Posted on Leave a comment

Turbine Fuel Pump Extreme Teardown

Turbine Fuel Pump
Turbine Fuel Pump

Here’s a destructive teardown of an automotive in-tank turbine fuel pump, used on modern Petrol cars. These units sit in the tank fully immersed in the fuel, which also circulates through the motor inside for cooling. These pumps aren’t serviceable – they’re crimped shut on both ends. Luckily the steel shell is thin, so attacking the crimp joint with a pair of mole grips & a screwdriver allowed me inside.

End Bell
End Bell

The input endbell of the pump has the fuel inlet ports, the channels are visible machined into the casting. There’s a pair of channels for two pump outputs – the main fuel rail to the engine, and an auxiliary fuel output to power a venturi pump. The fuel pump unit sits inside a swirl pot, which holds about a pint of fuel. These are used to ensure the pump doesn’t run dry & starve the engine when the tank level is low & the car is being driven hard. The venturi pump draws fuel from the main tank into the swirl pot. A steel ball is pressed in to the end bell to provide a thrust bearing for the motor armature.

Turbine Impeller
Turbine Impeller

The core of the pump is this impeller, which is similar to a side-channel blower. From what I’ve been able to find these units supply pressures up to about 70PSI for the injector rail. The outside ring is the main fuel pump, while the smaller inner one provides the pressure to run the venturi pump.

Pump Housing
Pump Housing

The other side of the machined pump housing has the main output channel, with the fuel outlet port at the bottom. The motor shaft is supported in what looks like a carbon bearing.

Midsection
Midsection

Removing the pump intermediate section with the bearing reveals quite a bit of fungus – it’s probably been happy sat in here digesting what remains of the fuel.

Armature Exposed
Armature Exposed

Some peeling with mole grips allows the motor to come apart entirely. The drive end of the armature is visible here.

Motor Can
Motor Can

The outer shell of the motor holds yet more fungus, along with some rust & the pair of ceramic permanent magnets.

Brushes
Brushes

The other end of the pump has the brush assembly, and the fuel outlet check valve to the right. The bearing at this end is just the plastic end cap, since there are much lower forces at this end of the motor. The fuel itself provides the lubrication required.

Potted Armature
Potted Armature

With the armature pulled out of the housing, it’s clear that there’s been quite a bit of water in here as well, with the laminations rusting away. This armature is fully potted in plastic, with none of the copper windings visible.

Carbon Commutator
Carbon Commutator

The commutator in these motors is definitely a strange one – it’s axial rather than radial in construction, and the segments are made of carbon like the brushes. No doubt this is to stop the sparking that usually occurs with brushed motors – preventing ignition of fuel vapour in the pump when air manages to get in as well, such as in an empty tank.

Posted on 5 Comments

Vodafone Mobile WiFi R207 Teardown

Vodafone Mobile WiFi R207
Vodafone Mobile WiFi R207

Here’s one of the old modems from my spares bin, a Vodafone Mobile WiFi R207. This is just a rebranded Huawei E5330. This unit includes a 3G modem, and a WiFi chipset, running firmware that makes this a mini-router, with NAT.

Specs
Specs

The back has the batter compartment & the SIM slot, with a large label showing all the important details.

Cover Removed
Cover Removed

A couple of small Torx screws later & the shell splits in half. All the electronics are covered by shields here, but luckily they are the clip-on type, and aren’t soldered direct to the PCB.

Chipset
Chipset

Once the shield has been removed, the main chipset is visible underneath. There’s a large Spansion MS01G200BHI00 1GBit flash, which is holding the firmware. Next to that is the Hi6758M baseband processor. This has all the hardware required to implement a 3G modem. Just to the right is a Hi6521 power management IC, which is dealing with all the power supplies needed by the CPU.
The RF section is above the baseband processor, some of which is hiding under the bits of the shield that aren’t removable.

SIM Socket
SIM Socket

There’s a socket onboard for a standard Mini-SIM, just to the left of that is a Hi6561 4-phase buck converter. I would imagine this is providing the power supplies for the RF section & amplifier.

Unpopulated Parts
Unpopulated Parts

Not sure what this section is for, all the parts are unpopulated. Maybe a bluetooth option?

PCB Reverse
PCB Reverse

The other side of the PCB is pretty sparse, holding just the indicator LEDS, button & the WiFi Chipset.

Realtek WiFi Chipset
Realtek WiFi Chipset

The chipset here is a Realtek part, but it’s number is hidden by some of the shield. The antenna connection is routed to the edge of the board, where a spring terminal on the plastic case mounted antenna makes contact.

Posted on Leave a comment

BluVision Bluetooth Low Energy Beacon

Violent Disassembly
Violent Disassembly

These photos were sent over to me by a friend, an interesting piece of tech that’s used in the retail industry. This is a BluVision BLE Beacon, which as far as I can tell is used to provide some automated customer assistance. From their website it seems they can also be used for high-price asset protection & tracking. These units don’t appear to be serviceable, being completely sealed & only having a primary cell. I’m not sure what they cost but it seems to be an expensive way to contact clients with adverts etc.

Component Side
Component Side

There’s not much populated on this PCB, the main component here is the CC2640 SimpleLink ultra-low-power wireless microcontroller for Bluetooth Low Energy. It’s a fairly powerful CPU, with an ARM Cortex M3 core, 129KB of flash & up to 48MHz clock speed. There’s a couple of crystals, one of which is most likely a 32,768kHz low-power sleep watch crystal, while the other will be the full clock frequency used while it’s operating. Unfortunately I can’t make the markings out from the photos. There doesn’t appear to be any significant power supply components, so this must be running direct from the battery underneath.

2.2Ah 3.6v Lithium Cell
2.2Ah 3.6v Lithium Cell

The other side of the PCB has a single primary lithium cell, rated at 3.6v, 2.2Ah. The factory spec sheet specifies a 2.2 year life at 0dBm TX Power, Running 24/7, 100ms advertisement rate.

Posted on 5 Comments

EpEver Tracer 4210A MPPT Solar Charge Controller Teardown

Tracer 4210A MPPT Solar Controller
Tracer 4210A MPPT Solar Controller

Here’s the solar charge controller to go with the MT50 from the last post. This is the 40A version of the EpEver Tracer A series, the 4210A. This unit is large, and very heavy. Most of this weight comes from the enormous heatsink which doubles as the mounting plate for all the other components, and the large inductors that are going to be required for the DC-DC conversion that MPPT requires.

Front Panel
Front Panel

The front panel has a basic LCD, which shows various stats, such as PV Volts & Amps, and battery bank Volts & Amps. The pair of buttons are used to navigate the basic menu to configure some options, along with switching the load terminals ON/OFF.

Specifications
Specifications

There’s a specs label on the top, with a slight difference here vs the manual, which states the max. PV volts as 92v.

Main PCB Overview
Main PCB Overview

Removing 4 machine screws from the bottom of the unit allows the top to come off. Like the MT50 remote panel, this unit also has moulded-in brass thread inserts in the plastic parts. The PCB in here is heavily comformal coated, which stops me from reading the laser-etched numbers on the semiconductor devices, so there will be few details there.

Main PCB Lower
Main PCB Lower

Here’s the bottom section of the main PCB, with the enormous screw terminals, which will easily take cables up to about 16mm². The RJ-45 jack which hosts the unit’s RS-485 bus is to the right, and a smaller 2-pin connector on the left sorts out the battery temperature sensor.
The DC output MOSFET switches are hiding just behind the right-hand terminals, there’s a pair of them in this unit to handle the output current. Some beefy diodes polarity-protect both the battery & PV inputs.

Board Centre
Board Centre

Moving up the board shows two 35A automotive blade fuses soldered into the board – these would be a real pain to replace if they ever blew, however with the electronic load current protection built into this unit, it’s an unlikely situation, unless something went hideously wrong. The main switching devices for the DC-DC converter are hidden – they’re clamped to the heatsink with the bars at right angles in the photo, I’m not going to dig any deeper into this just for those though – they’re just TO220 devices.
Under a load of thermal gunk on the right are 4 current shunt resistors, and the amplifiers for reading their values. These 1206-size SMD resistors looked a bit small for the power rating to me, but they’re heatsinked in operation to a small heatsink mounted in the top cover.

Board Upper
Board Upper

The upper section of the PCB hosts the main microcontroller, and the connections over to the front panel LCD & buttons. Couldn’t really get much info from these chips, due to the conformal coating.

Toroidal Inductors
Toroidal Inductors

Right at the top of the unit are these toroidal inductors, potted into aluminium housings. The copper windings of these is very heavy – at least 2.5mm². They’re electrically in parallel, the 20A version would only have a single inductor.

Current Shunt Heatsink
Current Shunt Heatsink

This small heatsink sits inside the top cover, and provides some cooling to the current shunts.

Display Board
Display Board

Not much to say for the display board, there’s going to be nothing here apart from an I²C LCD driver & the pair of front panel buttons, so I won’t bother removing this from the case.

Posted on 2 Comments

EpEver MT50 Control Panel Teardown

MT50 Control Panel
MT50 Control Panel

Here’s the MT50 controller from EpEver, that interfaces with it’s Tracer MPPT solar charge controllers, and gives access to more programming options on the charge controllers, without the need for a laptop. The display is a large dot-matrix unit, with built in backlight. Above is the display on the default page, showing power information for the entire system.

PCB Rear
PCB Rear

The rear plastic cover is held in place by 4 machine screws, which thread into brass inserts in the plastic frame – nice high quality touch on the design here, no cheap self tapping plastic screws. Both power & data arrive via an Ethernet cable, but the communication here is RS-485, and not compatible with Ethernet! The PCB is pretty sparse, with comms & power on the left, LCD connection in the centre, and the microcontroller on the right.

RS-485 Transceiver
RS-485 Transceiver

On the left of the board is the RS0485 transceiver, and a small voltage regulator. There’s also a spot for a DC barrel jack, which isn’t included in this model for local power supply.

STM32 Microcontroller
STM32 Microcontroller

The other side of the board holds the main microcontroller which communicates with the charge controller. This is a STM32F051K8 from ST Microelectronics. With a 48MHz ARM Cortex M0 core, and up to 64K of flash, this is a pretty powerful MCU that has very little to do in this application.

PCB Front
PCB Front

The front of the PCB has the ENIG contacts of the front panel buttons, and the LCD backlight assembly. There’s nothing else under the plastic backlight spreader either.

LCD Rear
LCD Rear

The front case holds the LCD module in place with glue, and the rubber buttons are placed underneath, which is heat staked in place.

LCD Model
LCD Model

The LCD is a YC1420840CS6 from eCen in China. Couldn’t find much out about this specific LCD.

Posted on 2 Comments

PowerAdd Pilot X7 20,000mAh Powerbank & Fast Charging Mod

PowerAdd Pilot X7
PowerAdd Pilot X7

Here’s the biggest portable USB powerbank I’ve seen yet – the PowerAdd Pilot X7, this comes with a 20Ah (20,000mAh) capacity. This pack is pretty heavy, but this isn’t surprising considering the capacity.

USB Ports & LED
USB Ports & LED

The front of the pack houses the usual USB ports, in this case rated at 3.4A total between the ports. There’s a white LED in the centre as a small torch, activated by double-clicking the button. A single click of the button lights up the 4 blue LEDs under the housing that indicate remaining battery capacity. Factory charging is via a standard µUSB connector in the side, at a maximum of 2A.

PCB Front
PCB Front

The front of the PCB holds the USB ports, along with most of the main control circuitry. At top left is a string of FS8025A dual-MOSFETs all in parallel for a current carrying capacity of 15A total, to the right of these is the ubiquitous DW01 Lithium-Ion protection IC. These 4 components make up the battery protection – stopping both an overcharge & overdischarge. The larger IC below is an EG1501 multi-purpose power controller.

This chip is doing all of the heavy lifting in this power pack, dealing with all the DC-DC conversion for the USB ports, charge control of the battery pack, controlling the battery level indicator LEDs & controlling the torch LED in the centre.

EG1501 Example
EG1501 Example

The datasheet is in Chinese, but it does have an example application circuit, which is very similar to the circuitry used in this powerbank. A toroidal inductor is nestled next to the right-hand USB port for the DC-DC converter, and the remaining IC next to it is a CW3004 Dual-Channel USB Charging Controller, which automatically sets the data pins on the USB ports to the correct levels to ensure high-current charging of the devices plugged in. This IC replaces the resistors R3-R6 in the schematic above.
The DC-DC converter section of the power chain is designed with high efficiency in mind, not using any diodes, but synchronous rectification instead.

PCB Back
PCB Back

The back of the PCB just has a few discrete transistors, the user interface button, and a small SO8 IC with no markings at all. I’m going to assume this is a generic microcontroller, (U2 in the schematic) & is just there to interface the user button to the power controller via I²C.

Cells
Cells

Not many markings on the cells indicating their capacity, but a full discharge test at 4A gave me a resulting capacity of 21Ah – slightly above the nameplate rating. There are two cells in here in parallel, ~10Ah capacity each.

XT60 Battery Connector
XT60 Battery Connector

The only issue with powerbanks this large is the amount of time they require to recharge themselves – at this unit’s maximum of 2A through the µUSB port, it’s about 22 hours! Here I’ve fitted an XT60 connector, to interface to my Turnigy Accucell 6 charger, increasing the charging current capacity to 6A, and reducing the full-charge time to 7 hours. This splits to 3A charge per cell, and after some testing the cells don’t seem to mind this higher charging current.

Battery Connector Wiring
Battery Connector Wiring

The new charging connector is directly connected to the battery at the control PCB, there’s just enough room to get a pair of wires down the casing over the cells.

Posted on Leave a comment

nb Tanya Louise – Oil Cooling Improvements

Temperature Gauges
Temperature Gauges

Since the engine & hydrostatic transmission were installed in the boat a few years back, the hydraulic oil cooler has been in the same fresh water circuit as the engine’s water cooling system, however this has been causing some heat issues with the engine & hydraulic system under a heavy load, such as when I’m using the onboard generator to run the welding gear. The hydraulic oil temp would rise to over 80°C during the course of a long day’s cruising – such temperatures will degrade the oil very quickly, and in turn will cause premature wear of the very expensive hydraulic pumps. (Not to mention increasing the requirement for hydraulic oil changes, which are very expensive). The engine oil has been cooled by a standard automotive oil radiator, with air forced over the matrix by two large fans. This is also pretty inefficient, so another cooler will be added to replace the automotive one.
This cooling requirement is caused by the inefficiency of hydraulic systems – a simple variable displacement piston pump driving a bent-axis piston motor has an overall efficiency of roughly 80%. Given our engine’s max power of 76HP (56.7kW), this gives an energy loss of 15.2HP (11.33kW) at maximum power. This extra heat overloaded the skin tank, resulting in a cooling system that didn’t really work all too well once the engine was hot.

To solve this issue, we’ve decided to run a raw water circuit using the canal to remove the waste heat from the hydraulic system & engine oil, putting less of a heat load on the skin tank to bring the temperatures down to something reasonable. The image above show the system at running temperature after I installed the monitoring instruments. The top gauge is measuring engine oil temperature, at the point where it’s being fed to the bearings. The bottom one is measuring hydraulic oil temperature.

The engine oil temperature does have to be higher than any other cooling circuit on board, to boil off any condensate from the cylinders. Overcooling the oil in the sump will eventually cause sludging as the oil tries to absorb the resulting water. I’m aiming for a system temperature in the engine oil circuit of 95°C-120°C when the engine is under load & at operating temperature.

Raw Water Suction
Raw Water Suction

Water from the canal is drawn from a skin fitting installed at the last drydock visit, pulling water through a strainer to remove all the large bits of muck. The large slotted screen on the suction skin fitting keeps larger objects out of the intake.

Raw Water Pump
Raw Water Pump

A flexible impeller pump provides the power to move water through the system, in this case about 25L/Min. This pump is a cheap copy of a Jabsco pump from eBay. So far it’s been pretty reliable.

Temperature Senders
Temperature Senders

The temperature senders are standard automotive parts, and some adaptors were required to graft them into the oil lines of both systems. The senser’s 1/8″ NPT threads are here fitted into 1/2″ BSP hydraulic fittings.

Hydraulic Temperature Sender
Hydraulic Temperature Sender

Here’s the hydraulic oil sender installed in the drain line from the main propulsion pump, this should give me a pretty good idea of the temperature of the components in the system, the sender is earthed through the steel hydraulic oil tank.

Engine Oil Temperature Sender
Engine Oil Temperature Sender

The oil temperature sender is installed in the return line to the engine from the heat exchanger. This is measuring the oil temperature the bearings in the engine are being fed with.

Hydraulic Oil Heat Exchanger
Hydraulic Oil Heat Exchanger

The stack of heat exchangers is located on the starboard side of the engine bay, the large one here is cooling the hydraulic oil, the auxiliary pump is continually circulating the oil from the tank through this, then into the return filter on the top of the tank.

Engine Oil Heat Exchanger
Engine Oil Heat Exchanger

The engine oil is fed through this much smaller heat exchanger mounted on the back of the large hydraulic cooler, the last in the circuit before the water is discharged back overboard through a skin fitting.

Remote Oil Filter
Remote Oil Filter

As we’ve got the diverter block on the side of the engine where the oil filter should be, a remote oil filter is fitted above the fuel tank. The thermostat strapped on operates the main engine bay ventilation fans, switching them on once the engine oil reaches 60°C.

Posted on Leave a comment

Blog Housekeeping & More Of The Same

Since I’ve been working on the backend servers a lot over the past few days, I’ve decided it was time to get some broken things on the blog fixed.

Firstly, the radiation monitor graphs. Originally I was using a Raspberry Pi to grab the data from the local monitor, and that was connecting via FTP to the server over in the datacentre to push it’s graph images. Since the server is now on the same local network as the monitor, there’s no need to faff about with FTP servers, so I’ve rejigged things with some perl scripts from cristianst85 over on GitHub, running on the web server itself.
I deviated from the suggested place to put the scripts on the server & opted to store everything within the Experimental Engineering hosting space, so it gets backed up at the same time as everything else on a nightly basis.

This is also accessible from the menu at top left, the script pulls data from the monitor & updates the images every 60 seconds via a cron job.

I’ve removed a couple of dead pages from the blog system, along with some backend tidying of the filesystem. Over the years things have gotten quite messy behind the scenes. This blog is actually getting quite large on disk, I’ve hit the 15GB mark, not including the database!

Caching is enabled for all posts on the blog now, this should help speed things up for repeat visitors, but as most of my content is (large) image based, this might be of limited help. I’m currently tuning the MySQL server for the load conditions, but this takes time, as every time I change some configuration settings I have to watch how things go for a few days, before tweaking some more.

Server Control Panels – More Of The Same

Sorry Sentora. I tried, and failed to convert over to using it as my new server control panel. Unfortunately it just doesn’t give me the same level of control over my systems, so I’ll be sticking with Virtualmin for the foreseeable future. Sentora stores everything in, (to me at least), very odd places under /var/ and gave me some odd results with “www.” versions of websites – some www. hosts would work fine, others wouldn’t at all & just redirect to the Sentora login interface instead. This wasn’t consistient between hosting accounts either, and since I didn’t have much time to get the migration underway, this problem was the main nail in the coffin.

Just storing everything under the sun in /var/ makes life a bit more awkward with the base CentOS install, as it allocates very little space to / by default, (no separate /var partition in default CentOS), giving most of the disk space to /home. Virtualmin on the other hand, stores website public files & Maildirs under /home, saving /var for MySQL databases & misc stuff.

The backup system provided is also utterly useless, there’s no restore function at all, and just piles everything in the account into a single archive. By comparison, Virtualmin has a very comprehensive backup system built in, that supports total automation of the process, along with full automatic restore functionality for when it’s needed.

Sentora did have some good points though:
It handled E-Mail logins & mail filters much more gracefully than Virtualmin does, and comes with Roundcube already built into the interface ready to use. With Virtualmin the options are to use the Usermin side of the system for E-Mail, which I find utterly awful to use, or install a webmail client under one of the hosted domains (my personal choice).
Mail filtering is taken care of with Sieve under Sentora, while Procmail does the job under Virtualmin.

Sentora does have a nicer, simpler, more friendly interface, but it hides most of the low-level system stuff away, while under Virtualmin *everything* on the system is accessible, and it provides control interfaces for all the common server daemons.

Posted on Leave a comment

Securing The New Server & Security In General

This was originally going to be part of another post, but it ended up getting more complex than I originally intended so it’s been given it’s own. I go into into many of my personal security practices, on both my public facing servers & personal machines. Since the intertubes are so central to life these days, good security is a must, especially since most people use the ‘net to do very sensitive operations, such as banking, it’s becoming even more essential to have strong security.

Since bringing the new server online & exposing it to the world, it’s been discovered in record time by the scum of the internet, SSH was under constant attack within 24 hours, and within that time there were over 20,000 failed login attempts in the logs.
This isn’t much of an issue, as I’ve got a strong Fail2Ban configuration running which at the moment is keeping track of some 30 IP addresses that are constantly trying to hammer their way in. No doubt these will be replaced with another string of attacks once they realise that those IPs are being dropped. I also prevent SSH login with passwords – RSA keys only here.
MySQL is the other main target to be concerned about – this is taken care of by disabling root login remotely, and dropping all MySQL traffic at the firewall that hasn’t come from 127.0.0.1.

Keeping the SSH keys on an external device & still keeping things simple just requires some tweaking to the .bashrc file in Linux:

alias ssh='ssh -i <Path To Keys>'

This little snippet makes the ssh client look somewhere else for the keys themselves, while keeping typing to a minimum in the Terminal. This assumes the external storage with the keys always mounts to the same location.

Everything else that can’t be totally blocked from outside access (IMAP, SMTP, FTP, etc), along with Fail2Ban protection, gets very strong passwords, unique to each account, (password reuse in any situation is a big no-no) and where possible TOTP-based two factor authentication is used for front end stuff, all the SSH keys, master passwords & backup codes are themselves kept offline, on encrypted storage, except for when they’re needed. General password management is taken care of by LastPass, and while they’ve been subject to a couple of rather serious vulnerabilities recently, these have been patched & it’s still probably one of the best options out there for a password vault.
There’s more information about those vulnerabilities on the LastPass blog here & here.


This level of security paranoia ensures that unauthorized access is made extremely difficult – an attacker would have to gain physical access to one of my mobile devices with the TOTP application, and have physical access to the storage where all the master keys are kept (along with it’s encryption key, which is safely stored in Meatware), to gain access to anything.
No security can ever be 100% perfect, there’s always going to be an attack surface somewhere, but I’ll certainly go as far as is reasonable, while not making my access a total pain, to keep that attack surface as small as possible,and therefore keeping the internet scum out of my systems.
The last layer of security is a personal VPN server, which keeps all traffic totally encrypted while it’s in transit across my ISP’s network, until it hits the end point server somewhere else in the world. Again, this isn’t perfect, as the data has to be decrypted *somewhere* along the chain.

Posted on Leave a comment

Topping NX1a Portable Headphone Amplifier

NX1a Amplifier
NX1a Amplifier

Time for another teardown! Here’s a pocket-sized headphone amplifier for use with mobile devices. This unit is powered by a built-in lithium cell, and can give some pretty impressive volume levels given it’s small size.

Audio Connections
Audio Connections

The 3.5mm audio input & output jacks are on the front of the unit, along with the relatively enormous volume knob & power switch. There’s a little blue LED under the switch that lets the user know when the power is on, but this is a very sedate LED, using very little power.

Gain & Charging
Gain & Charging

On the back is the High-Low gain switch, and the µUSB charging port. There’s another indicator LED to show that the internal cell is charging, in this case a red one.

PCB Top
PCB Top

Removing a couple of cap screws allows the internals to slide out of the extruded aluminium casing. Most of the internal space is taken up by the 1Ah lithium cell, here on the top of the PCB secured by some double-sided tape. The volume potentiometer is mounted on a small daughterboard at right angles to get it to fit into the small vertical space in the case.

PCB Rear
PCB Rear

The bottom of the PCB is equally as sparse – the only ICs being the main audio amp in the centre & the battery charger IC at the top.

Amplifier IC
Amplifier IC

The main audio amplifier is a TP9260, I couldn’t find a datasheet on this, so I’m unsure of what the specs are. The row of resistors above the IC are for the gain divider circuit. There’s also a pogo pin on the right that makes contact with the back panel of the case for grounding.

Battery Charger
Battery Charger

Battery charging is taken care of by a UN8HX 500mA linear charging IC, not much special here.

This little amplifier seems to be pretty well made, considering the price point. The only issue I’ve had so far is the audio cables act like antennas, and when in close proximity to a phone some signal gets picked up & blasted into the headphones as interference.

Posted on Leave a comment

IC Decap – TA7291 H-Bridge DC Motor Driver

Here’s a jellybean chip – a DC motor driver. This device has all the logic to drive a small motor, such as that used to drive the tray of a CD drive in both directions. The control logic is at the bottom of the die, while the main power transistors are at the top, in H-Bridge formation.

TA7291 Die
TA7291 Die
Posted on Leave a comment

USB3 SD/µSD Card Reader Teardown

USB3 SD Reader
USB3 SD Reader

This is a cheap little eBay reader to replace my ~10 year old multi-reader that very recently died. My original was an 8-in-1 version, but as I never read anything else other than SD cards these days, a little USB dongle version was more convenient.

Controller Chipset
Controller Chipset

The layout is very minimal, just the µSD socket, bypass passives & the main controller chip on this side, which is a GL3224 Dual LUN Memory Card Controller from Genesys Logic. This is fully USB3 capable according to the datasheet, but I’m not certain of the advantage of this for something that reads relatively slow devices like SD cards.

SD Socket
SD Socket

The other side of the PCB holds the full size SD socket, along with the activity LED & USB connector.

Posted on 4 Comments

DIY Eberspacher Glowplug Screens: The Test Of Time

Some time ago I did a couple of posts on cheapening up the maintenance of Eberspacher hot air heaters by making the glow plug screens myself. Now one of my pieces of stainless mesh has been in the heater for nearly a year, and the heater is starting to get a bit smoky on a cold start. This is usually a sign that the screen isn’t allowing the fuel to vaporise quick enough for the glow plug to ignite the flame, because it’s becoming blocked. So far the heater has had about 150L of diesel through it with my DIY screen.

Old Screen
Old Screen

After removing the plug, here’s what’s left of the screen. The bottom end has completely disintegrated, but this is to be expected – OEM screens do the same thing as this end is exposed to the most heat in the burner. There’s quite a bit of coke buildup on the top end of the screen around the fuel nozzle, again this isn’t surprising, as this is the coolest part of the heater not all the heavier fractions of the diesel fuel have the chance to vaporise.

Innards
Innards

Looking further down into the mixing tube of the main burner, everything looks good. There’s a coating of soot in there, but no tar-like build up that would tell me the unit isn’t burning properly. Another advantage of making my own screens is that they’re much easier to extract from the hole once they’ve been in there for months. The OEM screens have a stainless ring spot welded to the mesh itself to hold it’s shape, and once there’s enough fuel residue built up the entire mess seizes in place, requiring some sharp pokey tools & some colourful language to remove. The single loop of mesh held in place by it’s own spring pressure is much easier to remove as it collapses easily.

New 80 Mesh Screen
New 80 Mesh Screen

I’ve decided to change the mesh size of the screen while I’m in here, in this case to 80 mesh, which is much closer to the OEM screen size. There doesn’t seem to be much of a difference so far in either the starting or running capability of the heater, although the thicker wire of this screen might last longer before disintegrating at the burner end.

Posted on 2 Comments

nb Tanya Louise Heating Upgrades – The Pumps

 

Pierburg WUP1
Pierburg WUP1

With some recent upgrades to the boat’s heating system, the hot water circulation pumps we’ve been using are becoming far too small for the job. After the original Johnson Marine circulation pump died of old age (the brushes wore down so far the springs ate the commutator) some time ago, it was replaced with a Pierburg WUP1 circulation pump from a BMW. (As we’re moored next to a BMW garage, these are easily obtainable & much cheaper than the marine pumps).

WUP1 Cutaway
WUP1 Cutaway

These are also brushless, where as the standard Johnson ones are brushed PM motors – the result here is a much longer working life, due to fewer moving parts.

The rated flow & pressure on these pumps is pretty pathetic, at 13L/min at 0.1bar head pressure. As the boat’s heating system is plumbed in 15mm pipe instead of 22mm this low pressure doesn’t translate to a decent flow rate. Turns out it’s pretty difficult to shove lots of water through ~110ft of 15mm pipe ;). Oddly enough, the very low flow rate of the system was never a problem for the “high output” back boiler on the stove – I suspect the “high output” specification is a bit optimistic.
This issue was recently made worse with the addition of a Webasto Thermo Top C 5kW diesel-fired water heater, which does have it’s own circulation pump but the system flow rate was still far too low to allow the heater to operate properly. The result was a rapidly cycling heater as it couldn’t dump the generated hot water into the rest of the system fast enough.

The easiest solution to the problem here is a larger pump with a higher head pressure capability. (The more difficult route would be completely re-piping the system in 22mm to lower the flow resistance). Luckily Pierburg produce a few pumps in the range that would fit the job.

Pierburg CWA-50
Pierburg CWA-50

Here’s the next size up from the original WUP1 pump, the CWA50. These are rated at a much more sensible 25L/min at 0.6bar head pressure. It’s physically a bit larger, but the connector sizes are the same, which makes the install onto the existing hoses easier. (For those that are interested, the hose connectors used on BMW vehicles for the cooling system components are NormaQuick PS3 type. These snap into place with an O-Ring & are retained by a spring clip).
The CWA50 draws considerably more power than the WUP1 (4.5A vs 1.5A), and are controllable with a PWM signal on the connector, but I haven’t used this feature. The PWM pin is simply tied to the positive supply to keep the pump running at maximum speed.

Once this pump was installed the head pressure immediately increased on the gauge from the 1 bar static pressure to 1.5 bar, indicating the pump is running at about it’s highest efficiency point. The higher water flow has so far kept the Webasto happy, there will be more to come with further improvements!

CWA-50 Pump Teardown

CWA50 Cutaway
CWA50 Cutaway

Above is a cutaway drawing of the new pump. These have a drilling through the shaft allows water to pass from the high pressure outlet fitting, through the internals of the pump & returns through the shaft to the inlet. This keeps the bearings cool & lubricated. The control & power drive circuitry for the 3-phase brushless motor is attached to the back & uses the water flowing through the rotor chamber as a heatsink. Overall these are very well made pumps.

Impeller
Impeller

Here’s the impeller of the pump, which is very small considering the amount of power this unit has. The return port for the lubricating water can be seen in the centre of the impeller face.

3-Phase Driver
3-Phase Driver

Inside the back of the pump is the control module. The main microcontroller is hiding under the plastic frame which holds the large power chokes & the main filter electrolytic.

Posted on Leave a comment

NextCloud Linux Client Build Script

Having been a user of ownCloud for a long while, I decided to jump ship to the fork NextCloud for a few reasons, but the main one is that I never managed to get ownCloud to update itself (with the built-in updater app in the Admin panel) without completely shitting the bed, and as a result having to start from scratch & reupload all my files.

Nextcloud on the other hand has managed a major upgrade without any such problems, and the developers seem to be much more active than the ownCloud devs at present.

The one issue at the moment is that there are no packages for the Linux desktop client – it has to be built from scratch. This isn’t too difficult though, but to make things even easier I’ve thrown together a little bash script to automate the process. It’s tested to work under the latest version of Linux Mint (18.1), and does use a couple of commands that sudo won’t allow, so has to be run as root. It’s not polished in any way, but does work fine!

After the build process has completed, the client itself can be run from the Terminal, or made to run at system boot via the Startup Applications Editor in Linux Mint.

#!/bin/bash

echo "This script will compile & install Nextcloud Desktop Sync Client"
echo "Please be patient, this will take a while"

if [[ $EUID -ne 0 ]]; then
   echo "Root commands are used by this script, please run as root user to avoid errors"
   exit 1
fi

echo ""
echo "Installing Build Tools..."
echo ""
apt-get install cmake git-core -y

echo ""
echo "Cloning GitHub Repo..."
echo ""
git clone https://github.com/nextcloud/client_theming.git
cd client_theming
git submodule update --init --recursive

echo ""
echo "Adding Xenial Source Repos to /etc/apt/sources.list..."
echo ""

echo "deb-src http://archive.ubuntu.com/ubuntu/ xenial universe" >> /etc/apt/sources.list
echo "deb-src http://archive.ubuntu.com/ubuntu/ xenial-updates universe" >> /etc/apt/sources.list

echo ""
echo "Updating Apt & installing build dependencies..."
echo ""

apt-get update
apt build-dep owncloud-client -y

echo ""
echo "Compiling NextCloud Client..."
echo ""

mkdir build-linux
cd build-linux
cmake -D OEM_THEME_DIR=`pwd`/../nextcloudtheme ../client
make
make install

echo ""
echo "Adding Custom Library Directory Config..."
echo ""

echo "/usr/local/lib/x86_64-linux-gnu" >> /etc/ld.so.conf.d/x86_64-linux-gnu.conf
ldconfig

echo ""
echo "Nextcloud Client has been built & installed!"
echo ""
exit 0

 

Posted on 13 Comments

Honda GX35 Clone – Are They Any Good?

In a word, no they aren’t any good. As usual, cheap doesn’t equal good, and in this case the cheapo clones are a total waste of money. Read on for the details!

I’ve been looking into using a cheap Chinese clone Honda GX35 engine to drive an automotive alternator as a portable battery charging & power unit. These engines are available very cheaply on eBay, aimed at the mini-bike/go-kart market.
For those not in the know, the Honda GX25/35 4-strokes are strimmer-type engines that traditionally were always of 2-stroke construction. Honda worked out how to have a wet-sump engine without the need to keep the engine always in the “upright” position. They do not require mixing of oil into the fuel for lubrication as 2-strokes do, so should be much cleaner running.

So far I’ve had two of these cheap engines, as the first one died after only 4 hours run time, having entirely lost compression. At the time the engine was idling, no load, having been started from cold only a few minutes before. Having checked the valve clearances to make sure a valve wasn’t being held partially open, I deduced that the cause was broken piston rings. This engine was replaced by the seller, so I didn’t get a chance to pull it to bits to find out, but I decided to do a full teardown on the replacement to see where the cloners have cut corners.

Oil Return Hose
Oil Return Hose

I’ve already stripped off the ancillary components: exhaust, carburettor, fuel tank, cowlings, as these parts are standard to any strimmer engine. The large black hose here is the oil return feed back to the rocker cover from the crankcase. The oiling system in these engines is rather clever. The main engine block is made of light alloy, probably some permutation of Aluminium. There is much flashing left behind between the cylinder fins from the die-casting process, and not a single engine manufacturer’s logo anywhere. (From what I’ve read, the genuine Honda ones have their logo on the side of the crankcase).

Rocker Box
Rocker Box

Here’s the top of the engine with valves, rockers & camshaft. All the valve gear up here, minus the valves themselves & springs, are manufactured from sintered steel, there are no proper “bearings”, the steel shafts just run in the aluminium castings. The cam gear is of plastic, with the sintered steel cam pressed into place. The cam also has the bearing surface for the pin that the whole assembly rotates on. The timing belt runs in the oil & is supposed to last the life of the engine, and while I’d believe that in the original Honda, I certainly wouldn’t in this engine. The black grommet is the opening of the oil return gallery.

Cam
Cam

Here’s the cam on the back of the plastic pulley. A single cam is used for both intake & exhaust valves for space & simplicity.

Intake Valve Stem Seal
Intake Valve Stem Seal

Just visible under the intake valve spring is a simple stem seal, to hopefully prevent oil being sucked down the valve guide into the cylinder by intake vacuum. Running these cheap engines proves this seal to be ineffective, as they blow about as much blue oil smoke as a 2-stroke when they’re started cold. 😉

Starter Side
Starter Side

The starter side is where the oil sump is located on these engines, along with the dipstick.

Flywheel Side
Flywheel Side

The flywheel end of the engine is the usual fare for small engines. Ignition is provided by a magneto, with a magnet in the flywheel. This is no different from the 2-stroke versions. As these ignitions fire on every revolution of the crankshaft, the spark plug fires both on compression, igniting the fuel for normal operation, and again into the exhaust stroke, where the spark is wasted.
One thing I have noticed about these engines is an almost total lack of cooling air coming through the cowling over the cylinder cooling fins. Plenty was flowing over the exhaust silencer side, I believe bad housing design would be what causes this problem. A lack of cooling certainly wouldn’t help engine longevity!

Engine "Sump"
Engine “Sump”

Separating the bottom of the engine was a little difficult, as there is a significant bead of sealant used instead of a gasket. Inside the sump of the engine are a pair of paddles, which stir up the oil into a mist. As the piston moves in the cylinder, it acts as a pump, creating alternating pulses of pressure & vacuum in the crankcase. Oil mist flows through a drilling in the crank from the sump, into the crankcase where it (hopefully) lubricates the bearings & the cylinder wall. Incidentally, the only main bearings are on the crankcase – the far end of the shaft that carries the oil paddles & timing belt is just flapping in the breeze, the only support being the oil seal in the outer housing. The crank itself isn’t hardened – a file easily removes metal from all parts that I could get at. The big end journal pin might be, but these cranks are pressed together so I can’t access that part.

Lubrication Gallery
Lubrication Gallery

The oil mist feeds into the crankcase through this hollow section of shaft, there’s a drilling next to the timing belt pulley to connect the two spaces together.

Lower Crankcase
Lower Crankcase

The lower crankcase is just a simple die casting, there’s a check valve at the bottom under the crankshaft to transfer oil to the rocker cover, through the rubber tube on the outside of the engine. After the oil reaches the rocker box, it condenses & returns to the sump via the timing belt cavity.

Piston Crown
Piston Crown

Removing the crankshaft from the engine block gives me a look at the piston. The factory couldn’t even be arsed to machine the crown, it’s still got the rough finish from the hot-forging press. This bad finish will pick up much carbon from combustion, and would probably cause detonation once enough had accumulated to become incandescent in the heat of combustion. Only the centre is machined, just enough for them to stamp a number on.

Cylinder Bore
Cylinder Bore

A look up the cylinder bore shows the valves in the cylinder head. These engines, like their 2-stroke cousins have a single casting instead of a separate block & head, so getting at the valves is a little more of a pain. The cylinder bore itself is a cast-in iron liner and it’s totally smooth – like a mirror finish. There’s not a single sign of a crosshatch pattern from honing. If the first engine that died on me was the same – I’d be surprised if it wasn’t, this could easily cause ring breakage. The usual crosshatch pattern the cylinder hone produces holds oil, to better help lubricate the piston & rings. Without sufficient lubrication, the rings will overheat & expand far enough to close the end gap. Once this happens they will break.

Engine Valves
Engine Valves

Finally, here’s the valves with their springs removed from the cylinder. These are the smallest poppet valves I’ve ever seen, a British penny is provided for scale.

In all, these engines share many components with the older 2-stroke versions. The basic crankshaft & connecting rod setup is the same as I’ve seen in many old 2-strokes previous, the addition of the rather ingenious oiling system by Honda is what makes these tiny 4-strokes possible. I definitely won’t be trusting these very cheap copies in any of my projects, reliability is questionable at the least. The apparent lack of cooling air flow over the cylinder from the flywheel fan is concerning, along with the corner-cutting on the cylinder finishing process & piston crown, presumably to reduce factory costs.

Posted on Leave a comment

Behringer DEQ2496 Mastering Processor

Bootscreen
Bootscreen

I was recently given this unit, along with another Behringer sound processor to repair, as the units were both displaying booting problems. This first one is a rather swish Mastering Processor, which has many features I’ll leave to Behringer to explain 😉

Input Board & Relays
Input Board & Relays

All the inputs are on the back of this 19″ rackmount bit of kit, nothing much on this PCB other than the connectors & a couple of switching relays.

Main Processor PCB
Main Processor PCB

All the magic is done on the main processor PCB, which is host to 3 Analog Devices DSP processors:

ADSP-BF531 BlackFin DSP. This one is probably handling most of the audio processing, as it’s the most powerful DSP onboard at 600Mhz. There’s a ROM on board above this for the firmware & a single RAM chip. On the right are a pair of ADSP-21065  DSP processors at a lower clock rate of 66MHz. To the left is some glue logic to interface the user controls & dot-matrix LCD.

PSU Module
PSU Module

The PSU in this unit is a pretty standard looking SMPS, with some extra noise filtering & shielding. The main transformer is underneath the mu-metal shield in the centre of the board.

Posted on Leave a comment

Project Volantis – Storage Server Rebuild

For some time now I’ve been running a large disk array to store all the essential data for my network. The current setup has 10x 4TB disks in a RAID6 array under Linux MD.

Up until now the disks have been running in external Orico 9558U3 USB3 drive bays, through a PCIe x1 USB3 controller. However in this configuration there have been a few issues:

  • Congestion over the USB3 link. RAID rebuild speeds were severely limited to ~20MB/s in the event of a failure. General data transfer was equally as slow.
  • Drive dock general reliability. The drive bays are running a USB3 – SATA controller with a port expander, a single drive failure would cause the controller to reset all disks on it’s bus. Instead of losing a single disk in the array, 5 would disappear at the same time.
  • Cooling. The factory fitted fans in these bays are total crap – and very difficult to get at to change. A fan failure quickly allows the disks to heat up to temperatures that would cause failure.
  • Upgrade options difficult. These bays are pretty expensive for what they are, and adding more disks to the USB3 bus would likely strangle the bandwidth even further.
  • Disk failure difficult to locate. The USB3 interface doesn’t pass on the disk serial number to the host OS, so working out which disk has actually failed is difficult.

To remedy these issues, a proper SATA controller solution was required. Proper hardware RAID controllers are incredibly expensive, so they’re out of the question, and since I’m already using Linux MD RAID, I didn’t need a hardware controller anyway.

16-Port HBA
16-Port HBA

A quick search for suitable HBA cards showed me the IOCrest 16-port SATAIII controller, which is pretty low cost at £140. This card breaks out the SATA ports into standard SFF-8086 connectors, with 4 ports on each. Importantly the cables to convert from these server-grade connectors to standard SATA are supplied, as they’re pretty expensive on their own (£25 each).
This card gives me the option to expand the array to 16 disks eventually, although the active array will probably be kept at 14 disks with 2 hot spares, this will give a total capacity of 48TB.

HBA
SATA HBA

Here’s the card installed in the host machine, with the array running. One thing I didn’t expect was the card to be crusted with activity LEDs. There appears to be one LED for each pair of disks, plus a couple others which I would expect are activity on the backhaul link to PCIe. (I can’t be certain, as there isn’t any proper documentation anywhere for this card. It certainly didn’t come with any ;)).
I’m not too impressed with the fan that’s on the card – it’s a crap sleeve bearing type, so I’ll be keeping a close eye on this for failure & will replace with a high quality ball-bearing fan when it finally croaks. The heatsink is definitely oversized for the job, with nothing installed above the card barely gets warm, which is definitely a good thing for life expectancy.

Update 10/02/17 – The stock fan is now dead as a doornail after only 4 months of continuous operation. Replaced with a high quality ball-bearing 80mm Delta fan to keep things running cool. As there is no speed sense line on the stock fan, the only way to tell it was failing was by the horrendous screeching noise of the failing bearings.

SCSI Controller
SCSI Controller

Above is the final HBA installed in the PCIe x1 slot above – a parallel SCSI U320 card that handles the tape backup drives. This card is very close to the cooling fan of the SATA card, and does make it run warmer, but not excessively warm. Unfortunately the card is too long for the other PCIe socket – it fouls on the DIMM slots.

Backup Drives
Backup Drives

The tape drives are LTO2 300/600GB for large file backup & DDS4 20/40GB DAT for smaller stuff. These were had cheap on eBay, with a load of tapes. Newer LTO drives aren’t an option due to cost.

The main disk array is currently built as 9 disks in service with a single hot spare, in case of disk failure, this gives a total size after parity of 28TB:

/dev/md0:
        Version : 1.2
  Creation Time : Wed Mar 11 16:01:01 2015
     Raid Level : raid6
     Array Size : 27348211520 (26081.29 GiB 28004.57 GB)
  Used Dev Size : 3906887360 (3725.90 GiB 4000.65 GB)
   Raid Devices : 9
  Total Devices : 10
    Persistence : Superblock is persistent

  Intent Bitmap : Internal

    Update Time : Mon Nov 14 14:28:59 2016
          State : active 
 Active Devices : 9
Working Devices : 10
 Failed Devices : 0
  Spare Devices : 1

         Layout : left-symmetric
     Chunk Size : 64K

           Name : Main-PC:0
           UUID : 266632b8:2a8a3dd3:33ce0366:0b35fad9
         Events : 773938

    Number   Major   Minor   RaidDevice State
       0       8       48        0      active sync   /dev/sdd
       1       8       32        1      active sync   /dev/sdc
       9       8       96        2      active sync   /dev/sdg
      10       8      112        3      active sync   /dev/sdh
      11       8       16        4      active sync   /dev/sdb
       5       8      176        5      active sync   /dev/sdl
       6       8      144        6      active sync   /dev/sdj
       7       8      160        7      active sync   /dev/sdk
       8       8      128        8      active sync   /dev/sdi

      12       8        0        -      spare   /dev/sda

The disks used are Seagate ST4000DM000 Desktop HDDs, which at this point have ~15K hours on them, and show no signs of impending failure.

USB3 Speeds
USB3 Speeds

Here’s a screenshot with the disk array fully loaded running over USB3. The aggregate speed on the md0 device is only 21795KB/s. Extremely slow indeed.

This card is structured similarly to the external USB3 bays – a PCI Express bridge glues 4 Marvell 9215 4-port SATA controllers into a single x8 card. Bus contention may become an issue with all 16 ports used, but as far with 9 active devices, the performance increase is impressive. Adding another disk to the active array would certainly give everything a workout, as rebuilding with an extra disk will hammer both read from the existing disks & will write to the new.

HBA Speeds
HBA Speeds

With all disks on the new controller, I’m sustaining read speeds of 180MB/s. (Pulling data off over the network). Write speeds are always going to be pretty pathetic with RAID6, as parity calculations have to be done. With Linux MD, this is done by the host CPU, which is currently a Core2Duo E7500 at 2.96GHz, with this setup, I get 40-60MB/s writes to the array with large files.

Disk Array
Disk Array

Since I don’t have a suitable case with built in drive bays, (again, they’re expensive), I’ve had to improvise with some steel strip to hold the disks in a stack. 3 DC-DC converters provides the regulated 12v & 5v for the disks from the main unregulated 12v system supply. Both the host system & the disks run from my central battery-backed 12v system, which acts like a large UPS for this.

The SATA power splitters were custom made, the connectors are Molex 67926-0001 IDC SATA power connectors, with 18AWG cable to provide the power to 4 disks in a string.

IDT Insertion Tool
IDT Insertion Tool

These require the use of a special tool if you value your sanity, which is a bit on the expensive side at £25+VAT, but doing it without is very difficult. You get a very well made tool for the price though, the handle is anodised aluminium & the tool head itself is a 300 series stainless steel.

Posted on Leave a comment

eSynic 2-Way HDMI Signal Splitter

HDMI Splitter
HDMI Splitter

Time for another random teardown, a signal splitter for HDMI. These units are available very cheap these days on eBay. This one splits the incoming signal into two to drive more than one display from the same signal source.

Main PCB
Main PCB

The stamped alloy casing comes apart easily with the removal of a few screws. The PCB inside is rather densely packed with components.

Chipset
Chipset

The main IC on the incoming signal is a Silicon Image Sil9187B HDMI Port Processor, with a single input & 4 outputs. In this case the chip is used as a repeater to amplify the incoming signal. the signal path then gets fed into a Pericom PI3HDMI412 HDMI Demux, which then splits the signal into two for the output ports.

Microcontroller
Microcontroller

The main pair of ICs processing the video signals are controlled over I²C, with this STM32 microcontroller. The 4 pads to the lower left are for the STLink programmer. The main 3.3v power rail is provided by the LM1117 linear regulator on the right.

Posted on Leave a comment

Tenma 72-10405 DMM Teardown

Tenma DMM
Tenma DMM

Well it’s time for a new DMM. After the last pair of eBay El-Cheapo Chinese meters just didn’t last very well, I decided a proper meter was required. This one is a Tenma 72-10405, stocked by Farnell for under £60. Not quite as many festures as the cheapo Chinese meters, but I expect this one to be a bit more reliable.

PCB Rear
PCB Rear

Since I can’t have anything without seeing how it’s put together, here’s the inside of the DMM. (Fuse access is only possible by taking the back cover off as well. The 9v PP3 battery has a seperate cover).

PCB Rear Bottom
PCB Rear Bottom

He’s the input section of the meter, with the 10A HRC fuse & current shunt for the high-amps range. The other fuse above is for the mA/µA ranges. The back cover has a wide lip around the edge, that slots into a recess in the front cover, presumably for blast protection if the meter should meet a sticky end. The HRC fuses are a definite improvement over the cheap DMMs, they only have 15mm glass fuses, and no blast protection built into the casing.
There are some MOVs for input protection on the volts/ohms jack, the jacks themselves are nothing more than stampings though.

PCB Rear Top
PCB Rear Top

Not much at the other side of the board, there’s the IR LED for the RS232 interface & the beeper.

PCB Front
PCB Front

Most of the other components are on the other side of the PCB under the LCD display. The range switch is in the centre, while the main chipset is on the left.

DMM Chipset
DMM Chipset

The chipset of this meter is a FS9922-DMM3 from Fortune Semiconductor, this is a dedicated DMM chipset with built in ADCs & microcontroller.

Posted on Leave a comment

OLED Pulse Oximeter Teardown

OLED Pulse Oximeter
OLED Pulse Oximeter

Here’s a piece of medical equipment that in recent years has become extremely cheap, – a Pulse Oximeter, used to determine the oxygen saturation in the blood. These can be had on eBay for less than £15.

Powered On
Powered On

This one has a dual colour OLED display, a single button for powering on & adjusting a few settings. These cheap Oximeters do have a bit of a cheap plastic feel to them, but they do seem to work pretty well.

Pulse Oximeter
Pulse Oximeter

After a few seconds of being applied to a finger, the unit gives readings that apparently confirm that I’m alive at least. 😉 The device takes a few seconds to get a baseline reading & calibrate the sensor levels.

Main PCB Top
Main PCB Top

The plastic casing is held together with a few very small screws, but comes apart easily. here is the top of the main board with the OLED display panel. There appears to be a programming header & a serial port on the board as well. I’ll have to poke at these pads with a scope to see if any useful data is on the pins.

Main PCB Bottom
Main PCB Bottom

The bottom of the board has all the main components of the system. The microcontroller is a STM32F03C8T6, these are very common in Chinese gear these days. There’s a small piezo beeper & the main photodiode detector is in the centre.
There is an unpopulated IC space on the board with room for support components. I suspect this would be for a Bluetooth radio, as there’s a space at the bottom left of the PCB with no copper planes – this looks like an antenna mounting point. (The serial port on the pads is probably routed here, for remote monitoring).
At the top left are a pair of SGM3005 Dual SPDT analogue switches. These will be used to alternate the red & IR LEDs on the other side of the shell.
A 4-core FFC goes off to the other side of the shell, bringing power from the battery & supplying the sensing LEDs.

Battery Compartment
Battery Compartment

Power is supplied by a pair of AAA cells in the other shell.

Dual LED
Dual LED

The sensor LEDs are tucked in between the cells, this dual-diode package has a 660nm red LED & a 940nm IR LED.

Posted on Leave a comment

Inductive Hour Counter / Tachometer – Petrol Engines

As one of my current projects involves a small petrol engine – a Honda GX35 clone, I figured an hour counter would be very handy to keep an eye on service intervals. (More to come on the engine itself later on). I found a device that would suit my needs on good old eBay.

Inductive Engine Monitor
Inductive Engine Monitor

These engine monitors are pretty cheap, at about £4. The sensing is done by a single heat-resistant silicone wire, that wraps around the HT lead to the spark plug. The unit can be set for different firing intervals via the buttons. In the case of most single-cylinder 4-stroke engines, the spark plug fires on every revolution – wasted-spark ignition. This simplifies the ignition system greatly, by not requiring the timing signal be driven from 1/2 crankshaft speed. The second “wasted” spark fires into the exhaust stroke, so has no effect.

Internals
Internals

The back cover is lightly glued into place with a drop of cyanoacrylate in opposite corners, but easily pops off. The power is supplied by a soldered-in 3v Lithium cell. The main microcontroller has no number laser etched on to it at all – it appears it skipped the marking machine.

Input Filtering
Input Filtering

The input from the sensing wire comes in through a coupling capacitor & is amplified by a transistor. It’s then fed into a 74HC00D Quad 2-Input NAND gate, before being fed into the microcontroller.

Pickup
Pickup

The pickup wire is simply wound around the spark plug lead. I’ve held it in position here with some heatshrink tubing. Heat in this area shouldn’t be an issue as it’s directly in the airflow from the flywheel fan.

Posted on 12 Comments

Panasonic NV-M5 VHS Camcorder Teardown

Overview

Panasonic NV-M5 Camera
Panasonic NV-M5 Camera

Time foe some more retro tech! This is a 1980’s vintage CCD-based VHS camcorder from Panasonic, the NV-M5. There are a lot of parts to one of these (unlike modern cameras), so I’ll split this post into several sections to make things easier to read (and easier to keep track of what I’m talking about :)).

Left Side
Left Side

The left side of the camera holds the autofocus, white balance, shutter speed & date controls.

Left Side Controls
Left Side Controls
Lens Adjustments
Lens Adjustments

The lens is fully adjustable, with either manual or motorized automatic control.

Rear Panel
Rear Panel

The back panel has the battery slot, a very strange looking DC input connector, remote control connector & the earphone jack.

Top Controls
Top Controls

The top panel of the camera holds the main power controls, manual tape tracking & the tape transport control panel.

Viewfinder
Viewfinder

The viewfinder is mounted on a swivel mount. There’s a CRT based composite monitor in here. Hack ahoy!

Camera Section

Process Board Assembly
Process Board Assembly

Here’s the camera section of the camcorder, and is totally packed with electronics! There’s at least half a dozen separate boards in here, all fitted together around the optics tube assembly.

AWB PCB
AWB PCB

On the top of the assembly is the Automatic White Balance PCB. Many adjustments here to get everything set right. Not much on the other side of this board other than a bunch of Op-Amps. The iris stepper motor is fitted in a milled opening in the PCB, this connects to one of the other PCBs in the camera module.

AWB Sensor
AWB Sensor

Here’s the AWB sensor, mounted next to the lens. I’m not all to certain how this works, but the service manual has the pinout, and there are outputs for all the colour channels, RGB. So it’s probably a trio of photodiodes with filters.

Focus & Zoom Motors
Focus & Zoom Motors

Focus & Zoom are controlled with a pair of DC gear motors. The manual operation is feasible through the use of slip clutches in the final drive pinion onto the lens barrel.

Process Board
Process Board

The main camera section process board is above. This board does all the signal processing for the CCD, has the bias voltage supplies and houses the control sections for the motorized parts of the optics assembly. There are quite a few dipped Tantalum capacitors on pigtails, instead of being directly board mounted. This was probably done due to space requirements on the PCB itself.2016-08-20_13-40-11_000357

Under the steel shield on this board is some of the main signal processing for the CCD.

Optics Assembly
Optics Assembly

The back of the optics tube is a heavy casting, to supress vibration. This will be more clear later on.

Position Sensor Flex
Position Sensor Flex

The position of the lens elements is determined by reflective strips on the barrel & sensors on this flex PCB.

Sub Process Board
Sub Process Board

There’s another small board tucked into the side of the tube, this hooks into the process PCB.

Process Delay Line
Process Delay Line

According to the schematic, there’s nothing much on this board, just a delay line & a few transistors.

Piezo Focus Disc
Piezo Focus Disc

Here’s the reason for the heavy alloy casing at the CCD mounting end of the optics: the fine focus adjustment is done with a piezoelectric disc, the entire CCD assembly is mounted to this board. Applying voltage to the electrodes moves the assembly slightly to alter the position of the CCD. The blue glass in the centre of the unit is the IR filter.

IR Relective Sensors
IR Relective Sensors

The barrel position sensors are these IR-reflective type.

Iris Assembly
Iris Assembly

The iris is mounted just before the CCD, this is controlled with a galvanometer-type device with position sensors incorporated.

Iris Opening
Iris Opening

Pushing on the operating lever with the end of my screwdriver opens the leaves of the iris against the return spring.

Tape Transport & Main Control

Main Control Board
Main Control Board

Tucked into the side of the main body of the unit is the main system control board. This PCB houses all the vital functions of the camera: Power Supply, Servo Control, Colour Control,Video Amplifiers, etc.

Tape Drum
Tape Drum

Here’s the main tape transport mechanism, this is made of steel & aluminium stampings for structural support. The drum used in this transport is noticeably smaller than a standard VHS drum, the tape is wrapped around more of the drum surface to compensate.

Tape Transport
Tape Transport

The VHS tape sits in this carriage & the spools drive the supply & take up reels in the cartridge.

Main Control PCB
Main Control PCB

Here’s the component side of the main control PCB. This one is very densely packed with parts, I wouldn’t like to try & troubleshoot something like this!

Main PCB Left
Main PCB Left

The left side has the video head amp at the top, a Panasonic AN3311K 4-head video amp. Below that is video processing, the blue components are the analogue delay lines. There are a couple of hybrid flat-flex PCBs tucked in between with a couple of ICs & many passives. These hybrids handle the luma & chroma signals.
Top left is the capstan motor driver a Rohm BA6430S. The transport motors are all 3-phase brushless, with exception of the loading motor, which is a brushed DC type.

Delay Line
Delay Line

Here’s what is inside the delay lines for the analogue video circuits. The plastic casing holds a felt liner, inside which is the delay line itself.

Internal Glass
Internal Glass

The delay is created by sending an acoustic signal through the quartz crystal inside the device by a piezoelectric transducer, bouncing it off the walls of the crystal before returning it to a similar transducer.

Main PCB Centre
Main PCB Centre

Here’s the centre of the board, the strange crystal at bottom centre is the clock crystal for the head drum servo. Why it has 3 pins I’m not sure, only the two pins to the crystal inside are shown connected on the schematic. Maybe grounding the case?
The main servo controls for the head drum & the capstan motor are top centre, these get a control signal from the tape to lock the speed of the relative components.

Main PCB Right
Main PCB Right

Here’s the right hand side. The main power supply circuitry is at top right, with a large can containing 4 switching inductors & a ferrite pot core transformer. All these converters are controlled by a single BA6149 6-channel DC-DC converter controller IC via a ULN2003 transistor array.
The ceramic hybrid board next to the PSU has 7 switch transistors for driving various indicator LEDs.
The large tabbed IC bottom centre is the loading motor drive, an IC from Mitsubishi, the M54543. This has bidirectional DC control of the motor & built in braking functions. The large quad flat pack IC on the right is the MN1237A on-screen character generator, with the two clock crystals for the main microcontroller.

Erase Head
Erase Head

The full erase head has it’s power supply & oscillator on board, applying 9v to this board results in an AC signal to the head, which erases the old recording from the tape before the new recording is laid down by the flying heads on the drum.

Audio Control PCB
Audio Control PCB

The Audio & Control head is connected to this PCB, which handles both reading back audio from the tape & recording new audio tracks. The audio bias oscillator is on this board, & the onboard microphone feeds it’s signal here. The control head is fed directly through to the servo section of the main board.

Drum Motor
Drum Motor

The motor that drives the head drum is another DC brushless 3-phase type.

Hall Sensors
Hall Sensors

These 3 Hall sensors are used by the motor drive to determine the rotor position & time commutation accordingly.

Stator
Stator

The stator on this motor is of interesting construction, with no laminated core, the coils are moulded into the plastic holder. The tach sensor is on the side of the stator core. This senses a small magnet on the outside of the rotor to determine rotational speed. For PAL recordings, the drum rotates at 1500 RPM.

Motor Removed
Motor Removed

Not much under the stator other than the bearing housing & the feedthrough to the rotary transformer.

Head Disc
Head Disc

The heads are mounted onto the top disc of the drum, 4 heads in this recorder. The signals are transmitted to the rotating section through the ferrite rotary transformer on the bottom section.

Head Chip
Head Chip

The tiny winding of the ferrite video head can just about be seen on the end of the brass mounting.

Capstan Motor Components
Capstan Motor Components

The capstan motor is similar to the drum motor, only this one is flat. The rotor has a ferrite magnet, in this case it wasn’t glued in place, just held by it’s magnetic field.

Capstan Motor Stator
Capstan Motor Stator

The PCB on this motor has a steel backing to complete the magnetic circuit, the coils for the 3 motor phases are simply glued in place. The Hall sensors on this motor are placed in the middle of the windings though.
Again there is a tach sensor on the edge of the board that communicates the speed back to the controller. This allows the servo to remain locked at constant speed.

Viewfinder

Viewfinder Assembly
Viewfinder Assembly

As usual with these cameras, this section is the CRT based viewfinder. These units take the composite signal from the camera to display the scene. This one has many more pins than the usual viewfinder. I’ll hack a manual input into this, but I’ll leave that for another post.

Viewfinder Circuits
Viewfinder Circuits

Being an older camera than the ones I’ve had before, this one is on a pair of PCBs, which are both single-sided.

Main Viewfinder Board
Main Viewfinder Board

The main board has all the power components for driving the CRT & some of the adjustments. The main HV flyback transformer is on the right. This part creates both the final anode voltage for the tube & the focus/grid voltages.

Viewfinder Control PCB Top
Viewfinder Control PCB Top

The viewfinder control IC is on a separate daughter board in this camera, with two more controls.

Control IC
Control IC

The control IC is a Matsushita AN2510S, this has all the logic required to separate the sync pulses from the composite signal & generate an image on the CRT.

Viewfinder CRT Frame
Viewfinder CRT Frame

The recording indicator LEDs are mounted in the frame of the CRT & appear above the image in the viewfinder.

Viewfinder CRT With Yoke
Viewfinder CRT With Yoke

Here the CRT has been separated from the rest of the circuitry with just the deflection yoke still attached.

M01JPG5WB CRT
M01JPG5WB CRT

The electron gun in this viewfinder CRT is massive in comparison to the others that I have seen, and the neck of the tube is also much wider. These old tubes were very well manufactured.

Viewfinder Optics
Viewfinder Optics

A simple mirror & magnifying lens completes the viewfinder unit.

Posted on 2 Comments

CRT Flyback / Line Output Transformer Destructive Teardown

Small Flyback Transformer
Small Flyback Transformer

Here’s a small flyback / Line Output Transformer from a portable colour TV set. Usually these transformers are vacuum potted in hard epoxy resin & are impossible to disassemble without anything short of explosives. (There are chemical means of digesting cured epoxies, but none of them are pleasant). This one however, was potted in silicone, so with some digging, the structure of the transformer can be revealed.

Cap Removed
Cap Removed

The cap was glued on to the casing, but this popped off easily. The top of the core is visible in the silicone potting material.

The Digging Starts
The Digging Starts

A small screwdriver was used to remove the potting material, while trying not to damage the winding bobbin & core too badly. The bulge in the casing that I originally thought might house a voltage multiplier turns out to be totally empty. The white plastic bobbin is becoming visible around the core.

Bobbin
Bobbin

After some more digging & a lot of mess later, the entire transformer is revealed. The primary & auxiliary secondaries are visible at the bottom of the transformer, next to the pins. These transformers have multiple windings, as they’re used not only for supplying the final anode voltage of several Kilovolts to the CRT, but many of the other associated voltages, for the heater, grids, focus electrodes, etc. These lower voltage windings are on the same part of the core as the primary.
Above those is the main high voltage secondary winding, which looks to be wound with #38-#40AWG wire (about the thinnest available, at 0.07mm diameter. This is wound in many sections of of a few hundred turns each to increase the insulation resistance to the high voltage. The main anode wire emerges from the top of the bobbin.

Output Rectifier
Output Rectifier

Hidden in a recess at the top is the main HV rectifier, which on this small transformer is a single device (it’s probably not internally, most likely a series stack of diodes to get the PIV rating required).

Posted on 2 Comments

Tool Review – eBay Terminal Crimps

Soft Case
Soft Case

I recently decided to restock my toolkit, as there are plenty of jobs I need to sort that require the use of crimp terminals, so eBay again came to the rescue.
In my experience, cheap tools of any flavour are usually universally shite – I’ve had drill bits made out of a metal softer than aluminium, that unwind back into a straight flute bits as soon as they’re presented with anything harder to drill through than Cheese. Ditto for screwdrivers. But for once the far eastern factories seem to have done a reasonable job on this crimp tool set.

eBay Crimping Tools
eBay Crimping Tools

These are ratchet type crimping pliers, with interchangable heads so many different types of terminals can be used. A handy Philips screwdriver is included in the kit for changing the dies.

Large Dies
Large Dies

The largest dies in the set can handle cable up to 25mm² – just about the bottom end of main battery cables, which is very handy.

Medium Dies
Medium Dies

Smaller sets of dies are provided for other types of terminals.

Small Dies
Small Dies

I’m not precisely sure which type of terminals these dies fit – the profile is a bit unusual.

Tiny Dies
Tiny Dies

The smallest dies in the set are good for extremely small wires – down to 0.5mm

Automotive Dies
Automotive Dies

The pliers are supplied with the standard colour-coded automotive dies installed. Sometimes these terminals never crimp properly, as the dies just effectively crush the copper tube of the terminal, so more often than not the wire strands are just forced out of the terminal as the crimp is made, leaving a bad connection.

These are even better than the ratchet-type crimp tools at the local Maplin Electronics – the set of those I have just distorts when a large crimp is made, so the terminal never gets a full crimp. The steel is not stiff enough to handle the forces required.

Example Crimp
Example Crimp

Here’s a couple of large crimps on 6mm² cable attached to an ammeter. The crimps are nice & tight & hold onto the cable securely. The insulating sleeve on the terminals also hasn’t been cut through by the dies, which is often a problem on cheap crimp tools.