Lego Mindstorms Internals

The Lego Mindstorms (#9719) product is a robot-kit-in-a-box. It consists of a computer module (the "RCX"), and an inventory of many technics parts. It appears to be a productized version of the MIT Programmable Brick, as the following table will show you.

The Lego-Robotics Mailing List

A group of people are planning to learn how to talk to the RCX from operating systems unsupported by The Lego Group. It would be really great if TLG came out with an sdk, and save us some effort. Wired Online has noticed us.

This group of people gathers at the lego-robotics mailing list. You may subscribe to this list by sending a subscription request. Nothing special is needed in the subject or body of the message. You can also get off the list. You can also read the mailing list via HTTP (web pages) or via NNTP at LUGNET, and if you want to receive messages in digest format, LUGNET also offers news-by-mail delivery with several digest options.

General Mindstorms Info

You can buy the Mindstorms RIK (Robotics Invention Kit) at the stores listed below (presuming they have it in stock), and many fine toy outlets. Also available are extension kits Fred Martin has a robot builder's guide.

Places to buy Mindstorms (not a comprehensive list):

Erik Brok has an introduction to programming with Mindstorms page.

Kin W. Lau has a page of resources for using Mindstorms in education. Franz-Michael S. Mellbin has one also.


Todd Graham is working on a remote-control and remote-viewing robot he calls a Telerobot.

Cindy Salwen pointed out contributes two URLs (1 and 2) with a description of the protocol for the serial interface between the computer and the Dacta Control lab. This may or may not be related to the protocol used by the RCX, but if you're reading this page, it's probably interesting information anyway. She also contributes another URL: National Instruments (LabVIEW) pages. Robolab is available for sale from Pitsco.

Fred Martin, arguably the father of the RCX (well, given that Lego redesigned the Programmable Brick from the ground up for production reasons, the *grand*father), has a page on Lego Mindstorms.

Chris Busse has scanned the Pitsco Dacta catalog Mindstorms section. James Mathis has scanned some other pages: Dacta® Spares from Pitsco®.

Kekoa Proudfoot says "toast that warranty!" He took apart his RCX and took some pictures of the inside of it. He also looked up the numbers for some of the chips. Peter Ljungstrand bought a CyberMaster kit, disassembled the main unit, and took pictures.

Patrick R. Gili has some notes on disassembling the RCX

Dave Baum says that RCX to RCX communication is pretty simple. There's a low level command in the RCX to send a message which contains a single 8 bit number as payload (plus the protocol "wrapper"). The RCX also remembers the last "message" it has seen, and this value can be used to make decisions. Pretty basic stuff, but still enough to do some reasonable things.

Dave also talks about the various Lego motors. The motors that come with MS are the 5225 Gear Motor. Such motors may be purchased at Lego Shop at Home.

Dave is also "pretty sure" there are 32 global variables that can be used in RCX coding.

Rotation and temperature sensors are available from Pitsco.

Dave relates: The rotation sensor works very well for this sort of thing. Its "raw" value is one of 4 analog voltages, each of which correspond to a 22.5 degree segment within a quadrant. Simply based on raw readings, it is impossible to tell which quadrant the sensor is in. However, the RCX firmware samples this sensor quite frequently and can keep track of how many quadrants have been "moved through". The end result is a reading that tells you the number of revolutions in 1/16 of a revolution increments. Sample rate is good...I have been able to use the sensor directly on the "gear" motor and not miss any rotation. In one of my models I then geared down the motor by a worm -> 24t and a 8t -> 24t gear reduction. The result was I could measure the position of the gear reduced "arm" at better than 1/3 a degree.

Peter Liu says that "Do you byte, when I knock?" is the key to UnlockFirmware().

Jonathan Knudsen is working on an O'Reilly book on Lego Mindstorms.

Jonathan Woodward was curious about which colors of Lego reflect infrared the best.


René Schalburg wrote Creating a Spider Robot using LEGO-Mindstorms.

Doug Carlson has a four-wheel synchro robot which can move in any direction. He uses two angle sensors (available from Pitsco/Dacta), and can make it move in a perfect square.

Jonathan Knudsen also build a synchro drive.

Dan L says "You can place a 1X2 beam in front of the light sensor. This blocks the LED but not the sensor."

Gavin Smyth has pictures of a walker that uses universal joints to make the leg rods "bend".

Daan van der Weide has smacked together a page on his gear differential using standard gears and pieces.

Alex Wetmore built a robotic platform using the plans for the adder/subtracter found on Leo's Lego. The platform allows you the robot to get the normal four motions (forward, reverse, spin left, spin right) with a perfectly straight forward and reverse. One of the motors is used to move the robot forward and backwards. To turn the robot left and right you use the other motor.

Fredrik Glöckner created a triple gait cycle hexapod using the CyberMaster. He has other Technics models.

Bill Clagett has a few Technics and Mindstorms creations.

Robert Fay has posted pictures and a QuickTime movie of his new vertical mill.

Don Hewitt has built a rotation sensor from the Extreme Creatures Fiber Optic parts.

Bert van Dam has a page for his robots, and homemade sensors.

Likewise for Michael Gasperi, who has a Mindstorms page that talks about how the sensors work, as well as some building he's done, in particular, a recreation of Gray Walter's robotic turtle.

Ben Erwin has the only site with K-12 RCX-related lesson plans (that he knows of).

Henrik Hautop Lund is the head of LEGO Lab at the University of Aarhus.

Ben Williamson has built several robots, including:

The FetchBot searches for dark objects to grab, lift and deposit elsewhere. The grabber and the arm are driven by one motor. The page includes an animation of the arm grabbing a block, and photos of the gearing and cams that make it work.

The Truck is a robotic tractor-trailer vehicle with rack-and-pinion steering. The tractor contains sensors and the steering and drive motors, while the trailer carries the RCX controller and an earthmover. The Truck can back up in a straight line by using the sensors to determine if the trailer is off centre.

BTW, he got some fun feedback from The Probe robot that he posted earlier, including mail from someone who works for Digital Instruments. Apparently they hold the patent on the technique that his robot uses, they just do it on a somewhat finer (nano) scale. Sounds like a theme for a competition: how many patents can you infringe using Lego? :)

Rich Thompson has been playing around with the "radar" created by using IR messages and has posted some pics and code examples (in BotCode since the C skills are rusty, and BotCode feels more like assembly...).

Chris Stanley made a radarbot by transmitting IR data.

Dave Astolfo has pics of a Fire Extinguisher. It seeks out candlelight, and blows it out.

Simen Svale Skogsrud built a Lego-scanner. He also put in descriptions and code examples for proximity-detection and using the FOS-light unit as a rotation sensor. Be welcome. No actual pictures of lego-creations yet, but lots of attractive illustrations.

Michael Powell's directional transmission shows one way to do different things based on the direction of the motor.

Mario Ferrari built a two-legged walker

Dennis Clark has a homemade sensor to do IR proximity detection.

Jin Sato has made some nifty robots.


Kekoa Proudfoot has done the work to figure out the opcodes in the packets, which seem also to be the programming opcodes as well! He is a minor deity!


The Lego Mindstorms Group has an official SDK. This Technical Reference document tells you how to use SPIRIT.OCX directly to write LEGO MINDSTORMS RCX or LEGO Technic CyberMaster programs, providing more detailed control over the LEGO Programmable Bricks.

Thomas Dow is using his HP-100LX to generate RCX IR codes.

Bjarne Rene has made a web page on how to make a C++ program that can communicate with the RCX.

Paul Haas has a Perl program to talk to the RCX from a Linux box.

Owen Stenseth has some RCX perl tools, to disassemble RCX opcodes.

Dave Baum has a simple C-like language that can be used to program the LEGO RCX. It runs on Windows, Macintosh, Linux, and OS/2.

Kekoa has IRIX source for a very simple Unix tool for communicating with the RCX.

Laurent Demailly has written TclRCX.

Dario Laverde developed what is currently the Java equivalent of Kekoa's send.c using the Java Commmunications Extension API, but it'll evolve over time (source code is available).

Tramm "Foo" Hudson has a program to download firmware into the RCX.

Eric Brok has made a Visual Basic program (for Windows) that allows him to control the RCX and download certain programs. The program is called Mind Control. Mind Control can be used to interprete the user's own text files (with Spirit commands).

Sean Hearne and David Hanley at the Waterford Institute of Technology, Ireland, have put together a course for programming the RCX with Visual Basic.

Bert van Dam has data and programs in Visual Basic.

Gary Kacmarcik has written a H300 disassembler in Perl. This script takes the firm0309.lgo file (which you'll need to copy from your Mindstorms CD) and a separate comment file, and merges the output of the disassembly with the comment file to produce a commented disassembly.

Markus L. Noga has written some replacement firmware: legOS-0.1. legOS allows you to program the LEGO Mindstorms RCX in assembler and standard C. Beyond the bytecode barrier, arrays, structures, pointers and arbitrary user-defined data types await.

Marco Beri and Mario Ferrari just released the first version of emulegOS, a software emulator of legOS and the RCX itself. Emulegos is C/C++ code to compile and link together with your own legOS code. So it's not an application but requires a development system. Our first version runs under the Borland C++Builder IDE, but we put a great effort in keeping the code as much portable as possible, so it shouldn't be a pain to move it to other platforms/compilers. We'll appreciate anybody's help in this.

There's a shareware BotCode program. Don't know much about it.

Gordon's Brick Programmer is an alternative visual programming interface for Mindstorms. It provides a folding editor, symbolic variables, access to the RCX data log, a simple debugger and its free!

Brian Cwikla has written a program editor/tester/debugger that allows you to write programs for the RCX with all the functions listed in the Mindstorms SDK and not have to know VB.

Mark Overmars has created the RCX Command Center for Windows. It's a program that assists you in programming the Lego MindStorms Robots. It provides a higher level interface to the RCX, the programmable brick that forms the heart of the Lego Robots.

A new web page with examples of RCX programming using ROBOLAB.

Peter Hesketh wants to program the RCX in MS QBasic under DOS. He has written two programs so far: a talkrcx and a firmware download, both of which will work on any PC with DOS and QBasic.

Andy Bower has written Bot-Kit, an interactive object oriented environment for the RCX and Cybermaster using the Smalltalk programming language. It uses the Spirit OCX as a base and runs under Win95/98 and NT4 systems.

Ralph Hempel has a port of hforth to the RCX.

Malcolm S Powell has written Gordon's Brick Programmer as a replacement for the Mindstorms Programming Environment. Tree view based instead of blocks: point and click to add commands, drag to move them, allows variables, and nested loops. No C or Visual Basic programming required!

Chris Stanley has a utility called RCX Interrogator. It will (hopefully) tell you everything there is to know about the state of your rcx: variables, sensors, motors, memory map and more.

Nick H. has written WebSpirit, which enables you to control the RCX Via the ActiveX Control, and JavaScript

Richard Maynard has written Brainstorm which is a UCBLogo version for Mindstorms. Win95/NT.

Denis Cousineau is distributing RCX_command. RCX command is a program editor for the Lego RCX programmable brick. Using RCX command, you can build programs, and download them to the RCX. You can also send immediate command (ex. PlaySystemSound, or PBTurnOff). You can also retrieve information from the RCX using commands such as Poll, or MemMap. RCX commands are compatible with the Lego © SPIRIT.OCX library. Complete documentation is available on the Lego Mindstorms web site.

Kekoa's librcx is intended to be a lowest-level driver for the Lego RCX. It provides an interface between your C code and the ROM. The intent is to allow you to easily explore the ROM interface. It is also possible to use this code as a starting point for writing something more sophisticated, along the lines of LegOS ( Librcx requires the GNU H8 development environment.

Scott Lewis has a pure Java interface for communicating with the RCX. It provides an object-oriented interface for downloading and running tasks/subroutines into the RCX.

David Van Wagner has written code to write simple programs onscreen using the RCX buttons. Version 1.0 contains only enough functionality to be useful. Gotos, Outputs, and Delays are implemented with a maximum of 16 instructions. Later releases should have more functionality."

Jan Newmarch wrote a Jini/MindStorms driver as part of his Jini tutorial.

Aviv Eyal has been programming his RCX using Java and Visual J++ 6.0 COM features. He's generalized the code so others may use his classes to program RCX programs (tasks+subroutines) from Java. He calls it MJSDK - Mindstorms Java Software Development Kit.


The RCX uses a 38kHz carrier, which is pretty typical for TV remotes. As for the sampling rate, the RCX runs at 2400 bps, which makes each bit approx 417us. Sony remotes (which aren't the fastest), use pulse widths of 600us and 1200us, so we're in the right ball park. I think a learning remote would do pretty well.

Peter Middlestorb reports that a learning remote does indeed work. He used a Casio Model 1174 CMD-40 watch.

Someone says that the OmniRemote successfully learned and played back the Lego mindstorms command codes. So I can control my Lego robots with my Palm Pilot III.

The IR protocol associated with sending a "message" to the RCX is pretty simple. Bit encoding is 2400 bps, NRZ, 1 start, 8 data, odd parity, 1 stop bit. A '0' is coded as a 417us pulse of 38kHz IR, a '1' bit is 417us of nothing.

At the packet level, all packets look like this:

0x55 0xff 0x00 D1 ~D1 D2 ~D2 ... Dn ~Dn C ~C
where D1...Dn are the message body, and C = D1 + D2 + ... Dn.

The data for sending an IR message is F7 followed by the 8 bit "message". For example:

55 ff 00 f7 08 12 ed 09 f6
is a packet sending the message "0x12" to the RCX.

Kekoa writes:

The scheme used to transmit data results in an equal number of zero bits and one bits, allowing a receiver to compensate for a constant signal bias (caused by ambient light) simply by subtracting the average signal value. Note that the header also has an equal number of ones and zeros; this warms up the receiver before the real data arrives.

The data portion of each message starts with an opcode. An opcode is either a request (PC to RCX) or a reply (RCX to PC). Requests have 0x80 clear, replies have 0x80 set. The reply corresponding to a given request is the request's complement and vice-versa. Opcodes seem to come in pairs; that is, there are two opcodes to specify each request, and there are two opcodes to specify each reply. These "dual" of a given request or reply opcode is the exclusive or of that opcode with 0x08.


Op 0x10 Alive Request / Op 0xef Alive Response
Op 0x18 Alive Request / Op 0xe7 Alive Response
0x10 and 0xef are complements
0x18 and 0xe7 are complements
0x10 and 0x18 differ only in 0x08 bit
0xef and 0xe7 differ only in 0x08 bit

Dave believes the IR device loops back DTR/DSR, and the PC software uses this to detect if the IR device is attached.

Kekoa has a trace of a firmware download session.

Vadim Strizhevsky and Owen Stenseth have a program which lets you send and receive packets from RCX on a Palm Pilot via serial line. It can also decode/encode the packets and find out if RCX is on-line.

RC commands

Lu contributes the following table of RC commands:
Command Parameter(s) Vague explanation
On (outport A/B/C) turn on one or more things connected to port(s) A, B or C
OnFor (outport A/B/C)(time in tenths of a second or random)
Off (outport A/B/C)
SetPower (outport A/B/C)(1=low to 8=max)
SetDirection (outport A/B/C)(left or right)
ReverseDirection(outport A/B/C)
Wait (time in tenths of a second) possible values are 1-3276
Beep (sound type 1 to type 6)
Tone (frequency)(time in tenths of a second) possible frequency values are 0-20000 (a chart shows places middle C at 523) possible time values are 1-25
ResetCounter set the built in counter to 0
AddToCounter adds 1
ResetRotation (inport 1/2/3) to 0 if an angle sensor is connected
ResetMessage clears a received IR message
ResetTimer reset to 00:00
SendToRCX (integer 1 to 255) send IR message to another RCX
Flow control
Check&Choose (sensor 1/2/3)(True/False) pick sensor(s) connected to port 1, 2, or 3 and check the status
Check&Choose (counter/timer/RCX)(value range)(True/False) here's where you check for a message from another RCX
Repeat (integer or random)
RepeatForever moms just hate this
RepeatWhile touch sensor (1/2/3) repeat while sensor is pressed
" timer (0-3276) while timer value = preset val
" counter (0-32767) "
" RCX (1-255) while message val = preset val
" light sensor (1/2/3)(dark range/bright range) there are 2 ranges with a total range from 0-100
WaitUntil (sensor 1/2/3) until sensor condition is true
Sensor Watchers
Touch (sensor 1/2/3)(pressed/released)
Light (sensor 1/2/3)(dark value range/bright value range)
Rotation (sensor 1/2/3)(0 to 160)(forward/backward) 16 counts per rotation
Temperature (sensor 1/2/3)(cold value range/warm value range) C or F
Counter (range from value/to value) 0-32767
Timer (range from value/to value) in tenths of a second 0-3276
RCX (range from value/to value) 1-255


Kekoa writes:

Here are the specs on part number HD6433292, which you can see in the picture of the bottom of the circuit board:
Series H8/3297
Product name H8/3292
Part number HD6433292
ROM size 16K
RAM size 512
Speed 16MHz @ 5V
8-bit Timers 2
16-bit Timers 1
A/D Conversion 8 8-bit
I/O pins 43
Input only pins 8
Serial port 1
10mA outputs 10

Thanks to Patrick Gili for pointing Kekoa toward the Hitachi page with pointers the chip's manual in various formats.


Chip numbers, as discerned (with a magnifying glass!) by Kekoa, with some additions from Martin Legault.

Numbers for elements on the top (LCD side) of the board (power connector on the right), moving generally from left to right:
2 IR LEDs ?
1 IR receiver TK19 / TFM. / 749 / 1380
1 small chip, below IR receiver leads, four leads CDC / P83
8 small chips scattered on left half, three leads 3K / P / 81
3 small chips scattered on left half, three leads 1K / P / 82
1 capacitor to right of IR receiver leads 4.7uF
3 red cylinders w/ two black lines, two leads diac
5 resistors, yellow label on black 10K
1 resistor, yellow label on black 1M
5 resistors, yellow label on black 2.2K
1 resistor, yellow label on black 22K
3 resistors, yellow label on black 3.3K
3 resistors, yellow label on black 39
1 resistor, yellow label on black 47K
3 resistors, yellow label on black 10K 1%
1 resistor (?), yellow label on black IRD (?)
1 resistor (?), white label on green 560
3 gray boxes, two leads, scattered on left half ?
1 LCD display ?
1 speaker (under LCD) ?
1 LCD controller (under LCD) PCF8566T / 61875 / YSM98061
1 metal can with two (?) leads H2 / 100 / 16V
1 voltage regulator (?) LM293
1 power connector 8 (on back) / 22 (on top)
12 scattered brown boxes, two leads ?
24 scattered diodes SM 4002
12 clips ?

Numbers for elements on the bottom (microcontroller) side of the board (power connector on left), moving generally from left to right:
1 small chip, leftmost on board, three leads Z5 / P / 7d
1 MOSFET (?) F3055L / H7 / 01
1 tantalum cap 10uF, 6V
2 small chips, right of 3055, three leads 3K / P / 81
1 gray box, two leads ?
3 motor controllers (?), 16 leads ELEX 10402B / 9980A 4597
1 bank of three input NAND gates, 14 leads 74HC10D
1 small chip beneath 74HC10, three leads Z4 / P / 7o
1 small chip above right of 74HC10, three leads 1K / P / 82
1 bank of flip flops, 20 leads 74HC377D
1 crystal, above microcontroller 16Mhz
1 small chip above microcontroller, three leads P 005
1 microcontroller, 64 pin QFP HD6433292B02F
1 RAM, 32K (?), 28 pins D43256B60-70LL / 9752XD077
1 capacitor, upper right, two leads 4.7uF
1 small chip, right edge center, three leads 3K / P / 81
1 small chip, right edge bottom, three leads 1K / P / 82
1 resistor, yellow label on black 10
1 resistor, yellow label on black 100
1 resistor, yellow label on black 10K
10 resistors, yellow label on black 100K
1 resistor, yellow label on black 12K
1 resistor, yellow label on black 150K
4 resistors, yellow label on black 22K
1 resistor, yellow label on black 220K
1 resistor, yellow label on black 330
1 resistor, yellow label on black 390K
6 resistors, yellow label on black 47K
1 resistor, yellow label on black 470K
4 brown boxes, two leads ?

Frank Angeli disassembled his light sensor. He has pictures, too. Michael Gasperi figured out the light sensor schematic.

Paul Haas has figured out that the RCX generates a signal which can control a servo. His Hitec HS-300 servo responds to 1 millisecond (ms) pulses by rotating to one extreme and 2 ms pulses by rotating to the other extreme. You can make the RCX generate pulses like that. It takes 3 resistors to get the voltage right and the wave form shape clean enough. His Servo is only rated up to 6 volts, so he used 4 AA batteries for it. Now the servo goes to either extreme under the direction of the RCX.

John Kittelsrud wrote step-by-step instructions on a way to connect R/C servos to Legos.

Allen Martin wrote something about H8 interrupts.

Malcolm S Powell has devised a simple optical sensor that can sense linear motion or rotation.

Wes Matchett has been working on constructing a touch sensor from parts of old devices. He discovered that the micro switches from a MS mouse and a Logitech mouse are the exact width of the inside dimensions of a 2x Lego brick. Here are the instructions and two pics of the results. The price is right, $0.00

Johann Borenstein has written a book entitled "Where Am I? -- Systems and Methods for Mobile Robot Positioning". While it's about non-lego robots, it's got quite a bit of applicable information. This book, which you can download for free, contains nearly 300 pages with *great* illustrations. It's a pretty weighty tome, though (comes in at over 13.5MB, but is in PDF (Adobe Acrobat) format).


W. Craig Trader writes:

Since the RIS software downloads the firmware to the RCX brick, it should be possible to identify the firmware and disassemble it; I'm guessing that ...\Firm\Firm0309.lgo is the firmware file. I looked at it and it appears to be in Motorola S-record format.

Matthew Cross writes: I have sucessfully built a set of binutils that can disassemble the RCX firmware.

  1. Download binutils source:
  2. Run the configure script with the option --target=h8300-hitachi-hms. I also added --prefix=/usr/local to install it under /usr/local. Then run 'make' and 'make install'
  3. To disassemble the RCX firmware: /usr/local/bin/h8300-hitachi-hms-objdump -b srec -m h8300 --disassemble-all Firm0309.lgo

I just disassembled it last night and will be starting to analyze it today. I'll be very interested in trading notes with anyone also working on this. Be sure to snarf a copy of the h8/300 manuals.

I believe that they would operate the chip in mode 2 - Expanded mode with on-chip ROM. So the memory map should be the center one on page 60 of h83297h.pdf (the hardware manual). It seems that they have an on-chip ROM because there is no external ROM on the RCX board, and also note that the S-Records load at address 0x8000, which lines up with where the external address space starts on this memory map.

Olof Åstrand has similar instructions for NT users:

  1. download cygnus cygwin32.
  2. Then download the gnu binutils.
  3. Install the cygnus package. Create a /bin directory. Copy sh.exe to there.
  4. Unpack the gnu-binutils. Winzip will do this for you. I think you have to help it with the extentions ( .tar.gz or .tgz).
  5. In a Cygnus-shell, at the binutils toplevel, type
    ./configure --target=3Dh8300-hms-coff
    make install

I did get some errors when compiling ldemul.c but the rest of the tools installed fine. They install under /usr/local/bin. This is on your default disk. To access other disks use //c //d .

Copy Firm0309.lgo firmware.srec Then do /usr/local/bin/h8300-hms-coff-objdump -m h8300 -D --no-show-raw-insn firmware.srec > firmware.s

Now you should have your firmware dump.

Kekoa has instructions on getting a complete ROM image. He also has a writeup on how to download new firmware to the RCX.

Dick Swan measured the time it takes to execute an RCX instruction.

Send suggestions for improvement to
Russell Nelson
Last modified: Tue Jul 20 13:21:42 EDT 1999