R-Net Dongle tear-down.

[Irving]

Just thought you might like to see inside.... this is a 2008 vintage

[Dan]

Is there any reason why its software could not be emulated and made to run on a raspberry pi?
I'm too miserable to pay £400 for a real one

[steves1977uk]

It's not the software Dan, it's the hardware that needs emulating! I'm also guessing the EEPROM probably holds the service level, e.g. Dealer or OEM.

Steve

[woodygb]

Irving ...are you aware of some work that has already been done on the R-net code?

https://github.com/redragonx/can2RNET

[Irving]

I'm also guessing the EEPROM probably holds the service level, e.g. Dealer or OEM.

I'm not sure that's true as it appears to be connected to the FT245 not the main MCU. We'll see...

Irving ...are you aware of some work that has already been done on the R-net code?

https://github.com/redragonx/can2RNET

Yes, I'm well aware of his work. We already plan to use it in the lab but it's far from complete. His work primarily looks at injecting joystick commands into the r-net data stream. I'm planning to play with that too, but my initial focus is simply to look at the USB data stream when an eg 'get system time' command is issued to to r-net and see what data frames appear on the bus... And we'll go from there...

[terry2]

Just thought you might like to see inside.... this is a 2008 vintage

rnet dongle.jpg

Nice one dude.

So £80 of cpu\chipset and £400 for the finished thing...

Glad I don't need one now.

[Burgerman]

No the money is in the software. Developing software is a seriously expensive business. If you are selling say 10k copies a week, that makes it affordable. If its a hundred, that makes it very expensive.

An example. My automotive dynamometer software was 3 years in writing, and improving and bug fixing. And still not finished. And programmers are not cheap... 4k a month or more if any good.

[Irving]

No the money is in the software. Developing software is a seriously expensive business. If you are selling say 10k copies a week, that makes it affordable. If its a hundred, that makes it very expensive.

An example. My automotive dynamometer software was 3 years in writing, and improving and bug fixing. And still not finished. And programmers are not cheap... 4k a month or more if any good.

While software development is significantly cheaper now in terms of debugged lines of code per developer per day than it was, say, 10y ago, the only cheap way to do software development is still DIY or, if you can afford the time, find a group of students to open-source it.

Sadly the excellent work that Stephen Chavez & Specter did on reverse engineering R-Net stalled 2y or so back as the need to turn their skills into cash post studies arose; cyber-security work pays I guess. I'm not in his league by a long shot but I have the tools and when I have a little time I plan to have a look see.

[Irving]

Add on thought...

PGDT do sell a development kit for R-Net which no doubt gives some, but probably not all, insight into the message protocol. But it's probably megabucks to licence (you never buy/own this stuff) and under an NDA. Nevertheless I'm surprised nothing at all has escaped into the web from it.

As far as we know, has any manufacturer, other than Permobil, developed their own h/w or s/w for R-Net?

[wheelie junkie]

Ottobock have their Ten system which seems to be just a joystick and control pod. Works with R Net dongle and Sunrise OEM software.

[Burgerman]

Its R-Net. Its just using a different casing to try to convince you its their own. Same think as the pride whateveritscalled 3. Its just a system made by curtis instrements, for pride. Pride also had a rebranded pilot plus called something different too. Tha also was just pilot plus under the skin.

Non of em want the public to know they just assemble parts made by other companies, and that every chair is basically the same.

This for e.g. is the PERMOBIL new advanced joysick. Wuite obviously the cheaper plastic variant of the one I have on the salsa, made by PG drives.
https://permobil.ca/product/permobil-joystick-module/

Permobil my backside.

And the curtis controller, rebranded as qlogic, qlogic 2, and qlogic 3 so pride have 'their' own joystick and controllers..
https://www.quantumrehab.com/images/qua ... larger.jpg

They did the same with the pilot plus system before this.

[rover220]

Ottobock have their Ten system which seems to be just a joystick and control pod. Works with R Net dongle and Sunrise OEM software.

Ten is just rnet rebranded.

[ex-Gooserider]

Nice photo - hard to tell from the picture, but it looked to me like it was only a 2-layer board, so it might be possible (w/ much pain!) to trace the circuit by following the traces and reverse engineer the hardware...

The big question / challenge is whether or not it is possible to pull the code out of the ROM / MCU chips and copy it.... If the code can be copied then it would (at least in theory) be possible to clone the dongle. If the code can't be gotten then the hardware is useless without it....

ex- Gooserider

[Irving]

Nice photo - hard to tell from the picture, but it looked to me like it was only a 2-layer board, so it might be possible (w/ much pain!) to trace the circuit by following the traces and reverse engineer the hardware...

The big question / challenge is whether or not it is possible to pull the code out of the ROM / MCU chips and copy it.... If the code can be copied then it would (at least in theory) be possible to clone the dongle. If the code can't be gotten then the hardware is useless without it....

ex- Gooserider

I think it's 2 layer, the bottom is mostly ground plane with a few tracks but the density of components on the top makes tracing the circuit difficult. However the design is pretty conventional so it's probable that the Dout/Din of the eeprom is connected to D0 on the FT245 and then with D1 thru D7 to GPIO pins on the MCU. I've not buzzed it out as I don't want to risk damaging it. There's a few test points around the eeprom and I have some pogo-sticks (needle probes) so I'll 3d print a jig for them so I can connect the logic analyser and read the data stream. What use that will be will depend on possibly getting maybe another dealer and a pukka oem or two for comparison.

[terry2]

No the money is in the software. Developing software is a seriously expensive business. If you are selling say 10k copies a week, that makes it affordable. If its a hundred, that makes it very expensive.

An example. My automotive dynamometer software was 3 years in writing, and improving and bug fixing. And still not finished. And programmers are not cheap... 4k a month or more if any good.

I don't think they have enough money to invest in programming or a engine for a program.

They may use an programming\engine that is available.

I use Arduino as the main application\programmer. Then I use Marlin firmware inside of Arduino.
With Marlin firmware. I can program a 3D printer that has a laser and a router in a matter of hours.
So it with send the bespoke machine code to the motherboard.

[Irving]

No the money is in the software. Developing software is a seriously expensive business. If you are selling say 10k copies a week, that makes it affordable. If its a hundred, that makes it very expensive.

An example. My automotive dynamometer software was 3 years in writing, and improving and bug fixing. And still not finished. And programmers are not cheap... 4k a month or more if any good.

I don't think they have enough money to invest in programming or a engine for a program.

They may use an programming\engine that is available.

I use Arduino as the main application\programmer. Then I use Marlin firmware inside of Arduino.
With Marlin firmware. I can program a 3D printer that has a laser and a router in a matter of hours.
So it with send the bespoke machine code to the motherboard.

With respect Terry, so can I, but how much of that is your bespoke innovative code and how much 3rd party libraries? How are you assessing the complexity of your code versus BM's system? Marlin does most of the heavy work for you - how many man hours are you leveraging - but how many function points in your own code, what its its McCabe complexity score? I'm guessing BM's developers were starting from near scratch, working directly with the hardware & linking multiple data acquisition systems together, but even with my knowledge of how a dynamometer works I couldn't assess the complexity.

Whilst state of the art tools can ease the burden on the developer and improve code quality ultimately the time taken to write, debug and document a complete system depends on its complexity and unless you have a reliable quantitative means of comparing that any about how long it should take is futile.

[steves1977uk]

Irving, would one of these read the MCU?... https://www.aliexpress.com/item/32819765178.html

Steve

[terry2]

No the money is in the software. Developing software is a seriously expensive business. If you are selling say 10k copies a week, that makes it affordable. If its a hundred, that makes it very expensive.

An example. My automotive dynamometer software was 3 years in writing, and improving and bug fixing. And still not finished. And programmers are not cheap... 4k a month or more if any good.

I don't think they have enough money to invest in programming or a engine for a program.

They may use an programming\engine that is available.

I use Arduino as the main application\programmer. Then I use Marlin firmware inside of Arduino.
With Marlin firmware. I can program a 3D printer that has a laser and a router in a matter of hours.
So it with send the bespoke machine code to the motherboard.

With respect Terry, so can I, but how much of that is your bespoke innovative code and how much 3rd party libraries? How are you assessing the complexity of your code versus BM's system? Marlin does most of the heavy work for you - how many man hours are you leveraging - but how many function points in your own code, what its its McCabe complexity score? I'm guessing BM's developers were starting from near scratch, working directly with the hardware & linking multiple data acquisition systems together, but even with my knowledge of how a dynamometer works I couldn't assess the complexity.

Whilst state of the art tools can ease the burden on the developer and improve code quality ultimately the time taken to write, debug and document a complete system depends on its complexity and unless you have a reliable quantitative means of comparing that any about how long it should take is futile.

Arduino\Marlin and the other software it can run are open source. Any library that has been released that will work in Arduino is free.
All the top 3D printer\Laser\Liquid\Lath\router companies use Arduino and Linux. 10\1 you have lots of things in your house that run by it.
They have already got a Raspberry Pi 3 talking to the R-Net system. And taking over it.
https://github.com/redragonx/can2RNET

Our woody on here got round the Dynamics system with nothing more than a dongle that comes with a new chair. And £5 usb cable.

These days it's all about the software engines and most are free. Some do lock it down but most don't.

[Irving]

With respect Terry, so can I, but how much of that is your bespoke innovative code and how much 3rd party libraries? How are you assessing the complexity of your code versus BM's system? Marlin does most of the heavy work for you - how many man hours are you leveraging - but how many function points in your own code, what its its McCabe complexity score? I'm guessing BM's developers were starting from near scratch, working directly with the hardware & linking multiple data acquisition systems together, but even with my knowledge of how a dynamometer works I couldn't assess the complexity.

Whilst state of the art tools can ease the burden on the developer and improve code quality ultimately the time taken to write, debug and document a complete system depends on its complexity and unless you have a reliable quantitative means of comparing that any about how long it should take is futile.

Arduino\Marlin and the other software it can run are open source. Any library that has been released that will work in Arduino is free.
All the top 3D printer\Laser\Liquid\Lath\router companies use Arduino and Linux. 10\1 you have lots of things in your house that run by it.
They have already got a Raspberry Pi 3 talking to the R-Net system. And taking over it.
https://github.com/redragonx/can2RNET

Our woody on here got round the Dynamics system with nothing more than a dongle that comes with a new chair. And £5 usb cable.

These days it's all about the software engines and most are free. Some do lock it down but most don't.

I'm not sure if you missed the point of my post or are just naive about large-scale software development.

Agreed, software development environments make it easier these days (from personal experience over 40 years) but the fundamental issues around complexity in many large scale systems haven't changed. I too do a lot of stuff with Arduino, and ESP32, and Pi and other single board, or SOC platforms, often running multi-threaded solutions for robotic or other hardware control usually in some real-time operating environment (currently I favour Zerynth, but RTOS, ROS and others also feature). Whilst the software on these can be seemingly complex it generally is quite straightforward and there's a limit to the amount of code you can stick on one, though that is increasing over time. But these are mere toys compared to many real-world distributed, multi-threaded, real-time, integrated systems which take months if not years to develop (been there, done that).

The R-Net hack is an interesting one. Yes, they've reverse engineered a tiny portion of the system, around joystick control control messages, so its possible to drive it remotely or turn the lights on. But that's a long way from understanding how the programming interface works and creating a open-source programmer. Ultimately that should be possible, but that's still some months away - unless you'd like to explain how to solve it in a few hours with some as yet unspecified software tool?

[terry2]

With respect Terry, so can I, but how much of that is your bespoke innovative code and how much 3rd party libraries? How are you assessing the complexity of your code versus BM's system? Marlin does most of the heavy work for you - how many man hours are you leveraging - but how many function points in your own code, what its its McCabe complexity score? I'm guessing BM's developers were starting from near scratch, working directly with the hardware & linking multiple data acquisition systems together, but even with my knowledge of how a dynamometer works I couldn't assess the complexity.

Whilst state of the art tools can ease the burden on the developer and improve code quality ultimately the time taken to write, debug and document a complete system depends on its complexity and unless you have a reliable quantitative means of comparing that any about how long it should take is futile.

Arduino\Marlin and the other software it can run are open source. Any library that has been released that will work in Arduino is free.
All the top 3D printer\Laser\Liquid\Lath\router companies use Arduino and Linux. 10\1 you have lots of things in your house that run by it.
They have already got a Raspberry Pi 3 talking to the R-Net system. And taking over it.
https://github.com/redragonx/can2RNET

Our woody on here got round the Dynamics system with nothing more than a dongle that comes with a new chair. And £5 usb cable.

These days it's all about the software engines and most are free. Some do lock it down but most don't.

I'm not sure if you missed the point of my post or are just naive about large-scale software development.

Agreed, software development environments make it easier these days (from personal experience over 40 years) but the fundamental issues around complexity in many large scale systems haven't changed. I too do a lot of stuff with Arduino, and ESP32, and Pi and other single board, or SOC platforms, often running multi-threaded solutions for robotic or other hardware control usually in some real-time operating environment (currently I favour Zerynth, but RTOS, ROS and others also feature). Whilst the software on these can be seemingly complex it generally is quite straightforward and there's a limit to the amount of code you can stick on one, though that is increasing over time. But these are mere toys compared to many real-world distributed, multi-threaded, real-time, integrated systems which take months if not years to develop (been there, done that).

The R-Net hack is an interesting one. Yes, they've reverse engineered a tiny portion of the system, around joystick control control messages, so its possible to drive it remotely or turn the lights on. But that's a long way from understanding how the programming interface works and creating a open-source programmer. Ultimately that should be possible, but that's still some months away - unless you'd like to explain how to solve it in a few hours with some as yet unspecified software tool?

I've told a number of Chinese companies that I buy stuff from for the last 25 years.
How much it cost to buy for me £200. How much they sell it for on the net £400+.

The dongle would cost no more than £100. They have to hardware to read the OEM dongle and make there own.
Huge profits are gaurenteed when sold worldwide. Let's see what happens.

I don't need a dongle now as my new chair will have all the things I want changed, which is the top speed of 10 mph for free.

[steves1977uk]

Terry, I think you'll find you'll need a dongle to set up your chair to steer PROPERLY which can take many months to fine tune, unless you're happy with it being in drunken sailor mode! I've owned an OEM dongle for 6+ years and still fine tune settings to this day like BM does.

Steve

[Irving]

Terry, I think you'll find you'll need a dongle to set up your chair to steer PROPERLY which can take many months to fine tune, unless you're happy with it being in drunken sailor mode! I've owned an OEM dongle for 6+ years and still fine tune settings to this day like BM does.

Steve

Save your breath Steve, Terry obviously knows better

[Irving]

Irving, would one of these read the MCU?... https://www.aliexpress.com/item/32819765178.html

Steve

Possibly but I wouldn't buy it. For a start it talks about parallel interface to PC yet its clearly an old-school serial one. Its all through-hole components, no SMD parts, claims 2017, 1997 more likely! Whether it can really read the secure chip is open to debate, there's little mention of the software, and no screenshots. At best rubbish, worst its a scam.

[steves1977uk]

Yeah that's true Irving, I would prefer a more modern looking one that uses USB and up to date components.

Steve

[steves1977uk]

Save your breath Steve, Terry obviously knows better

Think I will! Terry can learn the hard way!

Steve

[terry2]

Terry, I think you'll find you'll need a dongle to set up your chair to steer PROPERLY which can take many months to fine tune, unless you're happy with it being in drunken sailor mode! I've owned an OEM dongle for 6+ years and still fine tune settings to this day like BM does.

Steve

My chair is rear steer and has two 120 amp R-Net computers on board.

1 for the front drive and the other for the rear power steering rack.
I only know about the Dynamics DX2 which woody did me a cable so I never had to pay out £100s to program it.

So with 2 R-Nets. I won't be touching this chair. I have just unlocked the speed to 10 mph.

[rover220]

the optimus drives like crap, you will need your own dongle to fine tune or you wll become frustrated very quickly.

[terry2]

the optimus drives like crap, you will need your own dongle to fine tune or you wll become frustrated very quickly.

I tried one last week and it was ok for me.

Until it comes I have no idea which R-Net box I should connect it to.
If I do need one. I can get one for £200 delivered from the EU

Remember this chair will not be used in doors. But only out and in the country side.

[Burgerman]

Yes. And it will swerve about like a thing possessed and you will not be able to safely hit a gap or stay on a narror path without hitting a car/wall/lamp post. Because its programmed just like all the rest.

If you are happy with that or dont understand the difference then no prob!
You nees a dongle, either OEM or DEALER with a pain in the ass workaround. And the oem software.

[Irving]

Had a play today verifying the CAN messages in the directory previously mentioned and available here.

Most are the same though the device numbering is different and the lighting and seat control messages on my Puma are very different (though oddly horn is the same) which probably reflects the fact that they were testing on a Permobil!

More to come as I get time to dig deeper...