Cracking comms for a cheap Chinese servos

Guys and girls!
I found where they come from!
But no way I'm going to spend 1200USD-3000USD with the robot to test them... (details in a few!)

UBTECH have many diferent robots and doing image search of their robots i found this (on just two webpages), look closely to the arms...

The servos looks exactly like ours!!! So I well think that this cheap servos from Aliexpress are from units not sold, because of the high price for such a small device to learn. I only found it to buy here:

1200€ with tax - https://www.generationrobots.com/en/403524-alpha-mini-humanoid-educational-robot.html 

1170€ excl. tax - https://marketplace.ednology.co.uk/product/ubtech-alpha-mini/

2450€ incl. ship. - https://es.aliexpress.com/item/4000070477083.html

This robot was firstly created through a Indiegogo project called ALPHA 2! 

Here is the link in case you want to check it: https://www.indiegogo.com/projects/alpha-2-the-first-humanoid-robot-for-the-family#/updates/all Also looks like xiaomi worked with them: 

After this robot was made, probably this one was developed, it's called ALPHA MINI! It's such a great pece of art! Front camera, two LCD screens as eyes, IA, and much more!

I wonder if what found "Nick777 on the #27 coment" can be implemented with the Mini, as it was for the ALPHA 2 robot and this looks like the next version.

I think I found him, but I cannot send him a message via Twitter. I made a tweet, let's see if he can answer "us".

I don't think I can use a logic analyser like Alex did with another servos from UBTECH, because we don't have the brain to send messages to the servo.

Any hint on how to use this library from Dynamixel to send the same messages like Alex and Nick777 did?

Another thing I found is pictures from the internals at FCC certification webpage:

This is the company at FCC.

And found all these robots and motors (Internal photos of each link):

Alpha 2:

JR1601:

03H16006:

Alpha 1 Pro:

UKITERE/UKITERU:

IM050 (Ironman):

YANSHEE:

AAG001:

JRA0101:

IPSWSTS:

There could be many many more motors around!
Next steps: try to implement this plugin fro the ALPHA servos with the EZ-B! (I don't think I'll buy one, as it's really expensive (shipping cost) for me. I'll try to use the halfduplex code for Arduino from above)

BTW: SkywalkerF34 also found part of the communication protocol (Comment #107). Just asked him trough email any hint to test them.

This is what he found:

Hi all, 
here is my research and what I found :

Baud rate:115200
Data bit:8
Stop:1
Check:0
Flow control:NONE TTL multi-layer connection,shared-bus
ID:1-240
Feedback:position:deviation adjustment,version information

Serial parameter:115200,8,n,1,1

Protocol analysis

EMBEDDED LED
// FA AF 01 04 00 00 00 00 05 ED switch on led light // no LED on mine
// FA AF 01 04 01 00 00 00 06 ED switch off led light// no LED on mine
RESPONSE AA + id // not tried yet as I cannot see with my proto board

GET VERSION
FC CF {id} 01 00 00 00 00 {sum} ED            // not tried yet 
RESPONSE FC CF {id} {V-1} {V-2} {V-3} {V-4} {sum} ED
this can be used to check if servo exist in a loop "for id"

MOVE  servo
// FA AF {id} 01 {angle} {time} {T1} {T2} {sum} ED whre T1=0 and T2= {time}= TIME to execute in ms / 20 0 to 255(FF) ie 5.12 second to execute
RESPONSE AA + id // not tried yet as I cannot see with my proto board

GET POSITION
// FA AF {id} 02 00 00 00 00 {sum} ED // not tried yet
REPONSE FA AF {id} 00 {angle} 00 {real} {sum} ED // not tried yet as I cannot see with my proto board

SET OFSET ANGLE
// FA AF {id} D2 00 00 {A1} {A2} {sum} ED where A1 adjValue/256 and A2 adjValue%256  // not tried yet
RESPONSE FA AF {AA + id} 00 00 00 00 {sum} ED

GET OFSET ANGLE
// FA AF {id} D4 00 00 00 00 {sum} ED   // not tried yet
RESPONSE FA AF {AA + id} D4 00 00 {A1} {A2} {sum} ED where A1 adjValue/256 and A2 adjValue%256

All works now, just think to cross wire in the daisy chain, else GND become DATA on next servo and block all transmission....

I got the small servo and it uses an "ATMEL SAMD10U 822B TW 18224YS" main board (looks like "SAM D10D 24-pin QFN" to me from the datasheet) and the chip on the back side is an "MPJJ 6515 800". But I could not find any datasheet.

SAM D10 datasheet pinout:

At the side of the board is written: " 2KG_D10YS_V0_04 PCB".

Sharing some new pictures here:

I'm reverse engineering the circuit to see if we can work with it.

Future work, check the compatibility with this codes:

https://github.com/Super169/UBTech/blob/master/UBTech.cpp
https://alexsonea.com/2017/10/15/jimu-hacking-the-communication-protocol/
Codes of the findings above can be found here:

https://synthiam.com/Community/Questions/Control-UBTech-Alpha-Servos-With-The-Ez-b-V4-3932/comments

The first type I bought here for $2.31 apiece, including shipping.

The second one from the same seller was slightly cheaper.

Description of both mentions that they are used, untested, and the seller does not know how to control them. There is no mention of brand or datasheet. 

Even though these are no longer available, you can still find similar used servos, like this one.

While the larger servos have no branding, the smaller ones have UBTECH name on two sides. This name eventually leads to their offering of small servos. And here we go.

There is a table with some basic parameters, a dimensional drawing, and a datasheet for each servo. I could not open the datasheet, so I'm stuck with whatever info I can get without it.

To illustrate some parameters, here's a rough comparison with SG90. There is a lot of variety when it comes to SG90 so take these figures with a grain of salt. 

Parameter	SG90	2kg UBTECH	3kg UBTECH
Weight	9 g	12 g	20.4 g
Operating voltage (DC)	4.8-6V	6-10V	6-10V
Maximum torque	1.2kg*cm@4.8V	2kg*cm@7.4V	3kg*cm@7.4V
Maximum speed (no load)	0.15s/60°@4.8V	0.31s/60°@7.4V	0.28s/60°@7.4V
Rotation range	180°	240°	360°
Rotation accuracy (no load)	3°?	1°	0.7°
Maximum working current	0.6A	0.2A	0.25A

Aliexpress description offers a rough outlook of the insides, but I took them apart to understand better what is behind the specs.

The larger 3kg servo has a magnetic encoder and Cortex-M0+ microcontroller. The board with motor is available without the shell for about a dollar on Aliexpress too(here). So when I eventually burn something, replacement is very cheap.

The smaller one uses a potentiometer for feedback. Here I couldn't identify any ICs. Here the board with the motor is also available for cheap.

Now that I have some idea of what I'm working with, I can start searching for a way to control them.