Project 'Landlord'

Hello all, I am getting quite a few PMs about this project.

I recently started programming again with the goal of making the firmware able to talk to OpenMower. https://github.com/ClemensElflein/OpenMower

The code on my GitHub is NOT READY YET. At the moment lpc1788 version of the code compiles but not the lpc1768. I am prioritizing LPC1788 at the moment but then that is somewhat ready for use I will start looking at the lpc1768 code again.

Pinout diagram can be found at https://github.com/Damme/LandLord

edit; spelling

Hello all!

First of all, Sorry for not answering you guys at all more or less. Also, I just noticed the link is bad to the io diagram so here is the link again:
https://drive.google.com/file/d/0B98aBL1DeE4uc3hLQUhHa1FXUGs/view?usp=sharing&resourcekey=0-qmhrLCdqSrvEi-HP7xEJgg

And the progress? Well there is none. I didn't have energy or time to continue at the time and I also hoped that competition in the market would make the machines better. Not WORSE what I can see they went. So in my eyes the competition only made companies want more profit from existing customers... Sadly.. 
I also made some progress with DB504 model. I made both 504 & 275 able to move around, start stop mower, start stop charging etc. but this is where I stopped.

There are techniques to have GPS based navigation down to a few cm position (With RTK gps base station etc)
I am pretty sure it would be possible to program a simple map only with compass and length meter too, it wouldn't be precise at all but I'm sure basic navigation with this technique would be possible, especially with the modern mcu:s that has a lot of compute power.

So where am I with this project today?
I am still interested in developing a new firmware. Especially since no progress have been made at all what I can see in the market..

Worx still seems pretty cheap and rather easy enough. I don't have any motherboards from the later year models at all. Hopefully they haven't changed much at all but I have no idea.
So if anyone out there would like to dokument, take hi res photos (Without a potato camera please!) I might be able to cross reference the different models. If I would continue this it would not be very smart to use a soon 8 year old robot for this. but if the motherboards are close enough the code could be somewhat universal.


Hopefully some of you that are truly interested in this project developing a new firmware are getting this message and maybe we can figure something out together.

//Daniel

There have been some discussion over batteries and charging down in the comments. I'll publish images of inside of battery.

The tabs are solders After case is screwed together. So to split it you need to cut the connecting tabs on one side...

Cells are Sony 18650 1900mAh. Thanks to Jan B!

Warning etc etc, use with caution... Might contain bugs :)

#!/usr/bin/python3.5
import sys
if len(sys.argv) <2:
  print( "usage:" )
  print("  " + sys.argv[0] + " [.PCK file]", "[Folder-prefix]" )
  print( "  " )
  exit()
import os
from binascii import crc32
from struct import unpack
#get unpack file
src_file_path = sys.argv[1]
#read file length
src_file_size = os.path.getsize(src_file_path)
#read file
b = bytearray(open(src_file_path, 'rb').read())
# crude bytearray to String converter
def toStr(b):
  return "".join(["%c"%i for i in b]).strip("\x00")
# convert 4 bytes to int
def word2int(w):
  return unpack("<I", w)[0]
# crude filetable parser
def getHeader(b, datastart):
  beginstart=b.find(63) #"?"
  filename = toStr(b[0:beginstart]).replace("\\","/")
  beginstart+=1
  beginlength=b.find(63,beginstart) #"?"
  start = int(b[beginstart:beginlength],16) + datastart + 4
  beginlength+=1
  length = int(b[beginlength:beginlength+10],16)
  return {
    "filename": filename,
    "start" : start,
    "length" : length,
    }
#crude way to create nonexisting directories
def checkCreateDir(filename):
  if not os.path.exists(os.path.dirname(filename)):
    try:
        os.makedirs(os.path.dirname(filename))
    except OSError as exc: # Guard against race condition
        if exc.errno != errno.EEXIST:
            raise
def save(filename, data):
  checkCreateDir(prefix + "/" + filename) #create missing directories
  print ("writing %s\t (%d bytes)"%(filename,len(data)))
  open(prefix + "/" + filename, 'wb').write(data)
## Start decoding
print("Unknown byte 0:\t"+ str(b[0]))
print("Unknown byte 1:\t"+ str(b[1]))
print("Unknown byte 2:\t"+ str(b[2]))
print("Unknown byte 3:\t"+ str(b[3]))
prefix = sys.argv[2] if len(sys.argv)>=3 else "."
headerstart_token = bytearray((int(62), int(0x0d), int(0x0a)))
headerstart = b.find(headerstart_token,0)+3
pos=headerstart
datastart_token = bytearray((int(0x0d), int(0x0a), int(0x0d), int(0x0a)))
datastart = b.find(datastart_token,0)
print("header end: \t"+ str(datastart))
nHeaders = b.count(int(13),4,datastart)
print("# files \t: "+str(nHeaders))
# crude way to parse the directory table
files = []
print ("found %i files\n"%nHeaders)
token = bytearray((int(0x0d), int(0x0a)))
for i in range(nHeaders):
  pos2=b.find(token,pos)
  h = getHeader(b[pos:pos2], datastart)
  files.append(h)
  print(h)
  pos = int(pos2)+2
for h in files:
  bFile = b[h["start"]:h["start"]+h["length"]]
#write stripped file
  save(h["filename"],bFile)
print("Done!")

The right one, its a ST L3GD20H, Thanks Ajlitt!

Left is MMA8452Q, 3-axis, 12-bit/8-bit digital accelerometerhttp://www.nxp.com/files/sensors/doc/data_sheet/MMA8452Q.pdf

I've been working on mapping 2016 year model of worx, they use DB504 motherboard. Usually .pck-firmware, its a container and the start is plain-text. It's possible to do a splitter for that but I use dd to copy out the firmware.

DB504 probably use LPC1788. I've been looking on some io's on a picture I've recieved and it seams to be correct. (not possible to read chip text without removing the conformal coating)

Display and Keyboard are the same as previous models. Wire sensor uses a daughter board:

Should we assume they still uses LPC and that this might be an LPC11U6x?

( https://www.ghielectronics.com/catalog/product/282 looks like a suspect...)

So far I've been developing and reversing DB275 (2015 WG790/791/794) It seams all 2016 has DB504.

WG796e (2015) uses DB297 which I haven't seen yet. So if any one wants to send in pictures of that motherboard it would be very appreciated!

I don't know much about earlier versions.

//Daniel

edit:

I had a small break, I let the mowers do their job outside! :)

I've figured out the boundary wire and how it works. I finally got the idea to use the USB d+ and d- (p0.29 + p0.30) and output of p0.7 - p0.10 and measure with oscilloscope.. :) (4 wire inputs -> raising and falling each on pos / neg)

The blue is probe directly on the boundary wire.

So if negative measurement is before or after the positive, then you know if you are inside or outside wire.

p0.21 select amplification or something, you can detect if you are within 1 meter of the wire or not.

p0.22 probably selects between left and right sensor.

And if you are close to the sensors you get some weird artifacts in the measurement, longer pulse, and even more than one pulse. It seams this is following a pattern and it might be possible to user and detect the distance to the wire at 0cm, 10cm, 20cm and 100cm.

And the last one, wire right on top of the sensor.

I could use some owners help. I would like to have your firmware-files!
I need to see how big of a difference it is between models.

Please contact me!

Thanks all!

95% of the pin-out is finished. There are some questions still to be answered. Also the models with WIFI, How do they look inside? I would love to see some pictures of the main board in that one!

One guess would be that the un-populated IC nead RTC battery is a SPI flash but not confirmed.

Next important step would be to understand the how the wire sensor works.

P0.0  GPIO Output, Motor Left, Select Forward/Reverse
P0.1  GPIO Input, Dip switch 3
P0.2  ADC6, Motor Right, Current ?? -> Need more investigation
P0.3  ADC7, Motor Left, Current ?? -> Need more investigation
P0.4 + P0.5 GPIO Output, Selector ADC4 input -> accelerometer LIS352AR pin S0, S1.
  0    0 - ADC4 = X
  0    1 - ADC4 = Y
  1    0 - ADC4 = Z
  1    1 - ADC4 = aux (temp batt)
P0.6  GPIO Output, Speaker High volume
P0.7  GPIO Input, ExtInt3 Raising edge - Wire sensor -> Need more investigation
P0.8  GPIO Input, ExtInt3 Falling edge - Wire sensor -> Need more investigation
P0.9  GPIO Input, ExtInt3 Raising edge - Wire sensor -> Need more investigation
P0.10 GPIO Input, ExtInt3 Falling edge - Wire sensor -> Need more investigation
P0.11 GPIO Output, Enable Charging (in charger, after P1.23 is set to 1)
P0.15 SPI SCLK, LCD
P0.16 SPI CSB, LCD
P0.17 SPI MISO, LCD <- Unused? NC?
P0.18 SPI SDA, LCD
P0.19 SPI RSTB, LCD
P0.20 SPI A0, LCD
P0.21 GPIO OUTPUT, Selector Guide Wire sensor, Range / Amplification
P0.22 GPIO OUTPUT, Selector Guide Wire sensor, Unknown function -> Need more investigation
P0.23 ADC0, Charge current? (Or Charge voltage, Only >0 then charging) 
P0.24 ADC1, Voltage Battery
P0.25 ADC2, Accelerometer, Sideways (X/Y)
P0.26 ADC3, Accelerometer, Forward (X/Y)
P0.27 GPIO Input, Motor Rotor, Rotation tick? -> Need more investigation
P0.28 GPIO Input, Charger state? Battery full? -> Need more investigation
P0.29 USB D+, Maybe used for softUART for GPS / External mcu communication
P0.30 USB D-, Maybe used for softUART for GPS / External mcu communication

P1.0  GPIO Input/Output, Keypad matrix Row1
P1.1  GPIO Input/Output, Keypad matrix Row2
P1.4  GPIO Input/Output, Keypad matrix Row3
P1.8  GPIO Input/Output, Keypad matrix Row4
P1.9  GPIO Input/Output, Keypad matrix Col1
P1.10 GPIO Input/Output, Keypad matrix Col2
P1.14 GPIO Input/Output, Keypad matrix Col3
P1.15 GPIO Input/Output, Keypad matrix Col4
P1.16 GPIO Input, Hall Sensor, Lifted
P1.17 GPIO Input, STOP Button
P1.18 Unknown, NC?
P1.19 Unknown, NC?
P1.20 GPIO Output, LCD Backlight ON, PWM1.2 can be used here if motors are inactive. (Pulsing screen then charging)
P1.21 GPIO Input, High then connected to charger and charger is RED
P1.22 Unknown, NC? USB Power on??
P1.23 GPIO Output, Initiate Charger, Keeps charger in RED mode. if low charger shows green light.
P1.24 GPIO Output, Speaker Low volume
P1.25 GPIO Output, Keep high for PCB Power on.
P1.26 Unknown, NC? Sensor?
P1.27 Unknown, NC? Sensor?
P1.28 GPIO Input, Power key, Normal HIGH
P1.29 GPIO Input, Sensor, Rain
P1.30 ADC4, Output from LIS352AR, Selected by P0.4 + P0.5
P1.31 ADC5, Motor Rotor, Current ?? -> Need more investigation

P2.0  PWM1.1, Motor Right speed
P2.1  PWM1.2, Motor Left speed
P2.2  PWM1.3, Motor Rotor speed
P2.3  GPIO Input, Dip switch 2
P2.4  GPIO Output, Motor Right, Enable/Start | Disable
P2.5  GPIO Output, Motor Right, Brake ON/OFF
P2.6  GPIO Output, Motor Right, Select Forward/Reverse
P2.7  GPIO Input, Dip switch 3
P2.8  GPIO Output, Motor Left, Brake ON/OFF
P2.9  GPIO Output, Motor Left, Enable/Start | Disable
P2.10 GPIO Input, EInt0??, Sens Motor? Error?  -> Need more investigation
P2.11 GPIO Input, EInt1 Edge, Motor Right Rotation tick
P2.12 GPIO Input, EInt2 Edge, Motor Left Rotation tick
P2.13 GPIO Output, Motor Rotor, Enable/Start | Disable

P3.25 GPIO Output, Motor Rotor, Brake ON/OFF
P3.26 GPIO Output, Motor Rotor, Select Forward/Reverse

P4.28 GPIO Input, Hall Sensor, Cover
P4.29 GPIO Input, Hall Sensor, Front