r/Defcon • u/ThingPuzzleheaded682 • 17d ago
How to prevent Bluetooth connection severing?
At DEFCON, I used my power assist wheelchair to get around. When i was in the LVCC, mainly the villages in hall W1/W2, the connection between the motor and controller kept getting disconnected due to the sheer amount of electronic noise in the building. I talked to both the RF and IoT guys if they had any ideas on how to stop this from happening and they said no.
The motor on the wheelchair is the Alber SMOOV One O10. I could not find a lot of documentation on it because either I got a 404 error or the documentation was in German because it’s a German company.
Idk what to do, so I turned to the smartest people I know. If you have any ideas please let me know. Thanks.
42
u/ferretguy531 17d ago
Electrical Engineer here who designs medical devices, reach out to your manufacturer to ask about a wired connection alternative.
There is unlikely to be something easy you can do and your manufacturer is best positioned to help.
10
u/nastea2 17d ago
Man I can't even imagine the difficulty with a wheelchair, but they were hammering my diabetes equipment. I had to go n outside to get proper care.
1
u/ThingPuzzleheaded682 16d ago
That’s some serious stuff, you should tell the organizers about that
8
u/SmackCrappy 17d ago
I can think of two things. Ask the manufacturer for a wired connection in the future model. Seems like a critical item like a throttle control or steering should be wired directly to the motor.
Second, you could make some type of Sonic tube and faraday cage arrangement between the sender and receiver. I'm assuming that would be as impractical as asking the vendor for a direct wire option depending on where the sender and receiver are located in the wheelchair. The tube would need to be wide enough for the signals propagate.
4
u/mammongram6969 16d ago edited 16d ago
The SMOOV uses a microchip BM78 bluetooth module to send throttle commands from the armrest dial to the motor on the axle. that's on the 2.4 GHz spectrum. That has a few different failure points:
- weak signal - bluetooth module transmitting at +1.5dBm to save battery your typical wifi router is shouting at +20/+30 dBm
- spectrum saturation - all the things taking up all the spectrum, so even the SMOOV's onboard bluetooth's channel-hopping technique can't escape the noise
- biological attenuation (a.k.a. the meatbag effect) - bodies are large bags of water, and water blocks 2.4 GHz signals, so so the direct line-of-sight between the armrest controller and a motor under the seat may be passing through your meatbag and attenuating the signal
- multipath - the LVCC is a giant reflective box with signals bouncing everywhere, amplifying the problem
possible solutions:
- move the meatbag - move the control dial away from the armrest so it has actual line of sight to the motor and doesn't pass through a "bag of water"
- build a directional waveguide - use copper foil tape inside of a dial mount, and then use industrial EMI-absorbing material (3M makes this stuff) on the outside. Focuses the weak Bluetooth signal like a beam, so you can point it straight at the motor.
- ferrite chokes - the metal wheelchair frame might act as an antenna that picks up ambient noise and pumps it into your electronics. if you put high-frequency snap-on ferrite cores onto any exposed cables, it can choke/reduce external interference.
the nuclear options:
- hack the firmware. you can use serial to connect to the BM78 module inside the controller, boot it into EEPROM configuration mode, and modify how the Bluetooth signal is sent. if you set LE Connection Interval to be very tiny (10-20ms), and set the receiver latency very low, it will make the transmitter work more like a machine gun than a series of widely-spaced polite requests. (will drain the battery faster, but that's a much easier problem to solve.)
- hard-wire a UART bypass (requires micro-soldering and will probably void your warranty, so maybe talk to tech support before you go this route?). USB-C on the SMOOV is for power only, no serial control. so you need to do some soldering to tap into the 3.3V UART TX/RX traces coming off the main microcontrollers (tap in between the microcontroller and the bluebooth chip). route those 3.3v wires into a transciever chip (like the RS485, which converts UART signals into differential signals that can be transmitted over a cable) to convert the signal. run a shielded cable (standard cat6 will work) between the transciever on the dial and the transciever on the motor. (ground the outer braided shield on one side only to prevent ground loops). This will physically bridge the logic boards and give you the zero-latency/zero-interference solution you're after.
2
u/jonas_vondenberg 17d ago
If you don't have to do for any other reason, go wired.
3
u/ThingPuzzleheaded682 17d ago
Unfortunately that’s not an option with this particular model
5
u/jonas_vondenberg 17d ago
I would still do it. Even by building a bridge. One device stuck to the controller, one to where the Motor controller is and wire it up in between. Smarter ppl might correct me, but you have two issues, one is noise related that makes the connection unstable and malicious bt signals. I believe the first one is predominant and proximity might help a lot in it.
2
u/dankney 17d ago
Translation from German is pretty reliable using Google. You should make sure to read it.
You have two options — stop using wireless, or shielding to prevent interference. If you go the shielding option, you should assume that no signal gets through; no WiFi or cellular, or whatever. If all the devices work without external connections, it’s a viable route.
2
u/Spectrig 17d ago
Based on the title, shielding is not an option. It will prevent connecting to the Bluetooth controller
1
u/dankney 17d ago
Unless both are within the shield
1
u/Spectrig 17d ago
That would be the biggest pain to actually get working reliably and to know it will be reliable at the con. At that point, just solder in a wire.
1
u/dankney 17d ago
Wired is more complex than that — data is transmitted via different protocols over Bluetooth than wired connections
1
u/Spectrig 17d ago
Well, how do you put both in the shielding if the controller is in front of the user and the motor is behind them?
1
u/Honest-Ant3487 12d ago
Passive repeater. Grab coax, bt antenna on one side, bt antenna on other side, tape both next to TX/RX antennas... Problem solved
1
u/Jebediah378 9d ago
Hey I think I might have helped you with your needing a laptop issue at the circle bar, did you ever find a solution? I want to make sure you get this solved
1
53
u/bbqribsofficial 17d ago
My suggestion is to try to find a wired controller to use as backup, trusting Bluetooth is tough with all the noise and deauth nonsense. Even in a normal environment.
What does the manufacturer say about wired back ups?