Teardown on davidzou.com

Arlec PIR Motion Activated Light (NL0009) Time Mod

Sat, 13 Aug 2016 00:00:00 +0000

The Arlec NL0009 is a mains powered, dual sensor (light and motion detection) LED night light. This product is available at Bunnings for $15.

I have one of these lights plugged in the hallway in motion mode to light up the hallway and stairs at night. It does a great job, but one of the downsides of this light is the really short light on time after being triggered by the PIR sensor. 1 minute is just not enough time to boil the kettle to get a hot cup of something. This would be the perfect product if Arlec had integrated a knob or two to adjust the light on time and maybe even the PIR/LDR sensitivity.

This light has a very sleek and clean looking design compared with similar devices such as the Jackson PT911L. There are two sets of lights in the device, one behind the vertical strip on the front and the other behind the light. The set of lights behind the device shines onto the wall and produces a pleasing diffused gradient of light. The colour temperature of the light is neutral (6400K as measured by my RX100M2).

This light offers two lighting modes, Dusk and Motion, adjustable via a sliding switch on the back. Dusk mode turns the device into a traditional night light whereby the front LED will light up when it’s dark and turn off again when light. Motion mode will turn the device into a motion activated light which only operates when the room is dark. In the motion mode, both the front and rear LEDs will light up for 60 seconds when triggered.

But as with almost all cheap electronics, it is probably easily hackable. Luckily, this device is assembled with four Phillips screws (#1 or J1 if you have one).

The circuit board looks well laid out and constructed, with no obvious safety issues. The device is powered through a capacitor resistor dropper circuit which means minimal wasted energy (no transformer) and is safe because the unit is sealed and the entire device is non-conductive. There is also a fuse wired in series between the mains pins and the circuit board.

The BISS0001 PIR Chipset Configurations

The Arlec NL0009’s PIR motion detection is powered by the BISS0001, a very low power IC. The chip has configurable trigger on/off time as well as the ability to enable and disable re-triggering.

The re-triggering option is enabled, which means the light will stay on as long as there is any movement between the original trigger and before the timer runs out (i.e the timer is restarted as soon as there is movement).

The trigger on/off timer time is configured by adjusting a capacitor and resistor and the datasheet provides the formula. With the component reference designator adjusted for this circuit board, the trigger on time can be calculated with the formula

$$ T_x \approx 24576 \times R_{10} \times C_{7} $$

The Arlec NL0009 is configured with $R_{10} = 200k\Omega$ and $C_{7} = 12\mu F$ (calculated) for a 60 second timer. A more acceptable time would be around 3 to 5 minutes, which would mean $R_{10}$ should be $600k\Omega$ to $1M\Omega$. I certainly don’t have any spare SMD resistors or capacitors lying around, nor do I want to be desoldering SMD components. Luckily, I found an unwanted circuit board with various 1/8 watt resistors. I managed to find a $1M\Omega$ and a $1.2M\Omega$.

So I proceed to remove $R_{10}$ and replace it with the $1M\Omega$, which should provide approximately 5 minutes of light when triggered. I plugged it in, triggered it and timed it. The light stayed on for 4 minutes and 48 seconds. Success! Not quite… For whatever reason, the triggering distance seems to have dropped to about 1.5 metres. As a sanity test, I shorted out $R_{10}$ and the timer was reduced to 1s and the trigger distance back to normal. So I concluded that the high resistance causes the triggering distance issues.

A potential solution is to use a higher capacity capacitor, $C_{7}$, but I didn’t have any spares. I couldn’t find any resistors around $600k\Omega$, so I added that $1.2M\Omega$ resistor in parallel with the $1M\Omega$ to give approx $550k\Omega$. A quick test had the light stay on for 2 minutes 42 seconds. The range of triggering does not seem to be affected. With my patience running out, I settled for that time and reassembled it.

If anyone has plans to increase the time for the Arlec NL0009, I would recommend buying a $1M\Omega$ linear trimpot to put in place of $R_{10}$. That will allow you to tune the time more precisely and find a suitable time which doesn’t impact on the triggering range. One could also replace $C_{7}$ with one of larger capacitance.

Sony SRS-X3 Battery Upgrade

Sun, 03 Apr 2016 00:00:00 +0000

I was sorting though some old junk when I found an old but unused laptop battery pack for the 1st Generation DER laptop (Lenovo s10e). It would have been a waste to chuck out an unused battery pack, but the laptop it belonged to was more than obsolete now (and we didn’t have any of them left). So I thought maybe I could use the cells inside for something. The size, shape, voltage and capacity certainly suggested that it contained six 18650 lithium cells. After cracking the case apart, it revealed six high quality Panasonic NCR18650 cells rated at 10.73Wh (2900mAh).

So then I was thinking what products of mine used 18650 cells. The two things that came to mind was my Sony SRS-X3 speakers and Led Lenser M7RX torch. I remember when I first disassembled my SRS-X3, I was disappointed to find a Chinese battery pack (ST-01) of dubious origins (Huizhou Highpower Technology Co., Ltd) which was only rated at 16.28Wh (two 2200mAh 18650 cells). At the time, I wasn’t concerned with the battery life, so I left the original batteries in. So with the Panasonic RCR18650 cells, I’m expecting at least a 30% increase in battery life. The M7RX also comes with an 8.14Wh (2200mAh) protected cell. I can only assume manufacturers use the 8.14Wh cells to cut costs. I had already picked up an EagleTac 18650 3400mAh protected cell (Panasonic cell) for my M7RX, but you can never have enough spare batteries!

If you are replacing your device with new batteries, I suggest getting the Panasonic NCR18650B cells, rated at 12.58Wh (3400mAh).

Enough talk… here are the instructions for replacing the battery pack in the Sony SRS-X3. We will be de-soldering the protection circuit from the original battery pack and soldering it to the new cells.

Required Tools/Materials

Something thin and flat, such as a flat head screwdriver
A Phillips #1 screwdriver (J1 if you have one)
Soldering iron and solder
Electrical tape or similar
Two 8cm lengths of hookup wire capable of at least a 3A load
A small length of metal or wire (braided solder wick works too)

Recommended Tools/Materials

Heatshrink
Flux pen

Steps

Peel the 6 foam pads off the bottom of the speaker
- Use something thin and flat to peel, such as a flathead screwdriver
- Peel from the corner
- Peel slowly
Remove the 6 silver screws and remove the bottom cover
Remove the 5 silver screws holding the circuit board and battery pack in place
Remove the front bezel by pushing the 3 retaining clips out (towards the front of the device)
Remove the 8 screws around the two speakers
Pry out the piece of plastic holding the two speakers in place taking care not to pull on the microphone
Lift the daughter board (connect to the battery) out by levering it up (about 30 degrees) from the front of the unit. Then pull the board away from the rear of the unit, dislodging the rear IO.
Pull the battery holder out of the unit and disconnect it from the daughter board
Remove the battery pack from the battery holder by wiggling it left and right. Do not pull on the wires with too much force.
Cut away the plastic wrapped around the cells and remove the red protective cardboard at both ends of the batteries
De-solder the existing connections to B+, B- and BM and detach the circuit board from the cells
Prepare your new cells

Be careful not to short anything! We don’t want exploding batteries.
- Connect the two cells in series
- Glue or tape the two cells together
- Attach a wire to the +ve and -ve ends of the battery and run them down opposite sides of the battery to the other end
Solder the battery protection circuit board to the new set of batteries
- Soldering onto the battery casing is generally a bad idea due to the heat, so if you must solder onto the cell itself:
  - Use flux
  - Use small amounts of solder
  - Solder extremely fast!
  - Cool the battery down as soon as the solder joint is made (use a sponge)
- The circuit board should rest above the bridge joining the two cells
  - Make sure nothing from the battery contacts the bottom of the circuit board
- The B+ terminal connects to the positive end of the battery through the length of wire
- The B- terminal connects to the negative end of the battery through the length of wire
- The BM terminal connects to the bridge connecting the two batteries in series through that length of metal or wire
  - The BM connection is used to monitor both cells individually. As no two cells are perfectly identical in capacity and state of charge, the charge circuiry is able to monitor and charge cells individually instead of as a pack. This prevents over-charging/over-discharging of individual cells and optmises the capacity of the battery pack as a whole. This is known as battery balancing.
Tape the circuit to the batteries
Place battery pack into battery holder
Connect the battery pack back onto the daughter board
Feed the flat flex (connecting the daughter board to the main board) back into the main compartment through the cutout and fit the daughter board back into position by sticking the IO ports into their cutouts first.
- You will need to pull out the left speaker to get the flat flex back into the compartment. There is no need to disconnect the speaker.
- Replace the left speaker with the speaker connections oriented to the left of the device.
Ensure both speakers are resting on their mounting posts
Replace the piece of plastic holding the speakers in place, ensuring the microphone is on the outside of the device.
Screw in the 8 black screws holding that piece in place
Place the microphone back in its cutout
Replace the front speaker grill
Screw in the 5 silver screws holding the daughter board and battery holder
Replace the bottom cover and screw in the 6 silver screws
Stick the foam pads back onto the bottom of the speaker

Results

A dead battery takes just over 5 hours to fully charge with a 5V 2.1A charger.

I haven’t done any scientific tests, but with casual listening it certainly feels like a larger than 30% capacity improvement. I have doubts that the original cells were actually 16.28Wh. Perhaps they were at very low discharge rates.

Moshi Luna: An Almost Perfect Keyboard

Sat, 02 Apr 2016 00:00:00 +0000

I’ve been using the A4Tech KV300H Isolation Keyboard for the past four years and for the most part, it’s performed solidly. For around $30 you get a full-sized 104-key low profile chiclet style keyboard.

Recently I’ve acquired the need for a backlit keyboard to work when the room is dimly lit. So I had a look at what a local computer store offered. I’m one of those people that have strict requirements for things I buy, and for keyboards they are:

Wired, because security!
Full size 104-keys (with the three columns by two rows of editing/navigation keys above the arrows
Full sized arrow keys (none of that half sized rubbish that Apple introduced on their Macbook keyboards)
Low profile chiclet style keyboard with bezel around very key

With these requirements, there were only a few possible candidates and they were all gaming keyboards. Some looked fugly and others took too much desk space. The only candidate left was the Razer Deathstalker line of keyboards. It ticks all of my above-mentioned requirements and there are a few backlit variants. They have a green backlit one (Deathstalker Expert) and one with programmable RGB colours (Deathstalker Chroma). I was certainly not forking out an extra $50 for the ability to change the colours of the backlight. Green will do just fine.

So I picked up a Deathstalker Expert keyboard. One of the first things you notice about the keyboard is that it’s not as premium as Razer makes it look in their renderings/photos. I then proceeded to type on the thing and the actuation pressure for the keys was a lot higher than I was used to, especially with the lighter than average actuation pressure of the A4Tech Isolation keyboard. Sliding your fingers across the keys yields a bit of a rattle like an old school keyboard (Razer’s design uses hard plastic to couple the key caps to the keyboard). The keys also feels a bit mushy when pressed, with less than desired amount of tactile feedback. I decided to give the keyboard a try for a while, in the hopes that I’ll get used to it. One of the first things I noticed is that I couldn’t type as fast as I would on other chiclet keyboards and I would get tired much sooner than I would before. This keyboard is really not good for typing. Another really annoying issue that occurs is that they keyboard stops working after switching between console and Remote Desktop sessions a few times. I’ve tried the Razer drivers and Windows generic drivers, and the issue still persisted. This is and will be the first and last time I buy a Razer product.

So the search was on again, and after a Google image search for chiclet backlit keyboards, I stumble across the Moshi Luna. The Apple/OSX keys put me off initially, but it was designed for both PC and Mac and reviews for it were generally positive. And unlike many other products you find online, this was stocked locally at most Mac oriented stores. I picked mine up for $129 at Mac Centre.

Typing on the Moshi Luna is very pleasant. The keys are very quiet compared to the A4Tech Isolation Keyboard and the Razer Deathstalker. Without further ado, here are my good and bad points about this keyboard.

The Good

Full sized low profile chiclet style keys with bezel surrounding all the keys
Good actuation pressure with very pleasant tactile feedback (scissor-switch and membrane)
Most keys are very quiet (with the exception of larger keys with metal bracing that give off a very slight rattle of metal against plastic)
Key caps are removable and swappable
A good number of backlight brightness levels (5 including off)
Has a function lock to switch between the function keys and their alternate functions

The Bad

Backlight escapes out the edges of the caps at shallow angles
Apple/OSX layout and key icons (the Option/Alt and Command/Win keys are swapped compared to a standard keyboard)
Glossy plastic makes greasy smudges and fingerprints more noticeable (especially on the clear plastic when its lit up)
No scroll lock indicator (I use the LED for notifications)
Then function keys default to their alternate functions each time the PC is switched on (the state of the function lock is not remembered)
Due to the fn key and the fn lock, you lose the context menu key and the Pause/Break key.
The palm rest acts as a light pipe and adds ambient light to a dark room

It may look like there are more bad points about this keyboard, but I’m just being nitpicky and some of the problems can be fixed. Here comes the fun of modding.

Blocking the light shone through the clear palmrest

This requires disassembling the keyboard to cover up the LEDs shinning at the palm rest. The keyboard can be disassembled by removing the 10 pieces of rubber covering up the Phillips screws underneath. Use a pin or flat head screwdriver to pry the rubber out and unscrew all the screws. The keys of the keyboard are attached to the front bezel and is connect to the circuit board via flat flex. Disconnect these to avoid damage. There is also an ESD wire screwed into the metal behind the keys.

The Moshi logo on the top left of the keyboard is lit by the light diffuser on the main PCB. If you dislike the logo, it can be covered up.

The palm rest itself can be unscrewed and removed, but you will be left with a gap where the palm rest protrudes from the keyboard.

To block the light coming out of the edges of the palm rest, simply add some opaque tape to the edge between the front bezel and the metal back plate.

Prevent the Backlight Escaping the gaps

When sitting at a comfortable/ergonomic distance from the keyboard, the backlight can be seen through the gaps between the key caps and the keyboard. The bottom of the function and number rows as well as the left side of the number pad are especially noticeable.

The solution is to remove the key caps and the key retaining clip to cover up some of the light diffuser.

All the key caps are removable. The key caps are attached to the keyboard by a scissor-switch retaining clip. The retaining clip is attached to the key cap with a hook and clip structure. On one side the hook it slid in and on the other side the clip snaps into place like a peg.

All the keys the size of and smaller than the Tab key have a single retaining clip. Some of the retaining clips are mounted sideways. Regardless, all these key caps can be peeled off from the top right corner.

Keys larger than the Tab key have two retaining clips and metal bracing. These keys may require you to slide something flat into the gap to detach the retaining clip.

After removing the scissor-switch retaining clip, the edges of the light diffuser can be coloured in to reduce the amount of light bouncing out the gaps. The ink used in Sharpie permanent markers will give off purple light. Artline permanent markers weren’t dark enough and let too much light pass through. In the end, I pulled the tip off a black Uni-ball Eye pen and used its pigment ink.

I covered only the edges of the key that are in line of sight with my eyes. Remember not to cover the entire diffuser as that would defeat the purpose of a backlit keyboard. 108 keys later, there is significantly less light shinning out of the gaps. The following photo was taken with HDR 6EV to match what a human eye sees.

Swapping the Option/Alt and Command/Win keys

A standard keyboard’s modifier keys are in the order Ctrl Win Alt while the Apple/OSX layout results in Ctrl Alt Win. Luckily, the Win and Alt keys are the same size and we can simply swap the keys around.

We also need to remap the keys as the original scancodes are still being sent.

Windows offers a registry value dedicated to remapping scancodes at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout\Scancode Map, but thankfully RandyRants has created a GUI tool called SharpKeys to make life easier. Simply map the keys to each other. I have also mapped the right Ctrl to the Application/Context Menu key.

Linux users can remap with udev(8), setkeycodes(8) or through a window manager such as X using xmodmap(1). Refer to this Arch Wiki.

DER Laptop BIOS Unlock

Mon, 28 Mar 2016 00:00:00 +0000

The DER (Digital Education Revolution) lasted 5 years starting in 2009, with the last generation of laptops handed out in 2013.

The first two models were pretty rubbish laptops. They had tiny screens and the S10e had unacceptably small keys. All models except the X131e had an SSD, and the DET SOE image was horrendously slow. They had a plethora amount of software installed and they didn’t make much of an effort to prevent useless services and startup entries. The login process was unbearable… at least for me (I’ve been made impatient thanks to SSDs).

Year	Model	Machine Type	Storage
2009	IdeaPad S10e	4333	160GB HDD
2010	ThinkPad Mini 10	3507	160GB HDD
2011	ThinkPad Edge 11	0328	160GB HDD
2012	ThinkPad X130e	2338	320GB HDD
2013	ThinkPad X131e	3367	120GB SSD

The laptops have a BIOS supervisor password and was locked until the owner of the laptop finished year 12 or the school uses it as a T4L device. The BIOS was configured to boot from the internal HDD only. When a student finishes year 12, the laptops are It’s the school’s decision who gets to keep the laptop after year 12, but most schools allowed students to keep the laptops unless they didn’t want it. When a student is graduating, a new entry should show up in SCCM to Unlock the BIOS and image the laptop to a clean install of Windows 7.

The DET have recently been decommissioning DER related servers/services and lately there have been problems with the SCCM. There have been imaging DER laptops and joining the DETNSW domain. Seeing as this year’s year 12 have last generation of DER laptops and the DER program is pretty much non-existent, I would show the procedure to unlock the BIOS, for any people who still have a locked BIOS and have physical access to the internals of the laptop.

For all the IT people who work with these DER laptops, you can actually obtain the BIOS unlock binaries from the SCCM after starting the DER Grad Unlock. The SCCM will create some folders in the system drive while it performs the unlock. You can suspend the SCCM process using Sysinternals Process Explorer after it starts and downloads the required files. You can then spend all the time you need to obtain the required permissions to access the files and make a copy. If you want a copy of the files, shoot me an email to my det nsw email account. You can find me on SMU by searching for my last name (the entry that has a Business Telephone No. ending in 1).

I have already written an article explaining how to bypass the supervisor password if are able to disassemble the laptop. In this post, I will provide a guide to disassembling the last three generations of DER laptops and removing the supervisor password.

The above-mentioned article is available here.

Required Tools

Torx T6 screwdriver
Philips #1 screwdriver

Recommended Tools

USB keyboard
Spudger or fingernails

Lenovo Edge 11 (0328)

Disassembly

Remove the back cover by unscrewing the three torx screws
Remove the battery pack and then remove the two large flat Phillips screws holing the keyboard.
Remove the HDD by removing the two M2x7 screws and sliding it out
Remove the keyboard by pushing it up and out though the HDD bay. The keyboard is attached by two flat flex cables. The larger connector can be unlocked by sliding the black ends of the connector towards the trackpad. The smaller connector has a locking lever which can be pried up with a fingernail or tweezers.
Disconnect the two flat flex cables from the mainboard in a similar manner to the smaller connector on the keyboard. One is for the trackpad and one for the power switch).
Disconnect the microphone from the mainboard by sliding the black part of the connector towards the right. (The connector is located under the bottom left corner of the keyboard.
Remove the three M2x7 screws exposed after removing the keyboard
Remove the part of the chassis which consists of the palm rest, trackpad and power button by using a spudger or running fingernails between the main chassis and the palm rest. This part is held together with small plastic hooks running around the chassis. Apply a little force to unhook them.

Locating the EEPROM Chip

The EEPROM chip is located to the right of the speaker connector. It should be a chip labelled L08 but could labelled PS08A or be a different chip.

Other Information

The Edge 11 runs a Legacy BIOS. Follow the procedure for BIOS based systems.

The SDA and SCL pins are the two above the number 8 of the label (the opposite corner of the dot/circle marker).

As the power button is located on the part of the chassis which is removed, you will lose the functionality of the power button. You can still simulate a press of the button by shorting the pins that lead to the power button. The pins for the power button are the first two pins (from the left) of connector CN2.

Be extremely careful when shorting these pins. Shorting pins other than the first two will result in you damaging the power management chip and your device will have problems powering off!

Lenovo X130e (2338) and X131e (3367)

Disassembly

Remove the back cover by unscrewing the three torx screws
Remove the HDD/SSD by removing the two M2x7 screws and sliding it out
Remove four M2x8 screws holding chassis and keyboard
Remove the two M2.5x5 screws to the left and right of the battery pack
Slide entire keyboard up towards the battery and then lift up from the bottom
Disconnect the two flat flex cables (for the keyboard and TrackPoint) from their connectors by levering the front part of the connector up.
Disconnect the flat flex cables from the mainboard in a similar manner to the ones on the keyboard.
Disconnect the microphone by sliding the connector towards the right
Remove the three M2x5 screws exposed after removing the keyboard
Remove the part of the chassis which consists of the palm rest and trackpad by using a spudger or running fingernails between the main chassis and the palm rest. This part is held together with small plastic hooks running around the chassis. Apply a little force to unhook them.
Remove the piece of black plastic around the microphone connector (to the right of the USB ports on the left hand side) as the EEPROM is located underneath.

Locating the EEPROM Chip

The EEPROM chip is located just below the microphone connector. I have seen two chips used for the EEPROM. It should be a chip labelled L08 or PS08A but could be a different chip.

Other Information

The X130e and X131e run UEFI. Follow the procedure for UEFI based systems.

The SDA and SCL pins are the two above the number 8 of the L08 label or the 8A of the PS08A label (the opposite corner of the dot/circle marker).