Friday, December 5, 2014

Reconditioning NiCd batteries

NiCd batteries are still commonly used in power tools.  When compared to lithium-ion batteries, cost isn't the only reason to prefer NiCd.  A common problem with nickle-based batteries is a drastically reduced number of cycles when they are not properly maintained.

Since I first got my cordless drill (a 14.4V Makita) many years ago, I would keep one battery pack in the drill and one in the charger.  This way I'd always have a fully-charged battery ready to go when I needed it.   Although I'd only use my drill a couple times a month, they'd loose most of their capacity after a few years and need replacing.  Instead of the 500-1000 cycles they're supposed to get, I was getting less than 100 cycles out of them.

My first searches of ways to recondition batteries lead me to blogs and youtube videos of people zapping batteries with high voltage, even using DC welders.  While this might temporarily remove dendrites, it will not restore them to anywhere near their original capacity.

Earlier this year, I found an article on Battery University - How to Restore Nickel-based Batteries.  It explains in great detail how Cadex battery analyzers work, and how they significantly improve the number of cycles obtained from battery packs.  However Cadex battery analyzers cost hundreds to thousands of dollars, too much to spend compared to less than a hundred dollars every few years for a new set of batteries.

The first thing I decided to do is stop keeping a battery on the charger at all times.  NiCd batteries are best stored with a minimal charge.  This would help get more cycles out of new batteries, but it wouldn't recondition my more than year old batteries that were giving me less than half their new capacity.

To exercise the battery packs, I needed to discharge them at 1C until they reached 1V/cell.  For my 14.4V 1.3Ah packs, this means a 1.3A discharge to 12V.  When my packs were discharged, they still had an open-circuit voltage of around 15.5V - a sign of high internal resistance.  A 15 to 20 Ohm, 20W power resistor would be ideal, but I didn't have one on hand.  Rather than order one and wait for it to arrive, I searched through my junk and found an old car speaker with a DC resistance of 13 Ohms; close enough to what I needed.  With a couple of alligator clips I had made a virtually free battery exerciser.

To recondition, I needed to do a "slow discharge" to 0.4V/cell, without a clear definition of "slow discharge".  I think around 0.05C should count as a slow discharge, so a 1W 220 Ohm resistor would be ideal.  I have a red LED with a 1.2K resistor that I use for breadboard projects, so I decided to use that.  I'm not sure if even slower discharge is tangibly better, but it should be at least as good as 0.05C.  And with the LED dimming as the battery pack discharges, I could avoid frequent checking of the voltage with my multi-meter.

The first exercise cycle on each pack took a little more than an hour, and the recondition cycle took 10-12 hours.  After one exercise/recondition cycle I didn't notice much of an improvement.  Three full exercise and recondition cycles seems to have nearly doubled the battery capacity.  Today when I took a dead battery from the drill I tested the open-circuit voltage and it was only 11V.  This means the exercise and recondition cycles have significantly reduced the internal resistance, and since the voltage is already below 1V/cell, I don't have to do the exercise cycle before re-charging it.

Saturday, November 15, 2014

SE8R01 2.4Ghz wireless modules

I recently purchased what were advertised as nRF24l01+ modules.  The modules don't have any silk screen marking the pinout, so the first problem was figuring it out.  After a bit of searching I found the pinout for nRF SMD modules, which is the same as the modules with the 8-pin connector except Vcc and Gnd is swapped:

  1. Vcc (1.8-3.6V)
  2. Gnd
  3. CE
  4. CSN
  5. SCK
  6. MOSI
  7. MISO
  8. IRQ
The next problem was coming up with a way to hook them up to a breadboard.  The castellated pads use a half-pitch (1.27mm) spacing, so you can't solder on standard pin headers and plug the module into a breadboard.  My solution was to solder 24AWG wire from an ethernet cable to the castellations, and in turn plug those wires into a breadboard.

My initial testing of these modules indicated they did not use Nordic nRF24l01+ chips, or chips that are compatible such as the Beken BK2423 or the SiLabs Si24R1.  The most obvious indication that these are not nRF modules iss that the default pipe0 address (register 0A) is 46 20 88 41 70 instead of E7 E7 E7 E7 E7.  They also respond to the bank switch command (0x50, 0x53), which is not supported by the Nordic chip.  I sent a message to the vendor asking for a data sheet, and while I waited I tried to figure out what chip the modules use.

Besides Beken and SiLabs, Hoperf makes a compatible module called the RFM70.  The RFM70 modules have a pinout that starts with Gnd, and they have the same default pipe0 address as the nRF.  The only other chip I could find that is similar to the nRF24l01 was the NST LT8900 or LT8901.  The datasheets for the NST chips didn't match with the register values from my modules.

Surprisingly, less than 24 hours after messaging the seller, I received an attachment containing a datasheet for the Semitek SE8R01.  My initial thought that these would inter-operate with nRF modules simply by changing the pipe0 address was disrupted by the discovery that these modules use a slightly different packet format.  Section 7.3 of the datasheet shows a 2-byte guard after the address field, just like bluetooth EDR uses where it switches from GFSK to DPSK.

If these modules use DPSK after the guard byte, then there is no way they will communicate with genuine nRF modules.  Another less significant source of incompatibility is that these modules don't have a 250kbps mode; instead it has a 500kbps mode along with the 1 and 2-mbps modes.  The 250kbps mode on the nRF24l01+ modules is good for extended range, since it has 9 dBm better sensitivity than 1mbps (-94 vs -85 dBm).  The SE8R01 datasheet indicates -86 dBm sensitivity at both 1mbps and 500kbps, so there would seem to be little reason to use the 500kbps mode.

One benefit to these modules is that they have a received power report in register 09, something the nRF modules don't have.  Although the datasheet documents the bank switch command, and how the currently active bank is reported in the status register 0E, there is no documentation of the bank 1 registers.

I also tested the modules to see if they will support packet sizes over 32 bytes.  The chip seems to accept a payload length of up to 255 bytes, but the read Rx payload command only gives 32 bytes before looping back and repeating the first byte in the payload.


The SE8R01 supports up to 4 dBm of output power, which should allow for better range than the nRF chip which tops out at 0 dBm.  To set the output power to 4 dBm, section 6.5 of the datasheet says to set PA_PWR[3:0] in the RF_SETUP register to 1111.  Power consumption for the Semitek chip at 0 dBm output power is 18.5mA - much worse than the 11.3mA consumed by the nRF chip at 0 dBm output.  The higher power consumption will make it much harder to power these modules with a CR2032 coin cell, since many cheap coin cells start dropping voltage when current output passes 10mA.


At a price of $6 for 10, the SE8R01 modules are 25% cheaper than nRF24l01+ modules selling for $8 for 10.  With nothing more than a couple minor tweaks, they can be controlled using existing nRF24l01 code libraries.  They do not inter-operate with nRF modules, and consume significantly more power, and likely have no better range than is available using the nRF 250kbps mode.  So while the lower price may make them attractive to a volume manufacturer, as a hacker I prefer to stick with the genuine nRF modules.

Sunday, October 12, 2014

USB DC boost converters

I recently purchased some USB boost converters and some AA battery holders to make 5V portable power sources.  The boost converters were $6.45 for 10 from AliExpress store XM Electronic trade, and the battery holders were 16c each at Tayda.
A few of the boost converter modules had a piece cracked off the 4.7uF inductor, but otherwise they were in good order.  I trimmed the leads from the battery holder and soldered them to the boost converter input.  I slightly bent the USB connector tabs so they fit into the holes on the back of the battery holder, and hot glued the board to the battery holder.

The modules were advertised as "input voltage: 1-5V" and "Output Current: Rated 1A-1.5A (single lithium input)".  I put in 2 NiMh cells, and the read LED on the boost module lit up.  The input from the batteries was 2.6V and the output voltage with no load was 5.08V.  I measured the current at between 2 and 3 mA.  If the modules output 1-1.5A with a 3.7V lithium battery for input, then I calculated they should output at least 600mA with 2.4V in from a couple of NiMh AA cells.  Other vendors advertise specs of the same modules as, "output current of 500 ~ 600MA with two AA batteries", so my 600mA calculation seems about right.

I started load testing with a 68Ohm resistor, and the output was 5.12V for an output current of 75mA.  With a 34Ohm load the output voltage was 4.89V.  The USB voltage is supposed to be 5V +- .25V, so getting 600mA output without the voltage dropping below 4.75V was looking unlikely.  For the next load test I used an old 15W car speaker with a DC resistance of 13Ohms.  With the speaker connected the voltage was only 4.48V, giving an output current of 345mA.  At this load, the output voltage from the batteries was 2.4V.  Interpolating between the results indicates the modules would output not much more than 200mA before dropping below 4.75V.

The last thing I tried was charging a phone.  When I plugged in my wife's iPhone, nothing happened.  In order to be identified as a USB charging port, the D+ and D- pins need to be shorted, or for a high-power (over 500mA) charging port they need to have a voltage divider from the 5V power.  I checked the pins with a meter, and they were not connected.  I then soldered a small jumper to short D+ and D-, and tried plugging in my wife's iPhone again.  This time the screen indicated the phone was charging.

Since the modules did not perform as advertised, I messaged the AliExpress seller XM Electronic trade/Allen Lau with the details of my testing, and requested a partial refund.  After four days he did not respond so I opened a dispute with AliExpress.  Within 12 hours, he rejected the dispute only stating, "There was no evidence of right".  In the past I've encountered sellers on AliExpress that have even given full refunds after learning their products don't perform as advertised.  With Allen Lau it's the first time I've encountered this kind of "I don't give a shit" attitude.

Although the modules do not perform as advertised, they are good for a 5V power source up to about 250mA.  You can also find boost converters with a beefier 47uF inductor, but from testing results I've read online they're not much better; with 2.4V in, the output voltage of the bigger modules drops below 2.75V at around 300mA.  For backup power for a mobile phone, one of the mobile power banks using a lithium 18650 cell may be a better idea.

If you're just looking to boost the voltage from a battery for a MCU project, check out Sprites mods.

Saturday, October 4, 2014

nRF24l01+ reloaded

Since writing my post on nrf24l01 control with 3 ATtiny85 pins, I've realized these modules are quite popular.  Of over a dozen posts on my blog, it has the most hits.  From the comments in the blog, I can see that despite a lot of online resources about these modules, there's still some not clearly documented problems that people run into.  So I'll go into some more detail on how they work, share some of my tips for testing & debugging, and more.

The biggest source of confusion seems to be with holding CE high.   Section 6.1.6 of the datasheet specifies a 10us high pulse to empty one level of the TX fifo (normal mode) or hold CE high to empty all levels of the TX fifo.  This is borne out in testing - CE can be held high for a transmitting device.

The above is a picture of a $1.50 wireless transmitter node I made.  Sorry about the poor focus - I don't have a good macro mode on my camera.  It's made with an ATtiny88-au glued and soldered with 30AWG wire to a nRF24l01+ module.  The pin arrangement is as follows:

ATtiny88 ------ nRF module
14 (PB2/SS) --- 4 (CSN)
15 (PB3/MO) --- 6 (MOSI)
16 (PB4/MI) --- 7 (MISO)
17 (PB5/SCK) -- 5 (SCK)
29 (PC6/RST) -- 3 (CE)

Connecting reset to CE keeps CE high when the AVR is running, and it also gives me an easy way to program the ATtiny88.  By connecting the CE pin to the RST pin of my programmer (a USBasp), the existing pins on the nRF module can be used as a programming header.  As long as CSN is not grounded, the nRF will not interfere with the communication on the SPI bus.  In my testing it worked with CSN floating, but it would probably be best to tie it high or connect a pullup resistor between CSN and Vcc.  A small 0603 15K chip resistor should work nicely for this.

The module is powered by a CR2032 cell in a holder on the back of the module.  When I wrote my post about Cheap battery-powered micro-controller projects, I hadn't done much experimenting with coin cells.  Although some CR2032 batteries can output 20mA continuous, the no-name cells I bought from DX certainly cannot.  I connected a 20uF electrolytic capacitor to provide enough voltage during transmits (around 12mA), and put the module in power-down mode the rest of the time.

While keeping CE high is fine for a device that is only transmitting or only receiving, you might run into a problem if you try to switch between the two.  The reason can be found in the state diagram from the datasheet: (contrast enhanced to make the state transitions easier to see)
The state diagram shows there is no way to go directly from Rx to Tx mode or the other way around.  The module must go into the standby-I state by setting CE low, or into the power down state by setting PWR_UP=0.  With CE held high, the only way to change between Rx and Tx mode is to go through power down mode.  Another option that doesn't require a separate pin for CE control is to connect CE to CSN.  This would allow you to use some nRF libraries that rely on CE toggling.  A potential drawback to this is if you want to keep the module in receive mode while polling the status (#7) register for incoming packets.  Each time CSN is brought low to poll the status, it will bring CE low as well, which will cause the module to drop out of Rx mode.  It only takes 130uS to return to Rx mode once CE goes high, so this may not be a concern for you.


Using a red LED in series with Vcc as my post on nrf24l01 control with 3 ATtiny85 pins makes it possible to quickly see how much power the module is using.  When in power down mode with CSN high, no light is visible from the LED due to the very low power use.  When powered up in Rx or Tx mode, the LED glows brightly, with 10-15mA of current.  By watching the power use I was able to tell that after the Rx fifo is full, the module stops receiving, causing the power consumption to drop.  The diagram in section 7.5.2 of the datasheet indicates that will happen if CE is low, but it still happens even with CE high.  Once a single packet is read out from the Rx fifo, it starts listening for packets again.

I also found connecting a LED to the IRQ pin (#8) helpful to see when the Rx or Tx IRQ fired.

Lastly, when testing connectivity, start with enhanced shockburst disabled (EN_AA = 0), and CRC off.  Then once you've confirmed connectivity, enable the features you want.  If you decide to use CRC, go with 2-byte CRC (EN_CRC and CRC0 in the CONFIG register) since a 1-byte CRC will miss 1 in every 256 bit errors vs 1 in 65,536 for a 2-byte CRC.

Undocumented registers

Register 6 (RF_SETUP) seems to be a 9-bit register.  Attempting to write 2 bytes to the register of all 1s (ff ff) followed by a read results in the following response:
0e ff 01
For other registers documented as being a single byte, attempts to read multiple bytes results in the same byte being repeated after the status byte.

There's also an undocumented multi-byte register at address 1e.  I found some code online that refers to this register as AGC_CONFIG, which implies it is for automatic gain control.  I could not find any documentation on how to use this register.  With my modules, the first three bytes of this register defaulted to 6d 66 05.  Reading them back after writing all 1s resulted in fd ff 07, so some bits are fixed at 0.

Sunday, September 14, 2014

On-chip decoupling capacitors

In virtually all of my micro-controller projects, I'll use 0.1uF ceramic capacitors between Vcc and Gnd.  Depending on the power draw of the MCU and inductance on the power lines, they may not be necessary, but at a cost of a penny or less each there's little reason not to use them.

I remembered seeing CPUs that have on-chip decoupling capacitors, and thought it would be nice if the MCUs I'm using had the same.  When working with small projects on mini breadboards, not having to find space for the decoupling cap would be convenient.  It would also save me the trouble of digging through my disorganized collection of components looking for that extra capacitor.

My first idea was to glue a 0805 (2mm x 1.25mm) MLCC to the top of the chip, and then solder 30AWG wire-wrap to the power and ground leads.  I used contact cement, and although it seemed secure after drying for about 30 minutes, once I added flux and touched it with my soldering iron tip it moved freely.  Then I tried a small drop of super glue, but for some reason it wasn't dry after an hour; maybe it was defective.  If someone knows of a glue that would work well, let me know in the comments or send me an email.

Even after drying for a day, neither the contact cement nor the super glue would securely hold the capacitors while I tried to solder them.  With the help of a pair of tweezers I was able to solder a MLCC to the top of an ATtiny85 as shown in the photo above.

For 28-pin DIP AVR MCUs that have ground and power on adjacent pins, the job is a lot easier.  Here's a ATtiny88-PU with a 0805 MLCC:

The easiest method I came up with doesn't require any glue.  I trimmed, then soldered the leads of a ceramic disc capacitor to the power and ground pins of an ATtiny84a:

2014/10/20 Update:
I found information about a high-temperature component adhesive which indicates typical cyanoacrylate adhesive is stable only up to 82C.  For something that is readily available in hardware stores, I may try silicone adhesive, or even BBQ paint.

Friday, September 12, 2014

Inside the "$10" Rockchip TV dongle

Last year Rockchip demoed a "$10" Miracast/DLNA TV dongle.  The $10 was not a target retail price, but probably the BOM cost.  They can be found for under $20 including shipping from China.  I bought one and posted a review of the Miracast and DLNA functionality.  In this post I'll document a basic teardown of the dongle, along with instructions on setting up a root console connection.

There are no screws holding the dongle together; the top and bottom of the case simply snap together.  The RK2928 is underneath a small heat spreader.  Next to it is a Spectek PE937-15E 256MB DDR3 chip. the rest of the components appear to be for power regulation.

On the bottom of the board is a Winbond serial flash chip and a Realtek rtl8188ETV USB wifi module.  Small pads labeled TX, RX, and GND are visible near the edge of the board.  They are obviously for a serial console.  I soldered some 30AWG wire-wrap wire to the pads, and to some 0.1" header pins.  With my soldering iron I melted an opening in the plastic case where I hot glued the header pins.

After putting the dongle back together, I connected the serial console to a USB-TTL serial adapter, and powered up the module.  I could see the Rx LED on the serial module flickering, indicating it was receiving console output data.  I started a terminal program, and was not seeing anything when I tried 9600 and 19,200bps.  Then I remembered my logic analyzer has a serial baud rate detection.  I hooked it up, ran a capture while the dongle was booting, and found the baud rate was 115,200kbps.

After setting the terminal program to 115,200, I could see what I recognized as the console output of a Linux kernel.  When the output stopped, I saw a "#" indicating a root shell prompt - no password required.  However the prompt wouldn't last long before the dongle seemed to reboot and repeat the start-up console output.

I first checked the board to make sure nothing was shorting from the connections I made to the serial port pads.  I then used a home-made USB cable with exposed power connections to measure the voltage.  I found the voltage was briefly dipping below 4.5V when the dongle was rebooting.  The dongle's peak power draw was too much for the PC USB port.  My solution was a 220uF capacitor connected to my home-made USB cable.  With the capacitor added, the voltage stayed above 4.8V, and there were no reboots.

The Linux installation seems to be a stripped-down android image rather than a standard linux distribution.  While the 256MB of RAM is ample for an embedded linux distribution, the 16MB of flash makes installing something like Picuntu Linux very difficult.

Sunday, August 24, 2014

A 5c lithium ion battery charger

My step-daughter lost the battery charger for her camera (for the second time in 2 yrs).  It takes a few weeks for a new one to arrive from DealExtreme, and she was hoping to use the camera over the weekend.  So I decided to hack something together.

As various sites explain, lithium-ion rechargeable batteries should be charged to 4.2 volts.  USB ports provide 5V, so all I needed was a way to drop 5V down to 4.2 or less.  Standard diodes have a voltage drop of 0.6 to 1.0 volts, so I pulled up the datasheet for a 1n4148, and looked at the I-V curve:
A standard USB port should provide up to 500mA of current, enough for charging a small camera battery.  A fully-discharged li-ion battery is 3V, and will climb to 3.8V within minutes of the start of charging.  Line 2 in the graph indicates a 1.2V drop at 350mA of current.  Under load the voltage output of a USB port will drop a bit, so with 4.9V from the USB port and 3.8V drop at the battery, the charging current will be around 250mA (where 1.1V intersects line 2).  Looking at the numbers, a single 1n4148 diode would work as a battery charge controller.

Connecting to the battery was the hardest part of the problem.  I tried making some contacts out of 24Awg copper wire, but that didn't work.  I though of bending a couple 90-degree header pins to fit the battery contact spacing, but I couldn't find my prototyping board to solder it into.  I ended up tack-sodering a couple 26Awg wires to plug into a breadboard.

For a charge status indicator, I used a couple LEDs I had on hand.  A 3V green LED in series with a 1.7V red LED start to glow visibly at 4V, and are moderately bright by 4.2V.  The few mA of current bleed from the LEDs over 4V would ensure enough current through the diode to keep the forward voltage above 0.8V, and therefore keeping the charge voltage from going over 4.2V.

The results were quite satisfactory.  After a few hours of charging, the voltage plateaued at 4.21V.  I removed the wires I tack soldered to the tabs, and the battery was ready to be used.  The same technique could be used with higher capacity batteries by using a different diode - a 1N4004 for example has a voltage drop of 1.0V at around 2A.