XAC with EV3

Este artigo é a parte 4 de 4 da série  Xbox Adaptive Controller

Running ev3dev (‘4.14.71-ev3dev-2.3.0-ev3 (stretch)’.

BT works, just needed to edit ‘/sys/module/bluetooth/parameters/disable_ertm’.


Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
hid-generic 0005:045E:0B0C.0002: unknown main item tag 0x0
Bluetooth: received HCILL_WAKE_UP_IND in state 2
input: Xbox Adaptive Controller as /devices/platform/soc@1c00000/serial8250.2/tty/ttyS2/hci0/hci0:1/0005:045E:0B0C.0002/input/input3
hid-generic 0005:045E:0B0C.0002: input,hidraw1: BLUETOOTH HID v9.03 Gamepad [Xbox Adaptive Controller] on a0:e6:f8:60:16:60

I don’t have a ‘/dev/input/js0’  because ev3dev ‘joydev’ has been deprecated.

But I can still read it with ‘cat /dev/input/event3’ but since it looks like garbage its better to use ‘evtest’:

No device specified, trying to scan all of /dev/input/event*
Not running as root, no devices may be available.
Available devices:
/dev/input/event0: LEGO MINDSTORMS EV3 Speaker
/dev/input/event1: EV3 Brick Buttons
/dev/input/event2: C-Media USB Headphone Set 
/dev/input/event3: Xbox Adaptive Controller
Select the device event number [0-3]: 3
Input driver version is 1.0.1
Input device ID: bus 0x5 vendor 0x45e product 0xb0c version 0x903
Input device name: "Xbox Adaptive Controller"
Supported events:
  Event type 0 (EV_SYN)
  Event type 1 (EV_KEY)
    Event code 1 (KEY_ESC)
    Event code 2 (KEY_1)
    Event code 3 (KEY_2)
    Event code 4 (KEY_3)
    Event code 5 (KEY_4)
    Event code 6 (KEY_5)
    Event code 7 (KEY_6)
    Event code 8 (KEY_7)
    Event code 9 (KEY_8)
    Event code 10 (KEY_9)
    Event code 11 (KEY_0)
    Event code 12 (KEY_MINUS)
    Event code 13 (KEY_EQUAL)
    Event code 14 (KEY_BACKSPACE)
    Event code 15 (KEY_TAB)
    Event code 16 (KEY_Q)
    Event code 17 (KEY_W)
    Event code 18 (KEY_E)
    Event code 19 (KEY_R)
    Event code 20 (KEY_T)
    Event code 21 (KEY_Y)
    Event code 22 (KEY_U)
    Event code 23 (KEY_I)
    Event code 24 (KEY_O)
    Event code 25 (KEY_P)
    Event code 26 (KEY_LEFTBRACE)
    Event code 27 (KEY_RIGHTBRACE)
    Event code 28 (KEY_ENTER)
    Event code 29 (KEY_LEFTCTRL)
    Event code 30 (KEY_A)
    Event code 31 (KEY_S)
    Event code 32 (KEY_D)
    Event code 33 (KEY_F)
    Event code 34 (KEY_G)
    Event code 35 (KEY_H)
    Event code 36 (KEY_J)
    Event code 37 (KEY_K)
    Event code 38 (KEY_L)
    Event code 39 (KEY_SEMICOLON)
    Event code 40 (KEY_APOSTROPHE)
    Event code 41 (KEY_GRAVE)
    Event code 42 (KEY_LEFTSHIFT)
    Event code 43 (KEY_BACKSLASH)
    Event code 44 (KEY_Z)
    Event code 45 (KEY_X)
    Event code 46 (KEY_C)
    Event code 47 (KEY_V)
    Event code 48 (KEY_B)
    Event code 49 (KEY_N)
    Event code 50 (KEY_M)
    Event code 51 (KEY_COMMA)
    Event code 52 (KEY_DOT)
    Event code 53 (KEY_SLASH)
    Event code 54 (KEY_RIGHTSHIFT)
    Event code 55 (KEY_KPASTERISK)
    Event code 56 (KEY_LEFTALT)
    Event code 57 (KEY_SPACE)
    Event code 58 (KEY_CAPSLOCK)
    Event code 59 (KEY_F1)
    Event code 60 (KEY_F2)
    Event code 61 (KEY_F3)
    Event code 62 (KEY_F4)
    Event code 63 (KEY_F5)
    Event code 64 (KEY_F6)
    Event code 65 (KEY_F7)
    Event code 66 (KEY_F8)
    Event code 67 (KEY_F9)
    Event code 68 (KEY_F10)
    Event code 69 (KEY_NUMLOCK)
    Event code 70 (KEY_SCROLLLOCK)
    Event code 71 (KEY_KP7)
    Event code 72 (KEY_KP8)
    Event code 73 (KEY_KP9)
    Event code 74 (KEY_KPMINUS)
    Event code 75 (KEY_KP4)
    Event code 76 (KEY_KP5)
    Event code 77 (KEY_KP6)
    Event code 78 (KEY_KPPLUS)
    Event code 79 (KEY_KP1)
    Event code 80 (KEY_KP2)
    Event code 81 (KEY_KP3)
    Event code 82 (KEY_KP0)
    Event code 83 (KEY_KPDOT)
    Event code 86 (KEY_102ND)
    Event code 87 (KEY_F11)
    Event code 88 (KEY_F12)
    Event code 96 (KEY_KPENTER)
    Event code 97 (KEY_RIGHTCTRL)
    Event code 98 (KEY_KPSLASH)
    Event code 99 (KEY_SYSRQ)
    Event code 100 (KEY_RIGHTALT)
    Event code 102 (KEY_HOME)
    Event code 103 (KEY_UP)
    Event code 104 (KEY_PAGEUP)
    Event code 105 (KEY_LEFT)
    Event code 106 (KEY_RIGHT)
    Event code 107 (KEY_END)
    Event code 108 (KEY_DOWN)
    Event code 109 (KEY_PAGEDOWN)
    Event code 110 (KEY_INSERT)
    Event code 111 (KEY_DELETE)
    Event code 119 (KEY_PAUSE)
    Event code 125 (KEY_LEFTMETA)
    Event code 126 (KEY_RIGHTMETA)
    Event code 127 (KEY_COMPOSE)
    Event code 158 (KEY_BACK)
    Event code 172 (KEY_HOMEPAGE)
    Event code 240 (KEY_UNKNOWN)
    Event code 241 (KEY_VIDEO_NEXT)
    Event code 304 (BTN_SOUTH)
    Event code 305 (BTN_EAST)
    Event code 306 (BTN_C)
    Event code 307 (BTN_NORTH)
    Event code 308 (BTN_WEST)
    Event code 309 (BTN_Z)
    Event code 310 (BTN_TL)
    Event code 311 (BTN_TR)
    Event code 312 (BTN_TL2)
    Event code 313 (BTN_TR2)
    Event code 314 (BTN_SELECT)
    Event code 315 (BTN_START)
    Event code 316 (BTN_MODE)
    Event code 317 (BTN_THUMBL)
    Event code 318 (BTN_THUMBR)
    Event code 319 (?)
    Event code 410 (KEY_SHUFFLE)
    Event code 704 (BTN_TRIGGER_HAPPY1)
    Event code 705 (BTN_TRIGGER_HAPPY2)
    Event code 706 (BTN_TRIGGER_HAPPY3)
    Event code 707 (BTN_TRIGGER_HAPPY4)
    Event code 708 (BTN_TRIGGER_HAPPY5)
    Event code 709 (BTN_TRIGGER_HAPPY6)
    Event code 710 (BTN_TRIGGER_HAPPY7)
    Event code 711 (BTN_TRIGGER_HAPPY8)
    Event code 712 (BTN_TRIGGER_HAPPY9)
    Event code 713 (BTN_TRIGGER_HAPPY10)
    Event code 714 (BTN_TRIGGER_HAPPY11)
    Event code 715 (BTN_TRIGGER_HAPPY12)
    Event code 716 (BTN_TRIGGER_HAPPY13)
    Event code 717 (BTN_TRIGGER_HAPPY14)
  Event type 3 (EV_ABS)
    Event code 0 (ABS_X)
      Value  32768
      Min        0
      Max    65535
      Fuzz     255
      Flat    4095
    Event code 1 (ABS_Y)
      Value  32767
      Min        0
      Max    65535
      Fuzz     255
      Flat    4095
    Event code 2 (ABS_Z)
      Value  32768
      Min        0
      Max    65535
      Fuzz     255
      Flat    4095
    Event code 5 (ABS_RZ)
      Value  32767
      Min        0
      Max    65535
      Fuzz     255
      Flat    4095
    Event code 7 (ABS_RUDDER)
      Value      0
      Min        1
      Max        8
    Event code 9 (ABS_GAS)
      Value      0
      Min        0
      Max     1023
      Fuzz       3
      Flat      63
    Event code 10 (ABS_BRAKE)
      Value      0
      Min        0
      Max     1023
      Fuzz       3
      Flat      63
    Event code 16 (ABS_HAT0X)
      Value      0
      Min       -1
      Max        1
    Event code 17 (ABS_HAT0Y)
      Value      0
      Min       -1
      Max        1
    Event code 40 (ABS_MISC)
      Value  32768
      Min        0
      Max    65535
      Fuzz     255
      Flat    4095
    Event code 41 (?)
      Value  32767
      Min        0
      Max    65535
      Fuzz     255
      Flat    4095
    Event code 42 (?)
      Value  32768
      Min        0
      Max    65535
      Fuzz     255
      Flat    4095
    Event code 43 (?)
      Value  32767
      Min        0
      Max    65535
      Fuzz     255
      Flat    4095
    Event code 44 (?)
      Value      0
      Min        0
      Max     1023
      Fuzz       3
      Flat      63
    Event code 45 (?)
      Value      0
      Min        0
      Max     1023
      Fuzz       3
      Flat      63
  Event type 4 (EV_MSC)
    Event code 4 (MSC_SCAN)
Key repeat handling:
  Repeat type 20 (EV_REP)
    Repeat code 0 (REP_DELAY)
      Value    250
    Repeat code 1 (REP_PERIOD)
      Value     33
Testing ... (interrupt to exit)

Pressing the big button ‘A’:

Event: time 1538574732.484613, type 4 (EV_MSC), code 4 (MSC_SCAN), value 90001
Event: time 1538574732.484613, type 1 (EV_KEY), code 304 (BTN_SOUTH), value 1
Event: time 1538574732.484613, type 4 (EV_MSC), code 4 (MSC_SCAN), value 90010
Event: time 1538574732.484613, type 1 (EV_KEY), code 319 (?), value 1
Event: time 1538574732.484613, -------------- SYN_REPORT ------------
Event: time 1538574732.574441, type 4 (EV_MSC), code 4 (MSC_SCAN), value 90001
Event: time 1538574732.574441, type 1 (EV_KEY), code 304 (BTN_SOUTH), value 0
Event: time 1538574732.574441, type 4 (EV_MSC), code 4 (MSC_SCAN), value 90010
Event: time 1538574732.574441, type 1 (EV_KEY), code 319 (?), value 0
Event: time 1538574732.574441, -------------- SYN_REPORT ------------

So it is a bit less easy than with Ubuntu but we’ll get somewhere.

Bluetooth working

Este artigo é a parte 3 de 4 da série  Xbox Adaptive Controller

XAC working with bluetooth on my Ubuntu 18.04 laptop.

Only needed to edit ‘sys/module/bluetooth/parameters/disable_ertm’ replacing ‘N’ with ‘1’ or ‘Y’

After a few attempts of pairing my connection kept stable.


Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
hid-generic 0005:045E:0B0C.0006: unknown main item tag 0x0
input: Xbox Adaptive Controller as /devices/pci0000:00/0000:00:14.0/usb1/1-8/1-8:1.0/bluetooth/hci0/hci0:256/0005:045E:0B0C.0006/input/input23
hid-generic 0005:045E:0B0C.0006: input,hidraw3: BLUETOOTH HID v9.03 Gamepad [Xbox Adaptive Controller] on 34:f3:9a:88:60:7a
Bluetooth: hci0: last event is not cmd complete (0x0f)

a lot more of those hci 0x0f errors will keep appearing but connection holds.

Also got a ‘/dev/input/js0’ device but with much more Axles (15) and Buttons (31). But buttons seem duplicated – for instance the big round button ‘A’ is both Button 0 and Button 15 (previously it was only Button 0).


Note 1: this workaround is not permanent.
Note 2: according to wikipedia, ERPM stands for ‘enhanced retransmission mode‘ and is ‘an improved version of retransmission and flow control modes’. Several posts related to using Xbox bluetooth controllers in linux suggest disabling it.


Este artigo é a parte 2 de 4 da série  Xbox Adaptive Controller

Great work Microsoft!

I now have 19 inputs that I can use with whatever I want.

Digital inputs are easy: just connect a switch. Any kind of switch, including LEGO RCX touch sensors.

But 4 of them can be also be analog… and no documentation at all to tell me what voltage levels I can use and if there is any kind of internal protection.

Xbox Adaptive Controller

Este artigo é a parte 1 de 4 da série  Xbox Adaptive Controller

I got one!

Yes, I bought a Microsoft device. A Xbox Adaptive Controller.

Yes, it is from Microsoft and no I don’t have a Xbox nor even a Windows PC. But it is also a USB HID device.

When it was announced, I liked the simplicity of the idea: a USB controller with lots of digital inputs and also some analog inputs with pretty common connectors: 3.5 mm audio jacks! (yes, TLG, common connectors!!!). And although not officially announced as so, it was not a closed device – it was meant to extend the gaming experience and not only for Microsoft systems.

And it also reminded me the LEGO DACTA Interface A but with inputs only, no outputs.

So now that it is available I ordered one. It arrived today… and linux thinks it is some kind of joystick.


usb 1-6.2: new full-speed USB device number 9 using xhci_hcd
usb 1-6.2: New USB device found, idVendor=045e, idProduct=0b0a
usb 1-6.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-6.2: Product: Controller
usb 1-6.2: Manufacturer: Microsoft
usb 1-6.2: SerialNumber: 3032353630303131363937383235
input: Generic X-Box pad as /devices/pci0000:00/0000:00:14.0/usb1/1-6/1-6.2/1-6.2:1.0/input/input23
usbcore: registered new interface driver xpad

ls -l /dev/input/by-id/ :

lrwxrwxrwx 1 root root 10 out 1 14:56 usb-Microsoft_Controller_3032353630303131363937383235-event-joystick -> ../event22
lrwxrwxrwx 1 root root 6 out 1 14:56 usb-Microsoft_Controller_3032353630303131363937383235-joystick -> ../js0

Since I got a joystick (‘/dev/input/js0’) let’s test it with jstest:

jstest /dev/input/js0

Axes: 0: 0 1: 0 2:-32767 3: 0 4: 0 5:-32767 6: 0 7: 0 Buttons: 0:off 1:off 2:off 3:off 4:off 5:off 6:off 7:off 8:off 9:off 10:off

The black cross-shaped pad is mapped to Axle 6 (Left: -32767 / Right: 32767) and Axle 7 (Up: -32767 / Down: 32767).

The ‘View’ button is Button 6, the ‘Menu’ button is Button 7 and the big black round buttons (‘A’ and ‘B’) are Button 0 and Button 1. No action detected when pressing the ‘Xbox’ and the ‘Profile’ buttons.

Now if I connect a 3.5 mm jack to the first plug (with the symbol of an arrow to the left and a cross) and shunt it I get ‘-32767’ at Axle 6… the same as pressing the left part of the black cross pad. In fact, the 4 first jacks are mapped to Axle 6 and 7 (left, up, down and right).

So I can connect any kind of switch to these jacks. Including, of course, LEGO switches 🙂

And, of course, I can also connect the XAC to the LEGO MINDSTORMS EV3 running ev3dev.

So what crazy HID shall we create?

Note: the XAC also has Bluetooth. It announces as “Xbox Adaptive Controller”  and I can pair it with my Ubuntu but it shows as disconnected (it does connect but when browsing the services it immediately disconnects). Microsoft states that BT only works with Windows 10 so I might need to sweat a bit more before having a wireless controller.

A LEGO relay

I needed a LEGO mechanism that could turn ON or OFF an electrical circuit using an independent power source. This power source could be a regular LEGO battery but could also be a different type. So a LEGO relay.

I remember seeing somewhere a few LEGO mechanisms with the same purpose, like moving the slider of a Power Functions battery box or rotating an axle inside of a Power Function switch… but could not find them.

So this is my own implementation.

I used a Power Functions switch. We can mechanical control the switch with a Technic axle inserted in two different ways – over the top or through it:

I decided to insert the axle through it. As the idea is using a MINDSTORMS to control the relay, I could have connected the axle directly to a motor and control the time or the angle. But I started with a Power Functions motor connected to a Power Functions battery and since the motor is too strong and fast I used a clutch gear to protect the switch when extreme position is reached.

The switch has 3 working positions where the neutral (middle) is the OFF position and both left and right extremes are ON both with opposite polarities. As I just wanted ON and OFF I needed to limit the motion to just half.

Perhaps not most the efficient mechanism or beautiful design but this works:

The cam gears were the first piece I found with the proper size – when the switch is off the cam gears touch the Technic grey brick so if the motor keeps rotating the clutch gear will slip and protect the switch axle.

The relay works with power Functions cables so regular LEGO batteries and devices can be used. But I used a 2.1 mm female jack with a pair of crocodile cables to connect an old LEGO electric plate to a 12V/1.5A wall power supply and a custom Power Functions cable with male headers soldered to it to connect to a kanthal wire.

I prefer to use kanthal wire instead of nichrome wire for several reasons: it has a higher electrical resistence and also a higher melting temperature… and it is also widely available now that vaping is a trend (I don’t smoke but could not find a single nichrome supplier here in Portugal but have several online vaping stores selling dozens of variants of kanthal wires). Metal strings used with guitars also work and are easy to find but electrical resistance is too low.

So I used a 20 cm piece of kanthal wire to make a coil with perhaps a dozen turns and test it several times:

Then connected the coil endpoints to 2 crimp pins and soldered it to the custom Power Functions wire (it’s not easy to solder kanthal wire so crimping is a better option)

And now I have a MINDSTORMS controlled ignitor. Great for hobby rockets or party candles:

Remember: don’t try to do this if you don’t fully understand it. Also keep in mind that although party sparkles aren’t dangerous per se igniting one near flammable products can start a fire. Always take safety measures.


And the bash script for the sparkle ignitor’s video (ev3dev):

#!/usr/bin/env bash

MTRTIME=1000   # 1 second
PAUSE=1 # MTRTIME / 1000

IGNITION=10 # ignition time in seconds

function Init {
    echo "Start"
    echo $MTRTIME > /sys/class/tacho-motor/motor0/time_sp

function SwitchON {
    echo $MTRSPEEDON > /sys/class/tacho-motor/motor0/speed_sp
    echo run-timed > /sys/class/tacho-motor/motor0/command
    sleep $PAUSE

function SwitchOFF {
    echo $MTRSPEEDOFF > /sys/class/tacho-motor/motor0/speed_sp
    echo run-timed > /sys/class/tacho-motor/motor0/command
    sleep $PAUSE

function SpeakCountdown {
    espeak -a 200 -g 12 -p 70 "Ten"
    espeak -a 200 -g 12 -p 70 "Nine"
    espeak -a 200 -g 12 -p 70 "Eight"
    espeak -a 200 -g 12 -p 70 "Seven"
    espeak -a 200 -g 12 -p 70 "Six"
    espeak -a 200 -g 12 -p 70 "Five"
    espeak -a 200 -g 12 -p 70 "Four"
    espeak -a 200 -g 12 -p 70 "Three"
    espeak -a 200 -g 12 -p 70 "Two"
    espeak -a 200 -g 12 -p 70 "One"
    espeak -a 200 -g 12 -p 70 "Zero"

function SpeakHB {
    espeak -a 200 -g 12 -p 70  "Happy birthday!"

function finish {
    echo reset > /sys/class/tacho-motor/motor0/command
    echo "End"

trap finish EXIT



Kittenbot Geek Servo

Este artigo é a parte 2 de 2 da série  LEGO-compatible RC servos

Found another RC motor that can be used with LEGO: the Kittenbot Geek Servo

It works very well with my Pololu Maestro board although I just can get a little less than 180º rotation instead of 270º as the title of the product at Bangood states (to be honestly I didn’t even noticed that title until now as I expect all RC servos to rotate 180º or, when modified, to rotate continuously).

I have a fixation with small LEGO motors and this one motor is smaller than the 4DBrix motor:

4DBrix Servo and Kittenbot Geek Servo motors

Both top studs and bottom reverse-studs connect to LEGO bricks but only bottom reverse-studs give a strong LEGO-like connection. The Technic-like holes work very well and the axle is also Technic compatible.

For monorail or train rail switches I still prefer the 4DBrix Servo because I can attach it directly to the 4DBrix monorail swicthes (of course) and to my Technic-based rail switches as drop-in replacements of Power Functions M or L motors (or even MINDSTORMS EV3 smaller servo). But for my LEGO Rock Concert cameras this little fellow might do a better job. It’s still bigger than the good old LEGO 9V micro-motor but it is already geared and Technic attachable so in the end it might even save more space and give bette results.

Each kit comes with 4 motors so the price is also quite good.

Sniffing the LEGO WeDo 2.0 Motion Sensor

Now that I have a working cable to intercept Powered Up signals I no longer need to cut a sensor cable to hijack it.

So let’s start with a simple sensor: the 45304 LEGO WeDo 2.0 Motion Sensor


  1. connect the male plug of the Powered Up Interception Cable to LEGO BOOST Move Hub (port C)
  2. connect a WeDo 2.0 Motion Sensor to the “female” plug of the Interception Cable
  3. connect the Bus Pirate to the “interception” 6-pin header
  4. connect the Bus Pirate to a USB port and set it up as a Transparent UART Bridge (115200 bps, 8N1, floating inputs)
  5. run jpnevulator to read traffic comming from the Bus Pirate
  6. turn of the LEGO BOOST Move Hub
  7. connect to it with gatttool
  8. enable notifications (‘char-write-req 0x0f 0100’)
  9. enable the Motion Sensor on port C (‘char-write-req 0x0e 0A004101000100000001’) in mode ‘0’
  10. watch, watch, watch

So everytime the measured distance change I get a notification in gatttool and a 3-byte message in jpnevulator. And it is simple:

00 => C0 00 3F
01 => C0 01 3E
02 => C0 02 3D
03 => C0 03 3C
04 => C0 04 3B
05 => C0 05 3A
06 => C0 06 39
07 => C0 07 38
08 => C0 08 37
09 => C0 09 36
0A => C0 0A 35

A start byte (‘C0’) plus the payload  plus and end byte (‘3F’ i.e. the complement of ‘C0’ minus the payload).

Great! Not even an initialization sequence!

So disconnect the Interception Cable male plug and replace the Bus Pirate with the FTDI Beefy 3 adapter, set ‘/dev/ttyUSB3’ to 115200 and raw mode and test several bash commands.

Not totally clear yet but this works:


#!/usr/bin/env bash

# sync
for i in {1..50000}
    echo -e -n "\x00" > /dev/ttyUSB3

for i in {1..50000}
    echo -e -n "\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" > /dev/ttyUSB3

(that ‘echo’ command is just a line)

Now the usual voodoo explanation:

The first byte sent is like a read command. I got success with ’02’, ’04’, ‘0F’, ’27’ and ‘FF’ and 3 different behaviors.

The remaining 15 bytes (’00’) are like the inital synchronization commands… I don’t think they are valuable data and sending a ‘break’ to the TX line for enough time would do the same… but I just can’t find a way to send a break.

So the 3 different behaviors:

  • ’02’ gets a lot of 3-byte messages from the Motion Sensor. Probably one message for each ’02’, I suspect 50 messages per second but need to check that. After a few minutes, it stops sending data.
  • ‘FF’ gets much less messages, about 1 per second. And the message is now 5-bytes long: ‘7B C1’ or ‘7B C2’ followed by the 3-byte message above (like ‘C0 00 3F’). And after a few minutes the sensor also stops sending data. So ‘7B C1’ or ‘7B C2’ are warnings from the Sensor stating that it expects something more.
  • Finally ’04’, ‘0F’ and ’27’ (and probably other values) make the Sensor behave in Mode 0 (i.e. just send data when distance changes). But it also expires after a while (I think sooner than other two modes) and the sensor sends a few ‘7B C1’ warnings followed by a read).

Now the interesting part is that if I keep moving something in front of the sensor it doesn’t “expire”. So it is probably some power saving definition, it would be nice if we could disable it.

So perhaps I’ve found a way to make my own sensor: if I can emulate the AutoID of the WeDo 2.0 Motion Sensor (device type ’23h’) I just need to send it short 3-byte messages (just 11 different values but that would be a start).

Powered Up interception cable

Fancy name 🙂

Arrived from holidays and had two small packets in the mail box:

  • One from David Lechner with 2 Powered Up-compatible male plugs with cables already attached (and 4 great ev3dev stickers!)
  • Other from Mouser Electronics with a few 1.27 mm headers I ordered to try to replicate Philippe “Philo” Hurbain idea to a pseudo female plug

So I finally made my own Powered Up extension cable with a third connector to sniff the communicares between the hub and a sensor or an interactive motor:

Philo hack works but it’s really tough to execute. My soldering skills aren’t great (my hands shake _a_lot_) and my vision is getting worse. But at my third attempt I got a working connection, not 100% tight but stable enough for my purposes.

Too bad I get back to work this week… I hope that spying the WeDo 2.0 tilt and motion sensors I can find something more about the protocol used on Powered Up sensors.

The end is near

Este artigo é a parte 8 de 8 da série  Sniffing the LEGO Interactive Motor

Holidays end today.

And finally got something repeatable with the motor.

The motor talks at 115200 bps, 8N1.

It expects an Init command. And it asks for it (or at least it complains of something). But it also requires some sort of warm up procedure that requires sending to the motor a lot of ’00’ for a while. It seems like a long break before start communication but for some reason it doesn’t work if I use pyserial break command.

Python code here.

Tried to use it in EV3 running ev3dev but no success. 115200 might be to much for the Ev3… or it’s just my bad programming skills.

And this is the FTDI Beefy 3 adapter that I’m using:

To recap the wiring:

  • FTDI GND (black wire) to pin 3
  • FTDI 3V3 (red wire) to pin 4
  • FTDI TX(white/grey wire) to pin 5
  • FTDI RX (green wire) to pin 6

And a sample of the output:

Speed   : 00 (h) =  0 (d)
Position: 00   00   00   00 = 0  degrees
CRC     : 27 (h) =  39 (d)

Speed   : 11 (h) =  17 (d)
Position: 09   00   00   00 = 9  degrees
CRC     : 3F (h) =  63 (d)

Speed   : 1D (h) =  29 (d)
Position: 13   00   00   00 = 19  degrees
CRC     : 29 (h) =  41 (d)

Timeout -> Resync
Speed   : 04 (h) =  4 (d)
Position: 9D   00   00   00 = 157  degrees
CRC     : BE (h) =  190 (d)

Speed   : 00 (h) =  0 (d)
Position: 9D   00   00   00 = 157  degrees
CRC     : BA (h) =  186 (d)

The script is still far from perfect – I was rotating the motor half a turn clockwise and it lost communication in the middle… but at least it reconnected fast enough to preserve position.

Geek kit for holidays

Next holidays don’t forget:

  • USB soldering iron (great acquisition!) and decent thin solder wire
  • small base for the soldering iron, with flexible arms if possible
  • high current USB hub and a high current USB battery pack
  • jumper wires (F-F, M-F, M-M, several colors)
  • alligator wires (several colors)
  • a few female headers compatible with the jumper wires (6 pin were great for EV3 and Powered Up hacking)
  • multimeter
  • Bus Pirate and BitScope (but a decent Logic Analyzer with linux support would be great)
  • Ubertooth (but a more recent BLE sniffer with linux support would be great)
  • a decent small wire stripper (still to be found)
  • a few EV3 and Powered cables and plugs
  • an Arduino and a NodeMCU
  • a FTDI Beefy 3 breakout board (or 2!!!)
  • a kit of resistors, diodes, capacitors and LEDs
  • a small motor driver or H-Bridge breakout board (shame!!!)
  • a swiss army knife
  • of course some LEGO (at least one EV3 rover with wi-fi and BLE)
  • some ziplock bags
  • a good excuse