Greg's Scratchpad Thread on Roomba Comm Hacking

[biolizard89]

I don't want to dump the contents of the MCU, I just want to wipe its contents, and start over by writing a completely homebrew firmware. Preferably, I'd also like to add a homebrew serial bootloader so that I could reflash unencrypted homebrew firmware images in the future through the SCI port.

Is it possible to wipe the flash on the MCU, and upload a new binary, using only BDM and/or SCI? If not, is there another avenue I could pursue to accomplish this?

Thanks.

[vic7767]

If you can figure out how to flash the MCU then you should be able to load binary files via a bootloader using the BDM. I haven't done that process and can't offer info to do so. Possibly another hacker has some experience and can offer some suggestions.

[biolizard89]

There appears to be a Hi-Wave script in the CodeWarrior distribution called "p&e_erase_unsecure_hcs12.cmd" ... is this likely to work? A quick Google didn't find any documentation, but a couple forum posts recommended it for various situations.

[Gordon]

Biolizard89, you are moving into a huge void by wishing to erase Create's (or Roomba's) operating system. Do you have any idea how long it will take you to implement your own control S/W?

Let's say you have cleared out all iRobot code and are ready to begin writing your own. Do you already know which of the MCU's pins/ports have been assigned to drive H/W, and which have been assigned to accept hardware data? Do you know the wheel-motors' control parameters and current limits? Can you instruct the MCU how you want to close the motor speed-control loop, and what constitutes a hardware safety problem?

What about the cliff-sensors' IRED-drivers, and their detector signals -- do you know how its IREDs are driven, and what detected signal range constitutes a "cliff"?

You will be dealing with a hard-wired PWB that contains decision making elex for some sensor functions (resulting in the MCU knowing only that a limit-threshold has been crossed), and analog data from certain others (thus requiring the MCU to decide how to respond to the sensor data).

IOW, and IMO, there is an embedded hardware side of your project which is being ignored, and that means all of the H/W items that you plan to use must be sufficiently understood before you write one line of peripheral command code.

[biolizard89]

I realize that reimplementing all of the Roomba or Create's functionality would be difficult. But, I like a challenge. And if I'm stuck and not getting anywhere, I'll just open-source whatever I have at that point so that other people can benefit from whatever I do find out. Either way, I'll probably learn quite a bit about embedded programming in the process, so it's not a complete waste of time even if I do fail.

(I also should say that the Roomba Red I will be initially trying this on, is a spare that I have no other use for. I could either sell it, or experiment on it. I opt to experiment on it. )

Anyone know if the p&e_erase_unsecure_hcs12.cmd script is likely to work on the Roomba/Create MCU given the security on it?

Thanks!

[vic7767]

Since the MCU in your Roomba Red is in the HCS12 family, you just might be able to erase the contents and have an unlocked MCU to work with. Post back and let us know your results.

[mfortuna]

Just to be safe you want to unplug everything from the controller card and just leave the battery. That way you won't have a runaway robot when you erase it. Not sure if you would, but it seems like a nice safety measure.

[biolizard89]

Is there a way to connect to the JU1 pads without any physical/electrical modifications to the board? I ask because I may wish to use this for a competition which bans physical/electrical mods but permits software mods. (I can take it apart, but I can't change the electrical functionality of the hardware in order to load software.) So solder-connecting to JU1 would be banned if I were to use the modified Roomba in said competition. I have not worked with Pogo connectors and I'm not entirely sure what that entails... does that electrically or physically modify the board? (I'm a software person and not really much of a hardware person.) I'm tempted to just use electrical-tape to attach some wires, but I suspect that's a bad idea. Any ideas or explanations would be appreciated... and like I said, I'm a software guy, so if possible, keep it simple.

Thanks again!

[mfortuna]

You should be able to rig something up with a testheader and some way to clamp it. Here is a pictue, you would need a two row header.

[Gordon]

Is there a way to connect to the JU1 pads without any physical/electrical modifications to the board?... I ask because ... I have not worked with Pogo connectors and I'm not entirely sure what that entails... does that electrically or physically modify the board? ...

No, but you would have to dismount the board from the robot every time you revise its firmware.

To get a feel of what Pogo contacts are like, think of a child's pogo-stick -- a spring-loaded rod (but w/o foot-rests and handle-bar), all metal parts and shrunk down to a couple mm diameter and 10 long. One end is fitted with a shaped contact point, and a wire (or PCB-track) would connect to the other. Four to six of these would be held in an insulated block while some means for pushing the assembly against the BDM pads on the board would exist. Obviously, means for countering that force would be required. These Pogo-contacts are production-tools, and are not something you would ordinarily employ. Visit this site to see details, and the variety of, Pogo contacts:
http://www.mill-max.com/products/newpro ... cfm?pid=14

However, this is the ONLY way to achieve your goal of not soldering to the robot's PCB. (Well, not exactly "ONLY", because I can see bolting of tiny wire-lugs to the BDM-pads through their 1 mm dia. via-holes, but that becomes a job for a watch-maker, which I presume is not w/in your skills scope.)

[yhmmc]

Everyone is always talking about sending codes to the Roomba. How???? and in what format???

[vic7767]

Everyone is always talking about sending codes to the Roomba. How???? and in what format???

THe commands to send are documented in PDF manuals from iRobot "Open Interface Specification" for both the 5XX and 4XXX models of Roomba.

The interface is accessed by using the proper cable or bluetooth device and pluging it into the SCI port on the Roomba. That port is a 7 pin mini din connector. There are programs written that can be used to communicate with the Roomba and two of them are, "SCI Tester" and "Roomba Status". Both can be downloaded for free, use google to search for them.

[yhmmc]

I am sorry to be a pest. But, the link just brought me to the irobot site. There, I could not find with search "Open Interface Specification" or pdf files. I looked in the forums and under customersupport.

Also, I have found and downloaded RoombaComm, etc. The problem IS that i am operating windowsxpsp2 not mac. I have no good knowledge of linux or java. i just need to know how to OPERATE and RUN the roombacomm programs.

I mainly purhcased the roomba to have my Ardunio control it with a roostick through the serial port. And, yes, I have already read the book Hacking the Roomba, but the directions when followed to the T does not work.

Thanks.

[vic7767]

Here's a link to the 5XX Open Interface Doc

http://www.robotreviews.com/chat/viewto ... f=4&t=7126

And here's a link to the 4XXX Open Interface Doc

http://www.roombadevtools.com/docs_roombasci.pdf

[yhmmc]

Hey Greg!

Well thanks to you and your help, I have gotten RoombaComm to work and control the 530 perfectly from the PC through the Roostick. I next want to add the Arduino into the picture ADDing to the features. I need to control it without loosing the navigation stuff, etc. I am excited and instead of tearing my robots apart after I finish them to use the parts for the next one, my wife allowed me to order a second arduino for this new roomba project. This should be interesting.

[kaleva]

Hope this thread is still active.

I have recently acquired an Irobot Roomba Discovery. I have been reading through the threads on the hardware hacking and found comments similar to what I hope to do also at the hardware level.

Checking the micro, one alternative possibly is burning it with something like StickOS BASIC runs as-is on a APS12DT256 via BDM.
This would give a lot of power to test pins and write code both in basic and assembler to run peripherals.

Has this or something similar been considered?


kaleva

[vic7767]

That idea was not discussed but both myself and Greg did obtain BDMs and looked at OSMO data. There was mention of just erasing the CPU/MCU and program from scratch. No further coding has been attempted.

[kaleva]

Thanks for the reply VIC7767.
I am just easing my way into this project so I'm just into the research stage.

I've done similar hacks on other devices for just the fun of it.

The Roomba is a good platform to start my mini robotics project.

Thanks to all for the great info on this site.

I'll post from time to time as I get further into taking this unit apart and re-build it into some thing else.

kaleva

[biolizard89]

Thanks for the reply VIC7767.
I am just easing my way into this project so I'm just into the research stage.

I've done similar hacks on other devices for just the fun of it.

The Roomba is a good platform to start my mini robotics project.

Thanks to all for the great info on this site.

I'll post from time to time as I get further into taking this unit apart and re-build it into some thing else.

kaleva

Hi Kaleva,

Thanks for the StickOS link. That looks quite promising, although it might require minor modifications to be compatible with the Roomba.

I'm considering erasing my Roomba Red's MCU, and trying to write a homebrew firmware. The only reason that I haven't done it so far is that I have limited free time due to school and work. If I have time to mess with it, I'll post info here. If you try StickOS on the Roomba, I'd be curious to hear how it goes.

[kaleva]

Just a quick update.

After reviewing all the hardware options, checking the BDM interface and software development, I have concluded
it is more work than I want to do. Also the 16 bit processor doesn't have the horsepower I'm looking for.
I will utilize the existing communications interface.

I am looking at buying a linux based SBC.
I get more interface options (video, wireless, memory, etc.) options and can script at a much higher level.
For those interested I'm looking at a GESBC-9G20 SBC from http://www.glomationinc.com.