A Box for my Pixles

This all started with wanting to modify a cheap camping light by replacing the LED’s with some colourful NeoPixels. I made a Printed Circuit Board to match the existing PCB disc that held the LED’s, as well as a board for an ATtiny85 microcontroller which incorporated a microphone and vibrating motor of the type used in a old mobile phone. The battery and charging circuit came from a cheap (Poundland) USB powerbank but it turned out that the battery from the powerbank didn’t fit in the camping light how I liked (in a measure twice, cut once sort of thing). Instead I made this:

Extracting MP3 audio from video files

Here is a small Bash script that converts any supported ffmpeg video format; such as .MKV, .MP4 or .MOV and extracts the audio to an .MP3 file, It will also split that MP3 file into chunks and put them in a convenient directory. You will need to install ffmpeg and mp3splt for your particular platform.

Example Usage:

This uses ffmpeg to convert “big fat file.mkv” to “big fat file.mp3” and then uses mp3splt to create a directory “big fat file” containing the files 01 – big fat file.mp3, 02 – big fat file.mp3, etc. The MP3 files will be encoded at 128k Constant Bit Rate and each file will be around 50 minutes in length. To install in Debian/Ubuntu use: sudo apt-get install ffmpeg mp3splt

mp3splt can find the audio in a quiet region near where the split is desired rather than midway through a word, this should make for much cleaner playback across tracks.

Alternative Method

This script gives the same results but uses ffmpeg to split the large MP3 file and then adds track numbering metadata using id3v2. To install in Debian/Ubuntu use: sudo apt-get install ffmpeg id3v2

Creating an Audiobook

Taking this further, I was thinking that it would be nice to have these converted into the M4B Audiobook format for use on my elderly iPod. The script below assumes that you have processed the files as above and have added metadata tags using a tool like mp3tag (yes I know this is for Windows).

To complete this we need to: Combine the multiple MP3 files into one big file, or read the original big file then convert that to M4B format at 96K bit and add chapter marks every ten minutes. For this I have used ffmpeg v3.2.12 and libmp4v2 (for the mp4chaps utility), to install in Debian/Ubuntu use: sudo apt-get install libmp4v2-dev mp4v2-utils ffmpeg

This script works best from a single MP3 file rather than from those that have been re-combined back into a single file, recombining the files caused ffmpeg to exclaim “invalid packet size” and “invalid data” errors. It is able to tell the difference between a directory and a single MP3 and processes the file accordingly, don’t forget to add metadata tags and cover art before you run the script.

When encoding to the M4B using a re-combined file I saw a few of these errors from ffmpeg:

These appear to be caused by the mp3splt program from when the original MP3 file was being split into 50 minute chunks, but I can’t hear any effect on the output.

Lots of information about the file can be gotten using mediainfo, to install in Debian/Ubuntu use: sudo apt-get install mediainfo, example use:

Links and References

Fixing an SD Card

The corner of one of my SD cards broke off and would no longer latch properly in the cameras slot, it was time to either throw it away or repair. I opted for repair.

For the repair I used some Poundland two part epoxy resin as this can be used to fill in the missing section and when fully cured, after 16 hours, is just as strong as the plastic its replacing.

I started with a sheet of glass from a picture frame to give me a flat surface, upon which I stuck a short strip of electricians tape as the epoxy resin wont stick to this, next I applied a small blob of resin to the tape over which I placed the SD card to cover the entire broken corner that you see in the photo then squeezing down to push out the excess. I then left it for about ten minutes to let the glue set a little when I could push the glue up and fill in the corner.

I then left it for about an hour to go solid but still pliable, I then peeled the tape off from the glass and glue. The next stage was to trim down the excess with a scalpel, this tided up the outer edges but still left a ridge by one of the contacts, in the morning I removed this by carefully filing it away. I finished by cleaning with isopropyl alcohol.

Sheffield Manor Lodge – Battle Re‑enactment Day, June 2018

With thanks to the management and staff at Manor Lodge for giving me permission to video the event with my quad-copter. http://sheffieldmanorlodge.org/.

Featuring:

Hacking the Yongnuo Wireless Controller

I wrote this back in May 2017 but it was never finished, I got distracted by other things and I needed the wireless controller for photography. I wrote all this and it would be a shame to delete it, so I am posting it now on the chance there may be of something of interest within.

I use this Yongnuo Wireless Controller in photography to control a number of flash units away from the camera body. It comes in two parts, a transmitter that connects to the hotshoe on the camera and receivers with a hotshoe that connect to the flash, a single transmitter can control any number of flash receivers within the claimed 300 meter range. The transmitter with a couple of receivers can be gotten of eBay for around £35.

Yongnuo Wireless Controller FSK 2.4GHz
RF-600TX transmitter
RF-602RX receiver

[image of transmitter and receivers]

I am looking to:

  • See how the flash is connected
  • Investigate how the transmitter works – reverse engineer as much as I can
  • See if I can control the transmitter directly with an Arduino
  • See if other devices using the same radio chip can also be controlled
  • Not destroy the transmitter while examining it

Opening it up

[images of the transmitter insides]

On the board inside you will find:

  • A power on/off switch
  • Bi-colour Red/Green LED
  • A dual-press button with two switches for operating the flash manually
  • A four way code selector (4 way DIL switch)
  • An anonymous (no markings) microcontroller – µC
  • A7105 2.4GHz FSK/GFSK ISM band wireless transceiver

On the underside, my board is marked with the following version and date:

Version: 1.21
Date: 14/04/23  – 23 April 2014

Looking at the datasheet for the A7105 it can work as both a transmitter and receiver and uses an SPI interface for user control, it appears to be popular with the radio controlled RC aeronautical drone community. The receiver looks to be very similar by way of components, using the same radio chip and anonymous microcontroller. I have not examined it in any detail and take care if disassembling as there are three hotshoe connections that need to be desoldered.

Receiver Insides
RF-602RX receiver

Flash Connection

On the Canon camera the hotshoe has six connections but we only need to examine three of these. Looking down on the camera with the lens facing away from you, the main plate where the flash slides in is ground, the large central dot is the flash trigger just below this on the left is the camera ready connection. I assume the rest are for the E-TTL functions and I have not looked at these.

Canon Hotshoe Connections
Canon Hotshoe Connections

Checking the hotshoe with a multimeter, the flash trigger appears to have a high resistance that decreases when the flash is fired, I suppose this is a legacy of when cameras were more mechanical. The Camera Ready connection goes High – around 5 Volts,  to tell the flash to wake up, that you have pressed the shutter halfway, the lens has focused and you are about to take a photo.

To find the duration of the flash signal on the cameras hotshoe I connected an almost flat AA battery between ground and flash to give me 1.2 volts to measure against on the oscilloscope (checking a canon flash itself, the voltage across the flash pin and ground is 4.47 volts). I found that the flash signal is sent by the camera for 352ms, which is quite long considering that a typical shutter speed of 1/125 second for flash photography works out at 8ms, although the amount of time a flash fires for is set on the flash and not by this signal.

Capturing the flash event
Capturing the flash event

Microcontroller Connections

I spent a while tracing out most of the transmitter circuit, I have ignored most of the supporting radio circuitry and the crystal timer as I am wanting to investigate the data side. The parts are also rather small and troublesome to investigate with standard multimeter probes.

RF600TX - Partial Schematic
RF600TX – Partial Schematic

The microcontroller looks to use internal pullup resistors for the input switches, the camera ready signal from the hotshoe switches a transistor to pull pin 16 low on the controller.

Looking at the circuit diagram we see an output to the antenna from pin 8 of the micro controller. This outputs two different square waves when the shutter button is pressed, one for camera ready and another for flash. I think these are being modulated on the transmitter output to produce a radio signal and simplify the transmitter design. Looking at the output from pin eight on the oscilloscope, the two states can be seen quite clearly:

Camera Ready signal
Camera Ready signal
Flash signal
Flash signal

These square wave outputs are always the same, I thought it may change when a different code was chosen through the DIL switches. The transmitter unit does not receive any radio data, and no acknowledgement is made by the flash units.

Using a Logic Analyser

Time to break out the Logic Analyser, this is a cunning device that allows you to see the data being exchanged between the microcontroller and transceiver, I don’t want to get too detailed but think this may help for the following sections.

The data system being used by the A7105 is SPI. The Serial Peripheral Interface bus uses four wires: Chip Select SCS, multiple chips can be on the same SPI bus, but they all have different SCS connections, the master controller chip uses SCS to tell the slave chip it wants to use for data exchange. Serial Clock SCK: This is used to provide time synchronisation for the data exchange with a fixed duration for the highs and lows. Data SDIO: This is the data being sent by the microcontroller and GIO1 is data from the transceiver sent in reply, normally for SPI this is 8 bits, to make a byte.

The naming conventions used here are from the A7105 datasheet, The SPI bus has standard names for data lines; SDIO is MOSI – Master Out/Slave In, GIO1 would be MISO – Master In/Slave Out and SCS is SS – Slave Select. In our case the microcontroller would be the master and the transceiver the slave.

SPI Single slave
SPI Single slave

The Logic Analyser displays data in a form that allows you to see the logic, here we can see two bytes of data:

SPI example
Example of SPI data

The microcontroller – µC sends data on the SDIO line and listens for replies on GIO1. When the µC sets Chip Select SCS low this tells the transceiver that the µC wants to talk to it. The µC sends a command byte followed by one or more bytes of data – a packet. During the SCS event, data is only transferred while the clock SCK is running.

SPI data, binary data from the highs and lows
SPI data, binary data from the highs and lows

We can see that the logic on the SDIO is read every-time the clock goes low, falling edge, a clock tick on the SCK line represents a bit of data, eight ticks make a byte. We now have our binary data: 00100101 for convenience this is converted into hexadecimal 0x25.

When examining an SPI bus check any available datasheets to see if the clock is set to tick on a falling or rising edge, the bit order is Most Significant Bit – MSB or Least Significant Bit – LSB, and the data length (normally eight).

Looking at the A7105 Transceiver

A7105 Block Diagram (a clearer version can be seen in the datasheet)
A7105 Block Diagram (a clearer version can be seen in the datasheet)

From the A7105 datasheet the SPI bus is set for the following:

  • To activate SPI, the SCS pin must be set low
  • data length: 8 bits
  • bit order: Most Significant Bit First (MSB)

I have made the following connections to the transmitter. Soldering test leads to the microcontroller (µC) is the most convenient place to do this.

Connections to the Logic Analyser
Connections to the Logic Analyser

This table shows the Input/Output pins on the transceiver and microcontroller, as well as the colour of wire used for the logic analyser.

A7105 Description In/Out µC Wire Colour
11 SCS 3 Wire Chip Select I 9 yellow
12 SCK 3 Wire Clock I 10 orange
14 SDIO Read / Write I/O 12 brown
16 GIO1 4 Wire SPI Data Output I/O 11 red
17 GIO2 4 Wire SPI Data Output I/O 13 white
GND Ground black
Trigger Out O 8 grey

How the A7105 organises data

The transceiver has two data modes, Strobe and Control. There are eight strobe commands to control the various modes the chip supports, these are four bits in length and always begin with a 1, where the transceiver is being operated in 8 bit mode the final four bits are ignored. The Control registers are eight bits in length and are used to configure and read settings from the transceiver, they are eight bits in length, the first bit is always 0 and the second is either 1 for write or 0 for read. The table below shows examples of a write, a read (or more accurately a request, the transceiver replies on GIO1) and a strobe command sent by the µC.

Address Byte Data
Bit: 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
Control: CMD R/W Address Data
Write Example: 0x2 0x1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1
Read Example: 0x42 0xff 0 1 0 0 0 0 1 0 1 1 1 1 1 1 1 1
Strobe: CMD Strobe ID not used not used
Example: 0xa0 1 0 1 0 0 0 0 0

Examining the A7105 data

Data is exchanged on the SPI during two events, after the transmitter has been switched on, and when you are pressing the camera shutter or the button on the unit.

Power On

Extract of the SPI power on data showing SCS event 48, see the spreadsheet for more details
Extract of the SPI power on data showing SCS event 48, see the spreadsheet for more details

When you first switch on the unit, the microcontroller initialises the transceiver with a few hundred bytes of data, I have created this spreadsheet from the SPI data, hex data across is the most useful sheet to view:

In summary the initialisation sequence consists of the following

  • The microcontroller sets the majority of control registers to default
  • Internal calibration is started and the microcontroller keeps checking until this is done
  • Final cleaning up
  • Place the A7105 into standby mode

Shutter Press

On the SPI the shutter press action has two distinct stages, the preamble and the transmission. The preamble takes the camera out of standby mode and sets the channel it is going to be transmitting on. The transmission broadcasts the camera ready and flash states.

The Preamble
At the beginning of the datacaptue I see a preamble packet sent over the SPI:

Logic Analyser Data - first five bytes of the Preamble Packet
Logic Analyser Data – first five bytes of the Preamble Packet

This preamble looks to only appear when the flash is first operated after the transmitter unit has been switched on, subsequent use goes straight to transmit. The fifth byte changes depending on the DIL switch setting on the underside of the unit, as you can see in the four examples given in the table below.

bytes
DIL switch strobe control data strobe
0000 0xB0 0xB0 0x05 0xB5 0xF0 0xD0
1000 0xB0 0xB0 0x05 0xB5 0xE1 0xD0
0100 0xB0 0xB0 0x05 0xB5 0xD2 0xD0
1111 0xB0 0xB0 0x05 0xB5 0x0F 0xD0

Taking the first example, we can break this down to see what each byte is doing

SCS Packet IN/OUT Command Payload binary
0 0xb0 STROBE PLL Mode 0b10110000
1 0xb0 STROBE PLL Mode 0b10110000
2 0x5 0xb5 0xf0 IN FIFO Data TX data 0b00000101 0b10110101 0b11110000
817µs gap
3 0xd0 STROBE TX Mode transmission begins 0b11010000

It is difficult to work out what is going on here, according to the datasheet you send a packet of data 0xb5 0xf0 to be transmitted to FIFO Data 0x5 and follow that with the strobe command TX mode 0xd0, but what is transmitted bears no relation to the FIFO packet.

We need to look further back in the initialisation sequence and the datasheet, the A7105 has three modes of transmission; easy, segment and extension. We need to undertake a little bit of detective work to find which this is. Chapter 16.4 of the datasheet shows us the two registers used in the initialisation sequence we need to examine:

Bit: 7 6 5 4 3 2 1 0
FIFO I 0x3 FEP7 FEP6 FEP5 FEP4 FEP3 FEP2 FEP1 FEP0
Setting value: 0x1 0 0 0 0 0 0 0 1
FIFO II 0x4 FPM1 FPM0 PSA5 PSA4 PSA3 PSA2 PSA1 PSA0
Setting value: 0x0 0 0 0 0 0 0 0 0

The datasheet does not say directly so we need to go through each modes description to see which is the best fit. Segment FIFO looks good: “In Segment FIFO, TX FIFO length is equal to (FEP [7:0] – PSA [5:0] + 1). FPM [1:0] should be zero”. So our settings: (FEP:0b1PSA:0b0) + 1 = 2. The number of bytes sent our FIFO Data packet is also 2.

Further reading of the description “This function is very useful for button applications. In such case, each button is used to transmit fixed code (data) every time. During initialisation, each fixed code is written into corresponding segment FIFO once and for all. Then, if button is triggered, MCU just assigns corresponding segment FIFO (PSA [5:0] and FEP [7:0]) and issues TX strobe command.”

The Transmission
Taking an initial look at the data gathered during a shutter press on the Trigger Out (pin 8 of the microcontroller) we can clearly see the transition from Camera Ready and Flash as we saw on the oscilloscope earlier.

Logic Analyser Data
Logic Analyser Data

GIO2 shows a mirror of the Trigger Out, but zooming in to the data and I see that it follows the Trigger signal. Looking in the initialisation spreadsheet at SCS event we see that the command 0xc 0x1 was sent for setting the function of the GIO2 pin. Looking at the datasheet this appears to be set as an ‘I am transmitting’ signal, WTR – Wait until TX or RX has finished. If I force GIO2 low by sorting it to ground then the flash does not fire when I press the shutter

Logic Analyser Data
Logic Analyser Data

In my data capture the Camera Ready signal was transmitted six times, and the Flash signal thirteen times, I am sure this is dependant on the length of time I had the shutter button pressed on the camera.

Apologies for the inconclusive ending, I ran out of time to pursue this further

Links and Sources

History: Reading Early 19th Century Handwriting

I recently posted a legal document written in 1827, this was written in hand using a quill pen (quite possibly made from a goose feather) and it is rather difficult to read, there is no punctuation, commas or full stops not even an apostrophe and the capitalisation is all over the place. There are fewer characters in this alphabet, with some serving a dual purpose in giving a value based on context rather than appearance.

Whatever is written here….

The ‘m’ and ‘n’ characters are upside down, uppercase ‘I’ and ‘J’ are both the same and some characters have still not been fully completed, so ‘c’ looks like an ‘r’ and ‘e’ looks like a ‘c’. The double ‘s’ – ‘ss’ had still not been invented at this time and words with these are spelt ‘fs’, so ‘passages’ is written as ‘pafsesges’. I have constructed this cheat sheet from that document and hopefully the chart will help you in your quest:

Letter Example
A  Upper A  Lower A and Example A
B  Upper B  Lower B between Example B
C  Upper C  Lower C second Example C
D  Upper D  Lower D hundred Example D
E  Upper E  Lower E same Example E
F  Upper F  Lower F of Example F
G  Upper G  Lower G shillings Example G
H  Upper H  Lower H her Example H
I  Upper I  Lower I said Example I
J  Upper J  Lower J jointly Example J
K    Lower K Blake Example K
L    Lower L latter Example L
M  Upper M  Lower M made Example M
N  Upper N  Lower N grant Example N
O  Upper O  Lower O Joseph Example O
P  Upper P  Lower P appointed Example P
Q    Lower Q quality Example Q
R    Lower R presents Example R
S    Lower S assign Example S
T  Upper T  Lower T the Example T
U    Lower U fourth Example U
V    Lower V revoked Example V
W  Upper W  Lower W wife Example W
X    Lower X execution Example X
Y    Lower Y yearly Example Y
Z    Lower Z Elizabeth Example Z

After few hours reading the words start to pop out, it helps that the document is written is a formulaic legalese style with many repeated phrases (were they paid by the word?).

Further Reading

History: A Property Contract, Sheffield, July 1827

An indenture dated 18th July 1827 for the transfer of a mortgage for £1000 and interest between Ralph Blakelock, a banker in Sheffield and the merchants; John Butcher, Samuel Hadfield, John Binney, and Thomas Binney, as well as Henry Agie a Gentleman all of Sheffield. The document looks to be describing the mortgage, rents and leases as well some land and property of a ‘large Capital Messuage or Dwelling house’ built on the site of two dwelling houses in a street or place in Sheffield commonly called or known by the name of the Hartshead. The two former houses were occupied by John Trippett and James Mycock before being ‘wholly pulled down and rebuilt’ by Nicholas Broadbent.

Indenture

Read More at: http://www.g7smy.co.uk/history/contract1827

TENMA Rework Station Teardown

In a previous post I added a control knob to my Tenma 21-10130 Rework Station, but now I am taking a more detailed look at the controller board hardware inside paying particular attention to the microcontroller connections.

Removing the board from the rework station was a bit of a hassle, the screws at the bottom are particularly difficult to access. Eventually I had to unbolt the transformer from the case so I could get the screwdriver in, the transformer bracket catches up against a heatsink and capacitor so it cannot be completely gotten out of the way.

Controller Board, component side

The board can be divided up into five sections, on the left is the mains power supply, with connections to the power switch and rework heater, along the bottom left is the 5V DC power supply for the microcontroller, top right is the control circuitry and connections for the rework heater and hot air, and bottom right those for the soldering iron. In the centre is the microcontroller and associated circuitry.

The rework heater, air pump and soldering iron are all controlled using triacs, these in turn are connected back to the microcontroller through optocouplers. The rework heater and air pump operate at mains voltage, 220V, while the soldering iron works at 24V, these are all using Alternating Current. Essentially the station is a collection of variable dimmer switches controlled by the microcontroller.

Wires Everywhere

There are ten connections to the controller board

Conn Purpose
CN1 Mains in – from power connector
CN2 Power Switch
CN3 220VAC out to transformer
CN4 Rework Heater
CN5 Rework Air Pump power
CN6 Soldering Iron Temperature
CN7 Hand Key – Controls for Rework Wand
CN8 AC 9V input
CN9 Soldering Iron Power
CN10 AC 24V input

The connectors CN5 and CN6 are used to provide sensing for the microcontroller; one for the soldering iron temperature and another from the rework wand with the button controls, in cradle detect, and temperature sensing, there is also a row of five onboard button switches.

Microcontroller Control

With the multimeter in beep mode, tracing back the connections to the microcontroller took a couple of days.

PIC16F916 pinout

The PIC19F916 microcontroller has 24 digital Input/Output pins which are divided into three ports of eight; RA0-RA7, RB0-RB7 and RC0-RC8. In the lists below I have shown the physical connection as well as the I/O port used.

The power control connections are to an optocoupler which in turn switches a triac:

PIC Pin Optocoupler Triac Purpose Conn
11 RC0 U6: MOC3083 TR1: BT136 220VAC CN3
6 RA4 U5: MOC3083 TR2: JST139F Rework Heater CN4
16 RC5 U4: MOC3023 TR3: BT136 Rework Air Pump CN5
7 RA5 U7: MOC3041 TR4: BT137 Soldering Iron CN9

After much tracing of circuitry I found the triacs to be connected to the optocouplers much as shown below. Resistor values vary and on the microcontroller connection side the current limiting resistor is on the low side, pin two, rather than on the 5V line.

Optocoupler – Triac switch (from the MOC3043 datasheet)

There are five front panel control buttons which go low when pressed. Internal pullup resistors appear to have been used in the microcontroller.

Key PIC Pin Purpose
K3 24 RB3 Rework Power
K1 22 RB1 Up Button
K2 23 RB2 Down Button
K5 26 RB5 Set Button
K4 25 RB4 Soldering Iron Power

The two LCD displays, both are the same with seven connection pins with pin one at the top. The rework stations designers have not used the PIC’s built in LCD display functionality. The LCD panels are marked JRD90601A on the underside, I couldn’t find anything about this on Google.

Rear of LCD display
LCD1
Rework
LCD2
Soldering
Conn PIC Pin PIC Pin Purpose
1 n/a 5V
2 n/a GND
3 13 RC2 13 RC2 Data 1
4 12 RC1 12 RC1 Data 2
5 15 RC4 14 RC3 Data 3 – LCD Select
6 n/a Backlight 5V
7 n/a Backlight GND

At present I have no information about the LCD data pins, I’m thinking that RC1 and RC2 could be Data/Clock while RC3 and RC4 is for selecting the LCD to send data to.

Controller Board, LCD displays side

The Hand Key connector CN7 for the Rework Wand with pin one to the left when looking at the component side with the key notches uppermost. I have not opened the wand as it is sealed closed with glue and I did not want to damage it.

CN7 PIC Pin Purpose
1 n/a GND for temperature
2 2 RA0 Rework Temperature – through OP07C op-amp
3 n/a GND
4 27 RB8 unknown – no connection?
5 18 RC7 Up Button
6 17 RC6 Down Button
7 28 RB7 Select Button
8 n/a GND for button controls

Other Connections

PIC Pin Purpose
10 RA6 Buzzer – through Q2 (possibly a SS8550 PNP transistor)
9 RA7 U3: PC817 photocoupler – some kind of mains frequency monitor?
3 RA1 CN6: Soldering Iron Temperature – through op-amp OP07C
1 MCLR Pulled high through 10K resistor – Master Clear Pin External Reset
21 RB0 9v AC monitor?

This concludes the examination of the hardware connected to the microcontroller, further work needs to be done through software and oscilloscope observations to see how the LCD displays, power controls (probably PWM), and temperature sensors work and what the 9V AC and 220V AC monitors are doing.

Rework Connections to the PIC16F916

Circuits

Here are a couple of diagrams I drew up of the more involved sensor circuits while tracing things out. Values for the ceramic capacitors have been omitted as they are not marked on the SMD package. Both the rework and iron temperature sensors have similar op-amp circuits.

Op-amp circuit for the soldering iron temprature
9V AC monitor circuit
220V AC monitor circuit

Datasheets

A Knob for my Rework Station

For soldering electronic components I use a Tenma 21-10130 rework station, this is a rebadged Chinese model sold by Farnells under their own brand name it has a soldering iron and hot air station combined in the same box, for me it works well, does the job and is considerably cheaper than those from Hakko or Weller.

Tenma 21-10130 Rework Station

The only real problem are the controls, five small fiddly buttons on the front panel, something that appears to be common on all these ‘budget’ stations, while the temperature on the soldering iron only needs changing infrequently, the hot air temperature and flow need to be adjusted more regularly. I guess the manufacturers preference for buttons is to make the machine cheaper to produce.

Under The Cover

Removing the lid reveals the air pump, sundry tubes, a large control board and a fantastic selection of wires to discourage taking the whole thing properly to bits.

Inside the Rework Station

The onboard microcontroller is a PIC16F916, this is a 28 pin 8-bit 20MHz controller with 14Kb of program memory, 24 I/O pins and an integrated LCD driver.

PIC16F916 pinout

Fortunately the connections for the front panel buttons can be just about reached with multimeter probes, and with the mains power disconnected, I was able to buzz out each switch and find where it went to on the PIC controller.

Button Connections
26 RB5 Set Button
25 RB4 Soldering Iron Power
24 RB3 Hot Air Rework Power
23 RB2 Down Button
22 RB1 Up Button
21 RB0 no connection
20 Vdd 5 volts
19 Vss Ground

Breakout

To improve access to the microcontroller connections I built a breakout board to give me access to all the micro-controller pins via standard pin headers. On the side that plugs into the existing socket I mounted a load of 90 degree pin headers and on the other a standard DIP socket with the legs splayed out so I could surface mount it. The pin headers are little on the large side for plugging into a DIP socket so you need to check its fully engaged with the onboard socket when you push it in.

Breakout board in place
showing the header pins
the PIC controller in the breakout board

Rotary Controller

Circuit Diagram

The rotary encoder I used is the SparkFun COM-10982 mainly because it is easy to panel mount, at this stage I have not used the builtin LED’s to add effects. This connects back to the controller board which has an ATtiny84 microcontroller to convert the encoder pulses into suitable button responses. There is also an opto-isolator for the button controls and a small DC-DC 3.3 volt power supply as I don’t know the power characteristics of the rework station. I took the 5v power for the controller from the same supply as for the PIC.

The controller board with an ATtiny84

I programmed the controller so that pressing the encoder emulates the set button and cycles through the available settings; the temperatures for the iron and hot air as well as the air speed. Rotating the encoder adjusts whichever setting has been selected. In the code, the Soldering Iron Power button is shown (RW_IRN) as connected; it is not used, the LED flashes when the rotary encoder is turned, its a bit pointless as it can’t be seen once the cover is back on. I wrote this in the Arduino IDE.

There is not much free space available on the front panel of the station, the encoder can only be mounted between the connection for the soldering iron and the mains switch. I have mounted the controller circuit board on the rear panel.

Rotary Encoder in place on the front panel

Limitations

One of the problems with this rotary encoder is when its turned too quickly it gets confused and can skip pulses or operate in reverse.

Also, the speed of change is limited, the PIC controller will only see so many pulses per second, I got this down to 14ms anything lower and it was unreliable, probably this is part of some code to detect button bounce, so a fairly long pause between each button press needs to be made.

Improvements

A few improvements could be made to the rework station that could mostly be implemented in the PIC software. Those that have occurred to me are; the control for the air speed only needs to go from one to eleven, slow, medium and fast, the speed currently goes between 20 and 100 and changing the speed can be rather slow. Some sort of velocity control on the rotary encoder so the faster its is turned the greater the amount of change in the temperature. An auto-off function for the iron, so when its back in the cradle it cools down and preserves the life of the soldering tip and, most importantly, a volume control for the annoying buzzer.

I have written more extensively about the main board hardware in this teardown.

Links and Sources