Hack your Logitech

Squeezebox Radio

In this article I show you, how you can build your own battery for your Squeezebox, how to connect it to your Squeezebox, how to gain acess to the serial (RS232) console of the radio and one easteregg I found. Pretty cool.

2011-04-09 Update: Added schematic of battery, added temperature during charging

Warning: Although this information is belived to be correct, I will not be responsible, if you break your Radio. Please follow at your own risk!

Content

1. Introduction
2. Connector pinout
3. DIY Battery Pack
4. Serial Console
5. Easter egg
6. Summary

Introduction

A few weeks ago I bought a Squeezebox Radio from Logitech for my bathroom. And when I had just unwrapped the radio, a small flap on the bottom of the box caught my attraction. When I opened the flap, I found a big cavity and a small 10 pin header. The manual says, you can buy a battery for the radio (~50€) and install it in this slot. But since I have still a lot of batteries laying around I decided today to build my own. But first I had to find out the pinout of the connector.

Connector pinout

The connector is a 10 pin, 2mm spacing male type header, and you can find various sockets for it on digikey or Farnell. I used the #1689483 from Farnell with those (or similar) contacts, but you can use those #1668190 as well. By try and error I found out the pinout of this connector. Seen from the rear of the Squeezebox I numbered the pins starting with "1" on the left-upper pin, "2" is the left lower pin (see picture)

1. Battery +
2. Unknown 1
3. Battery tap 2
4. Unknown 2
5. Battery tap 1
6. serial output
7. NTC
8. serial input
9. GND
10. +3.3V output

Between pin 10 and 9 you find the power outlet of the squeezebox, if you want to power your own circuit. I have no idea how much current can be drawn from there.

Between pin 7 and GND a NTC (10k) must be provided. This serves as a battery insert detection and to measure the temperature of the battery.

On the pins 6, 8 you find a serial connection where you can attach a serial to USB converter for example (see below)

Connect the positive terminal of a 10 cell NiMH battery to the Pin 1, a lower tap (maybe cell 3) to pin 5, and a higher tap (cell 7) to pin 3. You may consider two resistors (maybe 470R) in series with the tappings to limit the current in case of a fault. The negative terminal must be connected to GND. The input resistances of Tap1/2 are something like 9475 Ohms, and from the voltage readings (you find them in the diagnosis->power menu) I gess the internal ADC has a 10 bit resolution, 2.048V reference and an input voltage divider of approximately 10:1. To be precise, one LSB is internally weighted with 19.9883mV. I don't know, what the tapped voltages are used for in the Squeezebox, mainly to monitor the battery I gess.

The complete schematic:

The function of two pins is unknown:

Pin 4 is being pulled to GND with a ~10k resistor. The state of this pin seems to have no influence to the radio and is neither a handshake signal for the serial communication.

Pin 2 is even more strange. It must be some kind of analog input since it has some internal DC filter. I have drawn an equivlent circuit for this pin, maybe you have an idea?

DIY Battery Pack

The Squeezebox Radio uses a pack of 10 NiMH AA cells connected in series. I found this by connecting my laboratory power supply (set to ~13V or so) to the squeezebox instead of the battery, and connect the SB to the AC adaptor. The SB then tries to charge my ps to something like 16.1V, and after exactly 1 second recognises that there is nothing to charge, so the voltage falls back to the set voltage of 13V. Since the charge termination voltage for Lithium Ion cells is strictly at 4.20V/cell, such a battery would certainly be overcharged and damaged.

Voltage	Squeezebox response
16.1V	Maximum voltage during charge
11.1V	Displays "Low Battery"
10.6V	Shutdown

So asuming that the original battery consists of 10 NiMH cells, the charge termination would be at 1.6V maximum (much lower indeed, since the SB uses delta U charge termination) and the discharge would stop at ~1.1V per cell. I build such a batterie (2100mAh AA GP Recyco cells) and connected it to a connector as stated above. I also included the 10k NTC (Farnell #1672286) for temperature measurement and my USB to RS232(TTL) dongle.

But I was not quite sure, where to connect the taps to. And I don't know if and how the voltages are evaluated. Maybe for charge termination? Or for battery fault detection? I connected them to the joint of cell 3-4 and 7-8, so as symmetric as possible. So far no problems with that.

Not very nice, I know, but I had no heat shrinke ubing availabe at this size, so instead I used fabric tape. And it works! While running on AC, the battery is being charged, in the menue you can check the voltages and the temperature of the battery. Could not be better!

If idle or playing music at low volume my Squeezebox consumes about 2.1 - 2.5W, the exact value depends on the brightness of the backlight. So my battery pack should hold for approximately 12V*2.1Ah/2.5W = 10 hours, much longer than claimed for the original pack (they say it keeps the Squeezebox running for 6 hours). And the battery fits nicely in the slot, the serial cable goes in there, too.

Since the byttery is enclosed in a slot without any means for ventilation there is the risk for overheating during charging the battery. So I monitored the temperature rise during a charge cycle of a completely depleated battery pack.

I started the charging after I let the battery run low over night. This is why one can still see the temperature dropping in the begining. Charging my battery (2100mAh) takes about 5.5 hours suggesting a (non measured) charging curent of about 400mA. While the battery reaches maximum capacity the charging becomes ineficient and the pack heats up. This is a normal process with all NiMH batteries and can be used to determin charge termination (although the -dU method is more favourable). The exact time of charge termination can be determind by the inflection point of the temperature. Due to the sensor sitting on the outside of the pack the peak temperature is reached a while after charge termination. Have a look at the specs of your battery, most vendors recommend an operating temperature of 10-45°C. So I am in no way concerned about the temperature.

Serial Console

This is the fun part: Get one of the cheap USB to TTL RS232 converters based on the FTDI chip FT232 like this one, and connect GND, RX and TX to the appropriate pins (crossed RX and TX of cause). Then setup the good old HyperTerminal to this com port at 115k2 8-N-1, no handshake. Boot your Squeezebox Radio and you will see this:

++NAND: RCSR=54200900
Searching for BBT table in the flash ...
.
Found version 1 Bbt0 at block 1023 (0x7fe0000)
Block 46 is bad
Block 284 is bad
Block 787 is bad
Block 869 is bad
Total bad blocks: 4
.FEC PHY: RTL8201EL
FEC: [ HALF_DUPLEX ] [ disconnected ] [ 10M bps ]:
Ethernet mxc_fec: MAC address 00:04:20:26:12:cc
No IP info for device!
Unrecognized chip: 0xf8!!!
hardware reset by POR

...

Cool eh? The full log is available here. After the Radio has booted, just press 'return' and you get access to a console and the file system. But since I am not very familiar with linux, I have no idea of what to do with it now. But sure you have. Please This e-mail address is being protected from spambots. You need JavaScript enabled to view it !

Alternatively you can logon via SSH (see below).

Eastereggs

On the menue of the radio go to: Preferences->Advanced->Factory test->Display and zap through the test. In the end you see a picture of a lady. Obviously your screen is working.

Try to logon over ssh to your Squeezebox (login: root, pwd 1234, enable in the menue first) and you will see this funny message:

This network device is for authorized use only. Unauthorized or improper use
of this system may result in you hearing very bad music. If you do not consent
to these terms, LOG OFF IMMEDIATELY.

Ha, only joking. Now you have logged in feel free to change your root password
using the 'passwd' command. You can safely modify any of the files on this
system. A factory reset (press and hold add on power on) will remove all your
modifications and revert to the installed firmware.

Summary

In the manual it is written: "We hope you have as much fun using it (the Squeezebox) as we did creating it for you."  I have. Thank you!

Comments are welcome,

Achim