Controlling Romo with a Raspberry Pi
David Goeken
7/20/2020
Draft #1
Overview
The original Romo, the smartphone robot, by Romotive, was a
tank-like robot platform that was controlled via an iPhone�s or android's
headphone jack. It was a Kickstarter project. Romotive then developed Romo Version
2 � also a Kickstarter project. Romo V2 switched from using the headphone jack
to directly connecting to the iPhone 4�s 30-pin port and later the iPhone 5�s
lightning port.
I had a Romo and played with it using my iPhone 5. However, I
have since upgraded and my current iPhone no longer fits the Romo. In addition,
when Romotive went out of business the Romo App was removed from the App Store.
Fortunately, Romotive open-sourced the iPhone App along
with the Romo firmware. Others have used the open-source software to
continue Romo App development on the iPhone � the new App is available from the
Apple App Store for a fee.
I decided to
take a different approach. Using a low-cost USB logic analyzer, I have reverse
engineered the communication protocol between the iPhone and Romo. I am able to
control my Romo using a Raspberry Pi Zero to emulate the iPhone.
If one uses
the true meaning, you may say I hacked Romo. https://en.wikipedia.org/wiki/Hacker_culture
��������� 
First Approach
My first
approach was to use an Apple lightning male to female passthrough adapter
breakout board (APPLE-LM-LF-V2A) along with a low cost, USB logic analyzer (LHT00SU1
based) and the sigrok software.
�� ��������� 
Fortunately,
my iPhone 5 is functional and still has the original Romo App installed. After
hooking everything up, configuring sigrok, and plugging in my iPhone, I was
able to record the traffic between the iPhone and Romo.
After an
initial analysis along with some web searches, I was able to identify three (3)
phases of communication between the iPhone and Romo:
1. The iPhone negotiates with a chip in
the lightning connector for security along with determining which pins are to
be used for what purpose.
2. Romo tells the iPhone about itself resulting
in a request for the Romo App to be launched.
3. The Romo App on the iPhone sends
commands to Romo to control its behavior.
Since I realized
that I was no longer wanted to use the iPhone lightning interface with my Romo,
my next step involved opening up the Romo, knowing full well that this would
void my warranty 😊. There I saw a connector between the
Romo mother board and the lightning port. After moving the logic analyzer
probes into this connector, I ran another test with Romo and my iPhone. Results
were similar to the above but without the first phase of communication to
negotiate with the lightning security chip.
Very long
story short, after configuring a few pins, the communication is a relatively
simple serial protocol. I recorded and decoded the communication between the
iPhone and Romo. By having the Raspberry Pi emulate the iPhone, I am able to
control Romo using the Raspberry Pi.
Disassembling
Romo
First remove
the four (4) screws in Romo�s base. Romo also four (4) tabs holding the top
half to the bottom half. I put marks on the bottom of the Romo to help me
re-assemble the unit.
I was able
to slide a long finger nail file or letter opener between the wheels and base
and carefully pry the tabs open. With the wheels in the way, one can barely see
the tabs. So here is a picture of the tabs with one set of wheels removed.
The two (2)
blue semi-transparent end pieces add another level of difficulty to opening Romo.
The only advise I have is that one has to be careful and patient in removing
these two end pieces. The two end pieces appear to be identical, so the marking
may not be needed on those � although it is important to be able to identify
the top from the bottom. The two sets of wheels also appear to be identical and
with their built-in tabs, it is not possible to install them upside down. Even
so, the marking did provide assistance making sure everything was lined up for
re-assembly.
Here is an image
showing the main connector between the iPhone and Romo�s motherboard and an
image of the top section of the base showing the connector.
� ��������� ��������� 
Since I was
no longer going to attach an iPhone to the top of Romo, I removed the adaptor
by unscrewing the four screws from the top and removing the iPhone adaptor. In
addition, I removed the motor connected to the adaptor.
Analysis
using sigrok
My LHT00SU1
based USB logic analyzer is capable of measuring voltage levels and sigrok can
interface with it to act as an oscilloscope. This was used to identify the
function of the different pins on the connector and the voltage levels.
Initially I was not sure how I was going to interface with the Romo, but once I
discovered that it was a serial protocol using 3.3 voltage levels, I decided
that a Raspberry Pi was the tool I was going to use since the Raspberry Pi
operates using 3.3 voltage levels on its GPIO pins. I was contemplating using
an Arduino until I discovered the 3.3 voltage level protocol. In addition, the
Raspberry Pi was going to allow me to more easily add more features. In
development, the Pi having a WiFi connection and
being able to program it on the fly without having to remove the controller
were major advantages.
As stated,
after some quality time with sigrok, I discovered that Romo uses a serial
protocol. Two additional pins are used to get Romo�s attention. I do not plan
on fully documenting the protocol (at least not in this document), but will
give a high-level synopsis. One pin has to be tied to ground and another pin is
initially set to ground and then brought high � I have called this the control
pin. (I think this pin must be tied to some sort of reset pin on Romo�s CPU to
wake it from its power saving mode. Romo does not have an on / off switch and
its battery seems to last a long time when not used.) At this point Romo sets
it transmit pin high for a period of time before communication starts. Romo
first sends the iPhone information about itself, then the iPhone is triggered to
start the Romo App if it is not running, then the iPhone provides Romo some
information about the iPhone and the App, and finally the Romo app start to
command Romo. If there are no changes to the commands, multiple times a second,
the iPhone requests and Romo responds with status information.
I used
sigrok to record a few sessions with different app settings to be able to identify
the commands needed to set the three (3) motors� direction and speed, along
with controlling the LEDs.
But to give
you an idea, here a screen shot of a session:
And now
zoomed in to see a couple of packets:
Each packet
starts with hex FF 55, followed by 1 byte specifying the size of the payload.
The final byte is a checksum. The payload consists of the command or response
type, a transaction ID to keep things synchronized and to know what response
corresponds to what command, and additional information as needed.
Header Pin
Out
Here is a
close up of the connector.
I will start
numbering the pins from this picture�s left. I also traced the connector pins
back to Romo�s CPU; however, TXD and RXD appear to be reversed. The pin out
that I found to work for me:
Raspberry Pi
Pin��� Color��������� ��������� Romo��������������������������� ��������� Pin��� Comment
�1����� white������������������ ground������ ������������������ ��������� 6������ ground
�2����� gray����������� ��������� XCK0/T0/PCINT8��������� ��������� 6������ ground (tie to
ground somehow)
�3����� purple����������������� UART0_RXD����������������� ��������� 10���� GPIO 15 (RXD)
�4����� blue����������� ��������� UART0_TXD����������������� ��������� 8������ GPIO 14 (TXD)
�5����� green������������������ PA0
(ADC0/PCINT0)���� ��������� 12���� GPIO 18 control
�6����� yellow����������������� PA5
(ADC5/PCINT5)���� ��������� NC
�7����� orange���������������� PA6
(ADC6/PCINT6)���� ��������� NC
�8����� red������������� ��������� 5v
when charging������� ��������� NC
I found two
options to implement this wiring. First option is to use the existing connector
and solder on jumper wires to connect to the Pi. The existing connector wire is
very small � do not try using a knife to strip. I found that the �heat with the
soldering iron to melt and pull off� method to strip worked well. The second option
is to find a connector that fits � look for a JST PH 2.0 mm 8-Pin Female
Connector 16.5mm x 4.0mm x 6.5mm height, pitch:
2.0MM. Note: its wire
colors may be different.
Software
Again, I am
not going into a lot of details in this document; but at a high level, I used
the sigrok program to identify the baud rate used along with decoding the
contents of the communication packets. In addition, since Romotive open-sourced
the iPhone App along with the Romo firmware, that software was very helpful
with some of the details of the protocol � even though my Romo�s firmware is a
slightly different / older version.
To fully
document the protocol would take a document longer than this document and would
contain a lot of sigrok plots. The software that I developed contains the
necessary packets and correctly implements the protocol (AFAIK). The sigrok
analysis and software development took some time and was very iterative; but when
I first got it working and yelled, �It�s alive!�, my wife did come to see what
I was working on.
Modifying
Romo
In addition
to 1) creating the new connector between Romo and the Raspberry Pi, 2) removing
the iPhone adaptor from the top section of Romo, and 3) removing the unused
motor, I made the following modifications to my Romo:
4. I drilled out the four (4) holes on
the top section � keeping the small piece of plastic that attached to the top
and drilling through the top section. I found some 4 in x 6 in pieces of
plexiglass sold for picture frames and used it as a platform on top of Romo.
6. I extended the connector from the
unused / removed motor out to the top in case I found a use for it.
7. Added bolts on the plexiglass
platform for the Raspberry Pi.
8. Added a small breadboard area on the
plexiglass to add additional devices.
Here are a couple
of pictures of my modified Romo and platform without the Raspberry Pi or power regulator:
��������� 
Powering
the Pi
As stated,
to power my Raspberry Pi, I tapped into the existing Romo�s battery. My Romo
contains a Ni-MH 4.8v 2000mah battery. After fully charging, my battery
registered 5.5 volts. While running, Romo software provides data on the status
of the battery. During use, I measured and recorded the following:
