ChipCon SmartRF04 EB firmware reflashing

A while ago I picked up a CC1110 from eBay for cheap as we were looking at doing an IM-ME clone, Eventually got around back to the C11xx work.

ChipCon were bought by TI in about 2006, for the CC family, see the clue? the devboard I have is actually from the pre TI days, so I was amazed when in 2016 I downloaded the TI Smart RF software it connected and saw the board. The two dev boards also actually worked so lucked out on eBay again…

On plugging in it asked to update the firmware, which I did. . After that I could use Smart RF to control the board, but not from the board itself, no LCD display. So I went off and looked for old versions of Smart RF and older HEX files, no luck , OEMs always want to get rid of that stuff, they should make it all available but it is a support headache from the help vampyres, and TI’s forums had a few similar questions that mostly dead ended.

So I looked into the host chip, it’s a SI 8051F32, so needs a yet another debugger interface, I looked it up and see its USB Debug Adapter for about $30, not bad. It has an unusual shape and I recall having one, so I went and dug around and found it in a box, I actually had took it out of a box, looking through various devboards, looked at my hand and there it was, great…

So downloaded SI’s production programmer, still works, doesn’t read back only verify and program.. (is the verify download and compare, checksum or compare on chip) saw eclipse mentioned/java and went back to look for a different programming tool, SI have a utility dll from programming, read docs same deal only a memory downloader, check the memory map 0x0 – 0x3FFF with after 0x3DFF reserved.  Once I connect the USB Debug Adapter to the new software it want’s to update the firmware, here we go again, flashes and its OK after a USB reset.

Connected to the board, downloaded it to a “log file” which is literally a dump of the memory in either dec(with leading zeros)  or hex, and a cr\lf… quick sed script add commas to the dec, load it into an array, oh yeah, leading 0’s so it thinks its base 8 octal. redo it in hex output, add 0x, and end with , read it into an array write it out.

convert the newer TI supplied hex that didn’t work files to bin from the new 40 version, compare the two against the one I just read. they’re similar at the start, but it is shifted..  I realise the bootloader is there as as a separate hex, it’s loaded from 0x0 – 0x0800, so I chop that off and wrote out the file. they are now only slight differences, 0xFF where 0x00 is in the hex, this is likely a skip in the hex (unlikely since the hex file showed a single section) or the default erase byte .

Had I been watching the hex2bin output I’d have seen the start address of the firmware as 0x800, so at least independently verified, had too many windows open..

Lowest address  = 00000800
Highest address = 00003BDB
Pad Byte        = 0
8-bit Checksum = BE

So now all have to do is reflash the board with the code from the second board that I did not upgrade, so convert the .bin to .hex, either without the bootloader and reflash it with the TI tools, or clone one to the other and reflash with SI adapter.

Reflashed the whole thing in the end, which reverted it to 28 build.. Still no display when the EM is connected….so either flash on the EM module (which still works in Smart RF) mode or  theres something wrong with the EM module…


and yes reflashed the cc1110 and its back to life!  Probably should have tried that first Smile


SI USB chip docs

SI flash util


SmartRF flash programmer to redo the CC1110

LightObject Z Table for the K40/EBAY Chinese lasers.

Editors Note: This ztable doesn’t actually fit in my particular Chinese laser, it is too tall… I’m seeing if they have shorter threaded rods available. my lasers gantry is about 93mm to clear, ztable is 105mm. le sigh….

Note 2: see bottom for updates.


I Picked up a motorised Z table from light objects for my Chinese cheapo laser cutter, it’d make it a lot more useful.

Of course first time I saw it, I didn’t pick It up and it was out of stock the next day, so a few months later I saw them back again and ordered one, arrived a few days later. First thing I noticed no instructions, but simple enough. A week or so later I got an email from them saying there might be a cable missing, I wasn’t sure it was meant to come with one but either way, they sent it out and got it a few days later, so good service there.

Of course I thought I had stepper drivers around, but didn’t so I went back to LO and bought the M415 driver. So put it together and waited for them to arrive.

After hooking up the motors  and stepper to my frequency generator, I got nada, the motor wasn’t holding , stepping , buzzing or anything..

I probed the motor wires with an ohm meter and they were open circuit, so I prodded the pins on the motor and found the two coils, the cable was wired incorrectly.

I fed the info back to lightobject, who are a super nice place to deal with, just had to move two wires on the connector from position 1, to 2 and from 6 to 5.


Correct wiring.

I used the M415 driver, tried out a few speeds from 1khz to 16khz to see what gave the best results, 6khz seemed fine (16 steps) I also set the current of off/on/off or 1.05A measuring the power draw on my PSU it was about 0.4A which the datasheet for the motors its mean to be claim, the driver manual notes that the current on the coils might be less than you set, and it reduces the current by about 60% when idle. Though these might be different motors, they are not getting hot.



The Electronic Goldmine had a sale on miniswitches, I want to type mini microswitches, but that seems wrong, Stock # 61690B so I picked up a 100 or so they’re right angled pcb thru hole mount lever style, I wanted them for various things like cnc limit switches, so I’ll add them to this and see what happens

So then I needed something to drive it , poked through my dev board boxes and found a Cypress CY8CKIT-042 (as well as a stepper motor driver! ). It’s the PSOC4 Pioneer board


I did a quick test app


These are the pins I used.

If either of the switches are pressed, the table goes up and down, the limit switches will stop the current direction, but allow it to go the other way.

I set the PWM to period 32/16 count , that gave me just about 6khz

The pins I choose make the RGB LED on the board change colour when up/.down is selected

Pulse is wired to PUL on the m415 and Dir to DIR, common ground.


I could use the capsense to do a slider for the speed it moves at, but I think a fast/slow button set is easier.


Now all I have to do is mount the limit switches, and thenfit it into the laser


Remove the old bed is just four screws

and then remove these posts (and all the gunk)


One of the four posts on the z table gets in the way of the smoke extractor. so I removed the post, we’ll see what the effect of that is.


I haven’t decided how best to install it yet. I’ll update when I do.


The CY8CKIT is about $25, so instead I decided to make it for about $2


Decided to try to redo one of the old cylon boards to see if I can make a mini controller. The ATTIN2313A is a pretty neat chip. I modded my cylon to look like this, its got extra ports too. its about 2.6cm x 2.6cm

and a short while later (This is actually a rougher version I recut it)


With some rubout (potatocam)


Wired up.


Momentary pushes ( all my black ones were not working correctly, so I used two red) one easy way to wire up the limits is to use a microswitch with NC connections, normally closed  vs NO normally open. Wire the limit in series with the switch, so when its engaged the control button won’t be able to close the circuit, so you can only use the down one.


The downside to doing that way, rather than using the microprocessors inputs is that its harder to override if for some reason you need too, but if you’ve got limited IO space, and makes the wiring simpler, plus don’t really have to worry about noise/debounce.


Mounted onto the driver. since it’s a double sided board and I only cut one side, the blue kynar is doing ground, I couldn’t route it single but I might drop one of the io’s and add a ground on the rear pins. The cap is 1uF 0805 it won’t work properly without this


And there we have it, now to mount it in the laser, the tedious part!


Z table


The wiring is really simple.

Two phases to the motor, 24Vish to the motor driver, common ground, 5V to the opto and the controller board. The switches are common ground, then to the controller board, pins 2 and 3, pulse and dir to the controller, 8 and 9.


with notes.



Making the table shorter

The threaded rod is M6 x 1.0 pitch. So now I need a lathe, any excuse to buy tools right? So I did !


I figured I’d need some better measuring tools as I go along, so thread per inch measuring tool (doesn’t do metric aye aye aye ) mitutoyo gauges with SPC , very nice.



Since I also had gift cards lying around on amazon from bitcoin, I thought what the hell and bought one of those teen tiny lathes, its exactly what you’d expect it to be. I’m still deciding which real lathe to actually buy.



took the table apart


Marked the aluminium posts and cut them with a hacksaw, about 1 cm,  to fit my laser.


Then I marked the area to remove from the threaded rods, hacksawed them down.


On one of these the brass gear was loose, so I popped it off and filled it with thread locker then put it back on , that held it.

Next measured how much to remove for the bearings, I used the brass parts as a marker.


Then I squared off the aluminium posts and drilled holes in the middle.


Test fit


Now to see if it clears the gantry



I found it easier to remove the side bars while it was in the machine to get the threaded rods into the bearings


Poking around the laser for power, we need 18-24V, and 5V for the CPU.


This switch on the right has 5V, but if it’s a moshi board, there is an easier place.

This white connector with the four green, and red/black wires coming off the power supply, its marked 24V G 5V L , so that’s all we need.


The other side plugs into the moshi driver board.


Moshi marked it so bottom is gnd, 24v, 5v, L, I tapped into those by removing the pins and soldering to them. just pressing a pointed thing into the teeth and gently removing it. Solder the wires and then push the tooth out a little and snap it back in.


Next I drilled a couple of holes for the up/down switches.


And that’s more or less it, plugged in the stepper and tested it, all good.


I don’t have any tap/die sets so  I didn’t tap the posts , and I wanted to keep the original setup, plus again more excuses to buy more tools.


Made sure it was all working before I started bolting it all down.


Laser is almost running again, the pump I bought from lowes to replace the original chinese one fell apart so have to fix that now.


I might make a change to the software so if you press up, hold it then press down it’ll go faster (or slower),, and vice a versa.

Irritrol–RD1200 Sprinkler controller repair

I always have issues with water, I’ve flooded a couple of houses over the years. So the new house’s sprinkler system is no surprise, we have almost 150PSI of water pressure going into an old metal pipe sprinkler system, and I’ve been slowly replacing the pipe and reducing the pressure under concrete and all that,. This week i noticed a large dome shape on the front lawn and it turned out there was a few hundred gallons of water under the turf, and another broken pipe. Also the new flowers I planted had started to die off while I’d been out of town. the people I’d used to replace some of the bad pipes had missed one sprinkler output which had covered these flowers, so it goes on. I went out to repair these and I noticed the sprinkler solenoid  was chattering. 

Checking out the rest of them, they were all chattering, so its obviously a problem at the controller and not the solenoids. I checked the output of the transformer, about 26VAC, so that was fine, watching the sprinkler output it was swinging from about 6VAC to 18VAC, when it hit 12VAC or so the solenoids would chatter.

So I opened up the control box. Remove, power, Remove the ribbon cable, me plastic tabs that just pop out, then two screws hold the PCB down, which keeps the flexible LCD connector in place.  it just lifts out after the screws are removed.


A few minutes inspection revealed the issue.


The electrolytic capacitor is slightly swollen and leaking, its a 220uF 35V axial style, radio shack carries them for about $1.40. Changed it out and  its all working again, but make sure when you reassemble the box that the ABC switch gets on top of the PCB mounted switch, otherwise you’ll be doing what i have to do tonight and take it apart again.

layerOne 2013 badge


Update, PCB’s arrive

Well at the least we’ve got PCBs to hand out Smile though why do you think i choose a coffee mug sized board, worst case is always coasters.

Arrived at 10AM, after MY to TW to JP to USA, at 6AM it was noted as being in Japan..



Funny that I made the tracks stylistic, but we can’t see them. Which is also awesome for debugging.


Now to find out if they actually work! If they don’t well there’s always this option



We’re at layerOne again,  and it always seems to creep up on me. Even though I tried to follow Dark Tangent’s lead for Joe Grand and ‘Badges by Christmas’,  if Christmas is two days before layerOne then I’ve succeeded. I’m starting the 2014 badge after I finish this blog entry, well probably.

We definitely had a tough year for free time this year, got married, bought a house, fixed it up and launched a bunch of stuff at work.  I was having a creative block on what to do, we first though lets do a mash up of  the TV-B-Gone(null) and then the Dangerous Prototypes IR toy,they’re both neat things but I just felt we needed a bit more so about a week and a half ago I scrapped everything and started over, which when you have no time left, busy at work and funds are looking low is a really good idea.

I’ve thought about crowdsourcing the idea, but that doesn’t always work, in fact it rarely does. The ideas are either too crazy, impossible, cost about as much as yahoo overpaid for tumblr or only interesting to one or two people. Maybe 2014 we’ll try again.

So little time in fact, the PCB’s don’t arrive til Wednesday, our supplier had a snafu or something and they were delayed a tad. So here is a quick render with eagle3d. If you’ve bumped into me recently, you’ll notice I’ve been pre-occupied, this is definitely the closest we’ve cut it in time.


The USB is a mini not the giant one hanging off there, and the OLED is missing.

The LED drivers are the super nice TLC5947DAP and I’m not using charlieplexing this time, so they’ll look great ( I hope !), we used this chip on the blinky ball and the Tron disc the CPU is an ATXMEGA32A4U-AU 

Some of the challenges for electronics badges is making something everyone can build, have interest in and be interesting and be hack-able.,. Preferably  that they can also use past conference. we do tend to rework or use other proven designs because then we can see what the interest level is, last year we did the RC cars and people liked it but it wasn’t really well taken in and that was lot of work to get it right and find the right parts.

I started off with a chip and wanted to try the ATXMega it was the one i was going to use for the IR toy since it has USB. I came across the xprotolab and though that’d be a great badge since it has so much stuff on it and people can use it as a tool as well.  For the people that wanted one of the usual blinky LED toys, I slapped on a smaller version of the ‘Tron’ disc we made. This way we’ve go ta badge that is simple to build and looks purty, then a second circuit that is more complex to build , has an OLED and lots of features.  I pinged gabotronics about us using their design and they were super nice about it too. He’s also running a kick-starter for a portable version of the xprotolab too.

I picked up 8,000 LEDs since typically we only use SMD  and NullSpaceLabs has like 1 million + LED’s in the back room, but not so much in the 3mm variety.  Found a local place in Los Angeles area that had them, they arrived overnight, the OLED’s I found in china. Rest of the parts given the short time frame I picked up at Digikey. Some of the parts can be had cheaper elsewhere, but when you add shipping it ends up being more.

The badge has got all sorts of potential to hack though, the LED’s can be included in the xprotolab as well as be independent,  with the OLED and the extra expansion, as well as the ADC’s it’ll make some fun toys.

I really didn’t have time to prove out a booster for the 3V to 5V even though gabotronics sent me a suitable schematic for the portable version, so that’d be a neat hack too.

Add a Mic or other sensors with a beat detector or simple audio level device. Add on an IR LED and it can be a IR Toy/ TV-B-Gone too. Video game too!

I extended a few of the pads on components that people typically have issues with, or lift pads , particularly the CPU. We have an on-going battle at NSL on lead vs leadless chips, personally I think leadless chips(QFNs) are easier to solder and don’t get damaged as easy, others don’t. This year i opted for the large TQFP44 package with legs. One year I’ll do BGA just for the heck of it.

The PCB’s are posted on the Null Space SVN server the has links to it.

We will of course bring our pro as —- hardware hacking lab, probably a  dozen or more metcals, microscopes, hot plates, scopes, etc. I’ve yet to see another lab as well equipped as ours.








Feature list of the xprotolab (taken from gabotronics site)

  • Mixed Signal Oscilloscope: Simultaneous sampling of analogue and digital signals.
  • Advanced Trigger: Normal / Single / Auto, with rising or falling edge and adjustable trigger level.
  • Meter Mode: Average, Peak to peak and Frequency readout.
  • XY Mode:
    – Plot Lissajous patterns
    – See the phase difference between two waveforms
    – V/I Curve tracer with an external resistor
  • Spectrum Analyser with different windowing options and selectable vertical log.
  • Horizontal and Vertical Cursors with automatic waveform measurements.
  • Arbitrary Waveform Generator with Sweep on all parameters.
  • Display options: Persistence, Different grid options, and more.


Parts Breakdown

The OLED’s I picked up from here


as well as here, I split the orders since they looked like diff models.


The OLED Datasheet  is here

The 3mm LEDs I picked up from ( various colours )

Useful since its reasonably cheap and ships from CA, they came within a day.

The batteries are C123A’s and i got them from along with the holders. They are the cheapest i can find, and we’ve used them before. its a hassle to ship lithium batteries in CA. You’ll see a lot of batteries (especially watch batteries) that are listed a ‘California’ only, they’re crappy, so avoid if possible.


I guess I’ll find out Wednesday night/Thursday if my board layout works! If it doesn’t guess what the hardware hacking competition will be Winking smile 


We do have prizes for the Hardware Hacking competition, I have a pandaboard ex, beaglebone black and a pcduino to give away, and maybe some other stuff, we’ll see what goes down.

Now to start actually designing a badge for 2014. Will the proxmarklcd re-appear?



If you like this badge etc, I’ll be at layerOne, This is what i look like.


If not



Here’s some of other Null Space links :-

Changing the Mac address of a proxim 802.11abgn usb adapter

Windows 7 has a a limitation (That can be removed in the code of the individual driver) that you can’t set a fake mac id starting with 00 on a wireless usb So I did what any normal person would do, pulled apart the adapter, removed the eeprom found and edited the hardware MAC ID


Use a spudger to open the case, its not glued or anything.

I tried a few ways of programming the spi on board, but it just wouldn’t do it,, too much interference.


The chip is glued down, some acetone will take care of that, desolder the chip and pop it into a eeprom reader its an ATMEGA AT61 series SPI EEPROM so easy enough. Once you have the hex file, grep for the mac address in hex. Edit it to what you want it to be and reflash it back to the chip, there is no checksum etc.

You can send eeprom commands back to the chip via the driver, but I didn’t look into it too deeply;. Its pretty quick to remove it and change it, obviously this is more useful for cloning vs just changing.


The Proxim / Orinoco is just a Taiwanese usb adapter, I haven’t seen it for sale under the different brands though, but its considerably cheaper.


I’ll add some pictures to the post later.

Kinetis KL25Z Freescale freedom platform


Today my KL25Z dev board arrived from Newark,  I had it on pre-order as soon as i saw it, mainly because its cheap at $12.95 +tax and because its ARM M0+ that can go upto 48Mhz.

Comes in a nice box you solder the headers in if you want too, otherwise you get nothing with it ( but that’s not a bad thing ) the box has a colour print diagram of the connections to the board on the underside and its a nicely packaged.


Oddly, or not, the first thing I noticed was an unpopulated spot for an IC U5, a quick scan of the schematics and its for an AT45DB161D which is a 5V tolerant 3.3V SPI flash memory chip. Which is great because I just happen to have a stack of 16’, 32’s and 64’s at NullSpace. I’ll update the blog when I add it and see if it works, it is a fairly costly IC so that might be why its not included versus a build mistake.

Underneath there is a space for a CR2032 PTH battery holder.

It is a very nicely laid out board, going for the black mask with gold finish. Though placement of the RST button could be better, the placement of the pads underneath mean when you press the reset the board flips up, less so when the USB cables are plugged in, a minor annoyance. The captouch could also have done with something underneath as well, its just slightly off balance, again very minor and easily fixed.


specs are :-

  • MKL25Z128VLK4 MCU – 48 MHz, 128 KB flash, 16 KB SRAM, USB OTG (FS), 80LQFP
  • Capacitive touch “slider,” MMA8451Q accelerometer, tri-colour LED
  • Easy access to MCU I/O
  • Sophisticated OpenSDA debug interface
  • Mass storage device flash programming interface (default) – no tool installation required to evaluate demo apps
  • P&E Multilink interface provides run-control debugging and compatibility with IDE tools
  • Open-source data logging application provides an example for customer, partner and enthusiast development on the OpenSDA circuit


I dunno how I feel about the P&E stuff, Freescale must own stock in them or something, I have a bunch of P&E BDM’s, cyclones, cpu32/cpu16 etc. which i use for my reverse engineering work but they’re expensive and the software is about 1990’s level of basic, everything is an add on cost, the flash tool is one cost, programmer/debugger, capacity on the cyclone max etc. Also they don’t have a lot of protection, I’ve blown up my cyclone max with a bad PSU,  for such an expensive tool its poorly protected.

Talking about questionable software, my old friend CodeWarrior rears its head again, anyone who has been in game development for a long time, especially console, probably has a special place for CodeWarrior, along with the Sony CD burners for PSONE. Freescale/Motorola bought them out a long time ago and so of course it keeps coming back to haunt me, and haunt me it does. Still I’m sure its gotten better?… I’m not sure why TI/Freescale etc wants to roll their own dev tools, maybe for QC or lock–in but GCC is OK enough to use it and ARM were smart and paid someone to make the ARM support better in GCC. Beyond that CodeSourcery seem to do a good job of keeping it all together. Maybe I do want to download another 1.5G Eclipse installer (not CW thankfully). I think its a mistake going down this route, but there you go.

Link to CodeWarrior

Keil  (needs a patch )and IAR have tools as well,

Anyway enough of that, at least they’re trying and giving away what they can, my beefs lie with them mostly on the commercial side of things anyway.

This is what the OpenSDA firmware zip file contains

10/02/2012  11:48          79,583  DEBUG-APP_Pemicro_v102.SDA
10/02/2012  11:48         213,461  MSD-FRDM-KL05Z_Pemicro_v105.SDA
10/02/2012  11:48         213,461  MSD-FRDM-KL25Z_Pemicro_v105.SDA
10/02/2012  11:48         213,501  MSD-XTWR-KL25Z48M_Pemicro_v105.SDA
10/02/2012  11:47             177  Readme.txt
10/02/2012  11:47         287,369  Updating the OpenSDA Firmware.pdf

So no tools host side needed as such, just firmware for the connection to CW/PE multilinks.

It supports ETM and SWD, OpenSDA this doc goes over how to setup and upload files.

P&E’s tools are

Its an CDC driver that should auto install on Windows, there are drivers for it available if not. After that its drag and drop binary or Motorola S record files, they note that the dev tools work primarily on Windows but CDC obviously works on the other platforms.


< to be continued >

Soldercore quick intro


I ordered a SolderCore from Mouser yesterday, it arrived this morning. Its a pretty nice little device. Oddly I’d had some interaction with one of the creators at Rowley Associates, Paul,  on an email list talking about C compilers/assembler etc and it turns out we’re both Lotus people as well as having ECU related experiences, it is a small world.

Haven’t done much with yet, since i’m not at NullSpace and all my stuff is there.


  • Arduino Form Factor
  • Based upon a 80 MHz Cortex-M3
  • 512KB Flash, 96KB contiguous RAM
  • Built in Ethernet support with an on-board RJ45 connector.
  • USB OTG support with an on board microAB connector.
  • On board microSD holder.
  • Support for additional Flash and FRAM devices.
  • CAN, I2S, 2xI2C, UART, PWM, ADC, SPI and QEI supported
  • On board standard 10 way SWD JTAG header. (Only fitted to the Commando variant)
  • Power can be supplied via USB or the barrel jack (6V – 9V DC).

So decent enough specs.

Nice things are , no drivers, so no one whining about CDC driver support in Windows 7.  All the help, examples firmware are net enabled. All you need is telnet to edit.



compared to a Pandaboard ES, and one of our NSL ADK boards. Soldercore in the middle.

If you want the headers, you can solder them on. I like the idea Sparkfun has with single row headers and to offset every other one so its easier to solder, but these aren’t difficult, just hold and tack the first one very lightly with solder, make sure its straight and do the others. That first tack is important so its aligned and then you can re-align easily.

I plugged it in, pinged as per the label on the back, then i use Putty to login  in to it. (change from ssh to telnet) also it uses ^H for backspace so edit that too. I then posted to the forums with a hello world, but then realised it was a program that did it. So i went off to find it, since it isn’t in the examples but in the help section instead.

Had to edit a bit first. Mine didn’t like the command $NL so i used $LF instead. Then came along figuring out how to set NET.SMTPSERVER (which is fairly futile for me at this point so all my SMTP servers require a login) but trying anyway. I of course battled ahead and did NET.SMTPSERVER = “” NET.SMTPSERVER = “”  etc neither worked. It says ‘Digital I/O’ as the type.  My SMTP server will work even less with an IP address since it wants to use the FQDN to find it. But regardless..

Luckily BASIC being immediate, i just did


Which yielded

[0, 0, 0, 0]

Aha!, So

NET.SMTPSERVER = [192,168,1,1]

Easy enough. But i don’t have an open relay… So i got as far as ?SMTP server down in 60:

10 SUBJECT = "Hello from SolderCore!"
20 FROM = NET.NAME + “”  ‘ fill in your own e-mail address
30 TOO = ""
40 BODY = "Hello from " + NET.NAME + "." + $LF
50 BODY = BODY + "My device address is ." + $LF
70 PRINT "e-mail away!"
80 END

It didn’t like the IP$(NET.ADDR) either so i replaced it with text.

The original looks like

> list ↵ 10 SUBJECT = "Hello from SolderCore!" 20 FROM = NET.NAME + "@local" ' fill in your own e-mail address 30 TOO = "" 40 BODY = "Hello from " + NET.NAME + "." + $NL 50 BODY = BODY + "My device address is " + IP$(NET.IPADDR) + "." + $NL 60 MAIL TOO, FROM, SUBJECT, BODY 70 PRINT "e-mail away!" 80 END > run ↵ e-mail away! >


I concluded the problems/missing command might be an old firmware so I tried to do a firmware update with firmware run, but i realised it needed a FAT16 SD card (a good one not a cheap fakey one) All i had was  a 16B MicroSD so its too big, but normally you’d do. 2G is what you need.


where n: is the drive letter. After a year or two , it’ll be formatted

You should see something like :-

“Insert new disk for drive J:

and press ENTER when ready…

The type of the file system is FAT32.

The new file system is FAT.

Verifying 15267M (this is a problem)

You can also use this Which supposedly does a better job of the FAT format. I can’t try it at the moment, since format is still running.

The website does go into this in detail, if the GUI doesn’t show FAT as an option, the card is too big..

It has a few nice features, being able to update firmware over the internet is great, and you can type


and it’ll list all the examples available, over the net. Typing

example “welcome”

will load the welcome.bas, so that is pretty neat, most of the examples look like they need one of the add on boards though. It is case sensitive on the example filenames.



Seems equivalent to firmware catalog and it stops me typing catalogue(j/k)

A lot of people might gripe about BASIC but what BASIC looks like versus what goes on in the background are completely different things, look at BlitzBasic etc, they’re very quick. Having to do line numbers is a bit of a throwback for sure.

Here are a lot of builtin commands that do useful math, dot products, matrices etc. sin/cos, etc. Very useful. At worst case you can pop on a JTAG and write everything in C/ASM to your hearts content.

I have had one  reset so far, but its probably the usb port i have isn’t giving me enough juice, it has external power port too.  If i find a small enough SD card, i can try to update the firmware. My firmware is also at 0.9.5 which is older than they list at the website, so I’m sure some of the stuff has been fixed already. I’ll update the blog when i find an SD card.

I did all this with it so far, and no drivers installed and no software installed i can run it from android or nokia phone as long as it has telnet.

The usual BASIC commands like EDIT, RENUMBER work, its just like being back on the BBC or Archimedes.

Haven’t done much else with it yet, but I’m really interested in at as we use the Stellaris chips for other projects. I also really like Paul from the small interactions I’ve had with them, and Rowley Associates , I don’t know Iain or K&I but they did a nice layout job, so I’m looking forward to where they go with it. Anyone who’s a Lotus nut is ok with me !



I realised my Skyrocket had a 2GB card in it, so I swapped that out, formatted it as FAT16 and made the top level SYS folder, plugged it into the soldercore and typed

firmware run

After a few seconds its at 0.9.12 now. I retried the original syntax of the Mail  example and it accepted it fine, i still can’t relay the email but it does accept the commands that were missing. Easiest firmware update ever.

Quickly, an open relay! To hMailServer !

NSL gets a laser cutter

We’ve been trying to sort out a laser cutter for a while now, last year we bought a 40W tube and a PSU and burned holes into things. While hugely entertaining, it lacked some precision


That was as far as it went, so i had enough and just decided to order one, after a few stops and starts we bought an LC900N directly from wklaser in China, they’re the same ones FS laser and hurricane etc sell but they do some mods to the software/boards, but nothing that is worth the price increase that i can see. It cost us under $4,000 USD for a 90W laser with a 600x900mm cutting area, with a motorised Z table from china to us.

We’re on the third floor and our elevator is ( A ) too small ( B ) out of order, so we had to levitate it in.. Having hindsight we could have taken it apart, but had  been previously assured we couldn’t do that. Anyway…..

We did what anyone would do and removed the window, hired a crane and lifted it in through the window.


Taking it out to inspect the contents etc.


Building a landing table

Scientific weight test, the window is gone and 3rd floor, proceed to start jumping. Some people were confused about what don’t go past the blue line meant.

Yes this is a good idea.


Test lift

We put out cones, people removed them and parked anyway, I told a few people they may not want to park there, most people got annoyed and asked why not? So i explained, most of them changed location. But only most….


ok we’ve gotten it to here, what now ? Time for a meeting.

The tricky part, removing the first strap, everyone pitched in to help.

The Rapunzel method started off well but we discovered a problem in the hair length dept.


And its in!

Books are useful. Dropping it the last meter was harder than getting it from China.




Put the window back, respackle it and no one is the wiser.


Ok so the laser is purchased, shipped from china, craned in through a window. What next?



First install the tube


The laser needs a vent, preferably hilarious. (needs video)

Obviously take it apart and improve it.

The height setting tool needed improvement, so made that and labelled it as such

Test cuts. Lots of test cuts.

Align mirrors, the manual came in useful here. (bits of paper)

Now change mind, remove the mirrors, turns out they’re dirty! So we swapped them out for ii-iv’s, increasing the power 20%. Interestingly there is a technique to make CO2 laser mirrors from hard drive platters hard disk platter co2 laser mirror

Frostbite hand.

The new lens vs old one.

Ply Wood 5.2mm 8speed 90power OLD LENS
ply wood 5.2mm 15speed 40power NEW LENS


The T4 28” fluorescent bulb burned out after a day or so so we replaced it with some halogens, especially since they’re hard to source locally, test fitted with duct tape. The whole machine gets covered in grease for shipping so lots of cleaning first.

Next well they said we can’t cut steel. So quick trip to home depot for some O2.

The glo-stick is vital

well it is cut but…. not really useable, however great progress


vertical video!

Here we cut some 1” acrylic



The GUI is full of odd chinese-english conversions, but they use a UTF8 .ini file so you can edit it all you want. Instead of Datum, it is now Home . Just edit language.ini or use Resource Editor on the .exe for permanent changes the software does nt self check, even though it uses a senselock dongle.


Next is hack the software, we figured out the control software, reversed most of the API it actually rasterises vectors in the PC side and sends them over as points!! I’m shocked and amazed since the machine has a ‘DSP’ based controller board. It generates a TXT file and compiles it ,then uploads it the API has move, p-move, arc and circle functions but the software never uses them..


CLASS_DECLSPEC int APICALL M05_m_fast_line2(int chx,long disx,int chy,long disy);
CLASS_DECLSPEC int APICALL M05_m_set_vector_profile(double ls,double hs,double ac);
CLASS_DECLSPEC int APICALL M05_m_set_vector_profile2(double start_ls, double hs, double end_ls, double ac, double dc);
CLASS_DECLSPEC int APICALL M05_m_curve_vertex();
CLASS_DECLSPEC int APICALL M05_m_curve_begin();
CLASS_DECLSPEC int APICALL M05_m_curve_end();
CLASS_DECLSPEC int APICALL M05_m_set_period(double period);
CLASS_DECLSPEC int APICALL M05_m_set_power(int LowPower,int HighPower);
CLASS_DECLSPEC int APICALL M05_m_set_laser_mode(int mode);

The are all set ramp speeds, laser on, move here, move here move here, move here. Not set point, radius calculate in controller.


Oddly the first command we figured out (unintentionally) was fire the laser at full power indefinitely.

Is it off, no, is it off now , no ? how about now ,, no ? OK what’s the tube temp? still not off ? Easy to fix though, its just a toggle on/off. You also can’t easily jog the laser head around with the laser on, it’ll work but you can’t turn it off easily!


Knock out a quick GUI in Visual Studio.

I updated the header file for the DLL on our SVN. I’ll document it as i go along

Example of the txt file, which it compiles on the PC side.

CMD409,416,880,3000,41666,900,5000 //set  ramp speeds and power
CMD050,1,1 //laser on
CMD001,63556,42631 // move
CMD050,1,0 //laser off
i’m surprised it rasterises the vectors though, i was expecting to see a command for a circle that defined a center,radius etc.
speed change. 100 to 300
power change 9 to 99 ( *100)
horizontal line moved in y
horizontal line moved in x

Lots of boxes were cut

boxmaker scripty thing

Found a nice dragon box on thingverse

bVector made  a nice mod to that case.

So this ends our first week with the cutter, we have to decide if we’re replacing the controller, Leetro apparently want us to buy $25,000 of stuff to get the SDK documentation, but we’re so far into reversing it, that won’t matter. The controller might be ok. It has some strangeness we want it to speak GCODE so maybe another GRBL based controller like we did for Pickobear.

We’re also building a new frame for it, and updating it to 170W laser tube (maybe)

more to come….

Preparing for LayerOne 2012 at Null Space Labs  our awesome hacker conference in Anaheim, CA on 5/26/2012!

This year for our electronic badges we wanted something that people could maybe get some more interaction out of than is usual. So I figured lets make the badges into RC cars. The idea being the badge itself was the chassis for the car.

First off I thought buy some wheels, motors, gears from some hobby/robot store and use those to build up the cars, well that didn’t go well unless our budget was $100’s per car, its crazy how much people charge for the little wheels and motors kits.

We looked at the usual Tamiya kits which aren’t terribly priced, strangely even though Tamiya is about 10 miles from us, it was cheaper to buy them from abroad and ship back, but still very costly. Also I wanted tanks, but sadly no.

These are about $18 ish, it varies. It does have more parts though but the gearbox though a sheer master of Japanese ingenuity and design, won’t work for us.

Next was the usual hobby and robotic online stores, waaaaaaaaaaay more expensive, motors alone were crazy priced, especially the geared ones. So plan C, China.. Remember we need motors, mounting hardware, hearing, wheels, axels, steering mechanism, remote control parts.

I live on the edge of the Toy District in Downtown Los Angeles, so I wandered around and looked through the various stores for suitable donors.

We pulled apart a bunch of these figuring we could just take all the motors and wheels off and re-use them, and we could at a massive saving the FX Race car I picked up for $3.50

Pulling the cars apart we found they all used the RX-2B/TX-2B chips, I contacted the OEM in China for some of the chips and we brought in a bundle of them. Silan Electronics. Data Sheet

Of course its such a popular chip, others have come across it too

krs did a way more awesome schematic though

We didn’t manage to source the SMD version which some cars had, some of which are a knock off of the Silan. For a very simple short range RF setup with 5 functions its not bad at all. The (RX-2B/TX-2B) chips themselves has nothing to do with the RF stage, it just encodes or decodes the pulse train into an on/off for each of the 5 outputs.


So I started working on  a prototype car I used the electronics out of the car, and the wheels and motors, the top part of the PCB we reverse engineered the remote control and added it to the badge pcb, it was designed to snap off so you could drive the car part around and it’d still identify you as a conference attendee.

Paper aeroplane with wheels. Back to the drawing board.


Note to self, check wear on router bit first…..

But now we’re getting to the basic shape, the rear and front are both measured up to fit.


Here it is compared to our cheapest car and the most expensive (at the toy market and its still only $12!!) Geared motor and motorised steering. Yes they’re cheap motors and they’ll wear out but the kits are $3.50 – $4.50 ish and you get two motors.

Its drivable at this point, the front wheels get stuck the maximum turning angles.

Back to eagle, to refine it a ‘tad’. Add three batteries, remote and the car. We’re using CR123a’s


Cut it out. Basically Model T to well a Model T really..


This is how Ferrari started BTW

Add some more bits, to hold the rear drive motor we had to go around the wheels rather than sleek, this isn’t great but not really an easy way to hold the rear on.

this one only has one battery, and so its running at 3V, a bit less since its an old battery. Adding two batteries its a lot faster. Of course all the video we shot of the nicer cars and other driving, seem to have disappeared..


The tuneable inductor was going to be the tricky part, krs and mmca sat and tried out different settings, a resistor is used to set speed of the encode/decode time allowing multiple cars on the same frequency. See page 6 of the data sheet 

The nicer cars have a 27.145Mhz carrier frequency crystal, the cheapest cars didn’t use crystals at all.. The FCC has been informed obviously. However they are surprisingly accurate.

The crystals were ‘hard’ to get , read unpossible in the USA. eBay as usual came through, one seller agreed to DHL them to me and I got them in a few days from again China, which is great, of course all the others I bought that had ‘30 day’ delivery times also turned up the next week. So I have quite a lot of 24.145Mhz crystals for you know all those things that I use 24.145Mhz for, don’t be surprised to see us selling them on eBay Winking smile 

We built a test harness for the chips to see how it works, it mixes a a frequency with a pulse train, sends that out, strips out just the pulses and the chip decodes it into a single pin on the ic, left, right up down etc.

Everything was going pretty well, it wasn’t going to break the bank for us and we had a pretty good car running around. It was zippy and as easy to control as the normal ones.

So I think ok better buy all the cars, head back to the same store, with one of the cars, the business card and quote from the first few we bought. The guy swears he’s never sold them, even though I have pictures of us in the store buying them. So that’s a problem the next cheapest car is $5.50 I haggle him down to $4.50 and knowing I have some of this newer type at NSL, I head back to take it apart and see how it goes together so we can mod the PCB chassis.

I take apart all of the other cars, not one of them is suitable for mounting as easily (of course) I find the distributor, they’ve either gone under or changed names, I find the new supplier in the same address but they don’t carry that line…

So what do we do, time is getting short.. OK I think, we’ll just give people a finished car and a remote, but that’s not much on the badge.  So of course what do we add to it, yes everyone’s favourite  “open source/hardware” begins with an A ends with ‘sounds terrible to the average Italian’.

We can still use the parts from the slightly more expensive cars as bases for PCB cars and robots but we’d need some more standoffs and bits to mount the motors, much easier when you’re building a few of them at the space, but the idea is to get people up and running as quickly as possible at the conference so they can hack on them and enjoy the rest of conference.

I redesign  the badge and have them sent out for quick turn PCB at Pentalogix.

A few minutes later and here it is. We stripped off everything not needed and made it able to run off 3V or less and 5V USB with magical jumpers. I forgot one of the power traces, so a quick wire jumper after the old, why isn’t it booting up! We’re using the slowduino boot loader (page is down) so it can run at 3V albeit at a slower clock rate of up to 8Mhz. We left the pads for the xtals too though so it can function as a full speed device.


So now instead of it being  car, it’s a remote control that has the inputs wired to the ATMega CPU so that it can be controlled via USB, autonomous, strapped to the car, add sensors , switches etc. We left in the blink LED well because LEDs and the duino..

The QRCODE came from an eagle script on a forum post from honken on Ian Lesnet’s dangerous prototypes forum, which is a great place btw

The top part you can cut off and the two parts still work, like everyone thinks worms can do. Though if you cut it off badly, neither will work…

New donor car, sadly not as awesome. I did try!

mmca and krs further tune and identify the parts we need. Spec Ana time, looking great.


Tuning the antenna lengths, by (A) doing the maths, (B) guessing and cutting lengths.  The peak is the 27.145Mhz the blips are the encoded data for the remote

Guessing worked better,, science!! oh wait!

Also you can see our spindle for the mini CNC PCB we’re building, its been sitting there since late last year…never enough time…

This actually worked for the proxmark, just a spool of wire. I think our best antenna was around a metre


It drives..



OK so now that’s working back to the store and pick up cars and hoping the guy still sells cars, that lady is the one who originally sold me the other cars, and she remembers but its all too late now.


This left side is pretty much all helicopters and cars. As I wait for krs to come pick me up they try to sell me helicopters and all sorts of other things, those ones are IR LED based for the remote control, but that’s another story.


Cheap $4.50 crap you say? Well consider this

Those ‘drift’ cars come with one on/off led headlights, tail lights, motors, spare wheels, rechargeable batteries, aa batteries, remote and some other stuff, I picked them up for $8 for staff and other volunteers. the other boxes have the $4.50 cars. Also they drift awesome since they have shiny plastic wheels, lots of fun and great donor parts.For $8 ! Granted we’re limited on what we can do with it as a robotic base, but for lots of cheap steerable bots its great.

For that price its really well made too. its got a can style electrolytic cap!, actual connectors and lots of screws holding things together.


Our pile of donor cars gets bigger along the way.. The engrish on these is great btw. It is all FAST YOU GO and SPEED BECOMING etc


And our neat pile of cars gets reduced


krs making the test boards.

With a prep sheets to help people build them at the conference.



I redesign the badge and send it in to Pentalogix’s off shore PCB fab.  We got them today (Wednesday), the conference is on Saturday.

Looks ok right? Granted I admit I didn’t spent as much time on the graphics this time…. The QRCode works great but I did waver on changing the URL to a or something so we could have changed the link during the conference.. Ahh well. I also have a QR code for NSL with the URL as a graphic inside it but I didn’t want to push my luck on how well it read. I spent a more time drawing the L1 logo, rather than stick with the BMP to eagle conversion, I did that the over drew it with rectangles and a circle, since its more of an even finish and easier to scale. the www box was meant to be place holder.. We used the standard 2×3 ICSP header instead of usual 6×1 which was a hassle since all our 2×3 to 2×3 cables had been converted into 2×3 to 1×6 adapters.. But easier for others. Which reminds me to go place an order for 2×3 IDC crimped headers..


But wait what??? The PCB is twice as thick!! its .125 vs .0602ish. I check the email order and sure enough I ordered .125 , I talked to Pentalogix and sure enough I did order that, the quick turns were .060s . I thought ‘oops’ so after some investigating I found a slight bug in the element14 to Pentalogix Eagle PCB quote web page, which Pentalogix are now aware of, it doesn’t properly transfer the thickness of the board and changes it to .125” you can change it here, but to be honest ‘finish thickness’ I didn’t notice as being 0.125” as the thickness of the PCB, plus defaults, It’s my fault though, I should have spotted it.


Anyways no biggie, it can probably stop bullets now. Its solid…

Blink ! krs built this while I was writing this post. One nice thing about the thick board is that the pins don’t protrude out the other side, so for a badge that’s great! since no pins to mess up fabric

We also get to break out Pickobear for the speaker add on, it’s a shield that plugs in and it’s a remix of the last years badge, but designed as a quick build with a few days turnaround.


Getting crazy! (still have to write the code for it!) its 11:17PM Wednesday….. Plenty of time.. It has a TI TPS61040 boost convertor on it too. Also we have to test it… yes hackerspace….


Batteries and holders arrived today as well, AA’s and CR123as and the battery holders .. super cheap too! from luckily paypal screwed something up, I’d ordered them from elsewhere and batteryspace had them cheaper, so I was able to reorder.


We’re giving away some prizes to people who do the best car/badge hack at layerone , they’re not awesome prizes but hopefully someone likes them, they’ll still have a RC car and a ATMega based controller board.


There’s a lot more I’m going to add to this post, especially technical details. All our projects are open source and are available in our SVN in including all the screw-ups right from the start.. I’m exhausted after this project, and we haven’t even got to the conference yet ! We’ve also got out PCB CNC we’re designing too.

It’s a shame we didn’t get the PCB car thing, I wish we had but it was just time and uncertainty and these are much more hackable with the CPU added.

Packing all the stuff for layerOne, as usual we’ll have an awesome HHV with scopes, Metcal irons , hot air guns  and hot plates, and we’ll be teaching as well as building kits. Hope to see some of you there.


If we’re using shoelaces as lanyards, the lanyard supplier let us down and they didn’t turn up on Friday morning…. the parts from Digikey are supposed to be in on Thursday PM..  Talk about cutting it tight, this is why Joe Grand did an awesome job at Defcon a much larger conference.


Also our 90W laser cutter we imported from China decided to clear port on Wednesday as well, so that is fabulous it would have been really useful to have it earlier  and now it gets to sit in a box in a warehouse til after layerOne.




next years badge ?



Fuses (when I get to the conference, and think OMG what are the fuses, even though we’re preprograming)

E 0xff
H 0xDA
L 0xE2

The LED Blinky ball at [NullSpaceLabs]



I’ll add some clarifications after reading comments on various forums.

It doesn’t need a 70Mhz ARM CPU, all it does is shift bits into a shift register, that’d be a total waste.

There aren’t 16 CPU’s. the slices are designed to be either slave or master, just one ATMega328P chip, they’re chained together, each slice could be independent but it only needs one master.

charlieplexing wouldn’t have been better, it’d have increased the complexity of the board layout and the LED’s wouldn’t anywhere near as bright, the CPU would also need to be faster and its harder to do cool looking patterns, we’ve done a lot of charlieplexed projects. charlieplexing is awesome within its field.


We wanted to kickstart one of other projects at NullSpaceLabs but its a much more narrow field project and we’re going back and forth on what is best, working prototype or solidly laid out plans, partial prototype and partial laid out machine and software, with previous similar builds.

But while we ponder all of that, the blinky ball came from nowhere, its been a popular build at the space, and generated a lot of attention, but its an expensive one off build, so why not kickstart it to reduce costs. (one off’s in parts cost alone would be more than the the total cost of the kickstarter version)

The idea came from a build we saw on Hackaday. The PCB’s have a dedication to the  original ball maker, Nikolai, his is different to ours and ours is a scratch build . If there is one thing we really like at NullSpace its blinky LED’s.

We wanted it too!

So from the post on Hackaday

this :-


then this :-

Then this!

To this!


Earlier prototype of a slice. (this was earlier but no pictures!)



It is split into 16 slices, each slice can operate as a slave or master, you just build one differently its powered by an ATMega328 so easy to use on avr studio/arduino etc.  The master slice can be independent,

The bluetooth module is connected to rx/tx of the blinky so it can be remote controlled from anything with bluetooth SPP, unfortunately that means none jailbroken iPhones are out of the picture, you might be able to do something with xcode and your own phone, but i’m unaware of such a thing. Android is no problem, or meego/symbian/windows mobile etc. Windows/OSX/Linux are all fine too.

I made a simple app that pushes 8 bits (it scales it to 12 bits internally since that is the resolution the LED drivers can handle) via bluetooth and then when its received a push command or the buffer is filled the ball displays that frame of data. That makes it really easy to make patterns and so on.

The sample code on the ball just draws a few patterns, some of it uses modified octobrite code. You can do each led/slice individually by shifting a slice at a time, or the whole ball at once.

The accelerometer is the MMA TI 3-Axis we’ve used before, its SPI and easy to use.

A microphone is also available on an ADC to do sync with music etc ( also can be done remotely)

The ISP is broken out using out 6 straight pin format that we use on all our boards, it ‘ll work with just about any ISP, on Arduino you can bootload over the bluetooth with the right setup.

The battery is a really neat LiFePo4 unit that is much better than the Lithium Ion we’re used to seeing, it gives it a really great runtime of upto 10 hours, depending on brightness of the LEDs.

We’ve published all the information on the ball on our SVN as usual, the kickstarter is simply to get  parts costs down and for us to figure out kickstarter. We’ve got five prototypes that are being slightly modified for easier build for the kickstart DIY version.

The ball works with TLC LED drivers that ‘shift’ the state of the LEDs down the ball, it’s a bit like a framebuffer in a computer you load up the pattern you want and refresh it to the chips and it’ll appear, there are 4096 levels of brightness.


Pictures and videos

Its hard to take still pictures of it, the LEDs look like they’re out, but its just the pattern




Matt from CrashSpace . his first test slice


This is one of the changes we’re making if the kickstart goes through, the wires are just too fiddly to install








Big thanks to Nikolai and Hackaday for showing us the way though, its been a really enjoyable experience so far!

blink on!