Robot Vac Hack

Introduction:

I recently got the XR-210 robotic vacuum cleaner from zazz.com.au as one of their daily bargains. I've only been using it for a few days, but so far I'd highly recommend it.


One of the main features of the system is the automatic docking station. When the robot's batteries are low it can automatically find its way back and start charging. In my opinion this is the killer feature for the device, since it means you can set-and-forget the cleaner. It has a scheduler feature so you can arrange to have it start during the work day and complete the noisy cleaning before you come home.

Additionally there is a room denial system (which I'll call a 'lighthouse'), which allows you to throw a virtual wall across the room and prevent the robot from passing.

Lighthouse dissasembly & analysis:

I wanted to find out exactly what was inside the lighthouse. It has a single PCB with a few components, a single IC, some transistors and 3 LEDs. The green LED is power, and there are two IR leds. One is directional, pointing forwards to define where the robot is not allowed to pass, the other is a funneled through a reflector which bounces the beam in all directions.

However I noticed that there is a segment removed from the baffle, pointing towards the front. So I suspect the IR output to the front is slightly higher.


 

I hooked up a logic analyzer to the LEDs and studied how it blinked the LEDs in each mode. I used the excellent logic analyzer from Saleae. (Please make a Linux version, guys!)

The IR structre is very simple;
  • 8 bunches of pulses per second, each one 125ms long
  • Each bunch consists of 100ms of silence and ~25ms of burst data.
  • The burst data consists of 1ms of silence, followed by 1ms of 37kHz noise.
  • 37khz noise is a 13us On and 13us Off.
The above is for when the lighthouse is set to maximum. When it's set to medium the 1ms of 37khz noise has a massively reduced duty cycle. (about 0.5us or just under 2%). When the lighthouse is set to minimum, it appears to short fire pulses randomly. I'm not sure why that is, and I haven't investigated it further yet.

Note that the lighthouse IR beam isn't related to the docking station code below.

I can't believe it's not a lighthouse!: (Or, make your own with an arduino)

I wanted to recreate the code so I can add peripherals later if I need to. It was quite simple to recreate the IR pattern using an arduino and a simple IR led.

The atmega chip has enough current limiting to allow you to simply hook up the IR led without any resistors.

The pseudo lighthouse, the LED on the arduino breakout and the results below:

The arduino code can be downloaded here, or the link at the bottom of the page.

Docking station disassembly:

Note: after removing the base from the docking station you are greeted with 8 screws. Only the outer-most 4 are necessary to get the circuit board outside the case.

What was interesting was the construction of the docking station seemed quite different to the lighthouse. The dock uses through-hole components, and looks like some quite old technology, where the lighthouse uses surface mount. There are two sprung metal contacts on the front of the unit which the robot presses against for charging.

 
There are 3 IR LEDs, separated by baffles. It's quite an ingenious design. Depending on where the robot is on the 'glide path', different sets of LEDs are visible.

The system consists of 8 pulses. 4 synchronizing pulses, followed by 4 pulses which uniquely convey which LED is speaking:
What's so clever about the protocol is that the robot receiver only has to wait for the 4 sync pulses, then it knows which time to sample to figure out if each beam (top, left, centre and right) is visible. Since the pulses from all LEDs are synchronised it means that the robot can unambiguously tell exactly where it is on the glide path.

You can see roughly how the robot self-centres by looking at the time lapse pictures of the behavior here:
Note that there are a couple of failed docks in the pictures. The spiral pattern at the bottom left is the 'spot clean' mode.
 
 


Remote disassembly and analysis:

The remote can be opened by removing the screw at the back, and then gently inserting a flathead screwdriver into the gab and working your way aroudn the edge, prying a little bit open at a time.

The PCB has 14 surface mount buttons, a single DIP chip and an LED. There's a daughter board mounted on the main board which handles the RF communications.
The DIP chip has TK98P01  A949U0621#N.
There's a plastic encapsualted crystal (XTAL1B), which has Z4.0MC written on the side.
The daughter board is labelled XR210_SOV10, and has a 16MHz xtal on it.

Annoyingly enough, you have to desolder the battery terminals in order to get it out of the case. In doing so, it lifted the pads a bit.
 
Again I decided to have a look at the protocol using the logic analyser.


The RF daughter board has 4 pins which are connected to the DIP chip,and 3 which weren't. (Pic above taken earlier)I hooked them all up anyway, to see if anything interesting showed up.


If anyone's interested, I've attached the capture file from the remote. (The free Saleae software to view it can be downloaded here).
The keys pressed in following order:   Power, Up, OK, Down, Left, Right, Mon, Tue, Wed, Thu, Fri, Sat, Sun, Full Go

After each key is pressed a burst of information appears on pins 1 through 6 which lasts for 16ms.  This appears to repeat each 70ms while the button is held down
Pin 1 and Pin 3 appear to be data lines. My gut instinct is that pin 3 is the output from the uc to the RF unit, and pin 1 is the return.
Pin 2: Note that Pin 1 or 3 never changes while pin 2 changes. Highly likely that it's some sort of clock with 2us pulses. Additionally it's held high for 140us at the start, probably indicating a clear condition before communicating.
Pin 4: goes high for 0.415ms after each burst. So it's likely that it's some sort of ACK.
Pin 6: seems to be a 2Mhz clock, which is consistent with the resonator on the board.

My first instinct is that it's an SPI bus, but there's no clear slave-select line.

ċ
Remotecontrolcaptue02.logicsession
(394k)
Gavin Smith,
Jul 5, 2010, 4:33 AM
ċ
Robovaclighthousev01.pde
(1k)
Gavin Smith,
Jul 4, 2010, 3:46 AM
Comments