Ear Hat - Connected 3.0

By khyizang, 5 December, 2017

Ear Hat 3.0The newest Ear Hats, Connected 3.0, are a radical departure from the previous Ear Hats.  First off, they have a new pattern.  Pass.  They aren't as tall as the previous version.  The last ones were around 3" tall and these look to be around 2.5" tall.  Both have the same diameter, around 7" but the new ones have a lot less foam liner.  The upside of that change is that they may fit some adult heads a little better.  The plastic ears are noticeably thicker.  The previous ears were about 1/2" thick.  And now they're about 5/8" thick.  So there's that.

Curiously, the orientation of left/right with respect to the hat's label seems to be reversed with these new hats.  What was left is now right and vice versa.  The Mrs pointed out that this effectively mirrors what is seen in the new control app.  So maybe that's why the new orientation.  But it goes against all the legacy devices that are still out there.

But the more interesting changes are hinted at by the Bluetooth notice printed on the product tag and the promise that these new hats will glow along with certain Disney TV broadcasts.  Yep.  Made with Magic is coming home.  More about that after we take a look under the hood.

Teardown

ear mountsThe way the ears are mounted into the hat has changed.  There's a groove in the ear assembly that the hat fits into.  This makes it a whole lot easier to extract the ear assembly. First, pull out the foam liner and then simply cut the hat, starting at the rim, and continuing up to the bottom edge of the ears.  That should make it easy to slide out the combined Ear assembly.  Being that easy to get the ears out should make it possible for more folks to 'reimagine' these beauties.  Welcome news if you don't find the new hats alluring.

extracted ear assemblyNotice how the battery compartment doesn't stick out below the bottom ear contour? That's because the battery has been pushed further up into the ears.  That should make it easier to incorporate these new ears into another construct.  The ribbon connector may pose a challenge, but that may be a small price to pay for the relative ease of extracting these babies.  I imagine that this is as far as many of you may want to go.

Inside EarsIf your targets are the actual PCBs, you'll need to pry open the ears.  This isn't all that easy and seems to be irreversible.  So proceed at your own risk.  Use something thin and sturdy to insert into the crack where the ears join and pry them apart.  This will break the three snap connectors that you can see in the photo to the left.  Don't know any way to fix that problem. 

Once that's done, you can easily see the PCB and the battery compartment and just how far the assembly sticks up into these ears.

Connect 3 pcbsTo get those boards out, they have to be desoldered from the battery posts that stick all the way through each PCB.  You can see those connectors in the photo on right.  To get a better look, click the photo and you should get a larger image to inspect.  Among the changes since the last version is the migration of the on/off switch to the board that has the fewest components.  That makes a lot of sense.  The switch is still on the right ear if the label is in the back.

N51802The largest component appears to be the infrared receiver.  So we should expect this setup to handle substantial IR input. And there's a familiar LED at D2 that looks like the ones found in previous devices that facilitate peer-to-peer synchronization.  But I'm sure most of you are more interested in what's at position U1.  Near as I was able to find out, this is probably a Nordic Semi nRF51802.  For some reason, it's hard to find details about this processor.   Nordic says their nRF51 series are built around 32 bit ARM Cortex M0 processors with varying amounts of memory.  The nRF518 family provides Bluetooth low energy and 2.4GHz multi protocol SoC.  So that's how the Bluetooth gets done.  A 32 bit processor is a step up from the 16 bit TI 430s found in all the previous Made with Magic devices.

Other changes include a larger number of inductors, L1-5 and probably 4 transistors at Q1-4.  Having 6 legs, maybe those 'Q' devices are optocouplers?  The chip mark on those Q components is 34k.  Couldn't find what that chip marking signifies during a quick search.  Dunno.  The new inductors most likely are part of the Bluetooth antenna requirements, as is the 16 MHz crystal.

The other inductor probably goes with the 3412g boost regulator at the U2 position.  That regulator uses a voltage divider to set the operating voltage but looks to be intended for 3.3V usage.  Two battery max output is 120 mA.  That's less than the regulator in the previous devices and may explain why the new hats don't appear to be as bright.  Looks like this regulator will also tolerate inputs up to 5V.  That makes some hacks a little more convenient - especially when other components are in play that require 5V input.

Did some searching to see what the max tolerated current is for the GPIO pins.  Not satisfied with the results I found.  Not sure why it isn't easier to find that data.  I would think that would be one of the first things hackers would want to know.

No effort was put into trying to figure out the signals traversing the ribbon connecting the two PCBs.  Could be similar to what was discovered for the previous hat

Stored codes

A recorder was setup and the ears let run for a while.  The following codes were detected:

99 42 00 00 48 14 0C XX D0 0E 83
99 42 00 00 48 15 0C XX D0 0E 80
99 42 00 00 48 16 0C XX D0 0E 80
99 42 00 00 48 17 0C XX D0 0E 93
99 42 00 00 48 17 0C XX D0 0E 98
99 42 00 00 48 18 0C XX D0 0E 93
99 42 00 00 48 18 0C XX D0 0E 94
99 42 00 00 48 18 0C XX D0 0E 97
99 42 00 00 48 18 0C XX D0 0E 99
99 42 00 00 48 88 0C XX D0 0E 80

This may not be a complete list.  It simply demonstrates that the new hats can emit familiar IR signals to sync with legacy MwM devices.

Since these new hats are Bluetooth capable, the ears were also sniffed with a LE Bluetooth device channeled to WireShark and gave results like this:

No.     Time           Source  Destination Protocol Length Info
      1 0.000000000    Slave   Master      LE LL    53     ADV_NONCONN_IND

Frame 1: 53 bytes on wire (424 bits), 53 bytes captured (424 bits) 
on interface 0
Nordic BLE sniffer meta
Bluetooth Low Energy Link Layer

0000  15 06 2e 01 d2 68 06 0a 01 25 3f 00 00 76 31 c3   .....h...%?..v1.
0010  00 d6 be 89 8e 42 1b 3e cf 01 e2 af ee 02 01 04   .....B.>........
0020  11 ff 83 01 09 0c 02 ff 42 00 00 48 14 0c 1c d0   ........B..H....
0030  0e 83 31 2b ea                                    ..1+.

Looks like a familiar code fragment in line 0020.  Each transmission corresponds to a burst of what are essentially 6 copies of the same command.  That's different from the way the IR signals work but suggests the new hats are attempting to communicate via two different modes.  Wonder how the different inputs are sorted? 

Shop Disney Parks app

Shop Disney Parks appPerhaps the most exciting new feature to go with the new hats is the ability to control the hats at home using the Shop Disney Parks app.  Kind of a strange place to find such an app, but that's where it is.  Once the right link is loaded up, there are two tabs to choose from.  You've got one that is labeled Color Remote and the other is for Magic Events, which are the TV broadcasts that include Made with Magic control.  I'll go into my experience with the broadcast in a future post.  Here, I want to focus on the Color Remote option.

Clicking into the remote tab, it quickly became clear that this iteration of the app offers pretty limited control of the new ears.  The color can be selected for each individual ear and the rate of blinking can be controlled - but that's about it.  The first thing I discovered was that none of it worked with my phone!!!  I'm still using an iPhone 6.  The Mrs has an iPhone 7 that did work.  Lucky girl!  So that may be the first gotcha for this new service.  It may be necessary to be using a newer phone to make this go.

Another question that came up concerned whether or not the new ears would relay the signals from the app to the legacy devices that lack Bluetooth capability.  In short, no.  Looks like they won't. 

Response to previous IR show recordings

The new hats have infrared receivers and an ARM processor, so it seems likely that the new hats should handle the infrared transmissions from previous shows just fine.  But that's not what I've seen so far.  This video (sorry about the quality, made late at night when probably should have gone to bed instead) shows what happened when the codes from a recording of the Main Street Electrical Parade were replayed.  The new hat fell out rather quickly.  That was unexpected and can't be explained at this point.  So I transmitted a collection of 48 codes at the new hat to see if some of the codes simply weren't implemented.  Not the case.  The new hat responded to all the codes similarly to the older hat.  Is it possible the new hats just can't keep up?  Or are there poison codes in the old programs that cause the new hats to pause?  Lots to figure out.

You may notice that the light output from the new hat's LEDs look a little dimmer than the older devices.  That tends to be true.  But the colors look to be a little truer than the older hats. 

What's next?

Up next, I hope to dive into what I found out from monitoring the TV broadcast that ushered in the new tech.  Lots to talk about and plenty of new questions to be answered.  Stay tuned.