A co-worker received a Proper Atom I bluetooth helicopter and wants to control it with his Windows Phone… but Propel has only released iPhone and Android apps. I installed the android app on my tablet, paired with the helicopter, and we tried flying it. We noticed a delay of about a second between pushing a button and seeing the helicopter respond (when toggling headlight, for instance).
Strangely, the helicopter connects as a media device and the instructions suggest turning up the volume on your device to make sure the signal is strong enough. That means the app is generating an audio signal, playing it out over an A2DP bluetooth connection, which encodes it into a digital stream, and sends it to the bluetooth transceiver. The processed is reversed on the other side: the digital stream is decoded into an audio signal (basically analog), only to be converted back to some digital representation used by the helicopter. And apparently the signal quality is also dependent upon the volume of the device… if you have your volume turned down, the helicopter might not fly as well. Seems like a lot of work and overhead when there are more suitable bluetooth profiles for sending small packets of digital data. Not to mention even the serial port profile would have done the trick.
I suppose this could make hacking the device easier though. I found instructions for setting up an A2DP sink in Linux using the BlueZ driver. This enabled me to stream music from my tablet to my computer and also to fool the Atom I app into thinking it was connected to a real helicopter. As expected, the app generated an audio signal, which I captured and inspected in Audacity. In each screenshot, the signal on top is from an MP3 (lossy) and the one on the bottom is from a FLAC file (lossless). Each screenshot is zoomed closer than the last:
Full 30 seconds
One second interval
Three Pulses
Single Pulse
Detail
Listen to the audio here (warning – very loud):
I had some theories that the app might be using a common encoding scheme like Frequency Shift Keying (FSK) or Phase Shift Keying (PSK), so I compared the sound of the audio to clips of some common FSK/PSK modes I found online. No clear match. I looked around for signal analysis software and ended up trying Baudline. Here’s a spectral analysis plot:
Spectrum in Baudline
The spectrum seems pretty level during intervals where there is sound, so no frequencies standing out. <speculation> My current opinion is that the sound is intentionally just random noise, not a more advanced encoding scheme. I believe that the timing and duration of the pulses is encoding binary data, which could explain the long delay between the controller and the helicopter. Such a system would work with a weak signal and could be resistant to noise, especially if the data packets contain a CRC. </speculation>
As a first test, I tried playing back the recorded audio from my tablet to the helicopter, but no dice.
More experiments:
-Pass-through: tablet => PC => helicopter
-Pass-through with added noise
-Isolate a clip of audio that the helicopter understands
More Atom I helicopter hacking here: http://blog.davelester.org/2012/12/29/help-hacking-bluetooth-helicopter
SP Development Blog 