TSP #339 - How Did Mark Rober Steal a Car Using a Baby Monitor?! Theory, RF Circuits & Experiments
In this special episode Shahriar presents his collaboration with Mark Rober:
I Stole a Car Using a Baby Monitor
https://www.youtube.com/watch?v=h0EGCnBjTVk
Shahriar helped the engineering team at Mark Rober's studio build an RF repeater that can fool a car's keyless entry & ignition system. Using an old modified baby monitor, Mark's team managed to steal a car! In this video, Shahriar presents the technical theory behind this heist as well as a detailed view of the RF repeater, circuit measurements and a demonstration of bypassing a vehicle's keyless entry system.
This video is organized as follows:
00:00 - Introductions & collaboration with Mark Rober.
01:22 - How does Keyless Entry & Keyless Ignition actually work?
08:50 - A close look inside of a car's key fob.
11:14 - Making & measuring a magnetic loop antenna to capture a car's keyless broadcast.
13:30 - Complete RF & time domain measurements of the key fob & vehicle keyless signals.
16:56 - Why did we use an old baby monitor to steal a car?
18:30 - Detailed teardown & analysis of the baby monitor's transmit/receive modules.
24:51 - Measurements of the baby monitor's transmit/receive modules for fooling a car.
31:27 - Live demonstration of stealing a car using the baby monitor circuits.
33:52 - Conclusions & how to protect yourself against this venerability.
DISCLAIMER: This video is purely for educational purposes. The video purposely omits the design of come critical parts needed to replicate the project in full. The presented system, as shown, cannot bypass a vehicle's keyless entry or ignition at distance. DO NOT ATTEMPT TO REPLICATE THIS PROJECT FOR ANY ILLEGAL ACTIVITIES.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #338 - Measuring Light Spectrum at a Distance! Photo Research PR-670 Teardown & Experiments
In this episode Shahriar takes a look at a new dumpster find! A Photo Research PR-670 SpectraScan has some unique capabilities for measuring light spectrum. In particular, it has an adjustable field of view, as narrow as 0.125 degrees, which allows the spectrometer to ignore the majority of light sources in a scene and only focus on a small visible area. This means it is possible to measure multiple points of a screen or sources of light from far away.
The teardown & theory of operation of the instrument is presented including the spectrometer core which uses a diffraction mirror and linear CCD detector. A few experiments are also conducted which showcase the FOV measurement capability using an array of RGB LEDs. Lastly, the measured spectrum of a mercury discharge lamp is also shown.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #337 - Frequency Counters Can Measure DC Voltage! HP 5245L Voltmeter Plugin Theory & Experiments
In this episode Shahriar explores the capability of some frequency counters to measure DC voltage. While this may seem non-intuitive initially, the video shows how the architecture of the HP 5245L Nixie tube frequency counter can be used to realize an integrating ADC. A particular plug-in module, the 5265A, leverages the Start/Stop counter control to implement an ADC and display the equivalent DC voltage at the plug-in input. The theory of operation as well as the teardown of the plug-in in shown.
The plug-in module unit is zeroed & calibrated initially and then using a Fluke 5720A the performance of the entire system is evaluated. Despite being in storage for decades, the unit is incredibly accurate and precise.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #336 - A Fancy PID Controller! Keithley 2510 TEC Source-Meter Teardown, Repair & Experiments
In this episode Shahriar attempts the repair of a Keithley 2510 TEC Source-Meter. This instrument is capable of delivering up to 60W of power to any TEC in both polarities. Furthermore, the instrument integrates a flexible temperature read-out capability with 4-wire interface. Lastly, combining both capabilities, alongside a fully customizable PID controller, a precise temperature controller can be realized.
This particular unit returns erroneous readouts in all modes: voltage, current, resistance & temperature. The unit is also generating "squeaky" noises which is indicative of a failing DC-DC converter. The block diagram of the unit is examined and the fault is ultimately traced to a damaged opto-isolator in the isolated switching power supply. Several other components are also faulty which are located via thermal camera. The output Class-D / buck converter circuit & block diagram are also examined in details.
Unfortunately, the custom IC at the heart of the multi-slope ADC is also damaged. The IC is de-capped, examined under a microscope, and compared with its predecessor CPLD counterpart. This Keithley component is sourced from an older high-speed power supply. The correct readout is then verified. Several experiments are demonstrated using the PID controller and a custom TEC setup.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #335 - 1-fA Resolution! Keithley 2500 Dual Photodiode Meter Teardown, Repair & Experiments
In this episodes Shahriar repairs a Keithley 2500 Dual Photodiode Meter which does not power up. Teardown of the unit reveals two transformers coupled with two fully independent channels. The unit is able to source voltage in two quadrants as well as measure current down to 1-fA resolution. There is also a separate 5V switching power supply responsible for all digital circuits. This power supply is the reason why the unit does not power up. The fault is quickly traced to a bad switching power supply startup capacitor which is easily corrected.
The unit's voltage source & current measurement performance and operation is verified using a LakeShore M81 SSM system coupled with an SMU-10 module:
https://www.lakeshore.com/products/categories/overview/material-characterization-products/measureready-m81-synchronous-source-measure-system/measureready-m81-synchronous-source-measure-system
The Keithley 2500 is also calibrated using the same LakeShore system. An example of active fiber alignment (primary application for the Keithley 2500) is also demonstrated using a pair of infrared LEDs & detectors.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #334 - How Cold Can We Get? Cryocooler Limits, Thermal Lift & Turbomolecular Vacuum Experiments
In this episode Shahriar experiments with a SunPower CryoTel Mini Cryocooler:
https://www.sunpowerinc.com/products/stirling-cryocoolers/cryotel-cryocoolers/ds-2_1
A three-stage turbomolecular vacuum system is used to reach very low pressures of 10E-6 Torr to provide a suitable environment for the cryocooler. Unfortunately, due to the age of this unit, the maximum applied power is limited to 22W. Despite this, reaching temperatures of -210C is possible with no thermal load. A custom heater element is also used to inject thermal energy into the cold tip and measure the available lift from the engine. A new GUI is also developed to control the cryocooler, measure the cold tip temperature, rejection temperature and applied power as a function of time. This allows several cryocooler modes to be explored.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #333 - Would You Like Your Polarization Scrambled? Stressing Coherent Optical Communication Link
In this episode Shahriar explores the mechanism and reasons for fiber optic polarization scramblers. The video discusses the many fascinating methods for embedding data onto fiber optic links. Amplitude modulation, phase modulation, dual polarization (MIMO), wavelength division multiplexing, & spatial division multiplexing are all discussed. The overall architecture of typical coherent optical communication systems is also discussed.
With the theory of coherent communication in place, we can dive into the importance & application of such a polarization scrambler instrument. We further dive into how the unit works followed by a complete optical test system which characterizes the polarization scrambling capabilities. Lastly, a complete teardown shows the ultrasonic, multi-segment transducers which induce birefringence on the fiber segment and cause polarization scrambling.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #332 - ChatGPT versus Electrical Engineering Graduate-Level Final Exam - Analysis & Experiments
In this episode Shahriar asks an AI LLM to solve problems from the final exam of a metrology & instrumentation course intended for electrical engineering graduate students.
We also do some experiments to verify the theory from one of the questions. Let’s see how well AI can tackle these problems!
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #331 - Fixing with the Flu! Keysight 53230A 15-Digit 20ps Frequency Counter Repair & OSC Upgrade
In this episode Shahriar repairs a Keysight 53230A frequency counter with an unusual problem. The instrument reports OVERLOAD for both high & low thresholds on both Channel 1 & Channel 2 with or without an input signal. With this problem, the instrument also fails self-test.
There is no schematic or even a block diagram for this instrument. But since the unit is equipped with both the Microwave Pulse Measurement as well as the 15GHz Microwave input option (as Channel 3), it is certainly worth repairing. Channel 3 of the instrument is fully functional, which is a good sign for the health of the latter DSP portion of the unit.
Teardown reveals two parallel & identical Channel 1 & Channel 2. The circuits are examined in details and the primary comparators are identified. After some testing, it becomes clear that the comparator thresholds are controlled via some ADI DACs which are maxed out due to inactivity at the output of the comparators. Interestingly, the latch inputs ports of the comparator ICs are also controlled by a different DAC. This is the first part which is in common with both channels. After replacing this DAC, the instrument no longer reports the OVERLOAD error.
The instrument is also upgraded with an OCXO which should bring much better frequency stability. The unit is then calibrated against a Rubidium standard. The microwave pulse measurement is demonstrated first using a R&S SMBV100B Vector Signal Generator & Tektronix MSO-6B Mixed-Domain Oscilloscope. The Keysight 53230A is easily able to measure pulse duration, repetition as well as the carrier frequency. The frequency counter's trend chart, histogram & other advanced DSP functions are also demonstrated.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #330 - How Heavy is an Electron? The Experiment That Changed Physics - Scope Giveaway Results
In this episode Shahriar re-traces history and measures an important characteristics of a fundamental sub-atomic particle: the charge to mass ratio of an electron.
This experiment, first performed in 1897 by J.J. Thomson, changed physics by showing that atoms are indeed made of further sub-atomic particles through the discovery of electrons. We build a setup using a pair of Helmholtz coils, a cold-cathode vacuum tube driven by a multi-kV DC power supply & careful measurements of the beam deflection angle. The theoretical foundation of the experiment is described in details.
The measured e/m ratio is compared with the NIST established number with great agreement. The historical impact of the work of J.J Thomson & Robert Milikan (measuring the charge of an electron) are also presented.
The two winners of the giveaway are:
@nicolasblomstrand2912 (YouTube)
Robert S. (Patreon)
Each will receive a Siglent SDS1104X HD!
https://www.siglentna.com/product/sds1104x-hd/
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #329 - I Bought a Bridge! World's Most Accurate Capacitance Bridge Theory, Teardown & Experiment
In this episode Shahriar dives into the concept of a capacitance bridges. In particular, the Andeen-Hagerling AH2500A Ultra-Precision Capacitance Bridge:
https://www.andeen-hagerling.com
The theory of operation is explained in details alongside a comparison with more traditional LCR meters. A simple replica transformer-based bridge circuit is also used to demonstrate the principle operation using a Zurich-Instruments MFIA lock-in amplifier. The teardown of the unit provides further insight into the engineering design of the instrument.
The capacitance bridge is also used to measure small shifts in a parallel plate capacitor. Furthermore, a complete set of air capacitor standard modules are calibrated & adjusted using the bridge as a standard.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
TSP #328 - I found a Chub! Fluke / Hart Scientific 1529 Chub Standards Thermometer Teardown & Repair
In this episode Shahriar take a look at a broken Chub. These instruments are able to measure PRTs, Thermistors as well as other resistive based thermometers. They can also be quipped with thermocouple reader modules.
This specific instrument has a blown fuse and draws an excessive amount of current. The first problem is a faulty 5V DC/DC converter. Although changing the IC does resolve the 5V power supply problem, it is likely that the failure has also caused excessive voltage to appear across the unit. There is no activity from the microprocessor. After replacing the processor and re-programming the EEPROM, the unit is up and running. A few experiments with various sensors and precision resistors verified the functionality of the instrument.
Please consider supporting The Signal Path:
https://www.TheSignalPath.com/Donate
https://www.Patreon.com/TheSignalPath
Other links:
https://www.TheSignalPath.com
https://www.Twitter.com/TheSignalPath
