Reverse Engineering LEGO Education Science (“Coral”)

[Mr Hobbles]

Hey folks — I’ve been reverse engineering the new LEGO Education Science components. Much like Powered Up, the possibilities are excellent - provided you’re comfortable getting technical.

(Note: According to their code, LEGO refers to this product range internally as “Coral”.)

How It Works

Each device (controller, motors, colour sensor) has built-in Bluetooth and an NFC reader. When you power a device on, you wave one of the coloured cards next to it, and it “joins” that group.

Despite the cards being different colours, grouping is actually handled via NFC, not colour. Each card has a unique NFC ID, even if multiple cards share the same colour. In a classroom setting, this means you can hand out identical-coloured cards (for example, multiple green cards) and still have independent groups, as each card represents a distinct NFC identity.

Interestingly, the devices never connect directly to each other. Instead, they broadcast their state using Bluetooth Low Energy advertisements. Other devices listen for broadcasts by the same group and react accordingly.

For example:

• Move the left stick on the controller
• The controller broadcasts its state
• The left motor sees the broadcast and responds

It’s a surprisingly elegant and robust way of grouping and coordinating devices.

Coding Tools

LEGO provides a web-based coding environment at https://code.legoeducation.com/

Using Chrome, you can connect directly to the devices and program them via a Scratch-like interface. The blocks will feel familiar to anyone who has used SPIKE Essentials, SPIKE Prime, or Powered Up.

Building a Node.js Library

My initial plan was to sniff the Bluetooth connection between the Code website and the devices. It turns out there was a much simpler approach: just read the JavaScript! :D

While the code is obfuscated, it’s trivial to run through a deobfuscator. Doing so revealed all the Bluetooth commands. Interestingly, the wire-level protocol is far simpler than Powered Up — very lightweight and straightforward.

From this, I built a Node.js library in TypeScript, called node-coral, which allows you to control the devices directly using JavaScript or TypeScript.

https://github.com/nathankellenicki/node-coral/

Putting It All Together

As an experiment, I connected Coral, WeDo 1.0, and a Dacta Control Lab, and got them all talking to each other — interoperability spanning 30+ years of LEGO hardware! (I love this stuff lol)

This setup uses libraries I’d previously written, node-wedo and node-controllab. I’ve updated both of these over the past couple of days to bring them up to date.

https://github.com/nathankellenicki/node-wedo
https://github.com/nathankellenicki/node-controllab

Here's the setup:

• A LEGO Education WeDo (1.0) Hub with a Power Functions Medium Motor
• A LEGO Dacta Control Lab with a Power Functions Medium Motor and a 9v Touch Sensor
• A LEGO Education Science (Coral) Single Motor
• A LEGO Education Science (Coral) Controller
   
• The left stick on the Coral Controller controls the Power Functions Motor connected to WeDo 1.0.
• The right stick on the Coral Controller controls the Power Functions Motor connected to the Control Lab.
• The 9v Touch Sensor turns the Coral Single Motor on and off.

Here’s a video, along with an architecture diagram showing how everything is connected.

Hopefully some of you find this interesting - if only it wasn't so prohibitively expensive to normal people (even schools will find this expensive!)

[Stereo]

So reading between the lines a bit, none of the bricks are programmable, they just have preset signals they broadcast and respond to?  Sounds like it'd probably be possible to get PoweredUp hubs to control them, you'd just need to manually put the hub in a Coral "group" since it has no NFC reader.

[Mr Hobbles]

20 minutes ago, Stereo said:

So reading between the lines a bit, none of the bricks are programmable, they just have preset signals they broadcast and respond to?  Sounds like it'd probably be possible to get PoweredUp hubs to control them, you'd just need to manually put the hub in a Coral "group" since it has no NFC reader.

That’s correct, and in fact sadly, it looks like Pybricks won’t be compatible, as (like the Technic Control+ Move Hub) Lego have started signing the firmware.

Mind you, they aren’t programmable, but they are controllable, just like Powered Up.

I doubt it’s possible out of the box to have a Powered Up hub join a Coral group, but it may be if you put Pybricks on that Powered Up hub. I’m not too familiar with Pybricks capabilities, but as long as it can broadcast certain services/characteristics/manufacturer data, it’s theoretically possible.

It would be an interesting experiment!

[2GodBDGlory]

Thanks for sharing!