Wireless Router

I have a couple of old routers that have been replaced by more advanced ones.  So it is time to hack them for other use.  A wireless router is an embedded computer with wireless connection; so it is good for IoT applications.  A lot of old inexpensive routers have 32MB RAM and 4MB Flash, which is rather limited for more advanced router application.  OpenWRT no longer supports this type routers.  It'll be good to branch off OpenWRT to support this type of routers for IoT.   We looked at one such router earlier.

Here we take a look at TP-Link TL-WR841N, Ver 9.2.  300Mbps wireless N router, with 4x 100Mbps ethernet ports.  The main components are

• Qualcomm Atheros QCA9533-AL3A SoC
• 24Kc MIPS processor with 64KB I-Cache and 32KB D-Cache at up to 650MHz
• 25MHz clock input
• 1.2V switching regulator for core voltage.  2.62V LDO for DDR1 and GPIO.
• RF 20/40MHz band 2.4GHz OFDM for 802.11b/g/n, 2x RX/TX
• Zentel A3S56D40GTP-50L 
• 256Mb (16Mx16) 2.5v DDR400 200MHz @CL3xTSOPII-66.  
• Spansion S25FL032P 
• 32-Mb 3V Flash memory QUAD I/O 80MHz clock 40MB/s.  
• BCD's AP3502E 
• 340KHz fixed frequency 2A synchronous buck converter
• 3.3V output

The PCB date code is 1434, about 2014 August time frame.  QCA9553 is more powerful and more integrated than AR9130 used on the other router.

J3 is a 4-pin UART connector,

1. TX (2.6V)
2. RX
3. GND
4. 3.3V

Note the I/Os are 2.6V.  TX has no problem driving 3.3V UART receiver; there appears to be a few resistors in series with the RX pin, so it could be driven with a 3.3V input, but it may be prudent to add another 1K resistor in series.

The last OpenWRT version for this router is openwrt-18.06.8.  We get the boot message from the UART, 

U-Boot 1.1.4 (Build from LSDK-9.5.3.16 at Nov 29 2013 - 10:46:36)

ap143 - Honey Bee 1.1

DRAM:   32 MB
Flash Manuf Id 0x1, DeviceId0 0x2, DeviceId1 0x15
Flash:  4 MB
Using default environment

## Booting image at 9f020000 ...

   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 4.9.214 (buildbot@0d27b924961c) (gcc version 7.3.0
(OpenWrt GCC 7.3.0 r7989-82fbd85747) ) #0 Thu Feb 27 21:25:59 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 1 rev 1

BusyBox v1.28.4 () built-in shell (ash)
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 18.06.8, r7989-82fbd85747
 ----------------------------------------------------- 

We can interact with it through the ash shell.  Next we'll try to rebuild the firmware from the source and start to tweak.

H632S-WC Weather Channel EZ Crank Radio Extreme

 

The crank is a 3-phase alternator driven by two-stage gears; the output is rectified by 6 diodes.   There is another diode between the bridge rectifiers and the output voltage.   The FM radio IC is CD9088CB, which can operate between 1.8V and 5V, drawing about 5mA.  The 8Ω 4W speak and earphone are driven by TDA2822M, a dual low-voltage power amplifier, which works down to 1.8V.  The rechargeable battery pack is a 3-cell NiMH for 3.6V.   Most other components are for the radio.   The rectified voltage is used for direct battery charging without regulation.  And the 5 parallel LEDs are powered directly with only small series resistors.  All the wire connections are fragile.   For a retail price of $15, we do not expect it to be a very robust construction.

The battery pack seems no longer can hold charge.  We'll replace it with a small 480mAh LiPo pack (1.2 x 1.0 x 0.3"), that costs about $6 and is a little smaller than the NiMH pack (1.2x1.2x0.42") .   We install a 2mm JST PH 2.0 2-Pin connector.

We bring out the voltage after the bridge rectifiers to the outside, so we can monitor the crank generator output and potentially use it to power other devices, such as other chargers.   The diode to the Lipo isolates the battery to these wires, so it is relatively safe.

When unloaded, the crank generates about 5-8V at a reasonable crank rate.  It can peak over 10V if cranked really fast.  When it is loaded with battery, the voltages does not exceed 4.5V; after diode drop, the voltage on the battery is only about 3.8V, so it is safety for the battery .  The generator can supply enough power to sustain the radio, but not the LED light.

We also connect the output to a boost regulator, that generates 5V.  We use the 5V to charge a Bluetooth earphone.   The generator puts out 4.4V/45mA, about 200mW.   The rectified output is not very stable.  If we take the output from the battery side, it's better.  If we use it to charge a smartphone, the crank cannot keep up and the internal battery drains first.

AC Termination

In the case of the RS422 circuit, the differential line impedance is around 100$\Omega$ and "Standard RS-422 drivers are guaranteed to source and sink a minimum 20 mA across a 100Ω load."  (The receiver sensitivity is 200mV.)  That's 40mW dissipated on the termination resistor, and it could be 100mW dissipation at the driver if powered from a 5V supply.  Since this power dissipation is constant regardless the data pattern, the AC termination should be considered.  The AC termination draws power only at the data transition.  How effective is the AC termination?  The AC termination is a resistor and a capacitor in series.  The resistor value matches the transmission line impedance, so about 100$\Omega$.   People seem to use a capacitor value from several hundreds picofarads to a few nanofarads.  How do you select the capacitor value?  If we look at the transmission ratio (the voltage at the termination vs the input voltage), it is $$2\frac{1+j\omega R C}{1+2j\omega RC}.$$If $\omega >> 1/RC$, the ratio is 1.  If we take $R=100$ and $C=1$nF, the frequency must be much greater than 1.6MHz.  This is much more than the usual baud rate we use.  

But the steady state analysis is not the right way to go.  The step response that we are interested in is a transient.  Consider a 1V step applied to the transmission line.  Initially, a 10mA current flows into the termination resistor and capacitor.  The voltage across the capacitor rises as it is charged; and the voltage starts overshoot and reflects back to source.  It can be shown that the reflected voltage is half of the voltage across the capacitor.   The overshoot rises as 2RC time constant and reaches the peak when the reflected voltage makes the round trip.   So the overshoot is depended on the length of the transmission line.  If the transmission line delay is 10ns (~6ft), there is about 10% overshoot with 100$\Omega$ and 1nF termination.

If the transmission line delay is 100ns, the overshoot is $1-\exp(-2\cdot100n/(2\cdot 100 \cdot 1n)) = 63\%$.

TI's AN-903 erroneously stated, ; then the overshoot would be 39% or larger.

But one thing that we have not considered is the source impedance.  The driver could have 10-20$\Omega$ output impedance or series resistors may be included.   When the source impedance is greater or equal to the termination resistance, there is no overshoot, instead there is just a step followed by exponential rise.  For this case, a small capacitor gives fast edges (necessary for high speed transmission).

Christmas LED Lights

I have a string of 60 LED Christmas lights with 6 distinct colors.  I measured the RMS current with a multimeter, and found to be 27mA, so it worked out to be about 3.2W or about 54mW each, which seems reasonable if each LED takes about 20mA.  The string appears to have 3 parallel segments, with 3 lights having 3 wire connections.  That means each LED string consumes 9mA, so the 54mW number seems high for each LED.  Four of LEDs (all blue color why?) are not working, but the rest of the string works, so the connection is maintained.  I was curious to take one off; that segment was out.  So it is the LED that provides the electrical connection.  I took it apart and measured the resistance an found it to be 90 Ohms both ways.  Is there a built-in parallel resistor for fault tolerance?   Each of these resistors would take about 10mW.  The LEDs are running directly off AC, so the current is measured as true RMS, but the voltage RMS is not known.  

Anti Sulfur Chip Resistors

 Many automotive grade chip film resistors have the  anti sulfur feature.  Bourns has a white paper, "Advantages of Sulfur-Resistant Film Resistors".  It describes in good detail the construction.   In short, sulfur based gasses (such as caused pollution) can react with Ag/AgPd resistor terminal that leads to crack the package.  A Palladium (Pd) protection layer is added to the Ag terminal to eliminate the formation of Silver Sulphide and hence increases the reliability.

Computer Software Notes

Windows

Change network setting with commands
netsh interface ip set address "Local Area Connection" static IP NetMask Gateway
netsh interface ip set dns "Local Area Connection" static DNS primary
netsh interface ip add dns "Local Area Connection" DNS index=2

Add Emacs to the right-click menu.  Add to the registry
[HKEY_CLASSES_ROOT\*\shell\Emacs\command]
@="\"C:\\Program Files\\emacs-22.3\\bin\\runemacs.exe\" \"%1\""

Emacs for windows needs the diff program to run ediff.  If cygwin is installed, in .emacs (setq exec-path (list "c:/cygwin/bin")) to use cygwin's diff.  Also set environment variable CYGWIN=nodosfilewarning.

Emacs over VNC sometimes could not use the Alt key, add the following to .emacs

;; Map Alt key to Meta
(setq x-alt-keysym 'meta)

For computer with with multiple networks, eg hardwire ethernet and WIFI.  To set the network order
Control Panel -> Network and Sharing Center -> Change adapter settings -> The hit Alt to get the menu and choose Advanced -> Advanced Settings.

Screen saver timeout may have to be changed in the registry
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop]
"ScreenSaverIsSecure"="0"
"ScreenSaveTimeOut"="900"

Microsoft mouse software Intellipoint messes up the left handed setting.  Uninstalled it.

Microsoft robocopy is a useful tool for backups. The command  "rmdir /s/q folder" is a much quicker way to delete a large folder than through Windows interface.  [Others have pointed out a combination of "del /f/s/q foldername > nul" and "rmdir /s/q foldername" is even faster.]

Xilinx USB cable does not install incorrectly with ISE 11.1.  Manually running the following solves the problem,

cd C:\Xilinx\11.1\common\bin\nt

wdreg -inf windrvr6.inf install

Xilinx Platform Studio 7.1 cannot coexist with ISE 11.1. The PATH environment variable should contain either 7.1 or 11.1.

Foxit Reader is a better PDF reader than Adobe Acrobat Reader.

Matlab "Failure to find requested data acquisition device: nidaqmx."  Run Matlab as Administrator.

The driver for Proflic PL2303 based USB to serial adapter uses much more interrupt time than others.

Windows 7 jump lists are in %AppData%\Microsoft\Windows\Recent\AutomaticDestinations, deleting the large files helps restoring the lists.

Windows 7 does not include hyperterminal; copy the following files from Windows XP.  Hyperterminal does run on Windows 7.

c:\Program Files\Windows NT\Hypertrm.exe
c:\Windows\System32\hypertrm.dll

Hyperterminal can send ascii code by pressing and holding down ALT and entering numbers from the numeric keypad (with Num Lock on) then releasing the ALT key.  The code is sent upon the release of the ALT key.

xfig on cygwin complains about missing fonts.

cp /usr/share/ghostscript/fonts/*l.pfb /usr/share/fonts/Type1

cat /usr/share/ghostscript/fonts/fonts.scale >> Type1/fonts.scale
Change the first line to the number of fonts listed.
Update the font database:

mkfontdir

com0com creates a pair of virtual com port.

Laptop PC generates excessive fan noise even when there is little user activity.  The solution is to create a power plan that uses passive cooling, which reduces CPU speed first before increasing fan speed.  Furthermore limits the maximum processor state to 75%; that reduces the CPU frequency.  Power Options -> Create a power plan -> Change plan settings -> Change advanced power settings -> Processor power management -> Maximum processor state .

Linux

To clone a linux system to a large disk.
cp -ax /olddisk/. /newdisk
sed 's/`vol_id --uuid /dev/olddisk`/`vol_id --uuid /dev/newdisk`/g' /boot/grub/grub.cfg > /newdisk/boot/grub/grub.cfg
grub-install --boot-directory=/newdisk/boot /dev/newdisk
sed 's/`vol_id --uuid /dev/olddisk`/`vol_id --uuid /dev/newdisk`/g' /etc/fstab > /newdisk/etc/fstab

To keep the xterm open after executing a command with -e option,
xterm -hold -e 'command' 

To set up a remote git repository from a local repository
#Remote machine: Create the bare repository
mkdir proj.git
cd proj.git
git --bare init

#Local machine:
git remote add origin ssh://remote-machine///repository/proj.git
git push origin master
git checkout origin/master
#Create the local "master" branch that is tracking the "origin/master" branch
git branch -f master origin/master
git checkout master

To make an existing branch tracking a remote branch
git branch --set-upstream master origin/master

To fix a problem with acroread menu on Ubuntu,
"export UBUNTU_MENUPROXY="acroread":$UBUNTU_MENUPROXY
or disable global appmenu altogether
sudo sh -c "echo export UBUNTU_MENUPROXY=0 > /etc/X11/Xsession.d/81ubuntumenuproxy"

When partition a USB drive for Linux and Windows, place the Windows partition first.   Windows can only read the first partition from a USB drive.  The Linux can boot from the second partition.

To map the mouse buttons in X Windows
xinput list
xinput set-button-map 12 1 2 3

To create a pair of virtual serial ports 
socat -d -d pty,raw,echo=0 pty,raw,echo=0

The password length and complexity are controlled by
/etc/pam.d/common-password

The hardware clock setting is in /etc/default/rcS
UTC=yes
to set to UTC time.

Environment variables for Desktop, .pam_environment, the following may be needed to prevent undesirable scaling

QT_AUTO_SCREEN_SCALE_FACTOR=0

Tile Tracker

Powers off 3V CR2032 lithium coin battery
One piezo buzzer
Toshiba's TC35678FSG BLE 4.2 Cortex-M0 (13 or 26MHz) 384KB ROM, 192KB RAM, 256KB Flash.
Diodes PAM8904 12-pin U-QFN3030-12 18VPP output piezo sounder driver, charge pump
Could not identify the two other ICs