XP deus coil damaged by salt water

[Lavabo]

Hi all


My XP Deus coil got damaged by salt water last week. There was a crack in the transparent resin and salt water filled the area!!

By the time i get it back home, its seems too late, corrosion made some damage, i was on vacation in Florida and i wanted to use it on beach.
Then i opened the coil, i washed it with tap water. Im sure i void the warranty by doing so, but since i was on vacation for a week... i wanted it to WORK!!

Back home to canada, i washed the PCB with 88% alcool then Deoxit, but still does not work. Led flashed but died

My version is PCB 3.1, its a bit different it have a connector for the battery. There is 6 pins, and im trying to find the ones for the battery with a multimeter

Since i was manipulating the board, the 2 small wire from charge connector broke. Then i made an improvement by soldering a JST connector instead.

18650 is also a good idea!! I did not opened the battery compartement yet.

Anyway, anyone know if we can oder replacement PCB if i cant fix it?

I want to try to fix this



The new JST connector, so i can easily remoove the PCB



Close view of one side


ADA4841-2YRZ Analog Devices Operational Amplifiers



Rev 3.1


2x Relay Im41 3vdc Axicom



The 6 pin connector


The connector inside the coil



Packing it ready to test


While there, i added a led so i know my charger is properly connected and is giving current


packed with the led


Deoxit usually do the job...

[sled]

Hey, I'd go to repair shop for laptops / mobile phones which does component level repairs. They deal with liquid damage a lot and probably have a high end ultra sonic cleaner which can take care of the corrosion, just cleaning with alcohol usually does not stop the corrosion, there are too many small nooks and crannies under the chips, between solder joints etc.

Then:

- Check for shorts between power lines and ground with a multimeter
- Power it up, measure voltages on power lines to chips with a multimeter (i.e get the datasheet for the chip and locate Vcc/GND pins)
- Check current consumption
- Check signal lines with an oscilloscope

If the microcontroller is not damaged (unlikely to be damaged), it's definetely repairable.

It looks like there's a fuse on the board, which you definetly should check (the green component which I marked with a red circle in the attached picture).

May I ask whether you can do some good close up shots from the top and bottom, I'm really interested in the markings on the chips, especially those I marked with blue arrows Maybe you could tell me what's written on them if you can read it.

[Lavabo]

thank you for your reply
i will do closup of all the chips and i was also interesed in listing all the chips. Is the firmware is stored on the PIC24F ? I will check if there is an eeprom

Also, all the empty connector at left i saw after that they were for the Tx/ RX as in this picture, they are grouped in the same way as the previous pcb on the right of this picture
From top

RX+
RX-
power
power
TX+
TX-

PCB v 3.1



PCB v2.x




Then :



to be filled but i guess middle pin is power

[sled]

Cool, looking forward to know the chip markings

Yes the firmware is stored on the PIC24FJ64. The PCB in the coil does all the low level processing and sends minimal data to the remote control, almost all the magic happens in the coil.

There's one very interesting thing that could be done if you get the PCB working again, the firmware is uploaded to the coil via the remote control i.e PC --[USB]--> Remote Control --[RF link]--> Coil

The RF chip on the coil is the one marked "nRF24L01", if you attach a logic analyzer to the serial output which goes to the PIC24FJ64' you could intercept the coil's firmware which then could be used to flash a new chip, i.e we could create our own coils for DEUS.

[ivconic]

Firmware is hardcoded in offline updates.
Microchip experts could try to analyze and extract it in original form.
...
By total coincidence last couple days i was exploring details on NRF24L01.
Have 6 modules and am working on remote fuel level monitor.
So i got a bit more familiar with those chips.
Pretty obscure and "framed" chips. Yet quite decent for some roles.
Main drawback (my humble opinion) at those chips is a lack of promiscuous mode.
Otherwise it would be much easier to do some things more with them... like intercepting the communication between coil and remote unit.
...
I think the pcb with all the components here are alright despite the corrosion that appeared from moisture.
I think the firmware chip is corrupted on software level.
Almost nothing can be done at this point.
It must be sent to manufacturer on service.

[sled]

@ivconic the firmware is encrypted when downloaded from XP, there are separate firmware files for the coils, headsets, remote control. There might be a chance that the fimware is transmitted to the coil unencrypted. However I'm most interested to know what ADC is used, given the ADA4841 Pre-amp and the"C4E" marking (not sure about the last letter) on the Chip I guess it could be the AD7691 http://www.analog.com/media/en/techn...ets/AD7691.pdf, but it's a differential ADC which is strange?

Last thing, the NRF24L01 can be used in promiscuous mode, sort of, see here http://yveaux.blogspot.ch/2014/07/nr...er-part-1.html

[ivconic]

@ivconic the firmware is encrypted when downloaded from XP, there are separate firmware files for the coils, headsets, remote control. There might be a chance that the fimware is transmitted to the coil unencrypted. However I'm most interested to know what ADC is used, given the ADA4841 Pre-amp and the"C4E" marking (not sure about the last letter) on the Chip I guess it could be the AD7691 http://www.analog.com/media/en/techn...ets/AD7691.pdf, but it's a differential ADC which is strange?

Last thing, the NRF24L01 can be used in promiscuous mode, sort of, see here http://yveaux.blogspot.ch/2014/07/nr...er-part-1.html

I saw that, not tried yet though.
Too many limitations already.
This is important: "....For regular messages the length will have to be known or can be determined by testing different lengths until the CRC matches. With CRC disabled the payload size can only be guessed..."
And Deus is not having "regular messages", that's what's Alain Loube pointed me on "between the lines" , couple years ago when we exchanged few emails.
It seems they made special "protocol" with custom payloads and than passed through NRF.
Analyzing the morphology of NRF; some things around Deus becomes obvious too.
For example; the pairing between coils and remotes... among other things.

[Skippy]

I would say the green 'fuse' is actually a polyfuse, so self-resetting, and unlikely to be a problem.
If you think there's a battery-related problem, you can of course independantly charge up the battery. A trickle-charge at 50 - 100 mA until the cell voltage reaches 4.1 Volts should 90% charge it, which will be plenty for your tests/experiments.

If you make a small 'sniffer' searchcoil, you should be able to see if the transmit coil is being driven or not, as well as probing on the coil connections on the PCB.

The suggested use of an ultrasonic cleaner is also what I would recommend.

[sled]

I saw that, not tried yet though.
Too many limitations already.
This is important: "....For regular messages the length will have to be known or can be determined by testing different lengths until the CRC matches. With CRC disabled the payload size can only be guessed..."
And Deus is not having "regular messages", that's what's Alain Loube pointed me on "between the lines" , couple years ago when we exchanged few emails.
It seems they made special "protocol" with custom payloads and than passed through NRF.
Analyzing the morphology of NRF; some things around Deus becomes obvious too.
For example; the pairing between coils and remotes... among other things.

Another method would be to use a DVB-T dongle as SDR with a downconverter, then you get everything: http://blog.cyberexplorer.me/2014/01...24l01-and.html

In case of Deus, I'd just attach a logic analyzer to the NRF serial in/output and see what's transmitted

[ivconic]

Another method would be to use a DVB-T dongle as SDR with a downconverter, then you get everything: http://blog.cyberexplorer.me/2014/01...24l01-and.html

In case of Deus, I'd just attach a logic analyzer to the NRF serial in/output and see what's transmitted

That's interesting!

[Funfinder]

Another method would be to use a DVB-T dongle as SDR with a downconverter, then you get everything: http://blog.cyberexplorer.me/2014/01...24l01-and.html

In case of Deus, I'd just attach a logic analyzer to the NRF serial in/output and see what's transmitted

You can listen also to radio from 50 MHz to 2,4 GHz with the free SDRSharp software by some USB DVB-T dongle
(also when it just supports the old DVB-T 1 standard) but it should have a chipset with broad range - like the E4000.
And you might need some external antenna on the roof plus amp because those chips are not the most sensitive.


Concerning the coil I would look for a (second hand) replacement instead of wasting a lot time and effort with it!
I guess its not worth trying to fix it, especially as long as you don't know exactly where's the culprit.
If one of the micro-controller-chips got a shortcut which can happen with saltwater because some pins just need
very low currents, you can't replace it anyway.

And if it was not your fault that the coil got some crack before, I wonder what is this for a bad quality at all.
Anyway - you can use this opportunity to get some experience how to replace the LiPo battery for later times ...

[ivconic]

Another method would be to use a DVB-T dongle as SDR with a downconverter, then you get everything: http://blog.cyberexplorer.me/2014/01...24l01-and.html

In case of Deus, I'd just attach a logic analyzer to the NRF serial in/output and see what's transmitted

Coincidently a friend already had old dongle; Astrometa DVB-T2. Left and forgotten in a drawer somewhere.
So i took it today to give it a try.
Original driver&software which came with it; turns it in a completely useless piece of crap, believe me on this!
Software is awful and awfully slow! Scanning is impossible slow too!
You can't do anything about that, because it totally lacks on settings and adjustments. Total crap.
Also pretty deaf! Can't catch not even a local FM station.
So at first i was pretty disappointed.
But than i stumbled randomly on this: http://www.rtl-sdr.com/rtl-sdr-quick-start-guide/
So i gave it a try too.
Wow! SDR_Sharp with custom driver is turning it in a complete different pieces of hardware! Almost not to believe it!
Now is working like a hell! Scanning is ultra fast! Sensitivity excellent!
Adjustable RF gain!
It is catching much signals now, acting just nice!
It turns out that this is a very nice and useful piece of hardware if used with proper software.
Now it makes a lot of sense to me to obtain downconverter.

[ivconic]

[sled]

Cool! Also check out GNURadio, it allows you to connect signal processing blocks to create filters, demodulators and a lot more (http://www.rtl-sdr.com/tutorial-crea...radio-rtl-sdr/)
A fun project is to track the ADS-B signal from aircrafts: http://www.rtl-sdr.com/adsb-aircraft...-with-rtl-sdr/

[ivconic]

Cool! Also check out GNURadio, it allows you to connect signal processing blocks to create filters, demodulators and a lot more (http://www.rtl-sdr.com/tutorial-crea...radio-rtl-sdr/)
A fun project is to track the ADS-B signal from aircrafts: http://www.rtl-sdr.com/adsb-aircraft...-with-rtl-sdr/

Both links ROCKS!


Second one... a personal "flight control" !!!
...
Yup! Antennas are crucial here!
I am having "Slim Jim" for 2m, sitting on the roof for 25 years and more.
Probably with deeply oxidized junctions, must check it.
It's not been used for quite some time.
This toy will take much of my time this winter!
I am lost already!