Archive for the allmänt grinande Category

Solder Fume Extractor

Posted in allmänt grinande on 2018-12-28 by Kristian

Solder fumes are evil. 

Hence, I’ve planned to add a fume extractor to my workshop for years, but haven’t been really motivated until after finishing my PhD which oddly enough resulted in time to have hobbies again -> more soldering.


I used a square ventilation duct mounted on the garage wall to get the fumes out of the building, then a flexible ventilation hose from the round connector at the bottom of the duct to allow positioning of the extractor close to the work area.

The first proof of concept used a circular fan, but that suffered from low capacity as well as a tendency to roll around on the table.

Having a spare 120 mm high-capacity fan, I decided to CAD and 3D-print an adapter, which turned out really nice. It stays put where you place it and have a much higher capacity than the round one.

There will of course be a fan cover to protect the fingers, once I find it (or print a new).

(STL and FreeCAD sources are available from Thingiverse)

IKEA Rothult Part 3 – Reassembly and debug connectors

Posted in allmänt grinande on 2018-12-23 by Kristian

I cut out a slot for the breakout cabling and reassembled the lock. A better solution would have been to drill a small hole in the side, desolder/resolder the wires and route them through the hole instead. I will do that _later_, if I manage to reprogram the lock.


A quick test with various RFID cards revealed that the message on the serial bus always is ”52 46 41 4c 3a 20 63 75 72 53 74 3a 20 39 30 20 20 45 72 72 6f 72 3a 20 34 20 00 0a” which translates to ”RFAL: curSt: 90 Error: 4 ”.

This does not change regardless of the how the lock reacts to the card. Hence, useless.

It is intriguing though, why send ”error 4” even when the card is accepted?

I also connected the probe to H1 and H2, the connectors to the SWD port, but no signalling occurred on those.


Bus Pirate and Rothult

Unfortunately, the bus pirate and Rothult didn’t really work out. There is an implementation of the SWD protocol for the bus pirate, that I totally would have tried unless I had worked 50+ hour weeks for most of the winter. So I gave up and ordered some more toys from Mouser.


Left to Right: STM32 discovery board, Busblaster v4, ST-Link V2.1 with cables

OK, the STM32 discovery board would have been sufficient, it has a built in separately usable ST-Link, but the other items more or less paid for themselves due to the free delivery over 50 dollars thing. Or at least that is what I tell myself…

Waiting for Fedex

Have you ever tried getting a delivery with Fedex in a rural area? Then you know.

To be continued in part 4, ”connecting and using the debug tools”

Meanwhile, install OpenOCD, gdb, and if running an appropriate OS, the ST-Link utility.

IKEA ROTHULT, Part 2 – Connecting wires to the header

Posted in allmänt grinande on 2018-11-18 by Kristian

Having disassembled the lock and gained some kind of feeling for what is on the PCB, it is time to see if we can do something to it.

We could of course hot air the processor and solder something else in place instead (as done here with another IKEA product) but that is not as fun as it is to reprogram the device to do something else. So let’s attempt reprogramming!

Connecting a debugger

Step one is to carefully solder six wires to the small header to be able to connect instruments to the board. Later, I also added (not shown in the first photo) a ground wire directly to the battery compartment header to be able to connect the oscilloscope ground easier. Then I soldered an ordinary pin connector, left-over from an Arduino nano kit, to the wires, which makes oscilloscope connection easier.

The wires are somewhat difficult to solder to the PCB, and be careful to not melt the plastic.



The idea is to use the wires to connect to openocd through a bus pirate board, to hopefully be able to dump the IKEA firmware, and analyze it. If you need to flash the BP, the ds30 loader can be found here, the link in the howto is broken.

In part one we identified the pin-out of the debug header, from left to right in the picture:

  • H1 – Pin 24 (PA14, SWCLK, USART2_TX)
  • H2 – Pin 23 (PA13, SWDIO)
  • H3 – Pin 17 (VDD, 3V – see below)
  • H4 – PCB ground plane (if one look at the battery compartment, the negative pole of is connected to the same PCB plane and this is also confirmed by a circuit beep tester)
  • H5 – Pin 20 (PA10, USART1_RX)
  • H6 – Pin 19 (PA9, MCO, USART1_TX)


We will examine those pins in turn with a volt meter and an oscilloscope before the bus pirate is connected.

Power pins

We need to examine VDD closer to avoid releasing the magic smoke. The data sheet for the CPU specifies 1.65 V to 3.6 V power supply, but it could be anywhere in that range. The RFID circuit wants 2.4V to 5.5V, but is flexible down to 1.65V on its data pins. (The data sheets are linked in the previous post).

Looking at the PCB photos, it seems as if we can read the print on what seems to be a regulator circuit, so let’s check that as well.

A quick look through a magnifying glass reveals that most likely indeed is a regulator, an 6210A in a SOT-89-5 package, and from the other markings, I guessed that the output voltage is 3.0 volts. I haven’t been able to identify the manufacturer, unfortunately.

I took the opportunity to measure on the pins at the same time, which confirmed both the connectivity as in the list above, and revealed that the VDD indeed is at or slightly below 3 volts.

dsc_62821 (1)


Data Pins

Having investigated the power pins, we turn towards the data pins.

I’m actually primarily interested in H1 and H2, since they are connected to the serial wire debug feature (SWCLK, SWDIO) (link to relevant datasheet) which potentially is useful as an attack vector. (And hopefully can be used for something nice), but figuring out if anything is sent on the other UART is also highly relevant.

So let’s start with USART1 and do the SWD investigations in the next post.

Oscilloscope on H6 – Pin 19 (PA9, MCO, USART1_TX)

Touching one of the IKEA smart cards to the device results in a pulse train on this pin, as shown below. Interesting!

Unfortunately, we get the same message (52 46 41 4C 3A 20 <-> ”RFAL:  ”) regardless of if it is the IKEA card, or an SL card. Something is better than nothing, however, and this is without the motor etc installed so it could be a partial message.

(RFAL  is a reasonable part of a message.)


Oscilloscope image of H6

To be continued…







Posted in allmänt grinande on 2017-11-26 by Kristian
  • 850 gram vetemjöl
  • 200 gram smör
  • 5 dl mjölk
  • 50 gram kakaopulver
  • 1 tsk salt
  • 2.5 dl strösocker
  • 50 g färsk jäst eller 14 g torrjäst

Bakas som lussekatter, för det är lussekatter fast med kakao istället för saffran.

Hur man fixar fyra blink / fel på pumpen i en Whirlpool diskmaskin

Posted in allmänt grinande on 2017-01-22 by Kristian

Det står egentligen inget nytt här, utan det är samlad information för att det skall gå att hitta igen.

Vår Whirlpool ADP 4451 stannade och felkodade med fyra blink, följt av paus, vilket betyder att den inte kan pumpa ut vattnet.

Whirlpools (och andras) blink-koder hittar du här:

Så här gör man:

Baxa ut diskmaskinen så att du kan arbeta i den samt även vinkla den framåt. Det kommer att bli blött så se till att skydda golvet.

Ta loss silarna i botten inuti diskmaskinen, och häverta ut allt äckelvatten ur diskmaskinen. Lägg sedan något som absorberar resten av vattnet i sumpen och vänta ett tag.

Nästa steg är att skruva loss frontpanelen, plåten som sitter längst ned mot golvet under luckan. Det sitter fyra skruvar som håller fast den. De översta behöver du antagligen fälla ned luckan för att komma åt, men normalt behöver man inte ta bort luckan också.


Bakom panelen sitter avloppspumpen. Den ser ut som på bilden nedan och hålls fast av en flärp. Placera en tunn blöja, skurtrasa, etc, under pumpen så att du kan svampa upp vattnet som rinner ut.  Titta på den här filmen för mer detaljer:


Lossna kablarna försiktigt från den, tryck in flärpen (du kan behöva leta lite, men den finns ”bak vänster” om du tänker dig att du tittar på pumpen som den är på bilden) och vrid loss moturs. Det behövdes ungefär ett kvarts varv. Har du vridit 90 grader har du vridit för långt. Jucka loss pumpen. Nu blir det blött. Luta diskmaskinen framåt så att vattnet rinner ut istället för att fortsätta inåt på plåten. Vänta tills det har runnit klart, torka upp så mycket du kan från plåten under pumpen.

Avlägsna joxet i pumphuset och se till att den snurrar relativt lätt (den har två lägen som den kommer att växla mellan, hålls i de lägena av magnetern, men den skall gå att snurra mellan lägena). Låg det inget jox i pumphuset så är det antagligen något annat fel. Du kan provköra pumpen med stor försiktighet (lista ut hur själv, om du kan det så kan du nog förstå riskerna också) och kontrollera ifall den är bränd och behöver bytas, eller så är det stopp i avloppet någonstans.

Sätt tillbaks pumpen. Provkör maskinen på spol-läge utan att skruva tillbaks frontplåten så att du ser att det är tätt. Skruva ihop maskinen, montera tillbaks den.


(Om du fått ordning på din maskin tack vare detta och slipper lägga 4000+ på en ny så tipsar vi om



Mötestyper: B*kk*ke

Posted in allmänt grinande on 2016-11-08 by Kristian

I denna serie postningar avhandlar vi de olika typer av möten och mötesfenomen som man träffar på i näringslivet.


OK, innan vi börjar så varnas känsliga läsare för att klicka på länken till Wikipedia nedan. Jag tänker inte beskriva vad b*kk*ke är, utan det får man själv lista ut via denna INTE LÄMPADE FÖR ARBETET, FAMILJEN, BARN ELLER KÄNSLIGA PERSONER (NSFW) länk till Wikipedia.

Ett b*kk*ke-möte är kort och gott ett möte där alla inblandade har ett stort behov att uttrycka sin åsikt i frågan utan att egentligen bry sig om huruvida de övriga är intresserade eller om det är relevant för mötets syfte. Som deltagare blir man alltså dränkt i övriga deltagares åsikter, därav namnet.



Brewery: Hot Liquor Tank heating controller

Posted in allmänt grinande on 2016-11-04 by Kristian

For the last two years or so, I have experimented with temperature control for my femto-brewery with varying results.

The purpose of this post is to convince you that buying something off the shelf is the smartest option, or for an even simpler solution, do single vessel BIAB.  Building your own, in particular if you don’t have someone to copy, is insane. It is more expensive, and it is more frustrating. I do like tinkering, though…

Heating approach one: Immersion Heater

My first heating solution used  an immersion heater which worked quite well. An IKEA colander became a heat shield around the hot end. I also quite early added recirculation using a little brown pump (buy them on ebay or ali for the best price). Recirculation is necessary to be able to maintain the temperature when doing eBIAB.

Controller one: Brewpi 

For reasons I don’t remember I ordered two brewpi shields, one was intended for converting my soon-to-be-replaced fridge to wine storage, and the other I intended to use for mash temperature control. I never did the wine fridge conversion, because we still haven’t managed to find a new fridge of the correct height. I assume that the brewpi will work perfectly fine for that, since that is the design objective of the brewpi. I can’t explain why I thought the second one would make a good mashing controller though.

Quite soon after I got the hardware, brewpi moved to a new HW platform as well, which meant that the Genuino version didn’t really evolve at all. The software required the Atmel studio for hacking, and it was quite difficult to understand what was going on internally.

The stock software wasn’t really suited for mash control and I got impatient trying to figure out how to control it, so I abandoned this idea. The SSR:s and the one-wire temperature probes have however been used in all subsequent attempts.

Controller two: Adafruit sous vide

The Adafruit sous vide controller actually worked quite well, except that it lacked step mashing and remote control. I used a Genuino, with a screw shield and an LCD shield, adapted the software a bit to fit the hardware I had, and started brewing.

The main problem with this solution was probably that it wasn’t complex enough :-). I wanted to be able to step mash.

Controller three: Brewtroller

Please note that there is a new business selling new variants of brewtrollers, my hardware was delivered by the old business and I don’t know anything about the newer alternatives.

The third attempt was based on a brewtroller BX2 (I think). Apart from some serious problems with the rotary encoder (that I fixed), this has actually worked out quite well. However, the company making the brewtrollers went out of business quite soon after I bought the kit (of course) and software updates stopped. The main downside with the brewtroller is the programming interface, the rotary encoder issues made it a bit of a bother to program the setpoints. I have implemented a python interface to make it  bit easier to use.

I used this solution for nearly two years and have been mostly happy with it.  I actually think that the brewtroller could be a good solution for someone who want something out of the box, but the lack of software updates made me frustrated.

Heating approach two:

Some time during this period, the utilities company increased the voltage from 198 volts to 230 volts, which caused the immersion heater to be too hot and I got problems with wort scorching and decided to rethink the heating approach. I ordered a water heater element from ebay, and a sheet metal punch of the correct size, and built an electric kettle with recirculation. I also purchased a Chugger pump since I had problems with cruft in the little brown pump. Unfortunately, the Chugger turned out to be way too powerful and I still haven’t managed to get it working right.

I used this together with the brewtroller for about 1.5 years, quite successfully. Then I wanted to experiment with HERMS. (I like tinkering, remember?) So I got some hardware (solenoid valves, etc) and decided that modifying the brewtroller would be stupid: it works, and I intend to keep it that way. So, time to do something new.

Controller four: return to the brewpi shield

After finishing my Ph. D, I had time to tinker again, and I decided to build something off the brewpi hw that was collecting dust in the garage. I realized quite quickly that using the Atmel IDE and modifying the existing software was an exercise in frustration, so I extracted the display driver and the buzzer driver (both are on what seems to be non-standard SPI interfaces) into a separate Genuino IDE libraries which allowed me to use the genuino IDE and write new software for the brewpi shield. At the time of writing, controller four is being tested with lots of water.

I will spend some time in a future post describing how controller four works and what the design approach has been.



As I wrote in the introduction, I have most likely spent more money on this than an off the shelf solution would cost (there were no good solutions available when I started building mine, though) It has definitely been more difficult to use the home-made system for brewing than plugging something in and just using it.

Would a pre-made system have been as fun as building my own? Absolutely not.







%d bloggare gillar detta: