Inside Rovio

35 posts / 0 new
Last post
tome's picture
Inside Rovio

Here are some photos of the insides of Rovio....


 The base:


The front section of base showing two wheel motors and mount for (lame) LED headlight and collision avoidance:



The underside of the top plate showing LEDs and motor for raising camera boom:


The controller board:


The power section board:


Another view of the whole base:


The underside of the IC board that all the LEDs are wired to:


Another view of the underside of the top plate showing the boom motor:

tome's picture

A few more of the top part of camera boom (where camera is housed).

 The camera and it's controller board:


Further down the boom, you can see where the wiring goes through the hinge into the lower part of the boom:


A better view of the chip on the camera board:


The backside of the boom top cover showing the board under the nav window:


roschler's picture

Excellent pics tome. Let the hacking being, er, continue! :)

tome's picture

roschler said:
Excellent pics tome. Let the hacking being, er, continue! :)


Thanks.  If anyone wants the original images (large) they are here:

tome's picture


One more.  The underside of the camera IC board.

The original is posted at the previous link.


RobosapienPet's picture

Thanks for the excellent photos.
Some chip commentary: (revised theory, looks like the "W99802" was a red herring)

On the top side of the camera/WiFi board you can see the Marvell CPU chip (marked ARM 2702M...). Looks like a Marvell "PXA270M" ARM processor (formerly 'XScale').

The ARM CPU runs the main firmware/program (including CameraTest.bin running under eCos).
It uses the open-source 'libertas' library to access the Marvell chip WiFi features. Also it includes the Marvell proprietary 'microcode' downloaded into the Marvell hardware at startup from a binary image. This part is not open source.

tome's picture

RobosapienPet said: 
Also that plastic thing in the middle on the top of the board. Is that a CF/SD socket?


If you are referring to the long black connector thingy, it is a connector that the daughter card is plugged into.  The daughter card, I am assuming, is the wifi card.

Thanks for the chip run down.  I was going to try to look them up...

cadcoke4's picture

I didn't notice any sort of available port in those pictures. Something that might be used to connect other input or output, or perhaps a TTL level serial connection. It would seem the Rovio is closed, as far as hardware is concerned.

I guess an alternative is for a separate mobile computer to connect via the USB port, and for that computer to serve as the master. I had hoped that the Rovio could serve as the master to control some other additions such as a vacuum.

Joe Dunfee

DRAKHEN's picture

i am not done researching this but this is i have found so far


by looking at the great pics by tome #11 zoomed shows a windbond chip that could be this (wish tome could have cleaned the yellow dot off) hope this helps !!!!

RobosapienPet's picture

FWIW: I finally took my Rovio apart:
I'll post a few additional photos soon, including the insides of the NorthStar module (uses an MC56F8013 and looks very cool)

> (wish tome could have cleaned the yellow dot off)
That WinBond chip is a WinBond W99100DG. Can't find specs, but it looks like the Flash ROM (with 8051 CPU?? -- not enough pins for an ARM class CPU)
So it looks like my two ARM CPU theory is incorrect.
I guess the Marvell ARM chip does all the main CPU heavy lifting.
> I didn't notice any sort of available port in those pictures.
There are (at least) two serial ports.
They are at the bottom of this photo:
They are well labelled. One goes to the NorthStar board (to underside of board here:
The other goes to the main robot to the "mcu" motor controller.

I haven't found any additional serial ports (eg: for a debug terminal). Those four unsoldered holes look suspicious.
Without them you may have to piggy-back one of the existing protocols.

sevik's picture

page 15 of this presentation has reference to W99100DG with uc8051 marking...

DRAKHEN's picture

Thanks robosapienPet for the insite :)

with this info i found this

you are correct it is a 8051 uC (page 12, 15, 18)

it may just boot as in page 18 shows

it may use a gps engine with ecos (page 9)

so how does this twist the plot ?


RobosapienPet's picture

> so how does this twist the plot ?
This level of detail probably doesn't matter for most hacking. If it is only a 8051 uC, for bootstrapping and/or peripheral control, then not important unless we can find some unused signals to steal.
The rest is mostly a curiosity on how the rovio is put together (eg: where is the RAM and ROM?)
The real technical specs we could use is for the processor, the "2702M".

RobosapienPet's picture

Additional photos: The NorthStar module is located at the top of the robot. The circular cover over the sensor array pops out of the plastic robot cover. The module is mounted on a board which connects to the main one over serial. Here's what it looks like inside.

Top side of cover, bottom side of board (including Digital Signal Processor chip)

Top side of board with 3D pyramid shaped sensor (? and a pinhole camera in the middle ?)

Higher res versions:

Nocturnal's picture

RobosapienPet said:
Those four unsoldered holes look suspicious.

Just a thought, Rovio's firmware is under the belief it has two network connections, wlan0 and eth1

RobosapienPet's picture

re: ethernet
I'll have to probe the 4 pins more.
Overall that jives with my suspicions. I suspect they developed it using LAN debugging (not a serial port).
The Rovio eCos image includes "BOOTP" over wlan0 and other diagnostic print features. Another place where open source would help open a tidal-wave of Rovio improvements.

RobosapienPet's picture

More photos: inside the charger / homing beacon: 

The NorthStar Projector module is self contained. It only takes power from the other board.
There appears to be an I2C (-like) control bus that is unattached.
There appear to be jumpers (50Hz) and 3 data lines or jumpers. Also unattached.
High density, beautiful looking circuit board.

The rest of the charging station handles the power supply, charging and low tech IR location beacon. Typical toy construction.

Higher Res Versions:,

There is also a voltage regulator on a large heat sink below the projector module. That's what gets hot.

Rob's picture

This is such a great thread, I just wanted to get it back in view. MrScott (oops), think this deserves being pinned?

Along the lines of opening your Rovio, cmilian found he had to open his Rovio to fix his malfunctioning IR radar:

MrScott's picture

Certainly worthy of the thread owner creating a gallery of the pics posted.
Look at the top of your thread, Tome. There should be a "Create Gallery" button that will show you the pics you've already uploaded directly into the thread.

There aren't that many galleries, so it will be easier to find in the future.

roschler's picture

Northstar hacking, sweet. :)

Is everybody ready for a Northstar driven Femisapien, who knows exactly where and how to dance based on what room she is in? Wait until you see her "get me a soda please" Refrigerator Mambo!

-- roschler

Kreblon's picture

Hey guys-

OK, the camera board is a Koi-MP802. It is a vid cam processor board for cell-phones. The PDF Doc is here:

The "Multimedia-Processor" can handle cameras up to 3mp. It can also handle
bi-directional video .... I couldn't get the ID off the camera board.
It actually has a scalloped focusing ring - but the board implements auto-focus
in firmware. The board is pretty advanced - WowWee could do the -slow down the frame rate and integrate the light - to increase apparent sensitivity.....
Since I don't think anyone is getting more than 15 FPS out of the 802.11
connection anyway. The generic WiFi board inserts into the media processor and feeds it's antenna co-ax wire back down the head- and the antenna is in the body.

Great thread guys...more info!


RobosapienPet's picture

> ...OK, the camera board is a Koi-MP802.
Do you have photos?
That doesn't jive with what I'm seeing. The (small) camera board in mine is only the sensor ("ccs6003", 20 pin thing) connected to the main board with a ribbon cable (going into the ARM CPU).

The ARM Firmware looks like it may have been based on a "Winbond W99802" webcam. It may identify as something similar. (I originally thought they were using that particular '802' chip, but apparently it is doing all the work in the ARM 2702M CPU).

Kreblon's picture

I can pull it apart again..and get a pix... "KOI-MP802" is silk-screened
on the board. The cam indeed connects via ribbon cable to the board.

I assume this is correct because I found this PDF first- and it IS the board
inside the Rovio's head.

The name is located exactly where it is on the PDF. Notice the cam connector at the top.

What say?


RobosapienPet's picture

> The name is located exactly where it is on the PDF. Notice the cam connector at the top.
> What say?

Much closer, thanks. Also jives with mine.
The main brain of the Rovio is on that board (I call it the main board because it is the main brain of Rovio, the camera board is dumb in comparison).

It is controlled by an 8051 based microcontroller on the other side (WinBond W99100DG).
Specs for the ARM CPU chip are hard to find. The chip is marked "ARM 2702M", that adds to the confusion. It could be rebranded in many different ways. I suspect most end in "802".

Alan B
Alan B's picture

In another thread somebody said they fixed the Rovios problem where it lit up every where except the power button by replacing the 5v regulator on the main board. If that works I can fix this is mine but I need somebody to show me where it is on the board. Can somebody please help?

blak's picture

I just decompiled the activex plugin that zaps when in IE. It is a C library that basically interfaces with a WinBond WebCam. If anyone has a WinBond SDK laying around... I really could use it right now ...

(I'm a software hack for the most part... problem is I have no Winbond SDK to go off of... reverse engineering is taking forever.)

I am aiming to fix the audio stream into a java library that works in all browsers, or an actual C app to run off PC's (whichever is easiest once I get the API reference manual for the Winbond Camera).

So what I got so far is that the WinBond Camera delivers an audio stream in ASF format (standard). The only problem is that the port for the streaming is statically set inside the assembly (this sucks). If we could read the stream inside a java library we can get rid of that nasty static tcp port reference.

RobosapienPet's picture

> ...problem is I have no Winbond SDK to go off of...
Doubtful that you will find one, and even so that isn't going to help much.

The protocols are all reasonably understood. Check the official SDK guide, and the notes on the sticky thread "Rovio WebServer (URLs, JavaScript and tech stuff)"
For two-way streaming audio, look at the RTSP protocol (for one direction) and the GetAudio.cgi script (for the other direction)

IIRC: RTSP uses hard coded port numbers, which you can't change without patching the firmware on the Rovio itself.

DRAKHEN's picture

hello again :) i was doing OTHER research (ok i own other robots. there happy :P  ) and found a link to an artical that just happends to use the pxa270 arm !!!

this may make it much easyer to PLAY with rovio !!!!!!!!

DRAKHEN's picture

i have found more info on a sister like board to the one in rovio!

there is a lot of potential here. lots of software to play with!

techspy's picture

Has anyone been able to find a better quality replacement camera board that is compatible?

MassiveOverkill's picture

I'm not an electronics wiz. I want to install the camera board inside my RC tank. I'm guessing that to power the board all i need is to supply 7 volts power. I'm guessing that if I hook this directly to a 7.2V NiMH battery it will fry it without some sort of power regulator. Any help is appreciated. The tank reciever board is this: