Reverse engineering the R6NT power meter

Reviews and other little ventures that don't quite fit into the other forums
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Reverse engineering the R6NT power meter

Post by Daniel Wee »

Display board is an ER-TFTM035-6 from buydisplay.com
https://www.buydisplay.com/lcd-3-5-inch ... kout-board
https://www.buydisplay.com/arduino-3-5- ... r-mega-due
This uses the IL9488 controller from ILITEK. The LCD module has jumpers 2, 4 and 6 shorted, indicating the use of a "8080 16-bit" interface. The touch screen components was not populated.

The IL9488 seems to support SPI interfacing as well and it is unclear if the parallel port is being used or the SPI port. Arduino support comes by way of the Adafruit IL9341 library that appears to rely on SPI to interface with the LCD controller. *update: Jumper settings preclude SPI so it's parallel all the way.
https://www.instructables.com/Arduino-a ... 88-SPI-In/
*the MCUFRIEND_kbv library might be useful for LCD functions
https://github.com/prenticedavid/MCUFRIEND_kbv
https://forum.arduino.cc/t/ili9488-st7796s/637427
https://github.com/konkrog/TFT_eSPI
https://forum.arduino.cc/t/3-5-ili9488- ... p32/480035
https://learn.adafruit.com/adafruit-3-5 ... g-and-test

MCU is an STM32F103VCT6 (72MHz, 256kB Flash, 48kB RAM) with the SWDIO and SWCLK available. This seems to allow for the use of ST-LINK/V2 as the programmer. A likely schematic is attached.
https://sea.banggood.com/STM32F103-Dual ... mds=search

The two switch positions only differ in that one switches in (or out) an LM324 board, possibly some kind of filtering. This means that the actual performance of the averaging is at least partially controlled in hardware, with some additional averaging done in the MCU?
Attachments
ILI9488-ILITEK.pdf
(10.33 MiB) Downloaded 737 times
stm32f103_en.pdf
(1.09 MiB) Downloaded 733 times
stm32 schematics.pdf
(39.82 KiB) Downloaded 743 times
ER-TFTM035-6_Datasheet.pdf
(1.04 MiB) Downloaded 738 times
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

The Sitronix ST7796S and the IL9488 appear to be somewhat related?

http://www.lcdwiki.com/4.0inch_SPI_Module_ST7796

Everything points to MCUFRIEND_kbv as being the library to use. Alternatively there is also LCDWIKI_kbv

http://www.lcdwiki.com/res/PublicFile/A ... ion_EN.pdf

This library also claims to support the ST7796S and the IL9341
https://github.com/Bodmer/TFT_eSPI
Attachments
ST7796S-Sitronix.pdf
(3.39 MiB) Downloaded 748 times
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

The meter appears to switch in a PEP circuitry when in the PEP mode. This seems to consist of some op-amp buffered rectification and smoothing, similar to what happens in some of the Daiwa analogue meters.
Attachments
Daiwa_CN-801V_serv.pdf
(396.3 KiB) Downloaded 770 times
CN-801_2018-7-14_20-52-16.png
CN-801_2018-7-14_20-52-16.png (73.96 KiB) Viewed 11761 times
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

The relationship between AVG and PEP power is well-described in the following page:-

https://www.analog.com/en/analog-dialog ... e-177.html#
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

We now have the ST-Link V2, which needs a firmware upgrade before the STM32Cube utility will connect to it. With the SWDIO, SWDCLK and GND connected we are able to connect to the device.

The STM32F103VCT6 (72MHz, 256kB Flash, 48kB RAM) has 0x400 (256k) of Flash ROM. This can be read out completely and saved in the R6NT.bin file attached.

In the Arduino IDE, you will need to add a number of things to get STM32 support going. In the "Additional board manager" field, add:-

Code: Select all

https://raw.githubusercontent.com/stm32duino/BoardManagerFiles/master/package_stmicroelectronics_index.json
This is comma delimited with the other managers listed. From the Board manager, search for STM32 and install the board support. In the library manager, you may also want to add the following:-
MCUFRIEND_kbv
Adafruit GFX library
Attachments
R6NT.zip
(55.54 KiB) Downloaded 716 times
en.stm32cubeprg-win64_v2-7-0.zip
(87.38 MiB) Downloaded 715 times
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

The R6NT firmware appears to have some sort of serialization and activation involved. This was unaffected by re-flashing of the ROM that was read out:-

Code: Select all

Start: 0x08000000
 Size: 0xF0000
It is possible that the serial information is contained in the onboard I2C EEPROM chip - the Atmel 24C02BN (2kB). The MCU has only two I2C buses, I2C1 (PB5-SMBA, PB6-SCL, PB7-SDA) and I2C2 (PB12-SMBA, PB10-SCL, PB11-SDA).

The VCT6 designator refers to an LQFP-100 chip with 256kB of Flash ROM (datasheet pg.135)
STM32F103VCT6.png
STM32F103VCT6.png (130.14 KiB) Viewed 11669 times
Attachments
Atmel 24C02B.pdf
(670.41 KiB) Downloaded 705 times
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

MCUFRIEND_kbv Library

According to the text in mcufriend_how_to.txt in the extras subfolder, the library does support the IL9488 320x480 display controlled using the ID=0x9488 designator. Presumably also needing a #define SUPPORT_9488_555 (from MCUFRIEND_kbv.cpp) ? It is unclear if the chip support is for the parallel modes or just the serial modes.

The STM32 apparently has this as "standard":-

Code: Select all

LCD pins  |D7 |D6 |D5 |D4 |D3 |D2 |D1 |D0 | |RD |WR |RS |CS |RST| |SD_SS|SD_DI|SD_DO|SD_SCK|
STM32 pin |PA7|PA6|PA5|PA4|PA3|PA2|PA1|PA0| |PB0|PB6|PB7|PB8|PB9| |PA15 |PB5  |PB4  |PB3   | **ALT-SPI1**
Why does this say ALT-SPI1? This "standard" seems to only support 8-bit parallel connection to the board. The board jumpers seem to suggest the "8080 16-bit mode" of interface which employs DB15:0 on the LCD board.
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

The LCD board has the following connections to the MCU:-

(Even pins on the inside - 2,4,6,8, .... 20)

Code: Select all

Pin  1       --- VSS GND
Pin  2       --- VDD/VCC Power
Pin  3, DB0  --- PD14
Pin  4, DB1  --- PD15
Pin  5, DB2  --- PD0
Pin  6, DB3  --- PD1
Pin  7, DB4  --- PE7
Pin  8, DB5  --- PE8
Pin  9, DB6  --- PE9
Pin 10, DB7  --- PE10
Pin 11, DB8  --- PE11
Pin 12, DB9  --- PE12
Pin 13, DB10 --- PE13
Pin 14, DB11 --- PE14
Pin 15, DB12 --- PE15
Pin 16, DB13 --- PD8
Pin 17, DB14 --- PD9
Pin 18, DB15 --- PD10
Pin 19, DB16 --- GND
Pin 20, DB17 --- GND
Pin 21, _RST --- PE1
Pin 22, TE   --- NC
Pin 23, _CS  --- PD7
Pin 24, _WR  --- PD5
Pin 25, D/C  --- PD11
Pin 26, _RD  --- PD4
Pin 29, _BL  --- PD13
PD0, 4, 5, 7, 11, 13
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

Bit writing packet on pg.112 of IL9488 manual.

STM32duino handling of registers:-
https://gist.github.com/iwalpola/6c36c9 ... 0a118571ca
Daniel Wee
Site Admin
Posts: 2449
Joined: Wed 25 Feb 25 2009 8:00 pm

Re: Reverse engineering the R6NT power meter

Post by Daniel Wee »

Schematics of various versions of the R6NT meter.
Attachments
SWR_STM32F103VCT6_ER_TFTM035_6_V4.pdf
(30.73 KiB) Downloaded 744 times
SWR_STM32F103VCT6_ER_TFTM050_4_V2.pdf
(38.5 KiB) Downloaded 722 times
Post Reply