TOPO II Firmware
Summary: "Growing up with Lucy"
TOPO II Firmware
JNI + JAR + Applet (+ Cygwin) HOWTO
Summary: "On Intelligence"
This article describes my attempts to reverse-engineer the firmware of the TOPO II robots. The purpose of this exercise is to be able to control the robot from my PC without using an Apple II and the original software (I don't have either). So my attempts are focused on finding the protocol and commands that the Base Communicator accepts from the host computer.
ROMThe robot uses 3 microcontrollers of the type 8031. This is a variant of the common 8051 microcontroller, but without internal EPROM.
Tools & DocumentationI used the following tools to reverse-engineer the firmware.
I found the following documentation very usefull.
Results so farHere are the results I learned so far by studying the Base Communicator firmware.
Serial LinkThe serial link between the host computer and the Base Communicator is configured as 8 data bits, no parity bits and 1 stop bit (8,N,1). The switches on the Base Communicator define the baudrate as follow:
Communication ProtocolThe communication protocol between the host computer and the microcontroller uses ASCII characters. The following characters are allowed:
Bytes are send as two hexadecimal digits, where each character is one of:
'8', '9', 'A', 'B', 'C', 'D', 'E', 'F'
It seems that commands from the host are acknowledged with the character 'U'. This is also the first character that is send to the host when the microcontroller is reset.
Get Status command - 'Q'
If the character 'Q' is received the microcontroller replies with 1 status byte (not 2 characters!) and clears bit 0 of the status byte (if set). This command can be send at any time without impact on any partially send command.
Note: this command violates the communication protocol by returning one byte in stead of 2 hexadecimal characters.
Warm Reset command - 'X'
If the character 'X' is received the microcontroller pushes the value 0x00A8 is pushed on the stack replacing the origional return address. The subsequent IRET instruction jumps to address 0x00A8, i.e. the initialisation code at the start of the Main function.
This command can be send at any time.