Reverse Engineering Controller Tomix 22413

[lluisgib]

Hello,

 

During the first lock-down (March-April), I bought the Japanese train controller TOMYTEC 22413, a reproduction of a real train controller.

 

 

Here is the TOMYTEC video presentation:

 

https://youtu.be/a7CApVGZPMA

 

When I bought it I knew that it was damaged in some way, although I didn't know exactly how. When I received it I was very disappointed. Everything worked except the train control (the power output).
 

I didn’t want to leave as decoration and I decided to do reverse engineering. I opened up the controller and I was pleasantly surprised. The microcontroller is a MICROCHIP PIC. I had worked with PICs quite thoroughly years ago, so talking about the Microcontroller, there was no problem.

 

Board analysis

Here is a photo of the board (@iruchan)

 

 

The first thing I had to do was to understand a little bit about how the system works. So step 1 was the detection of the key components of the system:

- Microcontroller PIC16F886

- Power driver LB1948MC

- Sound chip aP89341 (in the little white box on the right)

The other ones are discrete components (resistors, capacitors, transistors...).

Once these key components were identified, the next step was to trace the connections between the microcontroller and the various peripherals and connectors. There are 4 connectors:

1. Sound card

2. Sound play and indicators module

3. Brake Module

4. Doors Opening and Closing Module

With a multimeter and a digital magnifying glass (camera with screen to see closely), I was able to understand the routing of the board

 

1. Sound Card

 

2. Sound play and indicators module

 

3. Brake Module

 

4. Door Opening and Closing Module

 

Apart from the connectors, there are some internal components that also connect to the Microcontroller:

 

With all the connections of the microcontroller tracked , the next step was to understand how the signals enter or leave the microcontroller, so that the program can manage them.

 

Let's go step by step:

 

MASCON: Master controller or speed regulator

This is a potentiometer that sends a 0 to 5 V signal to the microcontroller pin.

Although a potentiometer offers a continuous curve from 0 to 5V, mechanically there are 5 positions:

1. Stop

2. Speed 1

3. Speed 2

4. Speed 3

5. Speed 4

So what I did was checking what voltage level reaches the microcontroller pin in each position. Then with an Analog-Digital converter, I can read the voltage and determine the position and therefore the speed.

 

Brake Actuator

Like the MASCON, it is a potentiometer, which in this case has no fixed positions mechanically. Therefore, a voltage from 0 to 5V is supplied to the microcontroller pin and again I use an analog-digital converter to know its position.

 

 

In this case, I did not understand the reason why there are 2 pins of the microcontroller connected to the potentiometer, if only one is needed for the brake actuation. It is possible that in the operation of the original equipment, at some point (I suppose when it accelerates) the potentiometer is "disconnected" to save energy, and that this is done through the microcontroller pin.

 

Door open/close switch

It is a digital input, 5V or 0V. The circuit is a switch that has one pin connected to ground, and the other to the pin of the microcontroller with a Pull-up resistor to positive.

It’s curious that they have used the microcontroller's RESET pin for this input. It is really a simple digital input so it does not require much debugging. But as far as I understood, the pin next to it is not used. It would have been easier to leave the RESET pin with that function, and use the one next to it as a digital input.

 

PWM outputs 1 and 2

They are direct outputs of a square signal with pulse width modulation to control the speed of the train. Both pins are connected to the inputs of the Power Driver Integrated Circuit. No diagram is required.

 

https://en.wikipedia.org/wiki/Pulse-width_modulation

 

As information about the PWM signal, it is a signal with a frequency of approximately 19.6KHz. This frequency is generated by the microcontroller itself.

 

Reading of PWM signal

My first approach was to use this signal to read the real speed and use this measure to manage the speed meter. But lately I discovered because of a comment in a description of the system, that this signal is used to synchronize the start of the train with the speed meter and sound.

 

How it works? It uses the Back EMF effect of the DC motors. For the ones interested in this effect, here you are a link of the explanation.

 

https://circuitglobe.com/what-is-back-emf-in-dc-motor.html

 

A simple explanation is that when applying the PWM signal, just at the moment when the motor starts to turn there is an increase of the current, because the motor turns in the positive part of the cycle, and generates current in the negative part of the cycle. If you are able to detect this “step” in the current measure, you can synchronize the system.

 

To do this, you have to convert the PWM into a continuous signal and adapt it from the 9V output to a maximum of 5V that the Microcontroller supports. The following circuit is used for this purpose:

 

 

The two resistors act as a voltage divider:

Vout = PWM*R1 / (R2+R1)

Therefore, if we apply the formula to the 9V input, we have that the Vout is 2.87V.

The capacitor acts as a filter. That is, it converts the square input signal into a continuous signal with the average voltage value corresponding to the applied Duty Cycle. E.g., if we have a Duty Cycle of 50%, it means that during 50% of the time the output signal is 9V and the other 50% is 0, so its average is 4.5V in a period (1.435V after the voltage divider). The capacitor is in charge of making this "average" since its charge and discharge time is much slower. I would have to get into electronic theory, but that is not the purpose of this article either.

Position of Speed and Pressure Brake meters

It was the feature that gave me the most headaches, since in the Sound play and Indicator Module there is an auxiliary circuit that helps to handle the indicators.

The indicators are a compact module and cannot be easily dismantled, so I had to find out by trial and error how it works.

 

Each indicator has 2 electronic elements:

A motor that moves a gear wheel.

Potentiometer on the pointer shaft

 

The motor can move in both directions, so 2 signals are needed to allow us to have 3 motor states:

1. Stopped

2. ClockWise (CW)

3. Anticlockwise (ACW)

To control an engine with these characteristics, an H-bridge is used https://en.wikipedia.org/wiki/H-bridge

 

Again, it is not the intention of this article to explain in detail how an H-bridge works. But basically it relies on the activation of the transistors in one way or another to make the motor turn in one direction or another. I think this picture is quite illustrative:

Specifically the circuit used is identical to this one, made with bipolar transistors (although this one lacks the resistances since it is a conceptual scheme):

 

Therefore, we have the following table of combination of the outputs

 

We can now drive the motor in both directions.

 

Speed and pressure indicator readings

As I mentioned, there is a 360º potentiometer on the indicator axis. It has no mechanical end of turn. When it has turned all the way round, it returns to the initial value. The operation is like the MASCON reading. You only have to identify the values corresponding to the gauge’s 0 value (e.g. 0km/h) and the maximum value (e.g. 120km/h) to have a position reference and be able to make a recalibration when starting the operation.

 

LED control

It is a microcontroller output port that turns the LED on or off. It goes with inverted logic, that is, the LED lights up when you set the pin to 0. This is due to the way the circuit is made. Normally it is easier for microcontrollers to drain current than to provide current.

 

Pedal Horn

It works just like the door opening switch.

 

Direction selector

It is a selector that has 3 positions:

1. Standing

2. Forward

3. Backward

 

To do these three functions, we have three combinations of pins that you have to read with the microcontroller. You only have to detect which of the three combinations it is in to be able to know the position of the selector.

 

So much for the first part. In the next part I'll explain how the sound chip works and a little bit how the SW is made.

 

END OF PART 1

Edited November 6, 2020 by lluisgib

[lluisgib]

Here you are the part 2

 

aP89341 - Sound chip

 

It was a big question for me to know how sound worked. Especially in a type of device that we could define as "simple" or "Low cost".

The aP89341 chip is a specific chip for this type of functionality. In summary it has the following characteristics:

 

- Capacity to store up to 341 seconds of audio sampled at 6KHz with 4-bit ADPCM compression (8 Mbits - 2016 voice blocks)

- Up to 254 voice groups (I'll explain later)

- 3 operating modes:

     - Trigger signal

     - Parallel input from CPU

     - Serial commands

- Parallel digital output (8 bit) and audio output

 

For those with knowledge of electronics, this is the block diagram of the chip:

 

 

How does it work? It basically has a memory in which the different voice groups are recorded. The chip has 2016 voice blocks of about 160ms each. Therefore, if we want to make a sound longer than 160ms we have to group several blocks together. That is why there are Voice Groups.

 

Here is an example:

Let's suppose we have three voice files, which are "How are you?", Sound effect and Music. Each of the voice files is divided into several voice blocks of fixed length and stored in the memory.

● Voice file 1: "How are you?" is stored in voice blocks B0 to B12.

● Voice file 2: The sound effect is stored in voice blocks B13 to B15.

● Voice file 3: The music is stored in voice blocks B16 to B40.

The voice blocks are grouped together using the voice table to form a voice group for playback:

 

 

We need to know exactly what we have put in each voice block, so that we can then create the groups that interest us.

 

The audio is recorded on a non-volatile EPROM. This is a type of memory that can only be recorded once and cannot be deleted, so once the sounds and groups have been recorded, you cannot correct them.

 

As the chip is connected to the Microcontroller, it uses the serial control mode, so 2 pins of the microcontroller are used to send command, and one pin to monitor the status of audio playback.

 

The chip accepts 8 commands of which 5 are used to play the sounds in the system:

 

 

PUP2: Used to switch on the Audio module

PDN2: Used to turn off the Audio module

PAUSE: Pause the playback of the current audio

SUMMARY: Play the current audio

PREFETCH: Pre-load the Voice Group number you want to play.

 

The advantage of this chip is that while an audio is being played, you can pre-load the next one you want to play. This makes it possible to play different Voice Groups in a row without stopping playback between groups.

 

All the commands are 1 byte long except the PREFETCH which is 2 bytes long so that you can tell the chip which Voice Group you want to play.

 

To know which audios the chip contains I had to make a small software that played all of them with a space of time between them to be able to identify individuallythem. This is the list:

 

 

To send the PREFETCH, we have to send first the command and then the Hexadecimal value of the sound, which is constructed by putting the number or letter MSB + LSB (For those of you who don't know, the Hexadecimal is a counting system in computers that goes from 0 to 15. The symbols are 0-9, A-F, where A = 10 and F = 15)

 

Therefore, if we want to send a sound to open doors we have to send: 0x71 + 0x24

 

Power driver

 

The power driver is a chip that converts the 5V PWM signal coming from the microcontroller to a 9V, 800mA signal in order to drive the train (As I told you, this controller is for the TOMYTEC train series that can be motorised, and that works at 9V).

 

 

L means 0V

H means 5V

 

In this case the LB1948MC chip, a 10-legged chip that has 2 independent PWM channels (to put it simply, we could control 2 independent circuits). But if we put the two circuits in parallel we can feed 1 line but with more output current. This is the configuration that we have in the circuit.

 

 

It is possible that the whole circuit can be powered by 12V and run normal trains, but after all the work, I prefer not to reload the board :).

 

Software

 

Those of you who have some experience with Arduino or Raspberry Pi probably know that they are 32-bit ARM microprocessors and that they work with Operating Systems (for example, Raspberry Pi works with Raspbian).

 

A much simpler, 8-bit, special purpose processor is used in this controller. These microcontrollers are the ones that can operate small devices without much need for processing, such as a washing machine or dishwasher (that do not connect to the internet 😉 )

 

Therefore, the first thing we have to take into account is that an Operating System does not fit, so we have to pull other programming strategies.

 

Steps to create the SW

 

This can be done in different ways. What I have done is the following:

 

1. Set up the analogue-digital converter. This allows me to check that I am able to read all the analogue values I need:

○ Accelerator

○ Brake

○ Reading PWM speed 1

○ Reading PWM Speed 2

○ Reading Position Speed Indicator

○ Reading Position Brake Pressure Indicator

 

2. Set up the Digital ports, to read or control devices:

○ LED Doors (Output)

○ Speed Indicator Control (Outputs)

○ Control Brake Pressure Indicator (Outputs)

○ Door Open/Close Switch (Entrance)

○ Horn button (Entrance)

○ Address Selector (Tickets)

 

3.  Implementation of the PWM. To do this, the microcontroller has a dedicated peripheral for it, so it must be configured. Here I discovered that the Power Driver was broken, since the output of the microcontroller was working, but one of the power ouputs didn't work.

 

4. Starting up the sound module. For that I had to do a little more work, for two reasons:

○ Some of the ports that go to the sound module are shared for debugging the chip. For this reason, I had to debug this part "offline", that is, make pieces of program, record them on the chip and run the program, without having the debugger connected.

○ Sending commands. I had to create a special SW function to be able to send the commands to the chip. You have to call the function, telling it the following values:

     ■ Command value

     ■ Voice Group Value (If applicable. If not, send a 0)

     ■ Command length (1 or 2)

 

Once everything was set up separately, I puy the pieces of the puzzle together. To do this, as you can't use an operating system, I set up a "scheduler", that is, in the main loop of the program you call all the functions that have to do something sequentially and then you wait in a deadlock until the defined time cycle passes, to start again.

 

Concept diagram

 

1. Function 1

2. Function 2

3. Function 3

4. Function ...

5. Function n

6. Wait for time stamp

7. Jump to 1

 

In my case, I've done a 7.5ms cycle, enough for everything to run and for there to be enough time between one loop and another for the speed needle to increase by one step.

 

The SW functions are:

 

1. doors(): Door switch management. Checks the position of the switch and sends a message to the sound function to indicate whether it should play the door open or close

2. gauge_pressure(): Management of the brake pressure indicator Depending on the position of the brake handle, it puts the indicator in the right position.

3. gauge_speed(): Managing the brake pressure indicator. According to the reading of the PWM Duty Cycle value (according to the direction), it places the indicator in the right position.

4. fsm_analog_manager(): Manages analogue readings. They are launched sequentially, 1 in each execution of the program loop. There are 5 analogue readings so a particular value is updated every 37,5ms. This is done because every time you change the analogue channel, a time is needed for the chip to make the new reading correctly, without collisions with the previous reading.

5. mascon(): Management of the MASter CONtroller or accelerator. The position of the actuator is read and the PWM DUTY CYCLE value is increased step by step, at controlled time intervals, in order to simulate progressive acceleration. As it works in real trains, when you release it, it maintains the speed and it is by means of the brake that it decelerates. The MASCON only works if the brake is not applied.

In this function the direction selector is also read.

6. brake(): Brake management The position of the actuator is read and the DUTY CYCLE value of the PWM is decreased step by step, at controlled time intervals in order to simulate a progressive deceleration. Depending on whether there is more or less pressure on the brake, the decrease of the PWM DC is faster or slower. The brake only works if the MASCON is not activated. 

7. sound(): Sound management. This is perhaps the most complicated function, as all sounds must be managed, depending on the state the train is in (stopped, accelerating, decelerating...), and depending on the analogue readings and the positions of the system's actuators.

a.         When it is stopped, the horn, door opening and closing, and brake sound work

b.         When you accelerate, the forward sound and the horn work in preference

c.         When decelerating, the forward sound works until you reach a speed where you can switch to the deceleration sound. The horn sounds with preference.

 

This is the whole process of repairing the device. I would say that it took me longer to understand how everything works than to make the software. As I said before, I need to make the software robust, but the basic functionality is already assured.

 

Conclusion

 

When I changed the microcontroller, some of the pcb tracks were broken. When they solder the SMD components with a machine, they add a glue so that the component does not move until it passes through the welding oven. It was so strongly stuck, so I had to make a lot of pressure to release it and some copper tracks were lifted. I had to repair it by putting wires to replace the tracks.

The same happened with the Power Driver. I had to break it in order to unsolder it and change it, but at least, in this case, I didn't break any copper track, changing a little the technique I used for the microcontroller. You have to learn 🙂

 

I am happy. I have turned an "expensive decorative object" into something functional and I have enjoyed and suffered in equal parts. The satisfaction is, if possible, greater. I hope you liked the explanation. If you have any questions, I will try to answer them.

 

This is the setup I used to program the device:

 

 

And finally this is a video of the System running.

 

 

Thanks for reading

Edited November 7, 2020 by lluisgib

[Glad Pingvin]

Great informative write up, nice to see a "hockey puck" being used, I bought one at work years ago for a project and the project ended up being cancelled so it's still in its original packaging in a drawer in my desk 🤣

[brill27mcb]

This is really great info. Thanks!

 

I spotted one of these control systems on Yahoo Japan Auction; someone had added an amplifier to it, in order to overcome the power limitation of the PIC controller. (I don't really understand what I am talking about here ...) 😳

 

Rich K.

[NX:]

8 hours ago, lluisgib said:

Conclusion

 

When I changed the microcontroller, some of the pcb tracks were broken. When they solder the SMD components with a machine, they add a glue so that the component does not move until it passes through the welding oven. It was so strongly stuck, so I had to make a lot of pressure to release it and some copper tracks were lifted. I had to repair it by putting wires to replace the tracks.

The same happened with the Power Driver. I had to break it in order to unsolder it and change it, but at least, in this case, I didn't break any copper track, changing a little the technique I used for the microcontroller. You have to learn 🙂

 

I am happy. I have turned an "expensive decorative object" into something functional and I have enjoyed and suffered in equal parts. The satisfaction is, if possible, greater. I hope you liked the explanation. If you have any questions, I will try to answer them.

 

This is the setup I used to program the device:

And finally this is a video of the System running.

Thanks for reading

 

You went full on! Very interesting.

I will be reading carefully the information later on, I am just passing by now.

 

To mention, I have the same controller and mine also didnt work well when it arrived (not remember the problem at the moment)

I was planning to make an investigation but before that, I just carefully cleaned and scrubbed pretty much the whole board and contacts.

Then, the controller started working. I haven't tried that controller in long time, since its amp are low.

 

I will give my controller a try to see if it is still ok.

 

Cheers,

[Madsing]

Very impressive piece of reverse engineering!

[NX:]

Testing my controller after a long time... and the selector of direction is not working... hahaha...

As I mentioned it before, I do not use this controller much so I think I will open it later to clean it up again to see if that will help.

 

 

@lluisgib - Btw, have you think to make upgrades to your controller? Something like adding sounds effects for other trains?

 

Cheers,

[lluisgib]

On 11/28/2020 at 12:10 PM, NX: said:

 

@lluisgib - Btw, have you think to make upgrades to your controller? Something like adding sounds effects for other trains?

 

Cheers,

 

I see that you have the new version. I'm now after one of them to investigate it.

 

It's difficult to add new train sounds, because the sound board uses a very specific IC, thet can only be saved one time. This IC is discontinued and it requires a specific HW and SW to program it. I also should have to clone the PCB, so I don't think I can upgrade it.

 

But I'll think about other types of upgrades.

[brill27mcb]

I did not realize that there were two versions. Can someone elaborate on this?

 

Rich K.

[lluisgib]

 

On 12/5/2020 at 12:43 AM, brill27mcb said:

I did not realize that there were two versions. Can someone elaborate on this?

 

Rich K.

I'm not sure because I don't have the newer version. The main differences I can see are:

 

- Newer version has the MASCON, Brake and Indicators in a single body

- Newer version has a potentiometer. I guess this is because the Back EMF did not worl properly. Instead of trying to detect when the motor should start, they added this potentiometer to adjust the threshold.

- Newer version has improved SW features, like the enable/disable of the Doors light, and sound features.

 

Hope to be able one day to buy it and compare both versions.

[NX:]

On 12/14/2020 at 11:57 PM, lluisgib said:

 

I'm not sure because I don't have the newer version. The main differences I can see are:

 

- Newer version has the MASCON, Brake and Indicators in a single body

- Newer version has a potentiometer. I guess this is because the Back EMF did not worl properly. Instead of trying to detect when the motor should start, they added this potentiometer to adjust the threshold.

- Newer version has improved SW features, like the enable/disable of the Doors light, and sound features.

 

Hope to be able one day to buy it and compare both versions.

 

Yes, there are two versions... and both coudl come with problems... hahaha...

Anyway, it is good that Tomix/Tomytec controllers spice up the hobby.