Electric motorcycle test ride

The latest object of my gadget lust is just a battery. A big battery. A big battery with a couple of wheels attached.

2012_zero-s_studio_black-ra_777x555_gallerySometime around 2012 I took a test ride on a Zero S electric motorbike. I was really impressed by the power delivery and handling, but I seem to remember the price at the time was about £12,000 and the range was (at best) 114 miles. Power isn’t quoted, but I believe you can ride these on a UK learner licence, so not that much on paper. The style was OK but ordinary. It wasn’t really ready to be a replacement for a petrol bike. It was definitely something I was going to keep an eye on though. Electric bikes were the future, but not quite the present.

2016_zero-sr_studio_ra_777x555_galleryFast forward a couple of years. Things have improved a fair bit. The same bike dealer – 21st Moto in Swanley, Kent – had a 2016 Zero SR available for test so I had to give it a go. It has more power – 66hp for the ZF13 version but feels like more. It had more range – 161 miles city, half that on the motorway. The styling is better. There are various charging options but the main use case is the same – plug it in to a normal household supply overnight or whilst you’re at work and fuel is near enough free. The list price had until recently been £11,500 for the larger batteried version but a recent price hike and poor Sterling exchange rate had increased that to £13,000. Still tempting…

The SR may be the flagship model but I have always liked supermotos since the days were you had to make your own. Over the years I’ve had a home converted Honda XR650, lethal Yamaha YZ250, KTM Duke and currently an Aprilia Dorsoduro. The electric model that really appealed to me was a Zero FXS. The ZF6.5 version has less power (44bhp) less range (90 miles) but with less weight it had the potential for more fun on my short commute to work. List price had increased to £10,500.


21st Moto didn’t have a demo one. Daytona Motorcycles did, but due to the fact they lost their trade plate (literally – it fell of a bike) it took me about 5 weeks to try one out. It was worth the wait. I was impressed! It really didn’t feel like it only has 44hp. Electric motors deliver all their torque from zero rpm so there is as much as you need from low revs. In fact the power delivery needs to be restricted low down the rev range so that you don’t flip the bike. It feels like a much larger engine, only running out of puff a bit as you get to higher speeds. The handling is great.

A had a good 45 minute test ride covering high-ish speeds (85mph) and deliberately filtering through awkward and annoying traffic too. Hooked! It’s not a motorway or long distance bike but that doesn’t appeal to me anyway. It’s a great backroad and commuting tool. I had a quick 15 minute go back-to-back with their DSR. It’s a dual sport with trailie wheels but has the same engine as the SR I was considering. Whilst the extra power and range is of course nice, it’s not worth the extra to me.

So the big question – am I going to buy one. The answer is yes, but not just yet. The 2017 models are about to be announced. When I rode it the UK zero emission plug-in grant was still “almost here” as it had been for years. This could be a few thousand pounds so worth waiting for if it wasn’t too far off. Also, we might be moving house soon and a bike purchase might have to be bumped down the list.

Since my test ride the grant has actually been announced! It’s as part of the £35m zero emission package but it should mean £1500 off the list price of a Zero. Zero will have to register for this, so no exact date when it will actually happen. Maybe with the new 2017 models. A zero FXS will definitely be my next bike, but probably sometime in 2017.

Hacking the Tado (part 3 – Thermostat)

So, parts 1 and 2 showed that the Tado gateway could be debugged and re-purposed. What about the main Thermostat unit? That contains a MSP430F5659 rather than a Tiva. It also has a CC1101 sub-1GHz radio. There’s 2 Panasonic DK series latching relays to switch the heating and hot water – DK1a1b-L2-3V to be precise. Along with that is what I assume to be a switching power supply so it is powered by the mains and a 1.0F supercapacitor – probably to keep it working if this is briefly switched off. Finally there’s a Sensirion SHT21 temperature and humidity sensor – no thermostat would be complete without a temperature sensor! Whilst the MSP430s have an on-board temperature sensor these get heated by the processor itself so aren’t really much use.

Connecting a debugger

wp-1468699428814.jpgWell, just like the gateway, there was a very inviting 12 pin header – this time 0.1″ pitch through hole. It turns out this is a standard 14 pin MSP430 JTAG header with the unused pins 13 and 14 missing. Another result. Adding the header and connecting this up to a MSP-FET was all that was needed. Not the missing pins on the new header (on the RHS). That’s just to remind me to align it properly with the 14 pin ribbon cable.

wp-1468699453123.jpgThe MSP430 is actually on the reverse of the device, but to be honest that’s the only interesting thing there. Want a look anyway? OK then. Here it is.

The first thing I did was use MSP Flasher to verify it could connect to the MSP430 and then dump the sections of the ROM that I might want to put back. There’s MAIN (code), INFO (configuration and calibration), BSL (this was all 0xFFs anyway). I dumped the RAM too just in case. These need to be backed up to separate data files. Apart from one tiny bit of plastic that needs to be trimmed you can even get it back in the case with the header in place. Same with the Gateway.

CC1101, relays, buttons, LEDs

Next I need to work out what pins connect to the peripherals..


Hacking the Tado (part 2 – gateway)

Well, in part 1 I worked out that I could connect to the Gateway with a debugger. Now I need to work out a little bit about the board. It’s a 4-layer board, so tracing the signals isn’t that easy. Writing some simple code seemed to be the best way to determine what’s connected to what.


The easiest bit. I just toggled all the pins until i found out that the three green LEDs are all on port H. The link LED is bit 5, router is bit 6 and internet is bit 7. All are active high.


One switch is reset, so not much happening there. I can’t seem to determine what the other is doing yet. It doesn’t appear to be directly connected to a pin and may have circuitry between that and the reset button. I can’t  remember what function it had on the Tado.

CC1101 radio, Ethernet, USB type A jack

Still to come.

Getting started with StellarisWare

I thought the easiest approach to getting somethings going was to try some sample code from StellarisWare – perhaps even some Ethernet code. Unfortunately the examples seem to only cover specific evaluation boards and I seem to hit a hard fault at some point running adapted code. Not getting really anywhere right now.

Hacking the Tado (part 1)

Tado’s v1 connector. This connects the system to your router and Tado’s servers

I’ve been a fan of the Tado smart thermostat for a while. I didn’t quite make it onto the UK beta test, but bought one as they were first available. Way before Nest, Hive and the others. It’s a nice device. It knows when you’re home and what the weather is, so adjusts your heating to be warm by the time you get home.

Of course, I couldn’t resist a peek inside even before I installed it. It was great to find that the internals involved a TI Stellaris ARM microcontroller in one of the three components, MSP430s on the other two, and all three were linked with CC1101 sub-1GHz radios. The developers were also really helpful. When I had problem with my Sky Broadband’s rubbish DNS, they created and remotely deployed firmware for me within 24 hours. They also told me that it used 6LoWPAN (i.e. IPv6 over a mesh network) to communicate between the components.

Fast forward a couple of years and i decided to upgrade my Tado v1 to a v2. Whilst there was some discount of the list price for returning my v1 device, it seemed far more fun to play around with the hardware. I’m going to hack it. Nothing devious or underhand, of course. I’m just going to make use of this nice piece of hardware.

First the connector. This contains a LM3S9997 microcontroller. This has now been superseded by TI’s Tiva range – and Tado now use a STM32 in the v2 connector. However, there’s nothing wrong with this device. It does the job. A bit of snooping showed a couple of unpopulated SMT headers on the top – and similar large pitch versions on the underside. I traced the ICDI (debugging) pins on the LM3S and discover not only that the go to one of these headers, but that it is even in a standard ARM JTAG header format. Result! Thank you Tado. Hardware developers that care! You’ll see my new 10-pin addition in the photo above, along with the still unpopulated 8-pin header.

wp-1468447005484.jpgAll I needed to do was solder on a header and connect an ICDI to it. Unfortunately I couldn’t find the proper debugger – they’re a bit old for what I work with. The newer XDS110 on my CC2650 LaunchPad wouldn’t play with the older LM Flash programmer software. Whilst the really helpful Bluehash over on 43oh.com kindly offered to send me the correct debugger, I decide to see if I could hack something together. A bit of ribbon cable and some iffy soldering and my old Stellaris LaunchPad was called into action. Now I could dump the flash contents – so that I can revert to if needed – and program new firmware.

All I’ve done so far is dump the Tado firmware and take a peek. Nothing too revealing in all those bytes – other than a reference to Contiki 2.6. Whilst I don’t know much about Contiki yet, I know it’s TI’s preferred route to getting 6LoWPAN working to provide an edge router for newer devices like the CC1310 – an ARM microcontroller with a Sub-1GHz radio built in. Anyway, that’s enough for now. We have a vague plan…

NFC Login 2.1


Version 2.1

This should be the final revision. Just a few minor tweaks. The regulator is now a TPS77533 rather than an incorrectly footprinted TPS77333. Corrected the bi-colour LED wiring. Move to a smaller 4MHz crystal for the USB side of things. Shrunk it a bit as I’m no longer expecting to find any PCB bugs. Dropped the 0.1″ pin header as the TagConnect worked fine.

The most obvious change is the small capacitive touch sensor PCB on the front. The previous version searches for a tag a couple of times a second. This works fine but I don’t like the idea of all the 13.56MHz EM noise pollution. This will poll for touch frequently and if it senses a touch it will poll for tags rapidly for a few seconds. In theory it could be more responsive too. Not had a chance to code this yet though.

There’s is also a Login NFC the way to another implantee. I’d recommend you check out Hans Peter’s embryonic.dk blog.

Wicked Uncle – some great kids’ toys

home-boyI recently stumbled across a nice looking website if you’re stuck for a present to buy any kids that you know. I was mainly thinking about my own two boys, but to be honest it’s best set up to help out those of you without kids of your own. It really helps with questions like “What the hell is 6 year old girl into?” The site I’m talking about is wickeduncle.co.uk.

Anyway, I’d mentally noted that it might be a good site for something for my nieces and nephews – six of them ranging in age from 3 to 12. My two boys are 2 and 4 but I have a fairly good idea what they’d like. Anyway, they had a promo where 4 lucky bloggers could get a £40 voucher in return for an honest review. So for transparency, I got a voucher from them. That’s enough to persuade me to type a review. However £40 is definitely not enough to buy my integrity, so this is a genuine review.

The site

WickedUncleFirstly, the site itself. I’m a web developer myself so have no time for stuff that doesn’t work or is trying to be clever at the sake of usability. No worries here. It’s nicely laid out. You can narrow things down by gender, age and category (adventurer, role play, engineer, creative, etc.). With a bit of luck you’ll know at least there things about you godson / neice / friend’s spawn. I like it. Really useful. Age suitability for toys always seems a bit difficult as kids are so different, but it seemed to work.

I noticed is that the site was fine to use on a mobile device. No glitches or tricky bits. I did think at one point that it would be handy to allow different presents for different kids to be delivered to different addresses. Then I thought how no other sites do this and it was probably a bit of a big expectation. Lo and behold – I found in the FAQ that they used to do this and decided to discontinue it. Not too surprising I suppose.

Gift wrapping in an option (£2.95 for the first one, then £1.50). As is a card (£1.95). Both seemed like great options if you want to send it direct. However, as I wanted to check out the toys myself I didn’t chose either of these. Sound OK though. And just a simple message can be included free.

The only grumble I had about the site was that it insisted on a password to create an account. For a site that you might only ever use once, I thought this was a bit too presumptuous. I may well use it again, but if I do then I’d be more than happy to enter my details again.

The toys

I did notice quite a few toys on there that we already had. A good sign – they’re all toys that my kids like. It seemed very much like a small range of quality stuff rather than a store stuffed full of everything. Ideal if you’re trying to narrow stuff down a bit. Anyway, here’s what I picked:

T4 Transforming Solar Robot

wp-1450299890843.jpgI picked this thinking it might be suitable for my nephews who are 5 and 7. They love Lego and are pretty capable with this sort of thing. The specified age range (8) seems realistic though. I was too optimistic and Wicked Uncle were right. Inside it’s much more like an old Airfix kit. Lots of parts on sprues. (I bet you didn’t know that’s what those unused bits were called.) It looks good but it will have to head to an older nephew instead. It also meant I couldn’t try it out and review it properly before I sent it. Looks good though.

Magnetic Stacking Rocket

wp-1450300101982.jpgI got this because one of my boys (2 a couple of days ago) loves the plane version of this. It’s a nice toy. There aren’t too many pieces and the magnets hold them together nicely. Clumsy little fingers from 1 upwards can still put it together easily without lining thing up too accurately. He’ll be getting this for Christmas and I know he’ll like it. A bonus for those of us with a puerile sense of humour – one of the pieces looks like a boob. Check the photo and see if you can guess which one!

Hexbug Scarab
Not so impressed with this one. It says age 8, but I’d say maybe lower. I thought the Hexbugs did intelligent stuff like line following or turning round when then bump into things, but this just scuttles along. It goes quite fast and does seem very insect-like. My 2 and 4 year olds will love it, I’m sure, but that’s all it does for £12.99. For some reason I thought it was a crab and expected it to go sideways, but I can see it’s my mistake.

Zombie Aquabot Fish

635733509581622000Fairly simple, but very nice. My son previously had a similar fish but the tail broke off before he could even use it. This one seems sturdier and swims nicely. It seems to vary speed randomly. No idea if it’s supposed to but that works well and makes it seem more realistic. It just floats up to the surface slowly so that makes it quite realistic rather than just a floating toy. The fact that it’s a skeletal shark will go down well. The glow in the dark bit? I can’t say I actually tested that. I’ll let the boys try that bit out.

Well, there we have it. I can genuinely recommend the site. Ideal if you’re not quite sure what to get. (A nice change from a list of demands!) Absolutely perfect if you’re outside the UK and the child you’re buying it for is here.

NFC login 2.0 finally working


It’s taken some time, but it’s finally working! It’s hard to debug when you don’t know what’s at fault.

  • Is it the PCB design? I’ve never done anything as complicated or as high frequency as this.
  • Is the the PCB manufacture? I decided to get the board made by DirtyPCBs rather than home etching, so at least that took one potential source of screw-up out of the equation.
  • Is it my soldering? I’ve never done anything as fine as the LQFP (larger chip) and QFN (smaller one on the right). They’re both 0.5mm pitch but at least the LQFP has pins that stick out rather than just metal patches on the edges of a square block.
  • Is it the design of the antenna? This is the work of the very talented Mathieu Stephan (from here) so probably not the weakest link.
  • Is it the firmware? I’ve had the code running on a MSP430F5529 LaunchPad, but I’ve switched down to a smaller F5510 and reassigned the pins.

Well, it took three tries – as you can see from the scribble on the board above. There’s a mistake around the TPS77333 voltage regulator which truned out to be a footprint error in the Eagle-supplied libraries. It’s now a bodged-in TPS77533. There’s another by the LED which I’ve had to swap for two separate ones rather than a red/green single package. My mistake on the pinout there.

It turns out the problem was the soldering of the QFN packaged TRF7970A. Buying a microscope helped me sort it out and it’s finally there! It’s finally working! There’s more to do, of course. I need to fix the mistakes. The software could be tidier. Version 2.1 will be perfect (probably). I’ll publish the design and code when it’s tidy, but in the mean time if anyone’s interested in any of it, let me know.


I laser cut a simple acrylic enclosure. It’s just black acrylic on the back – with some 5mm neodymium magnets press fitted into holes so it attaches firmly to my PC.
Some clear acrylic makes up the front so I can see the LEDs and the fruits of my labours. M3 nylon bolts go into threaded holes on the rear piece.

It’s been harder and slower than I expected but I’m very happy.