A while ago I picked up a CC1110 from eBay for cheap as we were looking at doing an IM-ME clone, Eventually got around back to the C11xx work.
ChipCon were bought by TI in about 2006, for the CC family, see the clue? the devboard I have is actually from the pre TI days, so I was amazed when in 2016 I downloaded the TI Smart RF software it connected and saw the board. The two dev boards also actually worked so lucked out on eBay again…
On plugging in it asked to update the firmware, which I did. . After that I could use Smart RF to control the board, but not from the board itself, no LCD display. So I went off and looked for old versions of Smart RF and older HEX files, no luck , OEMs always want to get rid of that stuff, they should make it all available but it is a support headache from the help vampyres, and TI’s forums had a few similar questions that mostly dead ended.
So I looked into the host chip, it’s a SI 8051F32, so needs a yet another debugger interface, I looked it up and see its USB Debug Adapter for about $30, not bad. It has an unusual shape and I recall having one, so I went and dug around and found it in a box, I actually had took it out of a box, looking through various devboards, looked at my hand and there it was, great…
So downloaded SI’s production programmer, still works, doesn’t read back only verify and program.. (is the verify download and compare, checksum or compare on chip) saw eclipse mentioned/java and went back to look for a different programming tool, SI have a utility dll from programming, read docs same deal only a memory downloader, check the memory map 0x0 – 0x3FFF with after 0x3DFF reserved. Once I connect the USB Debug Adapter to the new software it want’s to update the firmware, here we go again, flashes and its OK after a USB reset.
Connected to the board, downloaded it to a “log file” which is literally a dump of the memory in either dec(with leading zeros) or hex, and a cr\lf… quick sed script add commas to the dec, load it into an array, oh yeah, leading 0’s so it thinks its base 8 octal. redo it in hex output, add 0x, and end with , read it into an array write it out.
convert the newer TI supplied hex that didn’t work files to bin from the new 40 version, compare the two against the one I just read. they’re similar at the start, but it is shifted.. I realise the bootloader is there as as a separate hex, it’s loaded from 0x0 – 0x0800, so I chop that off and wrote out the file. they are now only slight differences, 0xFF where 0x00 is in the hex, this is likely a skip in the hex (unlikely since the hex file showed a single section) or the default erase byte .
Had I been watching the hex2bin output I’d have seen the start address of the firmware as 0x800, so at least independently verified, had too many windows open..
Lowest address = 00000800 Highest address = 00003BDB Pad Byte = 0 8-bit Checksum = BE
So now all have to do is reflash the board with the code from the second board that I did not upgrade, so convert the .bin to .hex, either without the bootloader and reflash it with the TI tools, or clone one to the other and reflash with SI adapter.
Reflashed the whole thing in the end, which reverted it to 28 build.. Still no display when the EM is connected….so either flash on the EM module (which still works in Smart RF) mode or theres something wrong with the EM module…
and yes reflashed the cc1110 and its back to life! Probably should have tried that first
Probably going to be a longish entry, at least video wise.
One of the things that’ll improve usage, bit life, finish quality etc is having the computer control the speed of the motor. As i mentioned in the last log the flashcut can’t do it without an upgrade, given a crappy HID numpad with a cover is about $500. I didn’t want to ask. I started to look at Mach3, discovered Mach4 pushed off backlash compensation to the drivers boards I thought I’d try another way. Before I go on, CNC people are the religious types, like car people. Backlash is bad, can do terrible things, but being able to correct small amounts of it for certain things is useful to me, it is a tool and like any tool it can be used incorrectly, but I still want the option to do it.
All I had as an output on the FlashCut box was 1/0 low voltage digital on the controller side, and 0-24v or measuring resistance on the VFD wasn’t a whole lot to go on, sure I could buffer the signals but that is still on/off , can’t make a DAC since not enough control of the lines.. Really basic stuff.
I’d picked up the Automation Direct RS485 to USB adapter that allows me to connect to the VFD to program it. The software doesn’t control the speed just the programming. I took a look around and didn’t see much available, it is modbus which is fairly common in SCADA etc. Never used it before, I believe the internals of the FlashCut might have some modbus going on. I knew other people had used the modbus support in Mach3 so it can be done, but how to the flashcut gcode controller software to the modbus of the VFD.
I poked around and switched on the 0-10V display of the RPM in flashcut this pops up a slider and a text input box to allow you to either type in the RPM or move it up and down, so i figured all i have to do is read that out and we’ve got the RPM value.
This is what the loopymind HAD DXF logo looks like in flashcut
So at the bottom in the middle is the RPM edit box. This is a generic windows GUI element we can read it from somewhere else, consider it like a file system. It stores named objects that contain data we interpret, so we don’t need to know the location of the RPM variable in FlashCut’s memory space, we just need the GUI’s data which means we don’t need to hook or mess with FlashCut at all, which is desirable for something like CNC..
I’m using Microsoft Visual Studio C++ 2016 here, but it is mostly the same procedure for the last dozen or so versions.
In the development tool-set there is something called Spy++ that allows us to watch windows messages and interrogate the GUI, very useful tool. It’s usually on the Tools menu of Visual Studio or you can just run it from the start menu.
Run it and you’ll get something like this :-
We can even see this post i’m writing now listed as a window. These are a list of the Windows in the GUI, Windows (the OS) treats a lot of things like Windows(the GUI) so you can see tool tips (the little popups that show when you hover with the mouse),, there are some hidden apps/windows, Mostly visual studio windows here.
We’re going to use the Window Search feature to find the FlashCut window handle, so run the application you want to take a look at and then in the Search menu of Spy++ use the Windows Search popup.
Apparently I also some allergies going on.
OK, so now we know what we’re looking for there is a Window class called "Edit" which is the name for a standard windows edit box.
We’ll also need a library to chat to the modbus, I found libmodbus and made some windows style changes for it and added a 64 bit version of it, that is on my GitHub https://github.com/charlie-x/libmodbus it does have some specific changes for window, i changed the f/printf’s to switch to the debug message system windows uses and started to remove the errno to their version since i don’t like the idea of one variable for all errors, and a few changes for 64 bit and some of the newer API’s. It is forked from the original.
Next we will fire up Visual Studio and start creating the application GUI, probably better to watch this one full screen,
So the next steps are to track down the values from FlashCut and reflect them in our GUI, for that we’ll go back to Visual Studio and start adding code.
This video goes through finding the window, capturing the values and reflecting them in our UI.
We’ve pulled out all the information we need, and no need of reversing or disassembling at all. We’re not even really looking inside FlashCut, just querying the Windows GUI. This technique works for most MFC/Windows apps.If we’ve learnt anything so far, it is SUCCESS has two Cs !
In part 2 I’ll connect up libmodbus and start talking to the drive itself.
Editors Note: This ztable doesn’t actually fit in my particular Chinese laser, it is too tall… I’m seeing if they have shorter threaded rods available. my lasers gantry is about 93mm to clear, ztable is 105mm. le sigh….
Note 2: see bottom for updates.
I Picked up a motorised Z table from light objects for my Chinese cheapo laser cutter, it’d make it a lot more useful.
Of course first time I saw it, I didn’t pick It up and it was out of stock the next day, so a few months later I saw them back again and ordered one, arrived a few days later. First thing I noticed no instructions, but simple enough. A week or so later I got an email from them saying there might be a cable missing, I wasn’t sure it was meant to come with one but either way, they sent it out and got it a few days later, so good service there.
Of course I thought I had stepper drivers around, but didn’t so I went back to LO and bought the M415 driver. So put it together and waited for them to arrive.
After hooking up the motors and stepper to my frequency generator, I got nada, the motor wasn’t holding , stepping , buzzing or anything..
I probed the motor wires with an ohm meter and they were open circuit, so I prodded the pins on the motor and found the two coils, the cable was wired incorrectly.
I fed the info back to lightobject, who are a super nice place to deal with, just had to move two wires on the connector from position 1, to 2 and from 6 to 5.
I used the M415 driver, tried out a few speeds from 1khz to 16khz to see what gave the best results, 6khz seemed fine (16 steps) I also set the current of off/on/off or 1.05A measuring the power draw on my PSU it was about 0.4A which the datasheet for the motors its mean to be claim, the driver manual notes that the current on the coils might be less than you set, and it reduces the current by about 60% when idle. Though these might be different motors, they are not getting hot.
The Electronic Goldmine had a sale on miniswitches, I want to type mini microswitches, but that seems wrong, Stock # 61690B so I picked up a 100 or so they’re right angled pcb thru hole mount lever style, I wanted them for various things like cnc limit switches, so I’ll add them to this and see what happens
If either of the switches are pressed, the table goes up and down, the limit switches will stop the current direction, but allow it to go the other way.
I set the PWM to period 32/16 count , that gave me just about 6khz
The pins I choose make the RGB LED on the board change colour when up/.down is selected
Pulse is wired to PUL on the m415 and Dir to DIR, common ground.
I could use the capsense to do a slider for the speed it moves at, but I think a fast/slow button set is easier.
Now all I have to do is mount the limit switches, and thenfit it into the laser
Remove the old bed is just four screws
and then remove these posts (and all the gunk)
One of the four posts on the z table gets in the way of the smoke extractor. so I removed the post, we’ll see what the effect of that is.
I haven’t decided how best to install it yet. I’ll update when I do.
The CY8CKIT is about $25, so instead I decided to make it for about $2
Decided to try to redo one of the old cylon boards to see if I can make a mini controller. The ATTIN2313A is a pretty neat chip. I modded my cylon to look like this, its got extra ports too. its about 2.6cm x 2.6cm
and a short while later (This is actually a rougher version I recut it)
With some rubout (potatocam)
Momentary pushes ( all my black ones were not working correctly, so I used two red) one easy way to wire up the limits is to use a microswitch with NC connections, normally closed vs NO normally open. Wire the limit in series with the switch, so when its engaged the control button won’t be able to close the circuit, so you can only use the down one.
The downside to doing that way, rather than using the microprocessors inputs is that its harder to override if for some reason you need too, but if you’ve got limited IO space, and makes the wiring simpler, plus don’t really have to worry about noise/debounce.
Mounted onto the driver. since it’s a double sided board and I only cut one side, the blue kynar is doing ground, I couldn’t route it single but I might drop one of the io’s and add a ground on the rear pins. The cap is 1uF 0805 it won’t work properly without this
And there we have it, now to mount it in the laser, the tedious part!
The wiring is really simple.
Two phases to the motor, 24Vish to the motor driver, common ground, 5V to the opto and the controller board. The switches are common ground, then to the controller board, pins 2 and 3, pulse and dir to the controller, 8 and 9.
Making the table shorter
The threaded rod is M6 x 1.0 pitch. So now I need a lathe, any excuse to buy tools right? So I did !
I figured I’d need some better measuring tools as I go along, so thread per inch measuring tool (doesn’t do metric aye aye aye ) mitutoyo gauges with SPC , very nice.
Since I also had gift cards lying around on amazon from bitcoin, I thought what the hell and bought one of those teen tiny lathes, its exactly what you’d expect it to be. I’m still deciding which real lathe to actually buy.
took the table apart
Marked the aluminium posts and cut them with a hacksaw, about 1 cm, to fit my laser.
Then I marked the area to remove from the threaded rods, hacksawed them down.
On one of these the brass gear was loose, so I popped it off and filled it with thread locker then put it back on , that held it.
Next measured how much to remove for the bearings, I used the brass parts as a marker.
Then I squared off the aluminium posts and drilled holes in the middle.
Now to see if it clears the gantry
I found it easier to remove the side bars while it was in the machine to get the threaded rods into the bearings
Poking around the laser for power, we need 18-24V, and 5V for the CPU.
This switch on the right has 5V, but if it’s a moshi board, there is an easier place.
This white connector with the four green, and red/black wires coming off the power supply, its marked 24V G 5V L , so that’s all we need.
The other side plugs into the moshi driver board.
Moshi marked it so bottom is gnd, 24v, 5v, L, I tapped into those by removing the pins and soldering to them. just pressing a pointed thing into the teeth and gently removing it. Solder the wires and then push the tooth out a little and snap it back in.
Next I drilled a couple of holes for the up/down switches.
And that’s more or less it, plugged in the stepper and tested it, all good.
I don’t have any tap/die sets so I didn’t tap the posts , and I wanted to keep the original setup, plus again more excuses to buy more tools.
Made sure it was all working before I started bolting it all down.
Laser is almost running again, the pump I bought from lowes to replace the original chinese one fell apart so have to fix that now.
I might make a change to the software so if you press up, hold it then press down it’ll go faster (or slower),, and vice a versa.
I had a Windows 7 machine in one of the racks with a bunch of services not starting, no networking so not much of anything since its headless and graphics are network remote, so I pulled it out and switched its graphics cards to see what was going on.
Really slow to boot windows, after login black screen with mouse, sluggish response. dhcp, lass, service showing ‘starting’ and can’t be stopped or restarted ping etc gives no network, or various network errors Event logs stop working with “Error 1747 : The Authentication Service is Unknown” Even a BSOD on a reboot
sfc /scannow no issues, fsck, no issues. hardware all looked ok.
As usual MVP advice is reformat and re-install, so sad. So i did this instead
first disassembled it with IDA, pulled out C code and attacked it from there, working backwards with what the key ought to be, one value at first just seemed to be anti debug , which was just the ptrace test, which would increment it.
Also as eventually noted by fluxfingers team, if you happened to be running non root on ubuntu ( I was ) you’d get the wrong results because ubuntu doesn’t let child procs ptrace as a non root user…which would have been a big clue.
the thing that bothered me about my C version vs the elf binary was the speed difference, mine ran much faster for no apparent reason, so I looked harder at the initial ptrace test but even though it was forking I saw no way that it could be hooking and repeating itself, noping out the sleep code didn’t alter the speed.
stracing showed that it was forking and sleeping again. so single stepping I saw that some of the libc’s were indeed going to different places. looking at the plt
similar code again, and there were a couple of others.
so from here we knew that it was incrementing the value during the run.
jk wrote a python bruter based on the c code and we had been trying different values with the counter.
He got “4v0iDsS3CtIOnSLd” the password was “Ld4v0iDsS3CtIOnS” I’d even rotated it since phase one did that, but the change of case on the Ld threw a spanner in that. unfortunately for us that was about 1400 seconds before the end of the CTF when we really started focusing on the change of value.
Windows 7 has a a limitation (That can be removed in the code of the individual driver) that you can’t set a fake mac id starting with 00 on a wireless usb So I did what any normal person would do, pulled apart the adapter, removed the eeprom found and edited the hardware MAC ID
Use a spudger to open the case, its not glued or anything.
I tried a few ways of programming the spi on board, but it just wouldn’t do it,, too much interference.
The chip is glued down, some acetone will take care of that, desolder the chip and pop it into a eeprom reader its an ATMEGA AT61 series SPI EEPROM so easy enough. Once you have the hex file, grep for the mac address in hex. Edit it to what you want it to be and reflash it back to the chip, there is no checksum etc.
You can send eeprom commands back to the chip via the driver, but I didn’t look into it too deeply;. Its pretty quick to remove it and change it, obviously this is more useful for cloning vs just changing.
The Proxim / Orinoco is just a Taiwanese usb adapter, I haven’t seen it for sale under the different brands though, but its considerably cheaper.
Today my KL25Z dev board arrived from Newark, I had it on pre-order as soon as i saw it, mainly because its cheap at $12.95 +tax and because its ARM M0+ that can go upto 48Mhz.
Comes in a nice box you solder the headers in if you want too, otherwise you get nothing with it ( but that’s not a bad thing ) the box has a colour print diagram of the connections to the board on the underside and its a nicely packaged.
Oddly, or not, the first thing I noticed was an unpopulated spot for an IC U5, a quick scan of the schematics and its for an AT45DB161D which is a 5V tolerant 3.3V SPI flash memory chip. Which is great because I just happen to have a stack of 16’, 32’s and 64’s at NullSpace. I’ll update the blog when I add it and see if it works, it is a fairly costly IC so that might be why its not included versus a build mistake.
Underneath there is a space for a CR2032 PTH battery holder.
It is a very nicely laid out board, going for the black mask with gold finish. Though placement of the RST button could be better, the placement of the pads underneath mean when you press the reset the board flips up, less so when the USB cables are plugged in, a minor annoyance. The captouch could also have done with something underneath as well, its just slightly off balance, again very minor and easily fixed.
Capacitive touch “slider,” MMA8451Q accelerometer, tri-colour LED
Easy access to MCU I/O
Sophisticated OpenSDA debug interface
Mass storage device flash programming interface (default) – no tool installation required to evaluate demo apps
P&E Multilink interface provides run-control debugging and compatibility with IDE tools
Open-source data logging application provides an example for customer, partner and enthusiast development on the OpenSDA circuit
I dunno how I feel about the P&E stuff, Freescale must own stock in them or something, I have a bunch of P&E BDM’s, cyclones, cpu32/cpu16 etc. which i use for my reverse engineering work but they’re expensive and the software is about 1990’s level of basic, everything is an add on cost, the flash tool is one cost, programmer/debugger, capacity on the cyclone max etc. Also they don’t have a lot of protection, I’ve blown up my cyclone max with a bad PSU, for such an expensive tool its poorly protected.
Talking about questionable software, my old friend CodeWarrior rears its head again, anyone who has been in game development for a long time, especially console, probably has a special place for CodeWarrior, along with the Sony CD burners for PSONE. Freescale/Motorola bought them out a long time ago and so of course it keeps coming back to haunt me, and haunt me it does. Still I’m sure its gotten better?… I’m not sure why TI/Freescale etc wants to roll their own dev tools, maybe for QC or lock–in but GCC is OK enough to use it and ARM were smart and paid someone to make the ARM support better in GCC. Beyond that CodeSourcery seem to do a good job of keeping it all together. Maybe I do want to download another 1.5G Eclipse installer (not CW thankfully). I think its a mistake going down this route, but there you go.
Its an CDC driver that should auto install on Windows, there are drivers for it available if not. After that its drag and drop binary or Motorola S record files, they note that the dev tools work primarily on Windows but CDC obviously works on the other platforms.
I ordered a SolderCore from Mouser yesterday, it arrived this morning. Its a pretty nice little device. Oddly I’d had some interaction with one of the creators at Rowley Associates, Paul, on an email list talking about C compilers/assembler etc and it turns out we’re both Lotus people as well as having ECU related experiences, it is a small world.
Haven’t done much with yet, since i’m not at NullSpace and all my stuff is there.
Built in Ethernet support with an on-board RJ45 connector.
USB OTG support with an on board microAB connector.
On board microSD holder.
Support for additional Flash and FRAM devices.
CAN, I2S, 2xI2C, UART, PWM, ADC, SPI and QEI supported
On board standard 10 way SWD JTAG header. (Only fitted to the Commando variant)
Power can be supplied via USB or the barrel jack (6V – 9V DC).
So decent enough specs.
Nice things are , no drivers, so no one whining about CDC driver support in Windows 7. All the help, examples firmware are net enabled. All you need is telnet to edit.
compared to a Pandaboard ES, and one of our NSL ADK boards. Soldercore in the middle.
If you want the headers, you can solder them on. I like the idea Sparkfun has with single row headers and to offset every other one so its easier to solder, but these aren’t difficult, just hold and tack the first one very lightly with solder, make sure its straight and do the others. That first tack is important so its aligned and then you can re-align easily.
I plugged it in, pinged as per the label on the back, then i use Putty to login in to it. (change from ssh to telnet) also it uses ^H for backspace so edit that too. I then posted to the forums with a hello world, but then realised it was a program that did it. So i went off to find it, since it isn’t in the examples but in the help section instead.
Had to edit a bit first. Mine didn’t like the command $NL so i used $LF instead. Then came along figuring out how to set NET.SMTPSERVER (which is fairly futile for me at this point so all my SMTP servers require a login) but trying anyway. I of course battled ahead and did NET.SMTPSERVER = “smtp.mail.com” NET.SMTPSERVER = “10.0.0.1” etc neither worked. It says ‘Digital I/O’ as the type. My SMTP server will work even less with an IP address since it wants to use the FQDN to find it. But regardless..
Luckily BASIC being immediate, i just did
[0, 0, 0, 0]
NET.SMTPSERVER = [192,168,1,1]
Easy enough. But i don’t have an open relay… So i got as far as ?SMTP server down in 60:
10 SUBJECT = "Hello from SolderCore!" 20 FROM = NET.NAME + “firstname.lastname@example.org” ‘ fill in your own e-mail address 30 TOO = "email@example.com" 40 BODY = "Hello from " + NET.NAME + "." + $LF 50 BODY = BODY + "My device address is 192.168.1.159 ." + $LF 60 MAIL TOO, FROM, SUBJECT, BODY 70 PRINT "e-mail away!" 80 END
It didn’t like the IP$(NET.ADDR) either so i replaced it with text.
> list ↵
10 SUBJECT = "Hello from SolderCore!"
20 FROM = NET.NAME + "@local" ' fill in your own e-mail address
30 TOO = "firstname.lastname@example.org"
40 BODY = "Hello from " + NET.NAME + "." + $NL
50 BODY = BODY + "My device address is " + IP$(NET.IPADDR) + "." + $NL
60 MAIL TOO, FROM, SUBJECT, BODY
70 PRINT "e-mail away!"
> run ↵
I concluded the problems/missing command might be an old firmware so I tried to do a firmware update with firmware run, but i realised it needed a FAT16 SD card (a good one not a cheap fakey one) All i had was a 16B MicroSD so its too big, but normally you’d do. 2G is what you need.
FORMAT n: /FS:FAT
where n: is the drive letter. After a year or two , it’ll be formatted
The soldercore.com website does go into this in detail, if the GUI doesn’t show FAT as an option, the card is too big..
It has a few nice features, being able to update firmware over the internet is great, and you can type
and it’ll list all the examples available, over the net. Typing
will load the welcome.bas, so that is pretty neat, most of the examples look like they need one of the add on boards though. It is case sensitive on the example filenames.
Seems equivalent to firmware catalog and it stops me typing catalogue(j/k)
A lot of people might gripe about BASIC but what BASIC looks like versus what goes on in the background are completely different things, look at BlitzBasic etc, they’re very quick. Having to do line numbers is a bit of a throwback for sure.
Here are a lot of builtin commands that do useful math, dot products, matrices etc. sin/cos, etc. Very useful. At worst case you can pop on a JTAG and write everything in C/ASM to your hearts content.
I have had one reset so far, but its probably the usb port i have isn’t giving me enough juice, it has external power port too. If i find a small enough SD card, i can try to update the firmware. My firmware is also at 0.9.5 which is older than they list at the website, so I’m sure some of the stuff has been fixed already. I’ll update the blog when i find an SD card.
I did all this with it so far, and no drivers installed and no software installed i can run it from android or nokia phone as long as it has telnet.
The usual BASIC commands like EDIT, RENUMBER work, its just like being back on the BBC or Archimedes.
Haven’t done much else with it yet, but I’m really interested in at as we use the Stellaris chips for other projects. I also really like Paul from the small interactions I’ve had with them, and Rowley Associates , I don’t know Iain or K&I but they did a nice layout job, so I’m looking forward to where they go with it. Anyone who’s a Lotus nut is ok with me !
I realised my Skyrocket had a 2GB card in it, so I swapped that out, formatted it as FAT16 and made the top level SYS folder, plugged it into the soldercore and typed
After a few seconds its at 0.9.12 now. I retried the original syntax of the Mail example and it accepted it fine, i still can’t relay the email but it does accept the commands that were missing. Easiest firmware update ever.
We’ve been trying to sort out a laser cutter for a while now, last year we bought a 40W tube and a PSU and burned holes into things. While hugely entertaining, it lacked some precision
That was as far as it went, so i had enough and just decided to order one, after a few stops and starts we bought an LC900N directly from wklaser in China, they’re the same ones FS laser and hurricane etc sell but they do some mods to the software/boards, but nothing that is worth the price increase that i can see. It cost us under $4,000 USD for a 90W laser with a 600x900mm cutting area, with a motorised Z table from china to us.
We’re on the third floor and our elevator is ( A ) too small ( B ) out of order, so we had to levitate it in.. Having hindsight we could have taken it apart, but had been previously assured we couldn’t do that. Anyway…..
We did what anyone would do and removed the window, hired a crane and lifted it in through the window.
Taking it out to inspect the contents etc.
Building a landing table
Scientific weight test, the window is gone and 3rd floor, proceed to start jumping. Some people were confused about what don’t go past the blue line meant.
Yes this is a good idea.
We put out cones, people removed them and parked anyway, I told a few people they may not want to park there, most people got annoyed and asked why not? So i explained, most of them changed location. But only most….
ok we’ve gotten it to here, what now ? Time for a meeting.
The tricky part, removing the first strap, everyone pitched in to help.
The Rapunzel method started off well but we discovered a problem in the hair length dept.
And its in!
Books are useful. Dropping it the last meter was harder than getting it from China.
Put the window back, respackle it and no one is the wiser.
Ok so the laser is purchased, shipped from china, craned in through a window. What next?
First install the tube
The laser needs a vent, preferably hilarious. (needs video)
Obviously take it apart and improve it.
The height setting tool needed improvement, so made that and labelled it as such
Test cuts. Lots of test cuts.
Align mirrors, the manual came in useful here. (bits of paper)
Now change mind, remove the mirrors, turns out they’re dirty! So we swapped them out for ii-iv’s, increasing the power 20%. Interestingly there is a technique to make CO2 laser mirrors from hard drive platters hard disk platter co2 laser mirror
The new lens vs old one.
Ply Wood 5.2mm 8speed 90power OLD LENS ply wood 5.2mm 15speed 40power NEW LENS
The T4 28” fluorescent bulb burned out after a day or so so we replaced it with some halogens, especially since they’re hard to source locally, test fitted with duct tape. The whole machine gets covered in grease for shipping so lots of cleaning first.
Next well they said we can’t cut steel. So quick trip to home depot for some O2.
The glo-stick is vital
well it is cut but…. not really useable, however great progress
Here we cut some 1” acrylic
The GUI is full of odd chinese-english conversions, but they use a UTF8 .ini file so you can edit it all you want. Instead of Datum, it is now Home . Just edit language.ini or use Resource Editor on the .exe for permanent changes the software does nt self check, even though it uses a senselock dongle.
Next is hack the software, we figured out the control software, reversed most of the API it actually rasterises vectors in the PC side and sends them over as points!! I’m shocked and amazed since the machine has a ‘DSP’ based controller board. It generates a TXT file and compiles it ,then uploads it the API has move, p-move, arc and circle functions but the software never uses them..
CLASS_DECLSPEC int APICALL M05_m_fast_line2(int chx,long disx,int chy,long disy); CLASS_DECLSPEC int APICALL M05_m_set_vector_profile(double ls,double hs,double ac); CLASS_DECLSPEC int APICALL M05_m_set_vector_profile2(double start_ls, double hs, double end_ls, double ac, double dc); CLASS_DECLSPEC int APICALL M05_m_curve_vertex(); CLASS_DECLSPEC int APICALL M05_m_curve_begin(); CLASS_DECLSPEC int APICALL M05_m_curve_end(); CLASS_DECLSPEC int APICALL M05_m_set_period(double period); CLASS_DECLSPEC int APICALL M05_m_set_power(int LowPower,int HighPower); CLASS_DECLSPEC int APICALL M05_m_set_laser_mode(int mode);
The are all set ramp speeds, laser on, move here, move here move here, move here. Not set point, radius calculate in controller.
Oddly the first command we figured out (unintentionally) was fire the laser at full power indefinitely.
Is it off, no, is it off now , no ? how about now ,, no ? OK what’s the tube temp? still not off ? Easy to fix though, its just a toggle on/off. You also can’t easily jog the laser head around with the laser on, it’ll work but you can’t turn it off easily!
Knock out a quick GUI in Visual Studio.
I updated the header file for the DLL on our SVN. I’ll document it as i go along
Example of the txt file, which it compiles on the PC side.
SUB001 CMD101,0 SET002,20000 SET014,1,0,2,2 CMD109,1 CMD102,416,20833,97222 CMD104,6944 CMD401,416,880,41666,900 CMD402,900 CMD409,416,880,3000,41666,900,5000 //set ramp speeds and power CMD408,900,5000 CMD050,2,1 CMD002,63556,42631 CMD050,1,1 //laser on CMD103,416,41666,69444 CMD001,63556,42631 // move CMD050,1,0 //laser off i’m surprised it rasterises the vectors though, i was expecting to see a command for a circle that defined a center,radius etc. speed change. 100 to 300 CMD401,416,880,13888,900 CMD409,416,880,3000,13888,900,5000 CMD103,416,13888,69444 CMD401,416,880,41666,900 CMD409,416,880,3000,41666,900,5000 CMD103,416,41666,69444 power change 9 to 99 ( *100) CMD401,416,880,13888,900 CMD402,900 CMD409,416,880,3000,13888,900,5000 CMD408,900,5000 CMD401,416,880,13888,9900 CMD402,9900 CMD409,416,880,3000,13888,9900,5000 CMD408,9900,5000 horizontal line moved in y CMD002,62466,45271 CMD001,62466,45271 CMD001,69328,45271 CMD002,69328,45271 SUB603,416,20833,97222,69328,45271 CMD001,69328,45271 CMD001,69328,45271 CMD001,62466,45271 CMD001,62466,45271 CMD001,69328,45271 CMD001,69605,44993 CMD001,69605,45548 CMD001,62188,45548 CMD001,62188,44993 CMD001,69605,44993 CMD002,62466,45175 CMD001,62466,45175 CMD001,69328,45175 CMD002,69328,45175 SUB603,416,20833,97222,69328,45175 CMD001,69328,45175 CMD001,69328,45175 CMD001,62466,45175 CMD001,62466,45175 CMD001,69328,45175 CMD001,69605,44898 CMD001,69605,45453 CMD001,62188,45453 CMD001,62188,44898 CMD001,69605,44898 horizontal line moved in x CMD001,69328,45271 CMD002,69328,45271 SUB603,416,20833,97222,69328,45271 CMD001,69328,45271 CMD001,69328,45271 CMD001,69328,45271 CMD001,69605,44993 CMD001,69605,45548 CMD001,69605,44993 CMD001,69492,45271 CMD002,69492,45271 SUB603,416,20833,97222,69492,45271 CMD001,69492,45271 CMD001,69492,45271 CMD001,69492,45271 CMD001,69770,44993 CMD001,69770,45548 CMD001,69770,44993
So this ends our first week with the cutter, we have to decide if we’re replacing the controller, Leetro apparently want us to buy $25,000 of stuff to get the SDK documentation, but we’re so far into reversing it, that won’t matter. The controller might be ok. It has some strangeness we want it to speak GCODE so maybe another GRBL based controller like we did for Pickobear.
We’re also building a new frame for it, and updating it to 170W laser tube (maybe)
Rather than hand build all the badges for our socal security conference layerOne again, http://www.layerone.org/ we’ve gone to a pick and place machine.
Gleep found us a Juki(Zevatech) Placemat 360 (that seems to have been upgraded to a 460 ) pick and place machine. It was sold as ‘working’, the sellers definition was, if I’m completely honest a stretch (outright lie).
This is actually our second pick and place machine, we don’t mention the other one
We’re also interested in acquiring a Zevatech/Juki 460 if you have one for a decent price.
Basically he demo’d everything that didn’t need a compressor, that all worked. Of course everything that needed a compressor as we found out later, didn’t work! Still $1,200 isn’t bad.
I used my supersilent 20a as a temporary compressor, it only has a small < 1 gallon tank, but its actually quiet, we used the 8 gallon compressor at null space which is deafening, so i found a 3 gallon temporary one at harbour freight for cheap in their recent sale. its too small though, so we’ll need shop air at some point. The supersilent was causing the pickup head to fail to work after a few passes, so this caused as a few false starts, the machine needs a solid air supply to function , even in testing.
The existing filter and pressure regulator was a mess, so off to home depot to come back with the best we could find there, which isn’t that great.
This is the old one, remember sold as working. No filter, and all these bits were just lying around inside it.
The machine itself is based on the PC-8801 Z80 4mhz CP/M which I recognised straight away as my old job had me doing game conversions in Japan for the PC-9801.
The whole machine works pretty much on the principal of that if the CNC software said do this, do that, that it executed perfectly. Only limit, head, home and the tool changer have checks.
We fired it up , Krs and Gleep got it picking and placing a few resistors (though they somehow managed to get the tape removal part completely wrong and it was throwing resistors all over the place. Then mmca got it placing QFP parts correctly. The lamp spot system was off, the 90’o rotation was off, the tubes were old and cracking. Compressor filter was non existent and rusted out. We’ve also discovered the whole thing is covered in parts from the previous owners, we’ve scored a few 100 0805s and some IC’s.
The reed sensor was the first thing we found that was broken, a quick trip to eBay and a few days later we had replacements. Luckily Juki is in heavy use, and they use a lot of off the shelf components. Apparently the later 5xx machines do switch to a proprietary drive system.
The reed switch detects if the head is up or down. Its one of the few sensors in this machine. The bend has caused the wiring to break down internally over the years. so the machine gets confused about being up or down, and the software doesn’t cope well with that, it basically needs a full reset afterwards.
The new sensors , $9 from eBay.
I also bought a CPLD based floppy emulator from Poland, it hasn’t arrived yet and we’ll probably be done with the new system before it gets here, and we’ve discovered the speed stays the same but floppy drives won’t last so the SD is still a good replacement.
Placing QFPS (AT90CAN128)
Fashioned a quick tray for the IC placements. We use these great little boxes, also from eBay, for holding SMD components, they double up as handy platforms too.
The feeder is controlled by the head, it moves over the spring loaded pin and pushes it down, this releases air and the notched wheel on the right moves the component reel tape one step, at the same time the protective covering tape is peeled away, allowing the machine to come back and pick the part up. This time, they’re correctly threaded, previously the protective tape was wrapped around the pin in the middle.
Side view of feeders, you can see the reel of components on the left, and the pneumatics underneath. Its important to choose a pick and place with a widely available range of cheap feeders, all too often people buy a cheap pick and place then find out it has none, and it’ll cost $1000’s to get them, if at all.
Feeder with pneumatic assembly
The expansion board
This is the board inside the machine, it is a couple of 8255s which are the defacto standard for PC parallel IO, almost every PC has had one or more of these, they’ve since moved into the ASIC’s but the principle is the same. It memory maps each of the input/outputs of the machine so that host PC can see them. I pulled off the floppy image, copied the files to my PC and reverse engineered the controller code with IDA.
I found an IMG of the floppy online, this was MFM encoded . So i converted that to a raw binary file, and then used cpmtools to copy the files from it. I was hoping to find some of the saved files so we could reverse the format and write a quick tool to do the placement. Once the files were copied off i tried a few of the different PC-8801 emulators, M88 etc, but had no joy in getting it running. So finally I just pulled apart the CP/MCOM files in IDA and see what we could find.
The teaching process is tedious, so reversing the format would have been worthwhile.
This board takes the IO from the PC, buffers 74LS240 it and uses power darlingtons FT5723M to switch the 24V signals for the pneumatics. As well as read the various sensors and the + / – for the motors. The motors and stepper drivers are off the shelf, but very nice, we even have newer versions of the motors and controllers at NSL.I’ve removed the bottom connector to make it easier to take pictures.
The grey cable that has been added later is the automatic tool changer, this is soldered directly in the spare connections , 5V and 24V VDC. The 5V powers the small adapter board in the ATC and the 24V is for the pneumatic switches.
The remaining signals are multiplexed IO that are demuxed by a 74Ls138 on the ATC board, which deviates from the way the rest of the board works as the rest are all controlled by the darlingtons directly.
Each function of the machine is basically <control> – <buffer> — <pc> – <memory map>
So if you want the head to go down, you flip a bit in the PC’s memory. Its all digital IO, nothing fancy at all. The only extra part is the 5V TTL to 24VDC for the pneumatic switches.
Stepper drivers and power supplies.
The stepper drivers are on the bottom, the other one is to the right under the tray. the two power supplies are just visible at the top right, one is a 5V the other a 24V. The power filter is in the lower left.
Stepper motor driver
Since the machine was in bad need of service, we stripped it down, here the XY belts are visible. The top side has the the driver motor and the bottom side gets its power from a rod under the bed on the right side, so both belts are moved in unison. The ATC is in the top right and the frame in the middle is what is left of the PCB holder.
Tearing it down.
mmca stripped the head down. here it is removed from the gantry. mainly because there is a piece of string visible , and we can’t figure out what its for.
Shims, we don’t think these are factory shims.
The strange piece of string inside the head… What could it be for?
Bottom view of the tool pickup and the 90’o rotation.
These 4 arms are moved towards the part and clamp it gently, this straightens the part for placement, it can also rotate the part by 90’o ( which sucks for us because i always like to put parts at 45’o)
The laser, focused lamp (this machine continues to surprise us ) which is used to position the head in teaching mode.
We’re removing the lamp and replacing it with machine vision, so some measurements are taken.
The hoses are removed and marked with a letter , the corresponding connector is also marked with the same letter.
This is how the previous owners repaired the 90’o rotation arms….. so that explains the string. this was removed and repaired correctly. The 90’o does just that, it rotates a part by 90’o that’s all this machine can do, so we’re going to change that to it can do arbitrary rotations.
This hose had cracked, a few others did too. I found a few temporary replacements at the auto parts store 4mm ID, 8mm OD fuel priming line. The plan is to replace all the hose.
Stripped machine screw in the head. Replace from grainger, M3x8mm 0.4mm thread 5.5mm head size.
Spent some time measuring all the screws and what not. The machine is old enough that it came from proper manuals with circuit diagrams.
We’re replacing the IO board, the plan is to throw in a TI Stellaris ARM lm3s9b96 chip instead, (TI were good enough to send us a bunch a while ago, thanks TI!)
This board is a dumb board, it just marshals the I/O and does the switching of the 24VDC with darlington’s.
Here we’re removing and verifying the connector sizes and function (the manual had some errors) so its good to do that. It also gives us good insight into what’s going on.
Checking how the machine works with my trusty fluke.
I threw together the connector layout in eagle and printed it out to verify it, early revision.
Measure the hole size and distance. Our board is exactly the same size so its a drop in replacement, we’ll just lose the two larger connectors and change it to USB.
Here we were figuring out how the ATC worked, at first it was though to drive it directly , but there weren’t enough wires. So its 24V, 5V and control signals, the small interface board at the front is a 74LS138 decoder/demultiplexer with a few buffers and more darlington drivers , it switches the 24V on and off based on the 4 control signals coming in.
Automatic Tool Changer
The tool wanted is lifted up when the machine wants to change it, on the right are the pneumatic switches that are controlled by a 24V signal.
We’re using Power MOSFETs to control the 24V instead, a 6 pin ROHM US6K1DKR in a TUMT6 package ( time to create a new device in eagle again !) I ordered 100 from Digikey yesterday and should have the board layout finished today. Then we can mill out a test PCB and see how it works. (parts arrived a few minutes ago!)
You might be amazed, I was , about just how simple this machine is, you could run the whole thing from a set of on/off switches, albeit very slowly. But that is great for us though as it makes it very easy to replace the PC software.
The next big thing is going to be testing the new power MOSFET and building the new PCB. The chips will be here today have arrived.
So new eagle package
Cut out a few to test.
Apparently I goofed on the measurements, I did change it around a tad after the first revision. Teeny part.
Soldered it anyway
So the next step is adding cameras etc.
mmca explaining the new part to be cnc’d out for the camera
mockup of the mount
The head has to be recalibrated so the bottom of the tool is 62.5mm from the table, with a .1mm accuracy, so we as usual went overboard and used grade B gauge blocks.
69.5mm to .00005 inches accurate.
Gauge blocks are fascinating, they stick together like magnets if you put them together by making surer there is no air between them, but if you just stick them together they won’t. Super flat. these aren’t grade a or better, but they’re nice. mmca has the coolest stuff.
Starting to rebuild it
Machine vision tests
This is work in progress, testing RoboRealm/OpenCV and teaching it components, it works well!
Using a panda board a HP HD Webcam for testing the vision.
Playing around with layouts for a quick test tool. two grey areas are for the cameras.
Well that is it so far, my Motorola Atrix decided that the fingerprint reader would become burning hot to the touch. So I pulled it apart and removed it, but somehow managed to make it do a full hard reset (or a docwho76 as we call it ) and it deleted a bunch of my pictures. google+ had failed to sync them. But we’ll keep documenting the project,
charliex, tom, Charles Bynaker, and 8 others are discussing. Toggle Comments