Reverse-Engineering a Chinese Laser Scanner - Page 1
Forum section: electronics / general

author: seancsnm
author_rank: Regular Contributor
timestamp: August 31, 2015, 06:13:03 am
content: I purchased a Chinese-made/designed(?) laser scanner set. Although I really just wanted the galvos (the mirrors mounted to rotary actuators), I could only find sets similar to this:http://www.ebay.com/itm/20Kpps-laser-show-galvo-sets-scanner-ILDA-Closed-Loop-max-30kpps-/390924991455?ssPageName=ADME%3AX%3ARTQ%3AUS%3A1123&nma=true&si=bLcBarJZDOAg4XaRd1Rj49N1F4Y%253D&orig_cvip=true&rt=nc&_trksid=p2047675.l2557So I purchased it, and the main board started having problems (no output to either the X or Y galvo; I can't remember which). As there is very little information available on these Chinese laser scanners, I thought I'd do some reverse-engineering to see exactly what's going on.Theory of OperationFor those who aren't familiar with the theory, I'll try to briefly explain. Laser scanners are primarily used for laser shows. Typically, for each laser in the show, two galvometers or galvos redirect the laser beam either in space or on a wall. Similar to how a CRT monitor creates an image, the galvos redirect the laser very quickly to trace out an image faster than the human eye can keep track of, so a visible image results.The galvos are mirrors connected to coils of wire in some sort of rotary actuator configuration very similar to an older analog coil-based current meter. The galvo is driven very similarly to how a speaker is driven - by an input source. A digital signal is converted into a low-power analog signal, then that signal is amplified to provide enough power or current to drive the galvo. I don't believe the galvo requires very much power for steady-state operation, but for typical use, the galvo needs to be able to switch from position extremes about 20k+ times per second. Hence, some sort of high-speed amplifier is used.What I wanted to accomplishIt was the first stage board (low-power analog signal creation) that died on me. I had a few goals in mind when I started the reverse-engineering process:1) Figure out whether the board would be useful if Ididmanage to fix it2) If I couldn't use the board, find out if there are any important characteristics that might need to be carried over to a replacement signal generator3) Find out how the board worked4) Improve reverse-engineering skillsInitial Important Information and ConclusionsAwesomely enough, all of the IC's had datasheets available, except for the microcontroller which had its number very thoroughly scrubbed off. The image layer_labels shows where each IC is located, but they are also listed as follows:2x 358 Daul Op Amp3x 324 Quad Op Amp2x HEF4053B SPDT 3-channel analog signal, digitally controlled switch1x TLC7528 Digital to Analog Converter1x 75176B Bus TransceiverLooking at the DAC datasheet, it was immediately clear that the DAC was only 8-bit, and thus not a high enough resolution for what I was trying to accomplish (I probably need closer to 10-14 bit resolution). However, I wanted to accomplish objectives 2-4 still, so I kept going.I did a full traceout of the board as can be seen by the attached images. It was only a two-layer board but it still took me a very long time (8+ hrs) to do this step. It did give a good sense for how boards are laid out though. I've only laid a board out once, and it was a very simple cookie cutter design, so sometimes it's good to see how someone with experience does it (though I will take the techniques with a grain of salt, as the board was clearly optimized for price, not for quality).What the layout also gave me was a clear pinout of the microcontroller. After some searching I found that it matched the Atmel 89xxx(x?) series microcontrollers exactly. It makes sense that it would be a microcontroller like this because Atmels are some of the cheapest microcontrollers that I've seen. I don't know if clones exist, but even if they do I would think that interfacing with/programming them would be an almost identical process. I've only ever worked with the MC9S12 though so this is all speculation on my part. It could also be possible that a different manufacturer that uses a different architecture happened to have a microcontroller with the same exact pinout, but the chances of this happening seem minuscule.This leaves narrowing down the exact processor used. From looking at the datasheets of different 89xxx microcontrollers, it looked like the only notable differences were running speed, RAM, and flash memory. There was a 16 MHz oscillator used on this board, so that cuts out just a couple possibilities. The other useful bit of information is that the microcontroller stored some example laser shows. I'm not sure what a laser show format is typically in, but I believe that there is one dot per time frame, so if it was a sequence of X and Y 8-bit coordinates, and things were running at 10k times per seconds, and the controller plays a 2-minute show, that would equate to... 2.4 MB of data.Ok, obviously that's a horribly inefficient way to store show data and they found a way better way to store that information. I'm thinking 32 kB max in terms of memory requirements, as that's the upper range of the processor series, and the microcontroller is not using any external memory.I will have to upload schematics at a later time, as I'm out of time tonight, but what I did find was that the board has two main components:1) R, G, and B laser drivers2) X and Y galvo driversEach of these components is controlled in one of two ways at any given time:1) The microcontroller2) A sound card analog interfaceThe board definitely has design implementations to allow for the microcontroller to interface serially through a connector, but I am not very familiar with most communication protocols, so I'd have to do a good bit of learning before I'd be able to tell you exactly how the communication works (if anyone is in a really good mood, I have no qualms about you taking some time to direct me to where I could learn about it).But what's important for now is that we have a very high level idea of how it all works.The galvo drivers has the following signal flow:1) The signal source is determined by the sound card input port, and the 4053 ICs switch between the input source. If sourced from the sound card, the signal reaches the sound card port, is sent through what looks to be a fancy buffer, and goes to the switch input. If sourced from the microcontroller, the 8-bit digital bus goes from the microcontroller to the DAC, which requires an external op amp per output. From here, the signal is sent through a summer, which is tied to an external pot and allows the magnitude of the output signal to be adjusted. The output of the summer goes to the other switch input.From the switch output, the signal is fed directly to the analog output to the galvo amplifier as the positive output. It is also fed through an inverter before being sent off as the negative output. I guess this is what you would call a differential output.Hopefully it will be a lot easier to see what I'm saying if/when I manage to get schematics up, but for now bear with my textual description.What is happening is actually really simple if you look at it in terms of inputs and outputs. Input = digital/analog signal; output = bias-adjusted differential analog signal. No dedicated filters or fanciness at all as far as I can tell.

author: amyk
author_rank: Super Contributor
timestamp: August 31, 2015, 03:16:12 pm
content: It's thestandard 8051 pinout. Its UART is connected to an RS-485 transceiver whose direction is controlled by one of the port pins.The reason they use 8051 is because it's cheap and has lots of I/O.I doubt it's Atmel;STCseems more likely.

author: ajb
author_rank: Super Contributor
timestamp: August 31, 2015, 08:27:35 pm
content: It's typical to use an audio amplifier IC to drive galvos, usually a single half-bridge, hence a bipolar power supply is required. The large round section at the back of each motor will contain an LED and photodiode for optical position feedback. The position feedback signal will be used to close an analog PID loop, the parameters of which are adjusted via the trim pots on the board. The drivers may or may not contain a current integrator for additional feedback, and a notch filter to reject mechanical resonance.The other stuff is pretty typical of cheap chinese laser projectors offering DMX/ILDA/standalone functions. The DB25 connectors are going to be standard ISP or "ILDA Standard Projector" pinout. You can purchase ILDA control interfaces that will allow you to control a laser projector from your PC via USB or ethernet, LSX and QuickShow being popular options there. If you go that route, if you don't care about the standalone/DMX functions, you can pretty much just wire a DB25 connector straight to your galvo drivers and laser modulation inputs and Bob's your uncle.If you want to roll your own, it's just a matter of a pair of DACs for the X/Y control, and maybe another three DACs for color modulation that you can drive from an MCU. The scanner drivers typically expect a maximum +/-10V differential input signal for full deflection, but +/-5V or less will likely give you sufficient scan angle for most purposes.

author: seancsnm
author_rank: Regular Contributor
timestamp: September 19, 2015, 08:50:31 pm
content: This is way late, but thanks for the responses and more importantly the insight and corrections. What I think I'm going to do is scrap the idea of using the board for control and instead roll my own DAC. But going through the process was a great exercise for myself, and as an undergrad EE student, it's a good way to tie theory to practice.