I have a DAB radio which started to irritate me in various ways. Finally fed up with it, I bought another radio and decided to free up the space that the old radio takes up by tearing it down.
This is the DAB radio taken apart:
Nice display 16 char 2 line dot matrix.
Looking at PCB, it seems to have a three wire interface:
Scoping up the lines, one looks like a reset:
Others have data and clock:
Looking at the data, there's a different voltage level in there. I2C has an ACK which comes from a different computer to the one generating the data, so different level makes sense.
As this is probably I2C, switching on the decoder in the scope shows what is being sent:
Now we know the I2C slave address and some data. It does look like I2C. What device is it though? Searching the internet gives a few options. It could be a standard I2C GPIO expander attached to an LCD controller.
After power up there's an initialisation sequence:
That's the first byte in a longer sequence that goes:
There also seem to be two bytes for every bte of data transmitted, the initialisation bytes have a ledaing byte of 0x00, the data bytes have a value 0f 0x40.
Using this sequence we could maybe find the controller that is used. After more searching there's a possible match. The Winstar WO1602I-TFH- AT module has an initialisation sequence that is similar. The datasheet shows the initialisation sequence to be:
0x38, 0x39, 0x14, 0x74, 0x54, 0x6f, 0x0c, 0x01
This is similar enough to probably be the same controller with a slightly different LCD attached. The datasheet is useful. It says the controller is an ST7032, and the first byte of the two that are sent is a control byte. It holds Co and RS. RS is the command/data bit, while Co is a continuation bit that allows more than one control byte to be sent. The datasheet shows the RS bit as bit 6 which matches the trace on the scope. It looks like this is indeed the controller in the display.
Excellent, we have enough data to probably drive this display.
I got a Novena laptop from Crowd Supply several years ago.
I didn't use it too much and that probably contributed to the batteries not being charged enough to maintain good health. That lead to some magic smoke being released from the battery charger PCB. It looks OK in this photo, but it's not.
The laptop was dead at that point. Being open hardware, though, means that I have all the schematics, gerbers and firmware for the system, so it should be fixable.
I decided to change the Novena to a desktop system, so I removed the battery charger PCB and tried powering from the power socket that is on the main PCB. That seemed to work, in that it powered the main PCB, but the LCD didn't come up and there seemed to be a configuration problem. The push button at the front of the machine also didn't work.
It turns out that to run the Novena as a desktop you need a different PCB where the Senoko PCB lives. It's called the 'Senoko pass through' PCB and the Gerbers are available. I had some made and populated a couple.
Once fitted in the Novena all was well and the power supply can now be turned on using the button on the front of the case.
The display still didn't work, though. After looking at the schematics I came to the conclusion that a high voltage had travelled down the I2C bus that the battery controller was on and had destroyed anything on there. That unfortunately included the LVDS to eDP video converter chip. Well, that's not too much of a problem as the chip is still available ( I bought a few) and the PCB gerbers are available as well. So I had a few of those made up and populated two of them.
This PCB was much harder to populate as the BOM wasn't online (I subsequently got a copy) and so some of the components I used weren't exactly the right footprint. The packages used by these components were also in the 'nasty to handsolder' category. I tried both PCBs and neither came up with a display on the LCD. Was it the layer stack up? Maybe as I just had the PCBs made using my usual cheap supplier and didn't pay any attention to layer stack up. Was it my soldering or the footprint problems? More likely. Either way I still had no LCD display. Did the LCD get blown up? That was possible, so I bought a second LCD panel and tried that.
No output on any eDP PCB.
I then noticed that you can buy cheap HDMI to eDP converter boards and got a couple of those. Attached to the HDMI port of the Novena and attached to the second LCD I had bought, we had output. The HDMI output still worked and I had verification that the LCD I had bought worked. having an HDMI cable running from the external connector into the case and through a converter PCB to the LCD was untidy though.
Could I have damaged the mainboard somehow and the LVDS was broken? Maybe, so I bought a new mainboard as they were on sale. I tried that and the same result. No LCD output.
After more searching online I found that you can buy LVDS to eDP converter PCBs that use the same chip that the Novena eDP board uses. I bought one of those and started to investigate wiring it up to the LCD and the Novena mainboard. It wasn't an easy job. Before I finished doing that (or actually, even started wiring), I remembered that I had some spare LVDS to eDP chips that I bought to populate the eDP PCBs. I could remove the chip from the eDP board I got with the Novena and put a new one on. That board wouldn't have the possible layer stack up problem or footprint/component problems of the boards I'd made from scratch. I swapped the chip and tried that. Still no luck. This wasn't looking good. I swapped the mainboards around and still no luck.
The debug serial port spits out information about the setup as the Novena boot sand I noticed that the LVDS to eDP chip was recognised but didn't get powered up. I fiddled with the EEPROM settings but still no display. The chip seemed fine though, so my swap seemed to be OK.
I then booted into recovery mode, I can't remember why now, probably as it was another option to investigate the disabling of the LCD. I had the Novena facing me (the case opens in the opposite way to a normal laptop), so the LCD was facing away from me. As I booted I suddenly noticed that there was a reflection of the LCD on the screen of my logic analyser. the LCD had started up!
This was good news, but why was it on now? The only thing I could think of was that the disabling of the LCD was now a software problem, the hardware was functioning. Normal boot on the mainboard I had in the Novena was disabling the LCD for some reason. Which main board was I using? Well, it was the new one that I had bought, and that was part of a 'just the board' kit, so it may not have been configured for an LCD, rather to run as a server. I swapped the SD cards between mainboards and rebooted. The LCD worked fine. So maybe that theory was correct and my later problems after the chip swap were due to the SD card configuration. I've not found the setting for the LCD disable, partly due to taking a break after all the kerfuffle.
Saturday, 8 May 2021
Battery Leakage Again
A recent purchase:
It's a Casio FX502P in pretty much perfect cosmetic condition. Unfortunately the display isn't. It's not displaying anything very well at all. It's attempt at displaying Pi shows how bad the LCD is:
Once I opened it up, the problem was immediately obvious. It was battery leakage again. It's not very obvious in this photo but the batteries have leaked in the area of the battery contacts (which are remarkably clean) and the LCD.
The LCD is fortunately connected with zebra strips on this calculator, not heat seal:
This meant that I could dismantle the display and clean it. I also cleaned the tracks that had had leakage on them. the solder resist was loose so I removed it on any affected tracks. You can see that tracks I've cleaned are missing their resist and appear gold in this photo:
Once re-assembled, the LCD is working perfectly. It's got good contrast and the filter is completely free of scratches. It's the best example of a FX502P I've got.
I'd had a Sony MZ-R37 in the workshop for quite a while. I can't remember where I got it, I think it came in a job lot of something. It had battery leakage so I left it for later clean up. Unfortunately when I recently came to look at it again I found that the batteries had leaked out of the device and onto my shelf. It had turned from a possible recovery situation to a tear down and parts salvage. There's a video of the strip down here:
During that process I found that the display was an interesting little PCB with what looked like a serial interface. What made it particularly interesting was that it has a six character dot matrix display as part of the layout. This means that it could maybe display arbitrary character on it and make it a useful part to repurpose.
A very nice discovery was the service manual for the MZ-R37. This is very complete and had the pinout for the LCD controller flexi cable. It is indeed a serial interface. The interesting signals are:
DATA
CLOCK
STB
A0
DATA and CLOCK are serial data and clock respectively. STB is a strobe or chip select signal. The A0 line is a command/data selection signal. With this information it was easy to scope the signals up and see how the dot matrix data is transmitted. There's a block of 30 bytes clocked out with a preceding command byte of 0x0A. The bytes are columns of each 5x7 character, in sequence from left to right. The row order is not logical and has to be reordered from a standard top to bottom order. Only seven of the 8 bits in each byte is a dot matrix segment, the remaining bit (bit 0) controls an icon in the top right of the display.
I grabbed a trace of the matrix data for the Vr1.20 display, it is:
0x0a, // Command code (A0 low)
0xe2, 0x14, 0x08, 0x18, 0xe2, // First matrix character data
0x7c, 0x20, 0x40, 0x40, 0x40, // Second matrix character data
0x00, 0x80, 0x80, 0xfe, 0x00,
0x00, 0x08, 0x00, 0x00, 0x00,
0x8c, 0x1a, 0x2a, 0x2a, 0xc8,
0xf4, 0x1a, 0x2a, 0x4a, 0xf4
As the data is jumbled it was difficult to decode this. I wasn't even sure that the matrix data was segment data, but 30 bytes was a bit too much for 6 characters of text if it was ASCII data. Counting the number of 1 bits in the data gave the same number as the number of segments in Vr1.20: 66 bits.
So it was definitely segment data. It took a lot of fiddling and test programs to work out the jumbling, but I did manage to work out the row order.
I attached a Wemos D1 to the LCD PCB and replayed the 30 byte packet I captured earlier and the Vr1.20 appeared in the dot matrix area. I used voltage dividers on the GPIO lines and supply to drop the 3V3 to 3V0, just in case the display can't handle 3V3.
Once that was working I wrote a small test program that sent the 30 byte packet using a 5x7 font and jiggled row data. This allows arbitrary data to be displayed in the matrix characters. I also sent a second burst of data which is segment data for the left hand side of the display. The icons on the top right of the display are sent in bit 0 of each byte of the 30 character burst as mentioned above.
The switches are wired up with two signals that use voltage dividers to give different voltages for each key press. There's also a signal (WP) which pulses low when a key is pressed. Another signal (HOLD) is pulsed by the controller, but at the moment I'm not sure why. There's only one analog channel on the WEMOS D1 so I can't read both signals. At the moment the keys don't return different voltages when attached to the WEMOS, but do when attached to the MZ-R37 processor. I'm not sure why at the moment, but I'm not too worried about the switches, it was the display I was after.
Wednesday, 26 February 2020
Bus Sniffing Replacement Display for Fx702p
I've had bad experiences with heat seal connectors in the past (Casio PB220) and wasn't very happy to find that a broken Casio fx-702p had a heat seal connection from its main PCB to the LCD. The display wasn't working and when I had a look at the connector it had broken tracks. After buying some conductive paint (water based carbon), I had a go at repairing the tracks. This was going well until I pulled the LCD end of the connector ribbon at one side and the connections to the LCD just ripped off. The ease with which this happened might have been a clue as to why the fixes I was doing with paint didn't seem to be affecting the bad display at all. It looks like the LCD connections were dodgy as well. Fixing the LCD end of the connections is not something I think I will have much success at, so I ripped the entire connector off.
This made repairing the device out of the question at the moment as I have no way to connect the LCD to the PCB. After a bit of thought I wondered about attaching a totally different display to the LCD connections and get display output that way. This is theoretically possible, but as the LCD signals are multi-level (essentially analogue) and there are a lot of them (dozens) it would be difficult to capture the data needed to rebuild the display. The decoding of the signals isn't trivial either.
So I had a bit of a think and decided that an easier way to get a display would be to attach a sniffer to the bus that the processor uses to talk to the display controllers. Then I could capture the data going to the display controllers and put that on an external display. The fx702p would not have it's original display but at least I'd be able to use it. Then I thought about what else was on the bus and it got even better. The RAM chips that give the 702p its memory are also on the bus, so I could snoop reads and writes to the RAM and have an idea about what the programs stored in the RAM looked like. And any other data in there. This was looking feasible and interesting.
After some wiring
I had a logic analyser attached to the bus and I managed to capture bus traffic:
This actually shows the message that the 702p displays at power on. The bus is four bit, though, so you only get nibbles displayed, and the 702p doesn't use ASCII for it's characters. The values starting 1 5 in the photo are the sequence:
1 5 4 4 0 4 3 4 8 5 F 0 F 4
If you turn these into bytes (reversing each pair of nibbles) you get:
51 44 40 43 58 0F 4F
If you check out a 702p character set map (such as this one http://www.pisi.com.pl/piotr433/fx702cod.png) you will see that these character decode like this:
51 R
44 E
40 A
43 D
58 Y
0F (space)
4F P
This is obviously the start of the 'READY P0' message that is displayed at power on.
Interestingly, this appears to be data sent to the display controller. When the CE lines for the RAM chips are examined, there appears to be no access to the RAM chips at all at start up. It looks like initialisation of the memory is done within the internal memory of the processor.
The next step was to use a logic analyser to decode as much of the display data as I could and then display it on the LCD. The final sketch uses interrupts to handle the bus accesses to the two display controllers and the main loop of the code to display the data.
My logic analyser has a slow 9600 baud connection for dumping traces, so using it to capture bus traces was time consuming when I was transferring the data from the analyser to a PC. Because of this I created a build option for the sketch that captured traces very similar to my logic analyser trcaes in the ISR. These traces are then decoded by the main loop and the data is displayed from them. This leads to a fairly large (2 or 3 seconds) delay before data from the ISR is displaye don the LCD, and also sometimes causes a trace buffer overflow and loss of cycles. It's a lot faster when looking at bus cycles, though, as the serial port runs at 2Mbps. In normal ISR mode I also dump display data over the serial port so whatever is displayed on the 702p is available as a serial data stream.
There's a video showing it working and some description here:
The connections inside the fx702p require some fiddly soldering, but several signals can be taken from test pads, which is easier than soldering to an IC pin (which some signals have to come from).
I connected the signals to the blue pill using a milled PCB which makes the wiring much simpler than point to point. The physical layout of the board and components was for ease of debug and there are logic analyser connectors which aren't necessary any more. The whole thing could probably be designed to be much more compact.
The fx702p is normally powered by two 2032 button cells, which poses a problem as that can give a maximum of 6V when fully charged. The blue pill is a 3V3 device with 5V tolerant inputs. I therefore power the fx702p from the 5V supply of the blue pill and make sure that all signals from the calculator are going to 5V tolerant pins. This keeps the signals from the fx702p within safe levels. The calculator seems to run it's circuitry at the battery supply voltage, there's no regulator.
The latest incarnation of the display uses a milled PCB to simplify the signal connection from the calculator to the processor.
The arrangement could be shrunk down, this PCB was a breakout board and has connectors for logic analyser signals, and was definitely not designed to be compact. I don't think the new electronics would fit into the case of the fx702p very easily, and I haven't seen a display that would fit in the space left by the old one. A better layout could be done though, and I may do that now I have the code and hardware essentially working.
Some sample displays. This is the power on display:
The 8 BB is part of a debug display of the annunciator data.
This is the MODE 1 display:
And this is a calculation ready to be evaluated:
There's some extra annunciators on that last display
Posts
