Welcome, Guest. Please login or register.
Did you miss your activation email?
October 19, 2018, 09:41:10 21:41

Login with username, password and session length

Pages: [1]
Author Topic: Hacking Polycom Cameras (hw) + how to build a Visca controller for Sony cameras  (Read 28614 times)
0 Members and 1 Guest are viewing this topic.
Offline Offline

Posts: 15

Thank You
-Given: 5
-Receive: 20

« on: October 02, 2012, 05:50:02 05:50 »

Hi Everyone,
This will be a multi part message, and ultimately it will show you two things.
The first is how to make use of the camera in the early polycom system, and the second, how to build a visca controller.

Firstly, thanks to metal for inviting me to the forum and giving me an opportunity to be a part of the community. I've always wanted to be a part of this forum so I can share whatever interests me while learning from other like minds in the process.

Anyway, on with it.
A few weeks ago I purchased some Polycom units from a local auction. Today I decided that I'll document what I learned because nowhere else on the web is this information available. So, maybe it can be helpful for someone else!

As people in the know will understand, these Polycom units are now an outdated model and often appear at auctions for very very low prices. I think I paid about $20 for both of these units. In fact, the shipping cost more than the units did! Granted, It's just the main unit (the base) with the camera built in. I didn't get any power supplies or anything else with them, but that's cool, you can easily build your own.

Awesome right? The one on the left is the Early unit with the square camera, the one on the right is the later model camera. It's more of a sleek shape.

Now you might be wondering why I was so interested in a couple of old obsolete Polycom units!?
Well, not a lot of people know, but the cameras inside these units are an extremely high quality Sony Camera which are really worth a lot of money... Have a look on eBay, the earlier model EVI-D30 & D31 sell between $200-$300 and the newer EVI-D100's sell for about $400-600 each. Did that get your attention ?

That's right, inside these units are a High Quality Pan, Tilt and Zoom camera with 12x optical zoom, Auto Tracking & Hardware Motion Detection, High Speed PTZ motion & more! These are the Rolls Royce of Webcams!

In the Early Polycoms with the Square camera there is a complete Sony EVI-D30 PTZ (NTSC on American Polycoms) or Sony EVI-D31 PTZ (Pal Version, Australian Polycoms)
Complete as in all you need to do is add a power supply and buy a remote for it from eBay and you have a fully functional EVI-D3* camera for a fraction of the price of the retail version of the camera!
You don't need to do any hacking on these, they work straight out of the conferencing unit!

You can see from the rear shot of the D31 camera that there's an S-Video out, a Visca IN (But no visca out) and the 13.5V power input.
Without a Visca out, you wont be able to daisychain these, but for a webcam or Security cam, who cares. You don't need to hack these at all, once you pull them out of the Polycom system they are virtually complete.

The early cameras in the Polycom's are good, but the newer cameras are the ones I'm really interested in. These are a beautiful camera.

Inside the later models there are cut down versions of the Sony EVI-D100 PTZ cameras called the EVI-10PLBKP
The EVI-10 differs from the EVI-D3* in that it has a wider field of view (65% vs 45%) had 40x zoom (10x optical/4x digital), and uses an electromagnetic Pan and tilt mechanism for much smoother transitions compared to the mechanical D30-D31 models. Have a look at the features of the cameras, they are quite advanced!

The only problem with the EVI-10's in the Polycom units is that unlike the earlier Polycom Systems which basically had the entire camera hidden inside the case, with the newer one most of the circuitry to drive the cameras is gone! These are a really a cut down version!

When I pulled down the early model I was pleasantly surprised to find a full camera in there, so I was really hoping to find the same thing when I pulled down the newer model, but alas... it was not meant to be and this is what I found when I pulled down the newer unit.

I know... It sucks, but you can't win them all. So, refusing to give up, I looked for a diagram of the wiring and of course, it's a Sony, so there's nothing available and nobody from Sony wants to help. At this point in time, I have no idea what the pinouts are. Great

This is the breakout board that Polycom uses to interface with the camera. I also can't find a schematic for this
So, at this point in time, I have no idea what it does or what the connections are.

I'll do some reverse engineering to see if I can discover the pinouts on the polycom unit. Being a multilayer board it may take me a day or two, but I'm determined to make this camera functional!

Posted on: October 02, 2012, 12:25:54 12:25 - Automerged

Well, after a few days, I have made some progress. After spending many hours tracing the tracks on the main board of the Polycom, I've managed to work out the power inputs and the S-Video outputs and I now have a fair idea of what the Polycom breakout board does.

This is where I've started to hack away at the board, its not very helpful but I'll include some proper drawings soon.

I've also worked out the Visca control ports which means I can either make a cable that hooks directly to a RS232 computer port for computer control, or I can build a joystick controller that uses something like a MAX232 and a Pic chip to interface with the camera. I really like the idea of a joystick controller though, so this is the route I will probably take. For those that don't know, the controls for the camera have to come THROUGH the serial VISCA interface. Sony cameras use a protocol called Visca to control the different functions of the camera. It's a rs232 or rs485 serial interface that lets you control the camera.

That breakout board on the real of the Polycom is actually a RS*** interface, so Visca commands can be sent from the legacy motherboard via RS232 from the Polycom main system direct to the camera.

With the cut down version of the EVI-D10 camera, the serial interface that was built into the base of all EVI-D100's is gone, So Polycom obviously needed it there to communicate with the camera with Visca control commands.
So somewhere on the Polycom main board is a RS232C controller sending legacy commands to the breakout board which then acts as the interface to the camera control circuitry.

I'm not really sure why they did it like this. At first, It really seemed like a hack.

I thought it may have been done for backwards compatibility, but now I think that when Sony ended the production run of the EVI-D30/31, and replaced the model supplied to Polycom with the EVI-D10, Polycom probably had a LOT of the older style PCB main-boards! So rather than dumping potentially a lot of stock and having to make new boards it was probably more feasible to just make the add-on board. When you look at the actual mainboards between the old camera system and the new, there's not really many changes between them. My guess would be that they just changed the top case and the firmware because the Visca control set for the newer camera is slightly different to the older D30/31.

Most likely, they just used up their stock of boards and then went with the next model, which kind of makes sense, because not long after the new camera was introduced, they came out with the new model (VSX series). I haven't pulled a VSX model apart, but I'd bet that there would be a straight cable from the camera to the mainboard. You'd need the breakout connector.

This also means that for the units we have, we have to keep the breakout board because we need that interface to actually talk with the camera. There's 24 pins going into the camera, on the camera mainboard, but only 12 on the polycom breakout board. What are those extra 12 pins? I guess without a diagram of some sort, I'll never know. They would probably be visca out, composite video etc. I suppose I could just buy a Sony EVI-D100 and find out, but that defeats the purpose of getting the camera on the cheap.

Now, for the first test.
The output is S-Video, which would be great if the video card I have in my computer could accept it. So now I have to convert the S-Video to Composite. The D100 version of the camera actually has a composite output, but sadly if the D10 has it, I have no idea of which pins are for this (though it woule be more likely that the conversion would have been done on the removed part of the camera)

While it was easy enough to reverse enough of the polycom board to work out what pins were what, the Sony is much harder because it has lots of unmarked parts and chips. Thanks Sony

I'll just cheat a little for the first test. The easiest way to get a picture from S-video to composite is to bridge the Y & C ground as 1 output, and use the Luminance as a second output with a 470pf-10nf capacitor from the Crominance bridging to the luminance. So we have now have the required 2 outputs we need for composite. It's not a permanent solution because when we convert from S-video to composite we get artifacts on screen and bad colour bleed and an overall degraded picture.

But it will show us if we have everything correct and that's what matters. When I wire these up permanently I'll probably use an off the shelf solution like a FMS6410 to give me a cleaner and better conversion, though for now, i just want to see if everything works!

Ok, I've turned the current limit on my bench supply right down and in case I got something wrong and applied power!

The camera responds, pans up, to the right and back to a central position! But no picture!
A few seconds later, a picture pops up on the screen!

Success!! I must admit though, I got a little worried when the screen didn't come up straight away. The start up program must run through the camera self test before it actually enables the video outputs. So now we have power and picture! Rejoice!

I'm pretty happy with this. The picture is reasonably good considering the dodgy composite setup.

At this point in time though, that's all the testing we can do! I can't test the movement or zoom at all because I don't have a RS232 serial port on my machine, so I can't control it by cable/software. So it's going to be hardware movement for us!
I've ordered some max232 chips, a Joystick and some different pic chips and started to play with some pic code. As this progresses I'll put up more information.

I'm thinking of a hand controller with a joystick, with X & Y axis movement for the pan and tilt, and a Twist left/right for zoom in and zoom out. I'll get there.

Hopefully soon I'll have a camera and controller for a super low cost! Though thinking about it, for the time I've invested in this so far, I probably could have just gone out and bought a complete ready to go unit... But where's the fun in that?

I did look at some commercial Visca camera controllers to save some time, but they are just SUPER expensive! I don't particularly want to spend $300+ on a controller that may not even work!
The Visca set is well documented in the Technical Manual, which can be found here:

It's fun, but i'm getting tired of looking at this same board and poking and prodding it hoping for something to happen. Hopefully when I get the parts I'll find some more motivation to keep me going!

Posted on: October 02, 2012, 12:30:06 12:30 - Automerged

I haven't had much motivation or even time to spend on it. Of late I've just been really really busy with so many other things and as usual, I'm falling behind. I've been playing with it for the part 3 days or so, mainly because the parts I ordered came in and I figured I'd better get stuck into it before i forgot where I was at.
I've finally managed to scrounge some time and worked most of it out and I'm pleased to say, we now have full camera control. Pan, Tilt and zoom and a few other cool things!

The prototype board. This board consists of 2 main parts. A PIC16f688 (Programmable chip) and a MAX232 serial interface chip. The idea behind it is simple. The PIC chip contains the VISCA control codes, it sends them to the MAX232. The MAX232 chip has all the interface stuff built in, all we have to do is tell it how fast we want to communicate with the camera(9600 baud). Once we tell it that, it goes and automatically negotiates the connections and boom. All done.

For this project all we use is the RX and the TX lines, so theres only 2 connections we need to make to the camera breakout board (provided of course that you use the same power supply for the controller and the camera so there's a common ground!)

This shows the camera connections I've worked out. If your polycom doesn't have the breakout board, well, you are screwed. I guess you could always fabricate your own breakout board, its just a serial interface much like what we created with the prototype breadboard we assembled. I haven't reverse engineered it though, because I never needed to. I don't have a schematic for it. Just for your information, the black ground wire that's connected to pins 4 and 6 is done on the breakout board, so you don't have to worry about connecting that one.

This picture shows the connections on the breakout board (numbered from 1-12) and the connections shown as the back of the camera. So if you were looking at a regular camera from the rear, this is how the connections go.

This is the Sony diagram for the Visca connections. For our serial connection we only use pins 3 and 5 (the TXD and RXD)

This is the new PCB I made. It has connections for the joystick and some extra buttons that add some extra functionality. It's made to fit into the same case as our speed controllers, so all I really have to do is mount the joystick and I have a full PTZ VISCA controller!

The 2x orange wires on the bottom left are the rx/tx, the wires at the top left are the joystick control (at the moment I only have 2x potentiometers because my joysticks haven't arrived yet!) and on the bottom right is the 12-24v input connector.

As soon as I draw up the schematic I'll post it here, I'll also release the hex code so you can burn your own PIC chip and build your own controller!

I think I've accomplished what I set out to do. I was going to build a proper S-video to composite adapter too, but to be honest, the picture quality is good enough for me and I've already spent too much time on this.

To update, I've now gotten my joystick! The control is FANTASTIC! So, that's why I'm back working on this again!

Not a bad camera right? 
Smoking is bad. Ignore the cigarettes, I used them to lift the base of the camera up off the table!

The picture could be much clearer if I did the composite conversion properly, but as you can see, while it's a little fuzzy, its decent.

Some things I might do next is change the code so that I can use the twist in the joystick handle to adjust the zoom in and out, and I might use the spare line on the pic to increment the camera so that daisy-chaining will be possible.

This is the problem when you design things... You start to get feature creep where you begin to add all these different things that take you way beyond what your original design plan was.
Earlier today, I was actually considering to go to a bigger PIC chip and then add an lcd display then add more features, but then I caught myself and thought why?
It does what I originally wanted it to do and I'm not going out to manufacture these. I just wanted cheap, high quality control!

Posted on: October 02, 2012, 12:33:37 12:33 - Automerged

You'll love the visca controller! I'll finalise the schematics and code soon. I've implemented the twist to zoom, and if you are really keen you''ll be able to build and sell these on eBay for $100-$150 each!

Offline Offline

Posts: 15

Thank You
-Given: 5
-Receive: 20

« Reply #1 on: October 03, 2012, 07:18:48 19:18 »

I know the first part of the post was long, it basically showed you how to make use of the newer cameras inside the polycom units.

This second part will show you how to build a visca controller. These sell anywhere from $200-800, but I don't really understand why they are so expensive, they are not complex to build.

This is the schematic for the visca controller. I still need to finish the code and properly document this schematic. Consider this a work in progress because I may have to make some changes to the schematic for the twist to zoom joystick control. It's made to operate from a a joystick called a CH-300R-P3, you need this model, its a potentiometer controlled joystick and can be found here

Or you can do what I did and get is from china from Omiter. Their part number is OM-300R-P3. The joystick has X, Y and Z movement. X and Y is moving the joystick up, down and left, right. The z movement is provided by twisting the joystick to the left and right.

At the moment, I have everything working on the schematic, but the joystick for the Z movement uses a hall effect throttle, and when you put +5v to it the returned values are too low to be accurately read. So I may have to add a 12V source to the schematic too.  The problem with running the z axis off 5v is that if the power supply is not 100% stable the zoom will creep as the voltage in the circuit fluctuates.

There is a spare pin on the pic, i was going to use this for people who want to daisychain these cameras together to select which camera is currently controlled, but after thinking about it, I decided not to bother with this feature. I don't need it, and its really only useful if you want to make the controller commercially, in which case you will either need a bigger pic with an LCD display to show the modes and have more features or at least a lcd segment counter to show which camera is active at any time. For me, I just don't have the time to add this. I work long long hours and even this simple project has taken me 2-3 months to get this far.

I appreciate all the thanks I've received so far and I'll update this post as I have time to do so!

Offline Offline

Posts: 15

Thank You
-Given: 5
-Receive: 20

« Reply #2 on: October 12, 2012, 03:38:40 03:38 »

This is the code to run the above application. Make sure that your supply is stable. A 12V regulated supply will be perfect.
The twist to zoom is all implemented, and everything works properly.

I still need to tweak a little, so I'll post as I make progress!

Hero Member
Offline Offline

Posts: 562

Thank You
-Given: 386
-Receive: 130

Very Wise (and grouchy) Old Man

« Reply #3 on: October 14, 2012, 06:39:21 18:39 »

Rather than the HEX, would you list the actual movement/action commands that the camera would accept?

If I have said something that offends you, please let me know, so I can say it again later.
Offline Offline

Posts: 15

Thank You
-Given: 5
-Receive: 20

« Reply #4 on: October 18, 2012, 03:36:28 03:36 »

At this point in time, the only commands used are:

 left :                              8x 01 06 01 XX YY 01 03 ff
 right :                            8x 01 06 01 XX YY 02 03 ff
 up:                                8x 01 06 01 XX YY 03 01 ff
 Down:                            8x 01 06 01 XX YY 03 02 ff
 Stop:                             8x 01 06 01 XX YY 03 03 ff
XX =   Pan speed  (01 to 18)
YY =   Tilt speed (01 to 18)

cam zoom Stop:           8x 01 04 07 00 FF
cam zoom tele:            8x 01 04 07 02 FF
cam zoom wide:           8x 01 04 07 03 FF
Recall Preset:              8x 01 04 3F 02 0p FF   (p = preset 0 till 5)
Set Preset:                 8x 01 04 3F 01 0p FF   (p = preset 0 till 5)
Clear buffer memory     8x 01 00 01 ff )

 x = camera address   1 to 7, but camera addressing isn't implemented.

I haven't had a lot of time to spend on this lately, I've been too busy with work, but eventually I'll tidy up the code and release that too for people to play with. It's not being held back or anything, I just need to tidy it and try to document everything.
These codes are compatible with a lot of Sony cameras, on some models the codes may be slightly different though.

I also need to go back and do some reworking of the hardware for the smoother zoom control and I may add some more features too while I'm at it.

Posted on: October 18, 2012, 10:29:25 10:29 - Automerged

What camera do you have ? Have you built the circuit yet ?
Offline Offline

Posts: 15

Thank You
-Given: 5
-Receive: 20

« Reply #5 on: December 09, 2012, 12:53:13 00:53 »

I've not had much time for this, but I came back to the project this weekend. I've upgraded the code a little. The main changes is the camera now has multiple speeds for pan and tilt, the zoom code now works on the average input and some other changes that I forget.

I've also changed the electronics in that the zoom function will no longer work from +5V, it now needs +12V-13V, the feedback from this was too small at +5v. It really needs some changes to the electronics too, but I don't think I'll bother with this. It does what I need it to do. For a better picture quality, hook up a FMS6410 IC. It makes a noticeable difference in the video quality.

I will get around to documenting this someday.

This is the code, rar'd up so you can do what you like with it
« Last Edit: December 09, 2012, 12:55:21 00:55 by bytraper » Logged
Offline Offline

Posts: 15

Thank You
-Given: 5
-Receive: 20

« Reply #6 on: March 21, 2013, 04:00:23 04:00 »

Just to update people, while I haven't played with this more, don't run the zoom from 12V, leave it at +5v... any fluctuations in power at 12V will kill it... (so much for the manufacturer datasheet for the joystick) just change the code values to reflect the lower adc values!

If I ever get around to working on this again, I'll change the schematic to have a booster for the low output of the zoom control.

With the code you should be able to work all this out though. If you have any questions PM me and I'll try and help. Its really important you use a stable supply for this!
Pages: [1]
Jump to:  


... Copyright 2003-2999 ...
Powered by SMF 1.1.18 | SMF © 2006-2009, Simple Machines LLC | HarzeM Dilber MC