Monday, December 29, 2014

LED Light Panel Teardown and Evaluation

For a long time I've been wanting to take better quality photos for my blog, and although I have a few issues to take care of, like a better camera and a way to position it, the main thing holding me back is lighting.  The only way I can take half decent photos at the moment is with exposures in the range of one tenth of a second, which is fine for still photography, but it rules out videos.

I've tried to overcome this problem with things like LED spotlights, but quickly come to realise that they cast too many shadows and have intense reflections.  What's needed is a distributed, even light source.  Instead of reinventing the wheel I looked at professional photography solutions like soft boxes and light tents, and although they work well, they're rather bulky and cumbersome.  It'd also be nice if I could use the lights for general electronics work as well.  So I looked at what's recently become available due to the advancement of LED technology.

I came across these cheap ($30, AUD) LED panel lights from China and thought it was worth buying one to test out ideas.  The one I bought is 200 mm x 200 mm and is only 14 mm thick.  The construction is similar to how the back light in an LCD TV works, but we'll get to that later.  I didn't have a way to mount the light for testing but as luck would have the edges are only a few mm thick and it fits perfectly into my Panavise PCB holder.

Light Fitting
LED Light Panel 200 mm x 200 mm in Operation
The label on the back of the light says it's rated for 85 - 265 V AC which is pure B.S.  The driver module that comes with the light will take that but the light itself takes around 60 Volts DC.  I could understand if the two were integrated, but the driver unit is connected via a removable barrel jack, so the light should be labelled separately.  The colour temperature isn't what I'd normally go for, it's way too orange, but for testing it'll be fine.  The light is rated for 18 watt and will apparently output 1600 Lumen.  I have to take them at their word on this as I have no way to test it, but for comparison those number aren't too different from the LED fluorescent tubes I have. 

Light Fitting
Light Panel Back - 18 Watt - 3500 K - 1600 Lumen
Teardown time.  removing the back panel shows what I expected, a panel of optical material bordered by a strip of surface mount LEDs.

Light Fitting
Light Panel Interior
The back panel has four foam blocks to keep the layers of optical material sandwiched together.

Light Fitting
Back Panel with Foam Compressors
I mentioned before that the way the panel is lit is similar to how an LCD TV back light works.  I'd wouldn't be surprised if the manufactures of these devices are use the same materials because of low cost due to volume.  For something so effective it really is quite low tech.  LEDs border the edge of a clear sheet of plastic and shoot light into the panel.  The light bounces around in the clear sheet and leaks though the diffuser in a controlled manner to give an even light.  There's a bit more to it than that, but that's the gist of it.

The image below show the construction of the optical materials.  The thin white layer at the bottom is the reflector panel  that's patterned to help the light escape the light guide.  The clear thick section above it is the material that transports the light.  The off white section above that is the diffuser panel and is also the outer face of the light.

Plastic Optics
Plastic Reflector, Diffuser and Optical Waveguide
The diffuser has the same look and rough texture as a milk bottle has near the handle.

Optical Plastic
Light Diffuser
Looking through the optical guide to the reflector sheet on the back, if you look closely, you can see the pattern that helps the light escape the panel.

Plastic Reflector
Light Reflector
The power is supplied to the LED strips by couple of wires that are soldered directly to pads on them.  You can see in this image that the small amount of tension applied to the wires is causing the strips to come away from the frame.  This is a problem, as the frame is also the heat sink for the device and poor bonding will lead to the LEDs getting hotter than they should, causing premature failure.  I'd already made the decision to drive the panel to only 80% of its rated capacity, I think that was a good call.

LED Wiring
Power Connection to LED Strip
The LED strips form a loop around the border and consist of two strips containing 45 type 2835 surface mount LEDs each for a total of ninety 200 mW LEDs.  It's a very peculiar arrangement that I can't seem to find any information on anywhere.  Looking at the strips it can be seen that the LEDs are in groups of five, and we know that each strip draws around 30 Volts (60 volts divided by two strips in series).  This means that there's 30 Volts across 5 LEDs, giving a forward voltage of 6 volts, which is way too high for white LED.  After a bit of searching I've been able to find dual junction LEDs that are basically two LEDs in series in one package.  I assume this is done to get a higher power rating without needing a higher current, as this would increase the size of internal connections.

LED Strip
LED Strip Specifications
The two strips are soldered together on the other side of the panel.

LED Strips
Join of the two LED Strips
I hooked the panel up to my lab power supply and took some current and voltage readings at different operational points.  This is a bit new for me, I've embedded the graph from a Google sheet into the page so you should be able to hover over the each data point and the see the accompanying details.  Disconcertingly there seems to be a couple discontinuities in the graph.  I have a feeling this is due to either the multimeter measuring the current or voltage automatically switching ranges. (I need better equipment)

For the hell of it I used my phone to measure illuminance. I'm not sure why, I think I just needed to know that there was a relationship.  You can't actually read anything into this data  There's no guarantee the sensor in the phone is linear and my test set-up wasn't very rigorous.


The drive module supplied with the device seemed flimsy and I wouldn't use it if you paid me to.  First of all, it apparently only outputs 45 volts, but it managed to get to 59 Volts in the one test I did with it connected to the panel.  So I'm not sure what's happening there.

LED Driver
LED Driver Module
The internal construction is average.  The wires are barely soldered to the PCB, and the only way to get the wires out on the mains side of the box cause the active and neutral wires to be switched around according to the markings on the case.

LED Driver
Top Side of LED Driver PCB
There seems to be an attempt at isolating the mains from the output, and indeed the multimeter shows no connection, but I'd feel better if there were some isolation slots, and as for the feedback path, I couldn't see any suitably rated opto-couplers.  It may be marginally fine if used in a roof space, but if I'm touching the thing I don't want the output connected to mains making the frame live.  I like to live dangerously, but not stupidly.

LED Driver
Bottom Side of LED Driver PCB
So now down to business.  What's it like at actually illuminating things?  The image below is a quick test using a PCB from an old modem, and I'm quite happy with it.  It looks pretty good and has an even illumination.  Not withstanding the colour temperature and the camera quality I think this could work.  A couple of panels lighting the scene from different directions would work quite well.  The other advantage is that the exposure time for this image was less than a tenth of my usual photography.

PCB
PCB Lighting Test
As a final test I thought I'd see what it would look like as light table.  Maybe you're trying to track down where an internal trace goes, who knows, but I think it works well allowing you to see features you'd not normally see.  For instance, in the top left you can see a trace between two vias that connect two traces on the other side of the board.
PCB
PCB Light Table Test
I'm certainly going to do a bit more research on these products, I think they show promise and will allow me to create better content.

Thursday, December 18, 2014

Sensitech TempTale 4 USB Teardown

I was recently at a local recycling centre and saw that they had some second hand temperature data loggers on sale for $2.50.  At that price how could I not buy one to see how they worked.

If you're not familiar with the this kind of data logger, they measure the ambient temperature at regular intervals and log the data to internal memory.  They're typically used to monitor the temperature of stock through a logistics chain, be it refrigerated or not.  For example, if you run a grocery store and you notice that the quality of the fruit on sale isn't of an acceptable standard, you might get your supplier to put one of these in a delivery to monitor the temperature throughout the cold chain.  By doing this you may be able to detect that the refrigeration in the truck isn't at the right temperature.

Temperature Logger
Temperature Logger
The nice thing about this logger is that it has a built in USB cable.  When plugged into a computer the temperature logger appears as a mass storage device containing a pdf report and an encrypted file containing the logged data.

Temperature Logger
USB Cable
From what I can tell, the PDF report isn't actually stored on the logger,  it's generated dynamically from the logged data when the device is plugged in.

PDF Report
Logged Data Report
The specs on the back of the logger are a bit lacking.  It covers a temperature range of 0 to 30 degrees Celsius, and records data every 10 minutes for 111 days.  If you do the math, that comes to 16 thousand samples, that's where the 16K in the device ID comes from.  The SU indicates that this logger is single use, so it's not really any use to me.  There is software to configure the device that may be able to reset it, but it's not free and not worth the effort.  One thing that did surprise me is that there aren't any specifications for accuracy or resolution of the temperature measurements.

Plastic Case
Back Panel and Model Details
As the device was of no value to me I decided to pull it apart.  At first I tried to do it carefully, but when it wouldn't come apart I assumed that it was ultrasonically welded to stop moisture ingress.  So I decide to destructively take it apart.

After removing the sticker that covers the front, you can see the start and stop logging buttons that are an integrated part of the plastic case.  It should also be obvious at this point that they aren't too worried about moisture ingress,  there are holes all over the front panel, and although they're covered by a sticker, it's not ideal.  Having said that, the device isn't designed to have a long life.

Plastic Case
Buttons Moulded into Case
After hacking away at it, I soon found out where the the screws were hidden.

Plastic Case
Hidden Screw
There are little indentations on the back that I thought were part of the case, but it turns out that they are stick on covers that hide the screw head.

Plastic Case
Removing a Screw Cover
My initial guess that the case was ultrasonically welded together was wrong, it's just screws and a rubber seal.

Plastic Case
Rubber Waterproof Seal
When opened you can see the top (it's probably the back, but I'm calling it the top) of the PCB.  Nothing surprising here.  The battery that powers the device can be seen to the right.

Circuit Board
Top Side of PCB
The back side of the device isn't anything special either, the LCD is connected to the board with a standard zebra connector.  The dome contact switches can be seen below the chip on board assembly that contains the LCD driver.

Circuit Board
Back Side of PCB
Let's have a look at the ICs on the PCB.  The first is an Atmel 32 bit micro controller that handles the USB communication, and presumably generates the PDF report when the logger is plugged into a computer.  It's also likely that it coordinates taking temperature measurements and storing them in memory.  To meet the requirement of 111 days of operation it's likely that the micro-controller makes extensive use of sleep modes.

Circuit Board
AT91SAM7S256 32-bit Microcontroller
The 32 KiB Atmel EEPROM is most likely used to store the logged temperatures.  This makes sense at it has enough capacity for 2 bytes per sample.

Circuit Board
AT24C256C 32KiB EEPROM
The Texas Instruments quad FET bus switch is most likely used as a level converter to allow communication between ICs that operate at different voltages.

Circuit Board
SN74CBTLV3126 - Quad FET bus Switch
The purpose of the Winbond 512 kiB flash memory isn't clear to me.  Maybe it extends the program memory of the micro-controller, maybe it holds a template of the PDF report file, could be something else, I'm unsure.

Circuit Board
25X40CLNIG 512 kiB Flash Memory
Finally we come to the actual sensor, it's a bead style thermistor.  I was expecting something different, maybe having it thermally bonded to the case to get a better response.  It could have been mounted a little better, but I guess it does the job.

Circuit Board
Bead Thermistor
You may have a nagging feeling that something is missing.  A temperature logger that runs for 111 days should have some way to keep a stable time base, so there should be a real time clock somewhere, and sure enough, on the back, there's the expected 32 kHz watch crystal.  The traces from the crystal run into the chip on board assembly that contains the the driver for the LCD.

Another thing that I'm not sure about is how the thermistor is read, as the traces run into the chip on board.  I can think of two possibilities here, either there is an A to D converter that reads the thermistor and communicates the data to the micro-controller digitally, or there's a signal conditioning amplifier the feeds the signal to the on board A to D of the micro-controller.

Monday, December 8, 2014

Listening to the SPI bus of a Flash Memory IC

It's time for another update on my attempt to reverse engineer the protocol used by a toy that plays animal sounds.  To bring yourself up to speed I suggest reading the couple of posts I've done on this topic.


The goal is to figure out how the data is stored in flash memory and then replace it with my own audio, so far I've had no luck.  I had one last hope of figuring out how everything worked, and that was to get a logic analyser and listen on the SPI bus.  I thought if I could see what memory was accessed and when it was accessed I might be able to gain some insight into the operation of the device.  So that's what I did, but unfortunately things didn't work out.

Anyway, I'll still document how things went.  The first step is to solder some wires onto the signals of interest and bring them all out to a row of header pins to connect to the logic analyser.  To listen to the SPI bus we need MISO, MOSI, SCLK, CS, GND, and to see the audio I connected a a line to one of the speaker terminals as well.

Circuit Board
Probing the Flash memory
I hooked everything up, set the logic analyser to trigger when it sees data, and then swiped a card.  Success, it recorded all the data lines and decoded the data transmitted on the SPI bus.  Everything seemed to be going well until I realised that the amount of data transmitted was nowhere near what I expected, and the decoded data was just gibberish.  You should be able to see structured requests for data on the MOSI line, but all I was getting was random bytes.  It was then I did something I should have done a week ago, I probed the clock line of the flash memory.

Oscilloscope Display
Clock Signal
Facepalm.  My logic analyser only runs at 24 MHz, but the clock signal is 33 Mhz.  From what I've been able to gather, the operational frequency of the logic analyser should be 4 times the frequency you are trying to decode.  In this case that would be 132 Mhz.  I'm wayyyyyy off.  (Note: the sine wave above is expected.  The bandwidth of the scope is only 60 MHz, so only the fundamental frequency is making it's way through. The higher frequency components of the square clock signal have been filtered out.)  This means that unfortunately the logic analyser won't be able to help me.

It was also noted that the device requests data from the memory in bursts.

Oscilloscope Display
Burst of Clock Signal
I was able to see some activity on the MISO and MOSI signals

Oscilloscope Display
MISO Signal

Oscilloscope Display
MOSI Signal
I probed the speaker to see how it operated.  As expected it's just a PWM signal. It has a period of 15 uS and the drive signal is at most on for 2 uS, a duty cycle of 0.13.

Oscilloscope Display
Speaker PWM Signal
So that's pretty much it for me on this one.  To make things more interesting, it's been recently announced that there are an extra 72 cards that play sounds in addition to the original 108.  So we are now at 180 sounds, each one approximately 4 seconds long.  720 seconds of sound in 16 Mib of memory is not easy.  That equates to a data rate of 23.3 kb/s, so there has to be some sort of compression.  I'm assuming it's ADPCM not mp3,  I searched the binary data for mp3 frame headers and found nothing.  That's great I think I know the format of the data, but the ADPCM format isn't well defined, and there are hundreds of different possible algorithms.

Another possible lead I've been following is the software from a company called Nuvoton.  The Voice Prompt Editor for their chipcorder series of ICs may be able to program and read the memory, but it needs a password for installation.  I'm not saying they are the manufacturer of the chip, but it's worth a shot.  I'd really love to know if someone has more luck than me with this problem.  So, get to it internet.

For your convenience, here is the dump of binary data from the flash memory.

Although I didn't succeed in decoding the data in the memory, I used an EEPROM programmer and a logic analyser for the first time and learnt some of the pros and cons of each device.  I definitely want a higher speed logic analyser though.  Santa ,cough cough. :-)