At the core is the traditional key matrix. It is a grid of rows and columns with momentary push switches that connect a row to a column when pressed. All of the rows are tied high by resistors to the 5v supply rail. The rows are inputs to an octal NAND gate (IC4), which, in this case is better thought of as an OR gate with inverting inputs. I.e. but default the output of the NAND gate is low but if one of the rows is pulled low the NAND output goes high. The rows are also inputs in to the line data selector (IC2).

The synchronous 4 bit binary counter (IC1) is driven by the BBC Micro’s 1MHz clock and when the KB EN is high is in free running mode. The 4 bit outputs (outputs QA-QD) are decoded by the BCD to decimal decoder (IC3) such that the decoder’s outputs go low in turn. The outputs of the decoder form the columns of the grid. I.e. column 0 is low on the first clock pulse, column 1 on the second and so on. If a key is pressed the row the key is on will go low when the column goes low. This in turn makes the output of the NAND gate go high indicating a key is pressed. The output of the NAND gate is used to generate an interrupt in the BBC Micro’s CPU.

So normally the keyboard is being scanned by the hardware without any software influence. This is a good thing as it takes a lot of loading off of the BBC Micro’s CPU. When the key press interrupt is triggered the key scanning software takes over. As I said normally the 4 bit binary counter (IC1) is free running however if the LOAD pin (pin 9) is taken low the 4 bit input value (inputs A-D) are latched through to the outputs (QA-QD) and hence control the columns provided by the decoder (IC3). IC1′s load pin is connected to KB EN.

The S line of the data line selector (IC2) is the select line and is also connected to KB EN. The output of IC2 is 3 state meaning it either reflects the appropriate data input line when select is low or is high impedance. The data input lines are the row lines of the keyboard matrix. The input line is chosen using the three bit ‘address’ value on A-C. The row state is output via pin W.

So the keyboard is normally hardware scanning. If the user presses a key, the interrupt is triggered. The CPU enables the keyboard by setting KB EN low and then manually scans the key board by setting the columns in turn via IC1 and checking the state of the rows in turn via IC2. Once the scan is complete KB EN is set high and the hardware scanning continues.

There are three keys on the keyboard which are exceptions. The two SHIFT and CTRL keys are on a row that does not trigger an interrupt. This means that shift is only scanned manually or when another key is pressed. The BREAK key (labled RST) is completely separate from the matrix and triggers the CPU’s reset line. On boot the CPU scans the keyboard manually to see if any of the modifiers are held down to do a cold reset or mount the disk for example.

The BBC Micro keyboard can be easily interfaced with say an ATMEL ATMega328 (like in an Arduino). The micro-controller can drive a pin directly from one of the timers generating a square wave output to scan the keyboard. The interrupt can be connected to one of interrupt inputs and the rest connected to general purpose IO pins set as outputs or inputs as appropriate. Dick Streefland’s USBtiny code provides the functionality to support the USB protocol in software utilising three IO pins on the micro-controller and a few discrete components. All that is required by me is to write the keyboard scanning code and provide the missing bits of the HID device profile.

Overview

In order to install kind of new operating system I needed to have root access on the device. This meant I had to root it. Since Android 1.6 (Release R10) on the G1 doesn’t have any useful exploits I had to downgrade the OS to Release R7 first. Once it is downgraded it you can use the rooting exploit in R7 to get root access and install a recovery image that will allow the installation of an updated radio software and the new operating system.

Preliminaries

Firstly read all of this blog post and all of the pages linked to from this blog post. There is at least one point in this process where you can “brick your phone”. I.e. you can put it in a state where by a regular user cannot make it usable.

Secondly you will be wiping your phone and replacing the software on it. Back anything up you want to keep. This includes purchased applications, data, contacts, whatever.

Make sure the phone is fully charged. You don’t want it running out of power mid-flash!

Finally I provide no warranty express or implied. You are doing this to your phone. If it goes wrong its your fault! You have been warned!

Downgrading and rooting

Downgrading, rooting the phone, and installing a recovery image is described in the link below. However since there are specific requirements for upgrading to Android 2.X I’ll explain each stage here.

http://forum.xda-developers.com/showthread.php?t=442480

Downgrading

Before you do anything take note of the radio version string in the boot-loader. Its the fourth line down. You get the boot-loader screen up by holding down the camera button when powering on the phone. With the original loader you should have multi-coloured bars with yellow text in the top left hand corner. On my phone the radio version string read “RADIO-2.22.19.26I”. Write down the string and store it somewhere safe. You’ll need it later.

Now download the appropriate older image for your phone. The links to the image downloads are on the page above however here’s the link for RC7 for those with UK phones. Download the image, unzip it, and save the DREAMIMG.nbh file in the root of your SD card. While you’re at it also download recovery-RA-dream-v1.5.2.img which is a recovery image and will be used later. Save this in the root of your SD card also.

Turn off your phone, insert the SD card, and turn it back on again holding down the camera key as before. It should now re-flash your phone. There should be a progress bar. When its all complete you can restart your phone normally (without the camera key held down). This will result in some old school Android graphics and you wondering how anyone ever coped with that software. Once the phone has booted find the phone details in settings and check the software build version number. It should appear as something like TC5-RC7 112931.

Rooting the phone

Now you have exploitable image installed it is time to root the phone. This can be done using a back door. Go to the home screen then type…

<return>
<return>
telnetd
<return>

…on the slide out keyboard. This will look like a search in contacts for the name of telnetd. In fact telnetd is the telnet daemon which allows you to connect to shell on the phone via telnet. So now you need a telnet client. Use the Android Market to download a telnet client. Once installed you should be able to telnet to localhost and get a telnet prompt.

If all is well you have shell access as root (a ‘#’ prompt). Yay!

Installing a recovery image

Now we are going to install the recovery image we downloaded earlier. This will also give us permanent root access. In the shell type…

mount -o rw,remount -t yaffs2 /dev/block/mtdblock3 /system
cd sdcard
flash_image recovery recovery-RA-dream-v1.5.2.img
cat recovery-RA-dream-v1.5.2.img > /system/recovery.img

For those who are interested the lines do the following:

1. Remounts the flash memory in read/write mode. This allows you to save to the flash in the phone.
2. Navigate to the sdcard (which is mounted at /sdcard)
3. Flashes the recovery-RA-dream-v1.5.2.img image file in to the special recovery partition in the flash.
4. Copies the recovery-RA-dream-v1.5.2.img as /system/recovery.img (The Android busybox doesn’t have the copy command but cat with a pipe works just as well!).

Once you’ve done this and have a prompt again you can reboot the phone. This time if you hold down the home and power buttons when you power on the phone it will boot in to the recovery image. You can use the short cuts or the track ball to select a menu item.

Now we are ready to install the new software.

New radio software and DangerSPL

Now we have to repartition the flash to give enough room for the new platform. This is the scary bit. As I said before…

Finally I provide no warranty express or implied. You are doing this to your phone. If it goes wrong its your fault! You have been warned!

Read this page thoroughly http://wiki.cyanogenmod.com/index.php?title=Dream:DangerSPL. If you’ve gotten this far you fulfil the prerequisites to install Danger/SPL. You now need to download the appropriate radio image, place it in the root of your SD card and flash it. Remember that number we noted down from the boot-loader screen at the start (“RADIO-2.22.19.26I” or similar). You will need it now.

Boot in to recovery by holding down the home and power buttons. Select “Flash zip from sdcard”. Select update.zip (if that’s the name of the file) from the file menu. The image should be flashed and will then reboot the phone. Reboot the phone again.

Take out the SD card and boot back in to the boot loader. It should now appear as below.

Upgrading to FROYO and installing Google Apps

All the hard work is now done. You have a rooted phone with a nice recovery menu which allows you to flash anything that will fit.

To install the latest Android read this link: http://wiki.cyanogenmod.com/index.php?title=Dream:Installing_CyanogenMod_5%2B.

Clear out your SD card and download Froyo for the G1/Dream and the Google Tiny Apps (The G1 is a bit short on flash space so wont fit the all singing all dancing versions of the Google apps). Boot in to recovery as before (home and power buttons) and again select “Flash zip from sdcard”. Flash first Froyo and then the apps.

Finally reboot your phone. You should now have Android 2.2 installed!

Issues

The only issue I had was an exception from the keyboard software the first time I used Froyo. This can be solved using the “Wipe” menu in the recovery image. I wiped data, cache and delvik cache (The latter generated an error I ignored) and then re-installed Froyo.

I have created a new site http://projects.cyberspice.org.uk/ which contains all the details of these projects. Over the next few days I will be updating it with the details of Beebthernet, my programmable earrings and so on. Each of the projects will be described in detail and links to software and schematic downloads provided.

The first documented project is my ethernet for a BBC Microcomputer project known as Beebthernet.

I will be bringing a long several Arduino-a-likes together with a variety of components and CDs of the IDE so that we can get together in groups, code and play.

I am intending to take along items which are a mix of traditional crafts such as knitting and jewellery making combined with tech. For example programmable earrings, a temperature sensing hat and a bag that has a proximity detector and RFID tag so it can detect its owner.

I am also going to show off a couple of my other projects like an ethernet adapter for a BBC microcomputer and a “Mood Wall” (It analyses twitter tweets for the mood of the content displaying patterns and colours which reflect the prevailing mood).

Hopefully I will see you there!

Its a BoArduino, an HD4470 compatible LCD display, a WIZ810MJ ethernet module (in an adapter board) and some discrete components with a TMP36 for temperature monitoring.

This is the result set for the last day. The live graph is here.

The circuit uses nearly all of the digital pins (it would use them all if the ethernet library supported interrupts). The LCD is connected using digital pins 3 to 8. Pins 3 to 6 are the data lines, 7 is the enable pin and 8 is RS. The ethernet module is connected using digital pins 9 to 13 being Reset, SS, MOSI, MISO and SCLK. The temperature sensor is connected to Analog pin 0. It outputs 10mV per degree Celcius with a 500mV offset so that 0C is 500mv, 50C is 1V etc. The code sketch is below.

#include <string.h>
 
// Required for the LCD
#include <LiquidCrystal.h>
 
// Required for ethernet
#include <Client.h>
#include <Ethernet.h>
#include <Server.h>
 
// Required for the IINCHIP macros
#include <utility/spi.h>
 
// The ethernet reset control pin
int resetPin  = 9;
// The temperature analog input pin
int tempAnPin = 0;
 
// String buffer
char buffer[256];
 
// Hardcoded MAC, IP and gateway
byte mac[] = { 0xDE, 0xAD, 0xBE, 0xEF, 0xFE, 0xED };
byte ip[]  = { 192, 168, 1, 140 };
byte gw[]  = { 192, 168, 1, 254 };
 
// Create an LCD control object.  Doesn't use regular pins as
// we need some of them for the Ethernet SPI.
LiquidCrystal lcd(8, 7, 6, 5, 4, 3);
 
// Hardcoded server and port
byte svr[] = { 192, 168, 1, 128 };
int  port  = 80;
 
// A client class for connecting to a remote server to send data
Client client(svr, port);
 
/**
 * Writes a byte to a register in the W5100 chip used by the 
 * WIZ810MJ ethernet board. 
 *
 * @param addr The address in the W5100 controller to write.
 * @param data The byte to write.
 */
void writeByte(int addr, byte data) {
  IINCHIP_ISR_DISABLE();
  IINCHIP_SpiInit();
  IINCHIP_CSoff();
 
  IINCHIP_SpiSendData(0xf0);
  IINCHIP_SpiSendData((addr & 0xff00) >> 8);
  IINCHIP_SpiSendData(addr & 0xff);
  IINCHIP_SpiSendData(data);
 
  IINCHIP_CSon();
  IINCHIP_ISR_ENABLE();
}
 
// The four IP addres bytes (we're not IP6 compatible here)
byte ip0, ip1, ip2, ip3;
 
/**
 * Initialise the hardware
 */
void setup() {
  // Reset the ethernet board
  pinMode(resetPin, OUTPUT);
  digitalWrite(resetPin, HIGH);
  delay(1); // 1ms
  digitalWrite(resetPin, LOW);
  delay(1); // 1ms
  digitalWrite(resetPin, HIGH);  
 
  // Start ethernet
  Ethernet.begin(mac, ip, gw);
 
  // Enable ping.  Useful for debugging.
  writeByte(0x0000, 0x00);
 
  // Read the IP address (Check to see its working right) 
  ip0 = readByte(0x000f);
  ip1 = readByte(0x0010);
  ip2 = readByte(0x0011);
  ip3 = readByte(0x0012);
 
  // Form the output string (Adds about a K to the code size)
  sprintf(buffer, "%d.%d.%d.%d", ip0, ip1, ip2, ip3);
 
  // Display it
  lcd.home();
  lcd.print(buffer);
 
#ifdef DEBUG
  Serial.begin(9600);
#endif
}
 
// The value of the temperature analog pin
int tempAnValue;
 
// The temperature
int temperature;
 
// The temperature components;
int tempInt;
int tempFrac;
 
// A counter for sychronization.  Allows server to work out if a
// 'packet' is missing
int count = 0;
 
/**
 * Main processing thread
 */
void loop() {
  // Read the temperature
  tempAnValue = analogRead(tempAnPin);
 
  // Fixed point math to calculate the temperature (multiply then divide
  // to reduce rounding issues) Gives temperature in 100ths of degree C
  // 5000 millivolts is the maximum voltage
  // 1024 is the maximum ADC value
  // 500mv is 0 degrees C
  temperature = ((tempAnValue * 50000) / 1024) - 5000;
 
  // Since we're only going to report to 1 decimal place, add 5 for correct
  // rounding
  tempInt  = (temperature + 5) / 100;
  tempFrac = ((temperature + 5) % 100) / 10;
 
  // Form the output string
  sprintf(buffer, "Temp: %d.%d C", tempInt, tempFrac);
 
  // Display it
  lcd.clear();
  lcd.print(buffer);
 
#ifdef DEBUG
{
    sprintf(buffer, 
            "HEAD /newtemp.php?count=%d&temp=%d.%d HTTP/1.1", 
            count, tempInt, tempFrac);
 
    Serial.println(buffer);
    Serial.println("Host: my.host.org");
    Serial.println("Connection: close");
    Serial.println();
}
#endif
 
#ifndef NO_ETHERNET
  // Send to server
  if (client.connect()) {
    // If connected send the packet count and temperature
    sprintf(buffer, 
            "HEAD /newtemp.php?count=%d&temp=%d.%d HTTP/1.1", 
            count, tempInt, tempFrac);
 
    client.println(buffer);
    client.println("Host: my.host.org");
    client.println("Connection: close");
    client.println();
    client.stop();
  } else {
    // If failed sad face
    lcd.print(" :-(");
  }
#endif
 
  // Update packet counter
  count++;
 
  // Sleep for a minute
  delay(60000);
}

A couple of things to note are:

• I use integer math. avrgcc, the compiler, supports floats but its just more efficient and requires less memory to use fixed point integer math when its just one or two values you need to represent.
• I use a count value sent with each data packet so that if one goes missing you can tell, Currently the code at the other end doesn’t use it though.
• I send a HEAD request with a query string containing the values. My request is not technically valid HTTP but the server doesn’t have a problem. A HEAD request returns the headers for a request but no body. Since I’m ignoring the whole response anyway I don’t need the body!

The script on the web server that receives the data is below. It is very simple PHP. Since PHP doesn’t support HEAD requests directly in its super-globals (watch this space I process the query string by hand. As I know the format of the data since I control the client I’m not worried about URL decoding the data. It writes three values (the time in seconds since the UNIX epoch, the packet count and the temperature), colon separated, as a line to a text file. It returns nothing.

<?php
 
if ($_SERVER['REQUEST_METHOD'] == 'HEAD') {
 
	$fields = explode("&", $_SERVER['QUERY_STRING']);
	$values = array();
 
	foreach ($fields as $field) {
		$keyval = explode("=", $field);
		$values[$keyval[0]] = $keyval[1];
	}
 
	$file = fopen('/path/to/tempdata.txt','a+');
	if ($file) {
		fwrite($file, time() . ':' . $values['count'] . ':' . $values['temp']);
		fwrite($file, "\n");
		fclose($file);
	}
}
 
?>

Another script generates a graph as a PNG file based on the data. This code is below.

<?php
 
define('WIDTH', 1000);
define('HEIGHT', 520);
define('FONT', 1);
 
// Get the temperature data
$data = array();
$file = fopen("/path/to/tempdata.txt","r");
if ($file) {
	while (!feof($file)) {
		$line = trim(fgets($file));
		if (strlen($line)) {
			$fields = explode(":", $line);
			$keyval = array();
			$keyval['time']        = $fields[0];
			$keyval['count']       = $fields[1];
			$keyval['temperature'] = $fields[2];
			$data[] = $keyval;
		}
	}
 
	fclose($file);
}
 
// Get the number of data points
$datapoints = count($data);
 
// Lines are chronological
$mintime = $data[0]['time'];
$maxtime = $data[$datapoints - 1]['time'];
 
// Temperatures need to be processed.
$mintemp = $data[0]['temperature'];
$maxtemp = $data[0]['temperature'];
 
foreach ($data as $datapoint) {
	$mintemp = $mintemp < $datapoint['temperature'] ? 
	           $mintemp : $datapoint['temperature'];
	$maxtemp = $maxtemp > $datapoint['temperature'] ? 
	           $maxtemp : $datapoint['temperature'];
}
 
// Get the axis dimensions.  Round up and down to the nearest
// degree C and hour.
$lowtime  = intval($mintime / 3600) * 3600;
$hightime = (intval($maxtime / 3600) + 1) * 3600;
$difftime = $hightime - $lowtime;
 
$lowtemp  = intval($mintemp);
$hightemp = intval($maxtemp) + 1;
$difftemp = $hightemp - $lowtemp;
 
// Create the image
$image = imagecreate(WIDTH, HEIGHT);
if ($image) {
	$background = imagecolorallocate($image, 255, 255, 255);
	$black      = imagecolorallocate($image, 0, 0, 0);
	$red        = imagecolorallocate($image, 255, 0, 0);
	$blue       = imagecolorallocate($image, 0, 0, 255);
 
	// Draw the axes
	imageline($image, 20, 20, 20, 485, $black);
	imageline($image, 15, 480, 980, 480, $black);
	imageline($image, 15, 20, 20, 20, $black);
	imageline($image, 980, 480, 980, 485, $black);
 
	for ($i = 3600; $i < $difftime; $i += 3600) {
		$x = 20 + (($i * 960) / $difftime);
		imageline($image, $x, 480, $x, 483, $black);
	}
 
	for ($i = 1; $i < $difftemp; $i++) {
	    $y = 480 - (($i * 460) / $difftemp);
		imageline($image, 17, $y, 20, $y, $black);
	}
 
	// Draw the labels
	imagestring($image, FONT, 8, 490, date("H:i", $lowtime), $black);
	imagestring($image, FONT, 970, 490, date("H:i", $hightime), $black);
	imagestringup($image, FONT, 2, 485, $lowtemp . 'C', $black);
	imagestringup($image, FONT, 2, 25, $hightemp . 'C', $black);
 
	// Draw the points
 
	// Position of the first point
	$prevx = (($data[0]['time'] - $lowtime) * 960) / $difftime;
	$prevy = (($data[0]['temperature'] - $lowtemp) * 460) / $difftemp;
 
	// Draw line from previous point to current point
	for ($i = 1; $i < $datapoints; $i++) {
		$x = (($data[$i]['time'] - $lowtime) * 960) / $difftime;
		$y = (($data[$i]['temperature'] - $lowtemp) * 460) / $difftemp;
		imageline($image, $prevx + 20, 480 - $prevy, $x + 20, 480 - $y, $red);
		$prevx = $x;
		$prevy = $y;
	}
 
	// Finally time and date stamp
	$generated = 'Generated: ' . date("r");
	imagestring($image, 
	            FONT,
	            WIDTH - 15 - (imagefontwidth(FONT) * strlen($generated)),
	            HEIGHT - 15, 
	            $generated,
	            $blue);
 
	// Output the image
	header('Content-Type: image/png');
	imagepng($image);
 
	// Destroy it
	imagedestroy($image);
}
 
?>

This was a fun little project and as can be seen from the snap shot of the graph changing the bulb significantly changes the maximum temperature of the vivarium. I will be running with the smaller wattage bulb.

]]> http://www.cyberspice.org.uk/blog/2009/10/29/boarduino-vivarium-temperature-monitor/feed/ 10 http://www.cyberspice.org.uk/blog/2009/09/14/breadboard-power-supply/ http://www.cyberspice.org.uk/blog/2009/09/14/breadboard-power-supply/#comments Mon, 14 Sep 2009 12:17:53 +0000 cyberspice http://www.cyberspice.org.uk/blog/?p=283 Last Sunday I woke early so I started on a project I’ve had in mind for a while but not gotten around to doing. I built a power supply module that plugs in to a breadboard. There are a few kits for these kind of things around from Adafruit and others but I had slightly different requirements.


My basic requirements were 5V and 3.3V supplies with the unregulated supply coming from a power adapter plug. I built the circuit on strip board as I had some available, it saved me designing a circuit board, and the holes lined up. The size of the board was set by the width of the breadboard together with how much of the breadboard I wanted to obscure. I also wanted indicators for the unregulated supply, the 5V supply and 3.3V supply so that I could spot any faults. And I wanted it to look relative tidy. This is what I came up with…



I kind of put the cart before the horse since I didn’t have a circuit when I started. It was built basically from a design I had in my head. Its a fairly text book design with a diode to protect the circuit from reverse current, smoothing capacitors in to the regulators and smoothing capacitors on the outputs. LEDs and current control resistors make up the rest of the circuit. The electrolytic capacitor values were basically based on what I had available. I suspect a 100uF on the input smoothing would be better. The schematic is below.



I like my electronics to look neat so I laid out the major components to ensure the board was symmetrical, the LEDs lined up and it plugged in to the breadboard without issue. Everything else was fitted around those components. There are no breaks in the tracks on this circuit although there are a couple of wires underneath to provide the GND ‘plane’.

Finally here’s a close up of the board. This is annotated on Flickr so you can see what does what.



All in all a nice way to spend a couple of hours on a Sunday.

]]> http://www.cyberspice.org.uk/blog/2009/09/14/breadboard-power-supply/feed/ 7 http://www.cyberspice.org.uk/blog/2009/09/03/fun-with-a-boarduino/ http://www.cyberspice.org.uk/blog/2009/09/03/fun-with-a-boarduino/#comments Thu, 03 Sep 2009 12:20:44 +0000 cyberspice http://www.cyberspice.org.uk/blog/?p=270 In March I went to the first Makerfaire in the UK. The Newcastle-upon-Tyne Makerfaire was part of Newcastle Sciencefest. Its not that far from where I live so I drove up there for the day.

There were lots of kewl stuff as you’d expect. I particularly liked the electro-mechanical fire breathing horse robot. Amusingly I met one of the Microsoft guys who’d demonstrated the Microsoft interactive table at PHP London. He was there with his cheap, home brew, version of the table which used back projection of the image and a camera to detect the finger position. The guy with the UK101s who I’d met at Techadventure was also there.

Naturally there was an O’Reilly stand as they are publishers of both Make and Craft magazines. They had a pile of kits from Adafruit including the boArduino. This is an Arduino clone designed to plug in to a breadboard. There are two versions. One with a USB to Serial adapter on board and one which has a power supply onboard but requires TTL level serial which can be easily supplied by an FTDI lead. I bought one of the latter.

The kit languished on the shelves at my computer workstation until about a month ago when I decided to solder it together and play with it. Its a through hole double sided board which is relatively packed and so requires some experience of soldering. Apart from stupidly soldering in a LED the wrong way around and then having to desolder it and obtain a new one I had no problems. It worked first time! Limor aka Ladyada, who designed it and runs Adafruit makes good stuff.

I videoed it using my G1 phone (hence the poor quality due to low light). I have the Arduino IDE running on my MacBook. The FDTI lead is based around a common part with easily obtainable drivers for Windows, OS X and Linux.

]]> http://www.cyberspice.org.uk/blog/2009/09/03/fun-with-a-boarduino/feed/ 0