MigDevelopments

Ford Focus Duratec Box 'O Tricks - PATS Code Fun

2011-05-03T03:36:00.000-07:00

This post details reverse engineering the PATS security system in the Australian delivered Duratec engined Ford Focus. It follows on from this post.

After recording a few CAN sessions with and without a valid key, it was time to try and understand the encryption method being used by the focus. I took a punt and started by assuming they were using the Microchip owned Keeloq system. This encryption might be used by the wireless unlock system, but as it turns out, not the PATS system.

The cypher for the Keeloq system has been published as well as some tools to make breaking it a little easier. I started with a brute force approach. The code I wrote in C.Net was going to take years to complete all possible codes.

Disheartened by the lack of success I considered just creating a response map. Basically a table of the response for each possible challenge code. But since this is 32bit we are looking at 2GB to store the data as an offset table. Not an ideal situation, and gathering all the data would take a long long time too.

I started to look at the recorded challenge and response codes and thought there may be a pattern. However I only had responses to random challenges, making things a little tough. Then it struck me that I could remove the EFI ECU and send sequential challenges to the dash to record the responses.

With the sequential challenge \ response data (for a few hundred codes) I started to see some patterns. Then I dug a little further, looking at the data in binary helped a lot.

To cut to the chase, I was able to condense the data set required down from 32GB to just 1024 bytes!

As it turns out each byte of the challenge code maps a separate code table. So for each byte within the 4 byte challenge code, there is just 256 answers. Basically each byte is treated independently, greatly reducing the complexity. This was a huge surprise!

There are a few little tricks (bit nibble swapping and the like) which make the simple code a little harder to see at first.

In the next post I will illustrate some examples and the rules for this code simplification.

I am still convinced that there are patterns in the simplified code and this could be further reduced, I just haven't had the time yet.

Ford Focus Duratec Box 'O Tricks - Hardware

2011-05-02T05:44:00.000-07:00

Just here to get a picture link for a forum...

Killing ABS Warnings - Sometimes You Just Get Lucky!

2011-04-18T04:20:00.000-07:00

At the moment I am doing some work on the electrical system of a Hot Rod build that is mostly made up of a 2005 VZ Commodore, being built by Jim.

The good part about this project is that it is using almost all of the commodore, so the harness stays in tact and everything is guaranteed to work together in harmony.

Apart from a few small issues, the biggest headache is the ABS. The rod won't have ABS, so the instrument cluster was beeping and showing animated warnings non stop.

Pesky ABS Warning on the LCD Dash

I had looked at a lot of options to fix this, the easiest was to use a BCM from a non ABS VZ ute (yes they made them) but I think nearly everyone would have optioned AC & ABS, the base option is only to get the headline price down.

In the end I decided the only way to fix it was to create a ghost system that would pretend to be the ABS. Now I could reverse engineer this, but It was going to take ages and I needed access to a working system. Convincing a friend of a friends mother that you need to plug-in an play with the family car is not as easy as you think!

This time however, I go lucky!... Even though the ABS wasn't hooked up on the rod, we still had the original ABS unit. So I hooked up a CAN bus monitor and compared the system with and without the ABS module running. This yielded three message addresses belonging to the ABS.

Without ABS

With ABS ON

So now I knew that the ABS module was sending frames out on 140h, 280h, 2F0h at 21ms, 100ms and 100ms respectively. But I had no idea what the content of these frames represented. Sure I can guess, wheel speed, status, brake force, but that still doesn't help.

Suddenly I had a thought, I felt a little silly about trying it and didn't explain to those watching what I was doing in case of embarrassment..... But what do you know, it worked. I Just spammed out empty (all zeros) frames at on the addresses above at the original rates.

It seems that the BCM was happy seeing something, but nothing from the ABS module. It stopped telling the cluster to beep and flash, so now everyone is happy.

Sometimes you just get lucky.

Ford Focus Duratec Box 'O Tricks - Engineering In Reverse

2011-04-14T03:33:00.000-07:00

This post details reverse engineering the PATS security system in the Australian delivered Duratec engined Ford Focus. It follows on from this post.

To reverse engineer this system I began by listening to the CAN bus interaction between the Cluster & ECU. I use a Peak USB CAN interface, which is great, but you need to write you own PC software to get the best out of it.

The first task is to sort out which data on the bus relates to the function you are interested in. Typically you will get 20 ~ 50 addresses reporting at different rates on the bus so it can be daunting to start with. Removing components from the system one by one can help in starting to narrow down the addresses of interest.

In this case the engine ECU PATS is reported on address 46h whilst the instrument panel reports on 40h.

The next step is to identify the interaction pattern. There is no need to understand the detail of the message content yet, just the order and timing of the 'conversation'. This part needed recordings from several engine starts to compare the common parts, and the parts that changed.

The data interaction is detailed below.

The highlighted frames are the important ones. I don't know the interaction between the Key ECU and Cluster, but since I want to replace all of these, I don't care.

Basically the above shows a classic challenge response scheme., also know as Friend Or Foe This method doesn't require any codes or keys etc to be broadcast, reducing the chance of hacking. A diagram of the interaction is below.

Next I needed to get an understanding of the encryption to try and replicate it.

Ford Focus Duratec Box 'O Tricks - System Layout

2011-04-14T02:57:00.000-07:00

This post details the PATS security system in the Australian delivered Duratec engined Ford Focus. It follows on from this post.

The PATS (Passive Anti Theft System) essentially forms the vehicles immobiliser. Without the PATS system working, your Focus just wont start.

The thing that makes the system a little odd in this vehicle is the critical function performed by the instrument cluster. Not only is the cluster required for PATS operation, it has to be coded to match both the ECU and key!

The diagram below shows the layout of the components in the Focus PATS system.

The Instrument Cluster communicates with the Key ECU which is located beside the ignition cylinder, it includes a loop type antenna for wireless communication with the circuitry embedded in the key head. Communication with the cluster is by a independent serial bus.

The Cluster interacts with the Engine ECU through the high speed CAN bus which is shared with most other ECU's. The messages sent between these components perform many functions apart from the PATS feature.

Seatbelt Warning Lamp Timer

2011-04-02T22:01:00.000-07:00

If you are registering a ICV (Clubman, Cobra etc) in Australia you will need to have a seatbelt warning light to meet ADR requirements. There are a number of ways that the lamp is allowed to operate (for example linked to a switch in the seat), the easiest is just to run the lamp for a short time when the ignition is turned on.

The small (60x20mm) circuit will run the lamp for 20 to 30sec after power is supplied. When power turned off and on again the timing period restarts.

The circuit is a simple and robust. Power feed comes from ACC or ON ignition lines. The output can run a small bulb (2W max) an LED or the lamp in an OEM dash (where it needs to be grounded to operate).

The board is double heatshrinked and supplied with fly leads and wiring instructions, it is easily taped or cable tied to a harness or frame.


The completed timer board, wrapped in heatshrink

Dash lamp with symbol is also available

The Timers can be purchased for $20 including shipping (Aus only)

If you want the lamp as well the package is shipped for $35.

For sales and enquiries please email me using the form on the right, or using this address info@migdevelopments.com

Below is a hook-up diagram covering a few diferent scenareos. Click on the image for a larger view.

Tim's Tachometer Interface

2011-04-02T21:58:00.000-07:00

Tim is building an ICV using a 4cly Toyota Camry engine. For a dash he bought a multifunction LCD unit intended for motorbikes. It was a 'vapor' brand -> see picture below....

Vapor LCD Dash Unit - Intended For A Motorbike

The problem was that the tachometer was not triggering. The vapor dash had an input that could supposedly be hooked up a number of ways. The primary method was to wrap in input wire around the ignition lead, inductively coupling it.

Since the engine in Tim's car uses coil on plug ignition, there was no lead to wrap the line around.

Even though the dash instructions said that the tacho could also be connected to the coil trigger line, this didn't work. The trigger line is 5v, we fixed this with a transistor to get the same signal to 12v, but with no success.

The only time that the dash would just to life was when the line was connected to the power supply line of the coil. When I looked at this line on the oscilloscope I could see a lot of noise related to the coil firing. Each time the coil charged the voltage would drop and then spike to 16v when charging stoped (inductive field collapse). This worked ok at low rpm, but there was too much interference from the other coils at higher rpm causing erratic behaviour.

Interestingly some cheap rpm meters that plug into the cigarete plug use the noise on the power line to detect the coil firing rate.

Since the dash seemed to be triggered better by higher voltages (which would get quite high when inductively coupled with the ignition lead) I build a simple charge pump circuit to increase the system voltage to around 25v. The 5v coil trigger line activates an NPN transistor which is pulled up to the 25v rail. All this gives a higher input voltage signal to the dash, causing it to spring to life.

Circuit on proto-board

Circuit neatly mounted in a box

Basic Schematic of circuit

The only modification we made was to hook the circuit up to two coils, doubling the rpm displayed (this adjustment couldn't be made in the dash). The reason was that the unit was designed for a high reving motorbike and didn't look so good only revving to less than half the full display range.

USB DRO Project

2011-03-07T19:26:00.000-08:00

This project will increase the usability of any Mill or Lathe with minimal cost. Whats a DRO? It stands for Digital Read Out and is connected to the axis on a milling machine or lath to show the current location of the cutter. This makes it much easier to make things, rather than reading the dials and counting in your head. The productivity gains from adding a DRO are huge.

Traditional DRO System

Unfortunately DRO's tend to be realy expensive, some systems cost more than the home workshop equipment they are connected to. When I started to look at options I quickly ruled out the traditional 7 segment LED displays for the following reasons:

Too difficult to run - A three axis system might have 25 or more modules!
Too much current draw - It adds up!
Too expensive - Again, the cost adds up

I was also keen to make the system flexible, so that some users might have one axis, others 4 or more. Designing the PCB and control systems to be modular was a headache.

As an alternative to 7 Segment LED modules, I explores LCD's. However the readability was not so good and the same issues with flexibility etc weren't resolved.

Finally I decided to produce a PC based system. It is pretty easy to get your hands on a low cost (free) older PC running XP, small LCD screens (14") are worthless and both can be mounted easily high up next to the machine (or in between a mill and lathe for a shared setup).

By using the PC as the display and input system the costs are kept down, the system is flexible and there is plenty of scope for fancy functions to be added later (like pseudo CNC).

The above pictures are of the prototype system currently under development. The board on the left is the optical transceiver option (for linear\rotary position) and the board on the right is the hall switch option (for spindle RPM).

The optical transceiver and matching linear strips are from US Digital. The USB bridge is an FTDI FT232RL and currently a Microchip PIC18F1220 is loaded as the micro. Power is derived from the USB bus with a P channel mosfet ensuring the board does not draw excess current during suspend mode.

The pins exiting the side of the PCB are for development programming and will not be there in the final version. Also, the wires jumping across the micro are there to correct a mistake in the circuit which seems inevitable despite checking are rechecking (damn microchip and there use of the easily forgotten vdd \ vcc). The boards are 55mm x 32mm and were produced by PCB Core. The final units will be encapsulated in epoxy for water resistance.

I will keep placing updates here as I go. If you have any interest in the system please drop me an enquiry using the form on the right.

UV PCB Exposure From Old Scanner

2011-03-07T17:30:00.000-08:00

This is a project I finished a long time ago and even though I no longer use it the idea could be useful for someone else into home made PCB's.

Over the first few years of mucking around with electronics I tried many methods of making PCB's at home. Starting with hand drawing the tracks with a marker pen, then moving to some of the iron on methods. Finlay I decided the best (most accurate, repeatable, satisfying) method was the UV sensitive system from Kinsten.

To make this system work as well as possible the exposure should be done on a flat bed with the artwork sandwiched between the PCB and light source. Kinsten sell a nice UV exposure unit (picture below), but it is a bit pricey for the home user.

Kinsten Exposure Unit

As an alternative I salvaged an old flat bed scanner from a local throw-out. Removing the workings of the scanner I placed 5 small UV fluorescent tubes and associated power circuits that I removed from a number of 'party' lights that were designed to run from batteries or a 9v plug pack. I seem to remember paying around $5 each for the lights on sale. To finish off the project I added a switch mode power supply (240v -> 9v) and a timer from an old oven (rotate to set, rings a bell and switches off when finished).-

Photos of the recycled flat bed scanner

This unit gave me the most repeatable and accurate home made boards, I was able to produce small pitch footprints for SMD and make double sided boards (without plated through holes \ vias). There are also chemicals available to 'silver' the exposed copper (at room temp) to give the look of tin platting (HALT) as can be seen in the example below.

In the end I have decided to get a commercial company to make all of my PCB's now. Once you are handling small SMD parts and want high density there are too many defects when trying to make your own boards economically. I recommend the following PCB manufactures:

Futurlec [Thailand: For Through Hole and Larger SMD - Double Sided]
PCB Core [China: For High Density, Low Pitch SMD, Multi Layer]


Example PBC made using this system

Of course, its is pretty hard to come by a stand alone scanner these days, they all seem to be built into multifunction printers!

Race Car ECU - Graduate Project

2011-03-07T15:53:00.000-08:00

This is a blast from the past. Reminds me of how far my electronics knowledge and design skill has come!

My final year engineering (mech) project was to build a prototype engine ECU and data logger (integrated) for the Formula SAE contest. The project was completed in partnership with Julian Sanders under Prof Bruce Kuhnell. We also had some guidance from an engineer for a Formula One team.

The system was based around a Freescale MPC555 32bit processor, which was quite advanced at the time. The prototype was made with 2 A3 sized double sided PCBs which were hand made. Most of the parts were through hole. The system had an enormous number of inputs and outputs handled by the circuitry on these boards.

User input was from a 'remote' hand controller with an LCD screen and input keys. Data was logged onto an SD flash card using a uMMC board from Rouge Robotics.

By the end of the project we had the system running and test software written. However there wasn't time to hook it up to an engine. The reports for this project are available for download below, feel free to take a look. Please don't send any questions or comments, the project was completed a long time ago and I am more than aware of the limitation of my understanding at the time.

Research Paper

Final Report

Ford Focus Duratec Box 'O Tricks

2011-03-06T19:45:00.000-08:00

This group of blogs is about a system I developed for my Dads car (see below).

Those who build ICV's (like those at OzClubbies) will appreciate that taking an engine from a donor car and getting it to work in your back yard project is getting more an more difficult as the electronics become increasingly complex.

The ICV built by my father (Ian Rusch) used a 2005 Australian delivered Ford Focus 2.0L 'Duratec' engine. When wiring up the system we wanted to retain the minimum amount of electronics from the original car. For ADR compliance the original engine control ECU had to be retained, and obviously all of the engine sensors.

In the past it would have been easy to separate out the engine control to run stand-alone, but not in this case. The dashboard (gauge cluster) plays a fairly major role in the focus system, for our purposes the main function causing issues was the security system.

-One option to take (which others have) is to just retain the original dashboard in the new car. There are a number of reasons why we didn't want to do this. 1. The dash didn't suit the look of the car, aftermarket gauges matched much better. 2. The dash would complain non stop about a myriad of things that were 'wrong' with the car, such as doors being open, power steering faults, ABS faults etc. It is possible to trick the dash into thinking that all of the required systems are still there (by sending faked CAN Bus messages), but that is a bit of a band aid approach.

For all the reasons above I was tasked with creating a system to allow the engine to start and run using only the Engine ECU (bypass security) and to drive the aftermarket gauges and cooling fan.

In the next blogs I will describe the system I came up with and what I found out about the security system (Fords 'PATS' system - Passive Anti Theft System)

The Project That Never Was

2011-03-06T18:54:00.000-08:00

This was a project I started whilst looking at options for color LCD's to use as a remote control for a system I was designing for the company I worked for at the time. This project was intended an an evaluation of the LCD system.

After looking into a lot of systems I decided to use a turnkey option from 4D systems, specifically the uLCD-32PT. This is ready to go system that includes a uSD card to store images and has high level functions to draw shapes, controll the contrast etc. This is not the cheapest option, but avoids lots and lots of hardware and code to get the LCD running.

As an alternative, a college created a proto circuit to use Sony's PSP screen. These screens can be bought very cheaply as replacements on ebay. However, the circuit required about 5 power supplies and an FPGA to clock out the huge display. Additionally, all of the connectors and chips required are tiny and impossible to solder (if you can buy them). The final result was great, but too much work for low production.

The application I was working on for the evaluation was an OBDII interface which would allow you to plug in to your car and display all sorts of system information as dials or graphs. Changing the display was all done through touch and swipe movements on the screen.

I have the GUI working well when I discovered this iPhone App. Of course there was little point in going on with the project, since I would have to sell my system for close to the cost of an iPhone, and my box didn't make calls!

One day I will pull this project out and find another use for it.......

MiniMsgBoard - Software

2011-03-06T18:18:00.000-08:00

The PC Software for this project was developed using Visual Basic .NET (Visual Studio Express 2010) which can be downloaded from Microsoft for FREE.

The project requires the FTDI D2XX Driver and ChilKat XML ActiveX component to be installed.

The USB communications are handled by the FTDI API which utilises their D2XX driver. This is one of the two drivers you can choose to use with this chip. The virtual COM port driver makes the device look like a regular RS232 port that can be accessed by any UART program, this is useful for debugging, but a little unprofessional. By contrast, the D2XX driver looks more like a 'product' and limits easy access from other programs.

Changing the setup of the FT232RL is done with the FT_PROG tool from FTDI. Here you can set the name of the device (in this case"MiniMsgBoard"), which is used by the VB code do identify which device to connect to.

The RSS data to display is handled by the ChilKat XML ActiveX component. This allows the program to retrieve a text string from a particular RSS feed. The program maintains a list of RSS feeds that the user likes, the address to display is randomly chosen, and similarly the item to be displayed is randomly chosen. Even though the Chilkat Active X component is very good, I ended up writing my own XML parsing function as I found that the built-in would occasionally 'forget' to convert some XML to ASCII correctly (e.g. &).

The RSS data retrieval and USB communications are handled by a thread. This is the first time I have used threading and It is fantastic for this type of project. Because the communications function would spend a lot of time feeding characters to the microprocessor, the user interface would lock-up. Now with the long slow stuff handled by a thread, the user can click on the form and get an instant response.

The user interface is finished and stable, it just needs some time spent to make it pretty now. The program starts up minimised in the notification tray, where the icon changes color to inform the user of the status. User settings are saved within the program using the 'My.Settings' method, which greatly simplifies handling user preferences etc.

The RSS project is available for download below. The executable can be found within this folder as well.

VB Mini Msg Board RSS Feeder

MiniMsgBoard - Firmware

2011-03-06T17:46:00.000-08:00

The firmware for this project was writing in C and compiled with Microchip's C18 system. C18 can be downloaded for free from Microchip if you register as a student. The files are created and managed via Microchips IDE (MPLAB). The PICKITII system is integrated with the IDE so programming is done at the push of a button.

The basic program flow is grouped into 3 key areas:

UART Communications
Display Buffer Manipulation
Display Function

UART Communications:

This function handles receiving ASCII characters to display. The microcontroller uses the CTS UART line to signal to the PC software that it is ready to receive a character. The micro will continue to receive characters until the buffer is full, once the character has disappeared form the display it is removed from the buffer and another character can be received. By having a buffer much larger than the display width, there is no change of gaps in the display caused by time delays on the PC side.

Display Buffer Manipulation:

This function converts the received ASCII character into a 'font map' and adds it to the display buffer. Additionally it handles shifting the buffer along to create the 'scrolling' effect. Protection is provided to stop the updates being visible to the viewer.

Display Function:

This is the function that actually runs the LED display. The interrupt driven function switches the PNP line drivers line by line and sends SPIO commands to the GPIO chips to switch on the appropriate columns. The speed that this function runs at is tuned to make the alternate actuation invisible to the viewer.

The firmware project is attached for download below.

Firmware ZIP Folder

MiniMsgBoard - Hardware

2011-03-06T17:14:00.000-08:00

The PCB for this project is 100mm x 34mm double sided, manufactured by Futurlec.

The display is made up of 4 LED modules, each of 5x7 pixels. The modules are M7571AG-11 from Futurlec. Where the 'A' stands for common anode and 'G' for green. Normally these modules are arranged so that they form numerals that are 7 pixels high (same as a character LCD). However with this project I wanted to get the smallest possible display, so I squashed the font library to 6 pixels high (while still supporting capital and lower case!).

Each horizontal line of the display is connected to a common power line which is switched by a PNP transistor, controlled by the microcontroller. each 'dot' in the vertical lines are connected together and grounded (to turn on) by one of three Microchip MCP23S08 (SPI GPIO) which are used a little like a shift register. So at any one time, only one line is active, cycling through each of the 5 lines fast enough to be naked to the human eye.

Power for the circuit is supplied from the USB system. The current level to the display LED's has been limited to ensure that the maximum current does not exceed the 500mA allowed by the USB specification, in practice, the LED's are never all on at the same time.

The microcontroller is a Microchip PIC18F2515. A programming port is supplied for the PICKITII system. The PIC18 Communicates via UART with an FTDI FT232RL USB UART Chip. This greatly simplifies adding USB to your project and allows you to write microprocessor firmware without worrying about timing and overhead for USB tasks.

The PCB was designed using CadSoft Eagle which is available for free download, the limit being the size of PCB that can be designed. While this is a great starting point for the hobbyist, I have again moved back to using Altium (which is certainly a long way from free) as it is basically the industry standard and supports many more powerful functions. Altium is much more complex and daunting for the beginner, so I would still recommend starting with Eagle.

Unfortunately I no longer have the PCB file for this project. I may get around to drawing it up again in Altium when I get time. The schematic is available below. The one issue I know if is that pin 5 of the Mini-B USB connector needs to be connected to ground.

The bill of materials (BOM) is attached below. The designators don't quite match those on the schematic, but I am sure anyone could work it out.

Schematic File

Bill Of Materials

RSS Mini Message Board

2011-03-05T16:22:00.001-08:00

This is a little project that I completed a few years ago. Recently I pulled it out again and re-wrote the PC software because I was never happy with the original version.

At the time I designed this I was working as a designer for a company that made huge LED message signs (like those you see on the freeway). I set myself the challenge to see how small I could make a dot matrix message board.

The system is USB 2.0 based, providing power and the data flow from the PC. A visual basic program on the PC collects RSS news feeds from sites specified by the user and sends the data for display on the board.

More details to be posted soon... Click the video above to see it in action.

LCR Meter - Postsript

2011-02-28T03:25:00.000-08:00

If there are any questions about the project you can contact me on the address below.

I will answer general questions, however I cannot explain the reason for selecting a particular resistor value etc. Also, no futher work was done to this project after the article, so there are no finished PCB designs or firmware updates etc.

info@migdevelopments.com

Microchip Contest Site

www.circuitcellar.com/microchip2007/

Download article PDF:

http://www.circuitcellar.com/archives/viewable/214-Rusch/Rusch-214.pdf

Download source documents:

ftp://ftp.circuitcellar.com/pub/Circuit_Cellar/2008/214

LCR Meter - Whats Next

2011-02-28T03:19:00.001-08:00

This project was my first implementation of embedded DSP technology. It was also my first introduction to Microchip’s 16-bit processors. The toolchain and development tools supplied by Microchip made coding this type of controller quick and painless. The compiler was easy to use and all of the library files were well-documented.

I’m pleased that I can now cross the LCR meter off of my wish list. In addition, while adding a new and valuable tool to my workbench, I have learned a great deal about both analog and digital design. Now I look at the remaining items on my wish list and wonder which tool I should attack next. Perhaps a dsPIC spectrum analyzer!

LCR Meter - Further Development

2011-02-28T03:15:00.000-08:00

To correctly measure the impedance, or more importantly the equivalent series resistance (ESR) of electrolytic capacitors, a DC-bias voltage must be applied. I’ll add this to the next prototype as a fixed (e.g., 2 V) bias that is isolated from the measurement equipment by small-value DC-blocking capacitors.

Input overload protection is another feature that is especially important for large electrolytic capacitors. It is easy to add to the design. When the DUT is connected, stored energy in the device will discharge into the measurement circuit. Effective protection can be provided by varistors or Zeners coupled with forward-biased diodes.

The final version of this project will be incorporated into a multimeter-style enclosure. It will include battery power for portable use.

LCR Meter - System Performance

2011-02-28T03:14:00.000-08:00

The prototype system’s performance is very pleasing. The user interface is easy to use, push button operation is handy, and the graphic LCD is clear and easy to read. Measurements appear to meet the required accuracy (less than 1%), and repeatability is excellent. Because the system can automatically choose the most suitable frequency and circuit type, making basic measurements is very easy.

Currently, the program implements a five-cycle averaging function on the result to improve stability and accuracy. While this is a useful function, it has the disadvantage of increasing the overall test cycle time. A test on “automatic” will take up to 5 s to finish. A fast test feature is needed in the next prototype to enable quick sorting of parts at a lower accuracy.

Typically, LCR meters implement short-circuit and open-circuit calibration. Tests on this device have shown that use of the four-wire method has resulted in a series resistance error that is significantly less than the lower-limit impedance that can be measured. Open-circuit tests, however, have shown that there is approximately 3.5 pF of parallel capacitance in the test leads. At frequencies below 10 kHz, this capacitance represents an impedance value significantly above the measurement ceiling. Future revisions of this design will add a calibration cycle to measure and compensate for the parallel capacitance.

LCR Meter - Take A Measurement

2011-02-28T03:12:00.000-08:00

Figure 6 illustrates a simplified program flow for the function call that performs each test. The first tasks involve setting the ADC module, setting the DDS chip for the desired frequency, and setting the gain for both channels to a minimum value. The function of the initial acquisition loop is to auto-range the gain for each channel. Following offset correction and band-pass filtering, the dataset is scanned for the maximum value. If it’s below a preset threshold, the gain is increased (doubled) and the acquisition starts again. This process is continued until either a suitable gain is found or the maximum gain is reached.

Figure 6 — Two main loops make up the program structure that performs tests. The initial loop auto-ranges the analog stage gain before the second loop makes a complete measurement.

The second loop within the test function acquires data in a similar way to the previous loop, correcting the offset and filtering the resulting array. The main difference is that additional code is executed to calculate the crossing point and from this the impedance and phase angle. The number of times the loop executes is dependent on the argument passed to the function.

Calculations of the parameters other than impedance and phase angle are made within RUN_TEST(). This calculation is dependent on the circuit model under consideration. Auto mode attempts to first check if the Parallel mode is suitable (small capacitance); otherwise, the series model is used. The resulting parameter values are recorded to a global structure. A call to functions within the graphics module displays the values within this structure. It also displays the circuit elements graphically.

LCR Meter - Firmware

2011-02-28T03:06:00.000-08:00

I wrote the system’s code in C and compiled it with the contest version of Microchip’s C30 compiler. Code was developed as many individual functions, which could be tested in isolation. Developing the code in small pieces was necessary because the programming tool I used (PICkit 2) did not support the debugging of dsPIC devices.

Coefficients for the DSP filters were designed using Momentum Data Systems’s dsPIC FD Lite. The resulting assembly files from this program have to be slightly modified to suit versions of MPLAB C30 v1.30 and higher because the standard declarations used are no longer allowed by the compiler.

Before using a digital filter on a small data sample, its delay line has to be set appropriately. Because the initial value of the acquired dataset could lie anywhere within the sinusoid, there is a chance the data could appear to the filter as a step input, which would cause ringing throughout the dataset. The process of setting the delay line involves running a set of data whose length is an exact multiple of the period many times through the filter and ignoring the resulting output data.

Setting the delay line for IIR filters in this way doesn’t present problems; however, the actual frequency of the “100-Hz” test was adjusted to 100.80635 Hz to present an exact sinusoid period with an integer-sized data set. The FIR filters used for down-sampling cannot use recorded data because there is a strict requirement on the cycles between ADC buffer flags. Instead, the initial 50 cycles of the filter use fresh data to set up the delay line and then only the last few frames are stored for further analysis.

I used FastAVR’s FastLCD V1.2.0 to create the graphics displayed on the LCD (see Photo 2). The free program enables you to quickly create and preview graphics before exporting them as a text file in a number of formats, including one suitable for the Toshiba chipset. Graphics were stored in program memory as constants, representing a sizable amount of data.

Photo 2 — Test results are displayed on the graphic LCD. Graphics were created with FastAVR’s free program FastLCD V1.2.0. The data was exported in a format to suit the Toshiba T6963C chipset and stored as constants in program memory.

LCR Meter - User Interface

2011-02-28T03:04:00.001-08:00

You interact with the device via three control buttons. You receive information via a 128 × 64 pixel graphic LCD using a Toshiba T6963C chipset. The eight data lines are driven via an MCP23S08 SPI GPIO. The RD signal is supplied as an inversion of the WR signal via a general-purpose NPN transistor rather than using an additional GPIO line. The two remaining control lines, CE and C/D, are driven directly from general I/O pins.

The screen contrast is controlled by a connection to a PWM pin clocked at 1 MHz (required for DDS operation). Currently, the contrast is not user-adjustable, although this functionality will be added in a later revision. Similarly, backlighting control is not implemented in the prototype. This is required to improve battery life.

LCR Meter - Signal Conditioning

2011-02-28T03:03:00.000-08:00

The flow of signal conditioning stages is illustrated for each test frequency in Figure 5. Before being sampled by the dsPIC ADC, each signal is passed through an LP antialiasing filter to ensure that the Nyquist-Shannon sampling theorem criterion is met. In this case, the sample rate (Fs) is 100 kHz and the ADC is 10 bits; therefore, the filter needs to reduce the signal strength by approximately 61 dB between 10 kHz (highest frequency of interest) and 50 kHz (Fs/2). This task was achieved by a sixth-order Butterworth filter. Microchip’s free FilterLab 2.0 was used to design this filter and generate the passive component values.

Figure 5 — Test waveforms are first passed through antialiasing filters (sixth-order Butterworth) before being digitized by the 10-bit ADC at 100 ksps. Down-sampling and FIR low-pass filtering is performed on data from the 100-Hz and 1-kHz tests. The final stage before data analysis is IIR band-pass filtering.

Once the signal has been suitably band-limited, it is digitized by the 10-bit ADC. The next action is dependent on the test frequency. In the case of a 10-kHz test, the signal is passed directly to an IIR band-pass filter that limits the bandwidth to only the frequency of interest. In the case of the 1-kHz and 100-Hz tests, the signal must first be low-pass, FIR-filtered, and decimated. The rate of decimation is dependent on the test frequency, either at a rate of eight or 16. Decimation is required in this system at lower test frequencies to minimize the size of data needed to represent a single test cycle. It allows compliance with Nyquist criterion while only relying on a single antialiasing filter.

LCR Meter - Analog Stages

2011-02-28T02:59:00.001-08:00

For this project to be effective, I had to get heavily involved in the black art of analog design. The nature of this device requires high accuracy and low noise amplification over a wide range of gains. Because considerable amplification is required for devices at either extreme of the impedance spectrum, input offset and other errors can easily saturate op-amp outputs. With this in mind, the bipolar sections of the analog circuit were handled via Analog Devices AD8629 zero-drift op-amps whose 1-µV offset and 0.002-µV/°C drift are orders of magnitude below the expected signal range.

The task of the first analog stage is to condition the test signal. The signal from the DDS chip is approximately 0.3 V_PP, and its common mode voltage (CMV) is approximately 0.3 V. The signal is fed through a single-order, low-pass RC filter to further isolate clock noise. From there, it is directed to the inverting input of an AD8629 op-amp. The op-amp is configured to generate a nominal 1-V_PP signal with 0-V CMV. The required offset is achieved via a voltage present on the non-inverting input that is adjusted by the MCP41010 10-kW digital potentiometer.

The resultant signal from the first stage is fed via a 1-kW 0.1% source resistor to the DUT. A four-wire Kelvin clip test lead is used to minimize the effects of the lead resistance. The test signal passes through the DUT and into the inverting input of a ground-referenced AD8629 op-amp. The current flowing through the device is then imposed as a voltage across the 1-kW 0.1% feedback resistor.

The differential signals for voltage and current are directed to separate differential instrumentation-style amplifiers constructed of three AD8629 op-amp sections each. The gain for this stage is selectable via a Vishay Intertechnology DG418L analog switch, resulting in either G = 2 or G = 128. The final op-amp in this differential configuration is referenced at 2.5 V—provided by a Microchip Technology MCP1525 precision voltage reference and buffered by a Microchip Technology MCP6022 op-amp—to minimize source impedance.

The op-amp stages need lead compensation by way of a small-capacitance (47 pF paralleled with the feedback resistor). This was necessary to ensure stability, especially for stages with minimal gain. The capacitor value was carefully chosen to not attenuate the test frequency.

The previous stage output is centered on 2.5 V but still requires additional gain for impedances greater or smaller than the source resistance. The signal is amplified in binary steps (e.g., 2, 4, 8, 16, and 32) by a Microchip MCP6S91 SPI PGA. The reference pin for this op-amp is tied to the same 2.5-V reference voltage as the previous stage.

The non-ideal realization of the design is caused by the high-frequency impedance of the DG418L analog switch, a quantity not covered in the specification sheet. At 10 kHz, the switch displays approximately 3-dB attenuation and also introduces additional phase shift. Both have to be compensated for. A more suitable component with a higher cut-off frequency will be substituted in future revisions.