Elmo Live Dissected

221 posts / 0 new
Last post
RetroPlayer
RetroPlayer's picture
Elmo Live Dissected

First let me warn you, if you have small children that love Elmo with all their heart, you may not want to let them view this thread. :)

For all the help Sevik has given me while working on reverse-engineering the Elvis bust, I decided I needed to send him a thank you gift. I was originally going to send him a bust since he didn't even have one, but he isn't so much into that anyway. So I stumbled on the Elmo Live (which actually JUST hit the stores...) After showing him some videos he decided he must have one. So, I pre-ordered two of them and one will be shipped off to the Ukraine to meet its new happy owner.

 HI, SEVA!

But... one of them had to be opened up. And this is the story...

First of all, let's go over his movements.

Elmo Live can stand or sit, and can cross his right leg in the sitting position.

Each of his arms move up and down. His right arm also is also articulated at the elbow to allow him to bring his hand to his mouth.

His neck moves back and forth and his head can rotate upwards

Finally his mouth opens and closes

There are only 3 motors and 3 encoders to provide all of the movements. There is some trickery in how the movements are done and what must be some very interesting cams and clutches inside the two gearboxes within the torso. Obviously, I was a little disappointed about this, but it still has some potential, I think.

Unbelievably, as much as I find Elmo annoying, this toy is actually pretty entertaining (he is just a little too loud, though.) He has some cute stories, games, and animations. This generated a small amount of sympathy while I was skinning the fella.

Elmo has four switches that allow you to interact with him.

Left foot, back, belly, and his nose.

He also has a tilt switch in his left foot, which is weighted by the batteries.

While fully fur-clad, it really looks like he has a ton of articulation and his movements are very fast, springy, and life-like. The illusion is well done and all of the stories, etc... are programmed to make great use of his limited movements. Overall, a very well engineered toy that looks hard to break.

I will be "toying" around with this for a bit to see what kind of mayhem I can wrought. This thread will detail my adventures.

So far, I have managed to remove all of his fur without damaging it and will be posting the pictures and a how-to soon. I took 22 pictures just for the process of removing the fur, so it might be a little long for a forum thread.

For now, I present:

Elmo Live Dissected

RetroPlayer
RetroPlayer's picture

Just a warning before anyone runs out and buys this from my description above. I just got into the electronics and there are only three motors, three encoders, and some engenious mechanics. Might be very difficult to hack.

Grandlarseny37
Grandlarseny37's picture

That's pretty sweet, RetroPlayer. The thing that has impressed me the most about elmo live is how fast he can move (especially his mouth).

RetroPlayer
RetroPlayer's picture

Agreed. It really is what makes him seem so alive. Even if it will be tough to hack, this is some awesome engineering, programming, and animation work.

milw
milw's picture

Egad, it's the Elmo-nator!

MrScott
MrScott's picture

murmured in my best, thick, Austrian accent....

"Come with me if you want to laugh."

RetroPlayer
RetroPlayer's picture

MrScott... HAHAHAHAHA! Thanks!

If I hack him, THAT will have to be one of his phrases.

Peter Redmer
Peter Redmer's picture

Thanks for posting this... I love how he looks skinless with his eyes kinda popping out the top :)

Looking forward to the full gallery and maybe a hack too, it sounds like!

Have fun, Pete

Evans Digregorio
Evans  Digregorio's picture

RetroPlayer, After seeing the movements of Elmo Live on an ad, I was curious to see what this new Elmo looks like without the fur. Now seeing it, It looks like a good chassis for a robot. Thanks for sharing your pics.

idrum289
idrum289's picture

"Come with me if you want to laugh."

Great MrScott, very funny but you beat me to it!

RetroPlayer
RetroPlayer's picture

I have started to do a more in-depth tear-down. As mentioned, Elmo Live consists of three motors, three encoders, 4 pushbutton switches, a tilt switch, and a main controller PCB.

There are 3 gearboxes each with a motor and a mechanical encoder. The three gearboxes are: Head, legs, and arms. The way he works is that movement through a certain range will perform one action, while moving beyond that range, it performs a different action. I started working with the head a little and will describe that. But first, let's look at some pictures:

All the main pieces of Elmo separated.

Head Mechanism

Arm Mechanism

Leg Mechanism

Main PCB top

Main PCB bottom

RetroPlayer
RetroPlayer's picture

Alright, I am going to try to explain how the head mechanism works. This might be tough to put into words. I will try to get some video after I breadboard a simple controller.

There are xxxx ranges of movement. Normal position is with the neck centered and mouth closed.

To make Elmo talk, it moves the neck forward and back with a small range very quickly.

If the neck is extended past the "talking" range, Elmo's mouth opens all the way very quickly in kind of a snap motion. It looks like he is screaming or yelling.

If the neck is extended backward beyond the normal centered position, it hits a stop and converts the movement to rotating his head upwards (looking straight up. The mouth opesn during this movement as well. Like the other way, his mouth snaps open all the way once it reaches a certain point in the motion and it looks like he is screaming, yelling, or jaw agape in awe. He uses this motion during a story about a giant where he is looking up at the giant and screaming.

Since all of these ranges open and close his mouth, he can basically "talk" in all of these positions except the most extreme where his mouth snaps open all the way. All you need to do is switch directions of the motor very quickly and move it within the desired range.

The encoders tell the CPU which range of movement the gear box is in.

RetroPlayer
RetroPlayer's picture

I am currently looking a little closer at the electronics and found some interesting things I will be working with:

First up is the ROM daughterboard. As you can see, the connections are labeled. It should be possible to get a dump of this.

Next up is the top-side in the logic area of the board. There is an interesting jumper labeled Rx. It is connected by a trace on the board to the other side of the jumper and this goes to one of the speaker pins. The other speaker pin goes to a via directly under the CPU blob. Just a theory here, but this configuration looks like it is meant to cut the trace and use the line for serial, maybe? And then the connection could be replaced by filling the jumper.

Between the CPU and the IO Extender (educated guesses) there are two test points. If these are sunplus chips, then these test points are probably the I2C interface between the two chips. My logic analyzer should answer that question.

Also, near what appears to be an IO Extender, are four unpopulated jumpers. If filled, each one would be pulled to VSS (ground.)

The function of those jumpers are unknown. But not for long.... :)

RetroPlayer
RetroPlayer's picture

One possibility of hacking this Elmo is that it should be pretty simple to put this inside of any of the numberous stuffed hand puppets you can find at the toy stores and give it your own personality.

RetroPlayer
RetroPlayer's picture

Anyone want to place bets on how quickly Fisher-Price contacts me after I dump the ROM and show how to make your own messages? I know this information will be used for evil.

sevik
sevik's picture

Heh :))

I think we will have something like this weird thread if nobody will stop us early :))

MrScott
MrScott's picture

It would be some sort of kharmic cycle completion if Elmo's mechanicals were spliced into a RoboSapien carcass.

Why, you ask?
Because of this earlier effort.

http://www.robotsrule.com/html/elmosapien.php

sevik
sevik's picture

:))) Think about black and white colored short-wooled elmo :))

RetroPlayer
RetroPlayer's picture

First attempts to capture the ROM activity have not been successful. It looks like maybe he needs to be completely hooked up first. Right now, I have the PCB on my desk and powering it from a bench supply. No sound on the speaker either.

So, I just spent an hour in the workshop doing a few mods to make testing possible while he is put back together. I have a cable coming out which is connected to all of the ROM signals. I cut the trace on the Rx/Speaker jumper and connected a switch and a "look wire". This will also allow me to shut off his voice during testing.

Finally, I connected wires to all of the jumpers (J1-J4) and these will go to a DIP switch on a separate PCB.

These connections should allow me to access all of the signals that I am interested in. Now I just need to get him all back together (minus fur), but I have run out of time for today.

Shel
Shel's picture

What a delightful exploration. Do you know about a very early project by the Barbie Liberation Front that took numerous talking Barbies and G.I. Joes and switched their voice mechanisms? The translarynxed dolls were put back in their boxes and returned to the shelves of Toys 'R Us and many unhappy returns ensued.
Apparently Joe was heard to pipe (well above his usual bloodthirsty growl) "I love to shop!"

RetroPlayer
RetroPlayer's picture

Yes, I was aware of that story, Shel. :) That was what I meant by 'evil.' I actually appeared in a Boston Globe article about hacking toys that mentioned the same story. That was around 2002, I think.

Roboman
Roboman's picture

Hmm, wondering if l shouldnt simply rip the skin of my sons Elmo (keep it secret please) and use the robot base to finish my Chucky robot project as seen in http://mbah.net/mbahnet/robotics/main.htm

RetroPlayer
RetroPlayer's picture

Looks like this hit all the blogs already. :) Guess the pressure is on to perform.

I am getting data from the ROM right now and Sevik and I are analyzing the interface.

RetroPlayer
RetroPlayer's picture

Here's what we have determined so far:

DATA is a serial input/output for the data or address
CLK is the Data Strobe
ADDR is the Address strobe
DS appears to be a bank select

So far we have not been able to find a standard ROM interface that matches these signals. Usually, there is only one strobe for both data and address.

If anyone has seen this before, please give us a hand. Here's a LA capture of the bus transactions:

I'll upload it to the gallery so it can be seen at full scale

RetroPlayer
RetroPlayer's picture

Not extremely important as we know enough to get a microcontroller to dump the ROM for us. But, that is going to take some time. If it is some known standard interface, I might have the tools to dump it more quickly.

milw
milw's picture

Can you post an expansion of one data/clock/address burst? Hard to see what's going on in the gallery version...
ps how much $$ are these Elmos?

RetroPlayer
RetroPlayer's picture

milw said: Can you post an expansion of one data/clock/address burst? Hard to see what's going on in the gallery version... ps how much $$ are these Elmos?

Done. Added zoomed in traces to the gallery.

I paid $60 each from toysrus.com

RetroPlayer
RetroPlayer's picture

Shorting the jumpers (J1-J4) makes no visible difference. Still playing with the ROM signals.

It seems that the ROM only contains the animations and sounds. There must be firmware in the CPU. There is only activity on the lines when he is moving and speaking.

I will post some video of Elmo animating without the fur sometime tonight or tomorrow. Seems more than a few people want to see that. :) His Kiss-Kiss routine just cracks me up. So cute. I mean... in a 34yo grown up, serious, engineer kinda way. Hehe

My little niece is going to be here this weekend (tonight actually) and she is getting one of these for Christmas, so it might be a chance to see how she reacts without her catching on.

Shel
Shel's picture

RetroPlayer said: Yes, I was aware of that story, Shel. :) That was what I meant by 'evil.' I actually appeared in a Boston Globe article about hacking toys that mentioned the same story. That was around 2002, I think.

Yeah, someone told me about it a number of years ago, mainly because I knew people who worked at Mattel.

MrScott
MrScott's picture

Regarding that voice box swap deal, as a GIJoe collector, my subset of the toy market were split between amusement and outrage....

Which way a person went usually was related to whether they could find a non-sullied copy to replace the tinkered toy. Some collecting completists get bent out of shape when they cannot find a mint in box sample. MIB is not my concern, so I was the amused side of the group.

RetroPlayer
RetroPlayer's picture

I would think that a modded, but sealed copy would be a collectors item all by itself. A piece of history.

Pages