Hacking a

Document Sample
Hacking a Powered By Docstoc
					Hacking a

 Zip-Zap for Remote Control                                                                 W     hen I was in
                                                                                                  RadioShack         a
                                                                                            while back, I noticed
                                                                                            that they were selling off
                                                                                            the Zip-Zap mini RC
                                                                                            toys at deep discounts.
                                                                                            The store manager
                                                                                            explained that they were
                                                                                            closing out the line after
                                                                                            a four-year run. (Don’t
                                                                                            worry — they are still
                                                                                            available on eBay and
                                                                                            other web resources.) I
                                                                                            bought one to indulge
                                                                                            my “inner child.” I was
                                                                                            impressed by the tiny
                                                                                            size of the toy car and
                                                                                            the fact that it obviously
                                                                                            had four channels of
                                                                                            control — forward/back
by Guy Marsden                                                                              and left/right.

     After chasing the cat with it for a   such as a specific room.                    and clipped in my adjustable bench
few minutes and learning that the               It could also be used to reduce the    supply and slowly dialed it up to five
range was about 10 feet or so, I           number of wires needed to operate           volts while operating the transmitter.
started to think about applications        manipulators on the end of an arm.          The car steering (consisting of
for a nice, cheap little four-channel      Sometimes running multiple wires            two tiny electromagnets) still racked
control system. A number of ideas          through a robot arm can be tricky and       back and forth and the motor ran
came to mind, such as signaling            restrictive; a short-range radio link       just fine, but much faster. So far
between bots in game playing or            could reduce a bulky wire harness           so good.
flocking behaviors. A transmitter          down to two power leads. So I decided            Looking closer at the receiver, I
could be used as a sort of lighthouse      to take my toy apart to see how practi-     saw a row of SOT-3 parts that were
waypoint for mobile robots that            cal it would be to hack.                    labeled Q3 through Q7, with Q5
come within its limited range. Or it                                                   and Q8 on the back, so they were
could be used to keep mobile robots        Deconstructing                              likely to be the drive transistors. The
within a certain reception range,          the Receiver                                solder pads along the edge of
                                                                                       the board were nicely labeled: -B, L,
 Figure 1
                                                                 On opening up         +B, R, F, B (see Figure 1). Clearly,
                                                            the car, I found a tiny    these were for power, Left/Right, and
                                                            receiver board oper-       Forward/Back. After cutting all the
                                                            ating from an equally      motor wires off close to the board,
                                                            tiny battery that          I soldered some LEDs (with current
                                                            was marked 1.2V            limiting resistors) to the pads to
                                                            100 mAH. My first          confirm that the transistors were
                                                            concern was that I         operating as open collector switches.
                                                            would want to get a        Success! The transmitter was now
                                                            useful signal level out    controlling four discrete LEDs. (By
                                                            of the device in order     the way I find it handy to have a
                                                            to     interface      to   bunch of LEDs lying around with 470
                                                            five-volt logic devices.   ohm resistors attached. They are
                                                            I removed the battery      useful for all kinds of testing and can
72   SERVO 08.2006
be plugged right into a breadboard as       that they would          L       R        F         B      BCD       IC Pin CONTROL
an indicator.)                              operate         the
                                                                     0       0        0         1       1
     Since the F/B outputs comprise         transmitter. This                                                      1       LEFT
an H-bridge to reverse the motor, it        means that inter-        0       0        1         0       2
                                                                                                                   4       FWD
is clear that each output has two           facing to control        0       1        0         0       4
transistors apiece that pull the output     logic would simply                                                     5       BACK
                                                                     0       1        0         1       5
to the supply rails. This means that a      entail using the
small relay can be connected to one         output of any logic      0       1        1         0       6         14      RIGHT
of the outputs and tied to V+               device or micro-         1       0        0         0       8          3       GND
or ground and it will switch when           controller pin. It       1       0        0         1       9
actuated! These outputs can also            couldn’t be a                                                        TABLE 2.
interface directly to logic since they      simpler interface.       1       0        1         0       10      Transmitter
are driven both ways. The L/R                                     TABLE 1. Transmitter Codes.                   Connections.
outputs each have a single transistor       Antennas
driver with an open collector so these                                                    think that a metal box would be a
can switch a relay coil to ground only.         It’s not a good idea to change            bad idea.
To interface to logic, a pull-up resistor   the length of the wire antenna
would be needed; a 4.7K or 10K will         attached to the receiver since that           Applications
work fine.                                  would de-tune the RF circuit.
                                            However, since the transmitter uses                The transmitter board is a tad
Deconstructing                              a telescopic antenna, I have to               bulky at 2-1/4” x 3-1/4” since it
the Transmitter                             assume that the circuit will be               also incorporates the charging
                                            forgiving of adjusting that length. I         circuit for the car. Since this circuitry
     After opening up the transmitter       found by experimentation that                 is all at one end — near the Forward
box, I first removed the two AAA            anything from a 1” wire to a fully
batteries (three volts), connected my       extended       telescopic      antenna
adjustable supply, and dialed it up         performs about the same. However,
slowly starting at three volts while        as I carried the loose board and
trying the buttons and watching my          battery pack around in my hands, I
LEDs blink on the receiver. It worked       learned that holding the batteries
just fine at 5V, but at 6V it ceased to     close to the circuit board (right above
produce results; the range and              or below the components) severely
response did not seem to be compro-         compromised the performance. It
mised at five volts based on my             would be best to keep batteries and
relative tests. I tried pressing the        other metal at some distance from a
rubber pads on both the L and R             plane parallel to the board; I would                                        Figure 3
buttons simultaneously hoping to see
two LEDs light on the receiver. No          Figure 2
such luck — it defaults to just the R
output on the receiver. So the system
can only operate Left OR Right and
Forward OR Back as I suspected. I was
hoping to transmit four bit BCD to
make a 16 channel control system,
but this way I have the option of
transmitting eight discrete values that
could be decoded for many uses (See
Table 1).
     Looking closely at the circuit
traces, I noticed that one side of
each of the button pads went to
ground. I traced the other side of the
button pads and found that they all
terminated at the 14 pin chip (see
Table 2) I attached a color-coded
ribbon cable to these points (Figures
2 and 3) and tested them from a
CMOS inverter’s output to ensure
                                                                                                             SERVO 08.2006     73
Hacking a Zip-Zap for Remote Control
                                                                     Zip-Zap charging.
Inside of car.

and Back buttons — that part can          applications for the receiver include the   • Transmitting up to eight discrete
be carefully cut off if needed. The       following:                                  codes as a four bit binary coded
receiver, however, is pretty darned                                                   value.
small at around 1” square and             • The original use — running one
I’m sure that there may be many           motor forward/stop/back and switch-         • A combination of the       above like
applications for this tiny four-channel   ing two small loads.                        reversing a motor and        using the
device.                                                                               remaining outputs to drive   a run/stop
    This inexpensive toy can easily       • Switching four small loads or             relay and a Forward/Back     relay for a
be re-purposed in many ways, the          relays.                                     second motor. SV

74   SERVO 08.2006

Shared By: