Category Archives: Teardowns and reviews
SRF01 teardown and reverse engineering
SRF01 components

SRF01 components

I needed small ultrasonic sensors for a flying sensor. So I got the smallest one - . Quite nice unit, works down to 0 cm. There were some problems with it - Maximum detection frequency is only ~14 Hz and the resolution isn't so great (1 cm). Also, on some occasions after falling from a high height the transducers broke and sensor would only give out constant distance reading. To fix the broken sensors (which I had many) and to satisfy my curiosity I took one apart and reverse engineered it.

From component side: It has series 3 pin connector for communication and power. Since the working voltage is 3.3 - 12 V it uses LP2980 3.3V voltage regulator to power all the components. The transducer used is 400PT from china/Multicomp. Received signal is amplified by dual 10MHz op-amp. Then it is fed to ADC. The ADC frequency 500 ksps so the whole received 40 kHz signal is digitalized for analysing. This gives the benefit of extra resolution and ability to measure distances closer than 30 cm. Normally this is not possible with one transducer design because the transducer is still ringing from transmitting.

Schematic of SRF01 analog front end

Schematic of SRF01 analog front end

SRF01 PCB backside

SRF01 PCB backside

The analog front end is an active band pass filter. First stage is configured with a gain of 26x and second one with 5.6x. Gain-bandwidth product for both stages is <=1 MHz so the op-amp is more than decent enough. Filter cutoff frequencies are 8.8 kHz for low pass and somewhere >70 kHz for high pass. Top capacitor is somewhere in the pF range where my multimeter can't measure.

The necessary driving signal is generated by two IO pins. Driving the transducer this way gives 6.6 voltage peak-to-peak to the speaker. After generating 8 pulses @ 40 kHz it switches bottom pin of the transducer to GND and top side to input.

In conclusion it is a nice little sensor. It does some nice tricks to get its performance. Control software is has one pin serial interface to get data. Biggest problem with it is the detection rate. Measurement can be triggered only every 70 ms. The reason for this is to hear echoes for the maximum range of 6 m. Good idea, but for shorter distances the time could be much shorter. This speed is good enough for human interface, but not good enough for many control applications.

EDIT: Lot of people were interested in the failiure reason and fix. The failiure was caused by mechanically braking tranducer. I managed to destroy 5+ sensors and all of them had the same problem. Broken tranducers had slightly different capacitances, I didn't measure other parameters. Same tranducers were available from Farnell for quite cheap so I just swapped these for any broken sensor.

Glucose meters teardown
Three different glucose meters

Three different glucose meters

I got my hands on three different glucose meters. Glucose meters consumer level medical devices. They normally have chemical test strips that you put your blood on and then plug the strip to the meter. Meter measures the test strip either electrically or optically and displays the result.

Bayer Ascensia Entrust

Bayer Ascensia Entrust

First one to look at is the oldest of the meters: Bayer Ascensia Entrust. The design looks oldest and lowest volume. There are many components: MCU, external ADC, multiple opamps. The screen is through hole soldered. It also has a card edge connector for calibration card. With each pack of test strips there came a small memory stick with calibration data for these strips. Quite complicated and expensive, but this is what was necessary for precise measurements.

Accu-Chek Active insides

Accu-Chek Active insides

Second one Accu-Chek Active is a bit newer and looks more like a mass production device. Atmel microcontroller and only a few external components. LCD ribbon cable is hot bar soldered to the main board. Sensor looks like an optical measurement with several optical sensor dies on the PCB. Like the first one it has slot for calibration sticks.

Contour TS insides

Contour TS insides

Third is Contour TS. Smallest and most consumer level. Single chip solution, no amplifiers or calibration connectors. Buttons are rubber membrane and LCD is zebra strip - cheap and easy to manufacture.

It is interesting to see same product develop through age. All these tree provide the same purpose, but have different levels of complexity and very different BOM prices. There is more electronics integration from device to device with Panasonic custom chip in the last one. But there are also developments in sensor technology that allow to measure with same precision using cheaper electronics.

VoltaLumen bus stop LED screens
Demo of a installed bus stop screen that is not working at the moment

Demo of a installed bus stop screen that is not working at the moment

So Estonian LED display company VoltaLumen installed bunch of LED displays to bigger bus stops in my home town Tartu. As always - this requires a teardown. As it turned out - taking it apart without destroying it is practically impossible. It has been riveted shut and painted over. That stopped my teardown a bit.

In the accessible hatch there was bunch of debug connectors. RS485 for control over the wire, USB for programming, SD card slot for flashing firmware and GPRS modem slot. RS485 and 230VAC connections are brought out of the screens via nice cable for local controlling. Information is sent over RS485 in XML format to change bus times and clock. It also has an internal RTC, so clock synchronization doesn't has to happen every day.

From LEDs side - it uses orange PLCC2 leds. Quite high brightness, blinded us several times in the lab. Fortunately there is brightness control.

 

Overview of bus stop LED screen

Overview of bus stop LED screen

Insides of screen maintenance panel

Insides of screen maintenance panel

Close up of the LEDs

Close up of the LEDs

Aoyue 950 soldering iron and vacuum pen
Aoyue 950 unboxed

Aoyue 950 unboxed

After another frustrating desoldering session I ordered desoldering hot tweezers. Because I don't know how much will I use it I bought the cheapest - Aoyue 950. The price was about 50 € with shipping.

It came with two sets of tips: sharp and big blocks. Big blocky ones looked fine but the design was so stupid that it didn't work on any component I had.

Next - I teared it apart. The insides look like normal cheap chinese station. Big ugly transformer and even uglier piece of electronics.

In the end of the day - device works, makes desoldering of some components easier. As a common tool I would recommend hot air station first but to a bigger lab - this is a good tool to have for those nasty situations where other tools are not so suitable

Insides of the Aoyue 950

Insides of the Aoyue 950

Cracked bottom from the transportation

Cracked bottom from the transportation

 

 

 

 

 

 

Double vacuum pen

Double vacuum pen

I also got a vacuum pen. Useful when using solder paste method to assemble PCBs. It is a small box with a speed control button and two vacuum heads. Mechanics are exactly the same as in regular aquarium pump. It uses two channel diaphragm/membrane pump to make the vacuum. Another trick I like is that they use non filtered mains to move pump up and down.

Device itself comes with different tips, but for small components it is best to use syringe tip on original nozzle.

Insides of a vacuum pen pump

Insides of a vacuum pen pump

Multicode transmitter
Satel multicode transmitter

Satel multicode transmitter

I got my hands on a broken Satel OY multicode transmitter. It is an transmitter used to get information from remote sites - alarm codes, telemetry or sensor values. You can attache it to your pump or ground station and it sends a message up to 30 km if something is wrong. It puts up to 4 W of output power to VHF band 152 MHz in FSK modulation. As alarm systems go - it also had a place for backup battery.

This device is designed and produced in the end of nineties and it can be seen from the build. Old chips and packages.

The device itself is screwed in a thick aluminium box for weatherproofing, RF shielding and mechanical rigidity. Input power and signals come from DB15 connector and all go through low pass filters for protection. It has to survive the scariest test ever - the user! The brain of the thing is socketed Atmel TS87C51RB2 in a PLCC44 package. It is a device before flash memory - only single programmable!

Overview of transmitter

Overview of transmitter

From RF section we don't find fancy transceiver chips. Frequency synthesise is done by temperature controller temperature oscillator in a separate metal can. Modulating multicode is generated by Motorola MC14515 PLL frequency synthesizer. Bunch of analog RF circuitry filled by RF inductors does the modulation and matching. The output is amplified by BLT50 Power amplifier that is used out datasheet frequencies. Do your own datasheet - typical for RF power stuff. They don't use air core inductors, so they lose a bit of efficiency, but since it is externally powered they don't care. Also TLC542 ADC is used to get some feedback from RF front end.

Back side of the PCB

Back side of the PCB

Power amplifier and insides of a TCXO

Power amplifier and insides of a TCXO

Laserworld CS-500RGY
Laser projector, working

Laser projector, working

I got my hands on a Laserworld CS-500RGY laser projector. This is the smallest 500 mW one. It is a device that has three laser sources (red, red and green) and mirrors for moving laser pointer. It can be controlled by sound, DMX512 or ILDA interface. So, lets tear it down.

Case is really rugged and strong, made to last. Also has two fans for forced air cooling. Most of the insides is empty, they use the same chassis up to 2 W RGB projectors. Electronics is really modular and all through hole assembly. All what you would expect from low volume device and more than 10 year old company.

The laser assembly has two beam splitters that combine three laser sources into one. They two motors with feedback are used to move mirrors into correct angle.

Laserworld laser insides

Laserworld laser insides

Laser assembly, two small red lasers and one big green.

Laser assembly, two small red lasers and one big green.

Mirror assembly with two stepper motors.

Mirror assembly with two stepper motors.

Main processor with firmware sticker

Main processor with firmware sticker

MIMP, Advanced Design Studio, scikit-rf

I was searching for a program to match RF circuits. I already calculated input complex impedance and choose pi filter as topology.

First I looked Motorola Impedance Matching Program. It is really old program, runs in Dosbox and is quite awful. User interface is manageable after reading the manual couple of times. Got the filter values from the program, but I'm not sure in these since I'm not sure I used it correctly. But in its free and cross platform so, why not use it.

I also tried Agilent Advanced Design Studio, but yea, it is meant for full time RF engineers. It looks like it can do everything. Usability is almost okay, feels inconvenient like ltspice.

Next I tried to simulate the circuit with scikit-rf. Importing the network worked fine, but the easy part ended there. To make components I first needed to make Media. There was no lumped element Media, so I took the one easiest to use - Freespace. Also the connections don't sound really correct.

#Program accepts one argument - C1 value in picoFarads of PI filter. 
#It outputs transistor output impedance (calculated from amp.s1p file) 
#and a graph showing preferred PI filter component values.
import matplotlib.pyplot as plt
from pylab import *
plt.ion()

import skrf as rf
rf.pico = 1e-12

import sys

#amp that we are matching only S22
amp = rf.Network('amp.s1p')

print amp.z

#we need media to make components. weird
media = rf.media.Freespace(amp.frequency)

def get_db(C1, L, C2):
   #pi filter begin
   C1 = media.shunt_capacitor(C1*rf.pico);
   L = media.inductor(L*rf.nano)
   C2 = media.shunt_capacitor(C2*rf.pico);

   filter = rf.connect(rf.connect(rf.connect(amp,0,C1,0),0,L,0),0,C2,0)
   return filter.s_mag[0][0][0]

print get_db(10,22,7)

out = []
for L in range(1,15*3,3):
   out.append([])
   for C2 in range(1,15*2,2):
      out[-1].append(get_db(int(sys.argv[1]),L,C2))

#raw_input()
#print out
figure()
title('Pi matching network, C1 = '+sys.argv[1]+' pF')
imshow(out)
xlabel('C2 value [pF]')
ylabel('L value [nH]')
xticks(range(15), range(1,15*2,2))
yticks(range(15), range(1,15*3,3))
cbar = colorbar()
cbar.set_label('Return Loss Magnitude')
grid(False)

show()

raw_input()
PI filter values in respect of output reflected power.

PI filter values in respect of output reflected power.

And this program provides graph you can see on the right. Really nice graph what in theory should show right values. I like how I can look at the graph and pick values that exists in the shop and see how effective filter would be. But again, I can't verify these values on other tools so there is probably small miscalculation in my code.

Saike 898D teardown and upgrade
Saike 898D soldering station

Saike 898D soldering station

So I tore town my hot air station another day. It was bugging me that it restarted every time my refrigerator turned on. Probably a problem with not enough (if any) filtering.

Couple of screws later and it popped open. First impression - it is dirt cheap. Well, it is THE cheapest hot air and soldering iron station but wow.. It has a big transformer in its core. Transformer powers board with microcontroller, that controls the screen and buttons. Power for the soldering iron comes from different winding and is controlled by thyristor through a opto-isolator.

Main PCB and cabling of soldering iron

Main PCB and cabling of soldering iron

Some critisism: Single layer paper PCB, insides is a cabling nightmare. Everything is through hole, because you know - workforce is free.. It didn't even have a 7805, but a TIP122 transistor and a zener. Very weird design that I have also seen in couple of other ultra cheap Chinese stuff.

Positive side: it is really cheap - under 80 €. It works - I bough it some years ago and still no problems. All the tips and replacement parts are available really cheap also. So, I recommend it.

Front side of the board. Notice LED driver mounted on an angle.

Front side of the board. Notice LED driver mounted on an angle.

The upgrade: It actually had a lot of Y2 capacitors from power lines to mains earth. But I live in an old soviet building where is no mains earth. So I added more capacitors. Mains line got a biggest X2 that I found. Circuit 5V power line got couple of big electrolytes and some of small ceramic capacitors.

I also found the soldering iron tip grounding line and added 1 MΩ resistor between it and the ground. This gave me the ability to solder live circuits. Before I had couple of nasty incidents.

Owon DS7102V teardown and review

Some time ago I bought myself a Owon DS7102V 100MHz oscilloscope. It is similar to the Rigol entry level scope DS1102E, but thinner and with bigger screen. Oh, this beautiful screen, totally worth the money. But as time passed first flaw of this eBay originated scope surfaced - the fan broke. It didn't stop, it just started to make screeching noise whenever I turned it on. When taking aparart for the first time I also managed to break soft power button.. Oh well. I ordered new 12 V 60 x 60 x 10 mm fan and KDC-A11 power button to fix it.

Internal layout is really impressive. One third of the scope is cheap power supply, middle section is battery compartment, and all the scope electronics is one small PCB. Whole scope worth of electronics small enough to put in pocket.

Interesting chips I found from scope:

Internal layout of DS7102V

Internal layout of DS7102V

DS7102V power supply

DS7102V power supply

Old KDC-A11 next to new one. Slight problem with pin sizes.

Old KDC-A11 next to new one. Slight problem with pin sizes.

LCD connector board

LCD connector board

Small bodge inductor, probably against ripple on the line.

Small bodge inductor, probably against ripple on the line.

Keyboard PCB

Keyboard PCB

Analog board top view

Analog board top view

Top view with cheap looking ADC, FPGA  and ports.

Top view with cheap looking ADC, FPGA and ports.

Filters and amplifiers

Filters and amplifiers

Signal relays and more analog stuff

Signal relays and more analog stuff

Eeweb and advertising

Eeweb wanted to exchange links with me. Like always it sounded like a trap, but no. On closer examination it came out that they host webcomic that I read every week. I just have to link them now: http://www.eeweb.com/rtz . Because I love webcomics.

Return to Zero webcomic

They also wanted me to link their toolbox. So I checked it out and I was baffled to see all those tools. All calculators I had needed and that I couldn't find like Trace Resistance calculator that I needed for my last project and couldn't find one. And all done in pretty javascript, eye rests on it.

To not make it too one sided: check out Ohm's Law calculator on the12volt.com. Basically it has calculators to calculate I, U, P and R from each other in every combination. Super useful if you are too lazy to bend the formulas.

And to make it clear, they didn't pay me. I link them and everybody else because I like the content. At some point I thought about putting advertisement on my page to make it pay for itself, but now I don't want any more. There is enough stupid ads everywhere and I don't need that money so bad. Besides, if you are like me, all the ads take you to HobbyKing anyway, so go there without ads and buy their stuff. They are good and cheap.

Rework station
Saike 898D soldering station

Saike 898D soldering station

I have got myself bunch of cheap lab stuff. The most expensive of them - Saike 898d rework station. This is the cheapest combination of soldering and rework station on ebay - only 80€. While waiting it to arrive I figured out why all packages from China take a month to arrive - they are in Russian customs for 25 days. Or at least that is why my soldering station was in the post for a month.

The experience of the soldering station so far is amazing. The hot air soldering is as it should be - adjustable temperature, air flow and plenty of nozzles, not some wrecked and broken station in the school lab.  Desoldering chips is convenient like it should. Unfortunately I haven't bought solder paste yet, so soldering chips on is still annoying.

The soldering tip part is good to. I managed to damage the tip in a week, because of mu clumsiness. I bough new and wider tip what works really well with everything I have soldered (DIP, SOIC, TQFP). It still is one of the best irons I have used. Ground pads take a second to heat up but compared to my old 5€ iron - still awesome. Its so good to have good soldering station just for yourself, I highly recommend getting one.

Hot air rework part review.

Ebay no-brand 4070L LCR meter
Ebay 4070L LCR meter

Ebay 4070L LCR meter

I wanted to play around with some inductors and self made transformers, so I bougth the cheapest LCR meter. It cost about 14€. No fancy autorangeing. As a positive suprice it mesaures capacitances very fast and more or less precise. The downside is that the smallest resolution in inductance it can measure is 10μH, what is most times not good enough, when designing switching regulators.

Inside of LCR meter.

Inside of LCR meter.

I took it apart. The insides didn't have anything very fun. Typical ebay quality. The MELF package resistor network on the right side was a bit funny but that's all.

ebay digital DC voltmeter teardown
Cheap voltmeter in action

Cheap voltmeter in action

I bough 3$ digital DC voltmeter from ebay. I needed one for my power supply and I have became too lazy to build such things myself. It looks awesome, is not very precise. I found SMD potentiometer from the back that calibrates the voltage for about 1V, so, yea. Not precise at all. So, teardown time!

PCB of the voltmeter

PCB of the voltmeter

PCB is reasonable quality, two sided, plate through holes. SO-16 package in the middle that does all the work, part number is sandpapered off. I searched a bit and now I know that it is not a AVR nor a PIC. Probably not ASIC either because cheap chinese things have these in die bounded to PCB, but you never know. Pin 1 is GND and pin 2 is Vcc. Power circuit has protective diode in series and then 3.0V SOT89 regulator with 10µF tantalum capacitor for power. The display is 3x 7 segment display with dots. It has 8+3 pins so everything is multiplexed, bad for me, I wanted to change the comma position.

The input goes through 330k resistor and 4.7k potentiometer, so it should affect the input by about 1.5% of the full 100V scale. There is 10k resistor and 10µF tantalum between signal and input. So, some heavy low pass filtering and about 1/34 voltage divider. The input signal goes to pin 14.

Bottom side of the voltmeter, just some tracks

Bottom side of the voltmeter, just some tracks

I tore it apart to see if it can be easily modified to a ammeter. The cheapest ammeters cost about 3-5x more than voltmeter. To modify it to ammeter I have to modify voltage divider ten times smaller to measure shunt voltages from 0-1V. Also more of an visual thing - I have to move the dot one place left. But the placement of the dot is determined by the chip, so I can't move it. I can use it for my own purposes but I can't sell an unit with wrong comma placement, even to a friend. Damn.

Pictures of RF boards

I have recently started spending a lot of time in University of Tartu Space Technology lab. RF boards in the trash box look so beautiful that I just had to make pictures. Since I don't know what all these boards to, the descriptions can contain errors.

Overview of the RF board.

Overview of the RF board.

Random inputs? and some filtering.

Random inputs? and some filtering.

One of the big RF amplifier chips on the board.

One of the big RF amplifier chips on the board.

The other RF amplifier, even bigger than previous one.

The other RF amplifier, even bigger than previous one.

Output filter? or amplifier?

Output filter? or amplifier? The component is mounted on gigantic heatsink on the bottom of the board.

Power circuit of the board.

Power circuit of the board.

Old RF filter board.

Old RF filter board.

Overview of the board.

Overview of the board.

Output part of some old RF board.

Output part of some old RF board.

Middle section of the same board.

Middle section of the same board.

Input side of some old RF board.

Input side.

Overview of 3G telephone mast PCB. Golden stripes show where the metal shielding connected to the board.

Overview of 3G telephone mast PCB. Golden stripes show where the metal shielding connected to the board.

Golden bottom side of the same board.

Golden bottom side of the same board.

Random

Random

Probably some input filtering

Probably some input filtering

Power supply of the telephone mast

Power supply of the telephone mast

Beefy amplifiers

Beefy amplifiers

Another switching regulator part

Another switching regulator part

Awesome cascaded filters

Awesome cascaded filters

Weird add on card, looks like magnetic-core memory

Weird add on card, looks like magnetic-core memory

Some more magnetic-core memory

Some more magnetic-core memory

GP3974 High Speed USB 2.0 4 Port HUB For Laptop 480Mbps FAKE!
Cheap (and fake) usb hub from ebay.

Cheap (and fake) usb hub from ebay.

So I needed USB hub for my robot. So I bought one from eBay. When it arrived I started to test it, because, well, i don't trust eBay. It worked well when connecting one device, but stopped working with multiple devices.

Fake USB hub taken apart

Fake USB hub taken apart

After testing it a bit i decided to take it apart. The insides looked a bit suspicious - there were no crystal and one pad for crystal was connected to ground. I decided not to waste more time on it.

No chip inside, only tracks.

No chip inside, only tracks.

But then! Kalle appeared and took the piece of glue away with reworking station. And all the fakeness was revealed. It didn't have any chip inside, only tracks. And USB husbs must always have some chip inside that deals with all the traffic. This one worked as a junction box - if you connected one thing then it worked, if several - they shorted each other out.

But whatever. I'm not unhappy, I got cool box and bunch of connectors for 1.8$, but all you, who need a real hub, don't buy it. I bought it from shop named gogo21shop.

Crompton Ci3 Power Meter quick teardown
Power component side of Crompton Ci3

Power component side of Crompton Ci3

So I'm writing some host side software for Crompton Ci3 Power meter, and I thought to show the insides of it. The unit itself is a three channel industrial voltage, current and harmonics monitor. It is used in grid substations. Datasheet It is made out of one 4 sided PCB and LCD. Power tracks are in middle layers, probably for safety reasons.

Component side:

On the left there are 0.015Ω shunt current sense resistors for current and wattage measurements. On the center is probably the power supply for the logic. On the right side there are precision voltage dividers (made from couple of megaohm resistors). Left bottom - LCD flex cable connector. Top right - crystal and decoupling capacitors for MCU.

Bottom side of the PCB

Bottom side of the PCB

Bottom side:

 This is much more boring, and for some weird reasond, covered with some goo. There are some passives in the current measurement section. Also there is the main MCU of the unit. It is Atmel's AtXMega256A3 with some firmware sticker on it. They problably chose this processor for its fast ADCs. On the right there are programming pads but the firmware is probably write protected. The board runs on 3.3V logic.

RS485 plugin board

RS485 plugin board

Plugin board:

And finally - the RS485 plugin board. It has MAX1483 RS485 tranciver chip and three optocouplerers for protection. On the final version of the product I'm working on I will probably omit this board for cost savings, and mount my own board instead of the plugin board.

Barcode reader
Disassembled barcode reader

Disassembled barcode reader

Lately I have been enjoying looking teardowns and tearing down random electronics myself, because it teaches so much about electronic design - what chips to use, how to lay them out, how to solve common problems etc. So while trashing around in dorms storage rooms I found a barcode reader. It seemed like a good thing to disassemble. It connected with some weird DIN5 connector so it wasn't usable anyway. It had both connectors - female and male, probably to daisy chain it with something.

So I ripped it apart. First thing i found was an awsome linear CMOS image sensor tcd1201d. I even found it's datasheet. It is 2049px sensor with 1MHz speed. I use one just like that in my other project so it went to that project's box. After sensor there was 8x PLCC2 LED, piezo, some 74 series logic and Freescale MC68HC11 microcontroller, seems cool but not worth desoldering. After putting it back together, I striped the wire and sent +5V to red wire and GND to black one. It lighted up and beeped like a weird weapon (or a barcode reader).

Image sensor from barcode reader.

2048 px image sensor and its optics.