diodenring.de

  • Increase font size
  • Default font size
  • Decrease font size
Home Electronic Mikrocontroller Free your Squeezebox Radio

Free your Squeezebox Radio

PDF

Hack your Logitech

Squeezebox Radio

In this article I show you, how you can build your own battery for your Squeezebox, how to connect it to your Squeezebox, how to gain acess to the serial (RS232) console of the radio and one easteregg I found. Pretty cool.

 


2011-04-09 Update: Added schematic of battery, added temperature during charging

 

Warning: Although this information is belived to be correct, I will not be responsible, if you break your Radio. Please follow at your own risk!

Content

  1. Introduction
  2. Connector pinout
  3. DIY Battery Pack
  4. Serial Console
  5. Easter egg
  6. Summary


Introduction

A few weeks ago I bought a Squeezebox Radio from Logitech for my bathroom. And when I had just unwrapped the radio, a small flap on the bottom of the box caught my attraction. When I opened the flap, I found a big cavity and a small 10 pin header. The manual says, you can buy a battery for the radio (~50€) and install it in this slot. But since I have still a lot of batteries laying around I decided today to build my own. But first I had to find out the pinout of the connector.

 

setup

 

 

Connector pinout

The connector is a 10 pin, 2mm spacing male type header, and you can find various sockets for it on digikey or Farnell. I used the #1689483 from Farnell with those (or similar) contacts, but you can use those #1668190 as well. By try and error I found out the pinout of this connector. Seen from the rear of the Squeezebox I numbered the pins starting with "1" on the left-upper pin, "2" is the left lower pin (see picture)

 

Header

 

  1. Battery +
  2. Unknown 1
  3. Battery tap 2
  4. Unknown 2
  5. Battery tap 1
  6. serial output
  7. NTC
  8. serial input
  9. GND
  10. +3.3V output


Between pin 10 and 9 you find the power outlet of the squeezebox, if you want to power your own circuit. I have no idea how much current can be drawn from there.

Between pin 7 and GND a NTC (10k) must be provided. This serves as a battery insert detection and to measure the temperature of the battery.

On the pins 6, 8 you find a serial connection where you can attach a serial to USB converter for example (see below)

Connect the positive terminal of a 10 cell NiMH battery to the Pin 1, a lower tap (maybe cell 3) to pin 5, and a higher tap (cell 7) to pin 3. You may consider two resistors (maybe 470R) in series with the tappings to limit the current in case of a fault. The negative terminal must be connected to GND. The input resistances of Tap1/2 are something like 9475 Ohms, and from the voltage readings (you find them in the diagnosis->power menu) I gess the internal ADC has a 10 bit resolution, 2.048V reference and an input voltage divider of approximately 10:1. To be precise, one LSB is internally weighted with 19.9883mV. I don't know, what the tapped voltages are used for in the Squeezebox, mainly to monitor the battery I gess.

The complete schematic:

schematic diagram of the proposed battery pack

The function of two pins is unknown:

Pin 4 is being pulled to GND with a ~10k resistor. The state of this pin seems to have no influence to the radio and is neither a handshake signal for the serial communication.

Pin 2 is even more strange. It must be some kind of analog input since it has some internal DC filter. I have drawn an equivlent circuit for this pin, maybe you have an idea?

 

equivalent circuit to pin2

 

 

DIY Battery Pack

The Squeezebox Radio uses a pack of 10 NiMH AA cells connected in series. I found this by connecting my laboratory power supply (set to ~13V or so) to the squeezebox instead of the battery, and connect the SB to the AC adaptor. The SB then tries to charge my ps to something like 16.1V, and after exactly 1 second recognises that there is nothing to charge, so the voltage falls back to the set voltage of 13V. Since the charge termination voltage for Lithium Ion cells is strictly at 4.20V/cell, such a battery would certainly be overcharged and damaged.

Voltage
 Squeezebox response
 16.1V Maximum voltage during charge
 11.1V Displays "Low Battery"
 10.6V Shutdown

So asuming that the original battery consists of 10 NiMH cells, the charge termination would be at 1.6V maximum (much lower indeed, since the SB uses delta U charge termination) and the discharge would stop at ~1.1V per cell. I build such a batterie (2100mAh AA GP Recyco cells) and connected it to a connector as stated above. I also included the 10k NTC (Farnell #1672286) for temperature measurement and my USB to RS232(TTL) dongle.

But I was not quite sure, where to connect the taps to. And I don't know if and how the voltages are evaluated. Maybe for charge termination? Or for battery fault detection? I connected them to the joint of cell 3-4 and 7-8, so as symmetric as possible. So far no problems with that.

 

DIY battery

 

Not very nice, I know, but I had no heat shrinke ubing availabe at this size, so instead I used fabric tape. And it works! While running on AC, the battery is being charged, in the menue you can check the voltages and the temperature of the battery. Could not be better!

 

The squeezebox running on my DIY battery (do you see the tiny battery icon on the display?)

If idle or playing music at low volume my Squeezebox consumes about 2.1 - 2.5W, the exact value depends on the brightness of the backlight. So my battery pack should hold for approximately 12V*2.1Ah/2.5W = 10 hours, much longer than claimed for the original pack (they say it keeps the Squeezebox running for 6 hours). And the battery fits nicely in the slot, the serial cable goes in there, too.

Since the byttery is enclosed in a slot without any means for ventilation there is the risk for overheating during charging the battery. So I monitored the temperature rise during a charge cycle of a completely depleated battery pack.

 

Diagram of the temperature during chaging process

 

I started the charging after I let the battery run low over night. This is why one can still see the temperature dropping in the begining. Charging my battery (2100mAh) takes about 5.5 hours suggesting a (non measured) charging curent of about 400mA. While the battery reaches maximum capacity the charging becomes ineficient and the pack heats up. This is a normal process with all NiMH batteries and can be used to determin charge termination (although the -dU method is more favourable). The exact time of charge termination can be determind by the inflection point of the temperature. Due to the sensor sitting on the outside of the pack the peak temperature is reached a while after charge termination. Have a look at the specs of your battery, most vendors recommend an operating temperature of 10-45°C. So I am in no way concerned about the temperature.

 

Serial Console

This is the fun part: Get one of the cheap USB to TTL RS232 converters based on the FTDI chip FT232 like this one, and connect GND, RX and TX to the appropriate pins (crossed RX and TX of cause). Then setup the good old HyperTerminal to this com port at 115k2 8-N-1, no handshake. Boot your Squeezebox Radio and you will see this:

++NAND: RCSR=54200900
Searching for BBT table in the flash ...
.
Found version 1 Bbt0 at block 1023 (0x7fe0000)
Block 46 is bad
Block 284 is bad
Block 787 is bad
Block 869 is bad
Total bad blocks: 4
.FEC PHY: RTL8201EL
FEC: [ HALF_DUPLEX ] [ disconnected ] [ 10M bps ]:
Ethernet mxc_fec: MAC address 00:04:20:26:12:cc
No IP info for device!
Unrecognized chip: 0xf8!!!
hardware reset by POR
...

Cool eh? The full log is available here. After the Radio has booted, just press 'return' and you get access to a console and the file system. But since I am not very familiar with linux, I have no idea of what to do with it now. But sure you have. Please This e-mail address is being protected from spambots. You need JavaScript enabled to view it !

Alternatively you can logon via SSH (see below).

 

Eastereggs

On the menue of the radio go to: Preferences->Advanced->Factory test->Display and zap through the test. In the end you see a picture of a lady. Obviously your screen is working.

 

Try to logon over ssh to your Squeezebox (login: root, pwd 1234, enable in the menue first) and you will see this funny message:

This network device is for authorized use only. Unauthorized or improper use
of this system may result in you hearing very bad music. If you do not consent
to these terms, LOG OFF IMMEDIATELY.

Ha, only joking. Now you have logged in feel free to change your root password
using the 'passwd' command. You can safely modify any of the files on this
system. A factory reset (press and hold add on power on) will remove all your
modifications and revert to the installed firmware.

 

Summary

In the manual it is written: "We hope you have as much fun using it (the Squeezebox) as we did creating it for you."  I have. Thank you!

 

Comments are welcome,

Achim

Comments
Search
GiPe  - Fine Job !   |2009-12-12 22:53:55
Thanks a lot Achim for your detailed description. My squeeze box is now equipped
with 10xGP-2700 batteries.

Actually charging... All seem to be perfectly
working !

I'll tell you how it is running after some time.

Chuss !
GiPe   |2009-12-19 09:56:41
After using it during one week, I confirm that the battery pack perfectly
works.

Thanks again.
doubleugk  - Weiteres Hacking   |2010-02-05 17:51:03
Super coole Info. Hast Du in der zwischenzeit mehr darüber in Erfahrung bringen
können, welche Einstellungen über SSH modifiziert werden könnten? Habe bisher
nichts im Netz gefunden.
achim   |2010-02-07 04:25:56
Sorry, I have no further information about what you can modify over the console.
As far as I know, there is a Busybox Linux running on the SB.

But since I have
(nearly) no xperience with Linux, I can't tell, whats possible, and what not.
But I think, that you get really full acess to the device. For example I was
able to browse the folders, look at running threads etc. Experianced users
certainly will be able to reprogram the whole device.
bingo  - help for dummies?   |2010-02-17 14:00:35
thanks for taking the time to write this up! I was just thinking about doing
this myself and found your post.

I'm not an electrical engineer, just a daring
DIY kinda guy. Can you help describe what the connector is? The Farnell site
here in Sweden has THOUSANDS of connectors and I don't know how to begin to find
it!

NTC... is that a cap?
admin   |2010-02-28 19:42:49
Hey Bingo, do you have additional information on these topics?

Since I have
been asked a few times about the connectors, I hav now added links to Farnell
with some suggestions. The NTC (a temperature dependent resistor) got a link as
well.
bingo   |2010-02-18 17:15:30
thanks, bro. That helps alot!

I won't be using a USB connection so I just need
to connect the NCT resistor between pins 7 and 9 and 9 is also where I connect
the negative side of the battery pack, which is wired in series. Positive of
battery array goes to pin 1.

Is that correct?

pins 3 and 5.... battery tap? I
guess I don't need anything connected there.
admin   |2010-02-28 19:42:38
Correct!

I don't know, wheather the voltage on the taps are evaluated or not.
I connected the + terminal of battery 3 (nominal 3.6V) to pin 5, and the +
terminal of battery 7 (nom. 7*1.2V) to pin 3. But as I said, maybe this is not
neccessary.
danmcb  - unknown pins   |2010-02-25 16:46:24
nice work.

I am guessing that the designers allowed for connecting an external
digital device (maybe for diagnostics/repair) to the 10 pin, so maybe that is
what pins 4 and 2 do. They look like the kind of values that might be used to
enable an external device (the 10k pull down) or to reset it (the CR network
pull up, which would reset an external uP some milliseconds after power
up).

greetings

Daniel
Dingsdada   |2010-02-28 12:26:48
Ich habe einen Akkupack mit 10 Sanyo 2700mAh nach der Anleitung zusammengebaut.
Der Akku funktioniert tadellos und auch sehr lange (ca. 9h).
Nur leider läd das
Radio ständig - auch dann wenn der Akku voll sein sollte.
Im Power-Menü zeigt
er auch ne Spannung von fast 15V an (für Akkus super). Beim Laden macht er nur
ne Pause zum Abkühlen des Akkus (bei ca. 45°C).
Auch scheint die
Ladezustandsanzeige nicht richtig zu funktionieren (Er zeigt nie ganz voll an
und auch schon nach 1h nur noch halb, obwohl er ja noch 8h läuft).
Wer hat
ähnliche Erfahrungen gemacht? Kann es sein, dass die Zwischenabnahmen nach dem
3. und 7. Akku nicht reichen?
achim   |2010-02-28 19:42:03
Hi Dingsdada,

Ich bin mir nicht ganz sicher, wie die SB erkennt, ob der Akku
voll ist. Aber ich denke es ahndelt sich um eine delta U Abschaltung, bei der
ein Ladeende durch eine trotz weiteren Ladens abnehmende Akkuspannung erkannt
wird. Das ist beim Lade von NiMH Zellen Standart, und führt eine Erwärmung der
Zellen mit sich. Ich habe gerade geschaut, meine Zellen werden maximal 47°
warm. Zugegeben warm, aber es gibt in dem engen Schacht auch keine Kühlung
durch Konvektion. Zu den Abgriffen: Ein User hat vorgeschlagen 220 Ohm
Widerstände in die Leitungen zu schleifen, um in Kurzschlußfall den Strom zu
begrenzen. Persönlich denke ich, dass die Spannungen der Abgriffe garnicht
verwendet werden.
Dingsdada   |2010-02-28 21:09:25
Ich hoffe, dass bald jemand einen Originalakku durchmessen kann.
Dann wird sich
einiges klären.
Die 45°C finde ich für mich zu hoch und zu riskant. Hab den
Akku mal vorsorehalber raus.
Dingsdada   |2010-03-04 15:52:34
habe soeben meinen radio geschrottet, weil ich den stecker vom akkupack
falschrum reingesteckt hab. :( :( :( :(
warum bauen die keine diode zum
schutz ein :?:
da auch übers netzteil nichts mehr funktioniert, gehe ich davon
aus, dass man da nix mehr reparieren kann...
maniac_on_moon   |2011-01-05 17:32:08
Hallo Dingsda,

bin ein Leidensgenosse, kein Bild, kein Ton.
Was genau hast Du
damals gemacht?

Danke und Gruß
maniac_on_moon
achim   |2010-03-05 10:54:37
Das tut mir leid, es klingt echt nicht gut: Du hast die 12V an den 3,3V Ausgang
angeschlossen. Pin #2 hat warscheinlich Dioden nach Vdd und Vss, die in dem Fall
Strom von GND nach Vss fließen lassen. Warscheinlich ist da nichts mehr zu
machen.
Wagst du einen Reparaturversuch? Falls nein, kann ich dir anbieten mal
einen Blick rein zu werfen.
Dingsdada   |2010-03-05 20:35:15
Ich hab das Gerät schon mal geöffntet.
Alles kleinste SMD Bauteile. Die
Leiterbahnen zu suchen ist schon schwierig (zumindest keine Zwischenlage).
Rein
optisch sieht man da natürlich keinen Defekt.
Was mich wundert, ist, dass das
Radio auch übers Netzteil nicht mehr geht. Da scheints ein wichtiges Bauteil
(oder mehr) geshrottet zu haben. Ich weis halt auch nicht, was ich nachmessen
und überprüfen könnte. Man bräuchte halt Schaltpläne...
Danke für das
Angebot reinzuschauen. Ich denke da ist wirklich nichts mehr zu machen.
Dingsdada   |2010-03-07 14:15:25
Es läuft wieder!
Ich bin fassungslos. Nachdem ich jetzt alle möglichen
Leiterbahnen und Bauteile durchgemessen hab, startete es wieder.
Oh mann - das
war mir eine Lehre.
Purn0   |2010-05-22 13:07:11
What did you do to make it run again? I also inserted the connector the wrong
way around :(
Now, with the adapter plugged in, the PCB behind the display
becomes quite hot. If I let it cool down, it tries to startup, showing the
Loitech logo, but that's it! :s
Does anyone have a clue how to fix my Radio?
:dry:
auenkind  - Danke!   |2010-04-10 21:20:37
danke für die ausführlichen infos!

Hab das gerade eben zusammengelötet und
es funktioniert tadellos.

Jetzt bin ich gespannt ob das mit dem ladestatus
alles richtig klappt oder ob mir gleich das akkupack explodiert :X Ich werde
berichten.
mrMuppet   |2010-09-06 16:14:29
Ich habe auch vor, mir einen solchen Akku zu bauen, aber ich habe leider nur
sehr geringe Elektrotechnik-kenntnisse. Löten ist noch soweit ok, aber ich bin
mir nicht sicher, wie und wo ich diesen Temperatursensor anlöte, und auch wie
ich am besten die Zellen verbinde, ist mir nicht richtig klar.
Vielleicht
kannst du mir noch mal ein richtiges Blockschaltbild von deinem Akku irgendwo
hochladen.

Ich würde jetzt einfach mit einem Kabel die Zellen in reihe
aneinander löten, dann zwischen die 3. und 4. Zelle und zwischen der 7.und
8.-Zelle die Pins 3 und 5 anschliessen. Ansonsten vorne den Pluspol an Pin 1 und
den Minuspol der Zellen an Pin 9.
Ist das so alles richtig? Wie funktioniert
dann dabei die Temperaturmessung? Welche Kabeldurchmesser sollte ich verwenden?
Was ist sonst noch zu beachten?
jf2020  - Works perfect   |2010-12-17 00:26:05
Just wanted to say thank you. Works perfectly. I had a small doubt about the
battery taps but if you keep it logical it's fine: so you should have
GND- 10K
- 4V - 9V - 13V from pin 9 to pin 1.
ramon3000  - USB charging for iPhone   |2011-09-14 23:05:38
I wonder if the charge function of the SB can be used to charge my iPhone over
night, e.g. by using a power regulator to 5 volt?
achim   |2011-09-17 04:18:25
The simple answer is No.
At least there is no easy way of doing so since the SB
checks wether the output voltage is within a certain range. If no battery is
connected, the SB at first outputs a voltage, but stops after it found that not
battery is attached. So a simple 5V regulator is not enough, you will need to
model the whole battery pack.
However you might want to try the 3.3V output and
use a step-up converter to bring it to 5V. But I have no clue how much current
can be drawn from this pin. Experiments are at your risk.
Only registered users can write comments!

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."