Hacking the Tado (part 3 – Thermostat)

So, parts 1 and 2 showed that the Tado gateway could be debugged and re-purposed. What about the main Thermostat unit? That contains a MSP430F5659 rather than a Tiva. It also has a CC1101 sub-1GHz radio. There’s 2 Panasonic DK series latching relays to switch the heating and hot water – DK1a1b-L2-3V to be precise. Along with that is what I assume to be a switching power supply so it is powered by the mains and a 1.0F supercapacitor – probably to keep it working if this is briefly switched off. Finally there’s a Sensirion SHT21 temperature and humidity sensor – no thermostat would be complete without a temperature sensor! Whilst the MSP430s have an on-board temperature sensor these get heated by the processor itself so aren’t really much use.

Connecting a debugger

wp-1468699428814.jpgWell, just like the gateway, there was a very inviting 12 pin header – this time 0.1″ pitch through hole. It turns out this is a standard 14 pin MSP430 JTAG header with the unused pins 13 and 14 missing. Another result. Adding the header and connecting this up to a MSP-FET was all that was needed. Not the missing pins on the new header (on the RHS). That’s just to remind me to align it properly with the 14 pin ribbon cable.

wp-1468699453123.jpgThe MSP430 is actually on the reverse of the device, but to be honest that’s the only interesting thing there. Want a look anyway? OK then. Here it is.

The first thing I did was use MSP Flasher to verify it could connect to the MSP430 and then dump the sections of the ROM that I might want to put back. There’s MAIN (code), INFO (configuration and calibration), BSL (this was all 0xFFs anyway). I dumped the RAM too just in case. These need to be backed up to separate data files. Apart from one tiny bit of plastic that needs to be trimmed you can even get it back in the case with the header in place. Same with the Gateway.

CC1101, relays, buttons, LEDs

Next I need to work out what pins connect to the peripherals..

 

Hacking the Tado (part 2 – gateway)

Well, in part 1 I worked out that I could connect to the Gateway with a debugger. Now I need to work out a little bit about the board. It’s a 4-layer board, so tracing the signals isn’t that easy. Writing some simple code seemed to be the best way to determine what’s connected to what.

LEDs

The easiest bit. I just toggled all the pins until i found out that the three green LEDs are all on port H. The link LED is bit 5, router is bit 6 and internet is bit 7. All are active high.

Switches

One switch is reset, so not much happening there. I can’t seem to determine what the other is doing yet. It doesn’t appear to be directly connected to a pin and may have circuitry between that and the reset button. I can’t  remember what function it had on the Tado.

CC1101 radio, Ethernet, USB type A jack

Still to come.

Getting started with StellarisWare

I thought the easiest approach to getting somethings going was to try some sample code from StellarisWare – perhaps even some Ethernet code. Unfortunately the examples seem to only cover specific evaluation boards and I seem to hit a hard fault at some point running adapted code. Not getting really anywhere right now.

Hacking the Tado (part 1)

Tado’s v1 connector. This connects the system to your router and Tado’s servers

I’ve been a fan of the Tado smart thermostat for a while. I didn’t quite make it onto the UK beta test, but bought one as they were first available. Way before Nest, Hive and the others. It’s a nice device. It knows when you’re home and what the weather is, so adjusts your heating to be warm by the time you get home.

Of course, I couldn’t resist a peek inside even before I installed it. It was great to find that the internals involved a TI Stellaris ARM microcontroller in one of the three components, MSP430s on the other two, and all three were linked with CC1101 sub-1GHz radios. The developers were also really helpful. When I had problem with my Sky Broadband’s rubbish DNS, they created and remotely deployed firmware for me within 24 hours. They also told me that it used 6LoWPAN (i.e. IPv6 over a mesh network) to communicate between the components.

Fast forward a couple of years and i decided to upgrade my Tado v1 to a v2. Whilst there was some discount of the list price for returning my v1 device, it seemed far more fun to play around with the hardware. I’m going to hack it. Nothing devious or underhand, of course. I’m just going to make use of this nice piece of hardware.

First the connector. This contains a LM3S9997 microcontroller. This has now been superseded by TI’s Tiva range – and Tado now use a STM32 in the v2 connector. However, there’s nothing wrong with this device. It does the job. A bit of snooping showed a couple of unpopulated SMT headers on the top – and similar large pitch versions on the underside. I traced the ICDI (debugging) pins on the LM3S and discover not only that the go to one of these headers, but that it is even in a standard ARM JTAG header format. Result! Thank you Tado. Hardware developers that care! You’ll see my new 10-pin addition in the photo above, along with the still unpopulated 8-pin header.

wp-1468447005484.jpgAll I needed to do was solder on a header and connect an ICDI to it. Unfortunately I couldn’t find the proper debugger – they’re a bit old for what I work with. The newer XDS110 on my CC2650 LaunchPad wouldn’t play with the older LM Flash programmer software. Whilst the really helpful Bluehash over on 43oh.com kindly offered to send me the correct debugger, I decide to see if I could hack something together. A bit of ribbon cable and some iffy soldering and my old Stellaris LaunchPad was called into action. Now I could dump the flash contents – so that I can revert to if needed – and program new firmware.

All I’ve done so far is dump the Tado firmware and take a peek. Nothing too revealing in all those bytes – other than a reference to Contiki 2.6. Whilst I don’t know much about Contiki yet, I know it’s TI’s preferred route to getting 6LoWPAN working to provide an edge router for newer devices like the CC1310 – an ARM microcontroller with a Sub-1GHz radio built in. Anyway, that’s enough for now. We have a vague plan…

NFC Login 2.1

image

Version 2.1

This should be the final revision. Just a few minor tweaks. The regulator is now a TPS77533 rather than an incorrectly footprinted TPS77333. Corrected the bi-colour LED wiring. Move to a smaller 4MHz crystal for the USB side of things. Shrunk it a bit as I’m no longer expecting to find any PCB bugs. Dropped the 0.1″ pin header as the TagConnect worked fine.

The most obvious change is the small capacitive touch sensor PCB on the front. The previous version searches for a tag a couple of times a second. This works fine but I don’t like the idea of all the 13.56MHz EM noise pollution. This will poll for touch frequently and if it senses a touch it will poll for tags rapidly for a few seconds. In theory it could be more responsive too. Not had a chance to code this yet though.

There’s is also a Login NFC the way to another implantee. I’d recommend you check out Hans Peter’s embryonic.dk blog.

Wicked Uncle – some great kids’ toys

home-boyI recently stumbled across a nice looking website if you’re stuck for a present to buy any kids that you know. I was mainly thinking about my own two boys, but to be honest it’s best set up to help out those of you without kids of your own. It really helps with questions like “What the hell is 6 year old girl into?” The site I’m talking about is wickeduncle.co.uk.

Anyway, I’d mentally noted that it might be a good site for something for my nieces and nephews – six of them ranging in age from 3 to 12. My two boys are 2 and 4 but I have a fairly good idea what they’d like. Anyway, they had a promo where 4 lucky bloggers could get a £40 voucher in return for an honest review. So for transparency, I got a voucher from them. That’s enough to persuade me to type a review. However £40 is definitely not enough to buy my integrity, so this is a genuine review.

The site

WickedUncleFirstly, the site itself. I’m a web developer myself so have no time for stuff that doesn’t work or is trying to be clever at the sake of usability. No worries here. It’s nicely laid out. You can narrow things down by gender, age and category (adventurer, role play, engineer, creative, etc.). With a bit of luck you’ll know at least there things about you godson / neice / friend’s spawn. I like it. Really useful. Age suitability for toys always seems a bit difficult as kids are so different, but it seemed to work.

I noticed is that the site was fine to use on a mobile device. No glitches or tricky bits. I did think at one point that it would be handy to allow different presents for different kids to be delivered to different addresses. Then I thought how no other sites do this and it was probably a bit of a big expectation. Lo and behold – I found in the FAQ that they used to do this and decided to discontinue it. Not too surprising I suppose.

Gift wrapping in an option (£2.95 for the first one, then £1.50). As is a card (£1.95). Both seemed like great options if you want to send it direct. However, as I wanted to check out the toys myself I didn’t chose either of these. Sound OK though. And just a simple message can be included free.

The only grumble I had about the site was that it insisted on a password to create an account. For a site that you might only ever use once, I thought this was a bit too presumptuous. I may well use it again, but if I do then I’d be more than happy to enter my details again.

The toys

I did notice quite a few toys on there that we already had. A good sign – they’re all toys that my kids like. It seemed very much like a small range of quality stuff rather than a store stuffed full of everything. Ideal if you’re trying to narrow stuff down a bit. Anyway, here’s what I picked:

T4 Transforming Solar Robot

wp-1450299890843.jpgI picked this thinking it might be suitable for my nephews who are 5 and 7. They love Lego and are pretty capable with this sort of thing. The specified age range (8) seems realistic though. I was too optimistic and Wicked Uncle were right. Inside it’s much more like an old Airfix kit. Lots of parts on sprues. (I bet you didn’t know that’s what those unused bits were called.) It looks good but it will have to head to an older nephew instead. It also meant I couldn’t try it out and review it properly before I sent it. Looks good though.

Magnetic Stacking Rocket

wp-1450300101982.jpgI got this because one of my boys (2 a couple of days ago) loves the plane version of this. It’s a nice toy. There aren’t too many pieces and the magnets hold them together nicely. Clumsy little fingers from 1 upwards can still put it together easily without lining thing up too accurately. He’ll be getting this for Christmas and I know he’ll like it. A bonus for those of us with a puerile sense of humour – one of the pieces looks like a boob. Check the photo and see if you can guess which one!

Hexbug Scarab
Not so impressed with this one. It says age 8, but I’d say maybe lower. I thought the Hexbugs did intelligent stuff like line following or turning round when then bump into things, but this just scuttles along. It goes quite fast and does seem very insect-like. My 2 and 4 year olds will love it, I’m sure, but that’s all it does for £12.99. For some reason I thought it was a crab and expected it to go sideways, but I can see it’s my mistake.

Zombie Aquabot Fish

635733509581622000Fairly simple, but very nice. My son previously had a similar fish but the tail broke off before he could even use it. This one seems sturdier and swims nicely. It seems to vary speed randomly. No idea if it’s supposed to but that works well and makes it seem more realistic. It just floats up to the surface slowly so that makes it quite realistic rather than just a floating toy. The fact that it’s a skeletal shark will go down well. The glow in the dark bit? I can’t say I actually tested that. I’ll let the boys try that bit out.

Well, there we have it. I can genuinely recommend the site. Ideal if you’re not quite sure what to get. (A nice change from a list of demands!) Absolutely perfect if you’re outside the UK and the child you’re buying it for is here.

NFC login 2.0 finally working

image

It’s taken some time, but it’s finally working! It’s hard to debug when you don’t know what’s at fault.

  • Is it the PCB design? I’ve never done anything as complicated or as high frequency as this.
  • Is the the PCB manufacture? I decided to get the board made by DirtyPCBs rather than home etching, so at least that took one potential source of screw-up out of the equation.
  • Is it my soldering? I’ve never done anything as fine as the LQFP (larger chip) and QFN (smaller one on the right). They’re both 0.5mm pitch but at least the LQFP has pins that stick out rather than just metal patches on the edges of a square block.
  • Is it the design of the antenna? This is the work of the very talented Mathieu Stephan (from here) so probably not the weakest link.
  • Is it the firmware? I’ve had the code running on a MSP430F5529 LaunchPad, but I’ve switched down to a smaller F5510 and reassigned the pins.

Well, it took three tries – as you can see from the scribble on the board above. There’s a mistake around the TPS77333 voltage regulator which truned out to be a footprint error in the Eagle-supplied libraries. It’s now a bodged-in TPS77533. There’s another by the LED which I’ve had to swap for two separate ones rather than a red/green single package. My mistake on the pinout there.

It turns out the problem was the soldering of the QFN packaged TRF7970A. Buying a microscope helped me sort it out and it’s finally there! It’s finally working! There’s more to do, of course. I need to fix the mistakes. The software could be tidier. Version 2.1 will be perfect (probably). I’ll publish the design and code when it’s tidy, but in the mean time if anyone’s interested in any of it, let me know.

image

I laser cut a simple acrylic enclosure. It’s just black acrylic on the back – with some 5mm neodymium magnets press fitted into holes so it attaches firmly to my PC.
Some clear acrylic makes up the front so I can see the LEDs and the fruits of my labours. M3 nylon bolts go into threaded holes on the rear piece.

It’s been harder and slower than I expected but I’m very happy.

A stereo microscope

Wow. I didn’t really think I needed a “real” microscope. So far for working on those tiny SMD components I’ve got by with a jeweller’s loupe and a magnifying headband from my father-in-law who is a retired dentist. For inspection afterwards, I used a £20 eBay USB microscope. This all seemed adequate.

However, for the latest version of my NFC login project I had to solder a TRF7970A NFC transceiver. These only come in QFN package. The 0.4mm pitch pins aren’t too much of an issue. I can handle these OK on the LQFP package that the MSP430 comes in. It’s the fact that there aren’t actually any pins sticking out – just a visible metal pad on the lower edge of the chip. I had to rework one a few times as I hadn’t got it quite right and I suspect I was starting to do some damage to the chip and/or the PCB.

I did a bit of research – mostly on eevblog. The really good ones are way to expensive for the amount of use it. The good value AmScope models that most people recommend are too expensive to ship outside the US. Brunel microscopes in the UK seem good, but still quite pricey. Then I stumbled across the usual eBay “bargain” direct from China. I’ve been happy with the price/quality compromise on the laser and CNC mill I got this way. Time to dig a bit deeper and see of this is likely to be a good idea.

Microscope1I found a very helpful review on eereview that served to be the same model. To be honest, it seems the same as some of the AmScopes too. It actually looks the same as the BMDZ series from Brunel too. I decided to risk trading off quality for specifications and went for it.

Here’s the image straight from the eBay listing. I assume the seller won’t mind as I’d be happy to recommend lapsun_gift. The microscope (plus some x0.5 and x2 barlow lenses) arrived in about a week. It was marked a $95 but form some reason UK customs decided to charge me VAT on £125. The cost was about £300 so I was OK with that. The same microscope without camera, ring light or barlow lenses was £450+VAT in the UK so I was happy with the price too.

wpid-wp-1448207092901.jpgI’m very happy with it. Inspecting a reworking LQFP used to be a pain. My USB microscope would allow me to see stuff but the lighting meant I couldn’t really be sure what was a short of solder and what was a reflection. The actual soldering had to be done with no magnification and then re-inspected. Now I can actually see properly. The microscope itself is 7x to 45x zoom. With the 0.5x lens I get less magnification and a 165mm focal length and can actually solder under it – whether an iron or hot air. Zooming in (and perhaps removing the barlow lens) means I can actually see the individual balls in the solder paste.

The 2x lens (i.e. up to 90x magnification) is a bit much for anything other than really detail inspection of a PCB. It should be great for counting a spider’s eye with my boys though – if it’s not too scary!

WIN_20151122_16_23_58_ProThe camera is probably the weakest point of it all. When switching the camera in, you lose one of the stereo eyepieces. Not really a problem. However, I find the the image the camera sees is about 10% of what you see through the eyepieces. Focusing is tricky and I can’t see to get it to focus at the same place as the remaining eyepiece. In the image shown each pin is about 0.2mm with 0.2mm gap to the next one. Through the eyepiece you can see the whole 48 pin chip and some passives around it. It’s also far clearer. That photo really doesn’t do the microscope justice. Never mind – the camera was just a “why not” addition. I might try an adapter for my SLR camera at some point but no hurry.

Many people recommended a boom stand. This didn’t come as an option with the eBay model, but if I ever need one I can always add one later. The supplied one is certainly adequate for me so far. If I need to look at an angle I just tilt the board and refocuscam.