JopieK

Powered Up - A tear down...

Recommended Posts

Hi guys and gals,

I started with my Powered Up tear down. For now I chose the non-destructive path of least resistance:

For this phase I just needed a TORX T6H screwdriver:

27768366797_cbf615420f_c.jpg

These are the internals of the train remote control. You can see the Bluetooth chip right in de middle. I might also desolder the battery terminals so I can show the backside of the print as well. I think they did a great job in designing the PCB, looks neat and tidy (although I am an CS/Informatics teacher I design / solder a lot of PCB's for one of our college research projects).

So this is a close-up of the PCB:

27768364187_e591dc24ee_c.jpg

The Bluetooth chip is de CC2640 by Texas Instruments: datasheet / details.

I would have used a SoC, but they created everything of their own and integrated the antenna etc. right into the PCB, hope the backside will show the traces for it :).
You also see the RGB led (D2).

The 'grain circles' are the trick they used so that the knobs can be turned and the buttons will still ensure a proper reaction.

For now that's it for the controller. Next up: the receiver.

It needs to be a little more intricate:
- you need a motor controller (one can't directly control a motor from a microcontroller chip since motor draw too much current for such electronics and also often require a higher voltage)
- you need of course also a bluetooth chip

Not the best picture bu I focussed on making the IC's readable (and that worked quite well I think, you should be able to click on it for the larger / sharper version):

27768363217_d6f4cda8e4_c.jpg

So it uses an STM32F030 micro controller. I already guessed that since that is the same one they use in Boost. For the non-electronics people: a microcontroller is a computer on a small chip.
These chips are getting so powerful that their processing power and memory is approaching our first personal computers (but then for a fraction of the size, price and power usage). In fact this one is a 16 Kbytes Flash, 48 MHz CPU (my first 486 when I was a teen ran at only 25 MHz).

To the left near the PU ports are two tiny chips. I assume these have to do with the output ports, but I could not trace them for now. The chip at the top right is a tiny chip by Texas Instruments for power management of the board and system. Again you see the same RGB led.

Just like with the controller, to see the backside of the board requires desoldering the battery leads. That is not a problem at all but I don't want to melt the ABS below it so it requires some special care.

Last up is the inside of the motor:

27768365627_f4ea7141f4_c.jpg

It seems to look very much like the PF motors. It gives at least something away about the connectors: Two motor leads, two 'identifaction' leads (people trying to hack Boost suggested handshakes find place over these wires to determine what device is connected to it, but here ID1 on lead 5 is connected to lead 4 VCC (the 9V motor power) and ID2 (lead 6) is connected directly to GND (lead 3).

That HL05 golden thing is a self resetting fuse, would protect the system from harm if a short / stall occurred. The other little thingy (C2) is a capacitor that tries to prevent spikes coming from the motor while running, harming the rest of the electronics (read the controller).  

So this is the pinout as seen from the controller:

28765311538_e74bf2117a_m.jpg

That's it for now. I see a lot of possibilities to test the PU stuff even more. I already did some Bluetooth scanning using my iPhone, I could connect to the devices but one needs to send / receive commands in a certain way apparently so there is still a lot to do in that direction, hope LEGO will open up their commands to us, would be very beneficial for hobbyists and educators alike (I'm both ;)).

Here is b.t.w. a very useful link for the software part of Boost: https://github.com/JorgePe/BOOSTreveng

We will need some modifications for Powered Up, but it shares the basic principles and even the basic Bluetooth addresses.

Share this post


Link to post
Share on other sites

Thanks, useful pictures! I noticed that there some exposed pins on the controller, and in some other pictures I saw more exposed pins on the inside of the battery compartment of the hub. Do you think the micro controller can be reprogrammed?

Edited by Mr Hobbles

Share this post


Link to post
Share on other sites

I think so! You can also see that at the top of the remote (GND, TMS, TCK, TDC, TDI, RESET, VCC) that is obviously used to program the chip after the board is soldered. But then I need to desolder the battery connectors if I want to show the backside of the controller. I will do that but not before the weekend. The CC2640 chips could be reprogrammed (see: datasheet), they actually have two microcontrollers in it (A cortex M0 and M3 processor). I assume they allow for OTA (over the air) updates and I assume the app that LEGO promises to provide on the box will be able to update the firmware.

Share this post


Link to post
Share on other sites

Thank you, this is some really usefull information. 

Could it be possible that LEGO will release details about the Bluetooth protocol. I'm interested in some possible Arduino control options. 

Share this post


Link to post
Share on other sites

Looking at the hub electronics size, one can only imagine PF1 battery box could be smaller...but then this one would be bigger and there would be complaints. Now that's great planning ahead :)

Share this post


Link to post
Share on other sites
42 minutes ago, UrbanErwin said:

Thank you, this is some really usefull information. 

Could it be possible that LEGO will release details about the Bluetooth protocol. I'm interested in some possible Arduino control options. 

For now our best chance is doing it ourselves I guess (reverse engineering like the Boost-enthusiast did). I use nRF52 BLE chips with Arduino (SAMD21) and they work very well.

Share this post


Link to post
Share on other sites
12 hours ago, JopieK said:

Last up is the inside of the motor:

27768365627_f4ea7141f4_c.jpg

It seems to look very much like the PF motors. It gives at least something away about the connectors: Two motor leads, two 'identifaction' leads (people trying to hack Boost suggested handshakes find place over these wires to determine what device is connected to it, but here ID1 on lead 5 is connected to lead 4 VCC (the 9V motor power) and ID2 (lead 6) is connected directly to GND (lead 3).

Good to see there is no complicated logic inside the motor. Swapping M1 and M2 should change the polarity of the motor. Hopefully a controller can be paired with two receivers. Otherwise running long trains will become a problem. Has anybody tried it?

Edited by legotownlinz

Share this post


Link to post
Share on other sites

If two of the wires in the new cables are dedicated to this ID system, that means there could be up to four 'types' of motor - IIRC from the Sariel video, a Boost motor needs a constant signal to keep running, but presumably the train motors are the same up-down in terms of speed that we've gotten used to. I'd like to see if the two ID pins on a Boost motor are wired differently (all high, all low, or the opposite of what the train motor has).

Also, I appear to have guessed correctly at the method of allowing the controller's buttons to be twisted but still work. I believe this is how the older PF train remote works as well (slip rings).

14 hours ago, JopieK said:

27768364187_e591dc24ee_c.jpg

The Bluetooth chip is de CC2640 by Texas Instruments: datasheet / details.

I would have used a SoC, but they created everything of their own and integrated the antenna etc. right into the PCB, hope the backside will show the traces for it :).
You also see the RGB led (D2).

Initially I thought that the large white component that says BOURNS on it was the antenna itself, as it's labeled "ANT1" on the board for the controller. There's an identical component with the same designator on the board for the battery box, also in a similar position to the Bluetooth chip. However, I'm thinking now that it's part of the network for the antenna - I would hazard a guess that it's an inductor of some sort, given the size. It certainly has something to do with the antenna.

So far I haven't had any luck looking up the two small unknown chips associated with the PU ports - however, they were made in August of last year according to the date code (17 08). I think they're H-bridge chips, given the number of pins - as comparison, see the pinout for this TI DRV8837 chip: http://www.ti.com/lit/ds/symlink/drv8837.pdf

Edited by Phoxtane

Share this post


Link to post
Share on other sites

I think you are right that those are H-bridge chips, what else could they be.

Share this post


Link to post
Share on other sites

Thanks for the tear down.  Are there antenna traces on the other side of the PCB?   What is the range like for you?  Are you getting about 5 meters that Sariel(?) got over in the Technics forum?

 

Share this post


Link to post
Share on other sites

Thank you for these pictures and analysis.

I'm curious about the 6-wire cable protocol, so that I can figure out if/how to use "old" PF motors.

I'll wait for the views of the other sides of the PCBs. Do you expect that the 6 pinouts (GND, TMS, TCK, TDC, TDI, RESET, VCC) will be easier to access from the other side, and allow for somme TTL/serial connexion? That would be interesting.

Share this post


Link to post
Share on other sites
5 hours ago, Ambroise said:

I'll wait for the views of the other sides of the PCBs. Do you expect that the 6 pinouts (GND, TMS, TCK, TDC, TDI, RESET, VCC) will be easier to access from the other side, and allow for somme TTL/serial connexion? That would be interesting.

The datasheet for the CC2640 chip on the controller has, according to its datasheet: "2-pin cJTAG and JTAG Debugging", as well as the following peripherals: UART, 2x SSI (SPI, MICROWIRE, TI), I2C, I2S. Google seems to think that the 6 pin connections at the top are related to JTAG in some way. This is what I found online (from this site: https://www.xjtag.com/about-jtag/jtag-a-technical-overview/) about the JTAG connection:

"Interface Signals
The JTAG interface, collectively known as a Test Access Port, or TAP, uses the following signals to support the operation of boundary scan.

TCK (Test Clock) – this signal synchronizes the internal state machine operations.
TMS (Test Mode Select) – this signal is sampled at the rising edge of TCK to determine the next state.
TDI (Test Data In) – this signal represents the data shifted into the device’s test or programming logic. It is sampled at the rising edge of TCK when the internal state machine is in the correct state.
TDO (Test Data Out) – this signal represents the data shifted out of the device’s test or programming logic and is valid on the falling edge of TCK when the internal state machine is in the correct state.
TRST (Test Reset) – this is an optional pin which, when available, can reset the TAP controller’s state machine."

If this is indeed a JTAG connector, I'm not sure why Lego decided to use TDC instead of TDO and Reset instead of TRST.

Also, the datasheet says that the chip does support OTA updates.

 

Share this post


Link to post
Share on other sites

@Phoxtane, the name of a trace and even the silk don't affect the functionality of course, can also have to do with internal (company) considerations I would say.

Share this post


Link to post
Share on other sites

Thanks for this very helpful explanation, it looks like a proper circuit board and good quality, I loved the spinning knobs!

Share this post


Link to post
Share on other sites

Well guys and gals... I have cracked the HUB (Train part). Thanks to Jorge and other contributors from: https://github.com/JorgePe

It seems to be that the HUB is a simplified version of the Boost controller. The train motor acts like a WeDo motor. It is pretty cool, you can detect if a motor exists, if it is pulled out or plugged in. I can also control the LED (11 different settings, one of which is off). Hope in the weekend I'll be able to manufacture an app for it that I'll upload to the Apple store for the people that already have a train available ;) I'll also post the source somewhere on GitHub later on. I'm thinking of making a Playgrounds for it. Only disadvantage is that you need iOS for all of that. But... you could easily modify the stuff by Jorge for python to run at e.g. your Raspberry Pi or maybe even androsomething (no pun intended for @Andromeda of course ;)). I think this will make our train controlling lives a lot more easy especially since we can now also create an app to run a lot of trains using an iPad or something. We could even program options to run motors / controllers in sync. LEGO did nothing to work against us so I really appreciate that!!! 

I'll upload a video tomorrow.

Share this post


Link to post
Share on other sites
4 hours ago, JopieK said:

Well guys and gals... I have cracked the HUB (Train part). Thanks to Jorge and other contributors from: https://github.com/JorgePe

It seems to be that the HUB is a simplified version of the Boost controller. The train motor acts like a WeDo motor. It is pretty cool, you can detect if a motor exists, if it is pulled out or plugged in. I can also control the LED (11 different settings, one of which is off). Hope in the weekend I'll be able to manufacture an app for it that I'll upload to the Apple store for the people that already have a train available ;) I'll also post the source somewhere on GitHub later on. I'm thinking of making a Playgrounds for it. Only disadvantage is that you need iOS for all of that. But... you could easily modify the stuff by Jorge for python to run at e.g. your Raspberry Pi or maybe even androsomething (no pun intended for @Andromeda of course ;)). I think this will make our train controlling lives a lot more easy especially since we can now also create an app to run a lot of trains using an iPad or something. We could even program options to run motors / controllers in sync. LEGO did nothing to work against us so I really appreciate that!!! 

I'll upload a video tomorrow.

So does that mean we can have both outputs run 2 motors in one train and synced? Or make the current motors available in the boost/WeDo range work continuously so they can drive a train?

Share this post


Link to post
Share on other sites
18 hours ago, JopieK said:

Well guys and gals... I have cracked the HUB (Train part). Thanks to Jorge and other contributors from: https://github.com/JorgePe

It seems to be that the HUB is a simplified version of the Boost controller. The train motor acts like a WeDo motor. It is pretty cool, you can detect if a motor exists, if it is pulled out or plugged in. I can also control the LED (11 different settings, one of which is off). Hope in the weekend I'll be able to manufacture an app for it that I'll upload to the Apple store for the people that already have a train available 😉 I'll also post the source somewhere on GitHub later on. I'm thinking of making a Playgrounds for it. Only disadvantage is that you need iOS for all of that. But... you could easily modify the stuff by Jorge for python to run at e.g. your Raspberry Pi or maybe even androsomething (no pun intended for @Andromeda of course ;)). I think this will make our train controlling lives a lot more easy especially since we can now also create an app to run a lot of trains using an iPad or something. We could even program options to run motors / controllers in sync. LEGO did nothing to work against us so I really appreciate that!!! 

I'll upload a video tomorrow.

 

Thanks @JopieK, I knew you guys would be on the case. I was hoping to have a crack at this myself but I have to wait to buy the train like everyone else. 🙂 Can you answer a few questions for me so I can modify my code ahead of time? 😄

1. Is the BLE service id for the Powered Up Hub the same as the Boost Move Hub? ("000016231212efde1623785feabcd123").

2. Does the Powered Up Hub use a single characteristic for all notifications like the Boost Move Hub, or multiples like the WeDo 2.0 Smart Hub? ("000016241212efde1623785feabcd123" on the Move Hub).

3. What's the type id of the new train motor? (eg. WeDo Motor is 0x01, Boost Interactive Motor is 0x26)

4. When you say it acts like the WeDo motor, I'm guessing you mean there's no angle detection, timing commands like the Boost Interactive Motor?

Thanks for the info, pleased to hear it was so easy to crack!

I also had another idea for something else I wanted to try when I get my hands on a train. If I can get my laptop/raspberry pi/whatever to pretend to be a Hub by advertising the same services/characteristics, I wonder if I can get the remote to connect to the laptop. That would open up the possibilities to have remotes control trains, multiple motors, even "reassign" remotes to trains without re-syncing them!

Edited by Mr Hobbles

Share this post


Link to post
Share on other sites

@Mr HobblesIt uses the same characteristic for both RX and TX. Indeed the same UUID, for the 'Handset' and the 'HUB NO.4', both for their service and characteristics b.t.w.. The train motor is reported as a WeDo motor (0x01) (makes sense since it does not have any mean to give feedback as you could see in the image of the open motor). Apart from that I'm quite pleased, it is a neat feature that the system reports back and shows what motor is connected to what port. I haven't done a range test yet with my iPhone X, maybe it will react differently than with the 'Handset'.

The handset has still some tricks on it's sleeves, you can connect to it and read the green button without a problem but the +/-/stop seems to be more tricky, I think you need to complete some handshake first, I did an initial attempt but did not succeed after all, but I think we'll figure it out in the end 🙂

@supertruper1988 I'm not sure it is directly supported, there is a command for combining the two motors in the Boost setting but I don't have two motors so could not test it (it accepts the command with an acknowledge message), apart from that you could do that programmatically and in fact use different engines and HUB's for that (not with the LEGO Handset, but with your own app / Pi / whatever I don't see any reason why that would not work).

Share this post


Link to post
Share on other sites
25 minutes ago, JopieK said:

@Mr HobblesIt uses the same characteristic for both RX and TX. Indeed the same UUID, for the 'Handset' and the 'HUB NO.4', both for their service and characteristics b.t.w.. The train motor is reported as a WeDo motor (0x01) (makes sense since it does not have any mean to give feedback as you could see in the image of the open motor). Apart from that I'm quite pleased, it is a neat feature that the system reports back and shows what motor is connected to what port. I haven't done a range test yet with my iPhone X, maybe it will react differently than with the 'Handset'.

 The handset has still some tricks on it's sleeves, you can connect to it and read the green button without a problem but the +/-/stop seems to be more tricky, I think you need to complete some handshake first, I did an initial attempt but did not succeed after all, but I think we'll figure it out in the end 🙂

 @supertruper1988 I'm not sure it is directly supported, there is a command for combining the two motors in the Boost setting but I don't have two motors so could not test it (it accepts the command with an acknowledge message), apart from that you could do that programmatically and in fact use different engines and HUB's for that (not with the LEGO Handset, but with your own app / Pi / whatever I don't see any reason why that would not work).

Interesting! So I guess with the service UUID being the same the only way to tell the hubs apart would be by their advertised name strings. Also interesting that the train motor shares the same id 0x01 with the WeDo motor, this means there's no way to tell them apart. Although why you'd want to...?

So you're saying the remote/handset advertises itself as a BLE server as well as a client?! That's amazing. That should make it quite a lot simpler to code for once everything is figured out (like a handshake you mentioned).

Thanks for the info!

Ps. Interesting that you mention the Hub is advertised as "HUB NO. 4.". We know the Boost hub is labelled "HUB NO. 1.". That likely means there's two more types of hubs out there that are either a) Yet to be released or b) Will never be released. 😛

Edited by Mr Hobbles

Share this post


Link to post
Share on other sites
8 minutes ago, Mr Hobbles said:

Interesting! So I guess with the service UUID being the same the only way to tell the hubs apart would be by their advertised name strings. Also interesting that the train motor shares the same id 0x01 with the WeDo motor, this means there's no way to tell them apart. Although why you'd want to...?

So you're saying the remote/handset advertises itself as a BLE server as well as a client?! That's amazing. That should make it quite a lot simpler to code for once everything is figured out (like a handshake you mentioned).

Thanks for the info!

Yups, just use the name. I don't think the system sees it as a different motor because it can't, ID2 is connected to GND and ID1 to VCC :s (no resistor whatsoever), then connected it measures 3.9 MΩ.

Share this post


Link to post
Share on other sites

LEGO have released the App for controlling the trains.

Its called :

LEGO POWERED UP

Share this post


Link to post
Share on other sites

Looks nice. I'll test it in the weekend. I did test my own app this morning, the reach of the bluetooth connection with my iPhone X is about 10 - 15 m. The train will only stop when it gets out of reach. It seems to be that the normal controller cuts it off at about 5 meters.

Share this post


Link to post
Share on other sites

Thanks for the breakdown! 

On 6/7/2018 at 10:59 AM, JopieK said:

it uses an STM32F030 micro controller. I already guessed that since that is the same one they use in Boost.

Did you post Boost pictures on EB? I can't seem to find any.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now