, and also due the very thick protective paint on the CPU, which makes it hard to measure the signal paths.
The PCB of the Trilobite that I used is a bit updated from the other pictures posted here, but only smaller changes it seams. For reference, my trilobites are ZA2's.
The main pins on the '332 for uart rx/tx seams unconnected, so either the only way to get to the serial protocol is to solder a connector onto them, or I'm on the wrong port. On the '332, it is also possible to program the TPU to do uart comm's, but I would have thought that they used it mainly for step motor control.
I will therefore solder in some cables on the dedicated port, and try to stimulate some response from the CPU by pushing data onto it in different baud rates.
Meanwhile, I decided to send a mail to Ulrik Danestad @Electrolux, and his answer was that they had decided internally not to disclose those documents, so it seams that the only way for us to get them is from someone with ending NDA's.
I''m also trying to get hold of a debugger for this processor, possibly I can get one from my previous employer, but they where not sure if they had them still (or had thrown them away), so only time will tell.
The mapping of the connector was harder than I anticipated, mainly, because I did not see the signals I expected, and also due the very thick protective paint on the CPU, which makes it hard to measure the signal paths.
The PCB of the Trilobite that I used is a bit updated from the other pictures posted here, but only smaller changes it seams. For reference, my trilobites are ZA2's.
The main pins on the '332 for uart rx/tx seams unconnected, so either the only way to get to the serial protocol is to solder a connector onto them, or I'm on the wrong port. On the '332, it is also possible to program the TPU to do uart comm's, but I would have thought that they used it mainly for step motor control.
I will therefore solder in some cables on the dedicated port, and try to stimulate some response from the CPU by pushing data onto it in different baud rates.
Meanwhile, I decided to send a mail to Ulrik Danestad @Electrolux, and his answer was that they had decided internally not to disclose those documents, so it seams that the only way for us to get them is from someone with ending NDA's.
I''m also trying to get hold of a debugger for this processor, possibly I can get one from my previous employer, but they where not sure if they had them still (or had thrown them away), so only time will tell.
Re: Hacking the Electrolux Trilobite
Update:
Connected!
9600N81 connected to the '332 primary serial port at pin 75 and 76. Remember this is 5V interface!
O'Tool is the real time operating system, which I incidently have been working with on a similar processor.
CCC68k is, I think, the Microtek Research C++ compiler.
Now, if we only had the protocol... I'll do some more testing
Unfortunately, on my unit, the Flash memory isn't a PLCC as with the earlier units, so I really need a BDM connection to get the machine code.
I wonder what that "Map search disabled" means...
Connected!
9600N81 connected to the '332 primary serial port at pin 75 and 76. Remember this is 5V interface!
Code: Select all
**** O'Tool/CPU32/A Rel:3.57 SN:0000 T+ Dec 21 1994 CCC68k 1.2 ****
Trilobite TM (c) Copyright 1995-2004 Electrolux AB
Revision voltage 1106 mV HW 3 16 bit FPROM
Software revision:
113105401 r05
Software date:
070529 09:57:02
Compiled by Peter Dahl Electrolux FCLA AB (VM)
60 kHz Dual Band 8 Channel Sonar
Power on (batt2): 384 times.
Fan/brush 128:59 hrs. 400 380 charge cycles.
Revision ID 1106 seed 881215
OEM option: 0
RTC option: 1 (1:0)
Previous shut down cause: 18
Map search disabled
Temp batt 1 23.11C
Temp batt 2 22.75C
Motor voltages OFF 19.34 0.02 18.54 5.59 5.57 5.58 5.55
Enter main loop
UBAT: 19.4 V 19.3 V. U_CH: 18.7 V Lifted!
CCC68k is, I think, the Microtek Research C++ compiler.
Now, if we only had the protocol... I'll do some more testing
Unfortunately, on my unit, the Flash memory isn't a PLCC as with the earlier units, so I really need a BDM connection to get the machine code.
I wonder what that "Map search disabled" means...
- vic7767
- Robot Master
- Posts: 15556
- Joined: January 14th, 2006, 7:31 pm
- Location: Haughton Louisiana - USA
Re: Hacking the Electrolux Trilobite
Great effort getting that access and data. I also wonder about the mapping feature.
Re: Hacking the Electrolux Trilobite
YES!!
Another break-through this evening: I found RX/TX on the connector. I think Electrolux deliberately made this tricky!!
The primary serial port on the CPU goes off to a hex inverting schmittrigger all tracks very hidden. This means that we don't have to do any soldering on the board, and infact, everything we need are available on the red connector.
I'm getting a bit low on energy now, but here's the complete mapping of the connector.
'*' is active low/inversion sign in table below.
1. *TX
2. +V Battery through 10R
3. *RX
4. ???
5. *IPIPE/DSO through 220R
6. VDD
7. *IFETCH/DSI throug 220R and 22K Pull down
8. *RESET
9. FREEZE
10. GND
11. *BKPT/DSCLK through 220R and 4K7 Pull up
12. GND
13. *BERR through 220R and 47K Pull up.
14. NC (goes to unpopulated resistor R68)
Numbering as specified in Links excellent picture earlier (helped me a lot!).
As you can see, pin 4 is still a mystery. I goes in an inner layer, so it is impossible to see where. I *think* it might go to the battery/charger area of the board, but I am probably mistaken.
Next task for me is probably to make an interface board, which gives correct rs232 levels and a standard debug connector.
Another break-through this evening: I found RX/TX on the connector. I think Electrolux deliberately made this tricky!!
The primary serial port on the CPU goes off to a hex inverting schmittrigger all tracks very hidden. This means that we don't have to do any soldering on the board, and infact, everything we need are available on the red connector.
I'm getting a bit low on energy now, but here's the complete mapping of the connector.
'*' is active low/inversion sign in table below.
1. *TX
2. +V Battery through 10R
3. *RX
4. ???
5. *IPIPE/DSO through 220R
6. VDD
7. *IFETCH/DSI throug 220R and 22K Pull down
8. *RESET
9. FREEZE
10. GND
11. *BKPT/DSCLK through 220R and 4K7 Pull up
12. GND
13. *BERR through 220R and 47K Pull up.
14. NC (goes to unpopulated resistor R68)
Numbering as specified in Links excellent picture earlier (helped me a lot!).
As you can see, pin 4 is still a mystery. I goes in an inner layer, so it is impossible to see where. I *think* it might go to the battery/charger area of the board, but I am probably mistaken.
Next task for me is probably to make an interface board, which gives correct rs232 levels and a standard debug connector.
Re: Hacking the Electrolux Trilobite
Haven't hapened too much, still waiting to see if I can get hold of a debugger from old job..
While waiting, I have made a cable for serial port and debugger interface which I use, even though it is 5V - not real RS232 levels, but it seams to work fine, the USB-RS232 adapter gets a bit warm though.
While waiting, I have made a cable for serial port and debugger interface which I use, even though it is 5V - not real RS232 levels, but it seams to work fine, the USB-RS232 adapter gets a bit warm though.
Re: Hacking the Electrolux Trilobite
I think the Trilobite debug outputs are quite nice, it always reports what up ahead, and what it is doing;
and
Especially reporting stuff like "Obstacle at -82 deg 10 cm" is very useful. It seams that it always reports the nearest obstacle, "Obstacle at 55 deg 107 cm" etc. It will be interesting to see how far the sonar reaches, it obviously pics up small items, so special setup needs to be done, since it has a very wide view ~180 degrees.
I have realized that I either need to make a treadmill for the trilobite, or get a wireless connection. I'm considering setting up a linux computer on/in the Trilobite, with a WiFi USB dongle.
Oh, and my last thoughts about the mysterious "pin 4" might be a way of starting up the trilobite when it is powered off.
Code: Select all
Formatting transmitter band:
1472 027 1322 029
Start following wall
Track width 0 0 0 0 mm
Obstacle at -67 deg 2 cm
Starting wall trace (0 s) condition: 0
Batt2 low (3 s)Temp batt 1 20.95C
Temp batt 2 19.85C
, charger exists
Motor voltages OFF 19.72 0.16 18.92 5.76 5.75 5.75 5.73
Motor voltages ON 19.69 10.30 10.12 13.44 13.48 13.47 0.07
Code: Select all
Power on (batt1): 400 times.
Fan/brush 129:01 hrs. 400 380 charge cycles.
Revision ID 1107 seed 667468
OEM option: 0
RTC option: 1 (1:0)
Previous shut down cause: 15
Map search disabled
Temp batt 1 21.35C
Temp batt 2 19.86C
Motor voltages OFF 19.59 0.02 18.80 5.76 5.75 5.75 5.72
Enter main loop
UBAT: 19.6 V 19.5 V. U_CH: 19.0 V Lifted!
Motor voltages ON 19.56 10.30 10.03 13.44 13.48 13.47 13.44
Formatting transmitter band:
0344 008 0199 007
Start following wall
Track width 0 0 0 0 mm
Obstacle at -50 deg 5 cm
Starting wall trace (0 s) condition: 0
Found fence, following it
I have realized that I either need to make a treadmill for the trilobite, or get a wireless connection. I'm considering setting up a linux computer on/in the Trilobite, with a WiFi USB dongle.
Oh, and my last thoughts about the mysterious "pin 4" might be a way of starting up the trilobite when it is powered off.
Re: Hacking the Electrolux Trilobite
Wow what an advance!
Haven't been here around for years and my disassembled Trilobite was just resting in pieces in the cellar.
Glad to see that my efforts in PCB tracking weren't a complete waste of time.
Just last week I got myself a neato XV21 and was totally pleased with the LIDAR navigation(this is clearly
the way to go). And that remembered me of my old Trilobite and its misery.
The Trilobite is pretty useless to me only because of two things:
1. Meander Navigation, this is is just a pain in the ass and LIDAR navigation is a must-have.
I'm aware that a LIDAR hack on the Trilobite would probably need some sort of complete
replacement of the motherboard for some neato linux like board.......in a few years there
will be some kind of "raspberry 2" that will do the trick, and for the meantime the neatos
work fine for me(with their excellent performance/€ balance).
2. The attrition of the vacuum motor bearings and its noise:
I had once bought a replacement from electrolux and if I remeber right is was about 150-200,- €.
The point is that only two small ball bearings do wear out. The bearings are 1,- € each at ebay.
But the problem is to disassemble the motor by not destroying it. EBM Pabst is the manufacturer
and they did a great job to design a powerful wear-free brushless motor and cripple its durability
by preventing its disassembling for replacing the ball bearings. The cheapest brushless PC fan
out there is able to do that..........so screw you!
However I have managed to do it on one of the two motors and I can tell you this was a hell of a
job to do but it can be done. Just the last two days I'm testing the reassembled motor in the trilobite.
So far it works with a small less optimal imbalance on the ventilation rotor.
The point is that the motor bearings would last far longer and what is also important for me that
it would be far less noisy if the vacuum motor would spin with less rpm.
So would it be possible to hack in the firmware and slow down rpm of the vacuum motor?
Haven't been here around for years and my disassembled Trilobite was just resting in pieces in the cellar.
Glad to see that my efforts in PCB tracking weren't a complete waste of time.
Just last week I got myself a neato XV21 and was totally pleased with the LIDAR navigation(this is clearly
the way to go). And that remembered me of my old Trilobite and its misery.
The Trilobite is pretty useless to me only because of two things:
1. Meander Navigation, this is is just a pain in the ass and LIDAR navigation is a must-have.
I'm aware that a LIDAR hack on the Trilobite would probably need some sort of complete
replacement of the motherboard for some neato linux like board.......in a few years there
will be some kind of "raspberry 2" that will do the trick, and for the meantime the neatos
work fine for me(with their excellent performance/€ balance).
2. The attrition of the vacuum motor bearings and its noise:
I had once bought a replacement from electrolux and if I remeber right is was about 150-200,- €.
The point is that only two small ball bearings do wear out. The bearings are 1,- € each at ebay.
But the problem is to disassemble the motor by not destroying it. EBM Pabst is the manufacturer
and they did a great job to design a powerful wear-free brushless motor and cripple its durability
by preventing its disassembling for replacing the ball bearings. The cheapest brushless PC fan
out there is able to do that..........so screw you!
However I have managed to do it on one of the two motors and I can tell you this was a hell of a
job to do but it can be done. Just the last two days I'm testing the reassembled motor in the trilobite.
So far it works with a small less optimal imbalance on the ventilation rotor.
The point is that the motor bearings would last far longer and what is also important for me that
it would be far less noisy if the vacuum motor would spin with less rpm.
So would it be possible to hack in the firmware and slow down rpm of the vacuum motor?
Good to hear from some fellow trilobite owners!
Well, at the moment I am not spending too much time on the Trilobites (because of the summer), but I have now got a BDM interface, so if I can only mate it with proper software, I'll be able to pull the binary. Once I have that, I'd like to try to find out how to control the Trilobites. As it is now, it is a one way communication from the Trilo, while nice, it give us no opportunity to do more advanced navigation.
I have bought a tp-link router http://wiki.openwrt.org/toh/tp-link/tl- ... al.console and installed OpenWRT on it, the internal serial port are connected to the trilo, and it is also powered from the trilo. All through the red connector. It can easily be tucked away inside the trilo, but for now it lies on top on it.
So at the moment I am using ser2net to the trilo from my desktop. But no control.
Once we have control, I hope the manual control still uses the obsticle detection of the trilobite, because it is very good imo. Then adding, say a Beaglebone Black, for more powerful linux board to do the better navigation should be easy. (Well, maybe not the navigation, have no experience in this, but the control anyway). Or, if navigation does not need too much power, I have the RPi with the new camera on my desk, maybe it will do?
Leaving the the mainboard is probably the only realistic way forward, since it takes care of all low level stuff, and does it good. Also means that mapping can use 100% CPU without having to bother about obstacle detection and stepper motor control etc.
Not sure if it is possible to control the vacuum motor more than on/off.
Well, at the moment I am not spending too much time on the Trilobites (because of the summer), but I have now got a BDM interface, so if I can only mate it with proper software, I'll be able to pull the binary. Once I have that, I'd like to try to find out how to control the Trilobites. As it is now, it is a one way communication from the Trilo, while nice, it give us no opportunity to do more advanced navigation.
I have bought a tp-link router http://wiki.openwrt.org/toh/tp-link/tl- ... al.console and installed OpenWRT on it, the internal serial port are connected to the trilo, and it is also powered from the trilo. All through the red connector. It can easily be tucked away inside the trilo, but for now it lies on top on it.
So at the moment I am using ser2net to the trilo from my desktop. But no control.
Once we have control, I hope the manual control still uses the obsticle detection of the trilobite, because it is very good imo. Then adding, say a Beaglebone Black, for more powerful linux board to do the better navigation should be easy. (Well, maybe not the navigation, have no experience in this, but the control anyway). Or, if navigation does not need too much power, I have the RPi with the new camera on my desk, maybe it will do?
Leaving the the mainboard is probably the only realistic way forward, since it takes care of all low level stuff, and does it good. Also means that mapping can use 100% CPU without having to bother about obstacle detection and stepper motor control etc.
Not sure if it is possible to control the vacuum motor more than on/off.
Re: Hacking the Electrolux Trilobite
That sounds awesome, can't wait for a possible firmware hack. If I can help you out in one way or another let me know!
So your model 2.0 doesn't have the Flash memory: Am29F040B Chip? So where is the firmware on model 2.0 stored?
For the debugging or BDM Mode, have you already checked the X14 Pins(see in my pic)?
And for jacking up the trilobite for wired debugging you probably only need to block the two drive wheels pressure Sensors.
And for the vacuum Motor I can definitely hear that the motor spins higher when the Trilobite finished the "following wall" routine and starts "meandering". Whats causing this if its a software signal or some other reason I don't know.
So your model 2.0 doesn't have the Flash memory: Am29F040B Chip? So where is the firmware on model 2.0 stored?
For the debugging or BDM Mode, have you already checked the X14 Pins(see in my pic)?
And for jacking up the trilobite for wired debugging you probably only need to block the two drive wheels pressure Sensors.
And for the vacuum Motor I can definitely hear that the motor spins higher when the Trilobite finished the "following wall" routine and starts "meandering". Whats causing this if its a software signal or some other reason I don't know.
Re: Hacking the Electrolux Trilobite
Yes, my version 2 has a FLASH, but it is a TSSOP, which are much harder to desolder and read off board. Don't remember off hand what kind.
BDM is already mapped out, and I have made the connector, I only need to find a suitable windows/linux software to pull the image from the Trilobite. I think I read somewhere that linux GDB dropped support for the 68K. There's a demo version of Freescale C compiler/debugger suite that I'm thinking of using, but I am not 100% sure it allows downloading binary from target. Have to check this out. (Which might sound easy, but the hurdle is that I have to find a box to install windows in, that has a parallel port - I'm a linux guy...)
And:- You are correct! The Vacuum motor does change speed, I forgot that it already does this.
Maybe X14 does something to control the serial control interface, but I don't really think so, I was not able to understand where the X14 traces goes.
BDM is already mapped out, and I have made the connector, I only need to find a suitable windows/linux software to pull the image from the Trilobite. I think I read somewhere that linux GDB dropped support for the 68K. There's a demo version of Freescale C compiler/debugger suite that I'm thinking of using, but I am not 100% sure it allows downloading binary from target. Have to check this out. (Which might sound easy, but the hurdle is that I have to find a box to install windows in, that has a parallel port - I'm a linux guy...)
And:- You are correct! The Vacuum motor does change speed, I forgot that it already does this.
Maybe X14 does something to control the serial control interface, but I don't really think so, I was not able to understand where the X14 traces goes.
Re: Hacking the Electrolux Trilobite
Sorry to report that not much has happened, but to not just shamelessly bump, I am enclosing some pics of the current set-up. I have left the wrt wifi router externally, so I can easily just disconnect it should I need to.
This simple set-up is using power and everything straight from the red connector, and lets med logon to the router to get direct view of the serial output from the trilobite over wifi.
The NDA should be lifted now, but I have not been able to locate any of the people that had it.I might try to ask Electrolux once again, but perhaps if someone else would try (so it is not as much just *one* person nagging them ) send me a PM for the email address of the responsible manager.
This simple set-up is using power and everything straight from the red connector, and lets med logon to the router to get direct view of the serial output from the trilobite over wifi.
The NDA should be lifted now, but I have not been able to locate any of the people that had it.I might try to ask Electrolux once again, but perhaps if someone else would try (so it is not as much just *one* person nagging them ) send me a PM for the email address of the responsible manager.
Re: Hacking the Electrolux Trilobite
Is there still any interest in this project?
I recently got hold of a Trilobite as a donation as it didn't work (error #11), I got annoyed at the lack of error info and dumped the firmware from the PLCC flash. I found the string "Compiled by Peter Dahl Electrolux AB (VM)", searched his name and came across this thread
Looks like a lot of good info here, I'll try to post some updates if I get anywhere from looking at the firmware side. If anyone else is interested in looking at it, get in contact.
http://imgur.com/a/syMEX
http://i.imgur.com/3COQVtU.png
I recently got hold of a Trilobite as a donation as it didn't work (error #11), I got annoyed at the lack of error info and dumped the firmware from the PLCC flash. I found the string "Compiled by Peter Dahl Electrolux AB (VM)", searched his name and came across this thread
Looks like a lot of good info here, I'll try to post some updates if I get anywhere from looking at the firmware side. If anyone else is interested in looking at it, get in contact.
http://imgur.com/a/syMEX
http://i.imgur.com/3COQVtU.png
Re: Hacking the Electrolux Trilobite
Excellent! I looked at your string dump, and I suppose some of those strings are the serial port commands!
Now if I could only get how to get into command mode. I'm going to double check my setup...
I guess you have the first model (red one), seeing the flash is a PLCC?
Now if I could only get how to get into command mode. I'm going to double check my setup...
I guess you have the first model (red one), seeing the flash is a PLCC?
Re: Hacking the Electrolux Trilobite
Yep, it's a red one.
There's definitely lots of strings that look like serial commands. There's also reference to pin codes, a service menu, calibration type stuff, etc. I was surprised to find this much ascii in an embedded device
There's definitely lots of strings that look like serial commands. There's also reference to pin codes, a service menu, calibration type stuff, etc. I was surprised to find this much ascii in an embedded device
Re: Hacking the Electrolux Trilobite
So.
Hit 'Z' on your serial console during device bootup, timing might be difficult but keep trying.
I haven't managed any commands yet, I get replies back when I type things (with a carriage return for line ending), but it's all garbled. Doesn't seem to be baud rate, I think I need more delay between bytes.
Code: Select all
**** O'Tool/CPU32/A Rel:3.57 SN:0000 T+ Dec 21 1994 CCC68k 1.2 ****
Trilobite TM (c) Copyright 1995-2002 Electrolux AB
Revision voltage 966 mV HW 1
Software revision:
112860501 r15
Software date:
020903 13:35:38
Compiled by Peter Dahl Electrolux ¡²j¤¨È Ò-)/$Q]X[¡and 8 ChannelSonar
Production Test Monitor Sep 3 2002 13:34:47
>
I haven't managed any commands yet, I get replies back when I type things (with a carriage return for line ending), but it's all garbled. Doesn't seem to be baud rate, I think I need more delay between bytes.
Re: Hacking the Electrolux Trilobite
Great find!
Let me ask you a question; if you don't press 'Z', will you get a similar startup as the one I described above?
If so, does anything happen at that time, when you press anything on the serial console?
Let me ask you a question; if you don't press 'Z', will you get a similar startup as the one I described above?
If so, does anything happen at that time, when you press anything on the serial console?