VacuumRobot - 3irobotix CRL-200S Reverse Engineering

Complete hardware and software reverse engineering documentation for the 3irobotix CRL-200S vacuum robot motherboard.

📚 Documentation Index

Hardware

1. Motherboard Hardware - PCB reverse engineering, component identification, connector pinouts
2. Lidar Sensor - 3irobotix Delta-2D protocol, interfacing, and visualization
3. Sensor Integration - Complete sensor inventory, test scripts, hardware-software mapping

Software & System

4. Software & Firmware - TinaLinux system, processes, ADB configuration
5. System Architecture - Dual-processor design, communication, boot sequence
6. Installed Software - Complete software inventory, services, binaries, cloud connectivity
7. SLAM Configuration - Google Cartographer analysis, sensor fusion, mapping parameters
8. Map Storage & Cloud Upload - Map storage structure, WebSocket upload protocol, log evidence
9. Remote Access & Security - Manufacturer remote execution capabilities, rtty reverse tunnel, security analysis
10. Debugging Guide - ADB setup, serial console, troubleshooting

---

🚀 Quick Start

1. Connect to Device via ADB

# Install ADB (macOS)
brew install android-platform-tools

# Connect USB cable to J50 debug port
# Power on device (wait ~20 seconds for boot)
adb wait-for-device

# Enable persistent ADB connection (IMPORTANT!)
adb shell "touch /mnt/UDISK/debug_mode"

# Access device shell
adb shell

2. Test Lidar Sensor

# On your computer (external test)
python3 Research/Lidar/scan.py

# Or via motherboard UART (find correct port)
adb shell "cat /dev/ttyS1 | hexdump -C"

3. Explore the System

# System information
adb shell "uname -a && free -h && df -h"

# List processes
adb shell "top -bn1"

# View logs
adb shell "logread | tail -50"

---

🔧 Hardware Specifications

Main Components

Component	Part Number	Description
Main CPU	AllWinner A33	ARM Cortex-A7 Quad-Core @ 1.2GHz
Motor MCU	GigaDevice GD32F103	ARM Cortex-M3 @ 108MHz (real-time control)
RAM	Nanya NT5CC256M16EP-EK	512 MB DDR3L
Flash	Macronix MX30LF2G18AC-TI	2 Gbit NAND
PMIC	X-Powers AXP223	21-channel power management
WiFi	Realtek RTL8189ETV	802.11n
Lidar	3irobotix Delta-2D	360° laser distance sensor

Key Connectors

Connector	Function	Pins	Pitch
J50	Debug/ADB Port	5 (SHD)	1.0mm
J17	Lidar Sensor	5 (PH)	2.0mm
J24, J27	Wheel Motors	2 (PH)	2.0mm
J25, J26	Wheel Encoders + Sensors	16 (SHD)	1.0mm
J16	Vacuum Pump	4 (PH)	2.0mm
J15	Rolling Brush	2 (XH)	2.5mm
J5	Front IR Sensors	8 (GH)	1.25mm

---

💻 Software Architecture

Operating System

• Distribution: TinaLinux Neptune 2.0.0 (OpenWrt-based)
• Kernel: Linux 3.4.39 (Nov 12, 2021)
• Init System: procd (OpenWrt init)
• Filesystem: OverlayFS (read-only base + writable overlay)

Dual-Processor Design

AllWinner A33 (Main):

• High-level robot control
• Lidar/SLAM processing
• WiFi connectivity
• User interface

GD32F103 (Motor Controller):

• Real-time motor control
• Encoder reading
• IR sensor monitoring
• Safety functions

Communication: UART (ttyS1 or ttyS3, protocol being reverse engineered)

Key Services

• /usr/sbin/Monitor - Robot state monitoring
• /usr/sbin/wifiManager - Network management
• /bin/adbd - ADB debugging daemon

---

🔬 Research & Testing

Completed

• ✅ Hardware component identification
• ✅ PCB connector mapping
• ✅ Lidar protocol reverse engineering
• ✅ TinaLinux system analysis
• ✅ ADB persistence fix discovered
• ✅ Boot sequence documentation
• ✅ Sensor test scripts (wheel motors, suction)

In Progress

• 🔄 UART port assignment (Lidar vs MCU)
• 🔄 GD32F103 communication protocol
• 🔄 GPIO pin mapping
• 🔄 Motor control command set

Next Steps

1. Identify Lidar UART port on motherboard
2. Reverse engineer GD32F103 protocol
3. Create motor control library
4. Port Lidar reading to run on motherboard
5. Build unified robot control API

---

🐛 Known Issues & Fixes

ADB Connection Drops After Boot

Problem: Device appears briefly then disconnects

Root Cause: Missing debug mode flag

Solution:

adb wait-for-device
adb shell "touch /mnt/UDISK/debug_mode"
# Connection now persists across reboots

Details: See Software.md

Device Shuts Down When Sensors Disconnected

Problem: Device powers off after boot when running motherboard without sensors

Root Cause: /usr/sbin/Monitor process detects missing sensors and triggers safety shutdown

Solution:

adb wait-for-device
adb shell "touch /mnt/UDISK/PowerOn"
# Bypasses sensor checks for development/testing

Details: See Debugging-Guide.md

---

📊 Test Scripts

Lidar Visualization

cd Research/Lidar
python3 scan.py  # Real-time polar plot

Motor Control (External CircuitPython)

cd Research/Wheel
# Upload code.py to CircuitPython board
# Test PWM motor control

Vacuum Control (External CircuitPython)

cd Research/Suction
# Upload code.py to CircuitPython board
# Test PWM + digital activation

HID Device Enumeration

cd Research/Controller
python3 control.py  # List USB HID devices

---

🛠️ Development Tools

Required Software

• ADB: Android Debug Bridge (brew install android-platform-tools)
• Python 3: For test scripts (brew install python3)
• Serial Terminal: screen, minicom, or CoolTerm
• Optional: Logic analyzer for protocol analysis

Hardware Tools

• USB-to-TTL adapter (FTDI, CH340, CP2102) for serial console
• USB cable (data, not charge-only) for ADB
• Multimeter for hardware tracing
• Logic analyzer (recommended for UART analysis)

---

📖 Detailed Documentation

Document	Description
Motherboard README	PCB photos, component list, connector details
Software.md	OS, processes, services, ADB configuration
System Architecture	Processor roles, communication, boot sequence
Installed Software	Complete software inventory, cloud servers
SLAM Configuration	Google Cartographer configuration analysis
Map Storage	Map storage, cloud upload, log evidence
Remote Access & Security	Remote execution, rtty tunnel, security analysis
Debugging Guide	ADB setup, serial access, troubleshooting
Sensors	Sensor inventory, test scripts, integration
Lidar	Protocol spec, wiring, Python implementation
Device Logs	Log analysis, map upload evidence

---

🤝 Contributing

This is a reverse engineering documentation project. Contributions welcome:

1. Hardware discoveries: New components, pin mappings, schematics
2. Software analysis: Protocol details, service functions, binary analysis
3. Test results: UART captures, GPIO tests, sensor data
4. Code: Libraries, control interfaces, custom firmware

Goal: Complete open-source documentation and control stack for the 3irobotix CRL-200S platform.

---

📝 License

See LICENSE file for details.

---

🔗 Quick Links

• Enable ADB: adb shell "touch /mnt/UDISK/debug_mode"
• Serial Console: 115200 baud on J50 (pins 3=TX, 4=RX, 2/5=GND)
• System Info: adb shell "cat /etc/openwrt_release"
• All Docs: Browse /Research/ directory

Build Date: November 12, 2021 Target: astar-parrot/generic