Thanks for the excellent photos.
Some chip commentary: (revised theory, looks like the "W99802" was a red herring)

On the top side of the camera/WiFi board you can see the Marvell CPU chip (marked ARM 2702M...). Looks like a Marvell "PXA270M" ARM processor (formerly 'XScale').

The ARM CPU runs the main firmware/program (including CameraTest.bin running under eCos).
It uses the open-source 'libertas' library to access the Marvell chip WiFi features. Also it includes the Marvell proprietary 'microcode' downloaded into the Marvell hardware at startup from a binary image. This part is not open source.

I didn't notice any sort of available port in those pictures. Something that might be used to connect other input or output, or perhaps a TTL level serial connection. It would seem the Rovio is closed, as far as hardware is concerned.

I guess an alternative is for a separate mobile computer to connect via the USB port, and for that computer to serve as the master. I had hoped that the Rovio could serve as the master to control some other additions such as a vacuum.

Joe Dunfee

FWIW: I finally took my Rovio apart:
I'll post a few additional photos soon, including the insides of the NorthStar module (uses an MC56F8013 and looks very cool)

> (wish tome could have cleaned the yellow dot off)
That WinBond chip is a WinBond W99100DG. Can't find specs, but it looks like the Flash ROM (with 8051 CPU?? -- not enough pins for an ARM class CPU)
So it looks like my two ARM CPU theory is incorrect.
I guess the Marvell ARM chip does all the main CPU heavy lifting.
---
> I didn't notice any sort of available port in those pictures.
There are (at least) two serial ports.
They are at the bottom of this photo: http://bgp.nu/~tom/pub/rovio/_DSC8017.jpg
They are well labelled. One goes to the NorthStar board (to underside of board here: http://bgp.nu/~tom/pub/rovio/_DSC8011.jpg)
The other goes to the main robot to the "mcu" motor controller.

I haven't found any additional serial ports (eg: for a debug terminal). Those four unsoldered holes look suspicious.
Without them you may have to piggy-back one of the existing protocols.

Thanks robosapienPet for the insite :)

with this info i found this

http://www.winbond.com.tw/winbondcms/images/news/4-2%20mcu-seminar-32mm.pdf

you are correct it is a 8051 uC (page 12, 15, 18)

it may just boot as in page 18 shows

it may use a gps engine with ecos (page 9)

so how does this twist the plot ?

Additional photos: The NorthStar module is located at the top of the robot. The circular cover over the sensor array pops out of the plastic robot cover. The module is mounted on a board which connects to the main one over serial. Here's what it looks like inside.

Top side of cover, bottom side of board (including Digital Signal Processor chip)

Top side of board with 3D pyramid shaped sensor (? and a pinhole camera in the middle ?)

Higher res versions: http://aibohack.com/rovio/ns1.jpg
http://aibohack.com/rovio/ns2.jpg

re: ethernet
I'll have to probe the 4 pins more.
Overall that jives with my suspicions. I suspect they developed it using LAN debugging (not a serial port).
The Rovio eCos image includes "BOOTP" over wlan0 and other diagnostic print features. Another place where open source would help open a tidal-wave of Rovio improvements.

This is such a great thread, I just wanted to get it back in view. MrScott (oops), think this deserves being pinned?

Along the lines of opening your Rovio, cmilian found he had to open his Rovio to fix his malfunctioning IR radar: http://www.robocommunity.com/x/comment/27508/reply_with_quote

Northstar hacking, sweet. :)

Is everybody ready for a Northstar driven Femisapien, who knows exactly where and how to dance based on what room she is in? Wait until you see her "get me a soda please" Refrigerator Mambo!

-- roschler

Robodance 5 - Rovio over Skype with Voice Control

• No more router setup hassles
• 2 way audio on any system

> ...OK, the camera board is a Koi-MP802.
Do you have photos?
That doesn't jive with what I'm seeing. The (small) camera board in mine is only the sensor ("ccs6003", 20 pin thing) connected to the main board with a ribbon cable (going into the ARM CPU).

The ARM Firmware looks like it may have been based on a "Winbond W99802" webcam. It may identify as something similar. (I originally thought they were using that particular '802' chip, but apparently it is doing all the work in the ARM 2702M CPU).

> http://www.koitech.com.tw/Images/product/module/KOI-MP802-M001_WiFi_ICE_V14_0..
> The name is located exactly where it is on the PDF. Notice the cam connector at the top.
> What say?

Much closer, thanks. Also jives with mine.
The main brain of the Rovio is on that board (I call it the main board because it is the main brain of Rovio, the camera board is dumb in comparison).

It is controlled by an 8051 based microcontroller on the other side (WinBond W99100DG).
Specs for the ARM CPU chip are hard to find. The chip is marked "ARM 2702M", that adds to the confusion. It could be rebranded in many different ways. I suspect most end in "802".

I just decompiled the activex plugin that zaps when in IE. It is a C library that basically interfaces with a WinBond WebCam. If anyone has a WinBond SDK laying around... I really could use it right now ...

(I'm a software hack for the most part... problem is I have no Winbond SDK to go off of... reverse engineering is taking forever.)

I am aiming to fix the audio stream into a java library that works in all browsers, or an actual C app to run off PC's (whichever is easiest once I get the API reference manual for the Winbond Camera).

So what I got so far is that the WinBond Camera delivers an audio stream in ASF format (standard). The only problem is that the port for the streaming is statically set inside the assembly (this sucks). If we could read the stream inside a java library we can get rid of that nasty static tcp port reference.