Ford car 6000cd radio hack

Have you ever wanted to just plug your phone / audio device straight into a car radio. Here are the details to connect a 2.5mm audio jack or Bluetooth receiver into a standard car radio. The car is a Ford focus 2003 the radio model is a 6000cd. The pictures below show the solder points. there are 4 points that represent each speaker. So if you had a quadraphonic input source you could have it control each speaker individually. However, I am using a stereo Bluetooth output device so I paired red and white and black and red (thicker) together.

There are 4 connectors solder point inside the radio that will amplify a standard line signal.

Viceroy Lathe details. T.D.S 1 S.C.L

Imperial gearing thread chart.
Metric gearing thread chart.

Here is a gearing program that runs on Linux (wine) or Windows that can be used to deduce other gear combinations. Note that the 127/100 compound gear is not used. This magical gear is what makes the lathe exactly metric. The lathe, like most, has an 8 TPI imperial lead screw. The 127/100 effectively allows the imperial lead screw to have a 100 metric divisions. This is because 1 inch is equal to 25.4 mm and therefore 50 inches is exactly 127 centimeters. Therefore, 254 / 2 is 127 and 127 is prime. Which means its not possible to get a smaller gear that will divide exactly.

lead screwinchesmmequivalent teeth
on theoretical
compound gear

As you can see the table above lists theoretical gears with impractical numbers of teeth. This is made practical by another compound gear the 72 / 18 which is a ratio of a 1 / 4. 12.7mm / 508 is 0.25 which provides the metric basis to work with. The other gears provide ratios of on this.

This is a link to an online gear calculator.

Solar Evacuated Tube Collector (ETC) technology

Over the weekend we have almost perfect sun shine. So I collected some data on a 20 Tube solar collector. Here are the results.

Temp inTemp outdifference

The pump rate was at 6 liters per minute (0.1 liters second). So give this its possible to work out how much of the suns energy was being captured. We just need to know one more thing. The specific heat capacity of water. Which is 4.2 Kj / Kg / degree C. That is 4.2 kilo Jules per kilogram per degree C.

So the calculation turns out to be.

Total Energy per second = (Specific heat capacity of water) x (Liters per second) x (Temperature difference)

1.68 kW = 4.2 * 0.1 * 4

Microwave repair

It turns out that a microwave can be easily fixed. The symptoms are luke-warm food.

Here from the image above you can see the cracks in the magnets. These develop because the heating and cooling of them over time fatigue the fragile compound they are made from. I therefore, bought a new Magnetron (love that word) and plugged it in. It has now been working for over a year without issue.

Quad copter designed for flight longevity

The specification of the quad are as follows.

Load: 10.64 C Voltage: 14.28 V Rated Voltage: 14.80 V Energy: 62.16 Wh Total Capacity: 4200 mAh Used Capacity: 3570 mAh min. Flight Time: 4.8 min Mixed Flight Time: 16.9 min Hover Flight Time: 32.9 min Weight: 452 g   15.9 oz
 Motor @ Optimum Efficiency Current: 4.68 A Voltage: 14.55 V Revolutions*: 4886 rpm electric Power: 68.1 W mech. Power: 59.3 W Efficiency: 87.0 %  Motor @ Maximum Current: 11.18 A Voltage: 14.21 V Revolutions*: 4274 rpm electric Power: 158.9 W mech. Power: 129.1 W Power-Weight: 508.3 W/kg   230.6 W/lb Efficiency: 81.2 % est. Temperature: 43 °C   109 °F  
Wattmeter readings Current: 44.72 A Voltage: 14.28 V Power: 638.6 W
 Motor @ Hover Current: 1.63 A Voltage: 14.71 V Revolutions*: 2027 rpm Throttle (log): 26 % Throttle (linear): 44 % electric Power: 23.9 W mech. Power: 19.4 W Power-Weight: 77.1 W/kg   35 W/lb Efficiency: 81.2 % est. Temperature: 28 °C   82 °F specific Thrust: 13.05 g/W   0.46 oz/W  Total Drive Drive Weight: 1069 g   37.7 oz Thrust-Weight: 3.5 : 1 Current @ Hover: 6.51 A P(in) @ Hover: 96.3 W P(out) @ Hover: 77.8 W Efficiency @ Hover: 80.7 % Current @ max: 44.70 A P(in) @ max: 661.6 W P(out) @ max: 516.2 W Efficiency @ max: 78.0 %  Multicopter All-up Weight: 1250 g   44.1 oz add. Payload: 2541 g   89.6 oz max Tilt: 71 ° max. Speed: 40 km/h   24.8 mph est. rate of climb: 5.0 m/s   984 ft/min Total Disc Area: 58.58 dm² 907.99 in² with Rotor fail:

RCTimer motors 5010 motors 360

17″ Carbon fiber propellers blades.

Carbon fiber frame

Here is the eCalc link to an online calculator that can be used to approximate the build and estimate its flight capabilities.

XOR More than just a logic gate

I discovered an interesting thing about xor today. It can be used to encrypt data. Depending on how its used, it can be part of the strongest theoretically unbreakable encryption or the weakest.

The first example, where it is the strongest, is when it is used in a “one time pad”. A one time pad is a mechanism for encrypting data. Specifically where the Key data is the same size as the data that you want to send. This is often called the “plain text”. So the three ingredients are the

  1. “exclusive or”
  2. Random data.
  3. The useful data one wants to send.

To represent 2 and 3 I have two images.


The image above is the Key.png this is our random data.


The file above is our data we want to encrypt and send.


XORHelloKey          convert Hello.png Key.png -fx “((255-u)&v)|(u&(255-v))” XORHelloKey.png

The image above is the encrypted version of our data. This was generated by xor’ing the message with our random data. It looks random, I hear you say, and you’d be correct. In fact very correct. You are looking at the “holy grail” of encryption. This is the starting point of where all encryption begins. This is the unbreakable cipher. This is because we have used 100% random data to encrypt it. Ok, so why don’t all systems use this and why does computer code cracking even exist. Well, there is one “huge” downside to this method. You would have to exchange the Key secretly with someone you wanted to send the message to. Needless to say this method is not used today to support https transfers.


Ok whats next? Suppose you could transfer tones of random key data secretly between you and a friend. You could communicate secretly with unbreakable encryption. You could until you run out of secret random data, that is, using this xor method. For if you were to recycle that data just once then all hell breaks lose. The image above is the second message I want to send and the image below is the encrypted xor’d version of it. Using the same key as above.

XORWorldKey        convert World.png Key.png -fx “((255-u)&v)|(u&(255-v))” XORWorldKey.png

Great looks random enough and it is. However, the fact that the same key has been used twice,  means that when they are xor’d together then the image below is produced.

XORORIG    convert XORHelloKey.png XORWorldKey.png -fx “((255-u)&v)|(u&(255-v))” XORORIG.png

And that is the result. It is like looking at a negative. However quite readable. If your on a Linux box you can easily, replay this for yourself using the commands and downloading the image files. Using image magic its possible to “xor” images on the command line. Enjoy.



Use one PWM signal channel to switch onboard FPV cameras and switch on and off recording.

This Arduino sketch will allow two buttons on an er9x radio control radio transmitter to be multiplexed into turning on and off any predefined state of pins on the Arduino. I used it to control recording, on and off, of the raspberry pi. This was allocated to one of the switches and the other to toggle around 4 cameras. This could be easily extended to more cameras though. The pins that are used can be wired up to a solid state analogue switch. such as,


The code basically moves a walking bit from one pin to another enabling the CVBS signal from one camera signal at a time, to switch on and send the analogue CVBS signal to the onboard TV signal transmitter. This will then send the signal back to your receiver on the ground, where you can see a TV signal.

unsigned long duration;

int pin=A0;//This pin receives the signal from the receiver which is a 5v PWM signal
int ledPin = 13;//led to indicate recording.
int rec=0;//recored pin enable / disable

The three ranges below create four zones. That is given the PWM signal can exceed the LOW_RANGE and HIGH_RANGE. These have been defined as constants as all radios and calibrations are different and you will need to tune yours. I have found the pulse width is stable enough to stay within these reliably with space for more in future. I have two switches on the radio transmitter. One is a toggle switch and one is a binary 2 state switch. I use the toggle switch to switch from camera to camera and the other to switch record on and off. When recording is enabled the width of the signal stays within zone 2 and 3 and when it is disabled zone 1 and 4. Then if there is a zone transition between 1 and 2 in record mode this will toggle the camera to the next and so on.
//zone 1
const int LOW_RANGE   =1350;
//zone 2
const int MIDDLE_RANGE=1850;
//zone 3
const int HIGH_RANGE  =2350;
//zone 4

int chanTog=1;
void togChan() {//permits 4 states 0,1,2,3 then loops back to 0
if (chanTog > 1){
chanTog = 0;
} else {


void setup()
pinMode(ledPin,OUTPUT);//recording light only
pinMode(12,OUTPUT);//recording actual
//digital D7 needs to be low for ground.


}//close setup

void loop()
duration = pulseIn(pin, HIGH);

//Debugging serial

//Camera switcher
 if ( chanTog == 3) {//These high and low states can be set arbitrarily.
 if ( chanTog == 2) {
 if ( chanTog == 1) {
 if ( chanTog == 0) {

 /*  digitalWrite(2,HIGH);


 if (duration >  MIDDLE_RANGE) { //enable record
   if( duration > HIGH_RANGE ) { //channel change
   delay(300);//debouncing noise delay. ms
 } else {

   if(duration > LOW_RANGE ) {

} //close loop

Roland dg dxy-1300 firmware exploration

I have extracted the ROM images from the two 27C512 chips inside the DXY-1300. I then passed them though a disassembler. This produced the asm files respectively below.

RolandDG_R15209223_LH53140H_8949E is the more interesting because it contains z80 code that starts at 0100h.

The asm files have beep passed as all code. However they need to be separated into data and code. As there is HPGL data starting around E000h in the R15209223 file and likely numerous other sections. This HPGL is the test image that is drawn when the device is powered on holding down the enter key.

boot sequence log

The goal for me is to use my Z80 ICE debugger from Tauntek to analyze the memory until its booted.

An objective is to change and find how the pen speed works. As I have a laser burner I want to mount on it.

0100h is the default place the z80 jumps to for execution and called the ORG. I also expect Ill be able to use the boot test image at location “000e0e0” to print out back engineering debug info.





I am waiting until I receive some new 27512 chips in the post as it appears the originals in the plotter are ROM or in some way not writable by my EEPROM programmer lt866cs.

here Is a simple analysis of the most used sub routine calls within the code. I believe it identifies the main execution loop.

FPV in stanford-le-hope


I woke early today to test video recording with the Raspberry pi. Using the camera module. Here is the video below. It is quite shaky but it was also a bit windy. I would have liked also to use a gimbal to position the camera. I intend to do this using the two extra channels on the transmitter.