Ranco ETC-211000 uses AVR Atmega16L8

The Ranco ETC-211000 uses an Atmega16L8. The chip is initially protected so if you want to develop some code you will have to erase the chip first. The design is terrible, quit possible the worst i’ve ever seen in my reverse engineering time.  Mind you i have 20+ years experience. First of all there is a problem in the power supply in which voltage spikes can damage the onchip EEPROM, FLASH, and SRAM. They(Ranco, the engineer, the new guy) made their own RC-DAC from what i believe to a bit banged solution. The DAC is fed back into the analog comparator which then forms a ADC (most likely a staircase or SAR type). The lcd screen has 4 annunciators with 2 and 3/4 digits. At the time of this writing it is belived to be a static screen with a single common. 1/3 duty cycle seems to work fine. For more information on LCD screens check out Pacific Display Devices. Here is a rough-draft of the pinouts of the screen.

Pretty crappy, i know. I need to figure some things out in terms of conveying information easily. You’re going to have to deal with the crappiness for now.  Next I’ll move on to the rough-draft-partial schematic. This is basically a cheat sheet, i never build complete schematics(why should i?).

A word of caution here. When i reverse engineer i’m pretty much brainstorming. All schematics should be though of as a “diagram”. What i mean is that i don’t take time to make sure capacitors are polarized properly unless the circuit configuration requires special attention in such an area. I do however try to keep diodes, transistors, and IC’s good and proper. I was contracted to provide a repair solution for numerous ETC controllers which display error codes. My fix will be new MCU with custom firmware. I will attempt to emulate the original firmware to the best of my knowledge as well as add features the OEM did not provide.

Here i am testing the ISP interface. There are no modifications needed in order to program the chip. Sometimes the circuit sources or loads the ISP pins (Reset, Miso,Mosi,Sck) but not this time. This is pretty strait forward. Just clip and go.

Here is the setup i used to reverse the pinouts of the lcd. Brute force at its best. I started wiggling each pin and noting the segments. This may sound like a long drawn out process,  but it’s not so bad. Between BS’in with friends online, randon link hopping, and reading/sending email i managed to reverse the screen in about 4 hours.

The above picture is my cheat sheet. The color codes are my own standard for avr ISP cables, this saves a few seconds when testing / upgrading / repairing these controllers. This is just a quick demo of the firmware. The segments rolling around indicate the controller is waiting for a mode number. The firmware emualates ranco’s firmware and also adds features like timed stages, equipment wear leveling, etc. [ Sat Oct 22 2011] I was having difficulty registering a project on the Savannah nongnu project host. Apparently I had register a user name back in 2009. I had no idea what the name was not able to find anything that would give me a user name via email. After guessing for a while I finally figured out what my old user name was. Before I upload the project files I intend to make sure they actually work. Maybe I’m old school, but i expect a project to cleanly build, and , oh I don’t know.. maybe even work as-is. So before I upload the project files and give a link I intend to at least test the project on real hardware.

 

 

 

 

 

 

 

 

As you can see from the picture above, I have a few broken ETC-211000 controllers. The metal box with the Atmel sticker is where i keep all the AVR related development tools. On top of the box there are two ETC control board. One is missing the screen and MCU, this was the original controller which i reverse engineered. The second controller still has a Screen, MCU, and temperature probe attached. This board is used for testing firmware. Now that I have the hardware in front of me I’ll try to test the basics. Does the board still work? Can I program the chip with my GPL’d project as-is.  Does the firmware even work after getting beat around so much? So, wordpress competently mangled the formatting of the blog. I never touched any of the above images but it knew best i suppose. This brings all the great memories of how great WYSIWY dont get editors really are. I’m not fixing the format now as I have better things to do such as test some code and get all this hardware put back in my lab instead of my living room floor.

[Sat Oct 22 23:14:57 2011] The project cleanly builds and programs the device. Basic functionality seems to be ok. Here is the output of make.

# make avr-gcc etc-211000/interupts.c etc-211000/functions.c etc-211000/lcd.c etc-211000/init.c -mmcu=atmega16 -Wall -gdwarf-2 -Os -std=gnu99 -funsigned-char -funsigned-bitfields -fpack-struct -fshort-enums -MD -MP -MT main.o -MF dep/main.o.d -c etc-211000/main.c avr-gcc -mmcu=atmega16 -Wl,-Map=main.map main.o interupts.o functions.o lcd.o init.o -o main.elf avr-objcopy -O ihex -R .eeprom -R .fuse -R .lock -R .signature main.elf main.hex avr-objcopy -j .eeprom –set-section-flags=.eeprom=”alloc,load” –change-section-lma .eeprom=0 –no-change-warnings -O ihex main.elf main.eep || exit 0 avr-objdump -h -S main.elf > main.lss ***** Preliminary Summary ***** text data bss dec hex filename 16 0 0 16 10 main.o 294 0 0 294 126 interupts.o 540 1 1 542 21e functions.o 770 0 1 771 303 lcd.o 82 0 0 82 52 init.o ***** Total Project Cost ***** text data bss dec hex filename 1876 2 11 1889 761 main.elf

Everything is probably as you would expect.  Pertinent make args are:

  • clean (this removes all the files that make produces)
  • all (this builds everything)
  • flash (this will program the device)
  • nuke (this will erase the device)

As a more formal recapitulation, To clean the project, which is suggested prior to building,  use “make clean”. To build the project, which should be done after cleaning, use “make all”. The program the device, which should be done after building, use “make flash”. To nuke the chip, use “make nuke”. Technically we don’t need nuke. But it’s fun to have anyway. Also, experience has taught me to use nuke even though the programming theories claim otherwise. Since everything seems to be in order I tar’ed up the project and submitted it to Savannah project hosting. Hopefully the GPL licensing is in order and it is accepted.

[Tues  Oct 25 24:34:57 2011]

No confirmation, denial, or communication otherwise from the savannah people. They have a note that it may take a few weeks for the project status to be updated. While looking around for hints I noticed that the file I had uploaded was available to the public, provided you know the address. I did not see any notes that /I/ should not share this file while it is in lingo (admittedly, I did not study the guidelines in as much detail as I probably should have).  So unless I’m told otherwise, here is the link to the Tarball URL:

http://savannah.gnu.org/submissions_uploads/open-etc-211000.tar.gz

Since there are no official methods of communication regarding this project I will use this space to make a few statements or disclaimers, or whatever you want to call it.

This particular upload has already changed a great deal. I’ve added more lcd support functions, cleaned up some code, added comments, etc.  DO NOT BASE ANY WORK ON THIS BASE PROJECT! download it, build it, break it. But do not count on future versions being backward compatible.  You have been warned, otherwise happy hacking 😉

 

Advertisements

Tags: , , , , , ,

35 Responses to “Ranco ETC-211000 uses AVR Atmega16L8”

  1. Brian Says:

    Hi, I’ve got one of these ‘shot’ Ranco controllers. It displays E2 when the setpoint is less than around 52F. I’m curious if there’s any hope of repairing this thing or is it just shot.

    Thanks,
    Brian

  2. iteration69 Says:

    Yes it is possible to repair these Ranco controllers. The firmware project is still active (semi-hiatus). Error codes are a VERY common problem with this controller. You may replace the controller and the next day the error code appears or it may last forever.

    The controllers that i work on are used in geothermal HSS flow centers from B & D Mfg. I believe that a power spike/droop/outage and a compressor event combine to form the required waveform which damages this controller. This is a hardware design flaw in the controller itself, but bad power regulation / filtering can increase the chances of failure.

    The repair is quite simple. Replace the avr microcontroller, program it, and move a component. I hope to have a beta /testing/ version of the firmware within a week.

  3. stephanie Says:

    Hi. Would this also work for the Ranco ETC 11000? Is your version of the firmware available? Thanks in advance, Stephanie

  4. PJ Says:

    I’m also really interested in this project and would love to hear any updates (as well as see the firmware, if that’s possible).

  5. iteration69 Says:

    I’ve not worked on this project in well over a year. If i recall correctly, i was in the process of implementing equipment load balancing just before the project was pushed to the back burner.

    Between working, family, and home maintenance I don’t even have enough time to document my projects. But I am trying.

    I’ve decided to GPL all my projects, though it’s a slow process one day I’ll be able to properly share my projects with the community.

    I’m sure i can dig up the code (not sure if it ever made in into version control) and throw a GPL license along with it, if anyone is really that interested in it.

    • PJ Says:

      Thanks for the reply! I hear you on the list of priorities, but hope you can squeeze in some time to put up whatever you can still find for this. I know at least 1 person who is definitely interested! I’d like to talk about what I’m trying to do if you have time to shoot me an email. Otherwise I’ll settle for the code 🙂 Cheers

  6. iteration69 Says:

    You can contact via gmail. same user name.

    I use to write everything in assembly language but as time went on it began to learn that i no longer had the amount of free time i once did. Though assembler has a special place in my heart, I’ve embraced C and began to port all my existing work from assembler to C. The C source to this project is in rough shape, It’s enough to give you a kick start but it is no where near as functional as the asm code base.

    Sharing my assembly code is not an option, i’m goofy like that about asm. But i have no problems sharing C.

    There are several files in the project, so i can simply throw a GPL in the files and tar em up. I don’t have an official public repo yet, so email may be the best short term solution. Though i’d like everyone to have access to the code, if for nothing more than to save some time hacking.

  7. Collin Says:

    I also have the same ETC-211000 controller with the E2 error. I am very disappointed that a supposedly industrial grade controller would have these issues. I use the two stage controller to operate a 1KW chiller and 800W heater for our reef tank.
    I called Ranco and got the same line about having to replace the entire controller because the main chip was bad, so I am glad to see that some have decided to look into a fix for this prevalent issue. I also have an Arduino Duemilanova that I have been playing around with. I assume the chip on this controller is just a simpler version of the Atmega328 I would imagine, so is there a interface board out there to program it like the 328 or is it best to just program it on a breadboard and then reinstall to the Ranco board?
    I would also like a copy of your C code if that is OK. Is it the same C code language used to program the 328? I will email you at the Gmail address for that as you had instructed the earlier post.

    Thanks in advance

  8. iteration69 Says:

    I see it has been well over a year since this project was pushed to the side but it looks like there may be enough interest to bring it back to life.

    I need to look for some old notes regarding the initial problem in these controllers. There is a component which directs voltage spikes directly in to the low voltage circuit which is ultimately what damages the microcontroller.

    I enjoy reverse engineering as it sheds light in all directions, providing subtle details about overall skill of the team. In this case, something went terribly wrong in the design phase of this controller. This is especially obvious in the power supply filter section. A good design will attempt to shunt high frequency signals away from sensitive cmos devices. In this design, the correct components were selected but in stead of shunting the damaging high frequency signals away from the microcontroller, the circuit actually directs it all in to the low voltage circuit! I consider this to be an elementary filter design mistake.

    Hence, this problem needs addressed before replacing the microcontroller. Otherwise the same problem will keep occurring. Fortunately it is rather easy to correct this design mistake. It’s just a matter of moving a component, if you can remove the microcontroller you can easily move a single component to correct the power filtering.

    I’ve not compared the hardware differences between the 16L8 and other 40 pin variants. If the adc and timer pins do not change between chips, it’s probably ok to use a more readily available part.

  9. Collin Says:

    I just thought I would let everyone know that I placed an order on ebay for an Atmel Atmega16L8-PU. The lat two letters are very important. P=(40 pin DIP ie..Through Hole) and the U=(ROHS Compliance ie… No Lead). Make sure when you order a new chip that you specify Atmega16L8-Px and not a -Mx or -Ax, as these are both 44 pin surface mount chips.
    See the follow spec sheet.
    http://www.atmel.com/dyn/resources/prod_documents/doc2466.pdf

  10. Collin Says:

    Also, although Atmel’s website does have a form to request free samples, I have never been successful in receiving anything. I have read that this is others experience as well, however some have had success with their local reps though. I am not sure if there are any other companies that manufacture the same chip with an alternate part number or not, but I know some of the other companies like Maxim have been much more willing to provide samples.

    If anyone is interested I found this list of companies that provide samples.
    http://www.dutchforce.com/~eforum/index.php?showtopic=13348

  11. PJ Says:

    Awesome that this has been resurrected and I’m happy to have helped nudge it a long! Looking forward to ‘upgrading’ my Ranco (assuming I can get beyond breaking it).

    The pamphlet that came with my ETC had some resistance vs. temperature values that may be helpful. It says that these are for part #1309007-044 (the included thermocouple with 8′ cable).

    Deg C, Deg F, RES.Nom
    -40,-40,1010000
    -30,-22,531000
    -20,-4,291200
    -10,14,166000
    0,32,97960
    10,50,59700
    20,68,37470
    25,77,30000
    30,86,24170
    40,104,15980
    50,122,10810
    60,140,7464
    70,158,5200
    80,176,3774
    90,194,2753
    100,212,2036
    110,230,1531

  12. Collin Says:

    Iteration69,
    Thank you for posting the code. I look forward to trying it out. Is it in a working state currently? Could it be used, if uploaded to a new MCU on the factory board?

    Also, have you posted the circuit design change that needs to be made in order to keep the voltage spikes from killing the MCU? Would this fix require creating a new board?

  13. Collin Says:

    Iteration69,
    Do you have any suggestions for programers to use or did you just build your own?
    I was looking at the Atmel AVR Dragon which does programing and debugging. Is it woth the $49?

  14. iteration69 Says:

    I’ve not posted the fix yet, in fact i never even bothered to make a schematic representing the fix because it’s so simple. Just a matter of changing the circuit to a capacitor. I’ll look the circuit over and find the capacitor that needs attention.

    As far as a programmer & debugger…

    For programming i use avr isp mkii. I have several of these programmers, probably half a dozen if not more. I tend to work on a lot of AVR projects and can’t be bother to share a programmer between boards. The neat thing with the avr isp mkii is that each programmer has a unique serial number and you can specify that serial number when programming(so as to have several attached at any time and they all work properly). This is my preference, You may use whatever you want. Make your own, use an arduino, or use one of atmels development tools. I don’t have any experience with the other programming options and can’t really help there.

    As for debugging.. I’ve never been able to reliable debug any embedded projects using jtag or the like. Mind you, i don’t stumble over trivial issues so my view on debugging is likely to be very different from someone who has not cut their teeth with embedded. For example, the IO can debug any typical pot hole you may encounter.

    I’ve learned that real time problems are nearly impossible to debug with brain dead debuggers. What i mean by a brain dead debugging is any hardware that manipulates the rate monotonicity of the host device. Which pretty much covers everything sold as a “debugger”. If you have a real time problem and change the time domain of the device, you will never be able to “see” the problem, because the time domain has been altered.. However, if you have access to a plethora of electronic instrumentation then you can see a problem in real time, or at least artifacts of a problem.

    The code for this project uses an irq to fire the lcd driver, which uses a register backed buffering of states. This runs in real time, should you use a conventional debugger you will notice right away that the screen no longer works properly, and thus will fully appreciate my statements about brain dead debuggers. 😉

    About the condition of the code. It is /usable/ in the most loosest possible definition imaginable. You should be able to program a chip and see something happen. There is not much of a UI in the initial version. I’ve written several support functions and cleaned up a great deal of the code for the next version, or whatever we want to call it being the project has not been accepted yet, nor have i heard anything back from the folks hosting it.

  15. Collin Says:

    Thank you for the great information.

    If you have a chance, take a look at this video about the AVR Dragon. seems pretty cool. Works with Atmel AVR Studio 4&5

    “If you have a real time problem and change the time domain of the device, you will never be able to “see” the problem, because the time domain has been altered..”

    We just need to bring Brent Spiner in to look at the problem….. 😉
    ———
    “It is /usable/ in the most loosest possible definition imaginable.”

    The reason I ask, is that I rely on the controller for our reef tank temperature regulation; turning on a chiller or a heater depending on the need. It works as it is now, unless the power is lost and then I get the E2 error and have to set the time again. This is highly problematic, as I might not notice there is an issue until my “fishy friends” start having issues. 😦
    ———-

  16. iteration69 Says:

    You should be able to use the dragon. I’ve not used avr studio in several years, never cared much for that sort of thing so i can’t advise one way or anything as to how you would use avr studio or any other ide for that matter. When i use to use windows(damn i feel dirty for saying that) I used programmers notepad in combination with the win-avr package. I had problems with avrdude on windows and used atmels stk500.exe program. I despised avr studio to the point that I forced myself to figure out how to remove the drivers, and use stk500.exe in a minimalist manor in order to run things standalone from a flash drive(think: field work). Here is the old write up I did about it.
    http://www.shol.com/shadow_tech/nostudio.html

    The current version that is available for download, which i had branded to be “ /usable/ in the most loosest possible definition imaginable.” won’t meet your needs. It doesn’t even have a working adc routine. Basically it will initialize the screen, show a run indicator, and allow you to enter the precursor of a setup mod. The next version is much closer to usable in that it has better support functions for the screen, but it still does not have decent adc handling, nor a steinhart&hart implementation. These are trivial problems and will be addressed when i get an official project notification.

  17. iteration69 Says:

    It appears that the savannah folks have not check my project yet. This is letting me down a bit as i always considered savannah to be a better host than sourceforge. But i don’t get a reply soon I’ll register with someone else.

  18. PJ Says:

    Any word on the project?? I didn’t have any luck using an Arduino Uno I had around, so I’ve ordered a USB ISP that should be here tomorrow.

  19. iteration69 Says:

    PJ,

    That’s exactly what i’m wondering.
    “Fri 04 Nov 2011 03:39:13 AM GMT, comment #1:
    Wondering what’s going on with this project.”

    No one has replied. It’s as if they are ignoring the project. This is really agitating. I guess I’ll have distribute the source manually through email or something.

    My bigger concern is all the code that i’m GPL’ing. How can i even give my work away if the free software guys wont even reply to a project. To make things worse, i read about a guy who tried to give his program away and could not. A program called Baudline, it’s a LF spectrum analyzer for linux. I suppose most people use it for SETI or audio analysis. He tried to give it to major linux distro and they told him it was not very useful.

    Here’s my rant. Not very useful!? The program saved me several thousand dollars because i do not have to get another LF spectrum analyzer! Not very useful huh!!. But yet they openly invite stupid programs that generate leet speak. So he ended up making it closed source, people have to pay for the GPL copy now. If this is how the free software hosting folks want to play it, That’s how my code will be. 100% GPL, and if someone needs a copy they have to buy it.

    This is crazy. I’d never thought it would be this difficult to give something away.

    Ugh.

  20. iteration69 Says:

    Here is a link to the submission and comments.
    http://lists.gnu.org/archive/html/savannah-register-public/2011-11/msg00007.html

  21. iteration69 Says:

    I just received a reply from someone at savannah. It turns out they are swamped with project submissions and need more volunteers. Since i had asked they are going to review my project submittal. ** Hopefully it passes **

  22. iteration69 Says:

    My project was reviewed but It did not pass, I made some trivial mistakes.

    I used open in my name, which is against policy. I understand and agree with the policy, open should not be used because it confused people as to what their rights on in regard to the software. People need to know they are using “Free software”.

    Somehow I attached the wrong verbatim license, I have agpl.txt where i should have gpl.txt. I’m going to re-read all the license statements to make sure i didn’t goof something up there as well.(Really not sure how I grabbed the wrong license…)

    Lastly, a small mistake was made in regard to license completeness. I had included the generated files of the project so that new comers could simply grab and flash without fear of breaking any of the virgin code. These generated files also need to be covered by a license as derivatives. So I’ll add a README that attempts to blanket them with a nice cozy GPL.

    With any luck, the project will be up soon. Keep an eye out here for details.

    • Collin Says:

      I had no idea that there was so much involved in putting something out there as GPL. I am sorry you are having so many problems with the process, that is disheartening. I agree It’s pretty bad you have to jump through all the legal stuff to ensure you are given credit for your own work. I hope things come around for you, I know it is frustrating. I am pretty exited however, since the idea of fixing our controller has spurred me to move beyond arduino to AVR and get an emulator/programer to play with. 😉

  23. PJ Says:

    Hey, looks like I missed a lot of drama but some good progress has been made! I guess it says something positive about these repositories that they’re such sticklers – that’s one reason I prefer using them for software; at least I know it’s been vetted.

    I’m getting my ISP today, so will be uploading what I’ve got just to see if I can, and then will start digging into the code (naturally I’d prefer to do that with the latest, so here’s to the understaffed Savannah folks!).

  24. iteration69 Says:

    The project has been approved. Now I need to double check the licensing stance of my latest changes and then test that the code cleanly builds and functions on the controller. I will then tar the project files and upload to savannah.

    I need to figure out how savannah works on the project side. I suppose that version control will need to be set up etc,etc,etc.

  25. Collin Says:

    Great News!!

  26. iteration69 Says:

    I prefer subversion over cvs so that’s the route i plan to take for version control.

    The svn http access is at:
    http://svn.savannah.nongnu.org/viewvc/?root=free-etc-211000

    There is nothing there yet.. still working on a few things.

  27. PJ Says:

    I managed to flash my Ranco with an early version! No turning back 🙂

  28. iteration69 Says:

    Great to hear. I’m still hashing out how to manage my project. I managed to get a mailing list, and some other things worked out.

    Here is the base project url:
    https://savannah.nongnu.org/projects/free-etc-211000

    I suppose we should give the mailing list a try while I’m figuring out this management stuff.

    Go ahead and sign up here:
    https://lists.nongnu.org/mailman/listinfo/free-etc-211000-list

    With any luck i have it all set up correctly and it will simply work.. *fingers crossed*

    If the mailing list works i guess it’s the end of the road for this blog 🙂

  29. iteration69 Says:

    Project is at revision 1.

    To check out it out:
    svn co svn://svn.savannah.nongnu.org/free-etc-211000/

    Be sure to look at README.txt before you do anything

  30. Michael C Says:

    Hey,

    I’ve been trying to help PJ out with this a bit (I have a lot more programming experience). I tried out/flashed your latest code and I’m impressed with your reverse engineering on the display. I’ll be glad to contribute, but the A-D is a bit beyond me though– So definitely after you crack that nut!

    Looking forward to your progress

    mike

  31. iteration69 Says:

    Mike,

    Sign up on the mailing list with my project at savannah.
    https://lists.nongnu.org/mailman/listinfo/free-etc-211000-list

    I guess i’ll start on the adc soon. But try to use savannah’s resources if possible so that everything is centralized for new folks. (kinda pita bouncing from two places for information)

    And as far as the screen and reversing, it’s not perfect(youll notice a small twitch every now and then, it will be fixed when i finally get tired of knowing its there) anyway that screen was cake walk compared to what i consider a challenge. But it’s good to know it’s appreciated 🙂
    thanks

  32. Collin Says:

    Iteration69,
    Did you ever get your code finished for this? It seems they still have this defect and still refuse to own up to a faulty design.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


%d bloggers like this: