®

PowerUp® 3.0
Hacker package Documents

1 | PowerUp 3.0 | Hacker package Documents

Ideas for projects
Welcome to the PowerUp 3.0 hacker book! The ideas are divided into three skill set levels.
The best way to start hacking PowerUp 3.0 Choose the skill level that describes your
is selecting a cool project to work on. abilities best. After finishing a project you can
Need some ideas to get started? Be inspired always try out a higher level of difficulty!
by the following pages.

The skill levels

Beginners Advanced
You have some basic skills in building, soldering Beginner and intermediate skills bore you?
and electronics. No need to know any Dive deep and use the TI chip onboard our
programming. For this skill level, you will use Bluetooth Smart PCB to do want you want!
the PowerUp app without any modifications; We will give you some Texas Instruments
you will just use it for different solutions. references and let you try boosting what is
already at its limit! This is considered high
Intermediate level and is not for beginners. You should have
You are familiar with soldering, remote control some experience with embedded development
hobby projects and electronics. You also know and a lot of curiosity.
how to program and modify an app. Go ahead,
and create your own cool user interface for
iOS, Android or Windows. Bluetooth Smart
Generic Attribute Profile (GATT) protocols
are something you can get into quite easily
with support. We will provide you with some
links and book references to help.

2 | PowerUp 3.0 | Hacker package Documents

The ideas
Balsa Wood Glider
This is a basic, fun and quite simple project. A
great choice to start with!

Beginners Advanced
Use one of your already existing balsa wood Follow the intermediate level, and then try
gliders, buy a 2-channel plane from your modifying the firmware to allow easier support
favorite hobby store or make one yourself. for a 2-motor plane. You should change
De-solder the existing printed circuit board the firmware so that it will receive just
(PCB) and solder the PowerUp Bluetooth a thrust level and a direction and will
PCB into the plane (Please refer to the adjust the motors respectively. (this is a
connection diagram, further in this book). bit awkward…just to clarify: by adjusting the
A rudder and motor is enough for takeoff. firmware, the plane will only receive thrust
Make sure the plane uses a magnetic actuator level, and the direction “instructions” will
and no servo. Also try adding some wheels to automatically adjust the motors?)
the glider and build a launch ramp for a quick
takeoff! Car
Everything can be controlled with your
Intermediate smartphone, now you will be able to drive
Use one of your already existing balsa gliders around a small car with your PowerUp
controlled by two motors, buy one from your module!
favorite hobby store or make one yourself.
You now have to establish a control for two Beginners
motors. De-solder the actuator and solder Build a 3-wheeled car controlled by
another motor to its connection instead. Make PowerUp. One wheel in the front, two
sure the second motor is identical to the first wheels in the back and a rudder to control
(PowerUp) motor. Now it’s time to change the turns. Leonardo da Vinci already used this
the app to allow convenient control of a plane wheel formation in his 3-wheeler in 1478,
using 2 motors (i.e., by using 2 thrust sliders, the Italian car manufacturer “Piaggio” called it
one for each motor). “Ape” – now it’s your turn!
Use the Bluetooth PCB for this project. You
Instead of a 2-motor plane, you can connect 2 will need to solder the motor and actuator.
actuators. Now it’s a real glider! Go soaring! The motor will be used for powering the car

3 | PowerUp 3.0 | Hacker package Documents

wheels, and the actuator will control the front change the artificial horizon to an Everglades
wheel. Try experimenting with different gears boat with some alligators in the background
on the wheels to get to the right speed and to set the mood.
power for you.
Advanced
Intermediate Try building a boat controlled by 2 motors.
Follow the beginner level and then modify Make a relevant app and change the firmware
your app to easily control your car. Change to allow control of speed and direction.
the interface to something with a steering
wheel and acceleration slider on it and make it Space Shuttle
easy, and more realistic to control the car. The Space Shuttle is the advancement of an
airplane with a rocket motor. This can get a
Advanced little dangerous, so we suggest a minimum of
Try building a car controlled by 2 motors. an intermediate skill level for this idea. Always
Make a relevant app and change the firmware use caution when handling rocket motors!
to allow control of speed and direction.
Intermediate
Boat Get a model rocket motor from one of the
By Air, by land and by sea! It’s time for a various internet shops or your local hobby
smartphone-controlled boat! store. Attach the rocket motor to your balsa
glider from our first idea (see page XX). This
Beginners time, your take-off is vertical. Launch the rocket
Just use a plate of styrofoam and place a and use your smartphone later for soaring in
motor and propeller on top. The actuator will the sky. Re-design your balsa glider to look like
be used as a rudder in the water. You can also a space shuttle! Try modifying the app to look
use a water propeller. In this case, you have like an authentic space shuttle cockpit.
to build a water-proof solution for the motor
and the propeller. It is easier to just use the For advanced
PowerUp propeller and use a hovercraft or Follow the intermediate level, but this time
airboat as your inspiration. use the motor! Put the motor at the top of
your shuttle to give it some extra flying and
Intermediate thrust power. Try creating a landing sequence
Follow the beginner level and then modify where you slowly decrease your thrust for a
your app to easily control your boat with smooth landing.
a creative sea navigation interface. Perhaps

4 | PowerUp 3.0 | Hacker package Documents

Rail Zeppelin
Create your own propeller-controlled train!

Beginners Advanced
Create or buy a small model of a train car. Follow the intermediate level, but instead of a
Put the PowerUp 3.0 unit on top of it, and brake motor, try putting it in the other end of
you are ready to go. Build a cool-looking rail the train car to allow for braking and driving
system for the train to drive through. in the opposite direction. Modify the firmware
to support this function, and create your own
Intermediate good-looking app interface.
Follow the beginner level. Replace the actuator

More ideas?
with a motor and create a braking mechanism
to allow for smooth stops. Design your very
own rail zeppelin app. Use the throttle to What about an airship (did you mean jet
control the motor as well as the speed. Add engine?) A construction crane? A sailboat? The
some LED (lights?) to the brake motor output sky is the limit, enjoy!
so that braking will simulate a real train.

5 | PowerUp 3.0 | Hacker package Documents

Hardware
Physical Specs Using Motors and/or Coil
- Dimensions: 24,2x11,3x2,0mm actuators
- Weight: 0.9 Gram ± 5% A2L and A2R is designed as H-Bridge so the
- Input voltage: 2.0 - 3.6 V Output pair can be reversed (for using an coil-
- ¼ wavelength Monopole RF Antenna actuator or reversing a motor). Those Outputs
- Link Budget: -92 dBm (approx. 50 meter) have a 7 bit resolution PWM signal running at
- 3 outputs, max 880mA, voltage same as 50 Hz, in each direction and are controlled by
power supply, PWM the PowerUp app by tilting the phone left/right.
- 1x unidirectional 8bit resolution,
- 1x bidirectional output pair (two outputs, The motor output is just unidirectional which
polarity reversible) 7 bit resolution in each means that just have a half-H-bridge which
direction just hasone Polarity and can not be reversed.
- LiPo cell charger (1S), 3.7 V, charge up to 4.2 This means, if you hook up a motor, you can
V. The Charger will charge with 200 mAh. only regulate thespeed of the motor using the
- On/Off switch Throttle Slider in the app, but not the direction.
- Status LED The output generated is PWM with 8-bit
resolution running at 500 Hz.
Status LED patterns
Long blinks: waiting for connection Using LEDs
Two short blinks: connected Since there are 3 Physical Outputs/Channels
Continuous fast blinks: battery charging on the PCB (M- is connected to GND) you
can easily connect 3 different LEDS using the
Power Supply Outputs as Power Source and the Battery- (or
The PCB can be powered though a battery M-) as Ground.
(with 2.0 - 3.6 V) or using a DC Power Supply
Just connect B+ to the supply Voltage and B-to
Ground (or – from the battery)
Outputs
The High Power Outputs (A1L, A2R, Motor
Output) can supply 1.13A each in Steady state
(up to 1.28A peak for 5 seconds) or drain
0.88A in Steady state (up to 1A peak for 5
seconds).

6 | PowerUp 3.0 | Hacker package Documents

Firmware
Introduction IAR Embedded Workbench for
The firmware is the program running on the 8051
little micro-controller on-board the PowerUp. This is a set of tools (compiler, IDE, header
It controls all the functions of the module. By files) to compile your firmware programs
modifying the firmware, the PCB can be made written in C into 8051 machine code, and
to perform any function, including things not debug them. This is a commercial product,
at all related to flying a paper plane! This is and currently there are no free alternatives
suitable only for advanced level hackers. available. However, IAR offers a 30-day trial
version which will work just as well.
WARNING: If you don’t take care, it is easy
to damage your PowerUp by modifying the Texas Instruments BLE-STACK
firmware! This is software provided by Texas Instruments
which takes care of most of the Bluetooth
What you need communication, so that you can concentrate
To be able to customise the firmware, you on the actual functionality. It comes with a lot
need knowledge of several domains: of examples as well. This is required software
- Good knowledge of the C programming and your firmware will not be doing much
language without it.
- Good knowledge of Bluetooth Smart (see
the bluetooth section for more information) MORE INFO: More information about
- Basic knowledge of micro-controller all the required tools is available on the
programming product page of the CC2541 Development
- Basic knowledge of electronics Kit: http://www.ti.com/tool/cc2541dk-
mini#Technical%20Documents
Once you’ve acquired this knowledge, or are under “User Guides.”
ready to experiment, gather the following
materials: The firmware image
The electronic module of PowerUp 3.0 is
CC Debugger based on the Texas Instruments CC2541 chip.
This is a small black box that lets you connect This chip includes an 8051 micro-controller
your PowerUp to a computer through USB and Bluetooth Smart radio. On the micro-
for programming the firmware. Without this, controller, TI’s BLE STACK is running, which
it’s not possible to program the CC2541 chip. controls the Bluetooth communication. On
You will need to install the drivers before this top of the BLE stack, the PowerUp main
works. application is built which includes code to

7 | PowerUp 3.0 | Hacker package Documents

control the motor and rudder, battery status, things before the PCB is detectable and ready
provide device information and communicate to accept firmware upload over USB:
with the app on the phone using a well-define 1. Ensure that the B+ and B- pads have 3V
protocol. power supply (maximum 3.6V).
2. Connect the remaining 4 pins plus the
The BLE stack and the main application are RESET pin to respective wires on the CC
together formed into one executable binary Debugger flat cable.
image. This image is approximately 128 kB. Refer to the CC Debugger documentation to
find out which wires should be connected to
Image types whichpad.
The firmware images are of two types:
A and B. Only one image is running at any Programming the PCB
given time. During startup, the bootloader. Once you have successfully connected the
The CC2541 chip has 256 kB of flash storage, PCB to the CC Debugger, and pressing the
and each firmware image takes half of this. In RESET button on it turns the LED green,
this way, the other half of the chip’s storage is you are ready to program. From this point
used to download a firmware update through onwards, you will need to dive into the Texas
Bluetooth Smart. This means, if image A is Instruments BLE-STACK and code your
running, only image B can be uploaded to the firmware in C using the IAR 8051 compiler.
chip, and vice versa. This also provides safety in
case the firmware upload is interrupted - the MORE INFO: The Texas Instruments
original running image will keep running. e2e forums are a great resource for
firmware programmers. It is available here:
MORE INFO: More information about http://e2e.ti.com/support/wireless_
the firmware image types, and the firmware connectivity/f/538.aspx
upload Bluetooth protocol, is available in the
following PDF document: MORE INFO: Documentation for the
http://processors.wiki.ti.com/ CC2541 chip can be found here:
images/8/82/OAD_for_CC254x.pdf http://ti.com/cc2541

Connecting the CC Debugger

to the PCB
The PCB has 4 ports exclusively for
programming. These are marked on the PCB
connection diagram. You need to do two

8 | PowerUp 3.0 | Hacker package Documents

Bluetooth Smart: A Primer
The following pages describe the essentially be random, but are usually
various BluetoothSmart services and generated using a UUID generation algorithm.
characteristics that the SmartLink Lite Standardised Bluetooth services and
PCB supports. A basic knowledge of characteristics have a 16-bit “UUID,” which
how BluetoothSmart works is helpful are actually shortcuts for 128-bit UUIDs
to understand the description. A short constructed from a base “Bluetooth SIG.
primer is given below.
Advertising and connection
Data structure Every peripheral advertises its presence
Every device (a “peripheral”) exposes its periodically (the “advertising interval”)
functionality via several small pieces of data along with basic information (e.g. its name
called “characteristics” which are typically and the primary service it supports). A
a single number, string etc. Related smartphone (the “central”) can listen for
characteristics are grouped together into a these advertisements and connect to the
“service.” A few related services are grouped desired peripheral. It can then query the
together into a “profile” which is purely services and characteristics that the peripheral
a convention and is not enforced by the exposes. Once it has all this information, the
BluetoothSmart protocol. smartphone can read or write data.

The BluetoothSmart protocol includes Characteristics

functionality to query a peripheral for All data is exposed via characteristics. A
the various services it supports, which characteristic can be read from, written to, or
characteristics are included in each service, both. The peripheral decides what it permits.
its data type, read or write permissions and The peripheral may respond to the read or
so on. Access to this database is managed by write request acknowledging it (regular read
the Generic Attribute Profile, abbreviated or write), or it may simply act upon it without
as GATT. Whenever you see reference to a confirming (read or write without response).
GATT service or a GATT characteristic, it When a value of any characteristic changes,
simply means a BluetoothSmart service or the peripheral may notify the connected
characteristic. Every device includes a GATT. smartphone (i.e. the “central”) about it
automatically, without the central periodically
UUIDs checking for it. This is a “notification”. If the
Each service, and each characteristic within central acknowledges that the notification
any service has a unique identifier: its UUID. was received successfully, it is called an
These UUIDs are 128-bit long and can “indication.”

9 | PowerUp 3.0 | Hacker package Documents

To receive any notifications or indications, the - PowerUp service
central must request it to be enabled for the - Factory test service
characteristics of interest. Of these, the PowerUp service is the most
All data exchange happens in periodic bursts, important. It has fields to control the engine
and the interval between two data exchange and rudder.
events is called the “connection interval”
which is generally chosen by the peripheral NOTE: Not all services may be present on
depending mainly on how quickly the data your module. Out of the box, modules have
needs to be exchanged. Between two data the Factory test service but not the PowerUp
exchanges, the peripheral is typically in power- service. After the “first flight setup,” the factory
saving sleep mode to save battery. test service is removed and PowerUp service is
installed.
PowerUp 3.0 connection A detailed description of every service follows.
parameters
PowerUp 3.0 uses an advertising interval of 0xF171 - PowerUp Service
500 ms. The connection interval is 20 ms This service currently has three
(lowest value allowed by iOS). Both these characteristics: one for the motor speed, one
values may change in the future! for the rudder turning angle, and one for the
128 bit UUIDs are used everywhere except battery charger on board the PowerUp. The
for the Battery Service which is standardized motor speed and rudder angle can be read or
and thus uses 16-bit UUIDs. written. The charging status can only be read
The TailorToys standard 128-bit base UUID (in (or notified). When the motor is turned off
hexadecimal) is: (value 0) and the rudder is centered (value 0),
86C3810E-xxxx-40D9-A117- the chip can go into power saving mode.
26B300768CD6 Otherwise, the chip is continuously running,
where xxxx is replaced by the 16-bit UUID drawing approximately 10 mA from the
shorthand mentioned in the following battery, even if the motor and rudder are set
documentation. to very low values. So to save power, write
0 to motor and rudder when they are not
PowerUp 3.0 Bluetooth actually being used. Furthermore, write a value
protocol only if it has actually changed, i.e. avoid
The SmartLink Lite PCB includes several writing the same value over and over again.
services: This will help reduce data transmission.
- Device information service
- Battery level service

10 | PowerUp 3.0 | Hacker package Documents

0x0010 - Motor Speed change). The pulse width as well as the phase
inversion is controlled by this characteristic.
Allowed Read/Write Negative values invert the phase of the PWM,
Type unsigned 8-bit integer which causes the actuator to turn in the
Range 0 to 254 opposite direction.

This characteristic controls the motor speed. 0x0040 - Battery charger

A value of 0 turns the motor completely off, status
a value up to 254 increases the motor speed
proportionally from 0% to 100%. A value of Allowed Read/Notify
255 is out of range and will turn the motor off Type unsigned 8-bit integer
again. On the hardware, the motor speed is Range 0 or 1
controlled by applying a PWM signal of varying
duty cycle at a frequency of ~500 Hz (subject This characteristic provides information about
to change). The pulse width is controlled by the battery charger. When 0, the battery is
this characteristic. not being charged. When 1, the battery is
being charged. You can enable notifications on
0x0021 - Rudder (actuator) this characteristic to avoid having to read it
angle periodically - the chip will send a notification
when the value changes. On the hardware,
Allowed Read/Write this is connected to the STAT pin of the LiPo
Type signed 8-bit integer charger IC. Normally the battery is “in-use”
Range -128 to 127 and this characteristic will read 0. When a
microUSB cable is plugged in, supplying 5V,
This characteristic controls the rear rudder’s and the charger IC has started charging the
turn angle. A value of 0 centers the rudder and battery, this characteristic will change to 1.
uses negligible power. A value of -128 turns the It may take a few seconds for the PCB to
rudder fully to the left, while a value of 127 recognise that charging has started or stopped.
turns the rudder fully to the right. Intermediate
values cause the rudder to turn proportionally 0xF181 - Factory test service
either left (negative values) or to the right This service is used only during production.
(positive values) from the center position. It includes functionality to test proper
On the hardware, the rudder is attached to a functioning of the electronics and that the
magnetic coil actuator, to which a PWM signal various connections are correctly made.
is applied at approximately ~50 Hz (subject to It also has commands to turn on special

11 | PowerUp 3.0 | Hacker package Documents

RF transmission and reception modes for This characteristic reports the battery level
regulatory (FCC/CE) testing. in percentage. Value 0 represents an almost
depleted battery while value 100 represents
WARNING: This service is not intended to a fully charged battery. On the hardware,
be accessed by end-users, and is therefore not the battery voltage is measured once per 6
documented. seconds, and converted to a percentage value
for voltages between 3V - 3.75V. Note that
NOTE: This service is only present on a this measurement is very approximate, and
brand new PowerUp. It is erased and replaced may fluctuate often.
with the PowerUp service during the first
flight setup. 0x180A - Device Information
service
0x180F - Battery Service This is another standardised Bluetooth GATT
This is a standardized Bluetooth service to service which provides information about
report the battery level in percentage. It has the device, such as the manufacturer’s name,
only one characteristic, the battery level. model number, serial number and so on.
Please refer to the Bluetooth specification Refer to the official specification for more
documentation for more detailed information. information.

IMPORTANT: The base UUID for this MORE INFO: You can find the official
service and its characteristics is the Bluetooth specification here:
SIG base, not the Tailor Toys base. https://www.bluetooth.org/docman/
handlers/downloaddoc.ashx?doc_
MORE INFO: You can download the official id=244369
specification here:
https://www.bluetooth.org/docman/ Below we’ll provide a short explanation of
handlers/downloaddoc.ashx?doc_ what each field means in the PowerUp:
id=245138
Manufacturer name, model
0x2A19 - Battery level number
These fields are as they are named, to provide
Allowed Read-only information about the manufacturer and
Type unsigned 8-bit integer model number. It will be Tailor Toys LTD and
Range 0 to 100 PowerUp 3.0 respectively.
Unit Percent

12 | PowerUp 3.0 | Hacker package Documents

Serial number the 100 range. Full firmwares have version in
We use this field in a slightly different way. It the 200 range.
provides you the production batch number and
not individual serial number. This is a string. NOTE: his field is for informational purposes
Example: TTPU/rev1.5/001 means: only. The version information provided by the
“Firmware service” is the accurate value. The
- TTPU: internal code for Tailor Toys PowerUp two might mismatch.
- rev1.5: internal code for hardware revision
(here, rev 1.5) Hardware version
- 001: first production batch String containing internal hardware revision
number. Typically, it is 1.5 or 1.6 or similar.
The exact format can differ. For example, the
beta units say TTPU/r1.6/BETA-200 . It is Firmware Upload
recommended not to interpret this string. Use The firmware upload service is used to
it only for informational/display purposes. wirelessly upload newer firmware versions to
the PowerUp.
System ID This follows the OAD protocol defined by
This field is a 64 bit number which uniquely Texas Instruments.
identifies a particular device. It is built from a
combination of the internal MAC address and MORE INFO: You can find the official
other values. This value should be used as an documentation about the protocol on Texas
identifier only, the actual value has no pattern Instrument’s Wiki page: http://processors.
to it and is not a “serial” number. wiki.ti.com/index.php/OAD

Firmware version The 128 bit UUID for this

A string that gives information about the service is: F000FFC0-0451-
currently running firmware image. This is a 4000-B000-000000000000
quick way to check which firmware version
your PowerUp is running. It is a string, typically It has two characteristics:
containing a 3 digit number. Example: 207. - Image identification: UUID F000FFC1-
If your PowerUp is still fresh off the factory, 0451-4000-B000-000000000000
the factory firmware version will be displayed - Block upload: UUID F000FFC2-0451-
(example: factory-160). Higher numbers mean 4000-B000-000000000000
newer firmware versions.
Factory firmwares generally have versions in

13 | PowerUp 3.0 | Hacker package Documents

Please refer to the official TI OAD guide (linked MORE INFO: Light Blue app can be
above) for detailed information. See also the downloaded from
Firmware Programming section of this guide. https://itunes.apple.com/us/app/
lightblue-bluetooth-low-energy/
How to explore the PowerUp id557428110
via Bluetooth Smart, without
programming? MORE INFO: BLExplr app can be
Want to access the internals of your PowerUp downloaded from
over Bluetooth Smart but don’t want to https://itunes.apple.com/us/app/blexplr/
write your own code? No problem! There id524018027
are several ready-made “Bluetooth explorer”
apps available. For iOS, we recommend you to MORE INFO: BLE Device Monitor app can
try out the free “Light Blue” app made by the be downloaded from
fine folks at Punch Through Design. A non- https://play.google.com/store/apps/
free alternative is the “BLExplr” app made by details?id=ti.android.ble.devicemonitor
Michael Kroll.
MORE INFO: BLE Scanner app can be
Android users can try out Texas Instruments’ downloaded from
BLE Device Monitor app (free), or BLE Scanner https://play.google.com/store/apps/
by MacDom Apps Studio. details?id=com.macdom.ble.blescanner

14 | PowerUp 3.0 | Hacker package Documents

Smartlink technology
Diagram

15 | PowerUp 3.0 | Hacker package Documents