Hijacking Your Cute Little Vacuum Bot

The Roomba is a tempting hacker target: big payload, multiple onboard sensors. But its cleaning duties get in the way.

Illustration by Christoph Niemann

When artificial intelligence was all the rage in the 1980s, researchers joked that by the turn of the century, smart vacuum cleaners built in Japan would be cleaning smart tanks built in the United States. As it turns out, though, a few years into the new century the vacuum bot that is grinding across the floors of gadget freaks around the nation is American-designed. Produced by iRobot, a Massachusetts company that also makes pack robots for the Defense Department, this not-very-smart but persistent floor cleaner, looking a bit like a hugely pregnant Frisbee, scoops up dust, wood chips, cat hair and other lightweight trash for anyone with no patience for housework and $200 to spare. The Roomba bounces delicately off walls and furniture in a crazy-quilt pattern designed to cover every inch of a room at least once during an hour-long cleaning cycle. Mine scares me a little and fascinates our domestic carnivores.

To at least one budding appliance hacker, however, this useful little household robot has proved irresistible–if tricky to control. Hobbyists and researchers spend hundreds of hours and thousands of dollars developing mobile robots that can reliably cross a room carrying a load of sensors
and computing gear. In the Roomba, computer-security consultant Jake Luck saw a nearly perfect prebuilt robotic platform, one with multiple sensors already built in. Sure, it also carried a floor brush, but that ought to be easy enough to fix.

Luck had never taken apart a vacuum cleaner before he and John Ioannidis (a network and mobile gizmo guru at AT&T Labs) took the Roomba into the lab. Under the hood they found a remarkably simple, robust design, with no extraneous mechanical parts. For example, on the spring-loaded bumper that tells the Roomba that it just ran into something, plastic tabs do a job usually performed by finicky microswitches. When the bumper recoils, one of the tabs gets shoved into the path between a matching LED and a phototransistor. With two tabs, the CPU can figure out which part of the bumper hit an obstruction. Other banks of light emitters and detectors tell the robot whether it’s heading over the edge of a flight of stairs and how closely it’s following a wall. (The bot also comes with a “virtual wall”–a small box that emits an infrared beam to fence the Roomba in; sensors on the Roomba activate software that prevents it from crossing the infrared line on the floor.)

When Luck and Ioannidis put their pioneering disassembly guide on the Web, they received a congratulatory e-mail from the Roomba’s designers, but they have not detected a national groundswell in Roomba hacking. Luck guesses this may be because the $200 vacuum cleaner is good at a job that hackers aren’t interested in doing themselves–housework–why mess with it?

“That’s the ultimate compliment,” says former iRobot engineer Phil Mass, laughing: “To not want to hack it because it does its job so well.” Mass has good reason to feel satisfied: He spent the better part of three years writing and polishing the thousands of lines of code that give the Roomba its hardworking personality.

Mass, Chris Casey and Elliot Mack, part of the team that built the
vacuum’s electronic and mechanical systems, had in fact hoped that the Roomba would intrigue robotics enthusiasts (Sony’s robo-pooch Aibo launched a hacking wave, though the company initially fought the trend, citing the Digital Millennium Copyright Act when it went after code-disseminating Web sites). As it happened, designing a reliable consumer appliance out of a few dozen dollars’ worth of metal, silicon and plastic required some decisions that make a hacker’s job easier–and others that make it a real pain. For example, says Casey, hacking and penny-pinching instincts converge in the modular connectors that carry power to the wheels and sensor data back to the main board. It was much cheaper for the Chinese company that assembles the bot to build the internal circuitry in separate pieces–and it’s a trivial task for a hobbyist to hook into those circuits.

Getting at the software, on the other hand, is impossible: It’s burned into a ROM on the microcontroller chip, which in turn is soldered onto the main board. And that buried software poses a real dilemma for Luck and Ioannidis–or any other hackers who want to put the Roomba under remote computer control.

On the one hand, the CPU executes arcane signal-processing tricks to coax intelligible information out of the bot’s relatively primitive sensors. Simply chopping the CPU out would force a hacker to rebuild the robot’s control system from scratch–that is, throw Mass’s three years of elegant work out the window. On the other hand, most of the Roomba’s programmed responses to outside events–like bumping into a wall–are pseudorandomized to prevent the machine from, say, bouncing endlessly back and forth between two legs of a chair. If it receives a signal from object sensor A one time, it will move in direction B; if it receives the same signal again, it may move in direction C. This room-coverage algorithm makes the bot good at its job, but the hacker who wants to gain control by “spoofing” the sensor’s signal to the CPU is trying to take the reins of a fractious bronco. He might be able to get the thing going in the right general direction, but precise navigation is out. The robot has a much more predictable response to the virtual-wall sensor, says Mass: It simply turns away from the infrared beam until it can’t see it
anymore, so spoofing that signal will probably be the best bet.

Once you’ve finessed this and have a controllable Roomba, what do you do with it? There are plenty of possibilities, says Mack. A Roomba gutted of its cleaning equipment is a versatile platform that rolls around reliably without getting stuck in corners or trapped behind furniture, and it has plenty of payload capacity. Something roughly half again the size of a fat trade paperback could be stuffed inside the
injection-molded shell. I loaded a five-pound bag of flour on my machine without substantially impairing its mobility, and there are about 25 watts of power to spare, according to Casey.

Luck entertains visions of a couple of webcams and a laptop running image-processing software–with maybe a baby robotic arm attached. I’m thinking a camcorder and a tiny spotlight to help me investigate whether it’s time to spring for the undercoating cycle at the local car wash. Ioannidis says he’d love to figure out a way for a swarm of Roombas to clean a really big space–or pit a hacked Roomba against a hacked Aibo in a steel-cage death match. That would be worth watching: loyal dog bot against loyal vacuum bot.