TubeTime

Recently I obtained two Coby DP-151SX digital photo keychains to see if it is possible to hack the device. The answer is yes. These devices can be purchased for as low as $9, and I thought they might make a good source of color LCD displays. There is a project to hack small photoframe devices such as these, and they have already developed some tools to hack the firmware and display dynamic images (such as an MP3 player status screen) using the USB connector on the device. The Wiki at the previous link is a good resource.

Below is a photo of the disassembled device. Click the photo to see the Flickr notes annotating different parts of the device.

The specs of the device are as follows:

• LCD: Varitronix COG-C147MVGA, 128×128, chip-on-glass (COG) integrated controller with white LED backlight.
• CPU: Possibly the ST2203U 65C02-compatible device with built-in USB engine.
• FLASH: Spansion S29AL008 1Mx8 NAND FLASH memory.
• Battery: 180mAh 3.7V lithium ion rechargeable.

The ST2203U uses a 65C02 processor core with several peripherals: a DMA engine, FLASH memory controller, real-time clock, LCD controller (not used in the Coby device), and a USB engine. It has an onboard mask ROM, but this appears to be disabled on the Coby device. Since resistor R12 is jumpered with a zero-ohm resistor, the ST2203U boots from the external memory. If R13 was jumpered instead, then the device would boot from the internal memory. Apparently the program that comes with the Coby device has the ability to download new firmware through USB. I’m tempted to write my own firmware for this creature, but the lack of an ICE along with a decent toolchain has deterred me.

The device has a built-in battery charger. I have not yet attempted to reverse engineer it yet. The lack of inductors makes me think it’s a linear charge circuit.

The most interesting part, at least to me, is the LCD screen. It has a built-in controller which appears to be similar to or compatible with the PCF8833. Varitronix, of course, does not provide data on this particular LCD display. Based on a little reverse engineering (since many of the control lines are shared with the memory chip) I was able to figure out a pinout:

1. VCC (3.0V, but it probably works at 3.3V too)
2. GND
3. Unknown. Connected to the COG IC but is not driven as an output. This may be the OTP programming control pin.
4. NC (but can be connected to the COG IC with a jumper on the flex cable, J1)
5. CS# (Chip Select)
6. D/C# (Data/Command)
7. RD# (Read)
8. WR# (Write)
9. RST#
10. D0
11. NC
12. D1
13. NC
14. D2
15. NC
16. D3
17. NC
18. D4
19. NC
20. D5
21. NC
22. D6
23. NC
24. D7
25. NC
26. LED Cathode
27. LED Anode

The next step is to detach the LCD and wire it up to a breakout board. Then I can connect the breakout board to a microcontroller and attempt to communicate with it.

CNET’s Crave has a really fascinating post about a gentleman in Vietnam who has figured out how to unlock 3G iPhones–as of this writing, there is no software way to unlock this phone.

Unlocking iPhone 3Gs–the Vietnamese way

There are some interesting pictures showing some methods used by the Vietnamese technicians to remove and replace the flash memory device. They use a cheap hardware store heat gun, which is normally used to strip paint, to heat the solder until it melts, and then they remove it with tweezers. One of the problems with this sort of rework is that the adjacent components often loosen and shift or even fly off completely.

Look at the last picture in the article. The technician is using some small metal plates to protect the other components from the blast of hot air. Genius!

My Wagner fan restoration has progressed well (see previous posts). Recently I finished the final assembly. I took the entire fan apart and cleaned every part. Many of the parts needed to be repainted, and the fan blade needed to be stripped of the paint and polished.

Here are all the pieces laid out. Please click on the photo for detailed Flickr annotations. brittnybadger has taken some really great photos of household appliances in similar “poses.” I wish my photo was as good as one of hers.

The oscillator gearbox looks really interesting. Here it is before I added gearbox grease. It takes the high speed rotation of the fan motor and slows it down using two worm gears, and then drives the crank which rotates the fan from side to side.

There is still some work left to be done. The fan blade is made of steel which was copper plated before being painted. Time has not been kind to the plating. When I stripped the paint, I could see green corrosion and pitting that ruined the plating, so I had little choice but to polish off the rest of the copper plating. I have not yet decided whether to leave the blade steel or to get it copper plated again. Regardless of that I like the look of an unpainted blade.

The headwire which connects the fan motor to the base and the switch also needs to be replaced. The rubber insulation underneath the cloth has gotten brittle and cracked. Similarly, the line cord is not original and I need to do some more research to find out what an original line cord looks like.

Finally, I need to make some safety upgrades. I have already added a fuse in the base that will prevent shorts in the motor windings from causing a fire. I still need to add a grounding wire since the case is metal and could shock people if one of the motor windings touches it.

During the restoration process of my antique Wagner fan, I found that the bearings are a lot different than the Emerson 28646 I restored. This particular fan has a bearing on the front and one on the rear of the motor housing, and each bearing has an oil sump, some small holes to allow the oil leaking from the front and rear of the bearing to trickle down into the sump, and a wool wick that uses capillary action to “pump” oil out of the sump and bring it back up onto the bearing surface. Here’s a picture that shows how it all works:

In the picture, the oil sump is the lump protruding from the bottom of the round bearing housing. You can see the small hole that allows oil to drain back into the sump. On the inside of the bearing, there is an ovoid hole that lets the wool wick contact the rotating shaft and apply oil sucked up from the sump. You can click on the picture to see the Flickr annotations. Here is what the wool wick looks like:

The small round washer acts as a plug to keep the wool wick inside the bearing, and the hole is where you add oil. The wick itself is made of several strands of worsted wool yarn that have been tied with string. Originally this was a black lump of grease when I first pulled it out of the bearing, but I was able to clean it up by soaking it in laundry detergent. A greasy oil wick prevents it from working, and my Wagner’s front bearing was bone dry when I first took it apart. If you’re doing a restoration and you need to replace the wick, you must use real wool. Synthetic fibers apparently do not have same degree of capillary action. Wool wicking is also the material of choice for steam locomotive bearings.

The wick fits in the hole on the top of the bearing.

Here is a photo showing the assembled bearing (minus the washer).

I used a pencil to pack the wick into the bearing. It is now ready for oiling. I am using the 3-in-1 SAE 20 oil that is meant specifically for motors. It does not smell so strongly as the multipurpose 3-in-1 oil. In this picture below, you can see the wick soaked with oil on the fan after final assembly:

Add oil about 10 drops at a time and allow it to soak in for an hour. Do this again until the part of the wick you can see is saturated. If you add too much oil then it could spill out of the top, so you don’t want to add more oil than the wick can hold. It’s important to make sure the wick never goes dry so that your bearing will always be properly oiled.

At the electronics flea market, I found another antique desk fan. This one is a Wagner 9″ oscillator, series M, model 5260, model L53A68. I am not certain when it was manufactured: my guess is the early 1940s.

On the rear of the fan you can see the oscillator gearbox:

Here is a closeup of the fan’s nameplate. It has everything except for the date of manufacture.

This fan is in reasonably good condition, compared to the Emerson that I restored before. There is very little rust which makes the restoration job much, much easier.

Here are some photos of my latest clock. It uses large Panaplex-style neon-filled displays. I do not know the part numbers or the brand: these appear to be factory rejects, and each of the digits appears not to meet mechanical tolerances.

Under each digit is a reed switch that you can trigger using a magnet to change the number of that digit. The circuit board sits behind a regular picture frame where the glass has been painted black from behind. I masked off rectangular regions to allow the displays to show through, and I hand painted the “P” for the PM indication.

This is what the circuit board looks like:

The 180V power supply is on the lower right of the circuit board. The microcontroller timekeeping circuit is located underneath the leftmost digit. It is a PIC18F2420. I am using the onboard 32KHz oscillator with an external watch crystal, but I left room for a DS3231 timekeeping chip. It supports a battery backup, and you can see the place where it would go on the board right underneath the hour digits.

The left edge of the board has a row of header pins that I use to check the voltages, program the PIC in circuit, and probe the cathode voltages with a scope. The neon numerals have very interesting electrical characteristics, and eventually I will post an article about that.

Panaplex displays must be multiplexed to prevent damage. They are slightly more finicky than Nixie tubes, but the driving circuit is quite similar. I had to add a set of clamping diodes to limit the voltage swing on the cathodes (each segment is a single cathode).

This design was very fast and straightforward. I spent two evenings prototyping the circuit and getting the multiplexing working, another two evenings to enter the schematic and lay out the PC board, and two days to assemble, test, and finish the clock software.

So you’ve obtained an antique desk fan, and you want clean it up and restore it, but you just can’t seem to figure out how to get the blades off. Based on a number of email inquiries, here are instructions for removing the blades from certain Emerson antique desk fans. You will need some basic tools, including an Allen wrench, a flashlight, and a wrench appropriate to removing the cage.

Before you begin, you’ll need to remove the cage so you have easy access to the fan blades. Usually that means you need to undo the four bolts holding the cage assembly to the front of the motor casing.
Next, you need to examine the rotor of your Emerson’s motor using a flashlight. Look for a “blind” hole drilled into the side of the rotor. These are drilled by the manufacturer to remove some metal and balance the motor.

Once you’ve found the hole, insert the Allen wrench through one of the vent holes in the motor casing and into the balancing hole on the rotor.

The next photo shows a closeup of the Allen wrench inserted into the balancing hole.

When you do this, be very careful not to damage any of the stator windings. They are very fragile and protected only with a layer of cloth tape.

Once you’ve got the Allen wrench in position, grasp the fan blade by the blade hub (commonly called the “spider”). Yes, the blades will provide more leverage, but they bend pretty easily, and once you’ve bent a fan blade, it will never be the same again.

The threads fastening the wheel hub to the rotor are left-handed, so you need to spin the hub clockwise to unscrew it. The hub on my fan had frozen onto the rotor, and no amount of physical force would get it turning. I trickled some penetrating oil down the hub so it could get into the threads and free things up, but even after that I had to heat up the hub spindle with a heat gun. The heated metal expanded and broke the threads loose. It made a terrible squealing noise when I unscrewed it.

And the blades are off! You’ll want to clean up the threads at this point to remove any crud or rust, and add some oil to make it easy to remove the blades next time.

Yesterday I went to the local electronics flea market and picked up some interesting items. The first is a 3BP1 3″ round cathode ray tube. It was in the original box which was still sealed and coated with wax.

The label indicated that the tube was manufactured in 1945.

Of course I needed to open it to make sure the tube was intact. Many times these tubes are stored upside down, and often fragments of various internal parts will break off due to vibration, fall down, and ruin the phosphor screen.

I half-expected an Indiana-Jones-style puff of ancient air as I broke the seal.

And yes, it’s in perfect condition. The outside of the tube is slightly dirty but these tubes really didn’t need to be cleaned before leaving the assembly line to work properly.

The next find is an RCA 5820 Image Orthicon tube. This tube came in the original box which indicates that it was shipped to KGO-TV in San Francisco in 1953. It would have been used in the RCA TK-11 TV camera which was very common at the time.

This is a closeup of the front.

And here you can see the internal elements. The round bit in the middle is actually a very fine mesh screen.

Digging through my junk box today, I unearthed the scanning mirror from a laser printer, otherwise known as the Heart of the LaserJet. It’s got the infrared laser that generates the image as well as the scanning mirror that creates the raster. It’d be fun to get it up and running for nefarious purposes…

The scanning mirror and motor uses a “custom” (undocumented) Panasonic motor driver, the AN8247SB. As usual, Google returns a million hits for grey market parts brokers who spam the keywords with things like “PDF” and “datasheet” without offering any actual information.
So my usual plan of attack does not succeed.

The second step is to examine the single 5-pin connector to see what I could figure out. Pin 3 is obviously ground because it is the only pin connecting to any large ground planes. What I suspect to be pin 5 appears to be the power supply since it connects to two very low valued resistors (0.75 total) which probably perform a current sense function. Most of the other pins disappear inside the undocumented chip.

Digging around in my junk box produced the power supply board for the laser printer. I was able to find the other side of the connector and quickly verify that pin 3 is indeed ground. What I thought was pin 5 is actually pin 1, and it is indeed power. Tracing back through the power board I notice that it connects to a filter capacitor with a 25V rating. Based on that I conclude that it is very likely a 12V rail. I soldered some jumper wires onto the board and began experimentation in earnest.

Connecting the board to 5V didn’t result in any excessive current, so I slowly ramped up the voltage to 12V. Nothing happened. Not even anything bad.

Looking carefully at the laser printer’s power supply board, I traced the other three connections. They all went into a big microcontroller, but the wiring connections were different. Pin 2 had a 10K pullup to some low voltage supply, pin 4 went straight into the microcontroller, and pin 5 came from an RC filter from the microcontroller.

First I tried connecting a 10K pullup resistor to pin 2 on the motor driver board to 3.3V, and I hung a scope probe on it. It was a logic low. I spun the mirror assembly, and I saw pulses! This must be the tach output. By rotating the mirror very slowly by hand, I counted 6 pulses per revolution.

Next I probed the voltage on the other two pins, which were both weakly pulled up to about 3.6V on the motor driver board. I pulled pin 4 low, and the tiny mirror spun up with a whine to about 13,000 RPM (as measured by the tach output)!

That was really great because I was worried that those two pins were I2C control lines which would have made reverse engineering a lot more difficult. It’s not impossible because you can hook it up to a microcontroller and scan all possible I2C address to see if any slave devices respond, then randomly try to access registers… It gets pretty messy anyway.

The last pin gave me a bit of a headache because grounding it didn’t really do anything. I tried grounding it through an ammeter and noticed that the current, although it started at a few hundred microamps, tapered off quite rapidly. There must be a capacitor in series somewhere on the motor board, and that means the pin is designed for AC signals. Since no signal came out of the pin, it must be an input. I connected a function generator at a few kilohertz with a 3.3Vp-p square wave, and when I turned on the motor, I noticed that it “cogged” a lot and generally had a hard time. On impulse, I dramatically increased the frequency. Suddenly the motor slowed down and settled at a constant speed. By changing the frequency, I could manipulate the motor speed.

So pin 5 is a synchronization input. I guess the RC filter on the microcontroller side was designed to help reduce EMI in the cable. The next step was to figure out the relationship of input frequency to output speed, so I connected my trusty old Nixie frequency counter to the output of my function generator and my multimeter (set to frequency) to the tach output. The ratio appears to be fixed: divide the input frequency by 136.6 and you’ll arrive at the RPM of the mirror.

Here’s the complete pinout:

1 – +12V
2 – Tach output (open drain, 6 pulses per revolution)
3 – Ground
4 – Enable (active low, so drive it low to turn on the motor)
5 – Synchronization input

Now it’s time to come up with projects…

Just to give you a hint, I have something in mind involving a photomultiplier tube.

Drop me a line in the comments if you think you can guess what my idea is, or to post your own ideas, or even if you find this information useful for your own project.

Restoring the antique fan also involved some safety upgrades. Along the way, I derived the schematic. The motor has three connecting wires, but the trick was to figure out how the wires connected to the motor windings.

I measured the resistance between each wire, assigning the wires the arbitrary designators A, B, and C. The resistance between A and B is 53.3 ohms, B and C: 35.3 ohms, and A and C: 19.1 ohms. Assuming the star configuration shown in the figure below, it’s possible to calculate R1, R2, and R3 as follows. R1 + R2 = 19.1, R2 + R3 = 53.3, R1 + R3 = 35.3, therefore (solving for R1, R2, and R3 using substitution) R1 = 0.55 ohms, R2 = 18.55 ohms, and R3 = 34.75 ohms. Clearly R1 is just the center tap and R2 and R3 are motor windings.

Based on this information and similar measurements performed on the speed coil, the schematic was reproduced as follows:

This schematic shows two of the safety upgrades. First, I added a 3-prong AC cable and connected the metal chassis to the safety ground. Then, I added a fuse inline with the AC hot. The fuse serves two purposes: it prevents a fire if the motor windings short, and it also will blow if the AC hot shorts to the chassis.
Here’s what the underside looks like without the cover. The switch contacts, the fuse, and part of the speed coil are all visible.

The original speed selector switch lever was metal, which was not very safe because the lever was connected directly to AC hot. Only the plastic knob prevented a nasty shock. I fabricated a new lever out of FR-4 fiberglass sheet. The knob itself was originally molded onto the metal lever and I could not remove it, so I made a new one by casting a replacement out of epoxy.