Preparing for LayerOne 2012 at Null Space Labs  our awesome hacker conference in Anaheim, CA on 5/26/2012!

This year for our electronic badges we wanted something that people could maybe get some more interaction out of than is usual. So I figured lets make the badges into RC cars. The idea being the badge itself was the chassis for the car.

First off I thought buy some wheels, motors, gears from some hobby/robot store and use those to build up the cars, well that didn’t go well unless our budget was $100’s per car, its crazy how much people charge for the little wheels and motors kits.

We looked at the usual Tamiya kits which aren’t terribly priced, strangely even though Tamiya is about 10 miles from us, it was cheaper to buy them from abroad and ship back, but still very costly. Also I wanted tanks, but sadly no.

These are about $18 ish, it varies. It does have more parts though but the gearbox though a sheer master of Japanese ingenuity and design, won’t work for us.

Next was the usual hobby and robotic online stores, waaaaaaaaaaay more expensive, motors alone were crazy priced, especially the geared ones. So plan C, China.. Remember we need motors, mounting hardware, hearing, wheels, axels, steering mechanism, remote control parts.

I live on the edge of the Toy District in Downtown Los Angeles, so I wandered around and looked through the various stores for suitable donors.

We pulled apart a bunch of these figuring we could just take all the motors and wheels off and re-use them, and we could at a massive saving the FX Race car I picked up for $3.50

Pulling the cars apart we found they all used the RX-2B/TX-2B chips, I contacted the OEM in China for some of the chips and we brought in a bundle of them. Silan Electronics. Data Sheet

Of course its such a popular chip, others have come across it too

krs did a way more awesome schematic though

We didn’t manage to source the SMD version which some cars had, some of which are a knock off of the Silan. For a very simple short range RF setup with 5 functions its not bad at all. The (RX-2B/TX-2B) chips themselves has nothing to do with the RF stage, it just encodes or decodes the pulse train into an on/off for each of the 5 outputs.


So I started working on  a prototype car I used the electronics out of the car, and the wheels and motors, the top part of the PCB we reverse engineered the remote control and added it to the badge pcb, it was designed to snap off so you could drive the car part around and it’d still identify you as a conference attendee.

Paper aeroplane with wheels. Back to the drawing board.


Note to self, check wear on router bit first…..

But now we’re getting to the basic shape, the rear and front are both measured up to fit.


Here it is compared to our cheapest car and the most expensive (at the toy market and its still only $12!!) Geared motor and motorised steering. Yes they’re cheap motors and they’ll wear out but the kits are $3.50 – $4.50 ish and you get two motors.

Its drivable at this point, the front wheels get stuck the maximum turning angles.

Back to eagle, to refine it a ‘tad’. Add three batteries, remote and the car. We’re using CR123a’s


Cut it out. Basically Model T to well a Model T really..


This is how Ferrari started BTW

Add some more bits, to hold the rear drive motor we had to go around the wheels rather than sleek, this isn’t great but not really an easy way to hold the rear on.

this one only has one battery, and so its running at 3V, a bit less since its an old battery. Adding two batteries its a lot faster. Of course all the video we shot of the nicer cars and other driving, seem to have disappeared..


The tuneable inductor was going to be the tricky part, krs and mmca sat and tried out different settings, a resistor is used to set speed of the encode/decode time allowing multiple cars on the same frequency. See page 6 of the data sheet 

The nicer cars have a 27.145Mhz carrier frequency crystal, the cheapest cars didn’t use crystals at all.. The FCC has been informed obviously. However they are surprisingly accurate.

The crystals were ‘hard’ to get , read unpossible in the USA. eBay as usual came through, one seller agreed to DHL them to me and I got them in a few days from again China, which is great, of course all the others I bought that had ‘30 day’ delivery times also turned up the next week. So I have quite a lot of 24.145Mhz crystals for you know all those things that I use 24.145Mhz for, don’t be surprised to see us selling them on eBay Winking smile 

We built a test harness for the chips to see how it works, it mixes a a frequency with a pulse train, sends that out, strips out just the pulses and the chip decodes it into a single pin on the ic, left, right up down etc.

Everything was going pretty well, it wasn’t going to break the bank for us and we had a pretty good car running around. It was zippy and as easy to control as the normal ones.

So I think ok better buy all the cars, head back to the same store, with one of the cars, the business card and quote from the first few we bought. The guy swears he’s never sold them, even though I have pictures of us in the store buying them. So that’s a problem the next cheapest car is $5.50 I haggle him down to $4.50 and knowing I have some of this newer type at NSL, I head back to take it apart and see how it goes together so we can mod the PCB chassis.

I take apart all of the other cars, not one of them is suitable for mounting as easily (of course) I find the distributor, they’ve either gone under or changed names, I find the new supplier in the same address but they don’t carry that line…

So what do we do, time is getting short.. OK I think, we’ll just give people a finished car and a remote, but that’s not much on the badge.  So of course what do we add to it, yes everyone’s favourite  “open source/hardware” begins with an A ends with ‘sounds terrible to the average Italian’.

We can still use the parts from the slightly more expensive cars as bases for PCB cars and robots but we’d need some more standoffs and bits to mount the motors, much easier when you’re building a few of them at the space, but the idea is to get people up and running as quickly as possible at the conference so they can hack on them and enjoy the rest of conference.

I redesign  the badge and have them sent out for quick turn PCB at Pentalogix.

A few minutes later and here it is. We stripped off everything not needed and made it able to run off 3V or less and 5V USB with magical jumpers. I forgot one of the power traces, so a quick wire jumper after the old, why isn’t it booting up! We’re using the slowduino boot loader (page is down) so it can run at 3V albeit at a slower clock rate of up to 8Mhz. We left the pads for the xtals too though so it can function as a full speed device.


So now instead of it being  car, it’s a remote control that has the inputs wired to the ATMega CPU so that it can be controlled via USB, autonomous, strapped to the car, add sensors , switches etc. We left in the blink LED well because LEDs and the duino..

The QRCODE came from an eagle script on a forum post from honken on Ian Lesnet’s dangerous prototypes forum, which is a great place btw

The top part you can cut off and the two parts still work, like everyone thinks worms can do. Though if you cut it off badly, neither will work…

New donor car, sadly not as awesome. I did try!

mmca and krs further tune and identify the parts we need. Spec Ana time, looking great.


Tuning the antenna lengths, by (A) doing the maths, (B) guessing and cutting lengths.  The peak is the 27.145Mhz the blips are the encoded data for the remote

Guessing worked better,, science!! oh wait!

Also you can see our spindle for the mini CNC PCB we’re building, its been sitting there since late last year…never enough time…

This actually worked for the proxmark, just a spool of wire. I think our best antenna was around a metre


It drives..



OK so now that’s working back to the store and pick up cars and hoping the guy still sells cars, that lady is the one who originally sold me the other cars, and she remembers but its all too late now.


This left side is pretty much all helicopters and cars. As I wait for krs to come pick me up they try to sell me helicopters and all sorts of other things, those ones are IR LED based for the remote control, but that’s another story.


Cheap $4.50 crap you say? Well consider this

Those ‘drift’ cars come with one on/off led headlights, tail lights, motors, spare wheels, rechargeable batteries, aa batteries, remote and some other stuff, I picked them up for $8 for staff and other volunteers. the other boxes have the $4.50 cars. Also they drift awesome since they have shiny plastic wheels, lots of fun and great donor parts.For $8 ! Granted we’re limited on what we can do with it as a robotic base, but for lots of cheap steerable bots its great.

For that price its really well made too. its got a can style electrolytic cap!, actual connectors and lots of screws holding things together.


Our pile of donor cars gets bigger along the way.. The engrish on these is great btw. It is all FAST YOU GO and SPEED BECOMING etc


And our neat pile of cars gets reduced


krs making the test boards.

With a prep sheets to help people build them at the conference.



I redesign the badge and send it in to Pentalogix’s off shore PCB fab.  We got them today (Wednesday), the conference is on Saturday.

Looks ok right? Granted I admit I didn’t spent as much time on the graphics this time…. The QRCode works great but I did waver on changing the URL to a or something so we could have changed the link during the conference.. Ahh well. I also have a QR code for NSL with the URL as a graphic inside it but I didn’t want to push my luck on how well it read. I spent a more time drawing the L1 logo, rather than stick with the BMP to eagle conversion, I did that the over drew it with rectangles and a circle, since its more of an even finish and easier to scale. the www box was meant to be place holder.. We used the standard 2×3 ICSP header instead of usual 6×1 which was a hassle since all our 2×3 to 2×3 cables had been converted into 2×3 to 1×6 adapters.. But easier for others. Which reminds me to go place an order for 2×3 IDC crimped headers..


But wait what??? The PCB is twice as thick!! its .125 vs .0602ish. I check the email order and sure enough I ordered .125 , I talked to Pentalogix and sure enough I did order that, the quick turns were .060s . I thought ‘oops’ so after some investigating I found a slight bug in the element14 to Pentalogix Eagle PCB quote web page, which Pentalogix are now aware of, it doesn’t properly transfer the thickness of the board and changes it to .125” you can change it here, but to be honest ‘finish thickness’ I didn’t notice as being 0.125” as the thickness of the PCB, plus defaults, It’s my fault though, I should have spotted it.


Anyways no biggie, it can probably stop bullets now. Its solid…

Blink ! krs built this while I was writing this post. One nice thing about the thick board is that the pins don’t protrude out the other side, so for a badge that’s great! since no pins to mess up fabric

We also get to break out Pickobear for the speaker add on, it’s a shield that plugs in and it’s a remix of the last years badge, but designed as a quick build with a few days turnaround.


Getting crazy! (still have to write the code for it!) its 11:17PM Wednesday….. Plenty of time.. It has a TI TPS61040 boost convertor on it too. Also we have to test it… yes hackerspace….


Batteries and holders arrived today as well, AA’s and CR123as and the battery holders .. super cheap too! from luckily paypal screwed something up, I’d ordered them from elsewhere and batteryspace had them cheaper, so I was able to reorder.


We’re giving away some prizes to people who do the best car/badge hack at layerone , they’re not awesome prizes but hopefully someone likes them, they’ll still have a RC car and a ATMega based controller board.


There’s a lot more I’m going to add to this post, especially technical details. All our projects are open source and are available in our SVN in including all the screw-ups right from the start.. I’m exhausted after this project, and we haven’t even got to the conference yet ! We’ve also got out PCB CNC we’re designing too.

It’s a shame we didn’t get the PCB car thing, I wish we had but it was just time and uncertainty and these are much more hackable with the CPU added.

Packing all the stuff for layerOne, as usual we’ll have an awesome HHV with scopes, Metcal irons , hot air guns  and hot plates, and we’ll be teaching as well as building kits. Hope to see some of you there.


If we’re using shoelaces as lanyards, the lanyard supplier let us down and they didn’t turn up on Friday morning…. the parts from Digikey are supposed to be in on Thursday PM..  Talk about cutting it tight, this is why Joe Grand did an awesome job at Defcon a much larger conference.


Also our 90W laser cutter we imported from China decided to clear port on Wednesday as well, so that is fabulous it would have been really useful to have it earlier  and now it gets to sit in a box in a warehouse til after layerOne.




next years badge ?



Fuses (when I get to the conference, and think OMG what are the fuses, even though we’re preprograming)

E 0xff
H 0xDA
L 0xE2

LPKF EasyContac test

I used a BusPirate V3 board to test out these rivets. They are effectively thru-plating for PCB’s, normally you need to do messy multistage chemical stuff to do it at home. This isn’t as good a result as a chemical plate but it makes up for it in ease of use. It’s not the cheapest option, which is usually just using a bit of wire in the hole and hand soldered in, but that can cause problems with VIA’s under flush mounted  components.

Basically you put a rivet in the hole, flip it over and hit with an automatic center punch.

 LPKF Store

BusPirate Dangerous Prototypes ( Buy one of them at and support the effort Ian is making )

Here are some of the results so far. I didn’t spend as much time as i ought to have aligning the backside of the board, so the drills are slightly off.



DSC02327 (2)

Bottom side, they take up less space on the side that’s being compressed.



I used a needle to insert them one a time, a wire strung with a bunch might work.



A few more added.



Takes a little practice to get them smooth, making the automatic center punch ‘snap’ is key. They’re almost flush when that happens. (circuit in the back is Jack Gassett’s butterfly (the logic analyser update for the sump) )



some closeups with the HiView wireless usb microscope, because of the way it works you see black rings where there is really copper if its an angle.


This one went funky, needs some after attention, I didn’t put the center of the punch in the rivet !


trying out different pressure settings on the punch



My Cadsoft Eagle tips


Just some notes mainly for myself as I get into some of the finer points of Eagle, for instance I had a schematic that had been revised and no board, the previous version had both but there were enough changes to make it a hassle. So I figured script it, Eagle has a decently powerful scripting interface. Most of the things I end up trying to figure out involve changing existing laid out board to be suitable for my AccurateCNC 560 and PCB process.

There might and probably is a better way to do most of these, but that is partially why I’m putting up an entry.

I use the Sparkfun CAM (from ) as starting off point,my DRC generally has 8mil min sizes and 31 mil minimum drill for via’s which is huge. Sparkfun also have their library available, but it has conflicting information for commercial use.


Script/command line

rotate =MR90 LED1  rotates and mirrors LED1 regardless of starting position, M=mirror
move LED1 ( 1.0 1.0 )  moves LED1 to 1.0 1.0
info LED1  equivalent to properties
show LED1 same as clicking with the mouse


Changing VIA sizes after the board has been laid out, without ripping up

I have some via rivets LPKF EasyContac , the smallest has an outer diameter of 31mil , most board via’s are much smaller, so I wanted a way to resize them. I did the DRC, switched off some of the layers, then just clicked through them.

change drill value

Obviously the downside is that the changed Via may now overlap or cause routing problems, sod’s law will guarantee it. Its funny how the smallest of changes will throw off an entire board, the knock on effect can make it go from i just need to resize that one via, to the whole board has to be rerouted.

I’d hoped this would do it, but alas no. From a cursory glance over other scripts, you generate a cmd that does the changes. I just have to figure out how to select the via I want to change.

B.signals(S) {
  S.vias(V) {
     if( V.drill < drillminsize ) {
              V.drill = drillminsize;

So this is where i went with it


#usage "<b>Export size and position information from a board to a script.</b>\n"
       "<author>Author: Charlie Wallace</author>"


real u2u(int x) { // resolution 1/100 mm
   x = round(x * 100)/100;
   return u2mm(x);  // if mm

real u2ang(real x) {
  if (x > 360)
     x = x -360;
  x = round(x * 10)/10;
  return x;

if (board) board(B) {

          output("test.scr","wt") {   

        // switch to metric
        printf("grid mm\n");

        // iterate elements
        B.elements(E) {
            printf("move %s (%g %g)\n",,u2u(E.x),u2u(E.y));
            if( E.mirror )
                printf("mirror %s\n",;

else dlgMessageBox("Start this ULP in a Board!", "OK");
exit (0);


First problem is that it uses a fixed name and path for the scr, second is that the mirror is a flip flop not an absolute. I’ll go over the existing parts first

the real u2u…just converts eagles units to mm, easy enough i copied it from one of the existing scripts, same for the u2ang().

if (board) board(B)

this checks to see if we’re in a board, and then starts an iterator for all the boards in B. its like a for loop that makes B point to each instance of the board.

output("test.scr","wt") {   

this creates an output file called test.scr with “wt” as write text, C programmers that are familiar with fopen will notice the similarities. Eagle uses {} instead of fopen/fclose style, that is that the file will remain open for writing within the { } .  as with fopen this overwrites anything that already exists.

          // switch to metric
        printf("grid mm\n");


we’re using metric positions, easy enough, this outputs the a line by itself to test.scr that just says

grid mm

next is  

     B.elements(E) {


this iterates each of the elements in the board, look at E_ELEMENTS in the eagle help manual for all the members

              printf("move %s (%g %g)\n",,u2u(E.x),u2u(E.y));
            if( E.mirror )
                printf("mirror %s\n",;


this prints out a move and maybe mirror ( if the part is mirrored) with the internal eagle units converted to mm so it appears as

move R1 (1.0 1.0)

that is basically it! it was faster for me to learn eagle scripting and write this, than it was doing an info, show, and typing in the coords by hand for 50+ components.


Next is to fix the mirror issue. After a quick grep of the help file for ‘mirror’ we see that the rotate is able to set the absolute, which is great since we need to add rotation as well. angle is the member in the UL_ELEMENT structure we need for the rotation, so :-


            printf("rotate =MR%g %s\n",E.angle,;
            printf("rotate =R%g %s\n",E.angle,;


That adds the rotation and the absolute mirror, it doesn’t deal with multiple layers.

As its stands now, it needs a file requestor dialog for the script, and to support layers. But it worked (for the most part) for what I needed. Oddly enough one of the components refuses to accept a rotation or mirror, it’ll move but that’s it. Even by command line, have to investigate that one, it certainly helped me transfer the board, but it needs work.

#usage "<b>Export size and position information from a board to a script.</b>\n"
       "<author>Author: Charlie Wallace</author>"


real u2u(int x) { // resolution 1/100 mm
   x = round(x * 100)/100;
   return u2mm(x);  // if mm

real u2ang(real x) {
  if (x > 360)
     x = x -360;
  x = round(x * 10)/10;
  return x;

if (board) board(B) {

          output("test.scr","wt") {   

        // switch to metric
        printf("grid mm\n");

        // iterate elements
        B.elements(E) {
            printf("move %s (%g %g)\n",,u2u(E.x),u2u(E.y));
            printf("rotate =MR%g %s\n",E.angle,;
            printf("rotate =R%g %s\n",E.angle,;


else dlgMessageBox("Start this ULP in a Board!", "OK");
exit (0);


Polygon pours usually make for easier routing (as well as the normal benefits)

At the least this has been true for the boards I’ve been working on, having a common GND plane has made it much easier to route, the bonus being that you don’t have to work about the excess copper on the PCB during CNC too. Initially I’d been using PhCNC to do copper removal which looks nice and might help with assembly due to clearances, swarf and shorts during soldering but it takes a while to do and it eats up expensive end mills


Autorouter as a tool

Autorouters are a much maligned process, but its simple enough they’re a tool that may help with a process, not a solution for every situation. I use it to help me layout and then individually route, I find routing some of the harder parts by hand helps the auto routing a lot. Artistic style is one thing, but just like source code the pretty formatted code can still be buggy, it just makes more pleasing to humans, in circuits that is what schematics are usually for. Read up on all the right angle stuff, then find the papers where people have actually measured it and determine if your circuit needs it, granted habits are good but no need to go crazy but importantly learn why. Bunny over at Chumby Studios throws out some excellent tips. Engineers tend to be a bit overly obsessive, that is why they often ship late.

Don’t expect to the auto router to make pcb’s like you see on professional boards, it’s just not going to happen, but if you help it along a bit you’ll get good results. The usual horses for courses rule applies.


Multiple Monitors

Probably one of the best investments you can make, I like the Hannspree 28’s cheap and cheerful, Schematic on one, board on the other (and a third smaller one for the blog ! )

Re-laid out, changed SOIC-16 to SOIC-16DW


For some reason, which i haven’t checked yet the mill line routed around it, instead of through it, which caused it to be larger. I had this issue once before, last time i used the rectangle tool and this time the line tool, since i wanted a gap, which I set to two 0.05” grid spaces, that was slightly too much. I also cut it a bit deeper when doing the isolation routing. (Adding some notes to older posts: The reason it cut around the trace instead of through it was that the CAM file i was using had the dimension layer and not the milling layer, using the polygon tool on the milling layer fixed it, using a 0 width wire cuts around it)



I built the tool table this time. Which means you get something like this –>


However I did notice that it refers to T0 which is the bit number in the specific tool list, there are three 1. Isolate 2. Drill and 3. Route. So instead of getting the index from the master tool table, you get the one from the subset. It also counts from 0 for the tool change prompt, but the master Tool Table counts from 1. Also on the isolation rubout, it adds the isolate size to your set, so if you define 3 bits in the drill tool table, it’ll add one ( if its not already included ) and that one will be the isolate bit, usually the V90/60/45

Cut testing, Pictures of the fiducial registration mode.

  The double sided PCB’s are helped out by the camera, you basically find two drill holes, align the camera to one, find the drill hole that matches on the gerber , centre the cursor on that , right click and it moves the Gerber’s to match, second hole does the rotation.


Drill Test, trying different depths with the V90 bit, the software has a couple of extra modes to help get rid of the bits that come loose if different drill paths are too close, one is an extra isolation remove. This one I haven’t tried yet, it cuts away a little extra isolation to help with potential shorts, the second mode is rubout, you define a rectangle in the mech layer, or in PhCNC and the software calculates which areas to remove leaving just the tracks, this is heavy on the drill bit usage and takes a lot longer, you end up changing tools maybe 3 or 4 times. The good thing is you can try out nearly everything the machine can do with the demo version of PhCNC (Except camera), it does a cut simulation too.



Not deep enough, These next images are after the double sided cut , checking alignment, the blue areas are the drill path, the black is the copper left, as you can see they match up pretty good.









Find and align the first drill hole. I just did a rough guess watching where on the PCB the camera was and then used X<> Y<> to find it, make sure you focus the camera first


Then just match up the red circles as close as possible.

NinjaBadge take #3 drilled, and realisation, AccurateCNC


So this came out pretty good, there are still a few traces connected that ought not to be, the drills are slightly off to the right, and didn’t realise it was a double sided board!  whoops ( single sided pcb material)

A360_Test 008


But I’m happy with the progress. This is a fairly complex board with some small traces and it had some DRV’s so its not unexpected that it failed in some parts, and i did run it through twice.


Changing the drill bits isn’t that hard, and I still dislike imperial, the software shows things in inches, and not mil’s or cm and not mm’s, the drill bits are marked in mils, so just shift it left so not a big deal, its just annoying switching back and forth, I didn’t realise AccurateCNC offered a metric version, wish I’d realised beforehand, though its just really the micrometer.

The Z axis/depth setting for the bit seems to be sticking a little bit, so I have to watch that when I’m setting a depth.


For drilling depth, I kept a piece of PCB that is the same as the one mounted, and just measured the depth from that.


It’d be nice if the Z went up during the tool change, but i think its like that since it’d be really slow to change the tool out. Other things I’ve noticed as just small things


1. Camera chase mode, be nice if it automatically switched on the video feed if its not on.

2. DRC/DRV, if there any it warns you with a popup box, especially about the forced isolation mode being off, I’ve missed it a few times and the board will likely not cut properly. Probably a good reason, but I don’t see it yet.

3. USB camera doesn’t work well if there are two cameras on the same hub ,even on 2.0, haven’t tried it on a separate bus yet. Really not that big a deal, remote monitoring the CNC. Likely nothing to do with the PhCNC.

3. Resizable video window, it gets in the way, you can make go away altogether, but I’d like it smaller sometimes.

4. Video viewable in CAM mode, i use mplayerc.exe for this (Media Player Classic), you just have to keep switching and it doesn’t do the light/autofocus.

5. Ability to record/remember each of the previously captured camera locations, that way you can build a larger area or refer back to it when you’re elsewhere with the camera, so a bitmap layer.


I also noticed that when I did the thumbtacks for the mounted PCB boundary to lay the cut in CAM mode, when flipped to CNC mode, the image mirrors horizontally but its no longer inside the thumbtacks, not sure why yet.