Reverse Engineering LEGO Education Science (“Coral”)

[Mr Hobbles]

Hey folks — I’ve been reverse engineering the new LEGO Education Science components. Much like Powered Up, the possibilities are excellent - provided you’re comfortable getting technical.

(Note: According to their code, LEGO refers to this product range internally as “Coral”.)

How It Works

Each device (controller, motors, colour sensor) has built-in Bluetooth and an NFC reader. When you power a device on, you wave one of the coloured cards next to it, and it “joins” that group.

Despite the cards being different colours, grouping is actually handled via NFC, not colour. Each card has a unique NFC ID, even if multiple cards share the same colour. In a classroom setting, this means you can hand out identical-coloured cards (for example, multiple green cards) and still have independent groups, as each card represents a distinct NFC identity.

Interestingly, the devices never connect directly to each other. Instead, they broadcast their state using Bluetooth Low Energy advertisements. Other devices listen for broadcasts by the same group and react accordingly.

For example:

• Move the left stick on the controller
• The controller broadcasts its state
• The left motor sees the broadcast and responds

It’s a surprisingly elegant and robust way of grouping and coordinating devices.

Coding Tools

LEGO provides a web-based coding environment at https://code.legoeducation.com/

Using Chrome, you can connect directly to the devices and program them via a Scratch-like interface. The blocks will feel familiar to anyone who has used SPIKE Essentials, SPIKE Prime, or Powered Up.

Building a Node.js Library

My initial plan was to sniff the Bluetooth connection between the Code website and the devices. It turns out there was a much simpler approach: just read the JavaScript! :D

While the code is obfuscated, it’s trivial to run through a deobfuscator. Doing so revealed all the Bluetooth commands. Interestingly, the wire-level protocol is far simpler than Powered Up — very lightweight and straightforward.

From this, I built a Node.js library in TypeScript, called node-coral, which allows you to control the devices directly using JavaScript or TypeScript.

https://github.com/nathankellenicki/node-coral/

Putting It All Together

As an experiment, I connected Coral, WeDo 1.0, and a Dacta Control Lab, and got them all talking to each other — interoperability spanning 30+ years of LEGO hardware! (I love this stuff lol)

This setup uses libraries I’d previously written, node-wedo and node-controllab. I’ve updated both of these over the past couple of days to bring them up to date.

https://github.com/nathankellenicki/node-wedo
https://github.com/nathankellenicki/node-controllab

Here's the setup:

• A LEGO Education WeDo (1.0) Hub with a Power Functions Medium Motor
• A LEGO Dacta Control Lab with a Power Functions Medium Motor and a 9v Touch Sensor
• A LEGO Education Science (Coral) Single Motor
• A LEGO Education Science (Coral) Controller
   
• The left stick on the Coral Controller controls the Power Functions Motor connected to WeDo 1.0.
• The right stick on the Coral Controller controls the Power Functions Motor connected to the Control Lab.
• The 9v Touch Sensor turns the Coral Single Motor on and off.

Here’s a video, along with an architecture diagram showing how everything is connected.

Hopefully some of you find this interesting - if only it wasn't so prohibitively expensive to normal people (even schools will find this expensive!)

[Stereo]

So reading between the lines a bit, none of the bricks are programmable, they just have preset signals they broadcast and respond to?  Sounds like it'd probably be possible to get PoweredUp hubs to control them, you'd just need to manually put the hub in a Coral "group" since it has no NFC reader.

[Mr Hobbles]

20 minutes ago, Stereo said:

So reading between the lines a bit, none of the bricks are programmable, they just have preset signals they broadcast and respond to?  Sounds like it'd probably be possible to get PoweredUp hubs to control them, you'd just need to manually put the hub in a Coral "group" since it has no NFC reader.

That’s correct, and in fact sadly, it looks like Pybricks won’t be compatible, as (like the Technic Control+ Move Hub) Lego have started signing the firmware.

Mind you, they aren’t programmable, but they are controllable, just like Powered Up.

I doubt it’s possible out of the box to have a Powered Up hub join a Coral group, but it may be if you put Pybricks on that Powered Up hub. I’m not too familiar with Pybricks capabilities, but as long as it can broadcast certain services/characteristics/manufacturer data, it’s theoretically possible.

It would be an interesting experiment!

[2GodBDGlory]

Thanks for sharing!

[gyenesvi]

That's a really nice reverse engineering effort, great work!

11 hours ago, Mr Hobbles said:

Mind you, they aren’t programmable, but they are controllable, just like Powered Up.

So just to clarify what that exactly means, how do you set which control lever controls which motor and whit what speed / direction? And which unit runs that logic (the program that you code on the web)? Does it get sent to one of the units? Or does it run in the browser on a laptop for example?

[Mr Hobbles]

1 hour ago, gyenesvi said:

That's a really nice reverse engineering effort, great work!

So just to clarify what that exactly means, how do you set which control lever controls which motor and whit what speed / direction? And which unit runs that logic (the program that you code on the web)? Does it get sent to one of the units? Or does it run in the browser on a laptop for example?

So, out of the box, with no laptop in the mix, the behaviours are fixed. If they're in the same group, the left joystick on a controller will control the speed of the left wheel on a double motor, and the right joystiq will control the speed of the right wheel on a double motor. If there's also a single motor in the group, then the left joystick will turn the motor on and off - no speed control. Similarly with the color sensor, there are set behaviours on how the motors will react to colors.

However if you use a laptop to "code" the devices from the code.legoeducation.com site, then it's like Powered Up or SPIKE - you can program anything to happen, ie. have a robot do a dance when you move a stick up on the controller.

Taking it a step further, if you program it using traditional code (ie. using node-coral that I published above), you can make anything - have the lights in your living room turn on if you use the controller. :)

In terms of where the logic is run, the devices are dumb - the logic runs on your laptop. The devices receive commands from your laptop and report back sensor data to your laptop. So if you're using the code.education.com site, then it's in your browser.

[Mr Hobbles]

I made another video showing many things working together, this time with text to describe what's happening. 

 

[JopieK]

Awesome work @Mr Hobbles. Thanks for sharing the videos and the code! Did you also dare to open them? I'm interested what microcontrollers they are using (of course).

[Mr Hobbles]

@JopieK I haven't fully torn them down as the clips clipping it together look easilly breakable, so I daren't get to the PCB itself. However there are tri wing screws on the bottom that when removed, reveal an easily replaceable battery! Although, it looks like a bespoke battery type, and I'm not sure if Lego will ever sell it seperately. I hope so.

On another note, I made a small proof of concept of a 3D Space Shooter game in Unity, using the Coral Double Motor as a controller. It uses the IMU roll/pitch/yaw to control the ship, and turning the right motor acts as thruster control (increase/decrease), and turning the left motor activates laser firing.

Just a bit of fun, but it demonstrates what these devices are capable of!
 

 

[BrickTronic]

4 hours ago, Mr Hobbles said:

@JopieK I haven't fully torn them down as the clips clipping it together look easilly breakable, so I daren't get to the PCB itself. However there are tri wing screws on the bottom that when removed, reveal an easily replaceable battery! Although, it looks like a bespoke battery type, and I'm not sure if Lego will ever sell it seperately. I hope so.

On another note, I made a small proof of concept of a 3D Space Shooter game in Unity, using the Coral Double Motor as a controller. It uses the IMU roll/pitch/yaw to control the ship, and turning the right motor acts as thruster control (increase/decrease), and turning the left motor activates laser firing.

Just a bit of fun, but it demonstrates what these devices are capable of!
 

 

Hello,

Does you have taken pictures of you try to disassembling ?
Would be great if you could share. Maybe not only me is interested.

On Pybricks-Support Discussion there is not documented how Motor(s) can/will act as Broadcaster/Sender/Advertiser (of IMU-Data & Motor-Position/Speed)
Is your code somewhere available ?
A Link would be great.

Jo

Edited February 9 by BrickTronic
Typo

[Mr Hobbles]

1 hour ago, BrickTronic said:

Hello,

Does you have taken pictures of you try to disassembling ?
Would be great if you could share. Maybe not only me is interested.

On Pybricks-Support Discussion there is not documented how Motor(s) can/will act as Broadcaster/Sender/Advertiser (of IMU-Data & Motor-Position/Speed)
Is your code somewhere available ?
A Link would be great.

Jo

Hi @BrickTronic, my Unity code isn't published, my Node.js code is published as a library here. You can see how the motor emits sensor data once connected. https://github.com/nathankellenicki/node-coral

There are two modes of receiving data from Coral devices:
1. Connected - your BLE host connected to the BLE device and establishes a private connection.
2. Broadcast - there is no connection to the BLE device, the BLE device is always broadcasting its sensor data to all listeners (embedded in the advertising data).

The Pybricks discussion does not cover connected devices, only the broadcast workflow, and yes, they don't cover all sensor types yet, I don't think they've done much researching yet. My library covers the connected workflow, and includes all sensor types. The advertising payload data is identical to the sensor payload data when connected, so you can learn from that. My Unity prototype also uses the connected workflow.

Edited February 9 by Mr Hobbles

[JopieK]

Wow that is very cool @Mr Hobbles. That would be very cool for K-12/High school projects, combining it with Unity indeed, without the electronics fuss (I teach undergraduate embedded systems too, but at high school we don't have the lab possibilities etc, that is hard enough already at an applied university).