Author Archives: Phil Pemberton

Motor speed measurement

If you’re just here for the answer to the question “how fast does the Ptouch motor need to run”, the answer is 3000RPM. Ish.

I’ve confirmed this using two different measuring methods — measuring the timing between noise spikes on the motor’s power lines, and the old reflective-tape-and-laser trick. I didn’t use the motor inside the Ptouch; I actually found a motor in a defunct CD-ROM drive that was the exact same type as the one in the Ptouch. It’s a Mabuchi RF-300C-11440, FWIW. [Rapid Electronics]( stock them as “solar motors” (part number [37-0440](, and there’s a datasheet online too. Oh well, at least spares won’t be a problem 🙂

The spike timing trick is quite nifty, and involves using an oscilloscope to show the voltage across the motor. Then you measure the time between three spikes, halve the frequency (in Hz) and multiply by 60 to get the speed in RPM. It works quite nicely, for the most part. Unless the motor doubles up a spike or misses one altogether. As usual, I’m not the first guy to think of doing this — a certain Roman Black [beat me to it]( I never seem to have any original ideas…

To get a more reliable speed reading, I grabbed a laser pointer and a phototransistor out of my junk box. Then I promptly blew up the laser — seems they rely on the current limiting of the batteries — and the spare was broken (looks like the metal shell had worked loose, breaking the +VE connection). So I bought a 5V “idiot resistant” (that’ll be me then) 1mW laser from Maplins for a tenner and bounced a little spot of coherent red light off a piece of tinfoil I glued to the output pulley. That bit of tinfoil (shiny side up) bounced light into the phototransistor once per revolution. Once again, multiply the frequency (Hz) by 60 to get the speed in RPM.

Once again, I got a figure of 3000RPM. Well, 3030 actually, but what’s 30RPM between friends?

Next plan: make the laser tacho permanent. I’ve got some 5mW lasers on order (which should hopefully turn up in a few days) which are earmarked for other, more interesting projects (and 5mW is a bit much for this sort of thing anyway). This time I’ve bought five, so failed diodes shouldn’t be as much of a problem in future!

Well, that and they’ve got a built-in driver circuit. Only a single-transistor constant-current driver, mind, not like the photodiode-regulated three-transistor monster on the Maplin module.

Reverse-engineering a Brother PT-1000 label printer — Walkthrough

Well, yesterday I nipped down to Maplins and bought myself a Brother PT-1010 label printer, as an upgrade for the PT-1000 I’ve been using for the past few months. This was mainly down to the fact that the ‘1000 was nearly useless for labelling component boxes — mine would never print the micro (mu) symbol, or the ohm symbol. That and the PT-1010 has a 12-character display and shows actual error messages, vs. the 8-character display and single “ERROR” message on the PT-1000 (you have to spend ages working through the flowcharts to find out what’s wrong with it!) Also, I wanted an excuse to rip the PT-1000 apart and figure out how it works (or worked?)

So I checked that the ‘1010 worked, moved the label cartridge from the 1000 (they both use the “TZ” tapes), and swapped the batteries over. Then I ripped the 1000 open and started investigating…

The P-touch system seems to be based on thermal transfer technology. There are actually three tapes in the cartridge, not one:

* The plastic carrier tape — the ink is transferred to the back of this tape, which also forms the front of the label.
* A thermal-transfer ink tape — this carries a thermal ink which is transferred to the carrier tape using a thermal print head. The unused sections of this are discarded.
* The adhesive backing and base — adhesive coated on both sides, one side covered with a protective sheet. This forms the back of the label.

So the idea is, the first two tapes pass in front of the thermal head, then the ink dots that make up the character are transferred from the ink tape to the carrier. The used ink tape is fed onto a takeup spool inside the cartridge, while the carrier tape (with ink dots transferred) is attached to the adhesive backing. Nice and easy, and it works pretty well — the labels will tend to put up with quite a bit of abuse, and the plastic carrier stops anything reaching the ink.

But what about the printer — how does it work?

Well, the PT-1000 uses a Panasonic MN101C77 microcontroller to control the print head. This chip is a mask-ROM device that appears to have either 32K or 48K of ROM, and either 1.5K or 3K of onboard RAM. So obviously there isn’t much space there for character definitions, etc., which explains the slightly ropey print quality.

The LCD seems to be controlled by a glob-top LSI, as seems to be the case with a lot of Chinese-made kit.

Lastly, there’s a ROHM BA6220 motor speed controller, which seems to exist solely to keep the speed of the DC motor (which I’ll get to in a minute) constant under varying load conditions.

So now we move onto the printer mechanism. We can split this into three parts:

* Printing — the thermal head, basically.
* Label feed — the motor, gearing and drive system
* Sensing and detection — the cutter actuation switch, and the three pinswitches that are used for cartridge presence and type detection.

The printing head itself appears to be a 64-dot 12mm thermal print head, manufacturer unknown (possibly Kyocera). There are ten contacts on the flat-cable connector, which is obviously not enough to drive the printing elements individually. So that means there’s a shift register in there. Two pins are used for +9V (actually 7V to 9V according to the legend on the power connector), two for +3.3V, and four for control — strobe, clock, data and latch-pulse.

There are also three pin switches in the cartridge bay. These are used to detect the state (hole/no hole) of the cartridge type points on the bottom of the P-touch cartridges. One of these is used to detect that a cartridge is inserted, while the other two seem to identify the tape size. I only have the 12mm tapes, so I can’t say for certain which pins control what without doing some further tests.

So now we move onto how the head actually works. To start with, I powered up the printer and used a multimeter to find all the ground and power pins. This was fairly easy — the PCB has labelled ground and +3.3V test points. I scanned across all ten pins on the connector, and measured the voltage on each pin. By tracing the tracks on the board, I found a few pairs of pins that were connected to the same points. It turns out there are two battery supply (more likely heater supply, about 7V to 9V) points, two +3.3V supply points, and two grounds. That’s six power pins, which leaves four actual signal lines.

One of my fairly recent acquisitions is a Tektronix TDS2024B digital storage oscilloscope. This nondescript white box can acquire at a sample rate of 2Gsps (two gigasamples per second), across four signal channels. This makes it ideal for reverse engineering digital circuitry, where lots of signals often depend on each other. It’s an absolute godsend for debugging SPI serial buses (which involve four lines — chip select, master-out-slave-in, master-in-slave-out and clock). You can watch an entire bus transaction take place, capture it, zoom in and out, and figure out in a few minutes why that particular transaction failed.

But enough about the scope. Seeing as we only have four actual signal lines (once we eliminate the power feeds), we can put each signal on its own input channel and see everything that’s being sent to the print head at a given point in time.

But to do this, I had to attach about half a dozen wires to the fine-pitch flat-cable connector… less said about that the better. The connector appears to be about 1mm pitch…

So now I’ve got the head wired up to the scope, I powered up the ‘1000 again, filled the print buffer with capital “X” symbols (these are easy to spot in data traces, as you’ll see in a minute) and hit print. The scope was set to trigger on the first clock cycle, and I ended up with this:

OK, that gives you an idea what the P-touch is sending to the head — the scope is triggering off the falling edge of channel 1 (Note the “CH1 (fall) 2.40V” in the bottom right corner of the screen dump). From the trace, it’s pretty obvious that Ch3 (magenta/pink) is some form of clock signal, and Ch4 (green) is data, which leaves Ch1 and Ch2. We can also see that the print data is sent in eight bursts, though we can’t see how many clock cycles there are in a burst. So let’s zoom in a bit:

Hmm. Eight cycles in each burst. That makes sense, seeing as eight bits is a byte. Let’s take a closer look at that trace, turn the cursors on and see how fast data is being clocked into the head…

That’s 1.6us per clock cycle, or about 625kHz. Let’s zoom back out again, and see how much time there is between each burst:

Once again the scope did the hard work — there’s a delay of 10us between data bursts. It looks like the print head is being controlled by some form of onboard serial port (shift register?) on the Panasonic chip.

Now I’m going to turn the cursors off, and set the scope to view 1 again. Note that this is a short video clip of about 6Mbytes in XviD/AVI format, not a static image:


This is the first view again, but shown in real time. You can see the high area of the data bytes move into the centre, then back out again. Think about what an “X” looks like. Two arrowheads next to each other, with symmetry around the centre point. Data is sent line-by-line, and the P-touch prints horizontally. What you just saw was a bunch of “X”es being clocked into the print head as bitmap data.

So now we need a few more measurements:

* The low time and high time for the Ch1 waveform. They aren’t the same, there may be some meaning in that.
* The low time and period for Ch2, and how long it takes from the rising edge of Ch2 to the falling edge of Ch1

Let’s go back to view 1 again, zoom out and move the trace along a bit:

Note that I’ve turned the cursors on, and used them to measure the low time of the Ch1 signal (first image). I’ve also measured the high time (second image). We’re looking at a low time of around 4ms and a high time of around 10ms. That’s a total of 14ms.

Last but not least, we need Ch2’s low time (pulse period) and the Ch2-to-Ch1 delay. This time I’m going to set the scope to trigger off Ch2’s rising edge, in Single Sweep mode:

Reading off the cursor values gives us a low time of 1.4us (first image) and a delay of 11.2us from Ch2 going high to Ch1 going low (second image).

So now we need to do some research. What are these signals? What do they do? What do they mean? Well, it turns out Kyocera have produced a really nice application note on how their thermal print heads work… and the waveforms match the P-touch ones almost exactly. So open up the [application note]( and read through it. Pay close attention to the “Driver IC equivalent logic circuit” and “Sequence of printhead operations” sections.

Let’s take a look at the first image again (the overall view) and #7 (the zoomed-out view):

Compare these with the timing diagram in the Kyocera appnote. See the similarity?

It seems Ch1 (yellow) is our Strobe, Ch2 (cyan/light blue) is our /Latch (not-latch) signal, Ch3 (magenta/pink) is the clock (which we knew before), and Ch4 (green) is the data line (which we guessed from the video trace). From the video, we can also infer that when a high bit is clocked into the register, that heating element will be energised on the next firing cycle (latch pulse followed by low pulse on Strobe).

So if we merge the pinouts we’ve deduced with the scope with the power pins that we found earlier, we get:

1. Vheater. +9V supply from battery pack.
2. Data. Serial data into shift register.
3. Clock. Serial shift clock. Apparently clocks on a high-to-low edge.
4. Latch pulse. Negative-going latch pulse, ~1.6us wide.
5. +3.3V logic supply.
6. Ground.
7. Ground.
8. Strobe. Negative-active strobe pulse used to fire the print heads. Timing critical.
9. +3.3V logic supply.
10. Vheater. +9V supply from battery pack.

You’ll notice that I’ve described the strobe as “timing critical.” The strobe must be low for no longer than the P-touch holds it low (in this case, 4 milliseconds). If it is held low for too long, the print head will burn out. The high time is irrelevant, as in this state the head elements (heaters) are not energised.

It’s also worth paying attention to the time from latch to strobe (there is a time delay from latching the data to it appearing on the thermal printing elements) and the clock rates.

Now I just need to figure out how that blasted motor speed controller works… The motor is wired in reverse, and the drive voltage seems to be around 2.685V according to my DMM. The BA6220 datasheet is pretty sparse though…

And as a final bonus, here’s a picture of my rather scruffy, cramped workbench:

Public transport rant

OK, so I’ve been toying with the idea of going to the Duxford Airshow, on the basis that even if it gets rained off, the IWM should still be worth a look.

So I figure “I’ll go by train, it’ll be less effort than driving three hours both ways”.

The outbound journey takes 3hrs 30mins. It involves three trains — Leeds to Doncaster, Doncaster to Stevenage, then Stevenage to Cambridge. There’s a wait of 30 minutes at Doncaster for the Stevenage train, and a wait of 10 minutes at Stevenage.

The return journey takes about two and a half hours, goes from Cambridge to Peterborough, then Peterborough to Leeds. Not too bad. Except you can’t get a return ticket on that route. So you have to hang around Cambridge station for 30 odd minutes, go from Cambridge to Stevenage, Stevenage to Grantham then Grantham to Leeds, which gets me back to Leeds for eleven. Add in a 55-minute wait for a bus and the 40 minute journey, and I’d get home at twenty to one in the morning.

And it costs £67 return. Plus the bus ticket. So about £70.50.
Or if I got two single tickets (to take the earlier train), a whopping £137.40! And that’s Standard Class — First is an insane £385.50! Most plane tickets are cheaper!

I just priced up the same route by car at £43 and some change, plus I´m saving even more because I have this cheap van insurance to cover my car expenses.

And this is on the current rail fares system, not the “improved” (read: increased) system.

Why would anyone want to use the trains when they have to deal with that kind of crap? Aren’t the trains supposed to be, well, *faster* than the roads?

W. T. F.

The 100-400L Acid Test… Called off on account of fog.

Seems my 100-400L isn’t going to get a thorough workout this year… Spent 5 hours on the road (not counting time waiting to get into/out of the park-and-ride) to get to Sunderland for the airshow, and it was completely fogged off. No flying displays, just the usual airshow vendors and the like. The fog started to lift around 2pm, but quickly rolled back in within 20mins of clearing.

What a waste of time.

Canon EF 100-400 F4.5-5.6L First Look

So my bank card is a little warmer and a lot less solid than it was an hour a go, my wallet is lighter and my backpack is heavier. That’s right, I bought my first L-series Canon lens… The (in)famous EF 100-400 f4.5-5.6L IS/USM.

First impressions: Wow, this thing is heavy. Bolted onto a monopod (Manfrotto 679B – after the Cheap Tripod Incident of Aught-Four I wouldn’t trust my kit to anything less), I expect it to be much easier to handle.

Image quality: Goes from “Wow that’s nice” at 400mm f5.6 to almost razor sharp at 400mm f8. Can’t see any significant CA on my 40D. IQ in general puts the famous 70-300 IS “Hidden L” to shame.

Conclusion: This thing is horrifically heavy, but should be nice for the Sunderland Airshow tomorrow afternoon. IS will be tremendously useful, especially at 400mm. I need to stop letting go of the lens while swapping and changing though, the 40D really dislikes having that much load put on the lens mount…

Depending on how well the airshow goes, this may well be a keeper… I only wish I’d bought it when it A) cost less, and B) was still covered by the Canon Cashback…

USB-TMC isn’t all it’s cracked up to be

Why can’t anything be as easy as it looks?

I’ve spent the past two days trying to get my Tek TDS2024B to talk to a Linux box via a homebrew USB-TMC driver library. Based on the USB-TMC spec, I’m doing everything by the book — and in fact, I can get the scope to respond to a GET_CAPABILITIES control request. Problem is, as soon as I try and send a command over the Bulk endpoint, it times out.

Urgh. I’m going to spend a few minutes reading through some libusb sample code, then if I still can’t get it going I’ll try and finish reverse-engineering the nasty binary serial protocol the HM8130-3 signal generator uses.

Fedora 8 + fakeraid + second SATA controller = boom

Some more fun on Fedora… I’ve just upgraded my desktop PC to Fedora 8. Now, this machine has some oddities — namely, two separate SATA controllers (a VIA that’s built into the chipset and a Promise FasTrak that’s a separate chip on the motherboard). The problem with this arrangement is that the scan order depends on which module is loaded first…
So if the VIA controller is scanned first, /dev/sda ends up being the 80GB swapdrive, and /dev/sdb and /dev/sdc are the two RAID1’d drives on the Promise fakeraid. If the Promise controller is scanned first, reverse the order…

So the first time I boot the machine, I see something like this:

device-mapper: table: 253:0: mirror: Device lookup failure

And the machine crashes hard.

To fix this, disconnect the drive from the VIA controller and boot into Rescue mode. Chroot to /mnt/sysimage, then type “su -” to set up the shell. Then rebuild the initrd:

mkinitrd -v -f /boot/initrd-VERSION.img VERSION

Where VERSION is the current running kernel version (cat /proc/version will tell you this -- in my case it was Once this completes, reboot and make sure F8 boots.

Once you're sure F8 is bootable (run through Firstboot before you reboot!), try reconnecting the other SATA disc. With a bit of luck, the machine should remain bootable. Voila, problem solved.

First experiments in radio…

Well, I knew the TDS2024B would have some influence on me, but I never realised all the extra features would send me off on a rush to find something to do with them…

Oh wait. Yes I did.

So anyway, I’ve just picked up three of the nifty little battery radios that Superdrug are selling for £3.19 each at the moment. They’re Chinese-made, branded with the model number “DM-906”, the text “DIGITAL” and not a lot else. For this price, I didn’t expect much, but apparently the thing is a proper 10-band AM/FM/SW radio, with a real quadrature detector, and a fairly traditional IF system (a few IF coils and some ceramic filters). Very nice. Not to mention cheaper than buying the filters and such separately, so a nice source of parts. A really nice guy called [Hans Summers]( (G0UPL) has a few pages about the three previous iteration of the radio on his site, among other really interesting creations. The [10MHz GPS-disciplined frequency reference]( looks quite nice – I’ve never seen it done in that way before; everyone else seems to use PLLs that take ages to finally lock in. He’s used an Atmel AVR and its internal counter. Count the number of pulses on CLKin during a second, if it’s less than expected kick the frequency up, if it’s too high then kick it down. I’m going to have to get an OCXO or TCXO and try it out…

But enough about the radio. A while ago, I built up a 198kHz frequency reference (or part of it) from a design published in EPE. The receiver section has been sitting gathering dust for the best part of three years.. until today.

Last night I found out that it was actually outputting the whole AM modulated signal, not just the 198kHz carrier. That meant it was carrying the audio sidebands too… A bit of hackery later, and I now have an SA612A hooked up on a breadboard that’s up-converting the 198kHz signal to 1650kHz, at the high end of the Superdrug radio’s AM tuning range.

And it worked. First time too. It’s kinda neat hearing Radio 4 blasting out of a cheap pocket AM radio, even if it’s not done the ‘proper’ way. And this little experiment has set off something of an interest in radio… I have no idea why, but it might have something to do with the whole ‘sound from thin air’ aspect of radio… 🙂

At some point I’m really going to have to find out what I need to do to get an amateur radio licence…