narrowing the hop search

Dominic Spill has been kind enough to correspond with me about my recent work on reversing the Bluetooth hopping sequence. He pointed out some interesting ideas he had proposed last May. One essential idea I had overlooked is that 6 bits of clock can be recovered along with the partial address from (almost) any frame. These clock bits can be used to narrow the search space of possible clock values.

In my original analysis, I looked at the hopping algorithm and assumed that an observer is somehow able to accurately measure the intervals between frames captured on one or more channels. I also assumed that the observer has partial knowledge of the master's address, but I did not consider partial knowledge of the master's clock.

How can the observer measure intervals between frames? The method Dominic proposed (and I overlooked) is to decode the 6 bits of the master's clock from each frame. Differences from one frame to the next reveal information about the interval between frames. Unfortunately, the six bits of clock only describe 64 different time slot intervals, yet there is an average of 79 slots between two frames on a single channel. When observing a single channel, a difference of 47 might indicate an interval of 47 slots, but it could also represent an interval of 111 slots (47 + 64). A more direct approach would be to count the number of samples between observed frames. Perhaps the best method would be to combine direct measurement with confirmation by decoded clock values.

No matter how the intervals are determined, the 6 decoded clock bits can be used to narrow the search space. My first simulations included a search through 134217728 possible clock values. Taking advantage of the 6 known clock bits, it is possible to reduce the search space to 2097152 possible values. I ran a new set of simulations to find out how much this helps.

In order to have 95% chance of a unique match, we could observe all 79 channels for 3/8 of a second (30 channel seconds processed). Alternatively, we could observe a single channel for 3/5 of a second (3/5 channel seconds processed).

When narrowing the search space by the 6 known clock bits, the observation time required when observing all 79 channels changes very little, but the time required when observing a single channel changes considerably. This result strengthens support of my conclusion that the most efficient method to reverse the hopping sequence is to monitor a single channel.

reversing the Bluetooth hopping sequence

Monitoring Bluetooth is hard. A Bluetooth piconet (a small network of two or more Bluetooth devices) continually hops through 79 adjacent channels, each 1 MHz wide. The piconet uses one channel at a time, hopping to a new channel 1600 times each second according to a pseudo-random channel sequence based on semi-secret information.

In order to capture all the transmissions of a particular piconet, a receiver must predict and execute the piconet's hopping sequence. (An alternative approach is to capture all 79 channels simultaneously and then throw out the 78 that are unused at any particular time after identifying the channel that is active for a particular time slot. I'm considering this to be too expensive, but it can be done and will become less expensive over time.)

We can only predict the hopping sequence if we know two pieces of information. The first is a portion (the 28 lowest bits) of the piconet master device's numeric address (the "MAC address" or more properly "BD_ADDR"), and the second is the master's clock, a 28 bit integer value that increments 3200 times per second. If we know both the address and the clock at a particular time, then we can correctly predict the hopping sequence forever. We just have to use the hopping algorithm dictated by the Bluetooth specification.

In 2007, Spill and Bittau demonstrated that the necessary portion of the address can be derived from the contents of any single frame. [update: see Thierry Zoller's comment below.] It is easy to capture a frame by listening on a single channel and waiting for the piconet to hop through it. With 79 channels and 1600 hops per second, this doesn't take long. All that we are then missing is the clock.

One way to acquire the clock is to join the piconet. When we successfully join, the master shares its clock with us so that we can follow along from then on. In order to join, we need to know the entire address of the master, not just the lowest 28 bits. Since we already know part of the address, the remaining bits can be guessed fairly easily (see Josh Wright's BNAP BNAP project). Armed with the complete address, we can attempt to join the piconet. This works in a great many cases, even when you might think it shouldn't, but it is possible that we could encounter a master device that will not let us join. It is also possible that we would prefer to monitor passively and do not want to interfere with the piconet in any way.

There is a way to acquire the clock passively by observing another device joining the piconet. Unfortunately, this requires some combination of luck and patience. If we don't have an opportunity to observe a device joining the piconet, this technique doesn't help us.

It is possible to reliably determine the master's clock completely passively, and that is by reversing the hopping sequence. That is, instead of using the hopping algorithm in the forward direction (determining the sequence from the clock), we use it in reverse (determining the clock from the hopping sequence). The hopping sequence repeats every 134217728 steps (28 clock bits minus one bit because it only hops every other clock cycle) with each step calculated from the address and clock. You can think of it as a static sequence based on the address with the clock value indicating the current index or position within the sequence. Using the address, we can pre-calculate the entire sequence. If we then observe a small number of hops taken by the target piconet, we can search through the complete sequence to find the index that matches the observed hops. This index is the clock.

At first, I thought this would be a great application for a high-bandwidth (79 MHz) software radio device. We could capture all 79 channels for a fraction of a second, do a bunch of number crunching to identify target frames and reveal a short segment of the hopping sequence, and then search through the complete sequence to find the clock. Even if we can't decode all 79 channels simultaneously in real time, we can probably do real time decoding of one channel at a time after (slowly) reversing the hopping sequence. Assuming that the pseudo-random hopping sequence is reasonably random, we would only need to observe a few hops in order to have a high probability of locating a unique match within the complete sequence; five hops ought to be enough in most cases.

Unfortunately, the pseudo-random hopping sequence is a long way from being reasonably random. The algorithm does a good job of spreading nearby time slots across a wide range of channels, but it does so with a great deal of repetition in the long run. If we capture all 79 channels for five hops, our chance of finding a unique match in the complete sequence is almost nil. Even after observing fifty consecutive hops we would have less than a 50% chance of success.

To illustrate this, I simulated the results for a large number of cases (with random address and random clock). This graph shows how often an observed sequence segment turned out to be unique for various observation periods. One set of simulations was done assuming a single observed channel, one with eight adjacent channels (randomly selected), and one with all 79 channels. When observing fewer than 79 channels, we miss many of the hops, but we are able to capture a frame each time the piconet hops through one of the observed channels.

It turns out that, in order to have a 95% chance of getting a unique match while observing all 79 channels, we have to capture not five hops, but about 650! This requires an observation period of about four tenths of a second and a great deal of computation. Multiplying the four tenths of a second by the number of channels observed (79), the result is about 32 channel seconds processed. At the other end of the scale, if we only observe a single channel, it takes about 2000 total hops (out of which only about 25 will be captured) to get to a 95% chance of a unique match. It takes almost a second longer of observation, but the number of channel seconds processed is only 1.25.

Adding channels helps quite a bit less than I expected. Regardless of the number of channels observed, the important thing is to capture frames that span a long enough period of time. Since the observation of more channels involves significantly more computation and more expensive hardware, it looks like the best way to reverse the hopping sequence is to listen to a single channel until a unique match is found.

Here is the code I used for the simulations. It includes a fast (I think) implementation of the hopping algorithm. Please let me know if you find any bugs! I'd love to hear from you if you find this interesting or useful.

mystery signal challenge results

Congratulations to Emily Metcalfe for winning the Mystery Signal Challenge I announced at my Black Hat talk! Emily correctly identified the signal as a DECT cordless phone and was awarded a 5-in-1 network admin's cable plus a throwing star lan tap.

software radio at Black Hat and DEFCON

My Black Hat talk, Software Radio and the Future of Wireless Security went very well. Thanks to everyone who showed up. I've posted the final slides, demo code, and mystery signal stuff here.

Also at Black Hat were Olle's Mobitex talk and Kevin and Yoshi's talk on implantable medical devices. The Mobitex presentation was full of technical protocol details and described a method of decoding Mobitex traffic in software using sound card input from a radio receiver (more here). The medical devices talk was less technical but briefly covered wireless attacks on medical devices using the USRP (more here).

At DEFCON, NYCMIKE spoke about software-based decoding of pager networks. This was far less technical than Olle's talk, but it was nice to get a perspective from someone who just likes monitoring/scanning stuff. The canceled talk on MBTA vulnerabilities would have included a bit on using the USRP for everyone's favorite new hobby, attacking Mifare Classic RFID cards. It would have been nice to see their code. Thanks to the EFF for helping out on this one.

In his presentation at DEFCON, Rick pointed out the fact that the ath5k driver can be easily modified to tune wireless cards to a fairly impressive range of licensed bands. He also hinted that the cards might be able to be used as software radio devices for non-802.11 functions. I'm skeptical of this because it appears that ADC and DAC are tightly bound to PHY in the Atheros chipsets, but there are some interesting things like "i/q calibration" and "AR5K_ADDAC_TEST" that might be worth a closer look.

Software radio is certainly exploding in the security community. Maybe I should have called my talk, Software Radio and the Present of Wireless Security.

working into the night

It is getting colder tonight, but we are making good progess and having a great time at the World Ice Art Championships. We've had to abandon our plan A design (and even plan B) due to a variety of problems including gear cutting difficulties and poor ice quality. We had one large gear mysteriously break over night, perhaps due to cracks in the original block. Our block has many cracks this year. I guess this year's ice just isn't that great because we've seen other blocks that are much worse than ours.

We have made some small gears successfully, and we are well on our way toward completing an alternate design. Most of our new tools have performed admirably this year, and we'll continue to use them tomorrow until the horn sounds at 9:00 PM.

and we're off!

The Single Block Classic began at 9:00 this morning, and we are carving our block to bits! We are on camera this year. Check out the web cam for our site throughout the next three days, or stop by for a visit if you are lucky enough to be enjoying the Fairbanks winter. The temperature is currently slightly above 0°F, which is much, much friendlier than last year. As of Tuesday lunch, we are on schedule.

Unfortunately it has been more difficult this year for me to get photos online, but the web cam should fill the gap a bit. Also, Dan is here taking a lot of pictures again, and I'm sure he'll be happy to share some for the blog when we have a little time to devote to the project.

So far we have sliced off a new face on the front end of our block and taken three slabs out from the rear portion. We've also marked axle hole drilling locations on the front face that is quite planar thanks to the chainsaw guide rails that Lars bolted right into the ice. This afternoon I'll be roughing out the gears and flywheel while Lars gets started on the axles. The lathe is just to the right of the web cam view, but we'll see if we can get the camera position adjusted.

blogging from Ice Park

Alas, the computers at Ice Park are not in very good shape, and they fail to handle USB mass storage devices correctly. I was hoping that a little CF/USB adapter would allow me to get photos from my camera to the blog in record time. Oh well.

We have registered and are about to check out the condition of our block. We are site number six. Who is number one?

arrived

Ice madness has descended upon Belfair! It was here long before my arrival as is apparent from the array of new equipment Lars has constructed this winter. We didn't do much on our first night other than show off various gadgets and tools to each other. My Denver friends will be horrified to discover that I spent the night in a bed with an Oakland Raiders blanket. I didn't see it until morning. Honest.

yes, you can get a 25 pound Variac through airport security

I checked my two 49 pound bags and headed for the metal detectors. "What is in here?" the TSA lady asked.

"Oh, you're probably looking at the variable transformer. It is very heavy."

She turned down my offer to help carry the bag to the inspection table - protocol I suppose. "What is this again?"

"A variable transformer, like the AC adapters you plug into the wall, only bigger, and with a knob."

"You wouldn't use something like this in the home, would you?"

"You could, but mostly they are used in more industrial settings for testing electronic equipment and any other time you need fine control over voltage."

"So this thing is high voltage?"

"Only if you plug it into a high voltage source, like that socket over there."

Once I told her that guitarists sometimes use them to adjust the tone of old electric guitar amps, she finally warmed up and decided to let me on my way. Maybe she is a music lover.

flying

After a short night of sleep, I'll be on a plane for Fairbanks. It will be nice to meet up with Dan, Brian, and Tamara (the documentary crew) in Seattle as we all ended up on the same flight to Fairbanks. Here's hoping the TSA doesn't find my gear too interesting. . .

less than one week to go

Although our task list for the next few days is daunting, we are making great progress in our preparations for Ice Art 2008. Lars has finished building a trailer that will help us transport all our equipment and will also provide a relatively warm environment for heat cutting should the weather be extremely cold. He has also been hard at work on drill bits, the slab machine, and various other tools. I started and nearly finished the drill laser guidance system tonight and have a few other projects to finish (not the least of which is packing!) before heading to Fairbanks this Saturday.

The weather in Fairbanks has been unusually warm lately - so much so that Lars has had difficulty testing tools because of temperatures above freezing. It is supposed to cool off this weekend. With any luck, the forecasters will be right and we will have highs in the teens next week.

more bits

Since my last post I've learned that augers with their screws removed are called barefoot augers. They are rare but not unheard of. Since Lars had complained of the screw on a new auger of his that we hope to use, I suggested that we could turn it into a barefoot auger. It turns out that he already had a better idea!

He is fabricating a pilot spade bit that will screw onto the auger's feed screw. I think this is a great idea and can't wait to see if it works. If it doesn't, then we can always resort to hacking off the screw.

auger mangling

Augers have long been used for boring holes through ice, but it is difficult to find an ice auger smaller than 6 inches in diameter. There are plenty of smaller augers for wood boring, but they top out at around 1.5 inches. Even so, we plan to use at least one of these.

Wood augers have a screw tip designed to pull the bit into the wood. Unfortunately this doesn't work at all in ice, so I did some experiments today to see if a wood auger could be modified to work in ice.

I started with an old 3/4 inch auger that I picked up at a thrift store. It wasn't completely useless in ice, but I'd rate its performance at only about 40%. Not having an old brace, the first thing I had to do was hack off the square taper shank. Then I ground off the screw tip and what I'll call wings on the outer edge. I'd say that at best it only performed at about 5% in this condition. It was pretty bad.

I decided to compare it to a 6 inch hand cranked ice auger (for fishing) that I picked up on ebay a few months ago. I was worried about the flat center of my modified auger; it seemed that flat section was just pushing in vain against the ice. The 6 inch ice auger has a fairly small gap between cutting blades at the center, so I decided to try to cut a gap in mine.

I cut a groove across the center and tried it again, but I didn't notice any improvement. In hindsight, I think that these first couple of modifications may have resulted in a curvature that cause the cutting edges to not be fully in contact with the ice. I didn't notice that at the time, but I decided to try a more aggressive modification to get the cutting edges closer to the center point.

I removed quite a bit of material from the end of the bit and completely reshaped the cutting edges to look similar to the 6 inch ice auger. This time the results were excellent. I'd rate the performance at 80%, and the only thing keeping me from calling it 100% was that it was a little hard to get started in a precise spot.

I think this is a worthwhile modification, but the loss of control when starting a new hole is a concern. I think the ideal shape would have a small triangular spade tip instead of a larger screw tip.

hot wire didn't make the cut

Unfortunately the hot wire cutter I have spent so much time on isn't going to make the trip to Fairbanks this year. Even though the project has been somewhat successful, we decided that the method isn't fast enough to use for this year's sculpture. So far my fastest cuts with the device have been at a rate of about three inches per minute.

The only task we had in mind for the hot wire cutter this year was cutting discs (the flywheel and gear blanks). At three inches per minute it would take well over two hours to cut all the discs we require. Instead of using the hot wire cutter, we will use the table mounted chainsaw for this task.

We haven't completely given up on heat cutting. On the contrary, we intend to use hot wire gear cutters similar to last year's model but sturdier. The power supply that I have partially constructed for the single wire cutter will be put to use for this purpose. I expect that future improvements will make the single wire cutter and/or the boiler useful tools one day.

simulations

The only thing that will prevent our sculpture from running for a very long time is friction. Without friction, the momentum of the flywheel would lift the half gear all the way up to the full starting position repeatedly. Making a working model of the machine out of some other materials won't help us figure out how long the finished product will run (or if it will oscillate at all) because the friction is highly dependent on the materials and scale of the piece. We've turned instead to computer simulations.

I had a perl script from two years ago that I used to calculate the moment of inertia of the clock's gear train, so I started with that and added a simulation loop. Modeling friction was the hardest part, but I think I have a reasonable approximation of friction's effect at this point. It accounts for the weight of the various components as well as the gear separating forces (spur gears tend to push away from each other as one drives the next), but my values for the coefficient of friction at various speeds are somewhat questionable.

Assuming the simulation is in the ballpark, it has helped us to optimize our design for maximum running time. Things that improve running time include:

• larger half gear radius
• thicker half gear
• larger flywheel radius
• thinner flywheel (to a point)
• higher gear ratio
• thinner stage 2 gears

With a few modifications based on these findings, our simulated running time has increased from 45 to 105 seconds.

fat wire

I was excited to find the 16 gauge nichrome in my mailbox yesterday and quickly put it to use. It seems to do the trick! After my first test cut I thought my multi-meter was starting to smoke, but it turned out to be a wire draped across the multi-meter. I was overloading the wire going from the power supply to the nichrome. I should have thought of that! I quickly replaced it with some 14 gauge copper, but even that got warmer than I would like. I'll have to get some lower gauge connecting wire soon.

Even though the new nichrome worked well at high power and showed no signs of failure, cutting through ice wasn't exactly speedy. It should go a little faster once I reduce the connecting wire voltage drop with fatter wire. I'll also soon have air cooling for the power supply which should allow for close to 2000 Watts.

it's a good thing we're normal

One of the ways we hope to improve this year is by sculpting subtractively rather than additively; instead of assembling a sculpture entirely out of individual parts that we have produced, we'll carve most of it out of a solid block. There will be parts, like gears and axles, that we will have to add, but the bulk of the piece will be carved, not assembled. Our hope is that this technique will allow us to create a sculpture faster, with improved aesthetic value, and with better overall use of ice. The technique does come with drawbacks, however, the principle one being the difficulty of boring holes for axles.

This problem was one of the major reasons we decided to use the additive method in the past. We thought that the best way to drill the fairly large (3.5 inches usually) holes for axles would be to use a drill press on individual frame segments and then assemble those pieces together. The drill press does a good job of boring very straight holes, even with homemade bits, perfectly perpendicular to a slab of ice. Then it is simply a matter of aligning those slabs correctly when assembling the frame. Unfortunately it has turned out to be slower and more difficult than we originally anticipated to execute this process. In order for the frame pieces to be assembled with perfect alignment, many pieces must be produced, each piece must be very precisely shaped (more precisely than can be done with a chainsaw), and a lot of watergluing must be done.

Turning to the subtractive method brings back the problem we at first sought to avoid: How do you bore 3.5 inch holes through two feet (or even more) of solid ice while keeping the hole perfectly straight, level, and parallel to an adjacent hole? Some weeks back, I was discussing the problem with Dan, and he had an intriguing suggestion: lasers! By mounting one or more lasers on a hand drill and marking a target on the far side of the block of ice, it should be possible to keep the drill precisely on the correct path by aiming the lasers at the target. I loved the idea because it is simple and takes advantage of the transparency of the medium. It is certainly worth trying as it is much easier than constructing some sort of deep-boring, horizontal drill press.

This is the technique that Lars and I intend to use to bore axle holes in the frame of our sculpture this year. Fortunately, Lars was smart enough to point out that the method can only be used at the precise angle perpendicular, or normal, to the ice surface where the drilling begins; otherwise we would have to account for refraction of the laser beam when placing the target on the far side of the ice!

design

Lars and I plan to build a sort of perpetual motion machine for the 2008 World Ice Art Championships. This is a simplified diagram of the mechanism, notably missing gear teeth. The big red thing is a heavy half gear that powers the sculpture. It is shown here nearly at the starting position. The weight of the half gear pulls it downward, turning the little red pinion as it goes. The red pinion is connected to the large yellow gear which turns the yellow pinion. The yellow pinion is connected to the large green flywheel.

Once the half gear completes a quarter turn to the bottom position, the flywheel should have enough angular momentum to keep the half gear moving until it slows to a stop opposite from its starting position. With any luck, the half gear will be high enough that gravity will pull it back toward the center position, repeating the whole process in reverse. Our goal is to produce oscillatory motion that lasts for as long as possible, perhaps a few minutes.

snap

Good news: I was right about transformer winding selection. I switched to the heavy gauge secondary winding, and all is well. I can now crank the thing up as high as my household circuit breaker allows.

Bad news: As I feared might happen, the cutting wire became brittle at high temperature and snapped during my first test at a higher voltage!

In anticipation of this problem, I had prepared a quarter inch copper tube with a length of nichrome wire running through it, electrically insulated by a high temperature fiberglass sleeve. The idea, suggested by Lars, is that the tube, not the wire, bears the brunt of the ice pushing against it (stainless steel would be ideal, but copper was fine for testing). This certainly allowed the wire to get very hot; I could see it glowing brightly right through the fiberglass sleeve! It even left a couple of black marks on the sleeve. Unfortunately, it didn't produce enough heat to cut at a useful speed due to the wide swath of ice that must be melted for the tube to pass through. Maybe a narrower tube could be used, but I haven't found a smaller high temperature insulator to keep the current running through the wire and not the tube.

Then I tried a new length of nichrome in the original setup to see how it works at lower voltage. I adjusted the tension somewhat lower too. I was able to cut at a reasonable speed (at least two inches per minute) with 14V across eight inches of wire, but I had another breakage when I turned it up to 16V. It cuts more slowly than I had hoped, but it is certainly usable.

Two inches per minute may sound quite slow, but I believe it is faster than the boiler we used last year with some success. The benefit of this technique is the ability to make precise, intricate cuts that are perfectly perpendicular (or at some consistent angle) to a surface of the workpiece. For many mechanical parts this benefit could outweigh the slow cutting speed.

Next I would like to try a lower gauge cutting wire which should fail at a higher power level. My guess at this point is that the tension doesn't matter much (the second break happened under very little tension) but that the breakage occurs due to the wire becoming so brittle at high temperature that very little physical stress causes it to break. The failures tend to be located at the hottest part of the wire, between the ice and the alligator clips that deliver current. I'd also like to try to minimize that gap, but it can't be completely eliminated.

wooden bicycle

I am in awe. This guy built a working bicycle entirely out of wood.

smoking transformers

Having just received a new transformer in the mail, I was able to piece together a first attempt at a new power supply tonight. This allowed me to properly test the hot wire cutter for the first time. I am happy to report that it sliced through a block of ice quite easily. I had it up to about half of (theoretical) maximum power, and it cut as fast or faster than any hot wire I have used to date. This was the first time I have ever seen 19 gauge nichrome get red hot. I was afraid that it might become too brittle when hot and snap under the tension, but it remained intact. Unfortunately I had to cut my test short because the new transformer started making ominous crackling noises and then started to smoke a little bit!

The unit is rated for 2000 Watts, but, in hindsight, I think that rating is only for one of its secondary windings. It has a primary winding of heavy gauge wire rated at 100V, a secondary winding of the same wire at 95V, and various lower voltage secondaries from 15V to 30V. I plugged in a variac with its variable tap connected to the new transformer's primary winding and attempted to use one of the lower voltage taps to power the hot wire at 0-30V. It started to crackle at about one quarter power and smoke at half.

I think my problem was that the winding I used does not have thick enough wire for my power level. Instead of using the new transformer to step down from high to low voltage, I'll just use a lower voltage tap on the variac and use the 95/100 tap on the new transformer for isolation.

hot wire cutter

I got the new hot wire ice cutter mostly finished and in testable condition the other night. Unfortunately I am still missing one part needed for the power supply, but I was able to perform an initial test with a much weaker power supply from last year. Since the new device uses a very short length of low gauge wire (compared to the gear cutters of last year), it draws much more current. I hope to take advantage of this with a new power supply in the neighborhood of 1500 Watts for faster cutting, but for now I have to use my old power supply at very low voltage to prevent overheating of the transformer. It works, very slowly.

The device is made mostly of plywood with a 24 inch square piece of HDPE for the work surface, 19 AWG nichrome for the cutting wire, and assorted hardware. It should support the wire with enough tension to keep it reasonably straight while ice is pushed against it. So far I've cranked it up to 20 pounds of tension, but I think it will handle twice that. The cutting angle is adjustable to 45 degrees to either side. I still need to add an adjustable fence and rulers for the fence position and cutting angle.

my plastic isn't very plastic

My sheet of UHMW was nicely planar, but it had small grooves in concentric arcs left by some sawing or milling covering both sides. I thought it would be a good idea to make the working surface as smooth as possible, so I tried sanding it. No dice! One of the properties of UHMW that makes it attractive for its many uses is extreme abrasion resistance - it out-wears steel 10 to 1! It should be planable, but I only have a mini hand plane, so that didn't work very well. Then I thought I might be able to smooth out the grooves with a propane torch, like finishing ice. Bad idea! The process did work somewhat as intended, but it also slightly discolored the surface and, worse, caused major warpage! It turns out that UHMW has some pretty strong internal stresses originating from uneven cooling at production, and those stresses result in warping when it is heated near the melting point.

I tried to flatten the piece by heating the whole thing up and then letting it cool slowly while being held flat by heavy things. Unfortunately, it didn't work. In hindsight, I should have just left the grooves. I doubt that they would have been much of a problem in the first place.

I decided that having a flat piece of plastic was important enough to warrant buying a replacement, so I took another trip to Colorado Plastic Products to rummage through the scrap bins. I couldn't find any UHMW scraps of the correct size this time, so I settled for some HDPE. I'm pretty sure it will work just as well for my application, and it is quite inexpensive.

make your own working paper clock

The very cool Automata / Automaton Blog points out a neat book, Make Your Own Working Paper Clock. "Cut this book into 160 pieces, glue them together, and have a paper clock operated by weights that keeps perfect time and can be rewound and regulated."

complexity

One of our guiding principles this year is simplicity. We want to make a working mechanical ice sculpture, but we want the design to be simple enough that we can actually build it without compromising the design during construction. One way to gauge complexity is by counting mechanical parts such as axles and gears (I'm not counting bushings).

In our first year, we attempted to build a mechanical ice sculpture with 25 mechanical parts (9 independently moving assemblies). We failed but managed to assemble 6 mechanical parts (2 independently moving) almost functionally. In our second year, we attempted 22 mechanical parts (11 independently moving) and succeeded in building a functional mechanical sculpture of 5 mechanical parts (2 independently moving).

This year we hope to construct a sculpture consisting of only 8 mechanical parts (3 independently moving). I think this is an attainable goal. With the experience we now have under our belts, I believe we can produce a few more working parts than last year.

oops

Although Lars and I are very excited about Ice Art this year, we somehow have failed to find time for as much preparation as we had the last couple years. We even forgot to register for the event until a friend reminded us! Fortunately we were able to get one of the last spots in the single block.

Both of us are working on tool preparation, of course. I'm primarily working on a new hot wire cutter while Lars is attempting to resurrect the ill-fated bandsaw of 2006. We are both working on improving our arsenal of chisels.

I guess it's time to wake up and start blogging.

math review

It had been years since I last factored a polynomial. I had forgotten how to derive the quadratic formula. Clearly it was time for a math review. I picked up Precalculus Mathematics in a Nutshell from the Boulder Labs Library; it was just what I needed. The book by George F. Simmons zips through geometry, algebra, and trigonometry in about a hundred pages of amazingly complete and readable prose. Each section is independent of the others, so it is perfect for a quick review of any of the three topics alone. The book is sparsely populated with exercises, just enough to get a solid grasp of each topic. The exercises, as in any good math book, reveal insights beyond those illustrated in the text. I can't imagine a better tool for review, but the book probably wouldn't serve well as a first introduction to the subjects (except perhaps in the hands of the right teacher).

a good book

Yukio Matsuo's Ice Sculpture is a marvelous book, really two books in one. The first is filled with full-color photographs of the master's work, ranging from traditional culinary pieces to original abstract sculptures. Many of them demonstrate the sculptor's distinctive style. The second is a series of sketches, diagrams, and notes that concisely illustrate how to carve each of the depicted pieces. Wonderful!

just one word: plastics

I stopped by Colorado Plastic Products in Boulder today. They sell scraps of all sorts of materials, including high density polyethylene (HDPE), polytetrafluoroethylene (PTFE/Teflon), and ultra-high molecular weight polyethylene (UHMWPE), all of which are attractive for making ice carving tools.

I needed a low friction surface for a new hot wire ice cutter I'm working on, so I picked out a nice sheet of UHMWPE. It has terrific properties for the application, including a low coefficient of friction, low water absorption, and a wide operating temperature range. Lars had suggested the stuff because it is used for ski bases and dog sled runners, so it should work very well.

October visit

Lars and Sharon visited us in Colorado a couple weeks ago as a part of a post-wedding tour of the lower 48. We took full advantage of the opportunity to start planning for Ice Art 2008.

After touring Celestial Seasonings (Sharon's favorite part of the trip), we enjoyed an Ethiopian dinner with Keith and Andy, both ice scientists! It was an excellent opportunity to explore ideas for ice machines, but, more importantly, it was a good time in good company.

rumblings from the deep

The first snow has come and gone. The days are getting shorter. It's the time of year when Lars and I start talking about ice. It must be time to revive the blog.

serial/ethernet combination tap

J@§¤ñ wrote to tell me about how he extended my 5-in-1 network admin's cable to build a dual-purpose Ethernet and RS-232 tap. Very nice!

the great satellite disaster of 2007

I traveled to Fairbanks with a small hot wire gear cutter and parts to make a large one. At Belfair I spent the better part of two days making the large gear cutter and an axle guide prior to the start of the event. The structures were made primarily of balsa wood, fragile but lightweight enough to allow for gradual, gravity powered gear cutting without bending the resistance wire. Lars had the bright idea that I could use a single axle guide with the small and large gear cutter mounted at either end. We decided that this configuration looked somewhat like a satellite.

I didn't try to make a gear until the third day of the competition. By that time my power supply had apparently fallen off of one of our work benches and sustained some damage from the low temperature impact. The case was broken, and the Kapton tape holding the transformer to its mount had broken (They use the stuff to make space suits, so you'd think it would hold up in cold temperatures! I guess I must have had it against too sharp of an edge.) Fortunately, the wiring was intact, and current was delivered to the gear cutter as I attempted to make our pinion.

When I tested the hot wire gear cutting technique at home, I ended up with a nice gear and a puddle of water. Unfortunately, the colder temperature (-20°F or so) during the competition didn't allow for a similar result. No liquid water escaped at all, and I helplessly watched the device pass slowly through the entire cylinder of ice while all of the melted water re-froze immediately behind the hot wires.

I tried adjusting the voltage. More power made it work faster but also caused cracks to appear in the block of ice; no setting prevented the horrifying re-freezing. With only a half an inch to go, the power supply failed for an unknown reason (temperature affecting the semiconductor in the TRIAC dimmer switch?), so I began using the backup power supply (same design, smaller transformer). It finished the job, but I was left with a solid cylinder of ice trapped within the gear cutter assembly. Only a hint of a gear shape was visible.

I was almost ready to give up on making gears at all, but I figured that there was a chance that the technique might work if the individual resistance wires were bent slightly upward so that gravity could pull the liquid water along the hot wire toward the outer edge of the ice block. I decided to flip the whole contraption over, tweak the wires, and run it upside-down, passing the wires through the gear blank in the opposite direction. Even if it didn't work, I would at least free the ice from the gear cutter.

Here's a fun exercise to try at home: Place all your fine china or other fragile valuables in a large box with a bowling ball in the center. Don't use any packing material. Take the box for a walk around the block, flip it upside-down at least once, bring it home, open it, and witness the destruction. This is pretty much what it was like turning the balsa wood frame around with a block of ice trapped inside. I thought I could turn it over (holding the ice, not the wood) and pass it up from beneath the sawhorse workbench, but it was too big, or I was too clumsy, and it was, well, a disaster.

I did finally manage to get the small gear cutter in place, upside-down, over the gear blank resting on temporary supports, but the large gear cutter was badly damaged and completely separated from the axle guide in the process. I bent the resistance wires, attached the backup power supply, turned it on, and nothing happened. The backup power supply had failed! Thus our quest for gears ended.

Perhaps last year's technique would have been better, but the speed advantage of hot wire cutting seemed tremendous. After this experience and our first field use of The Boiler (Lars's hot tube cutting machine - effective but slow and with some cracking), we've determined that no heat cutting technique should be used in sub-zero weather. If we decide to use heat cutting in the future (and the speed advantage may well lead to that decision), then we will have to perform the operation on warmer ice with a warmer ambient temperature, perhaps in a tent.

Counterclockwise

Here are a couple photos of the completed piece. It is a working music box that plays one note. When the crank at the front is turned, a cam lifts and then drops a hammer that strikes a vertical chime.

The frame structure on the left ended up being completely superfluous because our chime was attached directly to the floor.

photos by Dan

Dan Gottesman graciously offered quite a few photos he took of our project. Here they are in chronological order.

We started out by carving a few slabs off of our block. We used a chainsaw with a 42 inch bar and a helper handle to follow lines scribed into the ice. At first we tried etching the lines with sharp things, but we eventually figured out the easiest way we had to mark the ice was with pencil. The pencil markings could be erased quickly with a chisel.

Breaks in the warming hut were essential as the temperature was rarely above -15°F. I heard that the average temperature during the competition was -23°F and that it was the first time in the history of the Single Block Classic that it never exceeded 0°F over the course of the three day event.

We used small, electric chainsaws to carve parts out of the slabs. Here is one of the saws next to one of Lars's homemade chisels.

We tried cutting slabs at night, but it turned out to be tricky. At temperatures below -20°F or so, the ice tended to crack. We never lost a whole slab, but some significant fractures appeared along the edge closest to the gas engine of the giant chainsaw.

Lars noticed that the exhaust port on the saw pointed directly at the ice where it had cracked, so we decided that slab cutting would be a daytime-only activity until a modification could be made back at the shop.

We were fortunate to have the aurora borealis overhead as we worked into the night. It is always a treat to see the lights in Fairbanks.

This display was fairly bright and active. There were two distinct bands of light that rippled quite a bit.

We were worried about how long an axle we would be able to turn on the lathe, but we ended up having no trouble producing axles of more than 50 inches.

Roughing out parts with chainsaws turned out to be the safest nighttime activity.

The drill press carriage assembly and custom 3.5" drill bit Lars made worked wonderfully.

Here you can see a hole ready to receive a lathe-turned axle.

We had some scary moments while assembling the chime frame that consisted of three horizontal shelves. The extreme temperatures made it difficult to waterglue ice. As soon as more than a few drops water or slush hit the ice, significant cracks appeared. Also, the frame pieces didn't fit together as well as we would have liked, mostly due to our slab cuts not being perfectly planar (though they were much better than last year's). The middle shelf broke apart into several large pieces while I was trying to level it for gluing. I was amazed that the lower shelf stayed intact when all the pieces landed on it. After that event, we came up with a bonding method that caused less cracking and also allowed for less precision: spreading a layer of dry snow between the parts, wiggling them into position, and then spraying the snow with a small quantity of liquid water.

Throughout the competition, we followed diagrams in a book I had printed using QCad. As the event wore on, we made more and more notes and modifications to the designs in the book.

Lars used a hot tube cutter ("the boiler") with a sheet steel template to carve the hammer.

The boiler worked well but very, very slowly. Unfortunately, it tended to create cracks in the ice, especially when used at night. We had the same problem with hot wire cutting, so we came to the conclusion that heat cutting is generally useless below about -20°F (maybe higher). If we decide to use heat cutting in the future, we will have to warm the ice up to a workable temperature before doing so.

As night fell on Thursday, we were working on the final assembly of our simplified music box. We had to pack a considerable amount of snow between the front frame pieces in order to get the axles aligned correctly. Ice was cracking like crazy when it came in contact with more than the tiniest amount of water, but I found that I could get the snow to stay in place with just a little moisture from my own breath.

I brushed snow off of the piece while Lars worked on the last few parts.

The cracking power cord on the die grinder held up just long enough for Lars to finish the bushings needed for the axle assemblies.

I kept scraping and brushing snow off the ice until the bushings were finished.

Just before the horn sounded, we put the axles in place with all of the parts attached. Unfortunately, it wasn't until the next day that we were able get the music box working.

counterclockwise or otherwise

Check out the official Ice Alaska page for our creation at the Single Block Classic. Shortly before the final photo was taken we affixed the crank handle to the front and made a few invisible modifications to allow the piece to function. It isn't much to look at, especially from the front, but it works. We should have turned the entire piece 45° so that you can better see the mechanical parts.

Hilariously, the sculpture is titled Counterclockwise, but it only works when turned clockwise. That should confuse some people. Lars carved a clockwise arrow above the handle that will hopefully get the point across. Unfortunately the mechanical parts are likely to break if it is turned the wrong direction; this was why we had originally planned to add a ratchet. Oh well. We'll see how long it lasts!

it works

I need to catch up on sleep before posting more of the story (and a whole bunch of pictures), but our effort to make the single chime mechanism work on Friday afternoon was a success! We turned the crank, the hammer hit the chime, and nothing broke! Unbelievably, it was still working when we returned a few hours later.

the competition is over

After an afternoon discussion, Lars and I decided to simplify our design and attempt to complete it by the 9:00 PM horn marking the end of the competition. If the piece wasn't done at 9:00, we would voluntarily disqualify ourselves and keep working until finished. Lars: "Art may break out at any moment!"

The simplified design consists of a single chime struck by a hammer once per rotation of a crank. It eliminates many parts that were required by the design capable of playing a tune but is still mechanical, interactive, and musical.

We finished making all of the required parts and were installing the axle assemblies as the clock ticked toward 9:00. When the horn sounded, all of the parts were in place except for the crank, and the sculpture only needed some waterglue and a little re-positioning of the chime before being completely functional.

Since we were so close, and the piece was starting to look pretty cool, we decided not to forfeit the competition. Instead we packed up our things, cleaned up the site, and headed home after one last donut from the warming hut. We'll return on Friday afternoon, during the warmest part of the day, to finish the piece and make it work.

Thursday update

A combination of technical difficulties and general lack of time have prevented me from updating the blog as often as I would have liked. As of lunch on Thursday, the last day of the competition, we are doing well but are behind schedule. Our tools have been working as intended this year, but we are finding that, even with better tools, carving each individual part takes quite a bit of time, sometimes well over an hour for a single part. We need to find ways to increase our speed!

We have made excellent progress this morning thanks to a few speed improvements, but there is still much more to do. At some point today we will have to decide whether or not we will simplify our design to get something working tonight. Another alternative would be to continue carving tomorrow, although our piece would be incomplete for judging tonight. Either way, we are doing much better than last year despite experiencing worse overall weather.

slab cutting

The giant chainsaw has been working very well for slab cutting. We've cut full slabs from two inches to six inches thick, and not a single slab has broken. The only improvement we can envision would be some kind of guide to keep our cuts straight. Our cuts haven't been horribly crooked, but a little more consistency in our slab thickness would help quite a bit.

in the shop

We spent a great deal of time on Sunday and Monday in the shop at Belfair. I spent most of the time working on a hot wire gear cutter for the large gear.

Lars worked on a number of things, including the super router that has become known as Julie. Originally envisioned as an attachment for a drill press, Julie ended up being constructed with her own motor.

Nephew Gary helped out by building a large nailboard that we call The Devil's Backscratcher or Old Scratch.

go!

We showed up early and set up hundreds of pounds of equipment this morning before the 9:00 starting time. We spent the morning carving large slabs of ice off of our block and making a pad of ice upon which we will build our sculpture.

The pad is made of hard-packed snow that has been leveled. After leveling the snow, we dribbled cold water onto it a few times, did some sanding, and eventually got it to the point where we could pour water onto it like a skating rink. By lunch we had a fairly slippery rink and were starting to carve structural pieces out of our slabs. Not a single slab has yet broken!

The giant chainsaw is working flawlessly, as is every other tool. Wow! We look like we sort of know what we are doing!

ready

After a delightfully uneventful flight to Fairbanks, Lars and I spent two days hard at work in the shop at Belfair. We have so many wonderful tools this year! I'll have to post photos of them, but I am unable to at the moment.

At Ice Park today we drew site number 42. Excellent! If you are in Fairbanks, we hope you'll visit us over the next three days. We've already unloaded some equipment at the site, and the rest of our stuff is ready to go in the morning. Our ice block has been oriented and placed (something that didn't happen until the first morning of competition last year), so we are ready to attack the ice with the giant chainsaw at 9:00 AM sharp.

going back to bed

I checked my email one last time before leaving for a long day of travel only to find a notice telling me that we had been bumped to a much later flight. Our first flight of the day was canceled. Other than the fact that we don't get to join Lars and Sharon for dinner tonight, our new itinerary is actually much better. This change cut our total travel time from thirteen hours down to seven hours, and it pretty much gives us a whole extra day.

"¡Peligro, Will Robinson!"

"I just heard that the SAW IS READY!! Peligro Will Robinson!" So said Lars before he went to pick it up. He now has the giant chainsaw, and it is ready to go!

one week to go

We've settled on a design and are making last minute preparations for next week's event. I've had a cold for the last few days, so my first priority has been to get healthy; I don't want to head to Fairbanks feeling less than 100%.

Lars has been very busy working on tools. He welded up a new drill press table (the "Drill Press Table X-2007 HD") and has done some ice axle testing. He is also trying to put together a hot tubing ice cutter to try out.

The high temperature in Fairbanks is supposed to be -20°F from today through Sunday, but they say it should be warmer (lows near 0°F) next week.

ice harvested

The word from Ice Alaska is that the ice harvest for the single block has been completed and that the ice this year is 31 inches thick, not counting a little white ice. This is quite a bit thinner than last year's block, but it should be plenty of ice for the music box. Hopefully the cold spell won't crack the ice too much.

cam, hammer, and pawl

We thought that we would have to resort to building eight or nine hammers, but now we have a design that only requires four hammers, one for each chime. The red thing is a cam that turns clockwise when the crank is turned. Each lobe of the cam lifts the hammer (green) and pawl (yellow), and then releases them in that order. When released, the hammer swings once toward the chime on the left (not pictured) and then swings back toward the cocked position. By the time the hammer returns, the pawl has been released and is able to catch the hammer mostly cocked.

If the crank is turned too fast, the pawl is released in time to catch the hammer after only a fraction of a swing, preventing the hammer from hitting the next lobe on the cam with damaging force. The pawl limits the tempo at which the tune may be played, catches the hammer to prevent damage caused by repeated swinging, and preserves much of the energy of the hammer, making the whole thing more efficient and minimizing wear.

Unfortunately, the pawls are four extra moving parts and an additional axle, but they help us avoid making eight or more moving parts that we would need if we were to use more hammers.

oh, for a giant chainsaw

Lars: "I was up in a balloon the other day when the chainsaw store called to tell me that the saw and Handburger Helper Handle was there, but then the balloon came crashing down the next day when they told me that the bar won't fit on the engine! They are '100% positive' that they've got another one that fits it, and can get it up by the 19th, so that's where we are. If that fails, I'm going to demand that they become one of our corporate sponsors, and give us the longest barred saw that they have during the contest in exchange for advertising. Maybe we'll have a corporate sponsor!"

Hopefully they'll get us a chainsaw with a 40 inch or longer bar in time for the competition. If not, we'll have to resort to hot wire slab cutting or cutting the slabs from both sides with a shorter saw like we did last year. We spent too much time trying to align the cuts last year, though. If we have to use that method this year, we'll probably settle for rougher cuts and then smooth the slabs with a large nailboard.

two weeks to go

Strangely there is not much to report. We continue to work on tools and designs, but our preparations aren't so frantic as they were last year. We have a much better idea of what we are doing this year, a better command of the medium, and more sophisticated tools. Hopefully we aren't victims of false confidence, but, although there is still much to do, there seems to be plenty of time to do it.

I leave for Fairbanks in eleven days, and I only have a few more days before my shipping deadline. I'm taking more stuff with me this year, but that means I'll have less to do in the shop at Belfair after my arrival.

three weeks to go

Lars writes, "The giant router is tacked together, and needs a little alignment and bit sharpening and final welding, but then it'll be fully ready to use." The router is actually a long, custom attachment for his drill press. The drill press is mounted over a table, and the giant router bit goes through the table and is fixed to a bearing on the under side. It should be great for precision cutting of large machine parts out of slabs of ice.

We're closing in on a final chime design, and much progress is being made on the cam and hammer design, though it is still somewhat up in the air. Before long we might actually know what our sculpture will look like!

more library books

What do you get when you pair architects with minimalist artists and turn them loose on media (snow and ice) they have little or no experience with? The Snow Show is a book filled with wonderful, full-color photographs of the results, creations that are beautiful and interesting enough to more than make up for being somewhat monotonous. Unfortunately, the book also features page after page of uppity, dysfunctional prose. Even the show's web site, with its "this experience is more important than anything else you could possibly be doing" full-screen presentation, manages to express the worst along with the best of the. . . Okay, I should stop now. Get this book for your coffee table and leave it there.

Snow Sculpture and Ice Carving is about as contrasting a book on the subject as could be imagined. A product of 1970's craft culture, James Haskins's book features black and white photos of sculptures that are more accessible if a bit crude. I didn't find the book terribly interesting, however, as it is heavy on ideas for what to carve but light on technique.

cams and hammers

Cam and hammer design has been the topic of much discussion lately. Lars and I both realized that, if we were to simply add extra pins to the cylinder on the original model in order to play all the notes in the tune, several of the pins would end up too close together such that a swinging hammer would crash into an upcoming pin before striking the chime (despite the fact that our tune features no rapidly repeating notes).

A related problem we've begun to consider is that we will have no control over the speed of rotation of the camshaft. There is no way to be certain that someone won't come along and turn the crank much faster than we would prefer. (Computer geeks like me call this an input validation problem.) Even if we have designed the pins so that they don't get clobbered by the hammer when turned at what we think is a reasonable speed, they could still be damaged when someone turns the crank too fast.

Yet another related problem is the speed at which the hammers swing. Since each one is essentially a simple pendulum, increasing the scale from model size means that the period also increases. It wouldn't do to have a hammer take longer to swing to and from a chime than the duration between two repeated notes, and that duration is completely dependent on the whim of the crank turner!

A solution we are likely to try is to use multiple hammers (probably two) for each chime. With only one hammer per chime, we will have repeated notes as little as 0.75 seconds apart, but two alternating hammers would increase the minimum repetition to 1.75 seconds (2.75 if we add a third hammer to the most frequently used chime).

Another solution might be to create some kind of mechanism to prevent the crank from being turned too fast or to prevent the hammers from swinging when it is turned too fast. Lars writes, "Once it gets colder, I might start building machine parts and putting things together at random!"

the healing power of touch

I went to the hospital cafeteria to see if I could get a bag of ice for a swollen ankle. They didn't have any bags on hand, so they gave me a latex glove to fill. It did the trick! I hurt the ankle by blocking a shot in a hockey game a couple weeks ago. It didn't seem to be healing very well, so I had it looked at. There was a faint line in one of the images, but doc says he doubts it is a fracture. It is a bone bruise that may take a while to fully heal, but I get to keep playing.

lathe improvements

Lars has recently made a number of improvements to the ice lathe he made last year. He added legs, a tool rest, and some kind of chucks to hold the workpiece in place. He writes, "the chucks work great! I had to keep tightening them as the piece was turning, since it's above freezing right now. . . . I wore a hockey helmet in case of disintegration."