Fixing CODE 10 Error for XLYNE 256GB USB Stick

IMPORTANT NOTE! YOU WILL LOSE ALL DATA WITH THIS METHOD!
YOU HAVE BEEN WARNED!

1. Dismantle the stick. To do this, lift off the back by heating it with a hair dryer and then carefully peel it off. There is hot glue inside...

2.After that, you should have the board in your hands and we will now force the stick into a so-called test mode, which is normally used in the factory for initial programming.

3. Short pin 27 + 28 on the square QFN chip "SM3281L" together and plug it in (while still shorted) to enable the test mode. Each side has 12 pins  => pin 3 and 4 counted from the upper right side, if the chip label is readable.

4. Check if the device is recognized in the device manager. If it isn't, retry the last step.

5. Download, unpack and execute "SM3281AB_R1019v2_B0KB_B05A" from the usbdev forum. If you cannot find it, contact me and I'll help you out.

6. You should find yourself on this screen now:

7. With the usb device in test mode attached it will show:

8. Now (AND AGAIN THIS WILL DELETE ALL YOUR DATA!) press the "Start" button.

9. The software now reinitializes the NAND Flash on the usb stick

10. After some time the software will be done and indicate this with a green OK label.

11. You can now unplug the device and try connecting it again (but this time without the bridged pins)

SUCCESS!

[Part 2] Sony WH-1000XM3 Not turining on

PART 2 Investigating the mainboard

Next, I took the left earpiece apart. Here you have to work very carefully because the NFC cable is very short and is soldered on both sides! After exposing the board I took a look at the bottom side, because there are many visible voltage supply areas. Mostly you can recognize them by the large inductors and capacitors. The Bluetooth chip from qualcomm seems to do the communication, the power management and the hardware buttons. I urgently need to investigate how the data gets from one side to the other, i.e. Atmega to the mainboard. But since all ICs are bga or with luck qfn packages, tracing is extremely difficult. I guess the board has at least 6 layers. Therefore a best guess approach is the best option for me.

I found the Datasheet after some search here.

So I first checked if the power supply reaches the other receiver without problems. This is actually just a connection via cable. Then I checked the voltages of the linear and switchmode controls from within the qualcomm ic. The chip has a total of 4 linear regulators and 2 dcdc internal power supplies. The corresponding voltages (1,8V 3,3V etc)  measured all fine on the board at the inductors and capacitors mentioned earlier.

If the headphones were again in the faulty mode I could see that the voltages increased but then collapsed again after a short time. This happens periodically with about 1.3 Hz. So where does this Signal to shutdown again come from. I started with the powerup cycle...
The datasheet gives the information that the hardware pin VREGENABLE boots the power supplies. This is usually connected to the battery voltage by a momentary switch. This seems to be the case with the WH-1000XM3. But there seems to be a diode in series to the signal, probably for ESD protection.

The voltage arrives at the output of the diode and is thus eliminated as source of error. Next I wanted to see if the power supplies are overloaded and therefore switch off. Therefore I tested all visible capacitors. Here I could not find any problems, as long as measurable in the circuit is usable at this point. So I could be half sure that everything is okay here. Then I tried to inject the voltages with my lab power supply into the board. To make a long story short this did not bring any improvement. What could stop the chip from starting now? And why only sometimes...

I looked at the chip's reset circuitry. The IC can get a reset from some sources. RST# pin, Power-on reset, USB charger attach reset, UART break character and Software configured watchdog timer. At this point I have ruled out a software malfunction for the time being and wanted to continue looking at the hardware. Furthermore the datasheet says: "If RST# is held low for >2.4s CSR8675 BGA turns off. A rising edge on VREGENABLE or VCHG is required to power on CSR8675 BGA". So this could well be my candidate.
As usual the reset pin is designed as active low. So it is either pulled high by a pullup resistor or by another external circuit. So quickly check where the pin for the reset line on this package is. Pad L1 for the reset is fortunately located directly at the edge of the chip and I could hardly believe my luck when I actually saw a track that meandered from this edge to a pad that could probably be measured.

Sorry for the bad image quality! I should' ve taken better images. You can get glorious images at the 52audio webpage that I've shown you in the previous post and here again. Absolute awesome teardown! I love the detailed work!

So I instantly grabbed the oscilloscope probe and examined the pin. And lo and behold, it is indeed the reset pin!!! Unfortunately, the headphones were now back in working mode and I waited a few hours and tried again and again to see if they finally had the error again.
Eventually I found out that as soon as I approach the board with my hands or the probe, the headphones are more likely to be switched on instead of beeing faulty, so we are definitely dealing with a floating pin or something like that!
Since I could not access the reset line properly without distorting the IC, I wanted to solder a thin copper wire to the pin. The problem with the idea was that the pad has an edge length of only about 0.3mm. This is a good demonstration on how small this is... This in combination with a high layercount of the board makes me suspect really bad things... To explain why this is so problematic: You try to heat a very small area so that the solder melts. To do this you have to use a lot of energy to overcompensate the heat dissipation into the other layers. This usually results in raising the temperature of the soldering iron, which in turn dramatically increases the chance of detaching the tiny pad from the board. The whole thing gets even worse when you consider that the wafer-thin copper layer on the board will expand faster than the substrate material underneath. And that in turn leads to pad detachment too. So extreme caution is required when working on such boards without preheating the whole board. But after about 10 minutes of soldering I had finally made a connection.

This is not the actual pad! Just to give you an idea on how tiny the pad is. That I was trying to solder to. The lower component is a SOT 23-3.

Not nice but in my defense: The insulation layer on the wire, which I unwound from a transformer, unfortunately contained more epoxy resin than I wanted (produces a lot of slag during soldering).

The green cable is a probe connection to one of the supply rails. Also only 0.5mm diameter...

Sneak peek through my microscope

Now I could make measurements without touching the board. The headphones were also nice enough to cooperate with me and entered their failed mode on the first try.

On the screen we see one of the power supplies (yellow trace) and the reset line (blue trace). There is a clear correlation between the two. So next I tried to overwrite the reset pin with the lab power supply to keep the IC permanently in non-reset mode. Now the headphones could not be switched on at all. Only when I disconnected the voltage I could switch them on again... So the reset pulse seems to be really important for the startup. At this point I unfortunately have to interrupt the repair because of lack of time... This time probably for a longer time until I have written my exams. In the meantime there is another project I am working on since the beginning of the year (Yes my projects take ages at the moment...).

[Part 1] Sony WH-1000XM3 Not turining on

PART 1 Hacking my way into the battery management

[somewhat off topic]
First a little story on how I got myself into fixing a pair of headphones. Due to the global pandemic I currently have to study at home. The problem here is that if you live on a busy street, the daily street noise keeps you off track every now and then. So I spent the last months with my simple Apple earpods to block the noise with music. The problem with these earpods is that they become uncomfortable after a while and the cable in front of you on the table is always in the way. Of course small problems but when you are confronted with this problem for hours every day it becomes a big problem. Therefore I have been looking for new headphones. However the really good ones are very expensive. At some point I had the idea to look for broken good ones. There I also found them very quickly. The problem from the article description was "cannot be switched on". Usually these kind of problems are caused by a unhealthy battery or problems with the battery management.

As soon as I got them I first tried the reset variants noted by Sony but the headphones didn't react to them at all. So the next thing I did was to open the left headphone. This is done by simply removing the ear pads and the foam underneath. After unplugging the flat ribbon cable for the touch interface the battery is already exposed. First I removed the battery and measured the voltage with my multimeter. A cell voltage of 3.9V is still full enough to work propaly. But to bei sure I discharged the battery with my charger and charged it afterwards. Thereby I can determine the remaining capacity of the battery. From the 1000 mAh labeled on the battery approx. 920 mAh went in. So the battery was definitely not the problem. Because the battery was not plugged in for some time now the remaining charge in the headphones should have been discharged. So I tried to switch on the headphone. And it worked at the first try! I thought okay that was probably the problem. It was probably just the battery management that was wrong with the cell charge. I used the headphones and was very pleased with the performance. The next day I wanted to switch them on again but unfortunately they were dead again. So I unscrewed the left earphone again and disconnected the battery. Unfortunately this was not successful. Also further attempts with very long disconnection times do not need success.

[rant]
Because I didn't really have the time to work on the device I decided to send it in for service. I thought with the price I would be cheaper even with repair. It seems that Sony itself does not repair their own products and so I had to send the headphones to their German support center which is not owned by them. After about one week of sending it in, I got a cost proposal with the content: "Repair not possible, because the spare parts are not available". On request I found out that it would be the motherboard. At this point I was very sure that the company had neither disassembled the headphones nor could they repair anything on the headphones beyond a battery. Ridiculous to call such thing a service. Well, I was then allowed to pay an inspection fee and the return shipping. A total of over 50€ for a statement that they could have given me in advance (known issue and I've even attached a long note with all the behaviours). As I find an absolute naughtiness. You want to leave something to the professionals and the only thing you get is an unfriendly mail contact (you don't even want to make a phone call there, trust me)... But enough ranting. That was the last time I sent something private in for repair that is for sure. Nobody there can do anything except exchange whole devices or write inspection fees for things that they cannot prove to me or when they are just guessing.

So I have the self-made problem of defective headphones, and unnecessary additional costs and no time to spend. Any normal person would stop at this point and either throw the headphones away or sell them. But that is out of question for me.

[starting with the actual repair]
After some research I found a teardown with datasheets for the headphones. The charging is done by a BQ27421 from TI and the battery is charged by a MP2625 from MPS. So the BQ27421 was my first candidate. This IC is accessed via I2C (from an Atmel chipset on the same board, which also processes the touch functions simultaneously). After I measured the resistors around the chip the orientation of the chip was clear to me and the two data lines lead past the battery connector to the other side (see picture).

Before the two data lines disappear into the board there are two test pads which give you good access to them. So I quickly soldered some cables to them and connected my logic analyzer. (If you want access to the samples that I took let me know). A good ground point can also be found in the photo (red cable). I took a few samples and started reverse enginieering. You always feel like a researcher at archaeological excavations. Always looking for what the engineers who were there before were doing.

After some pen and paper processing I was able to decode the actual measured battery voltage, state of charge (SOC), state of health (SOH) and many more parameters. Interestingly, the transmitted voltage was only 3100 mV which was definitely not correct because the battery was fully charged (so should be about 4V). So I felt encouraged to be on the right track. I wrote some code for an atmega328 which also connects to the I2C bus and can communicate with the battery management and the Atmega supervisor. After a bit of trial and error this solution was quite fast (about 2h into the repair). Now I was able to read the values live and also execute actions myself. I should have mentioned earlier that sometimes the headphones can be switched on for unexplainable reasons until you leave them off for a while. So I was able to log during normal operation and in case of an error. Sometimes the battery management reported a SOH of 0% which made me suspicious. Since the Atmega master on the board resets the chip when values that have been set before are wrong (I know this from my paper pen reverse) I decided to simply make hard reset requests as soon as I read a faulty status. These were accepted by the chip immediately but did not solve the problem. I tried many things at this point that all failed. Therefore I will omit them from this documentation. However all in all a quite interesting and satisfying thing to be able to see what ist going on.
Here a short video of the live output working during the speakers in normal operation. I'll continiue this as soon as possible I promise.

LS220D Serial interface

After some research I actually found the serial interface connections on the Buffalo LS220D.  Discussion and Datasheets over here: https://github.com/1000001101000/Debian_on_Buffalo/issues/52

The image is copyright free to use!

For logfiles or the full res image: https://drive.google.com/drive/folders/1rYEgoIc2LDBapYcMtrX-bgB10CaHhF_L?usp=sharing

Epson WF-2760 Error 0x9A fix and others

Today I repaired an Epson Wf-2760 and thought, since it took me a long time to find information myself, I would like to show you my solution here.
Unfortunately, the whole thing is not really documented in pictures, because I did not expect to have to repair anything at all. But as always with things I buy: There is something to repair...

Since we needed a new fax machine and the prices for these simple devices went extremely high (since the sales figures have probably fallen considerably) I looked around for alternatives. Since I myself use an Epson WF-2630 all in one as my copier (besides the Ricoh color laser of course which you can find more information about here ;-) ), I started looking for cheap used machines for these series. I came up with a bundle of 3 printers (two WF-2760 and one WF-2630) for free to pickup nearby. They where listed as "not printing condition". So I contacted the Seller and picked them up, thinking that I only need the fax function to work (digital fax reception only so no printouts needed). After an hour and a half of driving and traffic jam I had the printers at my home and got a fright, because the devices already lost the first screws when opening. But for free still justifiable. So I reassembled all loose parts and wanted to plug in the first printer. I had to find out that the printer already had no power supply. So further to the next... This one could actually be switched on, but then it threw an unrecoverable error. The error message called the error code 0x9A which you 'should' find in the documentation. I thought it would be great if you could read the codes directly from the manual. Full of anticipation for a quick troubleshooting I went to search for the code and had to find out that Epson itself did not list the error codes.
After a long search I had to find annoyed users in forums that have the same problem after a paper jam. But most often you can find that there is an error with the print head. The previous owner had already disassembled it and then obviously did not successfully break it off and gave it away in parts. So I thought to myself okay shit, all the driving for nothing. A new print head would not be worth the price and I would not even be sure that it is really the fault and not more things are defective. Shortly before I wanted to give up after hours of cleaning contacts, plugs and flat ribbon cables I found this forum entry which showed a debug software where the error 0x9a was also listed as a circuit error on the motherboard. So as a last resort, I ripped the motherboard out of the printer without power supply and took a close look at it. Then I looked for fuses and found the fuse F1.

The entire main board (pretty nicely made for the price!)

Faulty fuse before replacing it

After measuring this fuse it was clear to me I have the error! Since it was already late I postponed the further repair to the next afternoon. I bridged the fuse and assembled the printer so far that I could at least switch it on. I now got another fatal error but the print carriage moved very easily. So I realized that I probably fixed the error completely. So I started to build a complete printer with the remaining parts of the two WF-2760. This was successful after a lot of trial and error. If you want to do such a repair, take a look at this video, which will help you with the disassembly...

Full credits to the original maker of the video! It helped me a lot to find the matching screw holes for all the loose screws in my printer.

In the end I had a visually complete printer. So switch it on and see with a sharp eye what's going on. No smoke, no strange noises. Only a quiet noise of the print head while driving back and forth. And I had a main menu in front of me with all the functions that were important to me. I then checked the printer for function and everything works as it should. I would not recommend this repair to a beginner but people who can use a screwdriver, soldering iron and want to save a lot of money are sure to get what they want. After the repair I found the tool which was used in the screenshot in the forum. You can find it here. Very very useful if you want to maintain such a device or just want to know what a certain error code means. I hope I can help some people with this problem and I would appreciate feedback if you try it. I was not lucky enough to find this method on the net but I hope that my hours will be worth it for others.

Happy Stefan after first successful startup

The famous "K40 Laser Cutter" and some modifications I did to it

It has been quite a while since the last post on my Blog... It's not like nothing has been build in the meantime but I just didn't come around to actually write some of that down.

First, a little bit of background info to why I'm building and modding this device:
At the moment I'm involved into a cell biology research project, where I've been chosen to build a prototype device to do some modifications to cell culture inserts. As always, it very easy to get me excited about something like this. And as the DIY factor was quite large in this project I was happy to help out at this point.
To cut a long story short: Cell inserts had to be cut into small pieces while preserving the inserts as dust-free and sterile as possible, because later on the cells will be already in the inserts while they are cut. In addition, the instrument should be operable without maintenance or recurring settings by an operator. These are the reasons why we decided on a laser cutter for this. After a few tests on expensive industrial machines, we decided on a trial with a K40 laser cutter. These are quite common, cheap and also very dangerous machines! So the perfect mix to have some fun with.

A few days after the order, a large box arrived and with it an additional piston based air pump, that we will use later on. The Laser cutter usually comes with everything needed to get it running, but the variety of sellers, versions and options makes it hard to tell if that's always the case.

The device itself is a lot larger than I thought... Takes the full bench in my case. The protective "glass" is covered with a paper and wax type of foil. 

A look inside. In the white box beside the exhaust hose is the water pump housed

All of the sheet metal parts on the inside are punched and covered in blue film

Connections and a view in the laser tube cabinet

Hailea ACO 318 air pump

Mechanically the machine itself is build from surprisingly thick, powder coated steel and anodized aluminium parts. The X and Y gantries are reasonably steady and the belt drives are adjusted (at least on this unit) the way they should be. After removing the protective film from all the sheet metal on the inside of the machine, you'll be left with very sharp punched steel edges. Be very careful the first time you touch the edge! On the back of the machine are all the connectors for power, exhaust air, coolant and the coolant pump. The coolant pump has an north American plug. Which in my opinion is one of the most dangerous connectors for mains power out there, but we will get to that later on... 

High power laser supply and stepper driver/interface board. The laser power supply also powers the led strip in the cutters enclosure and the driver board. 

Emergency off and power switch are wired in series. The blue pcb contains the laser power control interface

slightly better view on the driver board. The usb connector is misplaced and it seems like the enclosure has been designed for another board

A view deep inside the machine. Some empty space where I will place the air pump. Above the empty space is the laser tube compartment, which is closed from all sides (even the inside).

Talking about electronics, in the dedicated compartment are the driver board for the stepper motors, one large power supply for the laser (which also provides the power to the motors and led stripes) an emergency off button and the power controls for the laser tube. The laser tube itself is mounted in the back of the machine and is the common water cooled variant with 40W on the label. There are a few things that I want to change and modify: First and most important step. Making the machine safer! Second, deal with the rather useless part mount. And third, add an air nozzle and pump. I check these points in a rather unordered form as I go along and also fix things that I'm not comfortable with. This is not intended to be a step by step guide and also not any kind of instruction. DO NOT BUY OR USE one of these devices when you are not familiar with electronics and high power lasers! This device is at least in the bought form highly deadly in many ways.

So let's start with the safety issue. The entire machine enclosure is made from sheet metal and therefore should be grounded. This has been done by the manufacturer, however they skipped on important steps while doing so... On this unit the star type grounding lug has been powder coated and therefore was not making any contact to mains earth at all! Ensuring a proper connection to the chassis solved that problem. Please be aware that also all the access doors rely on a metal to metal contact in the hinging for grounding. Fixing this with dedicated grounding wires is the preferred solution. I won't show any pictures of my grounding solution in order to keep people who are unfamiliar with this away from trying this on their own...

The next fix might sound a bit silly to some of you but I'm really a fanboy of the european protective contact socket (or Schutzkontaktsteckdose in german). The UK type plugs are okay for me. I disagree with the fuse in each socket and the rather large form factor, but I personally can't see a problem safety wise. The american plug, on the other hand, always gives me a headache when i see it. I can't seem to understand the reason why it's so popular. Exposed contacts up to the plug housing and minimalistic creepage distance are the largest safety concerns that I have. Of cause I've heard about sockets that have really deep insertion levels till they make contact, but why leave the users health integrity up the manufacturers? 

maximal distance with still valid connection. In my opinion far from safe

all doors are removeable

rather useless fan shroud

fan shroud

both old sockets removed and ready to make some space for the new one

the famous german schutzkontaktsteckdose in matching colour

the enlarged hole. Ready to rewire the back end.

Well, enough about my own opinion. The included water pump has such an american plug and the lasercutter housing also has two sockets next to each other. These are activated when the device is switched on and thus protect the laser tube (if the water pump is connected to one of them) from overheating. I removed all the covers from the device (simple spring tensioned pins) and took the entire XY mechanics out of the device. There also was a fan shroud for the exhaust fumes which I removed entirely as it was way to large and restrictive.

Then I removed the sockets, which as it turned out afterwards already had contact with minimal insertion. with a dremel tool, i removed the metal strip between the old sockets and made room for the new large one, which is also earthed. 

The water pump also got a new plug, although it will be replaced by a Julabo medical cooling system in the future. Now that the housing was already disassembled, I loosened the screws from the power supply and made room for the air pump. This found its place on the supplied rubber feet with 4 holes in the housing.

sketching up a template for the pump mounting holes

new drilled holes from underneath

air pump finally in place after a long fight with the far right nut...

For this, I drew a template on the inside of the housing and transferred it to the outside. The tightening of the nuts on the inside with the pump in the way was then again a special challenge but also succeeded after a little cursing.... Then I distributed the air hose in the housing and brought the whole wiring and mechanics back to place. 

A perfect match size wise!

Since the pump should be controllable via a separate switch, i cut a hole in the control panel and put another switch above the main switch.

The next thing that I did was adding a safety interlock to the lid of the device. The power supply already has a connector for such a switch in place and the enclosure also has openings for cables, but nothing installed by the factory apart from a jumper link to enable the laser all the time... Well you know what I think about stuff like that. So two more holes where drilled (be careful not to drop with metal shavings into the power supply!) and a roller switch got installed.

the air assist switch in place and first powerup

main door interlock to disable the laser during setup times

After this mayor rebuild I was confident enough to plug it in for the first time. And it worked flawlessly! The air hose got connected to a 3d printed nozzle from thingiverse (https://www.thingiverse.com/thing:2939495) and the hose routed to avoid contact with the laser beam. The part mounting mechanism is fixed to one specific height, which make focusing the beam onto our cell inserts quite difficult, so new spacers have been turned on the lathe and installed to our specific needs. The project has been done within 2 days as time was a real issue. The device has already been installed in the medical lab where it will from now on with some minor tweaks, support the research in endothelial cell perfusion. Time will show if our rather unusual and cheap way (at least in the field of medical devices) will be the success needed.

first tests with test cell inserts worked fine

LCSC Components | My thoughts

Last week, I got surprisingly early my ordered parts from LCSC. I should probably mention, that Im not affiliated with LCSC in any way. I just want to share my opinion with a shop that I didn't use before.

As you may have already seen in one of my recent posts, I'm assembling a huge amount of DIY FrSky compatible receivers. Some of the parts are quite expensive (about 2.5€ each) in reasonable quantities from my usual suppliers Mouser and Digikey. This time I wanted to try one of the more trusted chinese suppliers. I have some experience with parts from Aliexpress (especially rf ones) and most of them where not worth the cost saving. This time however I ordered as already mentioned from LCSC. No hugely critical components just resistors, capacitors, some ICs (and a reel of 5000 resistors just for kicks ~5€). In total I spend about 80€ including shipping cost to Germany. The cost savings in my case are about 65% compared to the same amount of parts from my already trusted suppliers. Maybe I just had luck, but the next day the order was already marked as shipped. I have not paid any extra fees for express shipping or anything like that so that was quite impressive. Again probably having luck, my order arrived only 2 weeks after the payment at my destination. I expected the parcel to be delivered to the local customs office because of the value. Over here in Germany it's quite common to pay the customs afterwards, so you should consider that already during the shopping. In my case, I pre-calculated the possible amount that they could have charged me. But still the cost saving was so high, that I thought, it's worth a try. I can't tell at the moment how the parts will perform and whether they are out of spec or not but I will give an update to that for sure. All I can say at this point is, that they arrived in a pretty well packed box and individually labeled.