I should have said, I was interviewed in the Boston Globe article "Hackers in toyland"
BTW, I have no connection with RTMARK (the leftist organization) but it looks like the only copy of the article left on the internet.
I was a minor part of the hacking Barney scene way back when, too.
I would think that a modded, but sealed copy would be a collectors item all by itself. A piece of history.
The collectors covet manufacturing variations and misprints. They're not so excited about products that were purchased, altered, and returned to be recirculated.
Believe it or not, there's a subset of the toy tribe that will buy a figure, open it, strip it of anything of interest, and substitute much cheaper content for a store return. The unaware gramma buying something for her grandkids ends up buying junk, and dissapointing the wee folk. It's not unsual to buy a high end figure and find it swapped for a $5 one.
Roboman said: Hmm, wondering if l shouldnt simply rip the skin of my sons Elmo (keep it secret please) and use the robot base to finish my Chucky robot project as seen in http://mbah.net/mbahnet/robotics/main.htm
Hey, Roboman. I missed your post before. Have you gotten any further with the chucky doll? Any of the mechanics already done?
Update: Sevik and I have decided that he will reconfigure his FPGA ROM emulator that he is using for the Robopanda hacking to dump the ROM and go that route. I will be focusing on creating an entirely custom controller. I would like to add some more movements anyway and will need a new controller to do that.
I haven't decided exactly what I want to do with him yet, but when I look at him, I see "Daffy Duck" or just about any of the warner bros. cartoon characters. A "Marvin the martian" would be awesome, except you can't see his mouth, so it might not be so interesting to watch. My favorite WB character is Michigan J. Frog. But That doesn't really fit the body type at all.
I am open to suggestions, if anyone has any.
I owe some videos of Elmo in his current state and will get those up before I retire the Elmo personality for good.
I also owe an article on disassembling him and some details on how the mechanisms and encoders work.
I shot a ton of video this morning before I realized that Elmo wasn't moving his legs at all. A wire had broken on his leg motors. So, instead of re-shooting everything, I am just going to record one routine where he sits and crosses his legs. I have a rough storyboard in my head to reduce the footage down to just enough to see all his features and will try my hand at splicing something interesting together.
That pretty much complete's Elmo's life as "Elmo." Starting tomorrow I will be breaking him down and making some molds of useful pieces and looking at what I might want to do with him.
Right off the bat, a few mods I have been thinking about are copying his right arm to his left arm, and modding his shoulders to allow them to move up and down. Right now, the shoulders have a ramp in them that move his arms away from his body as they rotate up. I also removed his springy hands which are just silly looking and useless. I will try to build something to replace them, perhaps with a simple cartoon like hand. Not sure yet. His legs would be very difficult to mod, I think. And his head really can't be modded much other than maybe some moving eyes.
As far as hacking his electronics, this looks to be pretty difficult to do for such a limited reward. The ROM is not a standard memory interface that we have found so far. We already know how it works and we will still be dumping the ROM. Sevik will most likely create a ROM emulator, but coming up with something for the average hobbyist will not be easy. Depending on how much of his movements I will be able to mod to be more generic, I might design a replacement controller.
The problem is that Elmo was designed specifically for the movements used in his routines. It seems they started with the content first, and then reduced it down to re-using similar movements, and then designed the hardware to do only these movements.
I really like the overall design, shape, size, etc... so I am likely to do something with it, but to make a generic robot base is going to require some pretty extensive modding. Definitely not impossible, but it will probably end up being hard for others to follow. Regardless, I will make the best effort to describe whatever I do as I do with most of my projects. Half the fun is in sharing information.
We'll see. The initial excitement of this toy has wore off a little (my 6yo niece found him more boring than I did, BTW) but this is certainly not the end of the story...
I started the full tear-down a little early and got a shot in the arm with what I have found. The arms are completely cable-driven. The mechanism is very simple. There are two pulleys. One for the shoulder rotation, and one for the elbow. There is a clutch between the two pulleys which allow the arms to rotate up and down freely. If the motor is moved beyond the fully up or down position, this engages the second pulley which lifts the elbow mechanism.
The arms themselves have joints capable of the full range of motion of a human arm (up to the forearm.) The shoulder sockets have the ramps in them that I mentioned before which limits the "side out" arm movement. But this can be machined down to allow the shoulders to move the full range.
Further, it looks like it should be fairly simple to make a copy of the right arm and install it on the left arm for two fully articulated arms. The only trouble is that there is one extra spring in the right elbow mechanism. But a piece of thin piano wire should be enough to take care of that.
If the rest of the assemblies are this simple, the modding possibility of this chassis just skyrocketed.
I uploaded several images of the arm sub-assembly tear-down to the gallery. The next to be done will be the head.
I've got some ideas for replacement hands. Remember those mechanical hand toys you had when you were a kid? If not, look here:
Something like this would work fine, but in the typical cartoon (3 fingers and a thumb) style and would be cable driven as well. I think a corkscrew type mechanism might even allow me to twist the wrist. Hard to describe, so I will draw something up to explain it. If all movements are, or can be converted to, cable-driven then all motors could be put in the torso (or even feet.) I know, at least, that part of his legs are cable driven. His hips probably are not since they need to handle his weight. The head appears to be all mechanical linkages and cams.
I got into Elmo's head (scary place, that) a little last night and found that it was all linkages and cams as I had suspected. To convert the movements it is going to take some planning since many of the cams and levers are very dependent on the gearbox casing. I have decided that there are enough mods that I want to do with the arms that I will be focusing on them first. I am not even sure that I would want to keep the head the way it is, so I'll save it for later when it has my full attention.
Back to the arms. I keep mentioning how great they are, but they really are. They are modular enough that they would be useful for full robotic arms of just about anything at this scale. This is the second reason I am planning to make molds of them.
There is one movement that these are not capable of, however. And that is rotation at the shoulder. Imagine if you place your arm down at your side. You are able to cross your forearm across your stomach. This is the movement that these arms are not capable of. This could be done at the elbow/forearm junction however.
I am not clear enough on my plans for these yet, so I am just going to show some closeup pictures of the arms to give you an idea of what they are capable of.
This is the shoulder of the right arm. The end of the shoulder has a pulley around which the string was wrapped to allow it to rotate. Inside is a place for a compression spring which would rotate it back. The two white knobs are currently just being used as stops to limit the side to side motion, but the white plastic pieces are actually rollers which slid along the ramps in the shoulder sockets to move the arms away from the body when the shoulder is rotated. It should be possible to machine out the ramps so these can just move around freely and a string attatched to these knobs to actuate them. Maybe a spring around the center axle to return them so only one string is needed?
To get the strings (or cables) through to the rest of the joints, the shoulder has a tube through the center of it.
Sorry for the dark pictures. The tube is big enough that several thin cables could fit in there. But if you put more than one cable in there, the cables should have shealths, so they don't bind each other. I usually make my own cables when I need something this small and just use insulated electrical wire. I pull the wire out to use the insulation for a shealth. It should be possible to buy capillary tubing small enough to use, but this is what I seem to always have on hand when I need to do something like this.
A diagonal hole would need to be drilled to guide a cable up to the shoulder knobs, since the tube just goes straight through right now.
The cable that went through the shoulder went over this elbow piece and looped around a piece that was screwed into the hole above in the forearm. The jagged points are meant to bite into the cable and secure it. When the cable was pulled through the shoulder, it would bend the elbow. There are compression springs at each end of this elbow piece to straighten it back out.
All of these joints are using rivets which will need to be removed to take the arm apart for molding and casting. I tried knocking them out with a small hammer and tap, but haven't been successful yet. I might need to make a tool out of a C-Clamp (like a gear puller) to push them out. They seem to be glued in. Not a big deal, but I am taking it slow so that I don't break anything.
This is the end of the arms. Elmo's hands were just long springs with paddles on the end. One end of the spring just looped over this post and a second piece (not shown) screwed down to hold the spring in place.
And finally, let's take a look at the movements:
This is the right arm, which has the elbow. The forearm can actually lay flat against the upper arm.
This is the left arm, which is missing the elbow. Looking at the mechanisms closely, the elbow piece from the right arm should fit in place of this forearm to make both arms articulated. The shoulder in this arm also has a tube through it just like the right, which means cables can already be run through it without modding it. The shoulder itself is a little different in that this one is a solid piece while the right side is machined to allow the cables some room.
Here's a video of the arm mechanisms (as-is) using cable control. All that I have done here is separated the arms to move independently and threaded new cords. It is ot so easy to move with just my fingers and I didn't think to create finger loops at the time. :)
Update: Wrong video linked
Something like this is planned:
My 9 month old sons elmo's mouth has stopped moving (only when he is talking) after one day and some heavy handed nephews, it was purchased from ebay so has no warrenty, is there a spring that could of come off that controls the jaw mechanism?
Any ideas guys please
Kmac said: Hi Guys My 9 month old sons elmo's mouth has stopped moving (only when he is talking) after one day and some heavy handed nephews, it was purchased from ebay so has no warrenty, is there a spring that could of come off that controls the jaw mechanism? Any ideas guys please
There are lots of springs, levers, and cams in the head that could have broke. His mechanisms are pretty sturdy, though and are designed to give way to forcing movement. They would difficult to break.
Let me ask a couple of questions to help you figure out what is wrong:
1. Is the jaw just hanging open and loose?
note: The upper jaw an lower jaw both move like a pair of scissors. So, a broken jaw should still show movement in the other jaw.
2. When he should be talking, do you hear alot of rapid motor noise?
note: It should sound very rapid, like a motor switching directions very quickly
3. Does his head still move when he talks?
note: the head itself should still move back and forth or rotate up and down, even with a broken jaw. A good test is to push the button on his foot. The first story he tells is about the giant and he rotates his head up and down during this story.
I found that with not-so-rough treatment during my disassembly, a wire had broke off his leg motor and I noticed that they were not soldered on very well. Probably this is all that happened to your son's toy.
Regardless; opening him is pretty easy, but putting him back together again is going to be a little more difficult. You are going to need some heavy red thread and two large zip-ties, small needlenose pliers and some patience.
If you are willing to try, I am willing to try to help you, but let's get a "test plan" going first by answering those questions above.
1 The jaw dosn't hang loose.
2 No exessive motor.
3 His head still moves.
On the test you asked me to carry out Elmo moves his mouth on the actions of the story but not when narrating.
I have also realised that when he is scared he should shake but he remains still even though the motor is running.
Sounds like either the encoder has been knocked loose or only the bottom jaw is broken. When his head tips back, the mouth opens, but you would notice the upper jaw moving and not the bottom, so it would look like his mouth was opening.
There is a plastic guide pin that moves inside one of the slots in the cams (I'll get a picture of it in a little bit.) Perhaps this was busted off.
Any rattling noise in the head if you shake it?
To get inside the head, you will need to locate the neckline in the back. The threads of the fur are concealing it, but if you push them around right where you feel a big ring, you will find it. Near the very center of the back of the neck, you should feel two hard plastic bumps. These are the ends of the zip-ties that are holding the fur to the torso and the head. You will need to try to locate in the seam and pull it apart a little, then clip the zip-tie off. Rip the threads holding the seam together along the back of the head and you should be able to fold the fur back enough to see that the eyeballs are holding the rest of the fur to the head. Pop the eyes out of the upper jaw bracket and you should be able to pull the fur all the way off the head.
Above you can see where the eyes clip into the upper jaw bracket.
This is what Elmo looks like while you are removing the fur. You shouldn't need to undo the fur on the torso, though.
Once the head is free, it should look like this.
There are three screws holding on the head shell. The other two screws that are exposed hold the mechanism together, so don't remove those yet.
Four screws hold the head mechanism together and a spring is slid onto one of the shafts. Remove the screws, then hold the pieces together while sliding off the spring. Inside the mechanism is another spring under alot of tension, so, before pulling the brackets apart, hold the upper jaw in place and be somewhere where you can find the spring if it goes flying.
This shows the mechanism related to the lower jaw. The circles marked "Post" have guide pins that fit into the cams. The upper one is connected to the lever for the upper jaw. "Spring" marks the location of the spring I mentioned above which is under high tension. One end is connected to the upper jaw and it wraps around the shaft in the picture above. There is a little hole there where one end of the spring pushes into.
Putting the head back together is not so simple mostly because of that spring. But, it is possible as these pictures were actually taken in reverse order, so you can see that I managed to get it back together.
Looking at the mechanism, it seems that it might be possible that one of the guide pins popped out of the slots. The whole mechanism is designed to have alot of give, but if someone were forcing the mouth open AND holding the neck straight at the same time, it would be possible to snap something. If they did, you will definitely hear some rattling inside the head.
Hopefully, if you get inside the head, these pictures will help you locate anything that is out of place.
Here you can see the spring that will probably go flying out when you open the mechanism. This spring holds the mouth closed, so even if it popped off the track (possible) the jaws should still move. His mouth will just hang open a little more than usual.
You can move the head to all of the positions manually. Like I said, they are meant to have alot of give. Push the head forward at the back of the neck and the jaws should open up. Push his head his all the way back and rotate it up (it will only move a little.) Hmm... this movement seems like it could be forced quite a bit and break something or pop something off track. The rest of the movements should give only little resistance and feel smooth and controlled. If it just flops around, then something is broke.
Also, take a look at this:
As you can see, the wires are breaking off. This is a little board with current limiting resistors for the motor. But, if his head seems to be rotating up (again, his eyes are connected to the upper jaw, so if he looks like he is looking up, then his upper jaw is moving) then the motor must be working.
Well, since I was playing around with Elmo again anyway to help out Kmac, I thought I would show you guys the encoders. I have removed the wiper so that you can see the actual contacts.
It's difficult to describe exactly how this works in words, I think, but I'll give it a try.
This is the head encoder, first of all. Pin one is the red wire.
As you can see, there is a common track, which is the ring around the center. This is connected to ground on the controller PCB. I will reference pin numbers according to this.
When the wiper is over pin 1, the head is in the normal, idle state (mouth closed, head back) Rotating clockwise from this position rotates the head upwards and counterclockwise moves the neck forward.
To talk, Elmo rapidly just moves his neck back and forward. It senses how much to move by rolling the wiper off the pin1 contact in either direction. Moving as far as the contacts for pin 2 or pin 6, he begins to look like he is yelling. Pin 6 and his neck is forward, beginning to yell. Pin 2 and he is looking up and yelling. Moving on and off these tracks allows him to talk while in these positions.
Pins 5 and 3 are the extreme positions both neck all the way forward (Pin 5) or neck back, and head rotated upward (Pin 3.)
The actual wiper is connected to the shaft and looks like a spring loaded roller skate:
The head encoder has 5 regions, while the arms and legs have only 3 regions.
WOW Thanks Retro player.
Im amazed by your effort to help us fix our Elmo!!
Im an Engineer but maybe not as talented as yourself in this field!! I will give it a go and let you know how I get on....once again thanks for your help.
Wow RetroPlayer, thats amazing! What role do you think the limiting resistors have for the motor?
What's your background?
DJ, after looking at them a little closer, they appear to be chokes, not resistors. Probably meant for noise & spike suppression to prevent the controller from resetting, due to the fact that the motor switches directions very rapidly. And due to the PWM, they probably also provide some resistance during a stall or short condition to prevent the toy from bursting into flames.
I haven't actually looked at the PWM output to the motors yet, so I am just making some educated guesses here that can be easily tested. The controller is currently disassembled for other research at the moment.
I am an electronics technician in the aerospace & defense industry.
Got my Elmo Live today :))
Really you need very low effort to get all needed parts exposed :))
ROM Extracted :))
Without ROM it does some looks-like-random actions including sounds...
So, at least some sounds are present in main cpu rom...
Actions is not random really, they are very similar to original movements as for me... I'll solder socket for rom and check...
Activity without ROM is much shorter than real.
ROM in socket, still works :))
Socketable ROM (really you can fit it to 2.5mm header):
hehe :)) Using simple LPT jtag cable, some wires and breadboard sent by RetroPlayer I got ROM dump :))
Rom uses bit level addressing with 24bit address and one bank select pin , so we have 4Mbytes total.
It has address autoincrement too, so really you just need to set Ds, clock 24 bit of 0 using ADDR strobe, and read data until end of times with CLK strobe.
For legal reasons I'll not post dumps here, but they are available on request :))
Start of first bank:
0000 39 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0010 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0020 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
... (a lot of FF)
0FD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0FE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
0FF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1000 12 3E 86 59 D9 11 80 FF 12 3E A3 1D D9 11 80 FF
1010 12 3E F8 FB D9 11 80 FF 12 3E CA 6F D9 11 80 FF
1020 12 3E 2B 11 39 11 80 FF 12 3E 6A 8D 39 11 80 FF
1030 12 3E 1C 4B 39 11 80 FF 12 3E 73 27 39 11 80 FF
1040 12 3E 3F B1 B9 11 80 FF 12 3E 1A 07 B9 11 80 FF
1050 12 3E 55 29 79 11 80 FF 12 3E 1A 4D 07 11 80 FF
1060 12 3E 3E F5 79 11 80 FF 12 3E 3D 59 87 11 80 FF
... (a lot of similar looking data
1800 12 3E CF E5 99 11 80 FF 12 3E 80 AD 99 11 80 FF
1810 12 3E 84 0B 99 11 80 FF 12 3E BA B7 99 11 80 FF
1820 12 3E C9 6D 59 11 80 FF 12 3E FB 5F 59 11 80 FF
1830 EA B2 26 B2 07 74 40 01 55 48 88 88 88 55 88 88
1840 88 88 80 81 00 A0 AA 88 88 88 88 AA 88 88 88 88
1850 AA 88 88 88 88 AA 88 88 88 88 AD 88 88 88 88 55
1860 88 88 88 88 55 88 88 88 88 55 88 88 88 88 81 01
1870 00 D0 AA 88 88 88 88 A8 88 88 80 00 20 08 80 00
Does not this a-lot-of-88 pattern is similar to something?... :)))
Start of second bank:
0000 EA B2 26 B2 07 74 60 FE 80 01 80 01 00 80 00 00
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0030 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0060 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0080 00 00 00 00 00 00 00 00 00 00 00 01 10 00 08 80
0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00B0 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00
00C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
00E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0100 00 00 00 00 00 00 00 00 04 01 00 00 00 00 00 00
0110 00 00 00 00 01 00 00 00 08 C6 44 8C 88 80 A1 8A
0120 46 22 47 8D FC 8D 82 2C 0C 41 80 DA C4 51 8C 48
0130 44 88 1D 5E 30 00 44 4C 2C 38 A4 C3 72 C1 50 22
0140 CC 06 00 C4 1C 48 08 48 17 88 04 08 C8 03 8C C2
End of second bank:
1F3230 00 00 00 40 01 00 00 00 00 00 00 00 00 00 00 40
1F3240 01 00 00 00 00 00 00 00 00 00 00 80 01 00 10 00
1F3250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F3260 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F3270 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00
1F3280 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F3290 00 00 00 00 00 00 00 08 00 08 80 00 40 88 80 00
1F32A0 00 41 01 80 88 00 00 00 02 00 00 00 80 FF 00 FF
1F32B0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F32C0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F32D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F32E0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F32F0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1F3300 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
... (a lot of FF)
1FFFD0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1FFFE0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1FFFF0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
--- (rollover on 0x200000) ---
200000 EA B2 26 B2 07 74 60 FE 80 01 80 01 00 80 00 00
200010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
200020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
You need to give that kitten a soldering iron and put her to work like I said. She seems very interested to help you! :)
I almost picked up the Elmo today but thought better of it since you guys have a handle on it I'll leave this hack to you all unless I think of something really cool to do with it.
I am mostly sitting on the side-lines for this latest effort with the ROMs. Helping Sevik with decoding it as much as possible, but he is much faster than me. :) We are getting close to figuring out the audio and once we do that, we should have the motions figured out too. But this is for making just a custom ROM which I am mostly not interested in doing myself as I learned my lesson from Elvis.
I am *very slowly* working on a controller for my Elmo using an ATMEGA32, which I might scale back to some smaller uC with some glue logic. I am toying with some bootloaders right now and trying to decide if I want to just have an external flash chip for memory and DA sound, or the whole SD Card/FAT/MP3 thing.
And of course, I am trying my best not to tear open my third Elmo to join Sevik in the fun he is having. My Elmo is beyond the point of simple return right now and I would have to undo much of the effort I have already put into it going in a different direction to get back to going in the direction Sevik is going. Not necessary, though; Sevik's got that covered now (and wow, within an few hours of receiving it!)
The third Elmo was going to be for my neice, but it looks like she doesn't want it. So I am going to wait to see if it becomes the next $1000 must-have toy for Christmas before I rip it open. If so, I will probably try to find her the Butterscotch robotic pony that she really wants instead (but that's 300 bones... ouch! Looks like it would be fun to hack, though, if I had $300 laying around. :)
$600, one for you, one to keep your niece happy.
In the past when working on things with my ATMega32, I found adding FAT support just ate up to much space.
FAT file read for 6502 (only FAT16, only root-directory, file-search and streaming read):
CODE Offs = 000000 Size = 000671
RODATA Offs = 000000 Size = 00008F
BSS Offs = 000000 Size = 000400
1650 bytes of code and 1024 bytes of ram (2 sector sized buffers, one for FAT buffering and can be reduced)
This was not a full FAT implementation though, right? You are just reading one file and not parsing the whole FAT table, if I remember correctly when you were telling me about it.
Probably not much more would be needed for Elmo either.