Does anybody know of any modifications that can be done to the x10
ninja pan&tilt base?  I need to be able to control it with a hardwire
because the remote control only works to 20 feet.

Dennis.

Dennis Hawkins
n4mwd AT amsat DOT org (humans know what to do)

"A RECESSION is when you know somebody who is out of work.  
 A DEPRESSION is when YOU are out of work.  
 A RECOVERY is when all the H-1B's are out of work."
To find out what an H-1B is and how they are putting 
Americans out of work, visit the following web site 
and click on the "Exporting America" CNN news video: 
http://zazona.com/ShameH1B/MediaClips.htm  

Might be easier to hack the remote by wiring to the button contacts and
then mounting the remote within range of the camera. Just an alternative
to hacking the actual camera.

n4mwd.dont.spam.me@amsat.org wrote:
> Does anybody know of any modifications that can be done to the x10
> ninja pan&tilt base?  I need to be able to control it with a hardwire
> because the remote control only works to 20 feet.
>
> Dennis.
>
> Dennis Hawkins
> n4mwd AT amsat DOT org (humans know what to do)
>
> "A RECESSION is when you know somebody who is out of work.
>  A DEPRESSION is when YOU are out of work.
>  A RECOVERY is when all the H-1B's are out of work."
> To find out what an H-1B is and how they are putting
> Americans out of work, visit the following web site
> and click on the "Exporting America" CNN news video:
> http://zazona.com/ShameH1B/MediaClips.htm

That is going to be a last resort.  I would prefer to hack directly
into the base itself so I can lose the unreliable RF link altogether.


I basically need some equipment that I don't have.  I need a memory
scope or a signal sampling card of some kind.  I would need this to
find out what kind of signals are being sent to the motor controller.

It looks like both the controller base and remote are powered by PIC
processors.  I don't know if it would be possible to read out the
program and disassemble it to see how they do things.  Some processors
lock the program inside so it might not be possible.

It really blows me away that a company called "X10" would produce an
alledged x10 pan&tilt base that isn't x10 compatable depsite having an
x10 transformer with house and unit code dials.  Then, despite being
totally open with their x10 protocols, refuse to divulge sufficient
information to make their product work properly.

Dennis.

"BruceR" <bruceNO@SPAMwhoever.com> wrote:

> Might be easier to hack the remote by wiring to the button contacts and
> then mounting the remote within range of the camera. Just an alternative
> to hacking the actual camera.

Dennis Hawkins
n4mwd AT amsat DOT org (humans know what to do)

"A RECESSION is when you know somebody who is out of work.  
 A DEPRESSION is when YOU are out of work.  
 A RECOVERY is when all the H-1B's are out of work."
To find out what an H-1B is and how they are putting 
Americans out of work, visit the following web site 
and click on the "Exporting America" CNN news video: 
http://zazona.com/ShameH1B/MediaClips.htm  

On Fri, 10 Oct 2003 06:36:03 GMT, n4mwd.dont.spam.me@amsat.org
wrote:
>
>That is going to be a last resort.  I would prefer to hack directly
>into the base itself so I can lose the unreliable RF link altogether.

>I basically need some equipment that I don't have.  I need a memory
>scope or a signal sampling card of some kind.  I would need this to
>find out what kind of signals are being sent to the motor controller.
>
>It looks like both the controller base and remote are powered by PIC
>processors.  I don't know if it would be possible to read out the
>program and disassemble it to see how they do things.  Some processors
>lock the program inside so it might not be possible.
>
>It really blows me away that a company called "X10" would produce an
>alledged x10 pan&tilt base that isn't x10 compatable depsite having an
>x10 transformer with house and unit code dials.  Then, despite being
>totally open with their x10 protocols, refuse to divulge sufficient
>information to make their product work properly.
>
>Dennis.

X10 may have licensed the software/protocol/chips from another
party and can't release the info you seek (I've seen this with
other products). It would be easier to get a servo controller (or
program your own pic) and make your own pan/tilt cam base out of
servos. At the below link is a simple home made pan/tilt cam
using servos.

http://www.geocities.com/zoomkat/ppswitcher-demo.htm

That is probably the best idea.  I am pretty sure that what is inside
is a PIC although it didn't have a regular PIC part number on it.  If
it is a PIC, then it may be an ASIC given the number of X10's they
probably sell.

It looks like the next step is for me to figure out the schematic and
publish it on the web somewhere.  Once  that is done, it shouldn't be
a problem to program a new PIC with serial input control.

If you know of a good website that will put up the schematic once I
get it figured out, let me know.

Thanks,

Dennis Hawkins


shb*NO*SPAM*@comporium.net (Si Ballenger) wrote:

> other products). It would be easier to get a servo controller (or
> program your own pic) and make your own pan/tilt cam base out of
> servos. At the below link is a simple home made pan/tilt cam
> using servos.
> 
> http://www.geocities.com/zoomkat/ppswitcher-demo.htm
> 

Dennis Hawkins
n4mwd AT amsat DOT org (humans know what to do)

"A RECESSION is when you know somebody who is out of work.  
 A DEPRESSION is when YOU are out of work.  
 A RECOVERY is when all the H-1B's are out of work."
To find out what an H-1B is and how they are putting 
Americans out of work, visit the following web site 
and click on the "Exporting America" CNN news video: 
http://zazona.com/ShameH1B/MediaClips.htm  

On Sat, 11 Oct 2003 12:40:56 GMT, n4mwd.dont.spam.me@amsat.org
wrote:

>
>That is probably the best idea.  I am pretty sure that what is inside
>is a PIC although it didn't have a regular PIC part number on it.  If
>it is a PIC, then it may be an ASIC given the number of X10's they
>probably sell.
>
>It looks like the next step is for me to figure out the schematic and
>publish it on the web somewhere.  Once  that is done, it shouldn't be
>a problem to program a new PIC with serial input control.
>
>If you know of a good website that will put up the schematic once I
>get it figured out, let me know.
>
>Thanks,
>
>Dennis Hawkins

Geocities has free web pages, and google will pick them up and
put them in the google search data base. If the ninja works in
the 400mhz range, then the serial baud rate might be in the
2400bps range. There are probably a couple of ways to tap off the
output of the receiver in the ninja and see the digital output.
You may also want to look inside the unit to see if you see a
receiver board that is similar to the below laipac ones.

http://www.laipac.com/ask-fsk-rf-modules.htm
 

I was hoping to have someone who already has an X10 or other page host
it for me.  I could get a free site, but then I would have to maintain
it.

The little receiver board is not very sophisticated - assuming its
really the receiver.  Its the only thing in the whole unit that has RF
coils.  Specifcally, it has 3 coils, 3 resistors, one diode, one cap
and one LM358 chip.  It also has one gray antenna wire that wraps
around the inside of the unit and three wires (black, white, and
yellow) that connect to the main board.  The receiver circuit is
probably a little direct conversion receiver.  The LM358 is just a
little OP amp circuit that probably simply amplifies the CW carrier
creating a bit stream.  I doubt that it is an FSK reciever.  It
measures about 1.25" x 0.75".  On the back side of the board are
numerous surface mount transistors, resistors and caps.

The main board has a 7805 5V voltage regulator which appears to supply
the digital components with regulated 5V power.  There is an Atmel
24C02 which is an I2C flash memory device which is probably used to
store the 4 preset positions.  The only other chip is an 18 pin DIP
chip with a sticker on it that reads "P10703K".  Under the sticker,
the chip is marked "H10219" on the top line and "0251W  BP2CH3" on the
bottom.  I suspect that this chip is a PIC but I haven't been able to
identify it yet.  There are only a handful of surface mount components
on the bottom side.

The main board and the receiver board are both single sided boards.
The yellow wire from the reciever board leads directly to the cpu
chip.  The black and white wires go over near the 7805 voltage
regulator.  There are several transistors spread all over the main
board.  The largest concentration seems to be around the two areas
where the stepper motor wires leave the board.  These wires are little
5 wire ribbon cables.

The main board itself is labeled "H10892E" and the receiver board is
labeled "H10766A".  These appear like the same configuration as the
cpu number.  The cpu is probably a factory ROM burned PIC.  I doubt
that it is an ASIC because they would have put the whole main board in
it if it were.

As soon as I have time, I'll try to dissect it further and get a
schematic.  Once I have that, it should be a snap to program a new PIC
with something standard.

Dennis.





shb*NO*SPAM*@comporium.net (Si Ballenger) wrote:

> Geocities has free web pages, and google will pick them up and
> put them in the google search data base. If the ninja works in
> the 400mhz range, then the serial baud rate might be in the
> 2400bps range. There are probably a couple of ways to tap off the
> output of the receiver in the ninja and see the digital output.
> You may also want to look inside the unit to see if you see a
> receiver board that is similar to the below laipac ones.
> 
> http://www.laipac.com/ask-fsk-rf-modules.htm
>  

Dennis Hawkins
n4mwd AT amsat DOT org (humans know what to do)

"A RECESSION is when you know somebody who is out of work.  
 A DEPRESSION is when YOU are out of work.  
 A RECOVERY is when all the H-1B's are out of work."
To find out what an H-1B is and how they are putting 
Americans out of work, visit the following web site 
and click on the "Exporting America" CNN news video: 
http://zazona.com/ShameH1B/MediaClips.htm  

Just a little update on the Ninja dissection.

I looked a little closer at the cpu chip.  The two OSC inputs and the
power supplies indicate strongly that this is a PIC16C56 cpu chip.
The wire from the wire from the reciever is connected to the RTCC
input pin #3.  On the bottom is a 3 pin SMT cpu supervisory chip
feeding pin #4 - the MCLR/ master reset input.

Since the RTCC is the Real Time Clock Counter input, I strongly
suspect that it is being used as a little frequency counter.  As such,
I believe I can conclude that the signals input from the receiver
board are not digital, but rather low frequency tones.  There is most
likely a tone for each key on the keypad (14 on mine).  The extra 4
tones are for progamming the position buttons.  The memory is in the
24C02 chip in the base and not in the remote.

Now, I just need to figure out a way to figure out what frequency
those tones are.  The tone approach would explain why the unit won't
work with x10 codes.

Dennis.


n4mwd.dont.spam.me@amsat.org wrote:

> 
> I was hoping to have someone who already has an X10 or other page host
> it for me.  I could get a free site, but then I would have to maintain
> it.
> 
> The little receiver board is not very sophisticated - assuming its
> really the receiver.  Its the only thing in the whole unit that has RF
> coils.  Specifcally, it has 3 coils, 3 resistors, one diode, one cap
> and one LM358 chip.  It also has one gray antenna wire that wraps
> around the inside of the unit and three wires (black, white, and
> yellow) that connect to the main board.  The receiver circuit is
> probably a little direct conversion receiver.  The LM358 is just a
> little OP amp circuit that probably simply amplifies the CW carrier
> creating a bit stream.  I doubt that it is an FSK reciever.  It
> measures about 1.25" x 0.75".  On the back side of the board are
> numerous surface mount transistors, resistors and caps.
> 
> The main board has a 7805 5V voltage regulator which appears to supply
> the digital components with regulated 5V power.  There is an Atmel
> 24C02 which is an I2C flash memory device which is probably used to
> store the 4 preset positions.  The only other chip is an 18 pin DIP
> chip with a sticker on it that reads "P10703K".  Under the sticker,
> the chip is marked "H10219" on the top line and "0251W  BP2CH3" on the
> bottom.  I suspect that this chip is a PIC but I haven't been able to
> identify it yet.  There are only a handful of surface mount components
> on the bottom side.
> 
> The main board and the receiver board are both single sided boards.
> The yellow wire from the reciever board leads directly to the cpu
> chip.  The black and white wires go over near the 7805 voltage
> regulator.  There are several transistors spread all over the main
> board.  The largest concentration seems to be around the two areas
> where the stepper motor wires leave the board.  These wires are little
> 5 wire ribbon cables.
> 
> The main board itself is labeled "H10892E" and the receiver board is
> labeled "H10766A".  These appear like the same configuration as the
> cpu number.  The cpu is probably a factory ROM burned PIC.  I doubt
> that it is an ASIC because they would have put the whole main board in
> it if it were.
> 
> As soon as I have time, I'll try to dissect it further and get a
> schematic.  Once I have that, it should be a snap to program a new PIC
> with something standard.
> 
> Dennis.

Dennis Hawkins
n4mwd AT amsat DOT org (humans know what to do)

"A RECESSION is when you know somebody who is out of work.  
 A DEPRESSION is when YOU are out of work.  
 A RECOVERY is when all the H-1B's are out of work."
To find out what an H-1B is and how they are putting 
Americans out of work, visit the following web site 
and click on the "Exporting America" CNN news video: 
http://zazona.com/ShameH1B/MediaClips.htm  

On Sat, 11 Oct 2003 23:33:20 GMT, n4mwd.dont.spam.me@amsat.org
wrote:

>
>Just a little update on the Ninja dissection.
>
>I looked a little closer at the cpu chip.  The two OSC inputs and the
>power supplies indicate strongly that this is a PIC16C56 cpu chip.
>The wire from the wire from the reciever is connected to the RTCC
>input pin #3.  On the bottom is a 3 pin SMT cpu supervisory chip
>feeding pin #4 - the MCLR/ master reset input.
>
>Since the RTCC is the Real Time Clock Counter input, I strongly
>suspect that it is being used as a little frequency counter.  As such,
>I believe I can conclude that the signals input from the receiver
>board are not digital, but rather low frequency tones.  There is most
>likely a tone for each key on the keypad (14 on mine).  The extra 4
>tones are for progamming the position buttons.  The memory is in the
>24C02 chip in the base and not in the remote.
>
>Now, I just need to figure out a way to figure out what frequency
>those tones are.  The tone approach would explain why the unit won't
>work with x10 codes.
>
>Dennis.

If it looks like just tones are being sent,, then maybe you could
just run a jumper from the receiver signal out and receiver
ground to the line in on your sound card and see if you can hear
anything (assuming they are in an audiable range). If DTMF tones
were being used, then things would be fairly simple. If you
connect the receiver to your sound card input, you can record the
tones using the windows sndrec32.exe to a wave file, then play
the wave file back to the input of the tone detection section to
see if you get movement. There are one or more free sound card
based o-scope programs available on the net that might be of
interest in determining the tone frequencys. It could also be a
single tone being modulated in an on/off manor that is being sent
to the counter, which would be back into a digital type
arrangement.  I find it interesting to hear that the unit uses
stepper motors. Preset positions would probably require some
memory, and I would think the pan/tilt unit would have to do a
little position calibration routine each time it was powered up
so it could know where the motors are positioned. Interesting
project.

>n4mwd.dont.spam.me@amsat.org wrote:
>
>> 
>> I was hoping to have someone who already has an X10 or other page host
>> it for me.  I could get a free site, but then I would have to maintain
>> it.
>> 
>> The little receiver board is not very sophisticated - assuming its
>> really the receiver.  Its the only thing in the whole unit that has RF
>> coils.  Specifcally, it has 3 coils, 3 resistors, one diode, one cap
>> and one LM358 chip.  It also has one gray antenna wire that wraps
>> around the inside of the unit and three wires (black, white, and
>> yellow) that connect to the main board.  The receiver circuit is
>> probably a little direct conversion receiver.  The LM358 is just a
>> little OP amp circuit that probably simply amplifies the CW carrier
>> creating a bit stream.  I doubt that it is an FSK reciever.  It
>> measures about 1.25" x 0.75".  On the back side of the board are
>> numerous surface mount transistors, resistors and caps.
>> 
>> The main board has a 7805 5V voltage regulator which appears to supply
>> the digital components with regulated 5V power.  There is an Atmel
>> 24C02 which is an I2C flash memory device which is probably used to
>> store the 4 preset positions.  The only other chip is an 18 pin DIP
>> chip with a sticker on it that reads "P10703K".  Under the sticker,
>> the chip is marked "H10219" on the top line and "0251W  BP2CH3" on the
>> bottom.  I suspect that this chip is a PIC but I haven't been able to
>> identify it yet.  There are only a handful of surface mount components
>> on the bottom side.
>> 
>> The main board and the receiver board are both single sided boards.
>> The yellow wire from the reciever board leads directly to the cpu
>> chip.  The black and white wires go over near the 7805 voltage
>> regulator.  There are several transistors spread all over the main
>> board.  The largest concentration seems to be around the two areas
>> where the stepper motor wires leave the board.  These wires are little
>> 5 wire ribbon cables.
>> 
>> The main board itself is labeled "H10892E" and the receiver board is
>> labeled "H10766A".  These appear like the same configuration as the
>> cpu number.  The cpu is probably a factory ROM burned PIC.  I doubt
>> that it is an ASIC because they would have put the whole main board in
>> it if it were.
>> 
>> As soon as I have time, I'll try to dissect it further and get a
>> schematic.  Once I have that, it should be a snap to program a new PIC
>> with something standard.
>> 
>> Dennis.
>
>Dennis Hawkins
>n4mwd AT amsat DOT org (humans know what to do)
>
>"A RECESSION is when you know somebody who is out of work.  
> A DEPRESSION is when YOU are out of work.  
> A RECOVERY is when all the H-1B's are out of work."
>To find out what an H-1B is and how they are putting 
>Americans out of work, visit the following web site 
>and click on the "Exporting America" CNN news video: 
>http://zazona.com/ShameH1B/MediaClips.htm  
>

It appears as though I have been tricked!  It is not tones after all.
I finally hooked up a small earphone to the output of the receiver
board and it is most certainly not distinct tones.  Its digital.
Apparently, the remote transmits a continuous sequence of serial bytes
for as long as the button is pressed.

I am going to try the sound card thing anyway.  Sampling at a high
rate ought to get me something that I can determine what the binary
format is.

Yes, as soon as you power up the base, its starts moving around
looking for the two center positions.  It has two photosensors that it
uses to determine this.

Dennis.



shb*NO*SPAM*@comporium.net (Si Ballenger) wrote:

> If it looks like just tones are being sent,, then maybe you could
> just run a jumper from the receiver signal out and receiver
> ground to the line in on your sound card and see if you can hear
> anything (assuming they are in an audiable range). If DTMF tones
> were being used, then things would be fairly simple. If you
> connect the receiver to your sound card input, you can record the
> tones using the windows sndrec32.exe to a wave file, then play
> the wave file back to the input of the tone detection section to
> see if you get movement. There are one or more free sound card
> based o-scope programs available on the net that might be of
> interest in determining the tone frequencys. It could also be a
> single tone being modulated in an on/off manor that is being sent
> to the counter, which would be back into a digital type
> arrangement.  I find it interesting to hear that the unit uses
> stepper motors. Preset positions would probably require some
> memory, and I would think the pan/tilt unit would have to do a
> little position calibration routine each time it was powered up
> so it could know where the motors are positioned. Interesting
> project.

Dennis Hawkins
n4mwd AT amsat DOT org (humans know what to do)

"A RECESSION is when you know somebody who is out of work.  
 A DEPRESSION is when YOU are out of work.  
 A RECOVERY is when all the H-1B's are out of work."
To find out what an H-1B is and how they are putting 
Americans out of work, visit the following web site 
and click on the "Exporting America" CNN news video: 
http://zazona.com/ShameH1B/MediaClips.htm