Thursday, October 20, 2016

Recovering data from broken screen Android phone - alternative

I was tasked with the issue of getting contact data from a broken Android phone (in this case Xiaocai X9). The touchscreen was functioning erratically, the display was blank, adb/developer debug was not enabled.
I've tried for some time to enable debug by dragging randomly on the screen, making a screenshot (hold down volume key + power) and trying again but gave up after an hour or so.
So: broken touch, broken LCD, no adb.

Tuesday, August 23, 2016

Designing a better diesel tuning box - part 4 - improved design results

If you are following the project you might've seen that the new source code for the firmware and (Android) client application are up:

Arduino firmware: https://github.com/ligius-/DieselTuningBox
Mobile UI: https://github.com/ligius-/DieselBoosterClient

With that out of the way, I've had about a month of testing with the new prototype and several months already with the old one. The definitive result is that there are significant fuel savings.

Outside city limits I now get better than 6L/100km, at highway speeds (130 km/h) better than 6.5/%. I believe the highway consumption can be further improved but I haven't used the car so much lately to be able to fine-tune the settings.




Previously I would get 7.6L/100km at best on country/county roads and 7.4/% on highways. So that would be a 12% mileage increase on highways and 21% on slower roads.

Inside the city is where the story changes since that's where I did most of my driving and had time to tune the parameters. I am now getting an average of 9L/100km (actually better) compared to 11L stock or 12.5L with RaceChip. So that's 18% mileage increase from stock and 28% increase from RaceChip..




Why such a difference?

The issue is a bit more complicated and I found it related to matching between sensor output impedance and ECU input impedance. That's why the improved prototype has provisions for adjusting this. On my car, with the default 'Arduino' circuit I need to set the offset correction to -50mV and gain correction to +3% in order to match the factory settings.
I doubt any of the aftermarket solutions account for this and is the reason why I get such poor city mileage with the commercial tuning unit.
The commercial units are likely ok at higher rpms since the gain correction is built-in (part of the tuning) and the offset error becomes insignificant.

The app


Building a mobile app was a great idea since it allows me to connect to the module, adjust the settings on-the-fly and save them.

I would probably redesign it now since I know now the usage pattern: adjust gain and offset once, play with the curve point gains indefinitely, save them. Currently the gain and offset are the biggest UI elements since the majority of the improvements can be achieved through those.

The 'Apply immediately' checkbox is also really useful as it allows the user to play with the values without having to hunt for the 'Apply' button. As soon as some settings are changed the application waits for a while (1-2s) and sends the new settings to the car.

It's cool showing the phone to someone and watch the consumption modify as you play with the values. A bit silly, but makes for a 'wow! never thought this would be possible' moment.

















Adjusting the individual gains however is a bit tricky to do while driving (or stopped for that matter) since they are quite small and a lot of them.


























I opted to add +/- buttons on the sides of each point setting instead of the classic numpad editor which is impossible to use at the wheel.

The app will also helpfully highlight the currently selected point (in blue) so you can see where the engine is at.

With the 'Apply immediately' feature it's just a matter of tapping '-' and wait 1-2s and see the effect.

Speaking of effect, the whole concept now seems a bit wrong to me - you are adjusting the END value not the START value so anything that you've adjusted affects where the next value will be. E.g. if you adjust the value for 200 (ADC = .244V) to lower it by 10% the ECU will compensate and now the new value will be 200+10%. I cannot explain this properly in words but I'm working on the EFFECT rather than the CAUSE.

Another interesting issue is that the engine does not run well at very low fuel rates, regardless of the setting. As long as the stationary consumption is above 0.7L/h the engine sounds fine, as soon is it goes below that it starts shaking. The 'solution' is to raise the consumption back by putting it in gear or starting A/C. So a 'cold engine' tuning should be different than a 'warm engine' one since consumption decreases as the engine warms up (emissions-related). At 0.4l/h the engine shakes badly.

Speaking of shaking, the automatic gear shift is not so smooth anymore since it's probably hand-tuned for specific torque values.

I haven't noticed any significant loss of power but I'm not the street racer type.

Future


I'll probably stop working on this project for a while and deal with the other pending projects since I think the goal was achieved.

I would like to integrate real-time reading of OBD2 values: fuel rail pressure (PID 59?), engine RPM (PID 0C), oil temperature (PID 5C), fuel rate (5E) and vehicle speed (0D). This would allow better data logging and perhaps some auto-tuning, through the app.

Would be nice to have a separate control module with real buttons and knobs instead of a smartphone.

Would be nice to use the internal Arduino temperature sensor to select different curves or values depending on ambient (engine) temperature. It should be good enough for most purposes.

Would like to find out if there is any damage that can occur when setting an extremely low consumption. I'm using the engine sound (smooth, rough, shaking, ...) to tune the settings now but I don't actually know why it's behaving like that since the rail pressure is well within parameters.

Tuesday, August 2, 2016

Cost analysis of a Lexmark inkjet printer

Six years ago I bought a Lexmark Pro205 all-in-one printer, one of the few affordable ones that had WiFi. This has proven a disastrous investment, so let's go quickly through the numbers:

  • purchasing price (10 Mar 2011): 140 EUR
  • black cartridge replacement (21 May 2012): 12E
  • full ink refill set (21 Dec 2013): 18E
  • full cartridge replacement (25 Mar 2014): 13E
  • full cartridge replacement (12 Mar 2015): 12E
In total 195E, there might be other expenses as well.
Electricity costs are not included and the printer is not very economical in standby.

Printed pages - as per printer counter - 691. I would estimate the total number of usable pages to be ~200, out of which ~15 were full-color photos. This is because most of the pages from beyond number 80 had streaks and the printer required at least 50 deep cleaning cycles. About one page in five is usable, but certainly not great.

So running costs until now are 1 EUR / page. That's definitely the most expensive printer I have owned.

In comparison, around 5 years ago I bought a Kyocera FS-1020D laser printer refurbished for 30 EUR. It has printed around 1000 pages with a discard rate of 1:50. That is, 1 in 50 pages came out bad because of the printer. So the running cost for this printer is <4 cents/page. No maintenance required other than the thermal fuse blowing out because it was sitting in an enclosed area (2h, see a recent article about fixing that).

Sunday, July 31, 2016

HackerX Frankfurt experience

This a departure from my normal subjects, but I don't have a blog dedicated to my software work.

I have recently attended the first HackerX instance in Frankfurt. For those who don't know, it's like a speed-dating event where potential employees and potential employers are face-to-face for 5 minutes, then the candidates (employees) rotate over to the next company.

Right off the bat I should mention that I did not receive my own invitation but I used one from a colleague. However the only difference is a missing email.

Tuesday, July 26, 2016

Blog updates July 2016

I was assuming that having some time off would allow me to update this blog more frequently but there is always something shinier.

Diesel Tuning Box (for lack of a better name)
I've tested extensively the latest iteration that does semi-automatic calibration and found no issues with the circuit itself. However there were many issues with the ghetto-style DB15 connector made using hot glue. Once I got the proper connector in it will stay in the car at all times.

The issue was caused by raised temperatures under the hood deforming the hot glue and leaving just a tiny contact patch that allowed very little current to flow in. Anything over 20mA would break the contact yielding 'check engine' errors. If you are fast, the errors go away when restarting the engine. If you are slow (>2 minutes) you need to reset the error using an OBD2 diagnosis kit. I used a bluetooth OBD2 connector (~12$) with the Android app Torque, while driving.
I'm testing these limits so you don't have to.

Otherwise, with the new software it has proven reliable enough and allows for realtime (while driving) control of tuning. However the serial interface has proven prone to error - while trying to insert comments in the log files my co-pilot inadvertently altered some settings. This will be improved by writing a phone app that will allow adjustment on the fly and saving of the log files. Currently still in the process of getting up-to-date with Angular2 and Ionic2, but I already have a working app. The source code - once final - will be published on my github page.

Printer repair
While doing the taxes my Kyocera FS-1020D laser printer died with a strange blinking error: the first three LEDs blinked slowly, then just the second LED blinked. After a bit of service manual hunting I found out this was error 6000 - fuser unit error.
It took a bit over an hour (including pictures) to work around the problem: the thermal cutoff  (fuse) was triggered which left the fuser lamp without power. I just soldered a wire between the fuse contacts since the printer already has a thermistor in place for monitoring and cutoff. Not 100% safe but I doubt it will start a fire. The fuse was rated for 157C, will write a detailed post once I find the time.

Odys Winpad V10
After an uneventful Windows 10 upgrade the tablet has been running fine with no significant drawbacks compared to Windows 8. To get the most battery life and keep the tablet cool I suggest setting the wireless connection to metered: this will stop the automatic updates and maintenance.
I also cut the cord from the power supply and attached a standard USB male connector to the tablet end and a female connector to the other end. This allows me to charge it using any USB supply.
Battery life is between 6h under moderate load (frontend development) and 12h idle (while connected to HDMI). To get the most of the battery I recommend turning on airplane mode whenever WiFi is not needed.

I scanned the steel paperweight inside the keyboard (230g) and looking for a way to replace it with some 1-2mm aluminium sheet. The new backplate would then be less than 75g, but some counterweights (~30g) might be needed to keep it from toppling over.

I have replaced/removed/re-soldered some caps inside the keyboard that made an annoying whine (5-15kHz). Just look for the biggest ceramic capacitors there and either resolder them to be less rigid or replace them with something of improved quality.
I have tried every other possible solution: using a strong glue to dampen them, changing orientation, adding some padding material - nothing except the above worked.

CTC 3D Printer
A gen 1 Raspberry PI was setup up as a remote web interface using OctoPrint. However there are many issues with it that prevent me from slicing files remotely (including the rPI speed). It also requires an OctoPrint restart whenever a job is cancelled, so it's far from ideal.
I installed the SailFish firmware on the printer and it has proven a huge benefit: the temperatures and speeds can be altered in realtime, allowing for example to print the first few layers slowly and the middle ones twice as fast.
I have been unable to use Simplify3D on it, currently MakerBot seems the best option.

Li-Po powered compressor
For my bikes I have to check the tires pressure quite often and this poses several problems: I don't have a nice high-pressure pump, it takes quite a while to bring racing tires up to pressure (8 bar) and it also takes a lot of energy. So I made a connector that has on one end alligator clips and a female XT90 connector and on the other end a 12V automotive (female) socket, the ones used for cigarette lights. With a cheap (15EUR) compressor I can now check and adjust the pressures in just a few seconds and can use either a 3S LiPo battery or a small motorcycle (or UPS) 12V battery.

Monday, May 23, 2016

Designing a better diesel tuning box - part 3 - simplified design results

As I wrote in the previous article, the barebones design has been through some basic testing - 500km mixed environment driving - and has been mostly successful so far.

I had a suspicion that the output impedance of the circuit must somehow match a known impedance, but was not sure which. The clue was that the RaceChip unit raised city consumption by 5-15% even though it had no effect during the bench testing.

Here's a datasheet for a similar Bosch pressure sensor:
http://rb-aa.bosch.com/boaasocs/index.jsp;jsessionid=A20738712FCFB9E51CA919DD7D2F9E91.sundoro2?ccat_id=275&prod_id=516

For testing they are using a pull-up resistor, so on the input side of the ADC the same circuit must be simulated in order to drive the sensor. I used a 10k resistor, but perhaps even the internal pull-up could work.

At the DAC/PWM output I found out that a 1.5k resistor was too large and could not sink the ECU input line low enough. With a 10ohm resistor it seemed to work fine, perhaps 47ohm would also be ok. I don't have a definitive value yet as I want to implement it in another way.

The initial barebones circuit used an Arduino Nano (v2?) without RTS/CTS lines on the serial port. This means that on startup, the bootloader takes around 2 seconds until it jumps to the main loop. The car does a basic check and reports the sensor as faulty. The solution: turn the ignition off and immediately back on, before starting the engine. This is because there is a 30s delay from ignition off until the systems are powered down, at least on my car. It's also a nice anti-theft measure, the thief can only drive with reduced power, I think around 20%.

Consumption


Idle consumption with my unit is now at 0.5l/h when warm, compared to 0.8-0.9L/h stock, 0.9-1.1L/h with RaceChip. So >30% fuel savings while idle.
The idle is a little shaky if unloaded, runs smooth if some load is added (A/C or in drive gear). Incidentally, with the unit disabled but in-circuit, the behavior is almost the same (0.6L/h) which means the input/output impedance is mismatched.

Highway consumption yielded a 5.7L/100km average on one trip, and then 6.3l for the return trip, so I would say a 6L/100km is achievable. Stock was around 8L, with RaceChip around 7L. I think that's pretty impressive, 25% highway mileage increase - see updates at the end of the post.



Here are the settings used during the test drive:



Power


Torque is lower, but still adequate for day-to-day driving. I measured a stock 0-100km/h time of 8s, I would guesstimate now it's 10-12s. The car had no issues reaching 170km/h so there was no reason to do more tests, for now. My goal is improved mileage, a target of 1300km with one tank.

Findings and improvements


As I wrote above, the input/output impedance is really sensitive and there is no way to get a precise setting for each car. So my next step would be to design another simplified circuit with a relay. The relay would initially pass the sensor line to the ECU while de-energized, and use the Arduino 'passthrough' if energized.
During the calibration phase the Arduino would sample the input at the relay while it's off. When turning on, it will check if the input is the same through it's own circuit; if not, it will calibrate the input. It will then measure its own output and compare it to the input, when no modifications are applied. It will then save the output calibration constant.
Either way, there should be at least two trimmer pots or perhaps digital  pots, 1-15k for the input pull-up and 10-100ohms for the output. Of course the RC constant of the output filter is also affected by this.


Firmware


There was an error in the Arduino playground EEPROM snippet, it reads a byte (0-255) and compares it with a char (-128 to 127) which fails the verification on values larger than 127.
I found the need of storing several curves inside the EEPROM, perhaps number 1 should be the default and have another 5 or so for testing (focused on power, consumption, city, highway etc).

The curve size of 10 points is a bit too coarse, perhaps I will increase it to 20 points.

Source code still at: https://github.com/ligius-/DieselTuningBox

'Packaging'


I've used a plastic food container to house the circuit. The plug was molded with hot glue as I cannot find any DB25 in my parts bin and still cannot source the original connectors. Bluetooth reception from inside the car is ok.







The small circuit board provides the input pullup, RC output filter and a way to probe and connect signals. I had to change its layout and components many times, which is why it looks like it has survived a war.



Update December 2016


In September I've had some problems with the DPF which caused me to initially suspect the custom module. However it turned out to be just a bad sensor that had to be replaced.
At that time I also took careful measurements of the consumption and found out that the OBC display was erroneous - the actual consumption was higher than reported.

I was worried that the increased consumption could flood the DPF causing costly repairs with seemingly no added benefit. However, I took the car to a dealer to have the real DPF soot measured and it was within nominal parameters (i.e. <6 grams).

I've since removed the module from the car but haven't done a lot of driving so without a definitive consumption baseline it's hard to tout any benefits. So far, stock, I'm getting 9L/100km in mixed driving and 12-15L in heavy traffic. I will need to do more precise measurements when refueling to see if that is a real value. If that is indeed a real value then the saving of the module is probably not 25% but still could be above 10%.

I need to see if I can access some real fuel flow data through OBD instead of the one derived by the OBC (which probably uses the rail pressure in addition to the flow meter).

TL;DR: the OBC display is way off sometimes and I cannot confirm any measurements. No negative side-effects have been observed.

Thursday, May 5, 2016

Designing a better diesel tuning box - part 2 - simplified design

There are many variables needed to get a reliable product, so while taking a break from the ISO automotive requirements I thought of playing with a barebones design - just an Arduino, an HC-05 module and perhaps a few passives.

Concept - this is similar to what the boxes on the market do - read the value on ADC, output the modified value with PWM. I'm using an Arduino Nano for this, took about half a day including the 'preview' spreadsheet.

Nano pinout:

  • Vcc to sensor supply (5V), from ECU
  • GND to sensor ground
  • A0 the output from the sensor
  • Pin 9 goes to ECU (former sensor data)
  • TX goes to RX of HC05
  • RX goes to TX of HC05
Notes:
A0 should probably be pulled up to Vcc through a 1k resistor, I haven't tested this yet. Perhaps the Arduino weak pull-up would work.
Pin 9 (PWM output) should go through a resistor and capacitor connected to ground, 1k with 0.3u looks good in my tests.




The first two pictures show the Android phone connected to the HC05 for sending commands and receiving telemetry. The third one is the Arduino terminal on the computer running at the same time. While HC05 is serial data can be sent to the computer but not from the computer.

The user settings can be stored in the internal EEPROM.

After proving that the concept works and is fairly reliable (in a non-automotive environment) I took the time to make an Excel sheet (actually, OpenOffice) to chart the input versus output and compose the serial configuration string.


Regarding serial, the arduino sends each second a status with raw input and raw output. This incidentally also blinks the white LED (on pin 13) so you should see a bright flash if everything is running fine.

A tighter loop - every 10ms - reads the analog input and adjusts the PWM output. By default the output is sent unmodified (i.e. module is inactive), to get it to enable you need to send 'e' via the terminal. Conversely, send 'd' to disable it. While enabled, the LED will light up with a low duty cycle.

Terminal commands:
  • e - enable offset ('boost' car)
  • d - disable offset (do nothing)
  • rm - reads the minimum value from which the module starts working
  • rM - reads the maximum range
  • rc - outputs the entire configuration (version, min, max, curve points)
  • sm - sets the minimum range. Example: input sm300 - press enter
  • sM - sets the maximum range. Example: sM800
  • sC - sets a point on the curve. E.g. sC5117 sets point five to value 117. This means that during that specific range the output will be offset above by 17%
  • sX - sets the entire configuration in a single string. Can be generated by the spreadsheet
  • S - saves the config to EEPROM
  • L - loads the config from EEPROM, overwriting the current one
I won't provide a detailed explanation on how this works, just play with the green numbers in the spreadsheet to see how the output (blue) changes and whats the 'gain' (red) compared to original.

There is no error checking, no failed user input protection, no electrical protection, no watchdog protection and absolutely no warranty.

Other things: the PWM output is running at 60kHz, I think since the original sensor has a 2ms response time this could go unfiltered to the ECU. I assume they are filtering it there. The bootloader adds a startup time, ~5s, that could cause the ECU to trigger an error if it expects something during that time. I don't think it does.

To get you started, the minimum signal (while powered) should be 0.5V, the absolute maximum should be 4.5V, the car idle voltage should be around 1.2-1.5V. In my example above, the idle voltage is increased (to lower fuel consumption while idle) while during the other active ranges the voltage is decreased (adding power).

Power consumption is 25-50mA.

Edit: initial live tests

I got the engine light on (blinking coil) but the engine did start. The values I was expecting were a bit different than the real ones. Got an ADC value of 243 (1.18V) for engine idle (~780 rpm) and 256 (1.25V) for 1000 rpm.
It seems that the bootloader startup delay might be interfering with the ECU expectations (see above) or a pull-up resistor is required somewhere. Will have to do some measurements to determine the exact cause.

Monday, May 2, 2016

Designing a better diesel tuning box - part 1 - I/O board

As seen from my previous post and the sources enumerated in it there are several competing designs on the market that basically achieve the same thing - apply a negative offset to the rail sensor voltage.

Since none of them offer a desirable amount of control (for the price) I'm open sourcing an own design.

Goals:

  • full programmability - curves, upper and lower threshold limits
  • telemetry
  • reasonably fail-safe
  • MCU agnostic - as far as possible
  • preserve the original waveform signal
  • easy to make - should not require exotic or expensive components

The overall architecture is simple: read sensor data into the microcontroller, process the signal, send an analog (PWM) signal out.

Disclaimer: this is probably not road-legal in many countries (missing certifications) and it might break the car subject. I am not responsible if anything bad happens, do it at your own risk.

However, it's not all dark, as I've already written there should be no damage as the unit still functions within factory settings and I will try to make everything as safe as possible.


In this first part I will focus on the driver electronics: concept, simulation, schematic and (perhaps) PCB. Since this is just a prototype I'm currently omitting protection circuitry.

Simulation


The improved concept I came up with is applying the negative offset through an opamp subtractor. This way, if the microcontroller ceases to function the unmodified signal will be sent back to the car ECU.



The simulation above provides proof of concept: the yellow trace is the output from the pressure sensor, the blue trace is our modified signal that gets sent to the ECU.

Saturday, April 30, 2016

Racechip tuning box - part 2 - reverse engineering

See my first article for a short review and teardown:
http://hackcorrelation.blogspot.de/2016/02/inside-stuff-racechip-car-tuning-thingie.html

First off let me start by saying I consider this fair use, as the instructions and website do not explain what the settings do, how the unit actually functions and what effects it can have. The description below refers to a single-channel Diesel engine (single common rail).

Settings

First off, most of the users will just want the simple explanations, here's a graph that should be in the manual:



The chart above shows 4 possible settings and their effects.
The first rotary encoder controls how much 'extra power' is requested. See 9E vs. BE vs. 4E
The second rotary encoder controls the RPM high range (endpoint). See BE vs B7.
The encoders go from 8 (minimum) through 9, A, B, C, ..., F, 0, 1 ... 7 (maximum).

Tuesday, April 26, 2016

Ricoh GR sensor dust cleanup

I bought a cheaper-than-usual Ricoh / Pentax GR APS-C camera on ebay that had a few minor issues.

One of the most visible ones was dust on the sensor, so I will show you two methods that I've used to clean it up - the hard way first, followed by the easy way.

First, to get the position of the dust spots a shot was taken with F/16 against a white background. The exposure was manually set to be as high as possible (while still retaining information), pre-focus was set to the closest position (macro).

The resulting image was then adjusted in Irfanview (Auto adjust colors) to get the highest contrast.

F/16, 1/3s, MF to closest position

Preparation


You need a very clean room, no dust, have a dust spray available and preferably wear gloves to avoid getting fingerprints.
All parts that cannot be cleaned after assembly (LCD cover backside, LCD, sensor) should be placed facing down on some lint-free material.
While removing the screws take note of their length, color and thread style.

The hard way - removing the sensor


Removing the back cover


First you need to remove the large rubber hand grip. Start from a corner and slowly peel it away, trying not to stretch it. Do not remove the two screws visible below, near the lens, it's not required.


Wednesday, April 6, 2016

Odys Winpad V10

In search of a cheap and light notebook that I can use it for light tasks - such as Udacity courses and connecting lab equipment - I stumbled upon Odys Winpad V10 on offer at Amazon.
While the Lenovo Miix 830 seemed like a good deal at the moment it suffers from poor battery life, limited USB connectivity while charging and lack of keyboard+touchpad. Most Bluetooth keyboard with trackpad on market now have issues and are overpriced, so the Odys seems like a good fit.

This is a short review followed by a look inside the 'docking' unit.

Initial impressions


The unit is very heavy for its size, ~670g for the tablet and ~670g for the keyboard. The keyboard/touchpad base does not contain any other batteries or peripherals.

Battery life is pretty good, I got >6h for light work and the battery bar estimated >14h while idle and connected to the HDMI output with the tablet screen off.

The built-in touchpad is pretty bad - the bottom touch area is reserved by the left and right mouse buttons. Internally, they are triggered by a single switch ('clickpad') so the unit knows whether the left or right button is pressed by the touch position. Two-finger scrolling is a fixed feature and cannot be disabled or modified - the scroll direction is 'wrong', i.e. the Mac way.

The keyboard has good feedback, the keys have little sideplay and touch-typing is pretty comfortable. The layout is almost standard (Macbook-based), with the arrow keys controlling Home/End/PgUp/PgDown using the Fn modifier. No backlight unfortunately.

Sound is abysmal, the speakers are tinny and directed towards the back. The bass response can be improved with the free APO Equalizer and the latter issue can be worked around by cupping your hand on the side of the unit so the sound is 'redirected' towards you.




The 10" IPS screen has a good color reproduction and viewing angles. I've ran a 3-hour calibration procedure using an i1 Pro calibrator under dispCalGui and there were no discernible corrections.
At the minimum brightness the screen is too bright for night use so I use f.lux to work around that.

WiFi connectivity is spotty, but works decent enough (54MBps max.) when no USB is attached. However, when a USB mouse or other peripheral is used on the OTG port the WiFi drops out every couple of minutes for a few seconds. This is consistent and I haven't found a way around it.

The overall build quality is pretty good, there's no flex to any parts of the unit. Not surprising, given that the tablet part has a solid piece of glass and the base part is a solid piece of metal.

The charger (5V, 2.5A) is small, has a 90-degree plug with a standard connector. I haven't measured the time it takes to charge from empty to full but should be around 5 hours with no use.

The aspect is pretty utilitarian and old, reminding of the first-gen Atom notebooks (eeePC) with a fingerprint-happy grippy texture. The hinge requires a great amount of force to fold, impossible to do one-handed.


Performance is the same as expected with Atom Z3735F units with 2GB of RAM. I haven't upgraded to Windows 10 and don't intend to. Suffice to say that it seems to run fine for basic office tasks and the occasional light games. Frontend web development (nodejs, Chrome dev tools) run decently.

Inside


I did not bother taking apart the tablet unit as I assume it would be identical to the Miix 3 teardown I did earlier since it has the same hardware. At 670g the tablet unit has a better screen-to-weight ratio than the Lenovo and seems to provide a better battery life.


The base comes apart by removing the 4 visible screws plus another 4 screws hidden beneath the rubber feet.

The sheet metal backplate can be removed by messing with the 8 screws, 4 of which are located near the hinge.

The base [hinge] is connected to the tablet through some magnetic stubs and 5 pogo-pins.



I initially thought the pins are just a USB-passthrough but I now assume it's just an SPI extension port, with 3.3V power and signaling.

The base plate is surprisingly thick and heavy but serves several purposes: flex-free keyboard input, rigidity for the base when the 'laptop' is opened and transferring the load of the hinge to a larger surface area.



The rest of the base has a matrix-driven keyboard and the SPI(?)-driven touchpad going to one black blob.



The lower-left side has another metal plate, probably for adding weight so the laptop does not tip over so easily.

The lower-right side hides a magnet that signals the tablet unit when the clamshell is opened or closed.



Surprisingly, the keyboard has an additional backing metal plate:




At this point I've tried removing the thick sheet metal and found the unit was happy to work like this, except the touchpad. I was also worried that the keyboard might crack when opening the clamshell. However this brought the weight down to 1100g.

A close-up of the touchpad with a ruler, the two points would need to be connected with some other kind of plate in order to get the clickpad working again. For normal operation the touchpad can work with only touch input, so it's not really required.



The chip driving the touch input is a Cypress CY8CTMA140-LQI 2-finger capacitive sensing solution. It can function as an SPI or I2C slave but I assume it's used in SPI mode.
I don't have access to the full datasheet but it seems to provide the HID output while taking into consideration the clickpad button, so probably a reference design.
Unfortunately it cannot be configured (yet) in the way that Synaptics touchpads are.


By the way, the tension of the hinge can probably be adjusted by untwisting of the self-locking nuts located at the ends of the rotating rod.
However, you should find a way to lock them in place (Loctite) since the parts will eventually wear out.


Edit Feb 2017: I had made several changes to this unit

  • reduce weight of unit by dremeling(?) off parts of the keyboard backplate
  • reduce electrical noise of the keyboard dock (5-15kHz) by replacing or resoldering ceramic some capacitors
  • disabled W10 services like Defender, Telemetry, auto-update to improve responsiveness
  • used f.lux to decrease brightness at night
  • burned out the USB port with an Arduino - turns out the port is not protected, but there should be an extra one on the dock connector

Thursday, February 25, 2016

Fail: controlling a buck converter with PWM

I wanted a second try on my bench power supply build, something that would allow me to programmatically control the output voltage via an 'Arduino'.
The supply already has two buck converters inside the unit, both controlled by their feedback resistors, so it was only natural to try to create a programmable resistor.

Resolution

The feedback resistors are in the potentiometer with ranges a few kiloohms. Since I'd like the output voltage to vary within 0 and 30V with a 50mV precision the needed resolution is 30/0.05 = 600 steps. That means a way to vary the output with 10 bits (1024 steps). A cheap 8-bit DAC (PCF8591) would provide a resolution of only ~120mV.

We should not confuse resolution and precision, but I will break the rules for now.

Why a DAC does not work

Third, just a DAC is not sufficient as we need to have the feedback voltage adapt to the output voltage. We could feed the input through and ADC, sample it, calculate and output the correct DAC value but the latency would be ~1ms while the cheapest converter running at 100kHz is able to do it in 10 times faster. It would also keep the microcontroller busy a lot of the time with no time to draw the fancy graphics or respond to user commands.

Even if we choose that route, we would need to output a maximum of 1.25V (usual internal reference voltage) which means we would only use less than half the range. Yes, there are opamps - for scaling - or external DACs with reference voltage input but I'd like to keep this build minimal.

Digital potentiometer

There are quite a few of them on the market but they provide only 5-8 bits. Internally, they just switch a network of resistors. The also don't like high voltages on their input, generally going up only to 3.3 or 5V.

FET as a voltage controlled resistor

A select number of MOSFETS have a bigger linear region than the usual ones, but let's assume we don't have access to those. Let's pick a typical MOSFET that you would use in an Arduino project and try to work with that.

I'll jump right to the simulation results and try to explain what's happening:



V1, V3 and B1 form a PWM signal with V3 as a triangle generator (carrier) and V1 as driving main sine wave (modulator). B1 is a formula-driven power supply.
V1 is at 50Hz so we give all the components (capacitors) time to follow the output and recover, V3 and B1 work at 33.33kHz, fast enough to not make an annoying sound and slow enough that an Arduino can do it.

Here's a simulation on how the three waveforms interact, the blue trace is the triangle waveform, the green trace is the sine wave (zoomed in), the red trace is the FET gate driving voltage:



A detail of the PWM output with the sine wave zoomed out, where the red trace represents the gate voltage:



The keen eye might have noticed that we are driving the gate with 15V, which is way above what an Arduino can handle. That's because FETs like to be driven hard and don't work properly otherwise. So there's one showstopper.

Analysis

Let's go back to the main simulation and I'll walk you through all the details.



The green trace is the modulating sine wave (at 50Hz) and the full width of the window shows once period of that (20ms). The top of the window represents 100%, the bottom part is 0% modulation.

The blue trace is the output voltage, sampled at the far right of the schematic from the top of C4.

The red trace calculates the virtual resistance of the circuit by using a resistor divider formula. That means that the far left vertical axis should corresponds to the value in kiloohms (since R6 is exactly 1k).

We can see that the linear region is small and asymmetric: 7 to 8.2 milliseconds on the rising edge and 12.8-13ms on the falling edge (being generous).
The usable range, with calibration, would be for a PWM between 50% and 5%, but only on the falling edge. On the rising edge there is a discontinuity until 15% after which it becomes usable up to 40%.

If you were to put this circuit into your own analog circuit those nonlinearities would introduce a lot of noise, certainly not something you'd want in a power supply.

Circuit

The rest of the circuit is fairly straightforward :
R1 is the needed resistor for driving the gate and R2 the corresponding bleeding resistor. C1 smooths a bit the driving waveform, not too much.
I've chosen V2 to be 10V and R6 to be 1k so that the voltage divider calculations yield readable results.
R8 was chosen to be 47k as it gives a better output range and yields the maximum linear region in my testing. Probably because the current through it matches the current of the transistor in the linear region, but don't quote me on that.
IRFZ46Z was chosen because it had a low Vds (usually signals low Vgs as well) and a high internal resistance. And the fact that it was built-in into LTSpice.
C4 smooths the output voltage so that it displays nicely in the simulation.

Part 2 - trying it with a real converter


To be honest, I did this next simulation before the transistor-only one, but the message seems the same.

The circuit is based on the ubiquitous LM2596 chip and the common IRF510 transistor.
It has the same signal generating components but this time the FET gate is driven at only 10V, for a bit more realism.

The text on the left is the chip's model for Spice, stolen from a Yahoo group.



This time a more realistic load of 10 ohms is used.
You can ignore R4 and C2, those are there only for graphing purposes.
The input voltage (V2) is 10V but the results are similar for 30V.
R2, R3 and R7 were tweaked to their death until they have the best response.

The principle: R2 and R3*+R7 form the voltage divider that feeds the feedback pin on the converter. The chip cuts power when the input voltage on the feedback pin is above 1.25V and raises it when it goes below. R3 is then gradually shorted by the MOSFET, proportional to the PWM percentage.

Of course, there might be heavy oscillations between the V3 frequency (33kHz) and the chip frequency (150kHz), but without going into pole compensation and Bose Bode plots it should be ok for experimentation. Actually, some converters reduce their frequency to 25kHz in special cases, so there's something to think about.

Waveform




The green trace is the sinewave signal, the blue one is the voltage at R3 and C3.

We can see a big rise on startup when the output should actually be zero. Not sure if this is an artefact of the simulation or if it would happen in real life as well. I would bet it does. That pulse can be unhealthy for any device that's connected to it.
The pulse gets larger if the load is smaller or the input voltage is higher or the gate driving voltage is higher -that means lighter loads (like a microcontroller) would see the full input voltage (30V) for almost half a millisecond.

There are serious discontinuities at the 6ms and 14ms mark, but that's to be expected, we're doing this cheap.

What's not that great is the big spike at the 10ms mark. At this point the feedback voltage is zero volts which means the converter either has to restart or gives up trying to regulate. The overvoltage is measured to be almost 30%.

Conclusion


While not a great way to do experiments, simulation can tell you if things are going to be horribly wrong. Since it uses mostly ideal components it is also biased towards optimistic results - reality is almost always harsher.

I think there's no way to do this reliably with a minimum number of components. You'd have to give up accuracy (and safety!) or perform linearity calibrations or use some kind of additional feedback.
Forgot to mention that this kind of supply will not go lower than 1.25V.

You can use a multiplying DAC, but the complexity of that is out of scope for this article.

Or you can just use one of the many tried and tested microcontroller-based power supplies, but their complexity is an order of magnitude larger if you start to consider pre-regulators as well.

Even if you manage to build one fast and cheap you'd still have to test it only to find out it has problems with varying loads, noise or bad start-up performance. Or that it makes audible noises depending on load and output voltage. Or that in certain combinations it locks up and blows itself or your circuit under test.

To sum it up

If you are a beginner just buy a decent power supply - even a 30USD one is fine - and a decent soldering iron. These are the kind of projects you don't want to get started into unless you can deliver better than the commercial offers.
The Korad KA3005P supply is ~100EUR and offers USB control as well.
If you absolutely cannot afford any of these just scavenge an LM317 and add a potentiometer to it (no Arduino, please). It's still cheaper to just buy 5 of these.

Friday, February 19, 2016

Inside stuff - Racechip car tuning thingie

I bought my unit half a year ago, so you can say I have plenty of experience using it. It functions as a man-in-the-middle between the ECU and the injectors. I believe it alters the injectors' on-time and perhaps even the timing with regard to the TDC.

See also: http://hackcorrelation.blogspot.de/2016/04/racechip-tuning-box-part-2-reverse.html

Short review


I wanted to lower the consumption of my 3L V6 diesel engine to slightly more frugal values, don't care as much about power. Sure, some extra low-end torque would be nice as I feel my particular car is lazy in shifting up.

Well, to my surprise, the unit actually does something, so it's not just a random box a la OBD-tuners. By the way, you cannot tune an engine through OBD, the engine protocol is filtered out by a gateway. Just some diagnostics are allowed through.

The highway mileage improved from 8L/100km (30 US MPG, 35 UK MPG) to less than 7L/100km. With the default settings (the unit can be adjusted) the low-end torque has also improved, as it was pretty sluggish under 1700 rpm.
However, the city consumption went up from ~10L/100 (23 US, 28 UK) to 12-14 liters, quite a bummer. More interestingly, the engine idle consumption increase was the noticeable one, going from 0.8L/h to 1.2L/h, that's the fuel you use while stuck in traffic or at traffic lights.

Sunday, February 14, 2016

Essential Android software for power users

Similar to my Windows tools post, this one focuses on tools that make life a lot easier - on Android - or help you pinpoint and troubleshoot problems.

AdAway

If you cannot live without an ad blocker, this is probably the best one to use. Requires the F-Droid store.

Root Explorer

Quite expensive at 4 USD but I think it's worth the money - if you have root that is.
You can find files, pack/unpack archives, change permissions, move stuff around, handle multiple tabs and work with SMB and FTP shares, Google Drive, Dropbox.
There might be some free alternatives (ES File Explorer, Root Browser) around but at that time (~2012) there weren't many tools like this..

Titanium Backup

Another paid tool, even more expensive (6 USD, I might've paid less) but I've used it hundreds of times. It does require root as well.
You can back up an almost complete state of your phone/tablet and restore it to another device.
The backups can be shared between accounts, so you can restore a purchased program with complete settings on another account/device.
I run a weekly backup and just dump the complete contents of the internal and external sd cards to the NAS. Later in time I delete obsolete backups, but they are really handy when things go wrong or if/when you lose your phone.

ColorNote

A TODO app that is lightweight, free, has only the needed features and syncs across devices. I just wish it had web access.

Terminal Emulator

Kill processes, change permissions, run top or logcat and do generic *nix stuff. Hard to use without a real keyboard, but it's not the application's fault. Hacker's keyboard helps though.


Micro CPU Monitor

See in one glance whether something is eating up the CPU. Then open up the developer tools, check 'Show CPU Usage' and see who is at the top. Or open terminal emulator and start killing stuff. Has saved my battery many times in spite of hanging applications.

Nova Launcher

You've spent days setting up your desktop icons and widgets - then you install an update or switch to a another phone and everything is gone, because the new phone uses a different launcher. This is the solution to that and provides other nice features.

Samba File Server

Access your phone's storage as a network share. Handy if you don't want to connect it to a computer or you have automatic backup scripts running on a NAS machine.

Soft Lock Screen

Remove the wear and tear on that power button.

Honorable mentions:
Hacker's Keyboard - add arrows, modifiers and function keys to the keyboard
Alarm Clock xTreme - if you have trouble waking up this is for you
Pocket - share web pages between devices. Can cache them for offline viewing
RealCalc - a decent scientific calculator
SecondScreen - adjust HDMI output parameters: resolution, overscan, DPI, ...
Trickster Mod - play with max/min CPU frequencies and schedulers, see actual sleep time
Google Translate - the picture translate mode is really useful, when it works. Real-world scenario:

VpnRoot - can create a VPN connection without enforcing security on your phone
QuickDic - an offline dictionary, useful when abroad with no internet connection.

Thursday, February 4, 2016

I2C, Energia, Stellaris Launchpad and HT21D

A friend asked me to help him connect the HT21D temperature and humidity sensor to a TI board.
He's using the TM4C123 board while I'm using the older LM4F Launchpad.

The first thing to know is that neither of the boards have pullups adequate for I2C. You need to add a 4.7k resistor from SDA to VCC and another one from SCK to VCC. I've tested it with 1k resistors and it works with those as well.

The second thing is that the Stellaris boards have several I2C modules, so you need to select one. Even worse is the fact that the Energia library by default chooses the Boosterpack:


if(i2cModule == NOT_ACTIVE) {
  i2cModule = BOOST_PACK_WIRE;
}

So you first need to go into this folder "\hardware\lm4f\libraries\Adafruit_HTU21DF_Library-master\" and edit two files as explained below.

Adafruit_HTU21DF.cpp
From:
boolean Adafruit_HTU21DF::begin(void) {
  Wire.begin();

  reset();
To:
boolean Adafruit_HTU21DF::begin(int moduleNo) {
  Wire.setModule(moduleNo);

  reset();

Adafruit_HTU21DF.h
From:
  boolean begin(void);
To:
  boolean begin(int moduleNo);

In the example file
From:
void setup() {
  Serial.begin(9600);
  Serial.println("HTU21D-F test");
  if (!htu.begin()) {
    Serial.println("Couldn't find sensor!");
    while (1);
  }
}
To:
void setup() {
  Serial.begin(9600);
  Serial.println("HTU21D-F test");
  if (!htu.begin(0)) {
    Serial.println("Couldn't find sensor!");
    while (1);
  }
}
Instead of begin(0) you can choose whichever I2C module you'd like, the LM4F has 4 of them.
The Wire::begin() function does not need to be called since the setModule() function will call it. But if you want to use the device as a slave, you need to call begin(slaveAddress).


Fixing an RF socket, coffee machines and other stuff

This is somewhere between a tutorial and a rant about the X2 self-healing capacitors.



The above cap seems fine and measures within spec but the appliance it's set into does not function correctly. In this case it was an RF socket from Aldi operating on 433Mhz. The LED would turn on but the load wouldn't. There was only a small click from the relay. From a set of 4 pieces, 3 have failed in the same way.
Sometimes, switching to a lighter (LED bulb) or heavier (washing machine) load would make the problem go away for a few weeks or even months.

A [Philips] Senseo Coffee machine failed to turn on - the red light would turn on for less than a second and then switch itself off.

A Philips drip coffee maker would turn on initially but turn itself off when starting to heat the water.

The common issue in all these cases was the X2 cap, replacing it cured the problem. So if you have the above symptoms just try swapping the capacitor with a new one and see if it fixes the issue. If you would like to understand why, read on.

Saturday, January 30, 2016

Modifying a dual USB charger socket

I bought a cheap pass-through socket with 2 USB ports from Pollin. The blue LED is too strong at night so I modified it, see below for the "before" and "after" pictures. Obviously, the unit is photographed with the mains socket missing, that's not how it actually ships.




The charger is rated at 1A and in my experience is able to provide more than that. It's actually one of the few non-dedicated chargers in the house that is able charge the iPad without triggering a warning on the screen.

Since it doesn't come [directly] from China it's likely built to a decent standard.

By the way, the part number was "94-351077", but it's not on stock anymore.





 The output is based on a THX202H SMPS regulator with decent specifications. The datasheet for that IC shows a reference circuit for a 5V/1A supply, which is what I guess they used here.





The underside shows quite a bit of rework happening: it looks like most of the SMD parts were manually soldered and the right-side USB socket as well. Judging by the quality of the soldering job I'm worried there might be a few cold joints and solder blobs waiting to fall and short-circuit the board.

Other than that, the separation between mains voltage (240V) and the low voltage side (5V) seems adequate.

The resistor that seems responsible for setting the LED current is R6 with a marking of 102, thus a value of 1 kilo-ohm.

I just desoldered that and put into its place a 10k resistor instead from my parts box. Probably any value between 4.7k and 47k will achieve similar results.

As you can see from the second picture, even with a 10 times less current the LED is still plenty bright.

Wednesday, January 27, 2016

AEG MC 4455 repair and mod

I bought this unit as broken for what I thought it was a good price, ~10 EUR while the retail price is around 50 EUR. Since I usually buy stuff that's DOA (Dead on Arrival) the fix turns out to be most of the times a cold soldering joint or a blown capacitor.

But first, in case you haven't bought one, here's a

Quick review


I'm surprised that in this day and age manufacturers still produce units without an auxiliary input, such as the one pictured below.


It claims to have 10 Watt output (maximum), infrared remote, can play MP3s from a CD or USB stick and has a radio. Let's review all of that, again:

The 10 Watt audio output is produced by a SJ2038 chip which can provided a maximum of 2x3.5W into 4 ohms at 5 volts with a THD of 10%.

The speakers are 6 ohms which would mean probably around 2x2.8W output at 10% distortion. Probably less than 4W for decent listening.

To be fair, for such a low power the speakers sound decent, much better than all of the cheap Bluetooth portable speakers out there.
The minimum volume is too loud for nighttime listening, as all Amazon reviewers are complaining. Also the blue backlight is annoying at night.

There is audible hum and hiss during quiet sections at all volume levels. I thought I could also hear quantization noise from the DAC, but I'm not such an audiophile.

While playing MP3 the entire disc or stick needs to be scanned which can take almost one minute. That's the case will all cheap system-on-a-chip MP3 players. During songs there is a significant seek and buffering pause. Before and after the seek phase above, the amplifier is disconnected and reconnected, resulting in a loud pop.

I haven't received an IR remote with my unit but I was able to 'create' one on my Galaxy S5 using the MyRemocon app and the Samsung LX-6000 preset. There's a lot of functionality that's only accessible using the remote control.

The radio has decent reception but is slow to scan and has again an audible pop while switching between stations.

Conclusion: there are much better units out there, probably for even less money. It does look nice though. Save your money and buy something else.

Repair


My unit came with the CD drive not functional, missing remote and it also would not read USB sticks. The USB port was as well not receiving any power.



Left side is the front panel with LCD, on the right is the main PCB, power supply at the bottom, amplifier at the top, not visible because of the MP3 decoder and CD driver carrier board sitting on top of it.

Notice the white 2-pin large connector in the middle-left part of the main board - it's the regulated power output for the entire unit, providing 5V. In a comical twist, the red wire is the ground while the black one is positive. You can see the carrier connector (center and above) has the correct labels.

Since I don't want to mess with 220V the first thing to do is to solder some wires that provide a safe 5V supply. Green is positive and blue is negative for the extra thrill of mismatching the polarity: