Page 1 of 2
Reverse engineering the R6NT power meter
Posted: Fri 11 Jun 11 2021 12:21 am
by Daniel Wee
Display board is an ER-TFTM035-6 from buydisplay.com
https://www.buydisplay.com/lcd-3-5-inch ... kout-board
https://www.buydisplay.com/arduino-3-5- ... r-mega-due
This uses the IL9488 controller from ILITEK. The LCD module has jumpers 2, 4 and 6 shorted, indicating the use of a "8080 16-bit" interface. The touch screen components was not populated.
The IL9488 seems to support SPI interfacing as well and it is unclear if the parallel port is being used or the SPI port. Arduino support comes by way of the Adafruit IL9341 library that appears to rely on SPI to interface with the LCD controller. *update: Jumper settings preclude SPI so it's parallel all the way.
https://www.instructables.com/Arduino-a ... 88-SPI-In/
*the MCUFRIEND_kbv library might be useful for LCD functions
https://github.com/prenticedavid/MCUFRIEND_kbv
https://forum.arduino.cc/t/ili9488-st7796s/637427
https://github.com/konkrog/TFT_eSPI
https://forum.arduino.cc/t/3-5-ili9488- ... p32/480035
https://learn.adafruit.com/adafruit-3-5 ... g-and-test
MCU is an STM32F103VCT6 (72MHz, 256kB Flash, 48kB RAM) with the SWDIO and SWCLK available. This seems to allow for the use of ST-LINK/V2 as the programmer. A likely schematic is attached.
https://sea.banggood.com/STM32F103-Dual ... mds=search
The two switch positions only differ in that one switches in (or out) an LM324 board, possibly some kind of filtering. This means that the actual performance of the averaging is at least partially controlled in hardware, with some additional averaging done in the MCU?
Re: Reverse engineering the R6NT power meter
Posted: Fri 11 Jun 11 2021 12:57 am
by Daniel Wee
The Sitronix ST7796S and the IL9488 appear to be somewhat related?
http://www.lcdwiki.com/4.0inch_SPI_Module_ST7796
Everything points to MCUFRIEND_kbv as being the library to use. Alternatively there is also LCDWIKI_kbv
http://www.lcdwiki.com/res/PublicFile/A ... ion_EN.pdf
This library also claims to support the ST7796S and the IL9341
https://github.com/Bodmer/TFT_eSPI
Re: Reverse engineering the R6NT power meter
Posted: Fri 11 Jun 11 2021 8:41 pm
by Daniel Wee
The meter appears to switch in a PEP circuitry when in the PEP mode. This seems to consist of some op-amp buffered rectification and smoothing, similar to what happens in some of the Daiwa analogue meters.
Re: Reverse engineering the R6NT power meter
Posted: Fri 11 Jun 11 2021 8:42 pm
by Daniel Wee
The relationship between AVG and PEP power is well-described in the following page:-
https://www.analog.com/en/analog-dialog ... e-177.html#
Re: Reverse engineering the R6NT power meter
Posted: Tue 22 Jun 22 2021 9:14 pm
by Daniel Wee
We now have the ST-Link V2, which needs a firmware upgrade before the STM32Cube utility will connect to it. With the SWDIO, SWDCLK and GND connected we are able to connect to the device.
The STM32F103VCT6 (72MHz, 256kB Flash, 48kB RAM) has 0x400 (256k) of Flash ROM. This can be read out completely and saved in the R6NT.bin file attached.
In the Arduino IDE, you will need to add a number of things to get STM32 support going. In the "Additional board manager" field, add:-
Code: Select all
https://raw.githubusercontent.com/stm32duino/BoardManagerFiles/master/package_stmicroelectronics_index.json
This is comma delimited with the other managers listed. From the Board manager, search for STM32 and install the board support. In the library manager, you may also want to add the following:-
MCUFRIEND_kbv
Adafruit GFX library
Re: Reverse engineering the R6NT power meter
Posted: Tue 22 Jun 22 2021 10:23 pm
by Daniel Wee
The R6NT firmware appears to have some sort of serialization and activation involved. This was unaffected by re-flashing of the ROM that was read out:-
It is possible that the serial information is contained in the onboard I2C EEPROM chip - the Atmel 24C02BN (2kB). The MCU has only two I2C buses, I2C1 (PB5-SMBA, PB6-SCL, PB7-SDA) and I2C2 (PB12-SMBA, PB10-SCL, PB11-SDA).
The VCT6 designator refers to an LQFP-100 chip with 256kB of Flash ROM (datasheet pg.135)
- STM32F103VCT6.png (130.14 KiB) Viewed 12106 times
Re: Reverse engineering the R6NT power meter
Posted: Tue 22 Jun 22 2021 10:53 pm
by Daniel Wee
MCUFRIEND_kbv Library
According to the text in mcufriend_how_to.txt in the extras subfolder, the library does support the
IL9488 320x480 display controlled using the ID=0x9488 designator. Presumably also needing a
#define SUPPORT_9488_555 (from MCUFRIEND_kbv.cpp) ? It is unclear if the chip support is for the parallel modes or just the serial modes.
The STM32 apparently has this as "standard":-
Code: Select all
LCD pins |D7 |D6 |D5 |D4 |D3 |D2 |D1 |D0 | |RD |WR |RS |CS |RST| |SD_SS|SD_DI|SD_DO|SD_SCK|
STM32 pin |PA7|PA6|PA5|PA4|PA3|PA2|PA1|PA0| |PB0|PB6|PB7|PB8|PB9| |PA15 |PB5 |PB4 |PB3 | **ALT-SPI1**
Why does this say ALT-SPI1? This "standard" seems to only support 8-bit parallel connection to the board. The board jumpers seem to suggest the "8080 16-bit mode" of interface which employs DB15:0 on the LCD board.
Re: Reverse engineering the R6NT power meter
Posted: Wed 23 Jun 23 2021 1:22 am
by Daniel Wee
The LCD board has the following connections to the MCU:-
(Even pins on the inside - 2,4,6,8, .... 20)
Code: Select all
Pin 1 --- VSS GND
Pin 2 --- VDD/VCC Power
Pin 3, DB0 --- PD14
Pin 4, DB1 --- PD15
Pin 5, DB2 --- PD0
Pin 6, DB3 --- PD1
Pin 7, DB4 --- PE7
Pin 8, DB5 --- PE8
Pin 9, DB6 --- PE9
Pin 10, DB7 --- PE10
Pin 11, DB8 --- PE11
Pin 12, DB9 --- PE12
Pin 13, DB10 --- PE13
Pin 14, DB11 --- PE14
Pin 15, DB12 --- PE15
Pin 16, DB13 --- PD8
Pin 17, DB14 --- PD9
Pin 18, DB15 --- PD10
Pin 19, DB16 --- GND
Pin 20, DB17 --- GND
Pin 21, _RST --- PE1
Pin 22, TE --- NC
Pin 23, _CS --- PD7
Pin 24, _WR --- PD5
Pin 25, D/C --- PD11
Pin 26, _RD --- PD4
Pin 29, _BL --- PD13
PD0, 4, 5, 7, 11, 13
Re: Reverse engineering the R6NT power meter
Posted: Wed 23 Jun 23 2021 10:24 am
by Daniel Wee
Bit writing packet on pg.112 of IL9488 manual.
STM32duino handling of registers:-
https://gist.github.com/iwalpola/6c36c9 ... 0a118571ca
Re: Reverse engineering the R6NT power meter
Posted: Thu 01 Jul 01 2021 5:43 pm
by Daniel Wee
Schematics of various versions of the R6NT meter.