Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
197 lines (141 sloc) 4.54 KB

Keepon Reverse Engineering Document

Author Info

Kyle Machulis <> v1.1, Nov 14, 2011


Keepoff is a project to reverse engineer with BeatBots/WowToys MyKeepon Dancing robot.


Board Image

An annotated image of the circuit board is available at


  • Microphone

  • Buttons

  • Servos (encoders?)

Processors and Components


P232CS14: * PIN1 - I2C CLK * PIN14 - I2C DATA

P234CS24: * PIN11 - I2C CLK * PIN24 - I2C DATA


  • Front (Touch/Music)

  • Body (Head, Sides)

Line Protocols

The two processors in the Keepon robot communicate with each other via the I2C protocol. A set of pads to watch communication between the chips is available on the circuit board, in the corner near the happy face.

The communication is 0V (GND) Low, +3.3V High. However, the internal microcontrollers are 5v tolerant.

To be able to control the system using the commands listed below, the microcontroller that works as the master node must be put into slave mode. This is done by pulling the I2C data and clock lines to ground for 1 second while the keepon is powering up or coming out of sleep. After this, the bus can be controlled by outside systems.

Devices and Commands

The following device addresses are available:

  • 0x52 - Sound bank access/playing

  • 0x55 - Servos for turning whole unit?

Device Sleep

Assuming no interaction takes place for 3 minutes, the robot will put itself to sleep. This will cause the data/clock lines on the I2C bus to both drop to ground.

Device Wakeup

To wake up the device from sleep mode, pull the V line on the exposed I2C pads to ground.


  • Device Address: 0x55

Keepon has 4 servos: The main base rotation, right/left body bend, forward/back body bend, and up/down "squat".

Messages written to the motors are as follows:

0x55 0xAA 0xBB 0xCC
  • 0xAA - servo index.

  • 0xBB - current servo position

  • 0xCC - unknown? Seems to be only 255 or single bit values (powers of 2)?

Main Rotation Base

  • Motor Index: 0x04

  • Servo Position: 0xBB

  • Movement Speed: 0xCC

Forward/Back Bend

  • Motor Index: 0x02

  • Servo Position: 0xBB

  • Movement Speed: 0xCC

Up/Down Squat and Right/Left Bend

  • Motor Index: 0x00

  • Bend: 0xBB < 0x80

  • Squat: 0xBB > 0x80

  • Speed: 0xCC

Motor Macros

Unlike the 0x00/2/4 device addresses for motors, the 0x6 address takes a single byte. It seems to have certain motor "macros" programmed into these values. The valid values for this byte are:

  • Motor Index: 0x06

  • 0x20

  • 0x21

  • 0x22

  • 0x23

  • 0x24

  • 0xA0

  • 0xA1

  • 0xA2

  • 0xA3

Motor Status

Status about the position of motors (rotation and front/back only, the up/down and side to side swaying motors do not seem to have encoders?) is retreived by requesting 13 bytes from the 0x55 device.

  • Byte 0x00 - Unknown

  • Byte 0x01 - Unknown

  • Byte 0x02 - Unknown

  • Byte 0x03 - Unknown

  • Byte 0x04 - Unknown

  • Byte 0x05 - &'d against the following bits

    • 0x0X - Up/Down Position (for Up/Down motor) - Range Unknown? (2-bit?)

    • 0xE0 - Leaning Left (for Left/Right sway) - Boolean?

    • 0xF0 - Leaning Right (for Left/Right sway) - Boolean?

  • Byte 0x06 - Unknown

  • Byte 0x07 - Unknown

  • Byte 0x08 - Unknown

  • Byte 0x09 - Unknown

  • Byte 0x0A - Unknown

  • Byte 0x0B - Front/Back Encoder

  • Byte 0x0C - Base Rotation Encoder

Sound Banks

  • Device Index: 0x52

  • Message Format: 0x52 0x01 0xAA

    • 0x91 - Up Wakeup Sound

    • 0x92 - Down Wakeup Sound

    • 0x95 - Yawn Down

    • 0x96 - Initial Boot Sound?

    • 0x97 - Sigh

    • 0x9A - Yawn Up

    • 0x9B - Sleep (Sound played before turning off)

    • 0x9C - Chirp

    • 0xAC - Whine

    • 0xBC - Beep noise when head hit

    • 0xBD - Up/Down noise when squatting

    • 0xBF - Sneeze Up

    • 0xC0 - Sneeze Down

Buttons - Front/Base

Button status is found from reading a single byte from Device 0x50.

  • Device Index: 0x50

  • Button Indexes:

    • 0x01 - Music Mode Front Button

    • 0x02 - Unused?

    • 0x04 - Top of Head

    • 0x08 - Touch Mode Front Button

    • 0x10 - Left Body (Facing toward user)

    • 0x20 - Front Body

    • 0x40 - Right Body (Facing toward user)

    • 0x80 - Back Body


Microphone information is not sent over the I2C bus.