Posted on Leave a comment

IC Decap: Motorola MC68HC11E9 8-Bit Microcontroller

This particular IC came out of a very old VHF band radio, from the early 90’s. The die was encased in a custom ceramic package, like every other IC in the radio, with a custom part number. I managed to identify it from the markings on the silicon.

Motorola MC68HC11L6
Motorola MC68HC11L6

This was a pretty powerful MCU for it’s time, with 16K of onboard ROM, 512 bytes of both RAM & EEPROM, a 16-bit timer, 8-bit ADC, SPI & a MC68HC11 CPU core.

Posted on 3 Comments

Evolis Dualys3 Card Printer Teardown

I recently dug out my other card printer to fit it with a 12v regulator, (it’s 24v at the moment), and figured I’d do a teardown post while I had the thing in bits.

This is a less industrial unit than my Zebra P330i, but unlike the Zebra, it has automatic duplexing, it doesn’t have Ethernet connectivity though.

Unlike domestic printers, which are built down to a price, these machines are very much built up to a spec, and feature some very high quality components.

Naked Printer
Naked Printer

Here’s the mechanism with the cowling removed. This is the main drive side of the printer, with the main drive stepper at left, ribbon take-up spool motor lower right, and the duplex module stepper motors at far right.

Main Motor Drive
Main Motor Drive

The main drive motor runs the various rollers in the card path through a pair of synchronous belts, shown here.

Main Stepper
Main Stepper

The stepper itself is a quality ball-bearing Sanyo Denki bipolar motor.

Main Stepper Driver
Main Stepper Driver

Electrical drive is provided to the stepper with a L6258EX DMOS universal motor driver. This chip can also drive DC motors as well as steppers.

Ribbon Supply Spool
Ribbon Supply Spool

Here is the encoder geared onto the ribbon supply spool. This is used to monitor the speed the ribbon is moving relative to the card.

Printer Top
Printer Top

Here’s a top view through the printer, the blue roller on the left cleans the card as it’s pulled from the feeder, the gold coloured spool to it’s right is the ribbon supply reel. The cooling fan on the right serves to stop the print head overheating during heavy use.

Spool Take Up Motor
Spool Take Up Motor

The spool take-up reel is powered by another very high quality motor, a Buhler DC gearmotor. These printers are very heavily over engineered!
This motor drives the spool through an O-Ring belt, before the gear above. This allows the drive to slip in the event the ribbon jams, preventing it from breaking.

Duplex Unit Stepper Drivers
Duplex Unit Stepper Drivers

The pair of steppers that operate the duplexing unit are driven by a separate board, with a pair of L6219DS bipolar stepper driver ICs. There are also a couple of opto-sensors on this board for the output hopper.

 

Main Control PCB
Main Control PCB

All the mechanisms of the printer are controlled from this main PCB, which handles all logic & power supply functions. Sections on the board are unpopulated, these would be for the Ethernet interface, smart card programming & magstripe programming.

Main CPU
Main CPU

The brains of the operation is this ColdFire MCF5208CVM166 32-bit microprocessor. It features 16KB of RAM, 8KB of cache, DMA controller, 3 UARTs, SPI, 10/100M Ethernet and low power management. This is a fairly powerful processor, running at 166MHz.
It’s paired with an external 128Mbit SDRAM from Samsung, and a Spansion 8Mbit boot sector flash, for firmware storage.

USB Interface & Power Input
USB Interface & Power Input

Here the USB interface IC is located. It’s a USBN9604 from Texas Instruments, this interfaces with the main CPU via serial.

Posted on Leave a comment

uRadMonitor – Node Online!

It’s official. I’m now part of the uRadMonitor network, & assisting in some of the current issues with networking some people (including myself) have been having.

It seems that the uRadMonitor isn’t sending out technically-valid DHCP requests, here is what Wireshark thinks of the DHCP on my production network hardware setup:

WireShark Screencap
WireShark Screencap

As can be seen, the monitor unit is sending a DHCP request of 319 bytes, where a standard length DHCP Request packet should be ~324 bytes, as can be seen on the below screen capture.

Valid DHCP
Valid DHCP

This valid one was generated from the same SPI Ethernet module as the monitor, (Microchip ENC28J60) connected to an Arduino. Standard example code from the EtherCard library was used to set up the DHCP. The MAC address of the monitor was also cloned to this setup to rule out the possibility of that being the root cause.

My deductive reasoning in this case points to the firmware on the monitor being at fault, rather than the SPI ethernet hardware, or my network hardware. Radu over at uRadMonitor is looking into the firmware being at fault.

Strangely, most routers don’t seem to have an issue with the monitor, as connecting another router on a separate subnet works fine, and Wireshark doesn’t even complain about an invalid DHCP packet, although it’s exactly the same.

Working DHCP
Working DHCP

As the firmware for the devices isn’t currently available for me to pick apart & see if I can find the fault, it’s up to Radu to get this fixed at the moment.

Now, for a µTeardown:

uRadMonitor
uRadMonitor

Here is the monitor, a small aluminium box, with power & network.

PCB
PCB

Removing 4 screws in the end plate reveals the PCB, with the Geiger-Mueller tube along the top edge. My personal serial number is also on the PCB.
The ethernet module is on the right, with the DC barrel jack.

PCB Bottom
PCB Bottom

Here is the bottom of the PCB, with the control MCU & the tiny high voltage inverter for the Geiger tube.

Control Electronics
Control Electronics

A Closeup of the main MCU, an ATMega328p

Logo
Logo

PCB Logo. Very artsy 😉

Posted on Leave a comment

Nokia 7110

Front
Front

Another phone from the mid 90s. This is the nokia 7110.

Slider Open
Slider Open

Here the slider is open showing the keypad.

Battery Removed
Battery Removed

Here the battery is removed, a Li-Ion unit.

Battery
Battery

The battery cell & protection circuit removed from the casing.

Rear Of PCB
Rear Of PCB

This is the rear of the PCB removed from the housing. Data & charging ports on the right hand side f the board.

Front Of PCB
Front Of PCB

Front of the PCB with the RF sections at the left hand side & the keypad contacts on the right.

RF Sections
RF Sections

Closeup of the RF sections of the board, big silver rectangular cans are VCO units.

SIM Connector
SIM Connector

Closeup of the top rear section of the PCB, with SIM cnnector, battery contacts, IR tranciever at the far left. Bottom centre is the external antenna connector.

CPU
CPU

The logic section of the board, Large chip is CPU, to right of that is the ROM storing the machine code. Other chips are unknown custom parts.

Mic & Speaker
Mic & Speaker

The Mic & the loudspeaker removed from it’s housing.

LCD
LCD

LCD from the front of the unit, SPI interfaced. Flex PCB also contains the power button, loudspeaker contacts & a temperature sensor.

Scroll Wheel
Scroll Wheel

The scroll wheel removed from the front housing.

Vibra-Motor
Vibra-Motor

Tiny vibration motor removed from the rear housing, alerts the user to a text or phone call.

Posted on 2 Comments

Current Cost ‘Envi’ CC128 Power Meter

Display Unit
Display Unit

This is the Current Cost CC128 Real Time Power Meter. Shown here is the display unit, British Gas issued these free to some customers.
This unit measures current power draw in Watts, cost of power currently being used (requires unit price to be set), overall kWh usage over the past 1, 7 or 30 days & power trends during the day, night & evening. Also displays current time & current room temperature.

Display PCB
Display PCB

Here the front panel of the display has been un-clipped. At the bottom are the RJ-45 serial port & power connections.
This unit uses a PIC micro-controller as it’s CPU (PIC18F85J90) Just above & left of the CPU is the 433MHz SPD radio receiver module. The chips on the right of the CPU are a 25LC128 SPI serial EEPROM for data storage & a 74HC4060 14 stage binary counter, to which is connected the 32kHz clock crystal. The red wire around the top of the display is the antenna for the radio receiver.

For more info on the CC128 in general, the serial port & software for computer data logging, see this link
See this link for Current Cost’s list of software

Processor & Radio
Processor & Radio

Closeup of the ICs on the mainboard.

Transmitter Unit
Transmitter Unit

Here we have the transmitter unit, with Current Transformer (CT). The red clamp fits around one of the electric meter tails & read the current going to the various circuits. This unit is powered by 2x D cells, rated at a life of 7 years.

Transmitter PCB
Transmitter PCB

The PCB inside the transmitter. Again very minimal design, unknown controller IC, 433MHz radio transmitter on right hand side with wire antenna. Two barrel connectors on left hand side of board allow connection of up to two more CT clamps for measurement of 3-phase power. Centre of board is unmarked header. (ICSP?)

Current Transformer
Current Transformer

CT unit. Inside is a coil of wire & an iron core which surrounds the cable to be measured.