All posts by Karl

drone

Sheffield Manor Lodge – Battle Re‑enactment Day, June 2018

Leave a comment

With thanks to the management and staff at Manor Lodge for giving me permission to video the event with my quad-copter. http://sheffieldmanorlodge.org/.

Featuring:

Arduino, Electronics, Hardware

Hacking the Yongnuo Wireless Controller

I wrote this back in May 2017 but it was never finished, I got distracted by other things and I needed the wireless controller for photography. I wrote all this and it would be a shame to delete it, so I am posting it now on the chance there may be of something of interest within.

I use this Yongnuo Wireless Controller in photography to control a number of flash units away from the camera body. It comes in two parts, a transmitter that connects to the hotshoe on the camera and receivers with a hotshoe that connect to the flash, a single transmitter can control any number of flash receivers within the claimed 300 meter range. The transmitter with a couple of receivers can be gotten of eBay for around £35.

Yongnuo Wireless Controller FSK 2.4GHz
RF-600TX transmitter
RF-602RX receiver

[image of transmitter and receivers]

I am looking to:

  • See how the flash is connected
  • Investigate how the transmitter works – reverse engineer as much as I can
  • See if I can control the transmitter directly with an Arduino
  • See if other devices using the same radio chip can also be controlled
  • Not destroy the transmitter while examining it

Opening it up

[images of the transmitter insides]

On the board inside you will find:

  • A power on/off switch
  • Bi-colour Red/Green LED
  • A dual-press button with two switches for operating the flash manually
  • A four way code selector (4 way DIL switch)
  • An anonymous (no markings) microcontroller – µC
  • A7105 2.4GHz FSK/GFSK ISM band wireless transceiver

On the underside, my board is marked with the following version and date:

Version: 1.21
Date: 14/04/23  – 23 April 2014

Looking at the datasheet for the A7105 it can work as both a transmitter and receiver and uses an SPI interface for user control, it appears to be popular with the radio controlled RC aeronautical drone community. The receiver looks to be very similar by way of components, using the same radio chip and anonymous microcontroller. I have not examined it in any detail and take care if disassembling as there are three hotshoe connections that need to be desoldered.

Receiver Insides
RF-602RX receiver

Flash Connection

On the Canon camera the hotshoe has six connections but we only need to examine three of these. Looking down on the camera with the lens facing away from you, the main plate where the flash slides in is ground, the large central dot is the flash trigger just below this on the left is the camera ready connection. I assume the rest are for the E-TTL functions and I have not looked at these.

Canon Hotshoe Connections
Canon Hotshoe Connections

Checking the hotshoe with a multimeter, the flash trigger appears to have a high resistance that decreases when the flash is fired, I suppose this is a legacy of when cameras were more mechanical. The Camera Ready connection goes High – around 5 Volts,  to tell the flash to wake up, that you have pressed the shutter halfway, the lens has focused and you are about to take a photo.

To find the duration of the flash signal on the cameras hotshoe I connected an almost flat AA battery between ground and flash to give me 1.2 volts to measure against on the oscilloscope (checking a canon flash itself, the voltage across the flash pin and ground is 4.47 volts). I found that the flash signal is sent by the camera for 352ms, which is quite long considering that a typical shutter speed of 1/125 second for flash photography works out at 8ms, although the amount of time a flash fires for is set on the flash and not by this signal.

Capturing the flash event
Capturing the flash event

Microcontroller Connections

I spent a while tracing out most of the transmitter circuit, I have ignored most of the supporting radio circuitry and the crystal timer as I am wanting to investigate the data side. The parts are also rather small and troublesome to investigate with standard multimeter probes.

RF600TX - Partial Schematic
RF600TX – Partial Schematic

The microcontroller looks to use internal pullup resistors for the input switches, the camera ready signal from the hotshoe switches a transistor to pull pin 16 low on the controller.

Looking at the circuit diagram we see an output to the antenna from pin 8 of the micro controller. This outputs two different square waves when the shutter button is pressed, one for camera ready and another for flash. I think these are being modulated on the transmitter output to produce a radio signal and simplify the transmitter design. Looking at the output from pin eight on the oscilloscope, the two states can be seen quite clearly:

Camera Ready signal
Camera Ready signal
Flash signal
Flash signal

These square wave outputs are always the same, I thought it may change when a different code was chosen through the DIL switches. The transmitter unit does not receive any radio data, and no acknowledgement is made by the flash units.

Using a Logic Analyser

Time to break out the Logic Analyser, this is a cunning device that allows you to see the data being exchanged between the microcontroller and transceiver, I don’t want to get too detailed but think this may help for the following sections.

The data system being used by the A7105 is SPI. The Serial Peripheral Interface bus uses four wires: Chip Select SCS, multiple chips can be on the same SPI bus, but they all have different SCS connections, the master controller chip uses SCS to tell the slave chip it wants to use for data exchange. Serial Clock SCK: This is used to provide time synchronisation for the data exchange with a fixed duration for the highs and lows. Data SDIO: This is the data being sent by the microcontroller and GIO1 is data from the transceiver sent in reply, normally for SPI this is 8 bits, to make a byte.

The naming conventions used here are from the A7105 datasheet, The SPI bus has standard names for data lines; SDIO is MOSI – Master Out/Slave In, GIO1 would be MISO – Master In/Slave Out and SCS is SS – Slave Select. In our case the microcontroller would be the master and the transceiver the slave.

SPI Single slave
SPI Single slave

The Logic Analyser displays data in a form that allows you to see the logic, here we can see two bytes of data:

SPI example
Example of SPI data

The microcontroller – µC sends data on the SDIO line and listens for replies on GIO1. When the µC sets Chip Select SCS low this tells the transceiver that the µC wants to talk to it. The µC sends a command byte followed by one or more bytes of data – a packet. During the SCS event, data is only transferred while the clock SCK is running.

SPI data, binary data from the highs and lows
SPI data, binary data from the highs and lows

We can see that the logic on the SDIO is read every-time the clock goes low, falling edge, a clock tick on the SCK line represents a bit of data, eight ticks make a byte. We now have our binary data: 00100101 for convenience this is converted into hexadecimal 0x25.

When examining an SPI bus check any available datasheets to see if the clock is set to tick on a falling or rising edge, the bit order is Most Significant Bit – MSB or Least Significant Bit – LSB, and the data length (normally eight).

Looking at the A7105 Transceiver

A7105 Block Diagram (a clearer version can be seen in the datasheet)
A7105 Block Diagram (a clearer version can be seen in the datasheet)

From the A7105 datasheet the SPI bus is set for the following:

  • To activate SPI, the SCS pin must be set low
  • data length: 8 bits
  • bit order: Most Significant Bit First (MSB)

I have made the following connections to the transmitter. Soldering test leads to the microcontroller (µC) is the most convenient place to do this.

Connections to the Logic Analyser
Connections to the Logic Analyser

This table shows the Input/Output pins on the transceiver and microcontroller, as well as the colour of wire used for the logic analyser.

A7105 Description In/Out µC Wire Colour
11 SCS 3 Wire Chip Select I 9 yellow
12 SCK 3 Wire Clock I 10 orange
14 SDIO Read / Write I/O 12 brown
16 GIO1 4 Wire SPI Data Output I/O 11 red
17 GIO2 4 Wire SPI Data Output I/O 13 white
GND Ground black
Trigger Out O 8 grey

How the A7105 organises data

The transceiver has two data modes, Strobe and Control. There are eight strobe commands to control the various modes the chip supports, these are four bits in length and always begin with a 1, where the transceiver is being operated in 8 bit mode the final four bits are ignored. The Control registers are eight bits in length and are used to configure and read settings from the transceiver, they are eight bits in length, the first bit is always 0 and the second is either 1 for write or 0 for read. The table below shows examples of a write, a read (or more accurately a request, the transceiver replies on GIO1) and a strobe command sent by the µC.

Address Byte Data
Bit: 7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
Control: CMD R/W Address Data
Write Example: 0x2 0x1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1
Read Example: 0x42 0xff 0 1 0 0 0 0 1 0 1 1 1 1 1 1 1 1
Strobe: CMD Strobe ID not used not used
Example: 0xa0 1 0 1 0 0 0 0 0

Examining the A7105 data

Data is exchanged on the SPI during two events, after the transmitter has been switched on, and when you are pressing the camera shutter or the button on the unit.

Power On

Extract of the SPI power on data showing SCS event 48, see the spreadsheet for more details
Extract of the SPI power on data showing SCS event 48, see the spreadsheet for more details

When you first switch on the unit, the microcontroller initialises the transceiver with a few hundred bytes of data, I have created this spreadsheet from the SPI data, hex data across is the most useful sheet to view:

In summary the initialisation sequence consists of the following

  • The microcontroller sets the majority of control registers to default
  • Internal calibration is started and the microcontroller keeps checking until this is done
  • Final cleaning up
  • Place the A7105 into standby mode

Shutter Press

On the SPI the shutter press action has two distinct stages, the preamble and the transmission. The preamble takes the camera out of standby mode and sets the channel it is going to be transmitting on. The transmission broadcasts the camera ready and flash states.

The Preamble
At the beginning of the datacaptue I see a preamble packet sent over the SPI:

Logic Analyser Data - first five bytes of the Preamble Packet
Logic Analyser Data – first five bytes of the Preamble Packet

This preamble looks to only appear when the flash is first operated after the transmitter unit has been switched on, subsequent use goes straight to transmit. The fifth byte changes depending on the DIL switch setting on the underside of the unit, as you can see in the four examples given in the table below.

bytes
DIL switch strobe control data strobe
0000 0xB0 0xB0 0x05 0xB5 0xF0 0xD0
1000 0xB0 0xB0 0x05 0xB5 0xE1 0xD0
0100 0xB0 0xB0 0x05 0xB5 0xD2 0xD0
1111 0xB0 0xB0 0x05 0xB5 0x0F 0xD0

Taking the first example, we can break this down to see what each byte is doing

SCS Packet IN/OUT Command Payload binary
0 0xb0 STROBE PLL Mode 0b10110000
1 0xb0 STROBE PLL Mode 0b10110000
2 0x5 0xb5 0xf0 IN FIFO Data TX data 0b00000101 0b10110101 0b11110000
817µs gap
3 0xd0 STROBE TX Mode transmission begins 0b11010000

It is difficult to work out what is going on here, according to the datasheet you send a packet of data 0xb5 0xf0 to be transmitted to FIFO Data 0x5 and follow that with the strobe command TX mode 0xd0, but what is transmitted bears no relation to the FIFO packet.

We need to look further back in the initialisation sequence and the datasheet, the A7105 has three modes of transmission; easy, segment and extension. We need to undertake a little bit of detective work to find which this is. Chapter 16.4 of the datasheet shows us the two registers used in the initialisation sequence we need to examine:

Bit: 7 6 5 4 3 2 1 0
FIFO I 0x3 FEP7 FEP6 FEP5 FEP4 FEP3 FEP2 FEP1 FEP0
Setting value: 0x1 0 0 0 0 0 0 0 1
FIFO II 0x4 FPM1 FPM0 PSA5 PSA4 PSA3 PSA2 PSA1 PSA0
Setting value: 0x0 0 0 0 0 0 0 0 0

The datasheet does not say directly so we need to go through each modes description to see which is the best fit. Segment FIFO looks good: “In Segment FIFO, TX FIFO length is equal to (FEP [7:0] – PSA [5:0] + 1). FPM [1:0] should be zero”. So our settings: (FEP:0b1 – PSA:0b0) + 1 = 2. The number of bytes sent our FIFO Data packet is also 2.

Further reading of the description “This function is very useful for button applications. In such case, each button is used to transmit fixed code (data) every time. During initialisation, each fixed code is written into corresponding segment FIFO once and for all. Then, if button is triggered, MCU just assigns corresponding segment FIFO (PSA [5:0] and FEP [7:0]) and issues TX strobe command.”

The Transmission
Taking an initial look at the data gathered during a shutter press on the Trigger Out (pin 8 of the microcontroller) we can clearly see the transition from Camera Ready and Flash as we saw on the oscilloscope earlier.

Logic Analyser Data
Logic Analyser Data

GIO2 shows a mirror of the Trigger Out, but zooming in to the data and I see that it follows the Trigger signal. Looking in the initialisation spreadsheet at SCS event we see that the command 0xc 0x1 was sent for setting the function of the GIO2 pin. Looking at the datasheet this appears to be set as an ‘I am transmitting’ signal, WTR – Wait until TX or RX has finished. If I force GIO2 low by sorting it to ground then the flash does not fire when I press the shutter

Logic Analyser Data
Logic Analyser Data

In my data capture the Camera Ready signal was transmitted six times, and the Flash signal thirteen times, I am sure this is dependant on the length of time I had the shutter button pressed on the camera.

Apologies for the inconclusive ending, I ran out of time to pursue this further

Links and Sources

history, Interesting

History: Reading Early 19th Century Handwriting

I recently posted a legal document written in 1827, this was written in hand using a quill pen (quite possibly made from a goose feather) and it is rather difficult to read, there is no punctuation, commas or full stops not even an apostrophe and the capitalisation is all over the place. There are fewer characters in this alphabet, with some serving a dual purpose in giving a value based on context rather than appearance.

Whatever is written here….

The ‘m’ and ‘n’ characters are upside down, uppercase ‘I’ and ‘J’ are both the same and some characters have still not been fully completed, so ‘c’ looks like an ‘r’ and ‘e’ looks like a ‘c’. The double ‘s’ – ‘ss’ had still not been invented at this time and words with these are spelt ‘fs’, so ‘passages’ is written as ‘pafsesges’. I have constructed this cheat sheet from that document and hopefully the chart will help you in your quest:

Letter Example
A Upper A Lower A and Example A
B Upper B Lower B between Example B
C Upper C Lower C second Example C
D Upper D Lower D hundred Example D
E Upper E Lower E same Example E
F Upper F Lower F of Example F
G Upper G Lower G shillings Example G
H Upper H Lower H her Example H
I Upper I Lower I said Example I
J Upper J Lower J jointly Example J
K   Lower K Blake Example K
L   Lower L latter Example L
M Upper M Lower M made Example M
N Upper N Lower N grant Example N
O Upper O Lower O Joseph Example O
P Upper P Lower P appointed Example P
Q   Lower Q quality Example Q
R   Lower R presents Example R
S   Lower S assign Example S
T Upper T Lower T the Example T
U   Lower U fourth Example U
V   Lower V revoked Example V
W Upper W Lower W wife Example W
X   Lower X execution Example X
Y   Lower Y yearly Example Y
Z   Lower Z Elizabeth Example Z

After few hours reading the words start to pop out, it helps that the document is written is a formulaic legalese style with many repeated phrases (were they paid by the word?).

Further Reading

history

History: A Property Contract, Sheffield, July 1827

An indenture dated 18th July 1827 for the transfer of a mortgage for £1000 and interest between Ralph Blakelock, a banker in Sheffield and the merchants; John Butcher, Samuel Hadfield, John Binney, and Thomas Binney, as well as Henry Agie a Gentleman all of Sheffield. The document looks to be describing the mortgage, rents and leases as well some land and property of a ‘large Capital Messuage or Dwelling house’ built on the site of two dwelling houses in a street or place in Sheffield commonly called or known by the name of the Hartshead. The two former houses were occupied by John Trippett and James Mycock before being ‘wholly pulled down and rebuilt’ by Nicholas Broadbent.

Indenture

Read More at: https://www.g7smy.co.uk/history/contract1827

Electronics, Hardware, Modification

TENMA Rework Station Teardown

In a previous post I added a control knob to my Tenma 21-10130 Rework Station, but now I am taking a more detailed look at the controller board hardware inside paying particular attention to the microcontroller connections.

Removing the board from the rework station was a bit of a hassle, the screws at the bottom are particularly difficult to access. Eventually I had to unbolt the transformer from the case so I could get the screwdriver in, the transformer bracket catches up against a heatsink and capacitor so it cannot be completely gotten out of the way.

Controller Board, component side

The board can be divided up into five sections, on the left is the mains power supply, with connections to the power switch and rework heater, along the bottom left is the 5V DC power supply for the microcontroller, top right is the control circuitry and connections for the rework heater and hot air, and bottom right those for the soldering iron. In the centre is the microcontroller and associated circuitry.

The rework heater, air pump and soldering iron are all controlled using triacs, these in turn are connected back to the microcontroller through optocouplers. The rework heater and air pump operate at mains voltage, 220V, while the soldering iron works at 24V, these are all using Alternating Current. Essentially the station is a collection of variable dimmer switches controlled by the microcontroller.

Wires Everywhere

There are ten connections to the controller board

Conn Purpose
CN1 Mains in – from power connector
CN2 Power Switch
CN3 220VAC out to transformer
CN4 Rework Heater
CN5 Rework Air Pump power
CN6 Soldering Iron Temperature
CN7 Hand Key – Controls for Rework Wand
CN8 AC 9V input
CN9 Soldering Iron Power
CN10 AC 24V input

The connectors CN5 and CN6 are used to provide sensing for the microcontroller; one for the soldering iron temperature and another from the rework wand with the button controls, in cradle detect, and temperature sensing, there is also a row of five onboard button switches.

Microcontroller Control

With the multimeter in beep mode, tracing back the connections to the microcontroller took a couple of days.

PIC16F916 pinout

The PIC19F916 microcontroller has 24 digital Input/Output pins which are divided into three ports of eight; RA0-RA7, RB0-RB7 and RC0-RC8. In the lists below I have shown the physical connection as well as the I/O port used.

The power control connections are to an optocoupler which in turn switches a triac:

PIC Pin Optocoupler Triac Purpose Conn
11 RC0 U6: MOC3083 TR1: BT136 220VAC CN3
6 RA4 U5: MOC3083 TR2: JST139F Rework Heater CN4
16 RC5 U4: MOC3023 TR3: BT136 Rework Air Pump CN5
7 RA5 U7: MOC3041 TR4: BT137 Soldering Iron CN9

After much tracing of circuitry I found the triacs to be connected to the optocouplers much as shown below. Resistor values vary and on the microcontroller connection side the current limiting resistor is on the low side, pin two, rather than on the 5V line.

Optocoupler – Triac switch (from the MOC3043 datasheet)

There are five front panel control buttons which go low when pressed. Internal pullup resistors appear to have been used in the microcontroller.

Key PIC Pin Purpose
K3 24 RB3 Rework Power
K1 22 RB1 Up Button
K2 23 RB2 Down Button
K5 26 RB5 Set Button
K4 25 RB4 Soldering Iron Power

The two LCD displays, both are the same with seven connection pins with pin one at the top. The rework stations designers have not used the PIC’s built in LCD display functionality. The LCD panels are marked JRD90601A on the underside, I couldn’t find anything about this on Google.

Rear of LCD display
LCD1
Rework		 LCD2
Soldering
Conn PIC Pin PIC Pin Purpose
1 n/a 5V
2 n/a GND
3 13 RC2 13 RC2 Data 1
4 12 RC1 12 RC1 Data 2
5 15 RC4 14 RC3 Data 3 – LCD Select
6 n/a Backlight 5V
7 n/a Backlight GND

At present I have no information about the LCD data pins, I’m thinking that RC1 and RC2 could be Data/Clock while RC3 and RC4 is for selecting the LCD to send data to.

Controller Board, LCD displays side

The Hand Key connector CN7 for the Rework Wand with pin one to the left when looking at the component side with the key notches uppermost. I have not opened the wand as it is sealed closed with glue and I did not want to damage it.

CN7 PIC Pin Purpose
1 n/a GND for temperature
2 2 RA0 Rework Temperature – through OP07C op-amp
3 n/a GND
4 27 RB8 unknown – no connection?
5 18 RC7 Up Button
6 17 RC6 Down Button
7 28 RB7 Select Button
8 n/a GND for button controls

Other Connections

PIC Pin Purpose
10 RA6 Buzzer – through Q2 (possibly a SS8550 PNP transistor)
9 RA7 U3: PC817 photocoupler – some kind of mains frequency monitor?
3 RA1 CN6: Soldering Iron Temperature – through op-amp OP07C
1 MCLR Pulled high through 10K resistor – Master Clear Pin External Reset
21 RB0 9v AC monitor?

This concludes the examination of the hardware connected to the microcontroller, further work needs to be done through software and oscilloscope observations to see how the LCD displays, power controls (probably PWM), and temperature sensors work and what the 9V AC and 220V AC monitors are doing.

Rework Connections to the PIC16F916

Circuits

Here are a couple of diagrams I drew up of the more involved sensor circuits while tracing things out. Values for the ceramic capacitors have been omitted as they are not marked on the SMD package. Both the rework and iron temperature sensors have similar op-amp circuits.

Op-amp circuit for the soldering iron temprature
9V AC monitor circuit
220V AC monitor circuit

Datasheets

Electronics, Hardware, Modification

A Knob for my Rework Station

For soldering electronic components I use a Tenma 21-10130 rework station, this is a rebadged Chinese model sold by Farnells under their own brand name it has a soldering iron and hot air station combined in the same box, for me it works well, does the job and is considerably cheaper than those from Hakko or Weller.

Tenma 21-10130 Rework Station

The only real problem are the controls, five small fiddly buttons on the front panel, something that appears to be common on all these ‘budget’ stations, while the temperature on the soldering iron only needs changing infrequently, the hot air temperature and flow need to be adjusted more regularly. I guess the manufacturers preference for buttons is to make the machine cheaper to produce.

Under The Cover

Removing the lid reveals the air pump, sundry tubes, a large control board and a fantastic selection of wires to discourage taking the whole thing properly to bits.

Inside the Rework Station

The onboard microcontroller is a PIC16F916, this is a 28 pin 8-bit 20MHz controller with 14Kb of program memory, 24 I/O pins and an integrated LCD driver.

PIC16F916 pinout

Fortunately the connections for the front panel buttons can be just about reached with multimeter probes, and with the mains power disconnected, I was able to buzz out each switch and find where it went to on the PIC controller.

Button Connections
26 RB5 Set Button
25 RB4 Soldering Iron Power
24 RB3 Hot Air Rework Power
23 RB2 Down Button
22 RB1 Up Button
21 RB0 no connection
20 Vdd 5 volts
19 Vss Ground

Breakout

To improve access to the microcontroller connections I built a breakout board to give me access to all the micro-controller pins via standard pin headers. On the side that plugs into the existing socket I mounted a load of 90 degree pin headers and on the other a standard DIP socket with the legs splayed out so I could surface mount it. The pin headers are little on the large side for plugging into a DIP socket so you need to check its fully engaged with the onboard socket when you push it in.

Breakout board in place
showing the header pins
the PIC controller in the breakout board

Rotary Controller

Circuit Diagram

The rotary encoder I used is the SparkFun COM-10982 mainly because it is easy to panel mount, at this stage I have not used the builtin LED’s to add effects. This connects back to the controller board which has an ATtiny84 microcontroller to convert the encoder pulses into suitable button responses. There is also an opto-isolator for the button controls and a small DC-DC 3.3 volt power supply as I don’t know the power characteristics of the rework station. I took the 5v power for the controller from the same supply as for the PIC.

The controller board with an ATtiny84

I programmed the controller so that pressing the encoder emulates the set button and cycles through the available settings; the temperatures for the iron and hot air as well as the air speed. Rotating the encoder adjusts whichever setting has been selected. In the code, the Soldering Iron Power button is shown (RW_IRN) as connected; it is not used, the LED flashes when the rotary encoder is turned, its a bit pointless as it can’t be seen once the cover is back on. I wrote this in the Arduino IDE.

There is not much free space available on the front panel of the station, the encoder can only be mounted between the connection for the soldering iron and the mains switch. I have mounted the controller circuit board on the rear panel.

Rotary Encoder in place on the front panel

Limitations

One of the problems with this rotary encoder is when its turned too quickly it gets confused and can skip pulses or operate in reverse.

Also, the speed of change is limited, the PIC controller will only see so many pulses per second, I got this down to 14ms anything lower and it was unreliable, probably this is part of some code to detect button bounce, so a fairly long pause between each button press needs to be made.

Improvements

A few improvements could be made to the rework station that could mostly be implemented in the PIC software. Those that have occurred to me are; the control for the air speed only needs to go from one to eleven, slow, medium and fast, the speed currently goes between 20 and 100 and changing the speed can be rather slow. Some sort of velocity control on the rotary encoder so the faster its is turned the greater the amount of change in the temperature. An auto-off function for the iron, so when its back in the cradle it cools down and preserves the life of the soldering tip and, most importantly, a volume control for the annoying buzzer.

I have written more extensively about the main board hardware in this teardown.

Links and Sources

Arduino, Electronics, Hardware

Using Phototransistors

With one of my electronics projects I am wanting to add a couple of phototransistors to make a crude movement sensor and to do this I first need to discover the best way of using them. A phototransistor is sensitive to the amount of light falling upon it, as this increases higher current is allowed through the device. This in turn can be used provide a variable voltage to an analogue input on your microcontroller.

For this posting I am using two different phototransistors, the SFH3710 is a surface mount device smaller than a red lentil and the TEPT4400 is through hole and looks like small white LED and is easier to prototype with, they are both NPN transistors made to respond to visible light at wavelengths around 570nm.

left TEPT4400, right the SFH3710 mounted in stripboard for prototyping

Connecting

A bias, or load, resistor is required to produce an output (VOUT). This can be above or below the phototransistor.
Common Emitter
The resistor RC acts to pull-up the voltage, as light increases the output voltage drops.

Common Emitter

Common Collector (Common follower)
In this case the resistor RE acts to pull-down the voltage, as light increases the output voltage increases.

Common Collector

Phototransistor Modes

The Fairchild Semiconductors application notes describe the two modes that phototransistors can be used in; switch and active. The mode is set by the value of the load resistor RL:

  • Switch Mode: VCC < RL x ICC
  • Active Mode: VCC > RL x ICC

Where :

  • VCC = Supply Voltage
  • RL = Load Resistor (Rc or Re)
  • ICC = Maximum anticipated current

In switch mode the transistor is either on or off, this ‘digital’ output is useful for object sensing or object detection, typically a resistor value greater than 5kΩ is adequate, the output in the ‘high’ state should equal the supply voltage, and for ‘low’ the output should be below 0.8V.

In active mode the output is variable, giving a value related to the amount of light. To use this a low value resistor is required to prevent VOUT exceeding the supply voltage, using Ohms Law you can find the maximum resistance, the value above which the transistor may respond in switched mode: Rmax = VCC / ICC, so: 5v / 4mA = 1.2kΩ. Connected up as Common Emitter, selecting a resistor value 30% below this to ensure a margin of error a 875Ω should give 4.5V at the output when completely dark, dropping to below one volt when saturated with light.

The drawback with active mode is that phototransistors have a non-linear response to light, as light increases beyond a certain level their output will suddenly jump and then flatten out, other factors, such as the ambient temperature and the type of light (daylight, fluorescent tubes, LED’s, etc) also affect the value of the output.

Practical Experiments

I want to test that the above is actually true, this circuit uses a white LED pointed at a TEPT4400 along a short piece of black straw to act as a stray light shield. The LED brightness is set using PWM on the Arduino. The phototransistor is setup for Common Emitter output, so the output voltage will drop as the light increases. For active mode RC was set to 220Ω and for switched mode this was 10kΩ.

Phototransistor Test Circuit

The code below uses PWM to fade the white LED up to full brightness, the reading taken from the analog port is a majority candidate reading, where from the ten readings made the one that occurs most often is used as the phototransistor output bounces around, I think this is caused by the PWM, the results are output on the serial port for use in a spreadsheet.

From the output, I was able to produce these graphs, remember that for the Common Emitter setup being used the voltage drops as the light increases, not quite getting the smooth response to light/time I was expecting.

With 10k resistor

With 220R resistor

I am not sure why I got these results, they were consistent and I suspect my test setup. Some more experimentation is needed, but for now I have run out of time.

Links and Sources

Electronics, Hardware, Interesting

Notes Regarding Trinocular Microscopes

In this post I am looking to discuss setting up a Trinocular Microscope for use with photography and video, covering my own experiences in getting the thing working and aspects that are not covered in the fairly useless manual. The type I am using is sold as an Industrial Inspection Microscope giving a magnification range of 3.5X to 90X depending on the installed optics. These look to come from a single factory in China and are distributed under various different brands by a variety of shops on the internet and in places such as ebay and Amazon.

In my electronics work I have been moving across to SMD (Surface Mount Devices) components, these can be rather small and fiddly for which a microscope is just the business. I chose a stereo microscope over the cheaper monocular microscope camera as this gives me a binocular depth of field view so when micro-soldering components I can make out the distance of the iron tip in relation to the board and component. In the past I have tried similar with a camera and monitor setup and this did not work for me.

Parts of the Microscope

Parts of a Trinocular Microscope

Clockwise from the top:

  • Eyepieces, to look through, with rubber cups – these make the scope easier to use. The eyepieces fitted here are WF10X/20, I’ll talk about the magnifications later
  • Ocular Tubes, the eyepieces mount into these and are used to set the dioptre – fine tune the focusing
  • Interpupillary Adjusters – to set the distance between the eyepieces
  • Objective Lenses – there are two of these
  • Focusing Knob – as you change magnification, you will need to re-focus.
  • Magnification Knob – for zooming in and out of your object
  • Trinocular Lever – pull this out to enable the camera view, when enabled the left eyepiece is blacked out. Simul-Focal microscopes do not have this.
  • Trinocular Port – camera mounting – the microscope shown comes with a C-mount adapter, here I have attached a C-mount to Fuji X-Mount adapter.
Objective Lenses on a Stereo Microscope

Other Parts
An essential addition to the microscope is some kind of illumination, an LED ring light is an excellent place to start, this mounts onto a slot on the barlow lens or a screw in adapter. You will be wanting one thats both adjustable, really bright and gives and even spread of light, look for those with at least 144 bright white LED’s.

LED Ring light

Barlow Lenses fit below the objective lenses, they are used to either reduce the magnification slightly to increase the working distance, or to add additional magnification.

Barlow Lenses

With the 0.5X barlow fitted the working distance can be raised from 9cm to around 15cm, I have not yet found any real use for the 2X barlow.

I have also fitted a 48mm UV (plain glass) filter from a camera shop, this is to simplify cleaning up the various emissions created when soldering, to this I have added a 48-52mm stepping adapter ring to give a place for the LED ring light to attach to as the 0.5X barlow lens does not have a suitable slot.

The objective lenses Magnification is shown on the right hand magnification knob, from 0.7X to 4.5X, the eyepieces are 10X and the barlow is at 0.5X the zoom is calculated by multiplying all the magnifications:

    \[total\ magnification\ = objective\ lens \times eyepiece \times barlow\ lens \]

Generally I am more concerned about the image size being appropriate for the work I am doing, but when specifying a scope you need to know what it can do, these inspection microscopes are excellent for electronics but completely useless for extreme closeups such as seeing the cells from a layer of onion.

The Field of View is shown on the eyepieces, it is the second part of the code: WF10X/20 this field number is the diameter of your objective view in millimeters at 1X magnification, the formula is:

    \[FoV\ \diameter in\ mm = \frac{field\ number}{objective\ magnification \times barlow\ lens\ magnificatoin} \]

Types of Stereo/Trinocular Microscope

These trinocular microscopes have two main types, those that are simul-focal and those that are not. As mentioned before, the standard (for want of a better name) have a lever on the left side which needs to be pulled to enable a view for the camera, this in turn disables the left eyepiece, this becomes a problem if you wish to video while you are working, for photography is is less so. These standard microscopes are a bit cheaper, around £80 – £100 than the simul-focus ones and the image quality from the optics is just the same.

I first started with a standard microscope, in the photo at the top of this page, the small stand makes it very stable for photography, and although it does not have a reducing barlow lens I have successfully used it for a few electronics projects. I have now moved onto a simul-focal microscope with a long boom arm, this is the AmScope SM-4TPZ, this type of microscope is popular among the independent repair shops on YouTube (see the links below), the boom arm and barlow lens makes it more flexible to use.

Microscope on Dual Boom Arm

Setup and Focusing

Setting up for eye focus or for camera focus is relatively straight forward, but getting the camera and the eyes to be working in the same focus can be tricky. The eyes are much more tolerant and have a greater depth of field than the camera, the following steps should give you the results you are looking for (with a 0.5X Barlow Lens, knock 5cm off the height if you don’t have one):

  • With the focus knob turned so that the scope support (the bit that goes up and down when focus is turned) is flush with the part attached to the support upright hold the microscope and loosen the upright knob at the rear, set the height of the scope so that the objective lens is around 15cm above your work surface.
  • Set the interpupillary distance to something comfortable, with your eyes hovering above the rubber cups, not in them, I use the bridge of my nose to fix the distance you should see a whole clean circle, and black shading around the sides means you are off centre.
  • Rotate the ocular tubes, dioptre, so that they are just above halfway distance in their range. Set the magnification to its lowest, 0.7X (I’m not including the magnifications of the other lenses).
  • With a specimen like a coin or ruler under the objectives, close your left eye and adjust the dioptre on the ocular tube for your right until the focus is sharp.
  • Repeat with your left eye, closing the right and adjust the left diopter. Its not unusual for your eyes to have different focal distances.
  • Now zoom in, as you increase magnification adjust the focus knob to suit, micro-adjust the dioptres as required. Once correctly set up, adjusting the focus should be minimal while zooming through the range.

Now that the eyes have been setup, its time for the camera. The smaller the cameras sensor the further away it needs to be:

  • Zoom back out to 0.7X and set the focus back to its central position, as you started with before
  • Mount the camera on the Trinocular Port and adjust the height so you see an in focus image.
  • Now as before, increase the magnification in steps 1X, 2X etc. and check the focus of the camera and eyes, put the camera into focus with the focus knob and adjust the diopters for the eyes, these should be micro-adjustments.

With everything in place, you should have a stable in focus range of around 3cm from your work surface where for a particular magnification nothing but the focus knob needs to be changed.

Photography

When taking photographs using the microscope my camera of choice is a Fuji X-Pro2. This is a mirrorless camera with an APS-C sensor, the reasons for this are: its lighter than most DSLR’s, an old fashioned mechanical plunger type cable release can be used, because the sensor size is smaller it crops out much of the tunnel effect caused by looking down a long tube, and the live view has a manual focus assist which can be used to zoom the live view display and help take a nice sharp image.

Camera attached to Microscope

The camera sensor size makes a huge difference, to illustrate this here are two photos, one with the Fuji and another with a Canon DSLR full-frame both uncropped:

Fuji APS-C sensor
Canon Full Frame Sensor

Normally I would crop to a square inside the image.

The depth of field is rather shallow and there is no aperture to change. To get around this I have used Image Stacking/Focus Merge, where you take a series of photos starting at the top of your object and focusing slightly further down, each image being a slice, I then use Affinity Photo to create a fully focused image.

Image Stacked Daisy

I set for a low ISO, around 100-400 and being lazy I use auto-exposure. Despite the bright LED light exposure times are generally quite long, 40th-60th of a second and bumping up the ISO to grainy makes little difference, cropping in post can make high ISO grain more apparent. I have made a suitable mount for a macro flash from the lid of an old spray can, a resize ring, small bits of wood and plenty of epoxy (I should have documented this).

One thing you may see in your images is a white dot in the centre of the photo, this is most obvious when fully zoomed in and is caused by light bouncing around the trinocular tube leading to the camera:

With the dreaded White Dot, and fixed

this is simply fixed by inserting a tube of matte black card running the length of the camera mount, in this case 40mm:

Cardboard inserted into trinocular mount

Video

I use a dedicated microscope camera for video, the photo cameras while I am sure they would work well have a built in time limit for recording and need attention, I also want to record directly on computer. The camera I use is a generic nameless blue box bought of ebay, on the computer it has the name “H1400 USB Camera” and I have it on a USB 2.0 port outputting 1080p at 30fps in to Open Broadcaster without any problems, it can also do HDMI and can take still images at 14 megapixels (apparently).

Video Camera for the Microscope with a 0.5X reduction lens

The big drawback with the camera is that the sensor used is tiny compared to those used for photography, this appears to be common among almost all video cameras designed for microscopes. To partly fix this a reduction lens can be fitted to the Trinocular Port, I use an AmScope FMA050 (aka RU050) 0.5X reduction lens which I got of ebay. You can see the cameras view in the sketch drawn on 5mm graph paper below, with the magnification set to 0.7X the outer circle is what I see through the eyepieces, the rectangle is what the video camera supplies to the computer:

Microscope limited video camera view

These cameras would also benefit from being able to provide an image in the old 4:3 aspect ratio as that is much more square than the 16:9 widescreen. The view to your eyes in the microscope will always be substantially better than that presented by the camera.

To Conclude

For a trinocular microscope suitable for micro-soldering I would recommend a simul-focus, its only little extra money for the functionality with the 0.5X barlow lens. AmScope do cheat the magnification a bit, not pointing out the need to swap barlow lenses round to get the advertised 3.5X to 90X range, but with the 0.5X barlow attached it goes upto 22.5X or without it is 45X, on the electronics for most of the time I work at around 15X only zooming in close for inspecting bad soldering and showing off.

As I live in the UK, buying through Amazon UK has the advantage that import duty is paid at checkout, AmScope ship from the USA (a well traveled Microscope, made in China) using UPS, this prevents holdups in customs and UPS’s hefty tax collection fee, ebay have a similar Global Shipping Programme.

Using the microscope for the first time is an odd experience, its interesting how your fingers adjust to the micro-distances, finding the occasional need to wave the soldering iron about until it appears in your field of view and looking at dead insects under the microscope, while eating, is probably best avoided.

Crows Feather

Links and References

Microscope Suppliers

  • AmScope – USA, also available on Amazon UK and ebay
  • GT Vision UK Supplier, also on ebay

YouTube microscope users – Independent Repair Shops, mostly iPhone and Apple Macs

Computer, Hardware, Interesting, linux, Raspberry Pi

Bluetooth Low Energy (BLE) on the Raspberry Pi

4 Comments

Bluetooth Low Energy – BLE – Bluetooth 4.0 is an industry-standard wireless protocol built for the Internet of Things – IoT, it is designed to provide connectivity for devices operating from low capacity power sources such as coin cell batteries.

Raspberry Pi2 with ASUS USB-BT400 Bluetooth 4.0 Dongle

In this introduction to BLE I’ll be configuring a Raspberry Pi2 computer to talk to a smart watch. We will be installing the latest version of BlueZ from source, enabling BLE support. This is not a tutorial on decoding the data from the watch I am just using it as an example, although I may write about decoding it in a future posting.

I am using a ASUS USB-BT400 Bluetooth 4.0 Dongle on a Raspberry Pi2 but this will work on any computer with a Debian based distribution. Your dongle must be BLE/Bluetooth 4.0 capable otherwise this won’t work. I am using an ID107HR activity tracker with pedometer and heart rate monitor, randomly chosen from the list of cheap ones available on Amazon. While using the Pi to talk to the the watch make sure Bluetooth on the phone is off as it can only connect to one device at a time.

The current distribution of Raspbian – jessie on the Raspberry Pi comes with version 5.23 of the BlueZ Bluetooth stack that’s rather old, dating from September 2014 which lacks many of the features we will be needing. The current version 5.44 of the BlueZ has many changes in the package with many familiar components such as hcitool and gatttool being depreciated, so I will be ignoring those and using the available commands, bluetoothctl, on the terminal.

Installing BlueZ

With Raspbian – jessie installed we will need to update the Pi make sure some packages are installed and then installing the latest version of BlueZ. But first, remove the installed version 5.23 of BlueZ:

Next, perform the traditional housekeeping updates then install the build tools and USB libraries. Those parts that are installed already will be automatically skipped.

Now, download the source code, at time of writing the current stable release is version 5.44, check the BlueZ site for the latest version.

Inside the BlueZ directory, configure, make (this takes a while), and install. The experimental option adds BLE support and enabling the library allows for python use later on:

Configuring and Starting BlueZ

At this stage we will need to check that the installation worked and that we can see your bluetooth dongle. With your bluetooth dongle in a USB port you should see it on your list of USB devices, here you see mine as device ID: 0b05:17cb ASUSTek Computer, Inc.:

You will also need to enable the experimental services, edit the file /lib/systemd/system/bluetooth.service and in the [Service] section change the ExecStart line to end with –experimental:

Start the bluetooth service, and while we are at it enable it to load on boot:

Once started, check the status of the bluetooth daemon with:

Should you need to, the service can be stopped and prevented from loading on boot with:

Finally, you may want to enable auto-power on for the device, to do so create this bluetooth config file:

and add these two lines:

You should restart the Pi at this point and check that the daemon has loaded properly with sudo systemctl status bluetooth

Testing BlueZ

Start the bluetooth controller, you should see your dongles MAC address and alias:

for first time use, try scanning to find your watch, if it doesn’t appear it is out of range, its battery is flat, or your dongle does not support BLE, here you can see it as ID107 HR:

bluetoothctl remembers your devices, so when you next use the program the watch appears on the list at the start. The controller has a number of options, these can be seen with help command. You can use show to view the status of your dongle:

The list of UUID’s show the services supported by the Dongle. Now we can power the dongle on, set the agent – this manages the connection, and then connect to the watch on which the bluetooth symbol will appear. Once connected there will be a pause then you will see a list of attributes supported by the watch, it is advertising the services available:

and now that we have connected we can ask for some info:

These UUID’s are used to describe the sevices available on the device, some are pre-defined and can be found in the a href=”https://www.bluetooth.com/specifications/gatt/characteristics” target=”_blank” rel=”noopener noreferrer”>GATT schema, others are vendor specific and unless they publicly release these, decoding can become rather difficult. There are four types of attribute:

  • Services – collections of characteristics and relationships to other services that encapsulate the behavior of part of a device
  • Characteristics – attribute types that contain a single logical value
  • Descriptors – defined attributes that describe a characteristic value
  • Declarations – defined GATT profile attribute types

Each attribute is identified by a 128 bit ID, for example, one of the characteristics from the list above: 00002902-0000-1000-8000-00805f9b34fb, the first eight bits are used as an unique identifier: 00002902 and are shown as UUID’s: 0x2902. Data is contained in services, each service has a number of characteristics that may contain further descriptions depending on the requirement of the characteristic. You can see how the data is mapped out in this chart:

Service Containers

A spreadsheet with the watch data reformatted and tastefully coloured to illustrates this. Observe the Service URL column, it looks a lot like a directory structure:

Here we see two services /service0008 and /service000c looking further into the second service: /service000c we see that it has four characteristics, and to of those have descriptors. We can interrogate the characteristics and descriptors to glean further information by selecting the attribute and reading, like so:

Which is all very nice, but not particularly helpful as the manufacturer has chosen to use custom, proprietary, UUID’s for the watch. We don’t know the instructions to send to have the watch realease its data.

Those Scripting BlueZ

Inevitably, you’ll be wanting to automate connections. This becomes easy with the automation scripting language expect. Install, then make a script file:

In this example the script forgets the watch, finds the watch, connects to the watch, gets some info and then disconnects:

in the script, send sends a command, don’t forget to add the carriage return – \r and expect is used to wait for a response within the timeout period, here it is set to 10 seconds. expect -re is using regex when looking for a reply, otherwise it uses a literal string. So much more can be done with expect and there are many tutorials, such as this one written by FluidBank.

More Bluetooth Data

For analysing bluetooth data a couple of very useful tools are available, Wireshark and Android data logging. I will go through the installation but not look at the data in any detail, this posting is getting a bit long. This Section is in two parts, installing Wireshark and Android Debug Bridge.

Sniffing with the Shark
Wireshark is a network and bluetooth packet sniffer, it shows you network and bluetooth traffic occurring on your Pi. Here is a quick installation method for a reasonably new version of Wireshark (v2.2.4) from the backports, answer yes to the question “Should non-superusers be able to capture packets?”:

and if you get a message about permissions, reconfigure the package and answer yes:

Start Wireshark and double click your bluetooth device on the list, in my case bluetooth0. There is not much to see as Wireshark will only see traffic between the watch and the Pi:

Wireshark Data Capture

Android Debug Bridge – ADB
For Anroid 4.2.2 and above, activate developer mode on the phone, go to Settings, tap About Phone and at the bottom of the list tap Build Number three times. Back in the main settings page Developer Options has appeared, tap developer and turn USB debugging On. With the phone plugged into a USB port a little Android head should appear in the information bar at the top-left of the screen. To begin we will need to install some udev rules written by Nicolas Bernaerts:

Install the android tools, confirm that you have at least version 1.0.31, and start ADB

At this point on the phone an allow USB debugging dialog will appear, give permission and always trust to authorise it. ADB will now show the device as a device:

If the device list is empty, with everything plugged in good and proper and the phone setup in developer mode, start your diagnosis by checking udev; open another terminal window and view logging with udevadm monitor –environment and reload with sudo udevadm control –reload I’m not entirely sure what I did to get it from ‘not working’ to ‘working’. If all else fails elevate yourself to root.

Data Capture
With ADB now setup we can capture the Bluetooth data being exchanged. With bluetooth off, in the Developer Settings find Enable Bluetooth HCI snoop log and turn it On. In the smartwatch app synchronise with your watch, once complete turn Bluetooth off manually – this is to minimise the amount of captured data. Don’t forget to turn logging off on the phone when done. To find where the log file has been stored and copy the file from the phone to the Pi use:

We can now use Wireshark to read the log file…

Wireshark reading the Android Bluetooth Log

This wasn’t quite the posting I originally had in mind, I wanted to decode the data from the watch for my own use, making something more useful, impressive graphs and charts, than that provided by the Android App VeryFit 2.0 but as the manufacturer has chosen to use proprietary GATT codes it makes the job that much harder. It may be much simpler to just buy an expensive FitBit and download the data from them. But with writing this I now know a few things that were previously unknown, and I hope that this has provided some light to your BlueZ (a pun!, right at the end!).

Links and Sources