Reverse Engineering the Message Mate FAN
Reverse engineering is the art of deconstructing and studying products for the purpose of discovering their underlying technological principles. The process is related to a cost and teardown analysis. The end result is a collection of documents and drawings that resembles the original manufactures engineering documentation. Essentially you could replicate the product if you wanted to. Chinese knockoffs are a common example of this practice. I’m going to turn-the-tables in this article because there is much to be learned from the design of Chinese electronic toys. The low profit margin nature of the products leads to an extreme attention to cost reduction. This leads to elegance in design and manufacturing practices not typically found in traditional Western engineered products.
You can buy
a Message Mate from a variety of online wholesalers and retailers. The example above is from one of the
Mate is a handheld battery operated fan that displays five 16 character
messages with a single 9 element LED array attached to one of the fan
blades. The message can be entered
(programmed) by the user and consists of letters, numbers, and symbols. The messages are edited using only three
pushbuttons located on the side of the handle.
It is manufactured by Dongguan PinGuan Electronic Co.,
The company holds a Chinese patent # 2731156 on the illuminated fan concept invented by Li Tao. Below is an exploded diagram from the patent showing most of the basic elements of the design. The patent covers blinking LEDs  in a pattern while the fan  is turning. The electronics are located on a round printed circuit board . Power is transmitted to the electronics through the metal shaft  of the motor  and a brush  with a rotating contact . However, the more elaborate functions of the programmable Message Mate are not covered by this patent.
The product produces the message by rapidly turning on and off 9 LEDs while the fan rotates. You can see the flexible circuit board on which the LEDs are mounted in the photograph below. The fan rotates very quickly and the phenomenon of persistence of vision makes you see the message as though it was floating in mid air. One of the biggest engineering challenges of the device is communicating with the LEDs while they are spinning. I’ll get to that detail later.
Close examination of a single character reveals that it is 9 pixels high by 7 pixels wide with a 1 pixel space between characters. The matrix below shows how the ampersand (@) is produced. The 9 pixel height is surprising since you would expect a nice microprocessor friendly power of two value like 8. This leads me to believe that there must be some specialized circuitry employed to actually send out the 9 bit output values.
I measured the fan speed to get a feel for the timing requirements of the electronics. A simple light detector can be built with a Cadmium Sulfide (CdS) photoresistor, 10K ohm resistor, and 9V battery. The resistance of the photoresistor drops with an increase in light and can be used to detect the light emitted by the LEDs. The schematic of the circuit is shown below along with the connection to an oscilloscope. A single solid character message was programmed into the Message Mate and then the photoresistor was held close to the spinning fan where the character was being displayed to pick up the light from it. This resulted in a waveform on the oscilloscope from which the time of rotation could be determined. With new batteries the speed was measured at about 55 revolutions per second or about 3,000 RPM. This is a very reasonable speed for a small DC motor with a light load. That works out to 18ms per revolution, 1.1ms per character, or 142us per pixel. That is a pixel rate of about 7KHz which is easily in the range of most microprocessors.
Another important fact about the timing can be observed by simply watching the display. The electronics must “know” the location of the fan blade relative to the handle. For example, while editing a message, the location of a character remains fairly static. If the display was not synchronized, there would be some drift or movement over time. So, as we disassemble the device, we should find some kind position sensor.
Let’s start the disassembly process by taking the back of the unit off. It held together with three self-tapping Philips screws. You can see the backend of the DC motor on the right and the programming buttons to the top. The power switch is grey and to the bottom of the photograph shown below. The body of the handle is made from polystyrene plastic. The battery terminals were first fitted into slots and then anchored by simply melting the plastic to hold them in place. It is a little surprising that the length of the interconnect wires is excessive, but it might have made the assembly faster.
We are also able to see how the battery gets connected to the rotating shaft of the motor. A copper brush is soldered to the metal top of the motor and has a sliding contact with the motor shaft as seen in the photograph below. This brush, through the metal body of the motor, is eventually connected to the positive terminal of the battery. This style connection has a fairly limited life expectancy, but the product is only realistically used for a few hours until the novelty wears off anyway. Generally, planned obsolescence like this is actually a sign of quality in that the customer doesn’t pay for more life than they actually needed.
The plastic nose cone of the fan is easily pried off and the clear polyvinyl chloride fan blades removed to reveal the flexible circuit board with the array of LEDs. The LEDs are directly wire bonded to the circuit board and then some clear epoxy added to protect the connections. In addition to being the least expensive method, it also reduces the weight of the assembly. If the discrete LEDs had been purchased in surface mount packages and then soldered, it would have not only been more expensive, but also have been considerably heavier. An electrolytic capacitor can be seen through the oval hole on the left.
With the cover removed, the control board with the electronic capacitor can be seen in detail. You can see the shaft of the motor electrically connected at the center of the board. Although it looks like the electrolytic capacitor is glued to a blob of black epoxy, that epoxy is actually covering the integrated circuit that controls the Message Mate. It was also wire bonded to the circuit board to reduce cost and weight. Additionally, there are two chip resistors (22 and 51 ohms) and two capacitors (both 0.01uF) on the board. I don’t have time to determine their function, but I suspect they provide some short time delays. The implied RC time constants are around 0.5 and 0.22us for 2 and 4.5MHz. Maybe they are parts to generate internal clocks.
From the side we can make out some of the moving contacts that pass signals and power to the control board. The brush on the right is soldered on the underside of the control board and sweeps around the outer part of the lower board. The brush on the left is soldered on the lower board and sweeps around the inner part of the bottom of the control board. Additionally, there is a spring that is mounted to the lower board and presses against the bottom of the control board making a forth connection. Remember, the shaft is also a connection.
After pulling the control board off the motor shaft, you can better see the spring and the brush soldered to the lower board. Both of these parts are eventually connected to the negative terminal of the battery. On the bottom of the control board you can see that the spring continuously presses against a large conductive region while the brush must periodically pass over a small separate conductive area. This must be the way the control board senses the position of the handle.
The brush on the bottom of the control board is sliding against the conductive ring on the lower board which is connected to the programming button circuit board in the handle. The button board has 4 resistors and one capacitor. The circuit is a simple voltage divider designed so that pressing each button creates a unique voltage. This voltage is how the integrated circuit on the control board knows which, if any, of the buttons is being pressed. No buttons pressed = 0V while Button 1 = 1.1V, Button 2 = 2.3V, and Button 3 = 3.6V.
The schematic below at least characterizes the circuitry of the Message Mate. Most of the mystery of the device should be gone now. As promised, the design is quite simple and economical. I’d question whether the timing and spring contacts could be combined to simplify it further, but there may be other power tradeoffs that make this slight redundancy necessary.