2
\$\begingroup\$

I bought a $10 RC car, and I am trying to replace the remote control with an arduino. I have puzzled out what most of the components on the circuit board are, but one of them has me baffled. In the center of the board is what I thought was a Dual H Bridge motor driver. It is apparently taking some sort of AC input signal from the RC antenna, and I cannot make head or tail of it. What is this thing? Do I have any hope of hijacking its inputs with an arduino? enter image description here


My electronics knowledge is self taught, and quite spotty. It is entirely possible that I have misidentified something fairly basic. I will try to give enough detail so that more experienced people can spot my mistakes. I am sure that most of these details are mostly irrelevant to my question.


Basic function of RC Car The rear wheels are powered by a single motor. The front wheels have a motor for steering. Both motors have forward, reverse, and off, with no speed control. This is consistent with a Dual H Bridge motor controller.


Description of Circuit Board The battery power comes in at the top of the image, runs through a switch which sits below the circuit board, and flows from there to the various circuits. There are three AA Batteries, supplying roughly 4.5V. The negative battery terminal is at the bottom of the board. The antenna connects in the top left corner. It immediately runs through an inductor and a coil of wire wrapped around a solid waxy substance (another inductor?). Both of these are attached below the board. They are marked on the picture as "Connected by inductor." From there, the antenna signal runs through a tangle of circuitry, that I have labeled the "antenna signal magic." I cannot identify the components in this area. There are a few types, all either black boxes with numbers written on them, or blank brown boxes. I know next to nothing about AC signals.

The antenna magic zone connects to a black box with 8 pins per side. I believe this box is some sort of Dual H Bridge motor controller. 8 of the 16 pins can be traced to motors, power, or ground. The other 8 connect to the antenna zone.


Input signals to Black Controller

I used my multimeter, and measured the DC and AC voltages between the antenna pins and ground, and then measured again with the rear wheel drive motor on. All of the antenna pins have a DC voltage between 1.3 and 1.4 volts. For 7 of the 8 pins this voltage does not change when the drive motor is engaged; for the fifth pin from the left it drops to 1.1V. The third and fourth pin from the left have an AC voltage of 1V when the drive motor is off. That voltage jumps to 1.5V when the drive motor is turned on. I assume this is the input signal.

I am not sure what exactly an AC voltage reading means. I do not have an oscilloscope to measure its frequency, or phase shift. The car's package said it uses a 24 MHz signal. Does this mean that the AC voltage my multimeter is reading is at 24 MHz? I didn't think my multimeter would even read a signal with a frequency that high.


Writing on Chip The controller has DK2991 BG0603 written on it. Googling this did not turn anything useful up.


Summary I have a tiny chip thing that I think is a Dual H Bridge motor controller that works off of AC input signals. What are these input signals? Is it possible to use an arduino to replicate them?

I do not have fancy equipment on hand, but I am more than willing to run more further tests.

\$\endgroup\$
  • \$\begingroup\$ Essentially you are asking how to reverse engineer a proprietary Chinese product, all without "fancy equipment". The RC communication is likely with some FSK or amplitude-modulated RF (24 MHz/27 MHz or higher) signal, with some serial protocol for commands. I would say that it is really difficult without any background in RC industry. You should start reading RC user groups, maybe you will find there similar projects. \$\endgroup\$ – Ale..chenski Jul 9 '17 at 19:22
  • 1
    \$\begingroup\$ Rip out the existing board, get yourself a Nano and rework it to bypass the regulator, and a TB6612FNG H-bridge on a carrier. If you want remote, wire in one of the nRF24L01+ modules. \$\endgroup\$ – Chris Stratton Sep 23 '17 at 18:53
  • \$\begingroup\$ All in one RC chip. Just like you can get an entire super nintendo on a chip at this point. \$\endgroup\$ – Passerby Sep 23 '17 at 18:55
  • \$\begingroup\$ @ChrisStratton Can you recommend the TB6612FNG? Does it need heatsinking at ~1A? \$\endgroup\$ – user2497 Oct 17 '17 at 2:44
3
\$\begingroup\$

Hi I had a go at figuring out this chip today and here is what i got. I monitored the signal going into the chip from the rf side and recreated the same signals on my arduino and it actually works. ;). Here is where to hook up the arduino to the rc board.


Arduino hook up to DK2991 board


And here is the arduino sketch:

void setup() {
  pinMode(8, OUTPUT); // Output to r6 on rc car
}


void loop() {
  rcLeft(5);
  rcRight(5);
  rcFWD(20);      //Send forward signal 20 times;
  rcFWDLeft(20);  // forward left 20 times and so on.
  rcFWDRight(20);
  rcREV(20);
  rcREVLeft(20);
  rcREVRight(20);
  rcLeft(2);
  rcRight(2);
  rcLeft(2);
  rcRight(2);
  delay(500);
}

void rcRight (int loops) {
  for (int f = 0; f < loops; f++) { //left
    for (int i = 0; i < 58; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(640);
      digitalWrite(8, LOW);
      delayMicroseconds(750);
    }
    for (int i = 0; i < 4; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(2000);
      digitalWrite(8, LOW);
      delayMicroseconds(740);
    }
  }
}

void rcLeft (int loops) {
  for (int f = 0; f < loops; f++) { //left
    for (int i = 0; i < 64; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(640);
      digitalWrite(8, LOW);
      delayMicroseconds(750);
    }
    for (int i = 0; i < 4; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(2000);
      digitalWrite(8, LOW);
      delayMicroseconds(740);
    }
  }
}

void rcFWD (int loops) {
  for (int f = 0; f < loops; f++) { //forward
    for (int i = 0; i < 10; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(640);
      digitalWrite(8, LOW);
      delayMicroseconds(750);
    }
    for (int i = 0; i < 4; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(2000);
      digitalWrite(8, LOW);
      delayMicroseconds(740);
    }
  }
}

void rcREV (int loops) {
  for (int f = 0; f < loops; f++) { //Reverse
    for (int i = 0; i < 40; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(640);
      digitalWrite(8, LOW);
      delayMicroseconds(750);
    }
    for (int i = 0; i < 4; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(2000);
      digitalWrite(8, LOW);
      delayMicroseconds(740);
    }
  }
}

void rcFWDRight (int loops) {
  for (int f = 0; f < loops; f++) { //FR
    for (int i = 0; i < 28; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(640);
      digitalWrite(8, LOW);
      delayMicroseconds(750);
    }
    for (int i = 0; i < 4; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(2000);
      digitalWrite(8, LOW);
      delayMicroseconds(740);
    }
  }
}

void rcFWDLeft (int loops) {
  for (int f = 0; f < loops; f++) { //FL
    for (int i = 0; i < 34; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(640);
      digitalWrite(8, LOW);
      delayMicroseconds(750);
    }
    for (int i = 0; i < 4; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(2000);
      digitalWrite(8, LOW);
      delayMicroseconds(740);
    }
  }
}

void rcREVRight (int loops) {
  for (int f = 0; f < loops; f++) { //RR
    for (int i = 0; i < 52; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(640);
      digitalWrite(8, LOW);
      delayMicroseconds(750);
    }
    for (int i = 0; i < 4; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(2000);
      digitalWrite(8, LOW);
      delayMicroseconds(740);
    }
  }
}

void rcREVLeft (int loops) {
  for (int f = 0; f < loops; f++) { //RL
    for (int i = 0; i < 46; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(640);
      digitalWrite(8, LOW);
      delayMicroseconds(750);
    }
    for (int i = 0; i < 4; i++) {
      digitalWrite(8, HIGH);
      delayMicroseconds(2000);
      digitalWrite(8, LOW);
      delayMicroseconds(740);
    }
  }
}

I had fun figuring this out and I hope it helps someone. Have fun with your arduino car.

\$\endgroup\$
  • \$\begingroup\$ You bought the same board I did? This was on a RC car I bought from Walmart. \$\endgroup\$ – BobTheAverage Apr 29 '18 at 16:17
  • \$\begingroup\$ Yeah it looks identical to your board. Mine is a rc truck my son got a while back probably from Walmart, but im sure they use the same circuit in many cheap rc cars. \$\endgroup\$ – Brad Wedlock Apr 29 '18 at 18:27
4
\$\begingroup\$

The chip you are looking at is not just a H-bridge, it is also a RF (24 Mhz) receiver, command decoder, and motor control. The RF control can be anything, FM or AM modulation, and if you have a working remote, you should be able to capture the commands it is sending. Unfortunately it will take a "fancy equipment" to capture and decode, and it can't be done with "wet finger" such as a multi-meter.

It will be cheaper just to replace the entire toy electronics with known H-bridge (or just with a standard motor controller shield) if you want to control the toy with Arduino.

\$\endgroup\$
1
\$\begingroup\$

This is the 2016 version of New Bright's $10 RC board. Not hacker-friendly like the 2015 version, which has discrete H-bridges. See my hack here: https://www.youtube.com/watch?v=w3ehfTnHnOw

\$\endgroup\$
  • \$\begingroup\$ +1 That's really interesting. This site generally prefers responses that stand on their own - would be great if you could edit in a few more details, for example identification of the bridge chips used on that version and the pin numbers that are their inputs which you cut and substituted. I think I have one of these somewhere that was VHF, and also several of a 2.4 GHz version that seems to use one radio/logic IC and a dual H-bridge IC. But often one wants to change the battery too, so I've tended to substitute a known bridge rather than guess what the stock one can do. \$\endgroup\$ – Chris Stratton Oct 16 '17 at 21:20
  • \$\begingroup\$ @Eric take a few screenshots and throw them in the answer \$\endgroup\$ – Voltage Spike Oct 16 '17 at 21:22
1
\$\begingroup\$

There is an easier way. You don't need to reverse engineer the Chinese chip (I couldn't find any info either). Just use the Arduino to take over the remote. The remote has four push buttons that are low current digital logics to send the commands to the motor. Just wire the digital outs from the Arduino into the switch output. The board is small enough you can just attach it over the board in the car. Not super power efficient, and you don't learn what the guts of the electronics are doing but super easy! Building one tomorrow with my son..

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.