OUR NETWORK: TechLore Explore3DTV MyOpenRouter MediaSmart home TiVoCommunity See all... About UsAdvertiseContact Us

 
Learn about scoring Forum's Raw Score: 1.59474E7
October 16, 2008 12:45 PM

Categories: Robot Hacks and Mods

Rating (1 votes)
  • 1
  • 2
  • 3
  • 4
  • 5
Rate This!


Member Avatar

RetroPlayer

Member
Joined: 03/07/2008

First let me warn you, if you have small children that love Elmo with all their heart, you may not want to let them view this thread. :)

For all the help Sevik has given me while working on reverse-engineering the Elvis bust, I decided I needed to send him a thank you gift. I was originally going to send him a bust since he didn't even have one, but he isn't so much into that anyway. So I stumbled on the Elmo Live (which actually JUST hit the stores...) After showing him some videos he decided he must have one. So, I pre-ordered two of them and one will be shipped off to the Ukraine to meet its new happy owner.

 HI, SEVA!

But... one of them had to be opened up. And this is the story...

First of all, let's go over his movements.

Elmo Live can stand or sit, and can cross his right leg in the sitting position.

Each of his arms move up and down. His right arm also is also articulated at the elbow to allow him to bring his hand to his mouth.

His neck moves back and forth and his head can rotate upwards

Finally his mouth opens and closes

There are only 3 motors and 3 encoders to provide all of the movements. There is some trickery in how the movements are done and what must be some very interesting cams and clutches inside the two gearboxes within the torso. Obviously, I was a little disappointed about this, but it still has some potential, I think.

Unbelievably, as much as I find Elmo annoying, this toy is actually pretty entertaining (he is just a little too loud, though.) He has some cute stories, games, and animations. This generated a small amount of sympathy while I was skinning the fella.

Elmo has four switches that allow you to interact with him.

Left foot, back, belly, and his nose.

He also has a tilt switch in his left foot, which is weighted by the batteries.

While fully fur-clad, it really looks like he has a ton of articulation and his movements are very fast, springy, and life-like. The illusion is well done and all of the stories, etc... are programmed to make great use of his limited movements. Overall, a very well engineered toy that looks hard to break.

I will be "toying" around with this for a bit to see what kind of mayhem I can wrought. This thread will detail my adventures.

So far, I have managed to remove all of his fur without damaging it and will be posting the pictures and a how-to soon. I took 22 pictures just for the process of removing the fur, so it might be a little long for a forum thread.

For now, I present:

Elmo Live Dissected

Discussion:    Add a Comment | Comments 46-60 of 228 | Latest Comment | « Previous 1 2 3 4 5 6 716 Next »

November 1, 2008 8:09 AM updated: November 1, 2008 8:24 AM

Here you can see the spring that will probably go flying out when you open the mechanism. This spring holds the mouth closed, so even if it popped off the track (possible) the jaws should still move. His mouth will just hang open a little more than usual.

You can move the head to all of the positions manually. Like I said, they are meant to have alot of give. Push the head forward at the back of the neck and the jaws should open up. Push his head his all the way back and rotate it up (it will only move a little.) Hmm... this movement seems like it could be forced quite a bit and break something or pop something off track. The rest of the movements should give only little resistance and feel smooth and controlled. If it just flops around, then something is broke.

Also, take a look at this:

As you can see, the wires are breaking off. This is a little board with current limiting resistors for the motor. But, if his head seems to be rotating up (again, his eyes are connected to the upper jaw, so if he looks like he is looking up, then his upper jaw is moving) then the motor must be working.

November 1, 2008 9:01 AM

Well, since I was playing around with Elmo again anyway to help out Kmac, I thought I would show you guys the encoders. I have removed the wiper so that you can see the actual contacts.

It's difficult to describe exactly how this works in words, I think, but I'll give it a try.

This is the head encoder, first of all. Pin one is the red wire.

As you can see, there is a common track, which is the ring around the center. This is connected to ground on the controller PCB. I will reference pin numbers according to this.

When the wiper is over pin 1, the head is in the normal, idle state (mouth closed, head back) Rotating clockwise from this position rotates the head upwards and counterclockwise moves the neck forward.

To talk, Elmo rapidly just moves his neck back and forward. It senses how much to move by rolling the wiper off the pin1 contact in either direction. Moving as far as the contacts for pin 2 or pin 6, he begins to look like he is yelling. Pin 6 and his neck is forward, beginning to yell. Pin 2 and he is looking up and yelling. Moving on and off these tracks allows him to talk while in these positions.

Pins 5 and 3 are the extreme positions both neck all the way forward (Pin 5) or neck back, and head rotated upward (Pin 3.)

The actual wiper is connected to the shaft and looks like a spring loaded roller skate:

The head encoder has 5 regions, while the arms and legs have only 3 regions.

View unverified member's comment - posted by Kmac

November 3, 2008 7:07 PM

Wow RetroPlayer, thats amazing! What role do you think the limiting resistors have for the motor?

What's your background?

November 3, 2008 8:13 PM

DJ, after looking at them a little closer, they appear to be chokes, not resistors. Probably meant for noise & spike suppression to prevent the controller from resetting, due to the fact that the motor switches directions very rapidly. And due to the PWM, they probably also provide some resistance during a stall or short condition to prevent the toy from bursting into flames.

I haven't actually looked at the PWM output to the motors yet, so I am just making some educated guesses here that can be easily tested. The controller is currently disassembled for other research at the moment.

I am an electronics technician in the aerospace & defense industry.

November 10, 2008 12:36 PM updated: November 10, 2008 1:14 PM

Got my Elmo Live today :))

Really you need very low effort to get all needed parts exposed :))



ROM Extracted :))



Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

November 10, 2008 1:28 PM

Without ROM it does some looks-like-random actions including sounds...

So, at least some sounds are present in main cpu rom...

Actions is not random really, they are very similar to original movements as for me... I'll solder socket for rom and check...

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

November 10, 2008 3:11 PM updated: November 10, 2008 3:16 PM

Activity without ROM is much shorter than real.

ROM in socket, still works :))



Socketable ROM (really you can fit it to 2.5mm header):

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

November 11, 2008 2:18 AM updated: November 11, 2008 2:29 AM

hehe :)) Using simple LPT jtag cable, some wires and breadboard sent by RetroPlayer I got ROM dump :))

Rom uses bit level addressing with 24bit address and one bank select pin , so we have 4Mbytes total.

It has address autoincrement too, so really you just need to set Ds, clock 24 bit of 0 using ADDR strobe, and read data until end of times with CLK strobe.

For legal reasons I'll not post dumps here, but they are available on request :))

Start of first bank:



0000 39 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0010 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
... (a lot of FF)
0FD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0FE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0FF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1000 12 3E 86 59 D9 11 80 FF 12 3E A3 1D D9 11 80 FF
1010 12 3E F8 FB D9 11 80 FF 12 3E CA 6F D9 11 80 FF
1020 12 3E 2B 11 39 11 80 FF 12 3E 6A 8D 39 11 80 FF
1030 12 3E 1C 4B 39 11 80 FF 12 3E 73 27 39 11 80 FF
1040 12 3E 3F B1 B9 11 80 FF 12 3E 1A 07 B9 11 80 FF
1050 12 3E 55 29 79 11 80 FF 12 3E 1A 4D 07 11 80 FF
1060 12 3E 3E F5 79 11 80 FF 12 3E 3D 59 87 11 80 FF
... (a lot of similar looking data
1800 12 3E CF E5 99 11 80 FF 12 3E 80 AD 99 11 80 FF
1810 12 3E 84 0B 99 11 80 FF 12 3E BA B7 99 11 80 FF
1820 12 3E C9 6D 59 11 80 FF 12 3E FB 5F 59 11 80 FF
1830 EA B2 26 B2 07 74 40 01 55 48 88 88 88 55 88 88
1840 88 88 80 81 00 A0 AA 88 88 88 88 AA 88 88 88 88
1850 AA 88 88 88 88 AA 88 88 88 88 AD 88 88 88 88 55
1860 88 88 88 88 55 88 88 88 88 55 88 88 88 88 81 01
1870 00 D0 AA 88 88 88 88 A8 88 88 80 00 20 08 80 00
...


Does not this a-lot-of-88 pattern is similar to something?... :)))

Start of second bank:


0000 EA B2 26 B2 07 74 60 FE 80 01 80 01 00 80 00 00
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0030 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0060 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0080 00 00 00 00 00 00 00 00 00 00 00 01 10 00 08 80
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00B0 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00
00C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
00E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0100 00 00 00 00 00 00 00 00 04 01 00 00 00 00 00 00
0110 00 00 00 00 01 00 00 00 08 C6 44 8C 88 80 A1 8A
0120 46 22 47 8D FC 8D 82 2C 0C 41 80 DA C4 51 8C 48
0130 44 88 1D 5E 30 00 44 4C 2C 38 A4 C3 72 C1 50 22
0140 CC 06 00 C4 1C 48 08 48 17 88 04 08 C8 03 8C C2
....


End of second bank:


1F3230 00 00 00 40 01 00 00 00 00 00 00 00 00 00 00 40
1F3240 01 00 00 00 00 00 00 00 00 00 00 80 01 00 10 00
1F3250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F3260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F3270 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00
1F3280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F3290 00 00 00 00 00 00 00 08 00 08 80 00 40 88 80 00
1F32A0 00 41 01 80 88 00 00 00 02 00 00 00 80 FF 00 FF
1F32B0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F32C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F32D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F32E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F32F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F3300 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
... (a lot of FF)
1FFFD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1FFFE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1FFFF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
--- (rollover on 0x200000) ---
200000 EA B2 26 B2 07 74 60 FE 80 01 80 01 00 80 00 00
200010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
200020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


ROM Reader:



Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

November 11, 2008 9:51 AM updated: November 11, 2008 9:51 AM

Sevik,

You need to give that kitten a soldering iron and put her to work like I said. She seems very interested to help you! :)

November 11, 2008 6:05 PM

I almost picked up the Elmo today but thought better of it since you guys have a handle on it I'll leave this hack to you all unless I think of something really cool to do with it.

Jax

GWJax, To Hack and make mods on robots is a life style and comes natural and not by choice. If a robot has a screw to open it then it must be opened!

November 11, 2008 7:02 PM updated: November 11, 2008 7:02 PM

Jax,

I am mostly sitting on the side-lines for this latest effort with the ROMs. Helping Sevik with decoding it as much as possible, but he is much faster than me. :) We are getting close to figuring out the audio and once we do that, we should have the motions figured out too. But this is for making just a custom ROM which I am mostly not interested in doing myself as I learned my lesson from Elvis.

I am *very slowly* working on a controller for my Elmo using an ATMEGA32, which I might scale back to some smaller uC with some glue logic. I am toying with some bootloaders right now and trying to decide if I want to just have an external flash chip for memory and DA sound, or the whole SD Card/FAT/MP3 thing.

And of course, I am trying my best not to tear open my third Elmo to join Sevik in the fun he is having. My Elmo is beyond the point of simple return right now and I would have to undo much of the effort I have already put into it going in a different direction to get back to going in the direction Sevik is going. Not necessary, though; Sevik's got that covered now (and wow, within an few hours of receiving it!)

The third Elmo was going to be for my neice, but it looks like she doesn't want it. So I am going to wait to see if it becomes the next $1000 must-have toy for Christmas before I rip it open. If so, I will probably try to find her the Butterscotch robotic pony that she really wants instead (but that's 300 bones... ouch! Looks like it would be fun to hack, though, if I had $300 laying around. :)

November 12, 2008 2:51 AM

$600, one for you, one to keep your niece happy.

In the past when working on things with my ATMega32, I found adding FAT support just ate up to much space.

RoboGuide - Your guide to hacking all things WowWee

November 12, 2008 3:03 AM

FAT file read for 6502 (only FAT16, only root-directory, file-search and streaming read):

a.o:
CODE Offs = 000000 Size = 000671
RODATA Offs = 000000 Size = 00008F
BSS Offs = 000000 Size = 000400

1650 bytes of code and 1024 bytes of ram (2 sector sized buffers, one for FAT buffering and can be reduced)

Free RoboPanda!!! :)

Yes! If something has a dump, it must be hacked :))

November 12, 2008 5:52 AM

Sevik,

This was not a full FAT implementation though, right? You are just reading one file and not parsing the whole FAT table, if I remember correctly when you were telling me about it.

Probably not much more would be needed for Elmo either.

Discussion:    Add a Comment | Back to Top | Comments 46-60 of 228 | Latest Comment | « Previous 1 2 3 4 5 6 716 Next »

Add Your Reply

(will not be displayed)

Email me when comments are added to this thread

 
 

Please log in or register to participate in this community!

Log In

Remember

Not a member? Sign up!

Did you forget your password?

You can also log in using OpenID.

close this window
close this window