Fullscreen HTML5Med Res (??MB)HTML4

SERVICEMAN’S LOG Neighbourhood network noise Dave Thompson This story isn’t about an electronic device that needs to be fixed; instead, it is about some neighbours who needed to be ‘fixed’ and an electronic device might have been the solution. These neighbours liked to make a lot of noise, and my long suffering friend thought that some electronic noise might just shut them up... Back in the mid-1990s, I had the excellent fortune to visit a pop-up James Bond museum in England. Many of the props and spy devices dreamed up by the fictional Q branch were featured. That included watches with lasers and retracting garroting wire, lighters, cuff-links and pens with embedded ‘radio transmitters’ and ‘trackers’ as well as other well-known ‘weapons’ such as Oddjob’s steel-rimmed bowler hat, Rosa Klebb’s knife shoe, Scaramanga’s golden gun and more. Of course, these are movie props designed to look good on screen, and most don’t really work. Still, everybody seems to love this type of thing and I am no exception. I’ve made my fair share of ‘bugs’, trackers, ultrasonic doodads and other gadgets but nothing as far-fetched as those Bond contraptions. These days, however, such things are not so far beyond modern technology. The other day, I watched a video of European armed forces taking control of an enemy drone and landing it into an allied soldier’s outstretched hand. The tool they used looked like a rifle fitted with an antenna array instead of 54 Silicon Chip a barrel and boasted several mysterious-looking cowlings hiding the electronics. The operator simply aimed it at the drone, held it in his ‘sights’ and brought it into a gentle landing. Incredible! As it turns out, I’m very familiar with the taking down of airborne vehicles. As an aeromodeller back in the day, I flew many radio-controlled models, and plenty of them were wrecked thanks to idiots accidentally (or deliberately, in one case) turning on a transmitter using the same frequency that I was using. This confuses the receiver and, as it doesn’t know which signal to respond to, it just locks up or twitches uncontrollably, inevitably causing the earth and the aircraft to meet – usually at ground level. Back then, we used the 27MHz band for model flying (later 35MHz, later still 2.4GHz). Within the 27MHz and 35MHz bands, only a set number of frequencies were allocated to R/C (remote control) use. Most flying fields and clubs used a ‘peg’ system; if your radio gear used, say, 27.125MHz, you took the peg for that frequency from the board; while you have that peg clipped to your antenna, nobody else is supposed to use anything on that frequency until you put the peg back. Obviously, this relied a lot on goodwill, patient queuing and not being stupid; sadly, plenty of people would neglect this system and turn up to the field, unload their model and switch on their transmitter to test things out without grabbing the peg first. The result was usually lots of swearing, some crashes and a firm reinforcement of the flying field rules to the offender. All you needed to do to ruin someone’s day was to sit somewhere within range with a transmitter, turn it on and watch the planes fall. Some miscreants did this for ‘fun’ or out of spite. You could do the same thing with any type of signal generator that swamped that band; many so-called ‘jammers’ work this way. In fact, anything that emits wide-band interference will naturally jam and confuse receivers and transmitters; a big enough spark-eroding machine or a plasma cutter can do it. Dad used to curse VW bugs driving past because the interference played havoc with his CB radios – it seemed no amount of RF Australia's electronics magazine siliconchip.com.au Items Covered This Month • • • • • • Denying the neighbourhood speaker Fixing two power banks Replacing an Ozito mower’s battery pack The flat 125Ah lithium-ion battery Refurbishing a Peak multimeter The breadmaker with a short fuse Dave Thompson runs PC Anytime in Christchurch, NZ. Website: www.pcanytime.co.nz Email: dave<at>pcanytime.co.nz Cartoonist – Louis Decrevel Website: loueee.com suppression stopped the electrical noise from those aircooled engines! These days, radio signals are supposedly much more robust and more immune to interference. Still, going by these emerging battlefield videos, signals can obviously be hijacked and the model/drone/UAV taken over to do the interceptor’s bidding. It is worrying indeed! Naughty neighbours need knackering This rather long-winded introduction is building up to a quandary a friend of mine brought to my attention recently. Like many of us these days, he is suffering from noisy neighbours. While suburban living is always going to have some noise, such as lawn mowers, chainsaws, water-blasters etc, they are usually temporary and sound levels soon drop to birdsong level once the yard work is done. Apparently, these neighbours place a large Bose wireless speaker out on their lawn and pipe music to it by some means. The sound levels are reportedly rock-concert loud and go on for hours every day and often into the night. That really would be annoying! My friend was at his wit’s end; he’d called the noise control people dozens of times – they seemed to be toothless other than giving the noisemakers a stern talking to. The usual occurrence, once the enforcement people leave, is the music gets turned back on, only louder. Surely, my friend suggested, I must know of, or could even make something, to fight back against these neighbours. I told him no. Despite being very interested in the technical aspects of any device that might help in this scenario, I wasn’t keen to get involved. Creating RF interference on purpose would likely be more illegal than them pumping loud music! Still, it really fired my imagination, so I decided to investigate anyway. My first thought is that any solution would need to be something that affects only the annoying guys while leaving other neighbours alone. That would likely be almost impossible. Simply cranking up a guitar amp and pointing it at the neighbour’s house while having someone who doesn’t play guitar do their best Jimi Hendrix impersonation would undoubtedly be entertaining. It’d also give everybody in the surrounding area cause for complaint! I admit to doing something similar many years ago when flatting and working nights at the airline. The guy next door had a DKW two-stroke car that he’d fire up at 6.30am siliconchip.com.au and leave idling for 15 minutes to ‘warm up’ before heading off to work. I asked him nicely several times not to do that, or park it on the road, because I worked nights and got to bed at 5am. He told me to suck it up, so I started practising guitar playing when I got home at 4am, with my amp perched on my bedroom windowsill, pointing directly at his bedroom window across the drive. Even at low volume, he would have heard it clearly. He got the message. While getting revenge like this is nice to imagine, it is far too indiscriminate in suburbia. If only there were some way to take control of their system and interrupt it, or turn it down ourselves. I knew of nothing that would achieve that goal. I suppose that some sort of jamming device might be able to disrupt the signal; I’ve noticed mobile phone jammers advertised on the likes of AliExpress and eBay, but they are pretty expensive, and jamming is illegal anyway. By the looks of the blurb on those sites, the jammers can block most bands associated with mobile phone operation, including the 2.4GHz and 5GHz WiFi and Bluetooth bands on some models. I imagine if anyone got caught using one of these in New Zealand, they would risk conviction, seizure of the hardware and incur a hefty fine to boot. I advised my friend against using such devices for that very reason; besides, it may not even work on their system, and that’s a lot of money to throw away for no result. Thankfully, he agreed. Still, this sort of thing is fascinating, a bit like those Bond gadgets; interesting and potentially useful in the right situation! Creating a ‘jam session’ More internet searching revealed several DIY jammers designs, but the assembly and technical details on them were scant. That path looked like a lesson in frustration. Besides, anything like this could only be purely hypothetical anyway because I didn’t know for sure how they were streaming the music to the speaker (Bluetooth, WiFi or even a direct connection). I also really didn’t want to get wrapped up in the whole grubby business. My research took me down a few rabbit holes, though, especially regarding the Bluetooth and WiFi angles. I also learned that the noisy neighbour issue is a global problem, if the number of people posting on forums and asking questions on project pages was any indication. Some people wondered if a ‘shotgun’ (hyper-directional) speaker existed (like those shotgun microphones that were all the rage once), but the consensus was ‘not really’. Could something be made to take control of the speaker and shut it off? There are quite a few experimental projects Australia's electronics magazine December 2022  55 along these lines, the downside being that the latest Bluetooth LE (Low Energy) protocol is not compatible with older versions of Bluetooth (and these projects) and is much more difficult to ‘hack’. To have any success, I’d need to know what devices were involved and what version of Bluetooth they used; that avenue was already becoming moot. However, I have plenty of older Bluetooth speakers and headphones around the workshop, and my interest was piqued. I breadboarded a unit; for obvious reasons, I won’t be going into details other than to say I used an Arduino to control it all. I also had to use relatively complex tools on my Linux laptop to ‘sniff’ for Bluetooth signals in my workshop. Once I identified the correct device, I could try to disrupt or break the connection using the ‘jammer’ circuit. While it did work after a fashion, to be truly useful, the transmitter would need to be much more powerful and considerably closer to the receiver to make much of an impact. As it turns out, most Bluetooth streaming protocols are incredibly robust, so this type of exploit would never fly, unless you could ‘ring-fence’ any potential target with hardware. A good idea then, but busted. My reading led me to another interesting area, though. People sometimes stream and cast music between devices using their home network and wireless router (some Bluetooth connections also use routers). Someone has created a small project that uses an exploit that still exists in many of today’s routers using the 802.11w protocol. Simply sending a ‘disconnect’ or de-authentication packet to the target router drops off anything connected wirelessly to it. This idea was too intriguing to pass up. I needed to build one of these and see if it worked – on our own network, obviously – most certainly not to harass anyone else! As they say, this device was for educational purposes only! Attack of the ESP8266 clones The project is very well-researched and is now on version 3. It is easily made by anyone familiar with computers and flashing .bin files. It uses a readily available (and 56 Silicon Chip very cheap) ESP8266 board, which must be flashed/programmed, utilising easy-to-use (and free) software tools. Once assembled and up and running, it turned out to be a very stable device, running from a battery pack, a 5V phone charger or a computer’s USB port. Power consumption is very low, making it quite portable, so it can be set up anywhere around the house to test how healthy a home network is and whether the router is immune to such exploits. In general, if your router is more than a year or two old, it likely will be vulnerable to the de-authentication attack. If the router uses the latest WPA3 security protocol, it should be immune. Essentially, the ESP8266 creates a standalone WiFi node and web server, which you can then connect to using a smartphone, tablet, laptop or any WiFi-enabled computer. Once joined, you enter the IP address of the board in your device’s web browser, accessing a web-based user interface. It is surprisingly comprehensive, and it transpires that this device has several other interesting and related functions aside from the de-authentication feature you can test network security with. I have a drawer full of older but still-too-good-to-throwaway routers gleaned over the years, so I set a couple of them up around the property with easily identifiable SSIDs (network names). I also connected some random WiFi-­ capable devices to them to test out this de-authentication functionality. Finding the routers is easy – all wireless networks within range are listed at the click of a button. Usually, the closest networks will be listed near the top; as I used specific SSIDs, it was easy to select the test networks. Once selected, a menu option is selected to carry out the de-­authentication attack. The instant I clicked the go button, my connected devices dropped off the target network. The same thing happened with the other router I set up. I tested a few more of my older routers, and all behaved the same way. I took the ESP board to the end of my long driveway and tried the attack on the routers I’d set up inside the house from there. Once again, all dropped connections immediately. So it is quite a powerful little device. While there is provision to add an external antenna on later versions of this board, I found my version 2 setup with a built-in antenna easily picked up routers in households well beyond the boundaries of my back-section property. I could see how this device might easily be misused in the wrong hands. The big test would be to try it on our main network router, a TP-Link Archer C7 v5. It is old by today’s standards, but it has some relatively sophisticated anti-cyber-attack features built in. They are off by default but can easily be switched on via the web interface. I had to pick my time because my wife works from home and is usually in Teams meetings half the day. I didn’t want to knock her connection off during my tests! When I had a clear run, I tried the attack and sure enough, off everything dropped. The thing with the de-­ authentication attack is that as soon as the packets are no longer being sent to the router, disconnected devices will usually try to re-establish the connection, so just one little drop-off might not be noticed. The ESP can be configured to send a continuous (preset) Australia's electronics magazine siliconchip.com.au stream of de-authentication packets to the router, preventing WiFi devices from reconnecting. Nasty! I tried applying the various anti-cyber-attack settings on the router, but as I suspected, they made no difference for this type of attack. While hiding the SSID (an option on most routers) might help prevent the router from being ‘seen’ by the ESP, it might also hamper connecting to it if you allow people to use your router’s WiFi connection. Upgrading to a new router should prevent most attacks of this type. I have one on order! All in all, it is a fascinating, functional gadget and strangely satisfying to build and test. For educational purposes only! Fixing two power banks B. P., of Dundathu, Qld will repair anything that isn’t working correctly. This time it’s a prevalent problem: over time, USB sockets on cheap devices can detach from the PCB and become intermittent... I have had two small power banks for several years. They came in very handy recently for charging our phones when our power was cut due to flooding in this area. Both power banks worked well to charge our phones, and we were recharging them from our car’s USB port. I noticed that the green power bank had a problem with the charging cable, which seemed to be loose, and it was necessary to push the cable to one side for the power bank to charge. After the power came back on, I looked closely at the faulty power bank to determine if it could be easily disassembled. It appeared that the white top was an insert that I could remove. I was then able to extract the PCB and battery. On close inspection, I could see that the micro Type-B USB port’s two power pins were no longer attached to the circuit board, and the two shell pins were very loose. The problem was that access to the tiny pins was very limited; it would be a challenge to re-solder the pins with a regular soldering iron. There was nothing for it but to try to re-solder the pins and hope that I didn’t destroy the power bank. I had a close look at how to get the tip to the pins without burning anything nearby. This was like trying to remove a splinter with a crowbar. I tried to re-solder the two power pins first; then, I plugged in a charging cable to test the repair. The first attempt was unsuccessful, and the charging light did not come on. The second attempt proved to be more successful, with the charging light now coming on, so I re-soldered the two shell pins and plugged the charging cable in again to ensure that everything was still OK. This power bank is just a small one that uses an 18650 (18mm diameter, 65mm-long) Li-ion cell. The fact that it can be easily dismantled for repair means that the battery could be replaced if it came to the end of its life and the power bank still worked. Another successful repair enabled the power bank to continue its useful life. Replacing an Ozito lawnmower’s battery pack R. S., of Figtree Pocket, Qld is a prolific contributor and he has been busy replacing rechargeable batteries in various devices... Ozito no longer supplies 36V mower battery packs and instead uses two 18V packs on their electric mowers because 18V packs are used for their other tools. So if you have one of these mowers and the battery fails, you either have to repack the battery or replace the mower. The packs use 20 18650 lithium batteries in parallel pairs, with 10 pairs in series to get 36V. As newer lithium-ion cells have a higher mAh capacity (3400mAh), I decided to use just 10 cells in series. I purchased four Samsung 18670s at $9 each from eBay and six Panasonic NCR18650B at $15 each, both from Australian suppliers. Buying from overseas is impractical due to transport difficulties or high delivery costs. I mainly used two different battery suppliers to compare them. There is no battery balance circuit in the packs. If some cells are already charged to 4.2V, charging is terminated too early, as the fully charged cells go open-circuit due to their inbuilt safety valve. So for the charger to charge all cells properly, the cells should all start with the same voltage (eg, 3.6V). The Ozito charger charges at 1A, taking about three hours to fully charge the battery pack. There is a 0.1W current-­ sensing resistor in the charger, which usually has 0.1V across it. If you prefer a slower charge rate, you can change the resistor to 0.33W to reduce the charging current to 0.3A. I repacked a 36V Ozito mower pack with ten Panasonic NCR18650B cells in 2017, and it is still working. With a 15W test load, the voltage drops from 41.5V to 39V, showing an internal resistance of about 0.9W. The mower won’t run with the pack with mixed cells – it has a higher internal resistance of around 1.3W. The NCR18650B cells I recently received can deliver less current (9A) than the ones I used to repack my first battery. It seems that the design has changed, or the ones I used this time are not genuine. Some Samsung cells have an electronic current limit (at the negative end), limiting the current to about 9A, but by removing it, the limit can be increased to about 20A. The cells with the electronic current limiter are a bit longer and have a copper strip down the side connecting positive to the circuit. I decided to repack the second battery with all Samsung cells this time due to their higher current limit. After swapping the second battery pack to all Samsung cells, it is now working. Paying extra for heavy-duty cells in the first place would have saved a lot of time, but my The PCB and battery was easily extractable from the power bank (shown at left); upon inspection, the USB socket’s two power pins were not attached. After resoldering those two pins it eventually powered up succesfully (shown at right). siliconchip.com.au Australia's electronics magazine December 2022  57 first repack with the NCR18650B cells in 2017 worked with no problems, so I expected the same this time. Another problem with repacking is that new cells may be longer than 65mm. For example, the Samsung cells I purchased are 67mm long. They would not fit in a Deebot DN5G robot vacuum cleaner, while in a Samsung SR8980 robot vacuum, there is plenty of room as the original battery was in a plastic case. The large cells used in the Dyson V11 vacuum are 20700 (2mm larger in diameter and 7mm longer), making them difficult to reuse if space is limited. I am soldering the cell terminals (they don’t come with solder tags). It seems to be easy to solder the negative end, but not the positive end, which I think is stainless steel. I bought some special liquid flux which helps. I also find that I also have to sand the positive terminal to get the solder to stick. However, one cell positive terminal would not take solder. When I get my spot welder, I will try that. In the meantime, I had to use another cell. Another new cell reads open circuit; perhaps the protection valve is faulty. Editor’s note: don’t mix Li-ion cells; use all the same type and age, especially in cases like this where there is no balancing circuitry. A flat 125Ah lithium-ion battery D. M., of Toorak, Vic saved his friend a lot of money with a trivial repair, when the manufacturer wasn’t all that helpful... I have a friend with a 4WD that has an auxiliary 125Ah lithium-ion battery with Bluetooth monitoring and a nominal voltage of 12.8V. It retails for a cool $1890. He uses it to power the vehicle fridge/freezer, which he keeps running whether the vehicle is in use or not. The battery is charged via the vehicle alternator. He was understandably rather upset when the battery apparently went flat, and the dedicated charger connected to the alternator would not charge the battery. Some chargers will not charge a very flat battery for safety reasons. He bought it to me, and I measured the terminal voltage at 1.9V. A call to the manufacturer’s representative resulted in them advising that the battery was almost certainly destroyed at such a low voltage. I told them that I thought these batteries had an internal battery management system (BMS) that would shut the battery down. In fact, the specifications say there is a low-voltage cutoff of 10V. The representative said the BMS did not always shut down the battery at low voltage, and its primary purpose was to manage the battery charge and discharge rates relative to cell balance and temperature. My friend independently called another branch of the manufacturer and was told they would take a look at the battery for a fee of $250 plus return freight between Melbourne and Sydney. The battery had a maximum charge voltage specification of around 14.6V, so I connected it to my bench power supply at 13.5V with the current limit set to 500mA. After a few minutes, I disconnected the power supply and was pleasantly surprised to get a reading of about 13.3V. I kept charging the battery for the next few days, gradually increasing the current to about 1A. I did not charge the battery fully because I could not tell the state of charge, as I could not connect to the battery’s Bluetooth system, 58 Silicon Chip which would give such information. In any case, I disconnected the power supply and the voltage held constant for a couple of days. I reinstalled the battery in his vehicle and, using a clamp ammeter, measured the charge current when the vehicle engine started as 40A. The battery can accept a 100A charge current. I told my friend to keep the battery on float charge via a dedicated charger if he wants to keep the fridge running when the vehicle is not in use. The recommended float charge voltage for that battery is 13.8V. My conclusion is that the BMS disconnected the battery from the terminals to protect it when the voltage reached the 10V threshold below which the battery could be damaged. The charger refused to charge it because the disconnection meant the terminals only presented 1.9V. As soon as I put a small amount of charge in it, the BMS reconnected the battery, and it could be charged normally. The manufacturer representatives seemed unaware of this possibility. My friend reports no further problems with the battery, and he is pleased I saved him $1890. You can see some pretty good photos of what the BMS circuitry looks like in a battery this large at the following website: siliconchip.au/link/abhr Refurbishing a Peak multimeter with new batteries R. E., of Majors Creek, NSW ‘fixed’ his multimeter by making up a new battery (with the original type no longer available). But with the simple repair comes an interesting story of the past... In the early 1970s, I obtained my first multimeter – a Peak OL-64D (Hioki Electric Works). I have used it extensively over the last 50 years. When I recently used it on the ohms range, the needle didn’t move because the AA cells were flat and had corroded the terminals. The 22.5V battery, which I suspect was original, was also flat. 22.5V batteries haven’t been made for years, so I planned to use two small 12V batteries in series with some series diodes added if the exact voltage was critical. I soldered together the batteries and soldered wires to the meter The front view of the Peak OL-64D multimeter. Australia's electronics magazine siliconchip.com.au terminals. I wound the ohms adjuster pot anti-clockwise in case the higher voltage caused the pointer to overshoot. To my astonishment, the pot could only adjust the zero a short distance up the scale. Wondering if my quick soldering had damaged the batteries, I checked the voltage with another meter. Surprise: only 3V! A close look at the batteries showed I had used N cells rather than the 12V A23 ‘lighter’ type, which are much the same size. After uttering some naughty words, I de-soldered the N cells and reconstructed the battery with two of the more suitable A23 batteries. The zero pot had plenty of range, and the x10,000 range worked again. In the 1970s and 80s, I worked at the NASA Orroral Valley Tracking Station on Operations. Occasionally, when major equipment changes were scheduled, the operational shift workers would be temporarily reassigned to other ‘day work’ at the station. In 1980, I had a week in the Test Equipment Lab, properly called the Precision Measuring Equipment Laboratory (PMEL). Dave (different from the Serviceman), the Senior Technician, was ex-Army, versatile and competent at maintaining the station’s master standards. He had a laconic sense of humour and a sensitive BS detector. Several times per year, American-based engineers would visit the station bringing ‘traceable’ (NBS became NIST in 1988) transfer standards on their flights to check the calibration standards held in the PMEL. Many of these engineers took their jobs with deadly seriousness. Some may have been recruited from regions where humour is unknown. There was a complicated paper trail of visit dates, equipment calibrated, discrepancies found etc. As well as using their signatures, these engineers all had personal rubber stamps that they kept secure so that no one else could use them. They would prepare the paperwork, get Dave to sign in the right place and then ask him to apply his stamp. Sometimes for impact, he asked them if they were sure. He would then stamp a red ‘rubber duck’ on the forms. Some were horrified, feeling that it diminished the importance The side view of the Peak OL-64D multimeter and NASA PMEL Cal sticker. siliconchip.com.au of their own stamps, their jobs and probably themselves. I’m glad I still have my meter with its 1980 NASA PMEL Cal sticker – complete with Dave’s initials and red duck stamp (see photo at lower left). RIP Dave. The short-fused breadmaker K. W., of Craigburn Farm, SA likes to make his own bread but was frustrated by the breadmaker playing up. Luckily, it turned out to be a simple fix… I’ve had a few breadmakers over the years; they don’t last forever. My Panasonic SD-2501 model has been the best yet, and its bucket and paddle are still in good nick, so I was perturbed when it started playing up. Twice it failed to bake after mixing, forcing me to complete the loaves in the ‘normal’ oven. Then it stopped powering up altogether. I pulled it apart to see if I could find an obvious fault. It is well made and opened up reasonably easily. I found no obvious failures, no burnt smell, no shonky connectors and heater element showing a fair resistance. So I started tracing the power feed. Sure enough, an over-temperature fuse (of two) in the supply line was open circuit. I sourced a replacement from Jaycar, getting the next temperature range up since they didn’t have the exact one. The hardest part of the whole process was prising the crimps open, pushing in the new fuse and re-crimping it. I just used pliers since I don’t have a flash crimp tool. I switched it on, and it was all good. So my favourite breadmaker was saved from the dump and is still working well. I think what blew the fuse was loaves that rose too high and blocked the heat vents in the lid. Too much water or yeast can cause that. I’ll be more careful from now on. I’ve kept our nice Panasonic microwave oven from the dump too. After a loud ‘pop’, it ceased heating. All inside looked OK, so I gambled on the klystron, buying a replacement online. Not an exact match, but it worked. The microwave lives on. Appliance failures are inevitable, but sometimes a simple look inside can reveal an obvious fault that’s easy to fix and much cheaper than replacing the whole thing. SC Australia's electronics magazine December 2022  59