Archive for the in English Category

Teardown of the IKEA ROTHULT RFID lock

Posted in in English, nörderier on 2018-11-01 by Kristian

EDIT: You can connect an stlink to the debug header. I never got that far in the writeup though, due to this being the first ARM project I looked at combined with the vacation ending. I have however tested it and it works.

Disclaimer: If you believe any of the below and burn down your house, lose your dog, or break your lock, or something else that is good or bad happens, it is your own fault. The likelihood of something being wrong is close to 100%.

The IKEA ROTHULT is an RFID-enabled motorized lock for desks, cupboards, etc.

Obviously, it would be nice if it could be connected to, for example, a mysensors network and used for home automation.

Teardown

The ROTHULT is kept together by four screws, no tricky plastic tabs. Simply unscrew the battery compartment and the lid, then lift it away.

Inside, you find the bolt, a gearbox arrangement with a small motor, and a circuit board. The RFID antenna is beneath a snap-in lid (visible in the first picture) and connected through four pins to the PCB. Two microswitches are used as end stops for the bolt.

rothult3

Unfortunately, the RFID antenna is soldered to the main PCB, which means that it cannot be lifted out of the box easily. Everything else can be removed without violence.

 

To remove the lid over the RFID antenna, lift CAREFULLY at the slots, while pushing the plastic tabs from the inside.

rothult6

If you don’t manage to push ”good enough” on the tabs, they are likely to break. (The two closest to the PCB on mine did, but it doesn’t really matter, if you are to use the lock as a lock later, it will not be visible and super glue is cheap :-) )

Lifting the lid reveals a PCB with an antenna on it. Unfortunately, that is all it seems to be, there is no hidden I2C/SPI/serial RFID module ready to be harvested.

PCB

Let’s take a closer look at the PCB.

DSC_6282

Q3-Q8 on top to the right seems to be the power transistors driving the motor.

The build is primarily surface-mounted (no surprise), and uses two main integrated circuits – a guess is that the right one handle the RFID decoding, and the left is the main processor (if there is such a thing in this device). Then, if we are lucky, the header right above the integrated circuit could be a programming/debug header.

Processor

rothult10

A closer look on the suspected CPU reveals the ST logo, and an identification number: L051K86, which is a reasonable match to the STM32L051K8 processor with LQFP32 pinout (datasheet).

If this indeed is the case, the pinout from the datasheet is shown below, rotated to match the photo above.

rothult11-e1541064985721.png

Looking at the header (ref black-and-white photo), from left (H1) to right (H6), the header pins appear to be connected as below – please note, this is still to be confirmed by a second view as well as with measurements!

  • H1 – Pin 24 (PA14, SWCLK, USART2_TX)
  • H2 – Pin 23 (PA13, SWDIO)
  • H3 – Pin 17 (VDD)
  • H4 – PCB ground plane (if one look at the battery compartment, the negative pole of is connected to the same PCB plane)
  • H5 – Pin 20 (PA10, USART1_RX)
  • H6 – Pin 19 (PA9, MCO, USART1_TX)

According to the datasheet (section 3.9 boot modes), programming the flash memory is done by using SPI1 (PA4-PA7), SPI2 (PB12-PB15), USART1 (PA9, PA10), or USART2 (PA2, PA3).

Since we indeed have USART1 connected to H5-H6 is would seem as if we can access the flash through this header (if the BOOT0 pin can be manipulated / is connected in an appropriate way). The datasheet in turn refers to STM32 memory boot mode AN2606. That datasheet can be found here.

For the remaining pins, H1/H2 are connected to the serial wire debug feature (SWCLK, SWDIO), see for example this datasheet for more details.

Let’s leave it at this for now, and move on to the rest of the circuitry.

RFID Decoder

The initial assumption is that integrated circuit #2 is a dedicated RFID decoder.

rothult12

This is confirmed by a new macro photo (the print on this circuit is really hard to read) which identifies it as an AS3911 (datasheet) NFC Initiator / HF reader IC.

The ams logo is quite identifiable once you know it is supposed to be there.

Looking in the datasheet, we find the pinout:

rothult13.png

Again, his is oriented the same direction as in the overview PCB photo (but not as in the closeup showing the markings) and the connections to the CPU can be traced:

  • AS3911 Pin 32 (/SS) <-> CPU Pin 10 (SPI1_NSS)
  • AS3911 Pin 31 (SCLK) <-> CPU Pin 11 (SPI1_SCLK)
  • AS3911 Pin 30 (MOSI) <-> CPU Pin 13 (SPI1_MOSI)
  • AS3911 Pin 29 (MISO) <-> CPU Pin 12 (SPI1_MISO)
  • AS3911 Pin 27 (IRQ) <-> CPU Pin 14 (PB0)

Hence, the AS3911 is connected to the CPU through SPI.

End Switches

The two microswitches seems to switch VDD/GND to an IO pin depending on their position.

  • Switch 1 (above the summer) is connected to CPU pin 27 (PB4)
  • Switch 2 (not above the summer :-)) is connected to CPU pin 28 (PB5)

Summer

No idea.

Motor Drivers

Not investigated yet.

Continued in part 2, where we wire up the debug header and decode the serial output.

 

Annonser

Cornflowers

Posted in bilder, in English on 2008-07-16 by Kristian

A wheat field on the way home from work is covered with Cornflowers.

I’m thinking that the poor farmer that owns the field won’t get much for his crop, the blue areas will probably not yield any wheat at all.

Looks pretty though.

Posted by Picasa

sweep-o-matic

Posted in in English, software on 2008-07-13 by Kristian

Too lazy to play ”minesweeper”?

Try ”sweep-o-matic”!

(download) (start in browser, requires plugin see below)

Sweep-o-matic plays minesweeper for you, which is at least as interesting as playing it yourself.


(Requires tcl/tk, downloadable here, or the tcl/tk firefox plugin, downloadable here. The plugin doesn’t play nice with ff3, it crashes when you press the ”back” button, at least mine does)

Wardriving

Posted in computers, gps, in English on 2008-07-11 by Kristian


Yesterday, I played a little with ”Network Stumbler” while trying to find out what the laptop was doing with its network interface.

Of course, leaving the laptop at home while driving to the in-laws today wasn’t really an option, one must play with the new toys, so we hooked it up to the GPS, a task that wasn’t as simple as it should have been since the GPS is USB and netstumbler handles serial only. Using a newer wardriving software, such as Inssider was impossible, the laptop has W2K and not XP. The solution was a trial version of Franson GPSGate which translates Garmin USB to a virtual NMEA serial port.

There are lots and lots of AP:s out there. You drive past a field, and the software picks up something from behind a small copse in the distance. It is amazingly sensitive, even when enclosed in the metal cage of the car.

What surprised me was the amount of unencrypted networks, 52 out of a total of 110, making it nearly one unencrypted network per kilometer, not counting the ones that were shielded by the car. (I tried walking around with the computer when we got to our destination, and it immediately found three networks not detected when driving).

Is this due to incompetence, or is it a clever scheme to try to aquire deniability in case IFPI knocks on the door?

Irish Stew, or how to use a metric ton of Pak Choi

Posted in bilder, food, in English on 2008-07-09 by Kristian

Lately we have eaten lots of ”Irish Stew”. It is dead simple to make, reasonably cheap, and provides an opportunity to use the insane volumes of Pak Choi that grows in our greenhouse.

”Irish Stew” is basically a lobscouse, you put meat and vegetables in a pot and boil it until the vegetables have dissolved. As such, it is well suited to finish cooking in the oven.

What you need:

  • 0.5 kg potatoes, sliced to 1 cm thickness, then chopped to 2×2 cm pieces.
  • approximately 0.2 kg green cabbage, shredded.
  • garlic, 1-5 cloves
  • onion, 1-2 medium size, sliced
  • fat, for frying
  • lamb or mutton, 0.25 kg, diced to 2x1x2 cm.
  • beef or chicken stock, to cover the ingredients.
  • herbs. Rosemary, thyme, oregano. If you tie the sprigs together with some cotton twine, it will be easier to remove them later.
  • salt and pepper
  • medium size pot, about 3 liters. Preferably oven-proof, but it is not critical.

The measurements are approximate. I usually use a lot more cabbage. YMMV.

Use the oven if you are lazy and have problems keeping track of the time, the likelihood of burning or otherwise ruining the food is much lower than if you keep it on the stove. The oven should be preheated and set to 175 centigrade.

Put the meat in the pot, cover it with cold water, bring to a boil, discard the water. Rinse the meat with cold water, and leave it to dry in a colander. Rinse and dry the pot as well.

Heat the fat in the pot. Add the onions and garlic. Fry gently until soft.

Add the potatoes. If it is a ”soft” variety, reserve half and add closer to when the stew is finished. If it is a ”hard” variety, add all of the potatoes.

Add the meat, cabbage, and herbs. Cover the ingredients with stock, cover the pot with a lid, and bring to a boil.

Put the pot in the oven or continue boiling on low temperature on the stove.

The idea is to keep boiling the stew until the potatoes and onions have dissolved and thickened the sauce. This takes about one hour.

Then you add the remaining potatoes, if you reserved any, and season with salt and pepper as needed. Boil an additional 20 minutes to soften the potatoes.

Remove the herbs before serving. Eat with bread.

If you use new potatoes or very ”hard” potatoes, it is unlikely that they will dissolve completely, in that case try thickening the sauce with onion powder. Avoid using flour, it ruins the texture of the dish.


Pak Choi

Posted in bilder, garden, in English on 2008-07-06 by Kristian

The pak choi is growing rapidly in the greenhouse. The seeds were getting old, so I planted all of them, which means that we’re harvesting bucket-loads of cabbage.


phun – "the 2D physics sandbox"

Posted in in English, software on 2008-07-04 by Kristian


Our latest addiction is ”phun”, a 2D physics simulation for your desktop. The son is absolutely fascinated and demands to ”look at the water”.

The interface is a bit strange, you have to start and stop the simulation in order to position things where you want them, but this is only a minor nuisance. This software will keep any nerd occupied for hours.

%d bloggare gillar detta: