A Certain Magical Index

A Lithium-Ion Cell Precharger

Mon, 01 Jan 0001 00:00:00 +0000

The rationale

When working with refurbished Lithium-Ion cells, in particular with attempting to recycle cells from used battery packs you will discover many cells in these packs who are very deeply discharged. It's common to see cells that read a < 1V open-circuit voltage. There can be a number of reasons for this to happen:

the cell may be damaged in a way that manifests itself as self-discharge
the cell may have it's CID (Current Interrupt Device) tripped which is an internal fuse in the cell that mechanically disconnects the cell terminals from the case in case of excessive conditions inside the cell, in this case the voltage just reads 0 and presents an infinite internal resistance
the cell may have been connected to a BMS and not charged for a very long time, this causes the slow leakage current of internal resistances in the BMS to slowly drain the cell

Of those 3 groups the last one is the most interesting to us as these cells can potentially still be reused. It is commonly known that deep discharge is damaging to lithium-ion cells. The cell will loose capacity, the internal resistance will increase. In extreme cases internal shorts can form in the cell which may cause thermal runaway of a cell (fire + smoke). So deeply discharged cell reuse is not without risks and you should always understand what you are doing, monitor the conditions of your cells (current, temperature and voltage) and always have safety features in place. Still for low-current applications there can be a place for a cell that will probably not handle its rated maximum current capacity safely but otherwise is not totally dead.

A random board of LEDs

Mon, 01 Jan 0001 00:00:00 +0000

I was a bit sick and bored one day so I decided to look into my junk box for something to do. I found this random board with some dual color LEDs on it that came from a "network appliance" which was basically a 1U server with a logo sticked on it. The box had some additional Ethernet ports at the front and the LEDs here were serving as link/activity indication. The board looks as follows:

Advantech LCD module

Mon, 01 Jan 0001 00:00:00 +0000

Intro

The Advantech LCD manipulator is a simple module which contains a text LCD, a keypad all connected to a controller board. Advantech is a industrial and embedded computer manufacturer. Unfortunately there are no labels or P/N information on the module or the board so it's not possible to exactly identify this part. The controller has a PIC processor and an RS-232 interface chip which drives an interface connecting to a PC mainboard. This module was installed in some kind of networking appliance which I disasembled some time ago and I decided to reverse engineer the communication protocol in order to be able to use the module in my own projects. The module front looks like this:

Avantree Audition

Mon, 01 Jan 0001 00:00:00 +0000

These are BT 4.0 headphones. I have noticed one problem with them - they work very well when connected to my One plus One phone but the sound is skipping when connecting to a PC. At the same time my journal was being spammed with messages like these:

lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 9074 us (= 1600 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 13077 us (= 2304 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 10090 us (= 1776 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 8097 us (= 1428 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 7073 us (= 1244 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 8091 us (= 1424 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 12095 us (= 2132 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 7078 us (= 1248 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 9080 us (= 1600 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 9083 us (= 1600 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 9084 us (= 1600 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 11086 us (= 1952 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 8090 us (= 1424 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 10094 us (= 1780 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 8074 us (= 1424 bytes) in audio stream
lut 02 20:59:12 shoggoth pulseaudio[4905]: [bluetooth] module-bluez5-device.c: Skipping 11072 us (= 1952 bytes) in audio stream

I think the reason for this is that I was using an el-cheapo old BT 2.0 dongle while my local 2.4 GHz spectrum is a bit crowded (I counted more than 100 802.11 networks when I last ran Kismet)! So now I need to buy a BT 4.0 dongle and test out my hypothesis.

Brother DS-720D

Mon, 01 Jan 0001 00:00:00 +0000

The Brother DS-720D is a color duplex roll scanner with Letter maximum paper width. It works with Linux using binary-only SANE backend files. I mirrored them here in case they become unavailable sometime in the future together with the scanner docs:

Quick Start Guide User Manual

libsane-dsseries_1.0.5-1_amd64.deb

libsane-dsseries_1.0.5-1_i386.deb

libsane-dsseries-1.0.5-1.i586.rpm

libsane-dsseries-1.0.5-1.x86_64.rpm

History of this item:

Timestamp	Event
2015-11-01	Purchased on http://www.x-kom.pl/ for 569 PLN

Cubify Cube 3D printer

Mon, 01 Jan 0001 00:00:00 +0000

The Cubify Cube 3d printer is a plastic filament 3D-printer. It's production is discontinued but I got mine for free from one of the members of the Warsaw Hackerspace so I thought I might as well see what's it worth. The online reviews of this printer are pretty bad (it has > 50% 1-star reviews on Amazon) but hey, I got it for free together with two cartridges of filament.

Screws are Allen H2.5 not Allen H3 or Torx like I thought.

D-Link DIR-655 Wireless Router

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

The D-Link DIR-655 is a 802.11 bgn and gigabit Ethernet wireless router. Its basic hardware is described on wikidevi with multiple hardware revisions.

Hardware

The main PCB with the main shield and heatpads removed reveals the main chip and the Ethernet bridge:

Main parts

Main parts are documented on wikidevi.

Connectors

Designator	Footprint	Description	Notes
J1	2x5 pin 2.54mm dupont	Debug connector?	Unpopulated, 4 MHz clocked synchronous signal output
J2	10P 1mm FPC	JTAG?	Unpopulated

J1 connector

Pin number	Description	Notes
1	DATA
2	Unknown	Pullup to 3.3V, occasional glitches
3	GND
4	Unknown	0V, likely N/C
5	Unknown	0V, likely N/C
6	CLK	4 MHz clock
7	Unknown	0V, likely N/C
8	Unknown	Pull-up to 3.3V when powerup
9	+3.3V output
10	Unknown	Pull-up to 3.3V when powerup

A signal trace from the J1 connector has been obtained using a Saleae Logic analyzer. The dump can be downloaded here. Attempts at decoding the signal were made using the SPI decoder have not revealed any ASCII communications - the protocol working here looks to be binary in nature.

Dell PowerConnect 2808

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

The Dell PowerConnect 2808 is a managed 8 port Gigabit switch.

Hardware

Main parts on PCB

Designation	Type	Description	Notes
U1	Marvell 88E6218-LG01	Main CPU
U2		Flash memory	Alternative for U3
U3	Intel JS28F640	Flash memory
U4,U6,U8	LVC16244A	3-state buffer
U5,U7	NANYA NT5SV16M16CS-6K	SDRAM	There is a second one on the bottom of the PCB giving a total of 64 MB of RAM
U13	Unknown	Bridge ASIC	Heatsink glued to top
U16	Unknown	Ethernet PHY	Heatsink glued to top
U17	Unknown	Ethernet PHY	Heatsink glued to top

Connectors

Designation	Footprint	Description
J1	2x10 pin 2.54mm dupont	JTAG
J2	1x4 pin 2.54mm dupont	Serial console
J4	1x6 pin 2.54mm dupont	Ethernet P0 of the Main CPU

Serial console (J2)

Serial console is a 3.3V TTL UART running at 9600 bps, 8 bits, 1 stop bit and no parity.

DNS-320L NAS

Mon, 01 Jan 0001 00:00:00 +0000

Intro

The D-Link DNS-320L is a simple 2-bay SATA NAS device which can run multiple versions of Linux. This post provides information on how to run the newest (at the point of writing) mainline kernel on it without patching as well as how to build a simple initramfs using buildroot. This is a bit different than other projects building Linux which usually focus on using debian packages.

Hardware

There exist at least four versions of the hardware, I own two of them and the ones that I own can be distinguished by using the following features:

Edimax BR-6204Wg

Mon, 01 Jan 0001 00:00:00 +0000

The random Edimax router found in the junk box will serve as a garage 802.11 AP.

Hardware

The router is built based on the RTL8186 SoC with 2 MB of Flash and 16 MB of RAM.

The device exposes a serial console with 3.3 V levels and 38400 8n1 setup. There are also JTAG pins exposed.

I have had this router without a case so it was not obvious at first what it was. By searching for the string '1244-00000401-01Z' silkscreened on the PCB on wikidevi I found out that it's an Edimax BR-6204Wg or identical (as documented on wikidevi the device is sold under many different brands).

Enecsys Gateway CG-A-AB-US-1

Mon, 01 Jan 0001 00:00:00 +0000

Intro

The Enecsys Gateway is a Zigbee gateway allowing communications between the Enecsys microinverters and their monitoring backend. The Enecsys company is unfortunately defunct since 2015 and their DNS domains have been taken over by a UK enecsys owner who created his own monitoring system on https://enecsys-monitoring.com/

Zigbee Radio

The gateway contains a ETRX2-PA Zigbee module manufactured by Telegesis. More information about this module can be found in the page describing the Enecsys SMI-360-72 Inverter. This module is connected with an UART on the main MCU. The uart settings are 19200 8n1.

Enecsys SMI-360-72 Microinverter

Mon, 01 Jan 0001 00:00:00 +0000

Intro

This is a page describing my notes about the Enecsys SMI-360-72 microinverter with main focus on reverse-engineering the 802.15.4 (Zigbee) communications protocol used for monitoring of the microinverter parameters by a Enecsys Gateway device documented here.

Zigbee Radio

The inverter contains a ETRX2-PA Zigbee module manufactured by Telegesis. This module is based on now end-of-life EM250 chip sold by Silicon Labs. It's been built by a company called Ember which has been since acquired by Silicon Labs. A datasheet (mirror) for the chip is available. Unfortunately, it uses an obscure XAP2b microprocessor core (more docs here (mirror) with no open-source compiler or instruction set published. The microcontroller designer (Cambridge Consultants, add another company to the vendor soup) has apparently licensed an IDE called xIDE (some docs here) to Silicon Labs as this software is what they are selling to their customers in order to develop custom firmware. No free licenses for this software seem to be available.

F&F MAX-MB-LI-4LO Modbus Pulse Counter

Mon, 01 Jan 0001 00:00:00 +0000

This file contains some information that I learned after buying and disassembling a modbus pulse counter from the F&F company. The model of the device is MAX-MB-LI-4LO.

BOM

Designator	Marking	Type	Manufacturer	Description	Datasheet	Notes
	ST8S005K6TC	ST8S005K6TC	STMicroelectronics	MCU	mirror
	S485C8	ST485C	STMicroelectronics	Low power RS-485/RS-422 transceiver	mirror
	USB62	USB6B1	STMicroelectronics	Data line protection	mirror
	LH04 354T X	LTV-354T	LiteON	Photocoupler	mirror	1 per channel

Reference information

Fred the Ripper

Mon, 01 Jan 0001 00:00:00 +0000

Fred the Ripper (FtR) is a CD-ripping (or recording if you want) robot based largely on the acrylic "kickstarter" version of the UFactory's Uarm 4-axis desktop robot. I added a few parts and other tricks to make a robot that can pretty robustly chew through a box of CDs archiving them complete with cover photos. To summarize the current fatures are:

archives Audio-CDs and Data CDs, as well as other data discs (like DVDs with ISO filesystem on them)
uses a camera to make photos of the cover of the disc to make your archive more easily searchable
can detect and correct a certain amount of problems in it's own operation
generates metadata for each archived disc
has sensors to detect that there are no more discs to archive to automatically stop
detects discs that failed to archive and puts them away on a special tray to be manually checked. All information and logs from the failed operation is retained

Rationale

The reason for this project was to learn how to use the UArm, OpenCV and flex my diy muscles while making something that will be actually useful. The usefullness part is me getting rid of two boxes full of old Audio CDs, archives and god-knows-what CD-R discs.

Fronius Symo 6.0-3-M inverter

Mon, 01 Jan 0001 00:00:00 +0000

The Fronius Symo 6.0-3-M is a 6 kW 3-phase grid-tie inverter that is currently a part of my home PV setup. This is a repository of all of the information I was able to gather on this device, some easy, some other a bit harder to find.

Interfaces

Aside the obvious DC and AC inputs the inverter has a number of interfaces for monitoring and integration to different systems.

GOPHERT CPS-3205 II power supply

Mon, 01 Jan 0001 00:00:00 +0000

Hardware

The GOPHERT CPS-3205 II power supply is a very cheap lab power supply that can be purchased for example on aliexpress. It has two boards inside:

a main power board
a smaller controller board screwed in front

Both boards are connected using a short bundle of wires with pins labeled on both ends. The wire is marked as SW19 on the controller board.

Main chips on the controller board are:

HIKVISION DS-7316HI-S

Mon, 01 Jan 0001 00:00:00 +0000

Symptoms

The HIKVISION DS-7316HI-S is an NVR supporting analog CCTV cameras which I got for free. It was declared to be broken and indeed was failing to boot. The console output was providing the following hints:

U-Boot 1.2.0 (Nov 28 2009 - 10:58:12)

DRAM:  256 MB
AMD Flash devid:0x227e id3:0x2221 id4:0x2201 
ARM Clock : 364MHz
DDR Clock : 310MHz
Hit ctrl+u to stop autoboot:  0 
### JFFS2 loading 'uImage' to 0x80700000
jffs2: scanning filesystem . done.
jffs2: cannot find inode(uImage)
### JFFS2 load uImage error(0)
## Booting image at 80700000 ...
Bad Magic Number
HKVS #

RS-232 interface fix

The bootloader is U-Boot but the console did not work. It would print the above messages but did not accept any input. After investigating this I found out that the RS-232 interface receive path seemed to be broken so I replaced the SP2020EEN chip that was responsible. After this the boot process could be stopped and the U-Boot console accessed. Some discovery follows:

Home UPS

Mon, 01 Jan 0001 00:00:00 +0000

Overview

A UPS which can power my entire home is built using a Schrack GENIO Online USDD400 UPS connected to four customized stock battery boxes. The battery boxes are retired APC SYBT5 which originally are 120 Vdc nominal and contain 10 x 12V 9Ah sealed lead-acid batteries. The total energy capacity of one unit is a little over 1kWh.

HV DC side

Battery boxes

A single SYBT5 battery box can be seen below:

IBOX FMT2BT Car FM transmitter

Mon, 01 Jan 0001 00:00:00 +0000

The device

This is a "cup-shaped" car FM transmitter that supports:

bluetooth speakerphone
MP3 playback from microsd
MP3 playback from USB sticks

It's OEM'd by IBOX (https://www.ibox.pl/akcesoria-samochodowe/2050-fmt2.html) and available in many electronics stores in Poland.

The internals

The internals consist of only 1 PCB with all of the connectors and buttons. There is a vertically mounted 5 V power supply which has been unsoldered to make better view of the board. The board has "AD-BT-A23 V1.0" and "2016.11.21" silkscreened on it. The PCB photos with all of the important parts highlighted:

In-situ 18650 heater cell detection

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

This is the documentation of some experiments I performed in order to ascertain whether it's possible to detect cells generating excessive heat (aka "heaters") in a diy 18650 battery pack built using the popular 5x4 20.2 mm pitch 18650 cell holders. All of the findings should be applicable to bigger cell arrays as well.

tl;dr

By using an array of LM75 temperature sensors attached to one side of a 18650 cell pack abnormal heating of a single cell to a temperature of at least 50 deg Celcius results in a measureable (2 deg C) temperature anomaly which may allow for heater detection before a major pack failure has chance to occur.

Liitokala Engineer Lii-500 Automation

Mon, 01 Jan 0001 00:00:00 +0000

Overview

The Liitokala Engineer Lii-500 is a universal chemistry 4-cell smart charger manufactured by the well-known Liitokala brand. It is very popular with people building battery packs out of second life 18650 Lithium-Ion cells because of its reasonable price and discharge capacity testing feature (NOR TEST mode). I own a number of those chargers and I use them as part of my cell assessment workflow. What I have found however is that entering cell capacity values reported by the charger manually into a computer is both a bit tedious as well as prone to mistakes. Therefore I have made attempts at automating the process by modding the charger.

Luna Drone

Mon, 01 Jan 0001 00:00:00 +0000

This is a description of my attempts at hacking or improving the Luna Drone.

The drone is powered by a 7.4V 2S LiPo 1800 mAh labeled as "FOREVER" with no specific model number. The battery size is 70x35x20 mm with a weight of 94 g. The connectors are JST for discharge and JST-XH for balanced charging using a generic li-ion plug-in charger.

When I got the drone the battery was badly swollen so I needed to order a replacement one. A good candidate was https://www.aliexpress.com/item/32850087307.html. The size is almost identical, the capacity is a bit smaller (1500 mAh vs 1800 mAh in the original one) however I have my doubts whether the original capacity was indeed as high as on the label.

Megacell Charger

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

This page gathers independent information about the Megacell Charger focusing primarily on the communications protocol used between the Megacell Monitor and the Megacell Charger with the purpose of creating custom automation.

All of this information has been independently discovered, later to be found documented on MegaCell Monitor Wiki. The "wiki" here is unfortunately not editable and may disappear at any time so the information here is likely to stay relevant as a backup.

Netgear ReadyNAS RN3138

Mon, 01 Jan 0001 00:00:00 +0000

Hardware

The Netgear ReadyNAS 3138 is a 1U rack-mounted NAS server with 4 3.5'' SATA drive slots. I have recently purchased such a device in order to use it as a small home fileserver and decided to play with it a small bit before placing it in production use on the network. The manufacturer part number on the sticker that I got was RN31843E which indicates, that the NAS was originally sold with 4 x 3TB disks inside (https://www.cdw.com/product/NETGEAR-ReadyNAS-Rackmount-4x3TB-Enterprise-Drives-RN31843E/3921155). I got it empty however so it's just a plain RN3138.

OnePlus One

Mon, 01 Jan 0001 00:00:00 +0000

This is a description of the OnePlus One phone.

History of this item:

Timestamp	Event
2015-12-11	Purchased on http://www.allegro.pl/ for 1190 PLN

Paperworker

Mon, 01 Jan 0001 00:00:00 +0000

Rationale

The paperworker project is a simple and cheap paper document scanning solution to handle all of my incoming paperwork. I generally feed all of the incoming papers into the machine and then just pick up the small amount of paper documents that I actually want to keep. After a significant amount of paper collects in the machine I get rid of it in bulk.

Hardware

First, a photo of the completed device:

PZEM-016 energy monitor

Mon, 01 Jan 0001 00:00:00 +0000

PZEM-016 is a 100 A capable single-phase power and energy monitor from Aliexpress. The interface is MODBUS over RS-485 and is documented here. It can also be used with openwrt's MODWRT (here). There are examples for Arduino. Apparently the meter is not isolated.

Second Life UPS

Mon, 01 Jan 0001 00:00:00 +0000

Design overview

I have decided to build a UPS that would power my home network equipment rack using lithium-ion 18650 cells.

First let's lay out some basic design considerations

should fit the equipment rack in a 1U format
it should provide 12V DC, 5V DC as well as 230V for the switch

The current list of devices that need to be powered by the UPS together with their nameplate voltage and current consumption information:

Second Life UPS Mark II

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

The Secondlife UPS Mark II was envisioned as a successor to the Secondlife UPS Mark I model with the following improvements:

increased battery capacity
increased power budget
circuit simplification
modularity
improved load connectors
various other usability improvements (for example moving the fuses to the front of the enclosure)
better documentation

The basic premise is to provide a short depth (~250 mm) rack mountable UPS which instead of 230V AC can provide typical low voltages suitable for powering of CCTV cameras, sensors, routers, 802.11 access points, modems, switches, embedded systems (like a Raspberry Pi) and other small devices. This approach is advantegous in terms of saving rack space where a PDU does not have to be mounted as well as potential power efficiency gains of having fewer AC <-> DC power conversion steps.

Shrack UPS USDD-R 400

Mon, 01 Jan 0001 00:00:00 +0000

This is a short note on the discontinued Shrack Genio USDD-R 400 UPS (EAN code 9004840378757). This is a tower or rackmount UPS with 4000VA of power that is currently used as backup in my house. It operates with a DC voltage of nominal 108 V_dc which is significantly higher than 12V or 24V in consumer grade UPSes but 10 AGM lead-cell in batteries in series does the trick here. Another nice thing that I found about this UPS (which was missing its internal batteries when I purchased it) was the BATTERY EXTENSION connector on the back.

TH-35 (DIN rail) mounting brackets for 18650 cell packs

Mon, 01 Jan 0001 00:00:00 +0000

The rationale

All builders of permanent DIY power wall batteries using refurbished 18650 cells need a way to mount the power packs into a rack or onto a wall where the battery will be deployed. For battery packs using the commonly found 20.2 mm pitch cell spacers/holders people have been using any number of ad-hoc solutions amounting to putting cell "blocks" on some kind of shelf or support and letting gravity do its work (for example here or here). I have initially considered the HBPowerwall 18650 mount to mount my cells but further research has pointed me towards a better solution - using TH-35 (aka DIN rails) and mount the cell packs on them. There are numerous advantages to using DIN rails:

The UFactory Uarm

Mon, 01 Jan 0001 00:00:00 +0000

The UFactory Uarm is an acrylic desktop 4-axis robot arm which was funded on Kickstarter. There is some information as well as tools on the manufacturer side (http://ufactory.cc/), however here I'd like to gather some of the less obvious pieces of information that I found while playing with this device.

uArm_Metal_Detail_Info&Specifications_en.pdf

uArm-Metal-Developer-Guide.pdf

These are both manuals for the metal version of the original UArm sold via Kickstarter. The second one (the developer guide) comes from the ufactory.cc site directly, but I decided to mirror it just in case.

Toshiba N554 mouse

Mon, 01 Jan 0001 00:00:00 +0000

The Toshiba N554 mouse is a Bluetooth mouse based on the Broadcom BCM2042 chipset.

Some information gathered on the net about this chipset:

A Bluetooth mouse reference design using the BCM92042MDX-B88 module

A different mouse reference design with more details, a BOM and PCB layout images

The Toshiba mouse seems to use this particular module, at least the layout looks very similar.

Toyota Corolla

Mon, 01 Jan 0001 00:00:00 +0000

It's my car. It currently hosts the whitestar equipment. It's a 2006 Toyota Corolla with a 1.4L Diesel engine. I have been collecting fuel consumption data for a while now and I have compiled a chart to summarize the fuel economy of the car as a variable of the average speed for each trip. This allows to easily distinguish between in-city and highway driving.

Also there is an MPG chart more useful for US-based viewers:

TTS Bee-Bot Unofficial Service Manual

Mon, 01 Jan 0001 00:00:00 +0000

TLDR

This is an unofficial "service manual" for the TTS Bee-Bot educational robot discussing common failures I've seen with it. Fixes to those problems are provided in the form of replacement part recommendations as well as replacement PCBs.

Metadata

A service manual (even an "unofficial" one) needs some kind of revision control. This is provided in the table below:

Date	Revision	Description
2024-01-01	1	Initial revision

Intro

The TTS Bee-Bot Programmable Floor Robot is an educational desktop robot geared towards teaching children simple programming concepts. The robot replays a sequence of movement steps (Forward, Back, Turn Left 90°, Turn Right 90°) which are programmed using buttons on its back. The robot provides audio and visual feedback for the child.

Vastra SS2 Smart Power Strip

Mon, 01 Jan 0001 00:00:00 +0000

Hardware

The hardware inside consists of (apart from the ordinary Schuko sockets) several PCBs connected together with JST XH and pin header connectors.

Boards

Board ID	Silkscreen	Notes
PSU1	SW3A-POWER V1.3
USB	SW3A-USB V1.3	Not used in SS2 model (no USB ports)
CON	SW3A-Control V1.3
BUTTON		Button and LED

Some photos of the boards:

CON Board (Controller)

Notable parts are 3 ADCs, a MCU and a Tuya WR3 wireless module. Summary below:

WH-SP-WS01 Wind speed sensor (anemometer)

Mon, 01 Jan 0001 00:00:00 +0000

Hardware

This is an anemometer for a very popular weather station sold on aliexpress (https://www.aliexpress.com/item/4001089508787.html)

The box is labeled that the anemometer is a wind speed sensor for WH2081 which is I assume the weather station model.

A different label on the back of the box:

It has an RJ-11 connector with a short cable:

Calibration

Aliexpress

The way in which pulses from the anemometer can be converted into wind speed has been documented in one of the aliexpress offers https://www.aliexpress.com/item/4000352147677.html

Whitestar

Mon, 01 Jan 0001 00:00:00 +0000

The whitestar project is my attempt at building a reliable and fully automatic wardriving equipment for permanent installation in my car. It's used to constantly gather 802.11 data for research purposes and contribution to the https://wigle.net crowdsourced WLAN map.

The overall architecture of the system is presented below:

The hardware

The whitestar is built around a kektop (NTT HOME W 300P net-top style PC) with an Intel Atom 230 CPU (1.6 GHz), 1 GB of RAM and a small 16GB internal SSD. The kektop has two wireless cards and a GPS connected via USB for wardriving purposes. There is also an ELM327 interface connecting to the car OBD-II port. Additionally, I figured I should store all of the data outside of the internal SSD to increase its life expectancy. For this purpose I connected a 2.5'' 500 GB USB hard disk. A laptop HDD was chosen because of better vibration resistance making it possible for it to actually survive working in a car for extended periods of time.

WRT-54G

Mon, 01 Jan 0001 00:00:00 +0000

Some notes about my attempts at resurrecting an old WRT54G v2.2 router board in order to use it as a managed switch.

Original firmware boot log

The original openwrt firmware on this device was ATTITUDE ADJUSTMENT (12.09, r36088)

picocom -b 115200 /dev/ttyUSB0                                                                     
picocom v2.2

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 115200
parity is      : none
databits are   : 8
stopbits are   : 1
escape is      : C-a
local echo is  : no
noinit is      : no
noreset is     : no
nolock is      : no
send_cmd is    : sz -vv
receive_cmd is : rz -vv -E
imap is        : 
omap is        : 
emap is        : crcrlf,delbs,

Type [C-a] [C-h] to see available commands

Terminal ready


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.

No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 216MHz
Total memory: 0x1000000 bytes (16MB)

Total memory used by CFE:  0x80300000 - 0x8043EB40 (1305408)
Initialized Data:          0x80338DB0 - 0x8033B160 (9136)
BSS Area:                  0x8033B160 - 0x8033CB40 (6624)
Local Heap:                0x8033CB40 - 0x8043CB40 (1048576)
Stack Area:                0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment:       0x80300000 - 0x80338DB0 (232880)
Boot area (physical):      0x0043F000 - 0x0047F000
Relocation Factor:         I:00000000 - D:00000000

Boot version: v3.4
The boot is CFE

mac_init(): Find mac [00:12:17:C7:39:04] in location 0
Nothing...

eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0:  hwaddr 00-12-17-C7-39-04, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3780 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sat Mar 23 16:01:31 UTC 2013
[    0.000000] CPU revision is: 00029007 (Broadcom BMIPS3300)
[    0.000000] bcm47xx: using ssb bus
[    0.000000] ssb: Found chip with id 0x4712, rev 0x01 and package 0x02
[    0.000000] ssb: chipcommon status is 0x0
[    0.000000] ssb: Initializing MIPS core...
[    0.000000] ssb: set_irq: core 0x0812, irq 4 => 4
[    0.000000] ssb: set_irq: core 0x0806, irq 5 => 5
[    0.000000] ssb: set_irq: core 0x0818, irq 6 => 2
[    0.000000] ssb: set_irq: core 0x0804, irq 2 => 6
[    0.000000] ssb: after irq reconfiguration
[    0.000000] ssb: core 0x0800, irq : 2(S)  3* 4  5  6  D  I 
[    0.000000] ssb: core 0x0812, irq : 2(S)  3  4* 5  6  D  I 
[    0.000000] ssb: core 0x0806, irq : 2(S)  3  4  5* 6  D  I 
[    0.000000] ssb: core 0x0818, irq : 2(S)* 3  4  5  6  D  I 
[    0.000000] ssb: core 0x0817, irq : 2(S)* 3  4  5  6  D  I 
[    0.000000] ssb: core 0x0816, irq : 2(S)* 3  4  5  6  D  I 
[    0.000000] ssb: core 0x080f, irq : 2(S)  3  4  5  6  D  I*
[    0.000000] ssb: core 0x0804, irq : 2(S)  3  4  5  6* D  I 
[    0.000000] found parallel flash.
[    0.000000] can not parse nvram name (null)ag0(null) with value 255 got -34
[    0.000000] ssb: Sonics Silicon Backplane found at address 0x18000000
[    0.000000] gpiochip_add: registered GPIOs 0 to 15 on device: bcm47xx
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 01000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00001000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00001000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4064
[    0.000000] Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 64 (order: -4, 256 bytes)
[    0.000000] Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Primary instruction cache 8kB, VIPT, 2-way, linesize 16 bytes.
[    0.000000] Primary data cache 4kB, 2-way, VIPT, no aliases, linesize 16 bytes
[    0.000000] Memory: 12856k/16384k available (2540k kernel code, 3528k reserved, 379k data, 168k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS0] enabled
[    0.004000] Calibrating delay loop... 213.50 BogoMIPS (lpj=427008)
[    0.044000] pid_max: default: 32768 minimum: 301
[    0.048000] Mount-cache hash table entries: 512
[    0.060000] NET: Registered protocol family 16
[    0.124000] bio: create slab  at 0
[    0.144000] Switching to clocksource MIPS
[    0.184000] NET: Registered protocol family 2
[    0.188000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.200000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.208000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.212000] TCP: Hash tables configured (established 512 bind 512)
[    0.220000] TCP reno registered
[    0.224000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.228000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.236000] NET: Registered protocol family 1
[    0.256000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.264000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.276000] msgmni has been set to 25
[    0.280000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[    0.288000] io scheduler noop registered
[    0.292000] io scheduler deadline registered (default)
[    0.300000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.328000] serial8250: ttyS0 at MMIO 0xb8000300 (irq = 3) is a 16550A
[    0.356000] serial8250: ttyS1 at MMIO 0xb8000400 (irq = 3) is a 16550A
[    0.412000] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 3) is a 16550A
[    0.444000] serial8250.0: ttyS1 at MMIO 0xb8000400 (irq = 3) is a 16550A
[    0.460000] bcm47xx_pflash: flash init: 0x1c000000 0x02000000
[    0.468000] Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000089 Chip ID 0x0088c5
[    0.480000] Intel/Sharp Extended Query Table at 0x0035
[    0.484000] Using auto-unlock on power-up/resume
[    0.488000] cfi_cmdset_0001: Erase suspend on write enabled
[    0.496000] bcm47xx_pflash: Flash device: 0x2000000 at 0x1fc00000
[    0.500000] bcm47xx_part: bootloader size: 262144
[    0.508000] bcm47xx_part: Looking for dual image
[    0.516000] bcm47xx_part: TRX offset : 0
[    0.520000] 4 bcm47xx partitions found on MTD device Physically mapped flash
[    0.528000] Creating 4 MTD partitions on "Physically mapped flash":
[    0.532000] 0x000000000000-0x000000040000 : "cfe"
[    0.548000] 0x000000040000-0x0000003f0000 : "linux"
[    0.564000] 0x000000133c00-0x0000003f0000 : "rootfs"
[    0.568000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.592000] mtd: partition "rootfs" set to be root filesystem
[    0.596000] mtd: partition "rootfs_data" created automatically, ofs=310000, len=E0000 
[    0.604000] 0x000000310000-0x0000003f0000 : "rootfs_data"
[    0.620000] 0x0000003f0000-0x000000400000 : "nvram"
[    0.640000] bcm47xx_sflash: error registering platform driver: -19
[    0.648000] bcm47xx_nflash: error registering platform driver: -19
[    0.656000] b44: Broadcom 44xx/47xx 10/100 PCI ethernet driver version 2.0
[    0.668000] b44 ssb0:1: eth0: Broadcom 44xx/47xx 10/100 PCI ethernet driver 00:12:17:c7:39:04
[    0.680000] BCM47xx Watchdog Timer enabled (30 seconds, nowayout)
[    0.692000] TCP cubic registered
[    0.696000] NET: Registered protocol family 17
[    0.700000] Bridge firewalling registered
[    0.704000] 8021q: 802.1Q VLAN Support v1.8
[    0.724000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    0.736000] Freeing unused kernel memory: 168k freed
[    5.548000] diag: Detected 'Linksys WRT54G/GS/GL'
[    5.636000] b44 ssb0:1: eth0: Link is up at 100 Mbps, full duplex
[    5.644000] b44 ssb0:1: eth0: Flow control is off for TX and off for RX
[    6.868000] roboswitch: Probing device eth0: found a 5325! It's a 5350.
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
[   14.956000] JFFS2 notice: (332) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 10 of xref (0 dead, 6 orphan) found.
switching to jffs2
- init -
[   15.592000] b44 ssb0:1: eth0: powering down PHY

Please press Enter to activate this console. [   21.600000] Compat-drivers backport release: compat-drivers-2012-09-04-2-gddac993
[   21.608000] Backport based on wireless-testing.git master-2012-09-07
[   21.616000] compat.git: wireless-testing.git
[   21.712000] cfg80211: Calling CRDA to update world regulatory domain
[   21.716000] cfg80211: World regulatory domain updated:
[   21.724000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[   21.732000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   21.740000] cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[   21.748000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[   21.756000] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   21.764000] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[   23.076000] b43-phy0: Broadcom 4712 WLAN found (core revision 7)
[   23.104000] b43-phy0: Found PHY: Analog 2, Type 2 (G), Revision 2
[   23.132000] Broadcom 43xx driver loaded [ Features: PNL ]
[   23.260000] Broadcom 43xx-legacy driver loaded [ Features: PLID ]
[   23.904000] PPP generic driver version 2.4.2
[   24.724000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   25.200000] NET: Registered protocol family 24
[   25.272000] nf_conntrack version 0.5.0 (203 buckets, 812 max)
[   31.264000] b44 ssb0:1: eth0: Link is up at 100 Mbps, full duplex
[   31.272000] b44 ssb0:1: eth0: Flow control is off for TX and off for RX
[   40.020000] b44 ssb0:1: eth0: powering down PHY
[   40.108000] b44 ssb0:1: eth0: Link is up at 100 Mbps, full duplex
[   40.112000] b44 ssb0:1: eth0: Flow control is off for TX and off for RX
[   40.180000] device eth0.0 entered promiscuous mode
[   40.188000] device eth0 entered promiscuous mode
[   40.208000] br-lan: port 1(eth0.0) entered forwarding state
[   40.212000] br-lan: port 1(eth0.0) entered forwarding state
[   42.216000] br-lan: port 1(eth0.0) entered forwarding state
[   52.004000] b43-phy0: Loading firmware version 666.2 (2011-02-23 01:15:07)
[   52.224000] device wlan0 entered promiscuous mode
[   52.372000] b43-phy0: Loading firmware version 666.2 (2011-02-23 01:15:07)
[   56.936000] br-lan: port 2(wlan0) entered forwarding state
[   56.944000] br-lan: port 2(wlan0) entered forwarding state
[   58.948000] br-lan: port 2(wlan0) entered forwarding state



BusyBox v1.19.4 (2013-03-14 05:29:29 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 ATTITUDE ADJUSTMENT (12.09, r36088)
 -----------------------------------------------------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@lazengann:/#

New firmware

I tried to build a new firmware from openwrt trunk, unfortunately the b44 ethernet driver did not work in openwrt stable kernel 4.19.

ZKETECH EBC-A20 Battery Tester

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

The ZKETECH EBC-A20 is a battery tester with integrated charging and discharging circuits. Its basic capabilities are:

voltage range when discharging 0 - 30 V
voltage range while charging 0 - 18 V
charging current range 0.1 - 5 A
discharge current range: 0.1 - 20 A

The device is pretty popular and there are multiple places where a manual can be downloaded with more detailed specifications. The focus of this article is the control and monitoring interface provided by the battery tester

A Certain Magical Index

A Lithium-Ion Cell Precharger

The rationale

A random board of LEDs

Advantech LCD module

Intro

Archive

Avantree Audition

Brother DS-720D

Cubify Cube 3D printer

D-Link DIR-655 Wireless Router

Introduction

Hardware

Main parts

Connectors

J1 connector

Dell PowerConnect 2808

Introduction

Hardware

Main parts on PCB

Connectors

Serial console (J2)

DNS-320L NAS

Intro

Hardware

Edimax BR-6204Wg

Hardware

Enecsys Gateway CG-A-AB-US-1

Intro

Zigbee Radio

Enecsys SMI-360-72 Microinverter

Intro

Zigbee Radio

F&F MAX-MB-LI-4LO Modbus Pulse Counter

BOM

Reference information

Fred the Ripper

Rationale

Fronius Symo 6.0-3-M inverter

Interfaces

GOPHERT CPS-3205 II power supply

Hardware

HIKVISION DS-7316HI-S

Symptoms

RS-232 interface fix

Home UPS

Overview

HV DC side

Battery boxes

IBOX FMT2BT Car FM transmitter

The device

The internals

In-situ 18650 heater cell detection

Introduction

tl;dr

Liitokala Engineer Lii-500 Automation

Overview

Luna Drone

Megacell Charger

Introduction

Netgear ReadyNAS RN3138

Hardware

OnePlus One

Paperworker

Rationale

Hardware

PZEM-016 energy monitor

Second Life UPS

Design overview

Second Life UPS Mark II

Introduction

Shrack UPS USDD-R 400

TH-35 (DIN rail) mounting brackets for 18650 cell packs

The rationale

The UFactory Uarm

Toshiba N554 mouse

Toyota Corolla

TTS Bee-Bot Unofficial Service Manual

TLDR

Metadata