Hijacking Your Cute Little Vacuum Bot

Mass, Chris Casey and Elliot Mack, part of the team that built the
vacuum's electronic and mechanical systems, had in fact hoped that the Roomba would intrigue robotics enthusiasts (Sony's robo-pooch Aibo launched a hacking wave, though the company initially fought the trend, citing the Digital Millennium Copyright Act when it went after code-disseminating Web sites). As it happened, designing a reliable consumer appliance out of a few dozen dollars' worth of metal, silicon and plastic required some decisions that make a hacker's job easier—and others that make it a real pain. For example, says Casey, hacking and penny-pinching instincts converge in the modular connectors that carry power to the wheels and sensor data back to the main board. It was much cheaper for the Chinese company that assembles the bot to build the internal circuitry in separate pieces—and it's a trivial task for a hobbyist to hook into those circuits.



Getting at the software, on the other hand, is impossible: It's burned into a ROM on the microcontroller chip, which in turn is soldered onto the main board. And that buried software poses a real dilemma for Luck and Ioannidis—or any other hackers who want to put the Roomba under remote computer control.



On the one hand, the CPU executes arcane signal-processing tricks to coax intelligible information out of the bot's relatively primitive sensors. Simply chopping the CPU out would force a hacker to rebuild the robot's control system from scratch—that is, throw Mass's three years of elegant work out the window. On the other hand, most of the Roomba's programmed responses to outside events—like bumping into a wall—are pseudorandomized to prevent the machine from, say, bouncing endlessly back and forth between two legs of a chair. If it receives a signal from object sensor A one time, it will move in direction B; if it receives the same signal again, it may move in direction C. This room-coverage algorithm makes the bot good at its job, but the hacker who wants to gain control by "spoofing" the sensor's signal to the CPU is trying to take the reins of a fractious bronco. He might be able to get the thing going in the right general direction, but precise navigation is out. The robot has a much more predictable response to the virtual-wall sensor, says Mass: It simply turns away from the infrared beam until it can't see it
anymore, so spoofing that signal will probably be the best bet.



Once you've finessed this and have a controllable Roomba, what do you do with it? There are plenty of possibilities, says Mack. A Roomba gutted of its cleaning equipment is a versatile platform that rolls around reliably without getting stuck in corners or trapped behind furniture, and it has plenty of payload capacity. Something roughly half again the size of a fat trade paperback could be stuffed inside the
injection-molded shell. I loaded a five-pound bag of flour on my machine without substantially impairing its mobility, and there are about 25 watts of power to spare, according to Casey.



Luck entertains visions of a couple of webcams and a laptop running image-processing software—with maybe a baby robotic arm attached. I'm thinking a camcorder and a tiny spotlight to help me investigate whether it's time to spring for the undercoating cycle at the local car wash. Ioannidis says he'd love to figure out a way for a swarm of Roombas to clean a really big space—or pit a hacked Roomba against a hacked Aibo in a steel-cage death match. That would be worth watching: loyal dog bot against loyal vacuum bot.