Hacking an Old School Toy Car Remote Control

I discovered this old Radio Shack remote control lying around that had the antenna missing but otherwise seemed to be ok. This remote control was popular after it came out in 1987 and was sold throughout the 90's. The manufacturer was Taiyo who also made the specialized chips that are in the transmitter and receiver. As I had no toy cars to test it with, I needed to resort to using test equipment to test the device. I eventually hope to make some use of the device to control something. I first needed to hack the device and figure out how it works before I could hope to design a receiver for it.

Step 1: Take Unit Apart and Examine Board

The first picture is of the board that is in my device. It is a fairly simple circuit designed around a Taiyo 7801 IC chip which I can't find any information on. There are 18 external components less the IC chip and switches. There is an external crystal that sets the first carrier oscillator at 48.860 MHz. There are two external inductors that probably have something to do with the 141 kHz oscillator and with the rest of the components set frequency and duty cycle of the multivibrators in the chip that turn on and off the carrier and vary the pulse width. The LED is to signal when the device is on.

Step 2: Start Analyzing the Spectrum

These are two screen shots of spectrum analyzer displays. The first one is showing the transmitter at rest with the controls in the "neutral" position. The 49 MHz signal is shown on the extreme right as an uneven spike which is just before the 50 MHz mark. All the other spikes along the spectral display show harmonics in the main signal. The second display shows the same display once the forward control is activated. The green areas at either end of the spectrum show how energy that has been added to the main signal in the form of modulation. The green area on the extreme left shows the original modulating signal (which happens to be 141 KHz) and the green area on the extreme right of the display show the main 49 MHz signal being modulated by the 141 KHz signal.

Step 3: Analyzing Modulation Signal in Forward Mode

The first two frames show the off state and on state of the signal in the frequency domain (on a spectrum analyzer). The third frame shows the output signal in the time domain (oscilloscope display) for the forward signal. 50 percent duty cycle at a frequency of 718 Hz.

Step 4: Analyzing Signal in Reverse Mode

The first spectrum again shows the 0 to 250 KHz portion of the spectrum with the transmitter in the neutral position. The second one shows the control sending out the signal for the car to go in the reverse direction. The third frame shows the actual waveform again at 50 percent duty cycle but at a frequency of 291 Hz.

Step 5: Waveforms of the Device Going Forward and Turning

In order for the toy car to be able to turn right or left, there is another motor that steers the front wheels of the car. In order to achieve this, another form of modulation is applied called PWM or Pulse Width Modulation. The first waveform shows the signal to tell the car to go straight ahead at 50 percent duty cycle. The second waveform at 10 percent duty cycle is what it looks like when the car is to turn full right and the third waveform is telling the car to turn full left with a 90 percent duty cycle.

Step 6: Waveforms of the Device in Reverse Mode and Turning

As in the previous page, the same steering scheme is used here when reversing. The main difference is that in the reverse mode, the smaller duty cycle tells the motor to go in the other direction.

Step 7: Designing a Receiving Device

To design a receiving device to make use of these signals, the easiest method would be to get hold of the decoding chip that came in the original remote control cars. If these are not available considering this device was designed 30 or more years ago, a decoder will need to be designed from scratch using discrete parts. A fixed frequency 50 MHz receiver, would need to be designed. The two tones would then need to be filtered out and the tone would need to be turned into a dc level and then applied to a comparator, the output of the comparator could be then applied to an H-bridge to drive the forward/reverse motor in the right direction. The duty cycle of the filtered waveforms would need further processing to turn them into proportional voltages and after suitable amplification could be applied to another H-bridge for the steering motor. In a future instructable, I am going to attempt to design and build a receiver/decoder that works with this device.

Comments

[LucianoS51]

Ok buddy I took a look at the datasheet you sent me. But unfortunately it does not correspond to the same IC. I would like to know if you sell me this control because I need the Ci that is in it for a project. If so, how much do you sell and how could we do this transaction?

[Franks Instructables]

Luciano
I don't want to sell the control but I will see about designing a control with other parts that are easy to get and make it into an Instructable.
Regards
Frank

[LucianoS51]

Hello Friend. I have a control with this TAIYO 7801 CI and have already searched a data sheet with the characteristics and working voltages of his pins but I have not found anything. Do you know his characteristics to inform me?

[Franks Instructables]

That data sheet is the closest I could find to that generation of remote control IC's. I want to keep the controller but by using the datasheet I sent you, you could order the sending and receiving chips and build your own transmitter and receiver. You could even build a transmitter with discrete components. All you would need is a couple of transistors to build a 27 or 49 MHz oscillator with a buffer on the output, a couple of 555 timer chips to make the 2 variable duty square wave outputs and an amplitude modulator to turn on and off the oscillator output followed by a transistor to strengthen and buffer the output before signal is coupled to a small antenna.

[Franks Instructables]

This should give you the information you need.

[LucianoS51]

Ok buddy I took a look at the datasheet you sent me. But unfortunately it does not correspond to the same IC. I would like to know if you sell me this control because I need the Ci that is in it for a project. If so, how much do you sell and how could we do this transaction? If you do not want to sell this control, you may have another device with the same CI that you can sell.

[LucianoS51]

Ok buddy I took a look at the datasheet you sent me. But unfortunately it does not correspond to the same IC. I would like to know if you sell me this control because I need the Ci that is in it for a project. If so, how much do you sell and how could we do this transaction?

[DanielM1080]

Hello, I have the same controller. I am troubleshooting, but cannot test as you do, but I do have the vehicle, it used to run fine, all PCB connections are fine, motors, potentiometer, batteries, all fine. I suspect the transmitter Could you please point out where the crystal is located? Best regards!!

[Franks Instructables]

I don't have the original unit I took pictures of handy, but looking at the picture of the circuit board on the first page of the Instructable, I believe the component at the bottom of the switch is the crystal. It kind of looks like a ceramic capacitor, usually designated with an "X" or "Cr" If you don't have access to a scope or spectrum analyzer you can make a simple RF probe for your meter so you can see if you have an output signal. Here are some good examples: http://n5ese.com/rfprobe1.htm

[DanielM1080]

Thanks Frank!! I also realized the transformer on mine is broke, tried to replace with a different one but still no comm. I have another remote with same frequency but the truck just goes ffw with it. You wouldn't still have this transmitter? I would love to buy it from you if you were ever willing. Best regards, Daniel

[-Skar-]

Nice Project and well explained. I like the oscilloscope graphics. But be aware of the units ;) mHz would be Millihertz however the signal is modulated in Megahertz (MHz). :)

[Franks Instructables]

Thank You for bringing that to my attention, I was bleary eyed when I did the writeup.

[Gelfling6]

One of the easiest RC transmitter/receivers was the original VEX Robotics pair, since the output of the receiver was a TTL serial-stream output, and each channel was a block signal within the stream. (the Servo/Motor signals were in the form of 0 to 255 mS width, and the push-buttons were either solid 127mS (no button) 1 (High button) or 255 (low button)

http://www.vexrobotics.com/media/catalog/product/cache/1/image/9df78eab33525d08d6e5fb8d27136e95/t/r/transmitter-receiver-kit_1_2.jpg

[Franks Instructables]

Interesting, I'll check it out.

[gm280]

If you like reverse engineering such things, go for it. But you have to know a typical setup with both transmitter and receiver are very cheap to buy.