# Trying to reverse engineer a simple circuit

My only experience with electronics is a bit of playing around with an Arduino starter's kit, but nevertheless I decided to buy a cheap little remote control car and figure out how it works and see if I can connect the antenna to my Arduino and make it do stuff... but that turned out to be harder than I expected.

There's one wire connected to the antenna, then this circuit connects to the two motors, but I've been unable to figure out how the actual circuit works. I thought maybe I would learn something by connecting a wire from the antenna to my Arduino and reading the analog values, but they were all over the place so either I did that wrong or it's the wrong thing to do.

So basically, I'd appreciate any tips or hints on how I can figure out how the antenna works and how to use that.

Here's a picture of both sides of the board.

-
You are going about this the wrong way. If you want to connect the antenna to your arduino, I assume you want to remotely control the car? If so, you need to look at the remote. You can replace the manual controls on the Remote, before the transceiver. – Passerby Apr 20 '14 at 21:27
@Passerby Actually I was aiming at using the remote to make the Arduino do things which probably won't involve the car. – Tal Apr 20 '14 at 21:37
See, that's an important detail. You be far better off getting a documented rf transceiver/receiver pair in that case. – Passerby Apr 20 '14 at 21:45
@Passerby I think you're right about that one. Plus, this seems like much more serious hardware than I can handle with my little Arduino-level knowledge. – Tal Apr 20 '14 at 21:50
Once an IC is involved, a small number of pieces does not necessarily equal "a simple circuit". – keshlam Apr 21 '14 at 0:58

Your best bet is to probe the pins with an oscilloscope. If you don't have one or can't afford one then you can use a software scope connected to your sound card. It will be rubbish for reading voltage values but good enough to see digital and PWM signals.

The next best thing is google. I always google before I reverse engineer something to at least know what to look for. Just search for "remote control toy car signal" and one of the top results will lead you to this page: http://electronics.howstuffworks.com/rc-toy2.htm

Basically cheap toy cars work by sending pulses to send a command and the receiver counts the number of pulses to figure out what to do (note that this is a very different signaling scheme compared to "real" RC equipment, those found on more expensive "toys").

The pulses look something like this:

    ┌────┐    ┌────┐ ┌─┐ ┌─┐ ┌─┐ ┌─┐
│    │    │    │ │ │ │ │ │ │ │ │
────┘    └────┘    └─┘ └─┘ └─┘ └─┘ └────
long pulses           short pulses
indicates start      encode the command
of "packet"


The number of short pulses encode the command. For example, on a toy car I once hacked I found this encoding:

• 10-15 pulses = forward
• 18-24 pulses = reverse
• 26-30 pulses = forward left
• 32-38 pulses = forward right
• 40-45 pulses = reverse left
• 48-54 pulses = reverse right

Last time I used one of these to send my own data I generated the expected pulses using a microcontroller and on the receiving end have a microcontroller read the voltages of the H bridge outputs controlling the drive and steering motors. Then I invented my own coding scheme to send bytes. Something like this:

• forward (F) = start of byte
• forward left (FL) = 00
• forward right (FR) = 01
• reverse left (RL) = 10
• reverse right (RR) = 11

So to send the letter 'A', which is 0x41, I'd transmit:

F, FR, FL, FL, FR


Considering that each "packet" takes around 80ms on average to transmit and you need 5 packets per byte and to be safe and avoid glitching you should send at least 2 or 3 frames per packet, you're looking at roughly 1 second per byte. Which is 8bps. Very slow but usable.

If you don't need to send bytes then just read the motor output directly. That gives you 6 momentary signals (F,R,FL,FR,RL,RR) or 3 on/off signals (F/R, FL/FR, RL/RR).

-

The SMD chip and the other SMD components on the bottom are probably the 27 MHz radio chip. The four transistors on the top are probably two H-bridges that drive the (two?) motors.

Determine the type of the SMD chip, find the datasheet. It will probably contain an example circuit that will probably match yyour print closely (designers are lazy whenever possible).

Alternatively, determine the circuit around the 8 transistors, decouple it from the radio chip, and drive them directly from your arduino.

Forget about interfacing to the antenna directly, that is too high a frequency to generate from an arduino (or most other uC's, unless maybe they operate at exactly the required frequency).

-

That is a single sided board, so it should be fairly easy to work out a schematic for this board. You will not see the output of the antenna with an Arduino. It just isn't going to be fast enough to see the signal changes. And the power from the antenna is very low.

I would guess the chip is the receiver and logic driver. For cheap RC, this is usually around 27 MHz. If this is the only board in the car, the transistors are most likely H-bridge drivers.

Once you have generated the schematic, then you can start seeing where the signals flow. And more importantly, get an idea of where to probe and see things.

An oscilloscope is one of the best things to figure out what is going on in a circuit. Even if it is a cheap used \$50 analog scope, it can give you an idea of what a changing signal is doing.

-

The SO-16 chip is mostly likely a SMD version of the RX-2B RC car radio receiver. This is a 27 MHz receiver with 5 function outputs. Compare the pin-out to the datasheet found here. For example, pin 2 is the ground pin, while pins 4 and 5 connect through a resistor to form the local oscillator. Pin 13 is connected to VDD through the large through hole capacitor on the other side.

-