Forfatter Mads Chr. Olesen

25 maj


Ford 3000 Tractor Instrument Voltage Stabilizer – Mechanical PWM!


Some time ago we bought a nice used Ford 3000 tractor (3 cylinder diesel, Chief frontloader). It needed some work, and one of the items was a new wiring harness. After replacing all the wiring everything seemed to work fine, until one day all the instruments just died; this being a mechanical beast everything else kept working. After quite some investigation, I found out that the instrument fuse (the only fuse in the entire system) had blown. Replacing it just blew it again, so something was clearly wrong. This lead to taking out the so-called “instrument voltage stabilizer”, and disassembling it.

Apparently I had connected it in such a way that the arm had raised itself, and was now short-circuiting to the case. I had already ordered a replacement, but only got what was essentially a very expensive connection:

So, what was the mechanism actually doing, and is it essential? After some headscratching at Hal9k the conclusion was that it was essentially a mechanical PWM, with something like this diagram

When the switch is touching the terminal current is flowing from the battery (B) to the instruments (I), but also to ground (E) through the resistor wrapped around the switch arm, causing the metal in the switch to heat up and lift. This breaks the connection, whereafter the switch cools down, and at some point makes contact again. Beautifully simple mechanism! Bending the arm back into position essentially fixed the device, and gave this waveform

I have seen the function described online as “pulsating DC”, which is actually quite accurate. So, I re-assembled the stabilizer with some sealant, inserted in the instrument cluster of the tractor, and it has worked perfectly ever since.

The only question is why it is done this way, if just giving a constant DC voltage from the battery also seems to work? I haven’t looked into it further, but my best guess is that the instruments are using coils to move the dials slowly, and that the PWM will heat up the coils less. In conclusion: If your voltage “stabilizer” is broken, you can probably do without it, or quite easily repair it.

For reference, here are the resistance readings between B-E, and I-E:

Gemt under: Extern, HAL9k

Tags: ,

28 jan


Reverse engineering Aduro Smart Response


I have a fancy thermometer for my wood stove namely an Aduro Smart Response. The accompanying Android app basically shows a temperature graph, with guidelines as to whether the burning is optimal and when put in more wood. I have generally been content with the app: it is quite slow, but generally helps in more optimal burning. Recently however, the Android app has stopped working (something about connecting to a database), and this prompted me to start on a project I wanted to do for some time: get the data from the Smart Response unit into a database under my control.

The Smart Response unit uses Bluetooth Low Energy, and is powered by 3xAAA batteries (my batteries lasted for a year before replacing). Connecting to a BLE unit from Linux is quite easy, at least from the command line:

$ sudo hcitool lescan
LE Scan ...
B4:99:4C:25:12:B2 (unknown)
B4:99:4C:25:12:B2 Aduro demo
$ sudo hcitool lecc B4:99:4C:25:12:B2
Connection handle 3585
$ sudo gatttool -b B4:99:4C:25:12:B2 --interactive
[B4:99:4C:25:12:B2][LE]> connect
Attempting to connect to B4:99:4C:25:12:B2
Connection successful

hcitool is used to create a connection/pairing. gatttool is used to query the device interactively. Thereafter the device can be explored, to see which “handles” are available:

[B4:99:4C:25:12:B2][LE]> primary
attr handle: 0x0001, end grp handle: 0x000b uuid: 00001800-0000-1000-8000-00805f9b34fb #Generic Access
attr handle: 0x000c, end grp handle: 0x000f uuid: 00001801-0000-1000-8000-00805f9b34fb #Generic Attribute
attr handle: 0x0010, end grp handle: 0x0022 uuid: 0000180a-0000-1000-8000-00805f9b34fb #Device Information
attr handle: 0x0023, end grp handle: 0x0027 uuid: 0000180f-0000-1000-8000-00805f9b34fb #Battery
attr handle: 0x0028, end grp handle: 0xffff uuid: 0000ffb0-0000-1000-8000-00805f9b34fb # ???

The annotations on the right are mine; the UUIDs can be looked up under GATT services on the Bluetooth website.
For example, the battery status can be queried somewhere in the Battery handle group from 0x0023 to 0x0027:

[B4:99:4C:25:12:B2][LE]> characteristics 0x0023 0x0027
handle: 0x0024, char properties: 0x12, char value handle: 0x0025, uuid: 00002a19-0000-1000-8000-00805f9b34fb
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x0025
Characteristic value/descriptor: 5d # Battery level 0x5d = 93%

Now, the only unknown primary is from handle 0x0028 and higher. Let’s query those:

[B4:99:4C:25:12:B2][LE]> characteristics 0x0028 0xffff
handle: 0x0029, char properties: 0x0a, char value handle: 0x002a, uuid: 0000ffb6-0000-1000-8000-00805f9b34fb # 0x0a = R/W
handle: 0x002c, char properties: 0x10, char value handle: 0x002d, uuid: 0000ffb7-0000-1000-8000-00805f9b34fb # 0x10 = notify
handle: 0x0030, char properties: 0x10, char value handle: 0x0031, uuid: 0000ffb3-0000-1000-8000-00805f9b34fb # 0x10 = notify
handle: 0x0033, char properties: 0x02, char value handle: 0x0034, uuid: 0000ffb4-0000-1000-8000-00805f9b34fb # 0x02 = Read
handle: 0x0035, char properties: 0x08, char value handle: 0x0036, uuid: 0000ffb8-0000-1000-8000-00805f9b34fb # 0x08 = Write
handle: 0x0037, char properties: 0x08, char value handle: 0x0038, uuid: 0000ffb9-0000-1000-8000-00805f9b34fb # 0x08 = Write
handle: 0x0039, char properties: 0x0a, char value handle: 0x003a, uuid: 0000ffb5-0000-1000-8000-00805f9b34fb # 0x0a = R/W
handle: 0x003b, char properties: 0x08, char value handle: 0x003c, uuid: 0000ffb2-0000-1000-8000-00805f9b34fb # 0x08 = Write

The annotations on the right are again mine: they specify the char properties as looked up under “Characteristic Declaration”. Querying the char value handles gives some uninteresting values (0x00 bytes, etc.), but also some interesting ones:

[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x002d
Characteristic value/descriptor: c4 01 03 01 fd 00
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x003a
Characteristic value/descriptor: 44 65 6d 6f 20 20 20 00 # 'Demo \x00'
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x0034
Characteristic value/descriptor: c3 01 ba 01 c4 01 27 00 c2 01 d1 01

Querying a bit outside also gives some very interesting strings:

[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x002b
Characteristic value/descriptor: 41 64 75 72 6f 20 47 65 74 4c 6f 67 # 'Aduro GetLog'
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x002f
Characteristic value/descriptor: 41 64 75 72 6f 20 4c 69 76 65 56 61 6c 75 65 # 'Aduro LiveValue'

At this point I tried to look for values that changed, and also manipulating the device (temperature, playing with the damper that is connected with a microswitch). It turns out that 0x002d and 0x0034 changes values, but 0x002d changes the most. Is there a pattern?

Characteristic value/descriptor: c4 01 08 01 fb 00
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x002d
Characteristic value/descriptor: c4 01 1f 01 f3 00
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x002d
Characteristic value/descriptor: c4 01 3c 01 ec 00
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x002d
Characteristic value/descriptor: c4 01 5c 01 e2 00
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x002d
Characteristic value/descriptor: c4 01 9f 01 c3 00
[B4:99:4C:25:12:B2][LE]> char-read-hnd 0x002d
Characteristic value/descriptor: c4 01 0f 02 9d 00
#counting UP DOWN

Something is counting up, while something else seems to be counting down; this was while the temperature was cooling down. As 0x002d allows for notify, we can even ask for notifications by writing 0x0100 to 0x002d + 1:

[B4:99:4C:25:12:B2][LE]> char-write-cmd 0x002e 0100
Notification handle = 0x002d value: c5 01 43 00 2a 01
Notification handle = 0x002d value: c5 01 44 00 2a 01
Notification handle = 0x002d value: c5 01 45 00 2b 01
Notification handle = 0x002d value: c5 01 46 00 2c 01
Notification handle = 0x002d value: c5 01 f0 01 94 00
Notification handle = 0x002d value: c5 01 f1 01 94 00
Notification handle = 0x002d value: c6 01 00 00 93 00
Notification handle = 0x002d value: c6 01 01 00 93 00

In the end of the series I manipulated the damper. Trying to identify the temperature, the last 2 characters seems the most promising: values from 0x93 (147 C) to 0x012c (300 C) seem reasonable from what I have seen previously. The middle 2 characters always increase by 1, so it is probably a datapoint counter. The first 2 characters seems to increase by using the damper.

This was implemented in a small Python script, using the Gattlib,

I hooked this into my home monitoring system (more on that in a later blog post), and now have a nice graph of the number of firings, and the temperature:

Gemt under: Extern, HAL9k

03 maj


Hal9k tager på Sommerhack!


Så sker det! OSAA og Hal9k inviterer til campen “Sommerhack” sidste weekend i august. Tag dit telt og computer under armen og kom til en maker-/hacker-/teknologi-camp i Midtjylland.

Tag gerne familien med til hygge i det fri. Vi planlægger også at lave workshops for børn.

Til Sommerhack er der spændende projekter, talks, mad inkluderet og god stemning omkring bålet om aftenen i fællesrummet “pejsestuen”.

Medbring gerne et eller flere projekter, hvis du har noget du arbejder på eller har bygget, og bliv inspireret af andre deltageres kreative og vilde idéer!

Der er plads til at du kan sidde med din computer, 3D-printer, loddekolbe eller hvad du nu har med, nede i det store bindingsværkslokale “pejsestuen”. Vi sætter et antal langborde op med el og netværksswitche, og laver et hackerområde hvor du kan sidde. Ved bordene rundt om den åbne pejs/ildsted, kan man sidde med sin computer og programmere etc., ligesom vi også her har fællesspisning morgen, middag og aften.

Hver dag vil der være talks om forskellige emner inden for bl.a. teknologi, elektronik og software.

På campingområdet er I velkomne til f.eks. at tage et fælles telt med, hvor I kan lave et “hackerområde”. I er velkomne til at samle jer i små “villages” med et fælles tema etc., som det kendes f.eks. fra OHM2013.

Vi håber på sol og sommer og dasen på stranden ved søen. Men fortvivl ej hvis der kommer en byge. Vi sørger for at der er plads til alle i fælleslokalet, og afhængig af deltagerantallet lejer vi også et stort festtelt, med fast bund og langborde mv., selvfølgelig også med el, WiFi og kablet net.

Rammerne er lagt og kun fantasien sætter grænser (næsten) for hvad I kan gøre eventet til.

Vi glæder os til at se jer!

Sommerhack 2016 arrangeres i samarbejde med IDA Embedded, Teknisk landsforbund og PROSA. Medlemmer af IDA, TL og PROSA har mulighed for at købe billetter til en reduceret pris.

Se mere på

Gemt under: Projekter

02 maj


Indkaldelse til ordinær generalforsamling i HAL9k torsdag 2016-05-26 kl. 19:30


Følgende er dagsordenen til den ordinære generalforsamling i foreningen
HAL9k torsdag 2016-05-26 kl. 19:30 på Sofiendalsvej 80, 9200 Aalborg SV.

Dagsorden til generalforsamling:
1. Valg af ordstyrer.
2. Valg af referent.
3. Valg af to stemmetællere.
4. Bestyrelsesformanden og kassereren aflægger beretning, samt
præsenterer planer for den kommende sæson.
5. Kassereren fremlægger det reviderede regnskab til godkendelse.
6. Forslag fra bestyrelsen eller medlemmerne, herunder
vedtægtsændringer, behandles.
7. Behandling af eksklusionssager.
8. Valg af revisor.
9. Valg af bestyrelse.
10. Valg af op til to suppleanter.
11. Behandling af indkommende forslag.

* Årsregnskab 2015 (Bedre formateret)

Balance pr. 31/12-2015 ved regnskabets afslutning var 59.493,69 DKK

Indkomne forslag skal være bestyrelsen i hænde senest syv dage før

Vi hackes ved,

Bestyrelsen Hal9k

Gemt under: Projekter

19 feb


Hvorfor korrelerer min DC-spænding med solen?


DC-spænding over 24 timer

I mit home-monitoring setup har jeg en AC-DC strømforsyning der laver DC-strøm og lader UPS-batterierne. Denne spænding overvåger jeg, som beskrevet i sidste blogindlæg. Grafen set for en typisk dag ser ud som ovenover. Der er en tydelig stigning i spændingen om morgenen og et tydeligt fald sidst på eftermiddagen. Det korrelerer forbavsende godt med hvornår solen står og og går ned. Her er data for 3 forskellige dage, overlagt med sol op-/ned-tidspunkt:


6. september – ufiltreret


26. oktober – filtreret


21. december – filtreret

Der er ikke noget forbundet til DC-forsyningen der trækker væsentlig forskellig strøm efter belastning (det der er forbundet er switche, router og Arduinoer), og intet der tænder/slukker efter tidspunktet. Temperaturen varierer ikke væsentligt i rack-skabet, og korrelerer ikke med spændingen:


Temperatur og spænding, hele oktober. Spænding (grøn) på højre akse.


Temperatur og spænding, 26. oktober. Spænding (grøn) på højre akse.

Så det store spørgsmål er: Hvorfor korrelerer min DC-spænding med solen? Er det pga. solceller i nabolaget? Er det pga. gadebelysning der tænder/slukker? Gode bud modtages :-)

Gemt under: Extern, HAL9k


31 aug


Measuring high DC supply voltage with an Arduino


For my home-monitoring setup I would like an Arduino to measure the supply voltage it is getting from a DC battery UPS (Uninteruptible Power Supply). Unfortunately (actually by design, but that’s another story), the power supply is 24V, which means it will put out anywhere from 21.3V-29.8V (according to the manufacturer), which is far too much to measure with the Arduino’s 0-5V input range. For simplicity’s sake, lets assume we want to measure a 20-30V voltage. The immediate answer is to use a voltage divider, which will bring a voltage in the 0-30V range into the 0-5V range. The general formula for the resistor divider is:

    \[V_{out} = \frac{R_2}{R_1+R_2} \cdot V_{in}\]

We want V_{in} = 30 to give V_{out} = 5, so

    \[\frac{5}{30} = \frac{R_2}{R_1+R_2}\]

resistordivider Now, just as a sanity check we should calculate the current of the resistor divider, to make sure we’re not converting too much electricity into heat. Ohm’s law gives us

    \[ I = \frac{U}{R}\]

which in this cases gives

    \[ I = \frac{30}{12000} = 0.0025 A = 2.5 mA\]

No problems there. This works okay, but we lose a lot of precision, as only ~1/3 of the Arduino’s range is actually used: the Arduino’s ADC has 1024 different readings between 0-5V, so when reading the 0-30V range the precision is just about 30V / 1024 \approx 0.03 V over the range. If only we could move the lower bound, so that 20V would map to 0V on the Arduino. A wild Zener Diode appears! One use of a Zener diode is as a voltage shifter. voltageshifter Zener diode voltage shifter. This work is licensed under the Creative Commons Attribution 3.0 License, The closest Zener diode I could find was an 18V of the BZX79 series. This resulted in the following circuit: zener-voltage-divider which I hacked into my Arduino box. Hacked supply monitoring Now, theoretically the formula for translating an voltage at the Arduino to the supply voltage should be:

    \[Vcc = V_{in} / (4700/(4700+6800)) + 18 = V_{in} \cdot 2.4468 + 18\]

I then did some quick measurements of various input voltages and the resulting voltage at the Arduino pin:
Input voltage Arduino pin
18V 0.32V
20V 1.16V
26V 3.60V
28V 4.41V
29V 4.81V
Plot it into a spreadsheet, create a graph and add a linear regression gives: Now, this formula is a bit different compared to the theoretical one, mainly in the Zener diode drop. However, the datasheet for the BZX79 actually has the 18V C-type (\plusminus 5\%) as between 16.8-19.1V, so this is well within spec. Since this is just a one-off, I’m happy to just use the measured formula, as this will be more accurate. The final precision should be 12V / 1024 = 0.012V. The current should be around I = \frac{U}{R} = 30V/11500 Ohm \cdot 1000 \frac{mA}{A} = 2.6mA, which again is ok.

Gemt under: Extern, HAL9k

Tags: ,

17 jun


Roomba 500-series Easy Scheduling using an Arduino


I have a iRobot Roomba 500-series vacuum cleaner robot, but without any remote, or command center or anything; alas, I have to push a button everytime I want the cleaning revolution to start :-(

But no more! It turns out the Roomba can be programmed, quite easily, to schedule automatically, and all you need is:

  • 1 Arduino
  • 2 wires

The Roomba actually supports a serial protocol, the iRobot Roomba 500 Open Interface Specification, that allows remote control, driving, sensoring, and scheduling.

Finding the serial port

Remove the plastic cover. It is easiest to remove the vacuum bin, and carefully pry it off with a screwdriver.

There should be a 7-pin plug, on the right side. It has the following pinout:

Roomba serial pinout

Roomba serial pinout

Program the Arduino

Use this sketch (download: roombaschedule.ino):

Set a schedule on an iRobot Roomba 500 series, using just an Arduino.
Mads Chr. Olesen, 2015.

const byte currentDay = 3;
// 0: Sunday, 1: Monday, 2: Tuesday, 3: Wednesday, 4: Thursday, 5: Friday, 6: Saturday
const byte currentHour = 2;
const byte currentMinute = 58;

// Schedule
const byte SUNDAY = 0x01, MONDAY = 0x02, TUESDAY = 0x04, WEDNESDAY = 0x08, THURSDAY = 0x10, FRIDAY = 0x20, SATURDAY = 0x40;

const byte daystorun = SUNDAY | MONDAY | WEDNESDAY | FRIDAY;
const byte times[14] = {
3, 0, // Sunday time
3, 0, // Monday time
3, 0, // Tuesday time
3, 0, // Wednesday time
3, 0, // Thursday time
3, 0, // Friday time
3, 0, // Saturday time

const int ledPin = 13;

void setup() {
pinMode(ledPin, OUTPUT);
digitalWrite(ledPin, 0);

Serial.write(128); //Start
Serial.write(131); //Safe mode, turns off Roomba light
Serial.write(128); //Start, back to passive mode

//Set day time

//Set schedule
for (int i = 0; i < 14; i++) {

void loop() {
digitalWrite(ledPin, 1);
digitalWrite(ledPin, 0);

You need to modify the variables at the top: set currentDay, currentHour, currentMinute according to the present time.
The pre-programmed schedule is to clean at 03:00 on Sunday, Monday, Wednesday and Friday. You can change this if you wish, by altering the daystorun and times variables.

If you don't modify the schedule, the Roomba should start automatically after 2 minutes.

Put it all together

You should now have a partially undressed Roomba, and a programmed Arduino. Now it is time to connect them. With both unpowered, connect the following:

  • Arduino GND to Roomba ground (pin 6)
  • Arduino TX (pin 1 on e.g. Uno) to Roomba RX (pin 3)

It should look like this:


Now, the moment of truth. Press the "CLEAN" button on the Roomba, the light should go on. Plug in the USB for the Arduino. The Roomba light should turn off briefly, and after a few seconds the Arduino should blink it's LED. The schedule is now programmed, all done!

Gemt under: Extern, HAL9k

Tags: ,

06 maj


Indkaldelse til Ordinær Generalforsamling i Hal9k torsdag 2014-05-15 kl. 19:30


Følgende er dagsordenen til den ordinære generalforsamling i foreningen HAL9k torsdag 2014-05-15 kl. 19:30 på Sofiendalsvej 80, 9200 Aalborg SV.

Inden generalforsamlingen er der fællesspisning ca. kl. 18.30. Tilmelding til spisning (menu/pris ikke kendt endnu, forventet max 50,-) foregår på af hensyn til antallet.

1. Valg af ordstyrer.
2. Valg af referent.
3. Valg af to stemmetællere.
4. Bestyrelsesformanden og kassereren aflægger beretning, samt præsenterer planer for den kommende sæson.
5. Kassereren fremlægger det reviderede regnskab til godkendelse.
6. Forslag fra bestyrelsen eller medlemmerne, herunder vedtægtsændringer, behandles.
  – Forslag om nedsættelse af kontingent fra sidste generalforsamling:
100kr pr. md, (75kr for stud.).
7. Behandling af eksklusionssager.
8. Valg af revisor.
9. Valg af bestyrelse.
10. Valg af op til to suppleanter.
11. Behandling af indkommende forslag.

Indkomne forslag skal være bestyrelsen i hænde senest syv dage før generalforsamlingen.

Vi hackes ved,  

Bestyrelsen Hal9k

Gemt under: Projekter

03 apr


LulzBot Unboxing


Gemt under: Projekter

17 jan

Kommentarer lukket til Reparere billige Denver Wake-up lampe

Reparere billige Denver Wake-up lampe


Jeg havde to billige wake-up lamper fra Harald Nyborg der begge fejlede med samme symptomer: lyset var permanent tændt så snart strømmen var sat til, i stedet for at kunne slukkes og dæmpes. Grunden til nr. 2 blev købt var at nr. 1 fejlede efter garantien udløb, og til 200,- kunne det jo knapt betale sig at kigge på det. Da nr. 2 fejlede med samme symptom blev jeg stædig og irriteret over kun at kunne lave “brug-og-smid-væk”.

Hvor svært kunne det være at reparere noget billigt Kina-skrammel? Ikke ret svært viste det sig. Skidtet blev åbnet, og viser ret tydeligt hvor meget kvalitet man får for ikke ret mange penge:
Billigt print
Efter lidt konsultation af nogle af de mere elektronik-kyndige fik vi lokaliseret fejlen til en Triac der nok var brændt af. Desværre havde producenten valgt at slibe teksten af, så det var umuligt at se hvilken chip det var (sådan noget svineri!) — det virkede dog heldigvis med en helt standard BT137. På den ene lampe var der også brændt en modstand af: den var helt forkullet, men heldigvis kunne vi se på den anden hvilken modstand det var.
Ny triac

Efter at have loddet ny triac og modstand på, virkede lamperne som nye 🙂

Kan det betale sig at reparere billigt Kina-skrammel der er gået i stykker? Måske ikke økonomisk, til gengæld risikerer man at lære noget. Og så er det jo ret fedt at kunne fixe ting selv, i stedet for kun at kunne købe og smide væk!

Gemt under: Projekter