In my mind, the most dangerous thing onboard any boat is the LPG system, as the gas is heavier than air, any leaks tend to collect in the bilges, just waiting for an ignition source. To mitigate this possibility, we’re fitting a gas monitoring system that will sound an alarm & cut off the supply in case of a leak.
Monitor Unit
Here’s the monitor itself, the two sensor model. It’s nice & compact, and the alarm is loud enough to wake the dead.
Control Board
Not much inside in the way of circuitry, the brains of the operation is a Microchip PIC16F716 8-bit microcontroller with an onboard A/D converter (needed to interface with the sensors), running at 4MHz. The solenoid valve is driven with a ULN2803 Darlington transistor array.
The alarm Piezo sounder can be seen to the right of the ICs, above that is a simple LM7805 linear regulator providing power to the electronics.
Remote Sensor
The pair of remote sensors come with 3.5m of cable, a good thing since the mounting points for these are going to be rather far from the main unit in our installation.
Sensor Element
The sensor itself is a SP-15A Tin Oxide semiconductor type, most sensitive to butane & propane. Unlike the Chinese El-Cheapo versions on eBay, these are high quality sensors. After whiffing some gas from a lighter at one of the sensors, the alarm triggered instantly & tripped the solenoid off.
Solenoid Valve
The solenoid valve goes into the gas supply line after the bottle regulator, in this case I’ve already fitted the adaptors to take the 10mm gas line to the 1/2″ BSP threads on the valve itself. This brass lump is a bit heavy, so support will be needed to prevent vibration compromising the gas line.
This is a System On Chip from Motorola, designed for network routing applications. This chip contains a hell of a feature set, so I’ll just include an excerpt from the datasheet:
XPC860PZP50D4 Die
Embedded single-issue, 32-bit MPC8xx core (implementing the PowerPC
architecture) with thirty-two 32-bit general-purpose registers (GPRs)
— The core performs branch prediction with conditional prefetch, without
conditional execution
— 4- or 8-Kbyte data cache and 4- or 16-Kbyte instruction cache (see Table 1)
– 16-Kbyte instruction caches are four-way, set-associative with 256 sets;
4-Kbyte instruction caches are two-way, set-associative with 128 sets.
– 8-Kbyte data caches are two-way, set-associative with 256 sets; 4-Kbyte data
caches are two-way, set-associative with 128 sets.
– Cache coherency for both instruction and data caches is maintained on 128-bit
(4-word) cache blocks.
– Caches are physically addressed, implement a least recently used (LRU)
replacement algorithm, and are lockable on a cache block basis.
— Instruction and data caches are two-way, set-associative, physically addressed,
LRU replacement, and lockable on-line granularity.
— MMUs with 32-entry TLB, fully associative instruction, and data TLBs
— MMUs support multiple page sizes of 4, 16, and 512 Kbytes, and 8 Mbytes; 16
virtual address spaces and 16 protection groups
— Advanced on-chip-emulation debug mode
Up to 32-bit data bus (dynamic bus sizing for 8, 16, and 32 bits)
32 address lines
Operates at up to 80 MHz
Memory controller (eight banks)
— Contains complete dynamic RAM (DRAM) controller
— Each bank can be a chip select or RAS to support a DRAM bank
— Up to 15 wait states programmable per memory bank
— Glueless interface to DRAM, SIMMS, SRAM, EPROM, Flash EPROM, and
other memory devices.
— DRAM controller programmable to support most size and speed memory
interfaces
— Four CAS lines, four WE lines, one OE line
— Boot chip-select available at reset (options for 8-, 16-, or 32-bit memory)
— Variable block sizes (32 Kbyte to 256 Mbyte)
— Selectable write protection
— On-chip bus arbitration logic
General-purpose timers
— Four 16-bit timers or two 32-bit timers
— Gate mode can enable/disable counting
— Interrupt can be masked on reference match and event capture
System integration unit (SIU)
— Bus monitor
— Software watchdog
— Periodic interrupt timer (PIT)
— Low-power stop mode
— Clock synthesizer
— Decrementer, time base, and real-time clock (RTC) from the PowerPC
architecture
— Reset controller
— IEEE 1149.1 test access port (JTAG)
Interrupts
— Seven external interrupt request (IRQ) lines
— 12 port pins with interrupt capability
— 23 internal interrupt sources
— Programmable priority between SCCs
— Programmable highest priority request
10/100 Mbps Ethernet support, fully compliant with the IEEE 802.3u Standard (not
available when using ATM over UTOPIA interface)
ATM support compliant with ATM forum UNI 4.0 specification
— Cell processing up to 50–70 Mbps at 50-MHz system clock
— Cell multiplexing/demultiplexing
— Support of AAL5 and AAL0 protocols on a per-VC basis. AAL0 support enables
OAM and software implementation of other protocols).
— ATM pace control (APC) scheduler, providing direct support for constant bit rate
(CBR) and unspecified bit rate (UBR) and providing control mechanisms
enabling software support of available bit rate (ABR)
— Physical interface support for UTOPIA (10/100-Mbps is not supported with this
interface) and byte-aligned serial (for example, T1/E1/ADSL)
— UTOPIA-mode ATM supports level-1 master with cell-level handshake,
multi-PHY (up to 4 physical layer devices), connection to 25-, 51-, or 155-Mbps
framers, and UTOPIA/system clock ratios of 1/2 or 1/3.
— Serial-mode ATM connection supports transmission convergence (TC) function
for T1/E1/ADSL lines; cell delineation; cell payload scrambling/descrambling;
automatic idle/unassigned cell insertion/stripping; header error control (HEC)
generation, checking, and statistics.
Communications processor module (CPM)
— RISC communications processor (CP)
— Communication-specific commands (for example, GRACEFUL STOP TRANSMIT ,
ENTER HUNT MODE , and RESTART TRANSMIT )
— Supports continuous mode transmission and reception on all serial channels
— Up to 8Kbytes of dual-port RAM
— 16 serial DMA (SDMA) channels
— Three parallel I/O registers with open-drain capability
Four baud-rate generators (BRGs)
— Independent (can be connected to any SCC or SMC)
— Allow changes during operation
— Autobaud support option
Four serial communications controllers (SCCs)
— Ethernet/IEEE 802.3 optional on SCC1–4, supporting full 10-Mbps operation
(available only on specially programmed devices).
— HDLC/SDLC (all channels supported at 2 Mbps)
— HDLC bus (implements an HDLC-based local area network (LAN))
— Asynchronous HDLC to support PPP (point-to-point protocol)
— AppleTalk
— Universal asynchronous receiver transmitter (UART)
— Synchronous UART
— Serial infrared (IrDA)
— Binary synchronous communication (BISYNC)
— Totally transparent (bit streams)
— Totally transparent (frame based with optional cyclic redundancy check (CRC))
Two SMCs (serial management channels)
— UART
— Transparent
— General circuit interface (GCI) controller
— Can be connected to the time-division multiplexed (TDM) channels
One SPI (serial peripheral interface)
— Supports master and slave modes
— Supports multimaster operation on the same bus
One I 2 C (inter-integrated circuit) port
— Supports master and slave modes
— Multiple-master environment support
Time-slot assigner (TSA)
— Allows SCCs and SMCs to run in multiplexed and/or non-multiplexed operation
— Supports T1, CEPT, PCM highway, ISDN basic rate, ISDN primary rate, user
defined
— 1- or 8-bit resolution
— Allows independent transmit and receive routing, frame synchronization,
clocking
— Allows dynamic changes
— Can be internally connected to six serial channels (four SCCs and two SMCs)
Parallel interface port (PIP)
— Centronics interface support
— Supports fast connection between compatible ports on the MPC860 or the
MC68360
PCMCIA interface
— Master (socket) interface, release 2.1 compliant
— Supports two independent PCMCIA sockets
— Eight memory or I/O windows supported
Low power support
— Full on—all units fully powered
— Doze—core functional units disabled, except time base decrementer, PLL,
memory controller, RTC, and CPM in low-power standby
— Sleep—all units disabled, except RTC and PIT, PLL active for fast wake up
— Deep sleep—all units disabled including PLL, except RTC and PIT
— Power down mode— all units powered down, except PLL, RTC, PIT, time base,
and decrementer
Debug interface
— Eight comparators: four operate on instruction address, two operate on data
address, and two operate on data
— Supports conditions: = ≠ < >
— Each watchpoint can generate a break-point internally
3.3 V operation with 5-V TTL compatibility except EXTAL and EXTCLK
357-pin ball grid array (BGA) package
This is an Audio DSP chip from the early 90’s, used for sound effects in audio mixing consoles. Unfortunately I couldn’t find much info on these.
TMS57002 Die
The die is massive, 10mm square at least. Interestingly, the markings on the die indicate it’s a TMS67002, maybe there was a different internal software version for the 57002 with fewer features, that used the same Silicon? In the centre of this die, there’s an area that looks like mask ROM, with the individual memory bits visible.
This camera has now been retired after many years of heavy use. Exposure to a 3-year old has caused severe damage to the lens mechanism, which no longer functions correctly.
Rear Panel
Pretty much standard interface for a digital camera, with a nice large LCD for it’s time.
Front Cover Removed
With the front cover removed, the lens assembly & battery compartment is exposed.
Rear Cover Removed
Removing the rear cover exposes the LCD module & the main PCB, the interface tactile switches are on the right under a protective layer of Kapton tape.
Main Chipset
Flipping the LCD out of it’s mounting bracket reveals the main camera chipset. The CPU is a NovaTek NT96432BG, no doubt a SoC of some kind, but I couldn’t find any information. Firmware & inbuilt storage is on a Hynix HY27US08561A 256MBit NAND Flash, with a Hynix HY5DU561622FTP-D43 256Mbit DRAM for system memory.
I couldn’t find any info on the other two chips on this side of the board, but one is probably a motor driver for the lens, while the other must be the front end for the CCD sensor input to the SoC.
Main PCB Reverse
The other side of the PCB handles the SD card slot & power management. All the required DC rails are provided for by a RT9917 7-Channel DC-DC converter from RichTek, an IC designed specifically for digital camera applications.
Top left above the SD card slot is the trigger circuitry for the Xenon flash tube & the RTC backup battery.
Main PCB Removed
Once the main PCB is out of the frame, the back of the lens module with the CCD is accessible. Just to the left is the high-voltage photoflash capacitor, 110µF 330v. These can give quite the kick when charged! Luckily this camera has been off long enough for the charge to bleed off.
Sensor
Finally, here’s the 7-Megapixel CCD sensor removed from the lens assembly, with it’s built in IR cut filter over the top. I couldn’t find any make or model numbers on this part, as the Aluminium mounting bracket behind is bonded to the back of the sensor with epoxy, blocking access to any part information.
Die images of the chipset to come once I get round to decapping them!
As I’ve been posting some photos of decapped ICs lately, I thought I’d share the process I use personally for those that might want to give it a go 😉
The usual method for removing the epoxy package from the silicon is to use hot, concentrated Nitric Acid. Besides the obvious risks of having hot acids around, the decomposition products of the acid, namely NO² (Nitrogen Dioxide) & NO (Nitrogen Oxide), are toxic and corrosive. So until I can get the required fume hood together to make sure I’m not going to corrode the place away, I’ll leave this process to proper labs ;).
The method I use is heat based, using a Propane torch to destroy the epoxy package, without damaging the Silicon die too much.
TMS57002 Audio DSP
I start off, obviously, with a desoldered IC, the one above an old audio DSP from TI. I usually desolder en-masse for this with a heat gun, stripping the entire board in one go.
FLAMES!
Next is to apply the torch to the IC. A bit of practice is required here to get the heat level & time exactly right, overheating will cause the die to oxidize & blacken or residual epoxy to stick to the surface.
I usually apply the torch until the package just about stops emitting it’s own yellow flames, meaning the epoxy is almost completely burned away. I also keep the torch flame away from the centre of the IC, where the die is located.
Breathing the fumes from this process isn’t recommended, no doubt besides the obvious soot, the burning plastic will be emitting many compounds not brilliant for Human health!
Once the IC is roasted to taste, it’s quenched in cold water for a few seconds. Sometimes this causes such a high thermal shock that the leadframe cracks off the epoxy around the die perfectly.
All Your Die Belong To Us
Now that the epoxy has been destroyed, it breaks apart easily, and is picked away until I uncover the die itself. (It’s the silver bit in the middle of the left half). The heat from the torch usually destroys the Silver epoxy holding the die to the leadframe, and can be removed easily from the remaining package.
Decapped
BGA packages are usually the easiest to decap, flip-chip packages are a total pain due to the solder balls being on the front side of the die, I haven’t managed to get a good result here yet, I’ll probably need to chemically remove the first layer of the die to get at the interesting bits 😉
Slide
Once the die has been rinsed in clean water & inspected, it’s mounted on a glass microscope slide with a small spot of Cyanoacrylate glue to make handling easier.
Some dies require some cleaning after decapping, for this I use 99% Isopropanol & 99% Acetone, on the end of a cotton bud. Any residual epoxy flakes or oxide stuck to the die can be relatively easily removed with a fingernail – turns out fingernails are hard enough to remove the contamination, but not hard enough to damage the die features.
Once cleaning is complete, the slide is marked with the die identification, and the photographing can begin.
Microscope Mods
I had bought a cheap eBay USB microscope to get started, as I can’t currently afford a proper metallurgical microscope, but I found the resolution of 640×480 very poor. Some modification was required!
Modified Microscope
I’ve removed the original sensor board from the back of the optics assembly & attached a Raspberry Pi camera board. The ring that held the original sensor board has been cut down to a minimum, as the Pi camera PCB is slightly too big to fit inside.
The stock ring of LEDs is run direct from the 3.3v power rail on the camera, through a 4.7Ω resistor, for ~80mA. I also added a 1000µF capacitor across the 3.3v supply to compensate a bit for the long cable – when a frame is captured the power draw of the camera increases & causes a bit of voltage drop.
The stock lens was removed from the Pi camera module by careful use of a razor blade – being too rough here *WILL* damage the sensor die or the gold bond wires, which are very close to the edge of the lens housing, so be gentle!
Mounting Base
The existing mount for the microscope is pretty poor, so I’ve used a couple of surplus ceramic ring magnets as a better base, this also gives me the option of raising or lowering the base by adding or removing magnets.
To get more length between the Pi & the camera, I bought a 1-meter cable extension kit from Pi-Cables over at eBay, cables this long *definitely* require shielding in my space, which is a pretty aggressive RF environment, or interference appears on the display. Not surprising considering the high data rates the cable carries.
The FFC interface is hot-glued to the back of the microscope mount for stability, for handheld use the FFC is pretty flexible & doesn’t apply any force to the scope.
Die Photography
Since I modified the scope with a Raspberry Pi camera module, everything is done through the Pi itself, and the raspistill command.
Pi LCD
The command I’m currently using to capture the images is:
raspistill -ex auto -awb auto -mm matrix -br 62 -q 100 -vf -hf -f -t 0 -k -v -o CHIPNAME_%03d.jpg
This command waits between each frame for the ENTER key to be pressed, allowing me to position the scope between shots. Pi control & file transfer is done via SSH, while I use the 7″ touch LCD as a viewfinder.
The direct overhead illumination provided by the stock ring of LEDs isn’t ideal for some die shots, so I’m planning on fitting some off-centre LEDs to improve the resulting images.
Image Processing
Obviously I can’t get an ultra-high resolution image with a single shot, due to the focal length, so I have to take many shots (30-180 per die), and stitch them together into a single image.
For this I use Hugin, an open-source panorama photo stitching package.
Hugin
Here’s Hugin with the photos loaded in from the Raspberry Pi. To start with I use Hugin’s built in CPFind to process the images for control points. The trick with getting good control points is making sure the images have a high level of overlap, between 50-80%, this way the software doesn’t get confused & stick the images together incorrectly.
Optimiser
After the control points are generated, which for a large number of high resolution images can take some time, I run the optimiser with only Yaw & Pitch selected for all images.
Optimising
If all goes well, the resulting optimisation will get the distance between control points to less than 0.3 pixels.
Panorama Preview
After the control points & optimisation is done, the resulting image can be previewed before generation.
Texas Instruments TMS67002
After all the image processing, the resulting die image should look something like the above, with no noticeable gaps.
This particular IC came out of a very old VHF band radio, from the early 90’s. The die was encased in a custom ceramic package, like every other IC in the radio, with a custom part number. I managed to identify it from the markings on the silicon.
Motorola MC68HC11L6
This was a pretty powerful MCU for it’s time, with 16K of onboard ROM, 512 bytes of both RAM & EEPROM, a 16-bit timer, 8-bit ADC, SPI & a MC68HC11 CPU core.
I’ve been working on something new for the blog, as I have a massive collection of scrap ICs – that is to decap the silicon & get them under a microscope!
Here’s the first image, a Texas Instruments part. This has been stitched together from 140 separate images to create the final version.
As the CO meter I bought on eBay didn’t register anything whatsoever, I decided I’d hack the sensor itself apart to make sure it wasn’t just an empty steel can. It turns out that it’s not just an empty can, but there are some reasons why the thing doesn’t work 😉
Cell Disassembled
The cell was crimped together under the yellow shrinkwrap, but that’s nothing my aviation snips couldn’t take care of. The photo above shows the components from inside.
End Cap
The endcap is just a steel pressing, nothing special here.
Filter
Also pretty standard is the inlet filter over the tiny hole in the next plate, even though it’s a lot more porous that I’ve seen before in other sensors.
Working Electrode Components
Next up is the working electrode assembly, this also forms the seal on the can when it’s crimped, along with insulating it from the counter electrode & external can. The small disc third from left is supposed to be the electrode, which in these cells should be loaded with Platinum. Considering where else they’ve skimped in this unit, I’ll be very surprised if it’s anything except graphite.
Counter Electrode
Next up is the counter electrode, which is identical to the first, working electrode. Again I doubt there’s any precious metals in here.
Backplate
Another steel backplate finishes off the cell itself, and keeps most of the liquid out, just making sure everything stays moist.
Rear Can & Reservoir
Finally, the rear of the cell holds the reservoir of liquid electrolyte. This is supposed to be Sulphuric Acid, but yet again they’ve skimped on the cost, and it’s just WATER.
It’s now not surprising that it wouldn’t give me any readings, this cell never would have worked correctly, if at all, without the correct electrolyte. These cheap alarms are dangerous, as people will trust it to alert them to high CO levels, when in fact it’s nothing more than a fancy flashing LED with an LCD display.
Ironically enough, when I connected a real electrochemical CO detector cell to the circuit from the alarm, it started working, detecting CO given off from a burning Butane lighter. It wouldn’t be calibrated, but it proves everything electronic is there & operational. It’s not surprising that the corner cut in this instance is on the sensor cell, as they contain precious metals & require careful manufacturing it’s where the cost lies with these alarms.
I was looking around eBay for decent deals on a branded CO alarm, and came across these for next to no money, so I thought I’d grab one just to see how bad they could be.
Alarm Opened
Popping the casing open shows the very small circuit board inside, with the CO sensor cell on the right. I can’t find any manufacturer information on this cell, nor can I find a photo of anything similar on the intertubes, so no specifications there. The other parts are pretty standard, a Piezo sounder & it’s associated step-up transformer to increase the loudness.
Sensor Closeup
The sensor cell has the usual opening in the end to allow entry of gas.
Main PCB
The other side of the board doesn’t reveal much, just an LCD, a couple of LEDs, a pair of transistors, Op-Amp for the sensor & a main microcontroller.
MCU
The microcontroller isn’t marked unfortunately. It’s not had the number scrubbed off, it’s just never been laser marked with a part number. Above the micro is a SOT-23 LM321 low-power Op-Amp which does the signal conditioning for the CO sensor.
I tried to make this alarm trigger with the exhaust from the Eberspacher heater, which on a well-made branded alarm registered a reading of 154ppm after a few minutes. In the case of this alarm though, I couldn’t make it trigger at all, no matter how long I exposed it to hydrocarbon exhaust gases. I won’t be trusting this one then!
Nothing quite like a piece of safety equipment that doesn’t work correctly from new!
I did a little more digging into the PSU circuitry of the small coin counting machine, and it’s even more strange than I thought!
The part I originally thought was a transformer on the PSU board is in fact a DC-DC converter module!
DC-DC Converter
Here’s the device after desoldering it from the PCB. It turns out that instead of a transformer, it’s an inductor.
Hiding Control Electronics
Underneath is the controller electronics, with an COB controller & the switching transistors are under a protective covering of silicone.
Mains Transformer
Driving this whole lot of PSU randomness is the mains transformer, with a secondary voltage of 35v.
The only reason I can think of that the manufacturer went to this much expense with the power supply is stability – a coin counting machine that miscounts due to power supply surges, sags & spikes wouldn’t be very much use. It’s not likely I’ll see anything similar again, unless I manage to get hold of something like medical grade equipment.
Here’s some teardown photos of an old De La Rue coin counter, used in businesses for rapid counting of change into large bags.
Mechanism
An overview of the whole mechanical system of the counter. Coins are loaded into the drum at the rear of the machine, which sorts them into a row for the rubber belt to pick up & run through the counter. The coin type to be sorted is selected by turning the control knobs on the right.
The control knobs adjust the width & height of the coin channel so only the correct sized coins will be counted.
PSU & Switching
The counter is driven by a basic AC induction motor, the motor power relay & reversing relay is on this PCB, along with the 5v switching supply for the main CPU board.
The SMPS on this board looks like a standard mains unit, but it’s got one big difference. Under the frame next to the main motor is a relatively large transformer, with a 35v output. This AC is fed into the SMPS section of the PSU board to be converted to 5v DC for the logic.
I’m not sure why it’s been done this way, and have never seen anything similar before.
The edge of the coin channel can be seen here, the black star wheel rotates when a coin passes & registers the count.
Controller PCB
Here’s the main controller PCB, IC date codes put the unit to about 1995. The main CPU is a NEC UPD8049HC 8-bit micro, no flash or EEPROM on this old CPU, simply mask ROM. Coin readout is done on the 4 7-segment LED displays. Not much to this counter, it’s both electronically & mechanically simple.
Counter Sensor
Coin counting is done by the star wheel mentioned above, which drives the interrupter disc on this photo-gate. The solenoid locks the counter shaft to prevent over or under counting when a set number of coins is to be counted.
Motor Run Capacitor
Under the frame, here on the left is the small induction motor, only 6W, 4-pole. The run cap for the motor is in the centre, and the 35v transformer is just visible behind it.
Main Motor Drive
Main drive to the coin sorting mech is through rubber belts, and bevel gears drive the coin drum.
Here’s an old HDSPA 3G USB modem stick that I got with a mobile phone contact many years ago. As it’s now very old tech, and I have a faster modem, not to mention that I’m no longer with Orange (Robbing <expletive>), here’s a teardown of the device!
Cover Removed
The top shell is just clipped into place, while a pair of very small screws hold down the orange piece at left to hold the PCB stack in the casing. Not much to see here, but it’s clear that there’s a lot crammed into a very small space.
PCB Assembly
Here’s the PCB stack removed from the outer casing. The main antenna is on the right, attached with another small screw. Every IC on the boards is covered with an RF can. No problems there, pliers to the rescue!
SD Card Slot
Here’s the top PCB, all the shields have been removed. On the left is a Qualcomm PM6658 Power Management IC with integrated USB transceiver. This is surrounded by many of the power management circuits.
The integrated SD Card slot is on the right side. with what looks to be a local switching regulator for supply voltage. This might also provide the SIM card with it’s power supply.
PSU & SIM Contacts
The other side of the top board reveals more power management, with another switching regulator, and a truly massive capacitor at the top edge. I’m guessing this is a solid Tantalum.
Main Chipset PCB
The other PCB holds the main chipset & RF circuits. On the left here is a Samsung MCP K5D1G13ACH IC. This one is a multiple chip package, having 1Gbit of NAND Flash & 512Mbit of mobile SDRAM.
To it’s right is a Qualcomm RTR6285 RF Transceiver. This IC supports multiband GSM/EDGE/UMTS frequencies & also has a GPS receive amplifier included.
At bottom right is an Avago ACPM7371 Wide-Band 4×4 CDMA Power Amplifier. The external antenna connector is top right.
Main Chipset PCB Reverse
On the other side of the main PCB is a Qualcomm MSM6246 Baseband processor. Not sure about this one as I can’t find anything resembling a datasheet. Another micro-coax connector is in the centre, probably for factory test purposes, as it’s not accessible from the outside.
Just above the coax connector is a Qorvo RF1450 SP4T (single-pole 4-throw) High Power (34.5dBm) GSM RF Switch.
Upper right is an Avago FEM-7780 UMTS2100 4×7 Front End Module.
Under that is an RFMD RF3163 Quad-Band RF Power Amplifier Module.
One of the central parts to the Eberspacher-type evaporative burner is the wire mesh screen that surrounds the glowplug, where the incoming fuel is heated to vapour before it’s blown into the combustion chamber & burned.
These screens, like glowplugs in the older heaters, are consumable parts and either get clogged with soot/tar or just eventually burn away.
The problem is that these parts (for what they are at least) are bloody expensive, so I’ve been looking to come up with something that can serve as a decent replacement for much lower cost.
OEM Screen
Here’s a slightly used screen from my D1LCC heater, as can be seen the lower edge is already burning away even after only a few hours use. This edge tends to burn as the screen projects into the combustion chamber by about 1/4″, so it’s exposed to higher temperatures there. The rest of the screen is covered by the alloy casting that holds the burner. The mesh itself is stainless steel, and looks like something between 120-150 mesh.
The mesh is wound 2-3 turns, and spot welded to hold everything together. I would imagine to give more surface area for fuel vaporization. An unfortunate side effect of this is that the screen is much more susceptible to clogging as the mesh size is effectively reduced.
This also makes them damn near impossible to clean, as the carbon deposits get stuck between the layers in the screen. Applying a blowtorch flame to the entire screen & heating it to orange heat (~1200°C) does burn most of the crap out of them. Running Paraffin/Kerosene as the fuel also makes for a much cleaner burn, extending life.
(Assuming of course that the screen can be removed without totally destroying it – in my experience after many hours of running they seize in place & require sharp implements, violence & much swearing to remove, in several pieces.)
I had some copper mesh spare from a previous project, around the correct mesh size, so I figured I’d cut a piece to the same size as the official mesh & give it a go in the heater.
DIY Screen
Here’s my single-layer DIY screen after a couple of hours operation in the heater. Ignition time doesn’t seem to be impaired, there’s no smoke from the exhaust, and it appears that it’s staying cleaner than an OEM screen, since the mesh size is a little larger. I’ll have to monitor the situation & see how long these last, but if it’s anything close to the OEM screen life it’ll make maintenance much cheaper.
Fuel Inlet
This is the opening that holds the glowplug & it’s screen. The fuel inlet can be seen on the left wall of the chamber, with a circular groove that feeds fuel onto the screen in operation.
DIY Screen Fitted
And here’s the DIY screen in place, it’s obviously not as good a fit as the OEM version, but it’s sufficient to do the job!
Glowplug
Finally, here’s the glowplug itself. Possibly the beefiest plug I’ve ever seen, even in large diesel engines.
These units are used to broadcast local audio, such as from a public address system or local microphone. They accomplish this by producing a modulated magnetic field that a hearing aid is capable of picking up.
Back Panel
Not many controls on this bit of equipment. A bi-colour LED for status indications, a microphone, external audio input, charging input & a power switch.
Internals
Popping the cover off reveals a small lead-acid battery, 2.1Ah at 12v. This is used when the loop is unplugged.
Main PCB
Here’s the main PCB, which takes care of the audio & battery charging. The inductive loop itself is just visible as the tape-covered wire bundle around the edge of the casing.
Audio & Power Input
Here’s the input section of the main PCB. The microphone input is handled by a SSM2166 front-end preamplifier from Analog Devices.
Power Amplifier
This audio is then fed into a TDA2003 10W Mono Power Amplifier IC, which directly drives the induction coil as if it were a speaker. Any suitable receiving coil & amplifier can then receive the signal & change it back into audio.
I have yet another receipt printer, this one appears to be brand new. It’s possibly the smallest thermal 80mm printer I have at the moment, and has both USB & Serial interfaces.
Controller PCB
There’s not much to these printers at all. Removing a single screw allows the case halves to separate, showing the guts. The controller is based around a Texas Instruments TMS320VC5509AFixed-Point DSP. It’s associated Flash ROM & RAM are to the right.
Power supply is dealt with in the top right of the PCB, with the interface ports further left.
Print Head
Here’s the thermal mechanism itself, with the large print head. The stepper motor to drive the paper through the printer is just peeking out at top right. The paper present sensor is just under the left hand side of the print head.
For as long as I can remember I’ve been using Trangia-type alcohol fuelled stoves when I go camping, even though these have served my needs well they’re very limited & tend to waste fuel. I did some looking around for Paraffin/Kerosene fuelled stoves instead, as I already have this fuel on site.
I found very good reviews on the Optimus Nova above, so I decided to go for this one.
This stove can run on many different fuel types, “white gas” (petrol without any vehicle additives) Diesel, Kerosene & Jet A.
Burner
Here’s the “hot end” of the device, the burner itself. This is made in two cast Brass sections, that are brazed together. The fuel jet can be just seen in the centre of the casting.
Fuel Pump
The fuel bottle is pressurised with a pump very similar to the ones used on Paraffin pressure lamps, so I’m used to this kind of setup. The fuel dip tube has a filter on the end to stop any munge gumming up the valves or the burner jet.
Pre-Heating
As with all liquid-fuelled vapour burners, it has to be preheated. There’s a fibreglass pad in the bottom of the burner for this, and can be soaked with any fuel of choice. The manual states to preheat with the fuel in the bottle, but as I’m using Paraffin, this would be very smoky indeed, so here it’s being preheated with a bit of Isopropanol.
The fuel bottle can be seen in the background as well, connected to the burner with a flexible hose. The main burner control valve is attached to the green handle bottom centre.
Simmer
Once the preheating flame has burned down, the fuel valve can be opened, here’s the stove burning Paraffin on very low simmer. (An advantage over the older alcohol burners I’m used to – adjustable heat!)
Full Power!
Opening the control valve a couple of turns gives flamethrower mode. At full power, the burner is a little loud, but no louder than my usual Paraffin pressure lamps.
Flame Pattern
With a pan of water on the stove, the flame covers the entire base of the pan. Good for heat transfer. This stove was able to boil 1L of water from cold in 5 minutes. A little longer than the manual states, but that’s still much quicker than I’m used to!
Fuel Jet
The top of the burner opens for cleaning, here’s a look at the jet in the centre of the burner. The preheating pad can be seen below the brass casting.
A lot of the electronics I use & projects I construct use batteries, mainly of the lithium variety. As charging this chemistry can be a little explosive if not done correctly, I decided a proper charger was required. This charger is capable of handling packs up to 6 cells for Lithium, and up to 20v for lead-acids.
External Connections
The usual DC input barrel jack on the left, with an external temp sensor for fast charging NiCd/NiMH chemistry batteries. The µUSB port registers under Linux as USB HID, probably so drivers aren’t required. Unfortunately the software is Windows only, but it doesn’t provide anything handy like charging graphs or stats. Just a way to alter settings & control charging from a PC. On other versions of this charger there’s a setting to change the temp sensor port into a TTL serial output, which would be much handier.
Output & Balance
The other side of the charger has the main DC output jacks & the pack balancing connections.
Cover Removed
Here’s the top cover removed from the charger, showing most of the internals. A standard HD44780 LCD provides the user interface, the CPU & it’s associated logic is hidden under there somewhere.
The PCB has nice heavy tracks to handle the 6A of current this charger is capable of.
Balancing Network
The output side of the board. Here the resistive pack balancing network can be seen behind the vertical daughter board holding the connectors, along with the output current shunt between the DC output banana jacks & the last tactile button.
Main Logic
Unfortunately the LCD is soldered directly to the board, and my desoldering tool couldn’t quite get all the solder out, so time to get a bit violent. I’ve gently bent the header so I could see the brains of the charger. The main CPU is a Megwin MA84G564AD48, which is an Intel 8081 clone with USB support. Unfortunately I was unable to find a datasheet for this part, and the page on Megwin’s site is Chinese only.
I was hoping it was an ATMega328, as I have seen in other versions of this charger, as there are custom firmwares available to increase the feature set of the charger, but no dice on this one. I do think the µUSB port is unique to this version though, so avoiding models with that port probably would get a hackable version.
There’s some glue logic for controlling the resistor taps on the balancing network, and a few op-amps for voltage & current readings.
Power Switching Devices
All the power diodes & switching FETs for the DC-DC converter are mounted on the bottom of the PCB, and clamped against the aluminium casing when the PCB is screwed down. Not the best way to ensure great contact, but Chinese tech, so m’eh.
It’s well known that there are two versions of the 701 type controller available for Eberspacher heaters, the version with the blue logo is the official un-restricted model, while the version with the white logo is a version built for BT that restricts the heater to 1 hour runtime & has no diagnostics built in.
As these devices are microcontroller driven, I assumed that the hardware would be the same, only the code running in the micro being the bit that Eberspacher changed. This option would certainly have been the lowest cost.
Controller PCB Rear
Here’s the PCB removed from the plastic housing. There are definitely some differences that I can tell. As the un-restricted version has an extra wire for the diagnostic serial interface, and this board has no unpopulated parts, the PCB is definitely a different version.
In the centre is a Microchip PIC16C622 microcontroller, the OTP version in this case for cost reductions. (I may try reading the binary from this chip in the future, chances are it’s code protected though).
Below the micro is an NXP PCF8577C 32-segment LCD controller, this has an I²C interface to the PIC.
The temperature control function on these heaters is done via applying a resistance to one of the control lines, between 1750Ω-2180Ω, ±80Ω. (Very odd values these, not to mention no standard components can create this range easily, bloody engineers >_<). This is accomplished in hardware with a BU2092F I²C shift register from Rohm, which is connected to a bank of resistors. The microcontroller will switch combinations of these into the circuit to get the range of resistances required.
The rest of the circuit is local power regulation & filtering.
Controller PCB Front
There’s not much on the other side of the PCB, just the LCD itself & the contacts for the buttons.
Tip Jar
If you’ve found my content useful, please consider leaving a donation by clicking the Tip Jar below!
All collected funds go towards new content & the costs of keeping the server online.
