The USART-based bootloader is probably the most popular way of burning code to the AVR. The Arduino, for one, uses this method.

For example say you were using a FTDI cable to talk to your Arduino. First the USB connector end of the cable would go into your host computer. The other end of the cable .....

Read the Rest]]>

The USART-based bootloader is probably the most popular way of burning code to the AVR. The Arduino, for one, uses this method.

For example say you were using a FTDI cable to talk to your Arduino. First the USB connector end of the cable would go into your host computer. The other end of the cable would then be plugged into the appropriate header of the Arduino. The RXD line from the FTDI cable now connects to the AVR’s TXD pin. The TXD line connects to the AVR’s RXD pin. In this way, the software serial interface on the host computer is converted down to its wire line equivalent for communicating with the bootloader on the AVR. Even the USB versions of the Arduino burn code effectively the same way – that is they still use a USART-based bootloader.

But how do you reset the AVR so you can drop it into the bootloader and burn your code? One way is to use a third wire from the serial port, namely the DTR signal wire, to do it. The Arduino places a capacitor between the DTR signal and the AVR’s reset pin and its pull-up resistor. When the DTR line is toggled a pulse is generated causing the pin to go low and the AVR to be reset. Your own personal AVR circuits can be designed to use this method as well, using a pull-up resistor and capacitor.

However, this requires three wires, not including ground, as well as code on the host computer to toggle the DTR signal.

Instead of using three wires, the circuitry illustrated above uses only two: the TXD and RXD wires. With this circuit the AVR is reset whenever a modem break is sent over the host’s TXD line. The RST line goes directly from the 556 to the RESET pin of the AVR with no pull-up or capacitor in between.

When prototyping saving one wire might not be worth it, but if your microcontrollers were to be remotely controlled or placed a good distance away from each other saving a wire might come in handy. In addition your development board no longer needs either the pull-up resistor or the capacitor.

Here is a command sequence that you can use to reset and burn the AVR with this reset method. Note, the ~# escape sequence sends a modem break over the serial port.

$ echo ‘~#~.’ | cu -l /dev/ttyUSB0 -s 9600
$ avrdude -c avrisp -b 9600 -P /dev/ttyUSB0 -p m328p [hexfile]

Unfortunately the ‘cu’ command is slow to return the command line, so the alternate technique below is recommended.

$ echo ‘~#~!avrdude -c avrisp -b 9600 -P /dev/ttyUSB0 -p m328p [hexfile]‘ | cu -l /dev/ttyUSB0 -s 9600

Have fun!

Yours sincerely, .....

Read the Rest]]> Okay, this is my first post on the HackHut blog-worklog thing. I’ll post some of my previous projects later and I will be adding descriptions about my current work too. It will mainly involve robotics, electronics and some other machanical stuff. Everything you can do out of junk using soldering iron, welding equipment, angle grinder, screwdriver, saw and knife.

Yours sincerely, Volt

I was looking into purchasing one of the all-in-one MIDI keyboard, knob controller, drum pad jobbies. There are a few models out there, but the axiom 25 looked cool, and seemed right. I had read about their .....

Read the Rest]]> (Sorry no pictures, my camera batteries were dead. And once I am in the zone – its hard to stop and find more batteries.)

I was looking into purchasing one of the all-in-one MIDI keyboard, knob controller, drum pad jobbies. There are a few models out there, but the axiom 25 looked cool, and seemed right. I had read about their problem of the drum pads becoming unresponsive, but I took a chance.

I found one on ebay for really cheap. The description was that it did not communicate with a computer.
“A ha!” I thought “Probably a broken USB jack! easy fix…” Or the USB to serial circuit was fried. Well, I bid on it, and won it. Including shipping -$50!

I received it, plugged it in, and the computer saw it right away. Hmmm…
I started up MIDI-OX to see what was happening. Only a few of the keys were responsive, and only two pads were responsive. Uh-oh.

Seeing as I used to repair keyboards for a living, I opened it and and jumped in. The keyboard is pretty standard. No broken bits of plastic. I unscrewed the keyboard assembly to get at the key contacts.
Once I stripped them off their pegs, I wiped them down with rubbing alcohol. Then popped them back on using a toothpick to push the rubber tabs back in to the holes.There was a lot of dirt, hair and grime I cleaned of the bottom of the keys too. That can interfere with there operation too.

MIDI-OX reports that all the keys are functional now! Onto the pads.

The drum pads are resistive pads sandwiched between sheets of plastic. I could not see anything broken or damaged. However, I noticed that the flex ribbon cable looked dull. I disconnected it and felt the contacts. Its just paint – it rubs off! Very cheap, M-audio! Well, that could explain it. And, if there were any cracks in the paint, I doubt I could see them. But, the good news is, I know how to fix this!

More paint! Yes – paint, “copper paint” to be exact. Pray tell, where do you find copper paint at 7 o’clock at night? The answer is: an auto parts store! I bought this stuff: Permatex 15067 Quick Grid Rear Window Defogger Repair Kit at a CarQuest store. Most parts stores will carry defroster repair kits, but don’t go to O’reilly , they still sponsor Rush Limbaugh (hey, its my blog).

This stuff was $12.99 at the store I went to. Not the cheapest, I am sure. But, considering I can get it now, and its less than the $20 replacement part that you supposedly can order form M-audio, it was worth it. Another option would be going to Radio Shack and buying a circuit trace pen. But again, its $20.

What to do:
1) Shake up the vile really well.

2) get a tooth pick, or two.

3) DO NOT USE the brush that comes with it. It is not fine enough, and you get get paint all over.

4) Instead use the TIP of a toothpick to dip into the paint. It won’t do you any good to get the whole toothpick full of paint!

5) Dab the paint on the thicker part of each trace on the flex cable – just the top side.

6) LEt it dry 5-10 minutes. Check continuity between traces, or visually inspect for bridges of paint.

7) Push cable back into connector. This will be a little harder because of the friction of the paint, but it will go.

Fire up MIDI-Ox or some other MIDI monitor/ program. Make sure each pad has a different MIDI note number and that the same MIDI note number shows up in the NOTE ON / NOTE OFF category. I had a bridge between two of mine and it showed the numbers of the bridged pads interchanged.

In less than an hour you are done!

During a long phone call with a good friend I got an interesting idea. There’s a company that offers modules for almost all BMW models with which you can turn them into your own custom light .....

Read the Rest]]> Besides investing mildly into new hardware to keep me able to waste my time I also did some real hacking, or at least prepared it.

During a long phone call with a good friend I got an interesting idea. There’s a company that offers modules for almost all BMW models with which you can turn them into your own custom light organ. Want to blind people randomly bu putting on the high beams when unlocking it? Just program their 150 bucks module to do so. Yes, people are buying such stuff and pay big money. While I understand that for some generations where BMW used a proprietary IBus interface for all their comfort modules I’m a bit surprised there’s no competition for this for CAN bus based models. Also, there’s no one offering such nonsense for other manufacturers.

Yeah, you get it!

As there is a nice Mercedes Benz in my garage I got the idea to tap into its interior CAN bus and try to fool around there a little. Before you do something like that you should have an idea of what you are about to do and how the stuff you’re going to interfere is working. So let’s take a little lesson on the CAN bus.

Basically in the automotive world most manufacturers use a two wire CAN bus, several of them. The common car has at least three. One for the OBD II diagnosis port that is just present for this reason and provided by the main control unit for the engine. It features some standard messages for diagnosis purposes but is practically limited to that. The second is the actual engine bus that’s used by the important systems, like engine, transmission and security systems. The third is the interesting one, used for everything that’s not highly mission critical, like lights, radio, AC, seats and such. The engine and interior CAN are, at least for most Mercedes cars,  loosely connected by the instrument panel (or however you call this thing in English). The instrument panel is connected to the engine bus and and the interior bus and acts as a bridge for certain kinds of messages, like speed or steering wheel position. What exactly it bridges and what not I’ll have to find out.

So we now know the topology. The CAN used for the engine is typically 500kbit, while, at least for older interior buses, 125kbit is common. But how does that whole CAN shenanigans work?

First, it is quite a bit different than the usual bus and network connections you know from computers. It features a different concept of addressing and also arbitration and collision management. Physically it is a bus of two wires with, iirc, differential signaling on those two lines and a 60Ohm termination, one 120Ohm terminator on each end. Signaling voltage is, iirc, again, something about 5V. To provide a constant clock for all devices on the bus, you’ll see why this is more important than elsewhere, in case nobody feels like talking bit stuffing is used. Ones and zeros get signaled by pulling the voltage down or leaving it, the actual signal is the voltage level, not the change of voltage signals. So three times a one is long low signal (or if I mix it up a long high signal). Therefore after more than 5 times the same bit one inverted bit is sent to ensure the devices stay in sync with their idea of what the clock signal is.

So how does addressing devices work?

Not at all! CAN devices have no device address. The protocol consists mainly of message IDs and payloads for those IDs. So if you want to talk to a specific device on the bus, you need to just send a message with the appropriate ID. If you want to listen to everything a certain device says, you need to know all message IDs it uses. This scheme is actually quite beneficial for tapping into such a bus, as there’s no way for any other device to detect the presence of a listener or to distinguish between messages sent by two devices. If my device uses the same message idea as another one, nobody on the bus has an idea of that. The only option would be that devices listen to the IDs they use themselves to see if anyone else uses them.

How are collisions handled?

Whenever you have a bus and especially if it is half duplex you have to somehow handle situations where more than one device wants to say something. You might know that for Ethernet it’s basically that when two start talking both shut up and try again after a random timeout. That’s done for a reason but it has one big downside. There is no guarantee that anything can be sent in a finite amount of time. Yeah sure, practically and such, but in theory you can solve this in other ways. You could e.g. have a master, like the USB host controller or cell towers, assign time slots and manage it this way, but that would not be too fail safe, as you would at least have to define what happens if the master fails. Your options for this are, in short, failure or complex stuff.

CAN does not have a collision detection approach, but a collision resolution approach. Message IDs not only distinguish between different  kinds of information, they are also responsible for determining priority of a message. The higher priority message always wins during the arbitration period and gets transmitted, while the lower priority message is held back and has to be transmitted later. Now we’ll see why a steady clock signal for all participants is important. If two participants want to send a message, they start at the same time and also listen to the bus. While both send the same bits, they have no idea whether someone else is also sending or not. Once a bit differs, one has to pull the bus low and one has to leave the level to signal the opposite bit. The one who leaves the bus alone sees it being pulled down, backs off and loses arbitration. The other one, and anybody else on the bus, has no idea that there ever was someone else intending to send and just goes on. The fact that one bit has to differ is determined by ensuring that all devices use different message IDs for sending.

So this way you can avoid congestion for the cost of delaying or suppressing messages with lower priority. This makes perfect sense in an automotive environment, where you can live with an increased latency or loss of unimportant information. Who’s gonna care about how high the latency for the power window button is when your anti lock brakes are in effect? And besides, I already mentioned power windows and such are separated from the critical bus, so it would maybe be something like adjusting ignition timing when you’re currently sliding in a 90 degree angle with ESP trying to keep you from acting like a dreidel. And I’m also sure the capacity of the engine CAN is high enough to not have any relevant latency even in this case.

So what does this tell us in regard to reverse engineering a Mercedes interior CAN?

A lot. For one it tells us to better get hardware that handles the CAN protocol itself, at least for the start. Implementing it with a normal microcontroller should be doable, at 125kbit and 5V signaling level, but that would be a mid sized project in itself. If you wanna do it really good and make sure signal edges and such are clean enough to be within specs and not just clean enough to be just working with whatever you have it would likely be a pretty big project.

Another thing is that we can assume Mercdes kept to the idea of using message IDs for priority. So chances are this can give us hints decoding messages. I’d guess the brake light gets preferred over the buttons to control the radio.

So yeah, I’m gonna get my hands on something that can tap the CAN bus sooner or later and see what I’m able to decode and understand. My current preference is something based on the ELM327 chip, which, among other things, does speak CAN, handles all the bus details and not only has a UART interface, but also comes with a very detailed datasheet explaining a lot not only about the chip and its behavior, but also CAN itself.

Don’t get too excited, though, this is more a long term idea and not necessarily happening this weekend.

Until some weeks ago I was still using my trusty Fujitsu T4210/15 as my main mobile computer and the TC4400 slate I built myself also saw some use from time to time.  But the hinge of the T was obviously starting to show its age after .....

Read the Rest]]> No I didn’t die. My mother actually did, but that’s neither about tablets nor technology.

Until some weeks ago I was still using my trusty Fujitsu T4210/15 as my main mobile computer and the TC4400 slate I built myself also saw some use from time to time.  But the hinge of the T was obviously starting to show its age after more than half a decade of heavy use and abuse. The latter from me as much as likely from the previous owner. Trying to keep it alive was tried with different ways.

How to lube a Tablet PC hinge?

Classic lithium based grease and WD40 have both failed to act as a suitable lubricant for the hinge construction inside the display housing that is responsible for the opening and closing process. MoS2 grease wasn’t good either. The sound it made when moved with either of those was a little frightening to say the least. The thing that finally made it silent and feel good again was some bicycle chain oil I had lying around. Less watery than WD40 (here in DE WD40 is mainly petroleum, US WD40 might work well) and less solid than any of the other greases, while also being quite adhesive. None the less you could feel that the whole hinge construction was nearing the end of its useful lifetime under the conditions I exposed it to. So I decided to look for a successor and give it to my GF, who should have another year or two of fun with my T.

What to get now?

But what to get? It had to be a Tablet PC again. Normal laptop was not worth considering, annotating PDFs and using OneNote for all kinds of scribbling is way to convenient once you are used to it. A pure slate without a keyboard also was no choice. Handwriting recognition is really good, but its weakpoint to me is recognizing symbols and combinations unusual in normal language. Besides this is way slower than typing.

I looked around for some time and in the end the best bang for the buck was the very same ebay seller selling the very same TC4400 I had recommended to so many people. So I now have not just a TC4400 Slate, but also a normal TC4400. Getting was a ibt of a hassle as the first one I got was way worse then described, but after some encouraging calls I ended up with one that essentially looks brand new. No visible use of the keyboard or trackpad. The backlight also seems to be in a good condition (it’s CCFL, so gets dimmer and shifts color to a rose tint over time) and no scratches or signs of actual use anywhere. The only thing you can see and feel has been used a bit is the pen. What I paid? Including a secondary battery below 200€!

I thought long about getting something as old as this from a technology point of view. But in the end, I have no reason to buy anything newer as the additional performance from the CPU is not going to make it much faster and the other big point, battery life, also wouldn’t be substantially better unless I would buy something pretty recent. That would be roughly 5 times the money at least. For a real boost it would have to be Sandy Bridge which equals ~1400€+++, for essentially next to nothing.

How to hack it?

I’ve cursed this in the past and it has kept me from recommending or getting any Dell, IBM and HP hardware: BIOS whitelisting, blacklisting and all the like.

HP is big in this game, too. If you scroll back a lot here to the early days of this blog, you’ll find an article describing how I got around HP’s damned branding of a Wifi Link 5100 by rewriting the device ID and subsystem ID. They take normal hardware and have it customized with changes useless besides making it incompatible. And then they sell “their” cards for five times what the generic version is worth. Of course you can’t upgrade your Wifi too far even when buying their crap, better get something entirely new.

So yeah, the TC4400 of course also has BIOS whitelisting and refuses to take that very same Wifi Link 5100. Well, refused. I googled a lot and got into a thread on some forum where people where quite eagerly deciphering and reverse engineering BIOSes and among that was one for an NC4400, which is essentially the exact same with a different hinge and without a digitizer. After some time of delving into the topic I thought this should be doable. In addition I found out that there are ways to restore a bad BIOS flash easily, without desoldering anything or using JTAG. The damn thing can restore a bad BIOS flash from a USB diskette (!) drive.

It now happily accepts my Wifi Link 5100 and possibly anything else, too. I haven’t done too much myself, as I have to admit. I mainly ported a BIOS hack to a nearly identical other BIOS.

What the …?

I noticed a slight misbehavior of my newly acquired toy after its initial defloration, for replacing memory, wifi card and harddisk. The power light never goes out entirely. It merely gets slightly dimmer. Also, the battery gets drained about 5% per hour. In addition, when shut off or sleeping while connected to AC or a non empty battery it later shows very very weird symptoms on its LCD. On the left and right side entire horizontal lines of subpixels are constantly on, like dead pixels. On the upper and lower rim of the screen it’s just parts of the line. So a problem on the level of display memory or logic is out of the question, also it happens everywhere and is totally independent of picture content.

I have never seen this before. If you wait long enough those colored lines get more and ultimately the display has a border of too high brightness all around. How the fuck ?!?

Additionally there’s another quirk. If you disconnect AC and all batteries, inserting a battery will make it change its power state, rev up the fan but not show any image or do anything. You can switch it off again, but there’s no way to boot it. You have to insert the battery while it is on and connected to AC or a different battery.

Before you read on, try to guess what could cause this. Consider all you know about computers and their sometimes weird behavior. I would have never figured it out be mere thought if I would have been presented the laptop in this state.  As I had changed CPU, HDD, wifi and memory in one go I tried to change back the parts piece by piece after being sure to have no explanation which one of those could cause this.

It was in fact the Wifi card. Once it is pulled the power LED does not stay on for no reason and also inserting a battery is not a problem anymore. I have not found the time to fix this or further investigate how this works, but someone else with a very similar problem has told me that isolating all of the mini PCIe card’s pins that are unused or NC according to some pinout he found did fix the problem for him. I would have tried the same as a first step.

So, yeah. Once I tape up the wifi card’s pins I should be done setting this thing up and can just use it.

I’m separating the controller for the 7 channel audio selector as it’s own build… since it has issues of it’s own to note.

It’s using (from pc to micro logical view) a usb-to-serial converter and pic microcontroller. Also on the pc side is the interface app.

The usb-to-serial converter is a module from DLP design, which uses the FTDI’s FT232BM ic. This .....

Read the Rest]]>

I’m separating the controller for the 7 channel audio selector as it’s own build… since it has issues of it’s own to note.

It’s using (from pc to micro logical view) a usb-to-serial converter and pic microcontroller. Also on the pc side is the interface app.

The usb-to-serial converter is a module from DLP design, which uses the FTDI’s FT232BM ic. This is what I had from a while ago, and it still works nicely (haven’t blown it up yet). It allows the use of usb port with the microcontrollers on a pc without the serial/rs232 port. The module is connected in bus powered mode, so it doesn’t require additional power pin hookup. It only needs the rx, tx and gnd (for reference).  Since the module is already powered with logic level power, it spits out the serial information that way too. No additional level interface ic’s are needed, just plug in straight into the microcontroller of choice (at least in my case, since they’re both 5V logic).

The simples way to use the usb-to-serial converter on the pc side, is to open up the hyperterminal (or any terminal application). To get this working a bit spiffier (don’t ask), I whipped out a small vb app, using serial port.

I choose to go make a gui app for a few reasons (ranting commences a in a few).  Since I still haven’t gotten a handle on the C++ gui, i reverted back to the vb line. It seems that in their wisdom, m$ decided to add back the support for the serial port. I heard the rumors about it after vb6, but haven’t touched it since back in the day. The app was done with the free IDE vb2008express.  The commands that I choose to implement and the meanings will be noted a bit later on.

List recent sites wordpress plugin (80)
(just the app. it is assumed that there are no warranties or guarantees whatsoever. not releasing the source just yet, but should be easy enough to reproduce if you need something for yourself. good luck )

When the app starts up, if it’s 1st time in that location, and/or there’s no .ini setup file, it will create one, and fill it in with the defaults. This will also dump a few hidden settings, that can be manually altered/enabled. The information for the convenient explanation of what is connected to which port is stored in the .ini. It has to be manually edited to change it from defaults. This allows to have a way to alter the information displayed by the app, without recompiling the application.  (Hopefully this all makes sense, and it seemed like common sense that I would like to have.)

Another (raw) interface mode is the hyperterminal (or any terminal application), as mentioned previously. For that, simply type in a number, and you get a response. The annoying thing with the hyperterminal is that if you don’t care about the stupid modem dialup, and don’t type in some bs area code, it keeps on harassing you about it on startup. Then when you want to exit it, it keeps on annoying you even more about ‘are you sure that you want to close the connection?’. Well no shit, I clicked the exit button for a reason. Also, there is no indication/reminder what do you have connected where, as opposed in the app. Anyways, enough ranting for now.  As mentioned, the command set is noted later.

Lastly, the end of the line interface is the 16f628a microchip pic microcontroller. I have been using this guy on and off for a while now, and had a few still around. In order to minimize power use but not setting it totally in the sleep mode with interrupt wakeups, I set it to run with it’s internal oscillator at 48kHz. This works nice, since it’s still responsive, but I haven’t confirmed the power draw difference yet. The downside to this choice is that the uart is clocked off the ic’s main oscillator… Long story short, I got it to communicate at 300 baud rate. It took some tweaking to the spbrg register, compared to the calculations, but for what I need, it works. With the setup as is, there was just enough i/o pins to get it all done for this version and implementation of the overall project.

[Download not found]
(the compiled code to run on the microcontroller. no source just yet. compiled in the microchip’s new mplab-x ide. hope it works for you )

This ic has 18 pins, so roughly the i/o implementation is as follows:

• 2   – power (vcc, and gnd/common)
• 2  – uart (tx, rx, and tap to gnd)
• 7  – input switches, pulled high with external resistors. went with port A, since mclr/reset is on there, and can be used as input only.
• 7  – outputs, spread across remaining port A and port B.

Also the appropriate pins are tapped for the ICSP header. But to use that, it’s a good idea to disconnect the relay connections, so that the relays don’t go chattering to the programming serial/data streams.

The whole set is here

-Inexpensive

-Good looking

-Kinda reliable

-Really nice mechanical interior,fun to watch and show

Ok so now,everybody know that often,cheap good looking stuff can’t be reliable.

So upon receiving 3 of em, I wondered just how accurate they were at keeping time….

First obvious point : why don’t you set them and just check the next .....

Read the Rest]]> So, a couple weeks ago I’ve ordered some mechanical watches on eBay,why?

-Inexpensive

-Good looking

-Kinda reliable

-Really nice mechanical interior,fun to watch and show

Ok so now,everybody know that often,cheap good looking stuff can’t be reliable.

So upon receiving 3 of em, I wondered just how accurate they were at keeping time….

First obvious point : why don’t you set them and just check the next day?  It’s pretty simple,they are mechanical watches,if you don’t wear them,they won’t crank back up and stop pretty quickly. If you wear them 12h/day,they will last forever.

So, a device of some kind was needed to check the Accuracy…

Unfortunately, I’m not at home,where I would have used an arduino to do data acquisition and count up the “ticks” on a definite time length.

Then I got an idea : my pentax WG-1 GPS has a pretty cool intervalometer built-in that can take pictures every minutes for a long period…why not use it to gather “stroboscopic” images of the watches running, if they are accurate,the seconds counting hand should stay still while the minutes and the hours go on.

Second Obvious point : What tells me that the camera is accurate?

Solution was to make a first “video” at 1min intervals of a Real time clock,the only one I could find near me was an online website : http://atomicclock.org/

Here’s the video of the snapshot taken of the clock :

Click here to view the embedded video.

As you can see,it’s pretty darn accurate,somewhere about 0,2 s.

From that point,I was ready to go on and test those :

Here is the resulting video:

Click here to view the embedded video.

Analysis base on a timescale of 2hours and neglecting the camera’s error:

Watch #1 :

Lost 2 seconds

-2/7200 = -277.778E-6 seconds

Error of -0.02777 %

Error for one day : -24 sec

Conclusion: Pretty accurate.

Watch #2 :

Gained 14 seconds

14/7200 = 1.944E-3

Error of 0.19444%

Error for one day :  2 min and 48 sec

Conclusion : Not accurate enough

Watch #3:

-2/7200 = -277.778E-6 seconds

Error of -0.02777 %

Error for one day : -24 sec

Conclusion: Pretty accurate.

General conclusion:

It is clear that W1 and W3 bears the same clockworks thus have the same error minus the variations in springs.

So this is how you find out about watches guys. Don’t get scammed,I’m returning W2 to the supplier. I have to time to waste.

Hope you like it!

(it’s avaialable for download,look in the youtube info under the video!)