Just recently, I built an AT89S52-based LED Heart and an LED Clock Kit, so I wondered just what else is out there that is AT89S52-based. Searching around on eBay led me to a “shake stick” kit for AU$4.37. It looked rather primitive and simple compared to the other kits, but I thought I might as well give it a go anyway. After all, cheap kits with no documentation are a great way to challenge the hands and mind, and spend an evening.
This is yet another kit packed in a thin zip-lock plastic bag with little padding and no care for ESD safety whatsoever.
The long “wand shaped” shake stick PCB is a blue-coloured double-sided PCB with silkscreening on one side, and soldermask on both. The pads have a tin-plated finish, and the silkscreen provides guidance on component values. Unusually, unused pins on the microcontroller have no donut pad at all – this arrangement is not that usual, as pads are often provided but not-connected to ensure mechanical support and provide better looks. The pads are not all optimized for hand-soldering because of the lack of thermal-bridges, however, the weight of the copper isn’t too high, so it’s not likely to pose great difficulty in soldering.
The rest of the components are in a second zip-lock bag. We can see that an IC-socket is supplied, as the same “trick” of under-socket component mounting is utilized in this design.
There really are not a lot of components to this one – four resistors, a diode, three capacitors, 17 LEDs, a 40-pin IC, a crystal, two switches, a shake sensor, a battery holder with screws/nuts and an ISP header.
The chip legs were relatively intact, although the underside of the chip looks like it may have been scrubbed or washed with something. I’m not sure, but maybe these guys have a source of AT89S52’s that are recycled?
Of note is that no instructions or documentation is provided, and the kit maker is anonymous. All the components are through-hole, which means easy construction. This kit is pretty much suitable for beginners, but the microcontroller-based nature doesn’t really teach them much. It’s good soldering practice though. Lets quickly calculate the number of solder joints that the kit will require:
IC = 31 (as unused pads are not on the PCB) Xtal = 2 C = 6 R = 8 D = 2 LED = 34 SW = 9 ISP Header = 10 Battery Holder = 2 Shake Switch = 2 Total = 106 solder joints
Construction and Testing
Construction is pretty straightforward, and the kit takes about 30-45 minutes to construct. As usual, you must supply your own solder, soldering iron, screwdriver, pliers and two AAA batteries. During construction, it was found that the ISP header was a tight fit, as the drill holes were a bit small compared to the pins. The header itself isn’t particularly useful unless you have the correct programmer and connection cable for it. There are pads for a serial console, however, the header pins are not provided. I suspect the microcontroller is not programmed for use with the serial input. The shake sensor has a “dual footprint”, and only one of the two footprints will be populated. Holes are provided to feed through the battery holder leads and solder them down (clipped to length for neatness), and screws are provided to hold the battery holder in place. In all, the exact number of required components was supplied – no more, no less, and the design is relatively neat despite not having any casing.
This is the kit completed, but just missing the IC.
This is the kit with the IC inserted. From there, testing is as simple as inserting two AAA batteries and sliding the switch to on. The leftmost LED should be lit, indicating power is on. Shaking the stick should trip the shake switch and result in graphics being visible through persistence of vision. If you see this, then congratulations – you’ve completed the kit. Pressing the push-button will allow you to toggle through four different modes of pre-set graphics.
Because of the crudeness of the circuit, I didn’t bother to draw a schematic for it. Instead, I’ll just mention some of the important design points.
Incoming power is routed through the slide switch, and this is then directly applied to chip and the last LED. The diode in the design is not used for reverse polarity protection, but instead is used to add voltage drop to the common positive rail amongst the remaining 16 LEDs that form the graphics. The power indicator LED uses a 1.5k resistor for current limiting. I suppose that you can ignore fitting this last LED and 1.5k resistor as it doesn’t have much use but to consume energy and cause a red “stripe” to show on any long-exposure photos. The other 1.5k resistor is used to hold the reset line of the microcontroller at a valid value. The two 10k resistors used both are used as pull-up resistors for the push button/shake switch. The ISP pins and serial pins are connected to the microcontroller for programming and debugging purposes.
The microcontroller is mounted in a socket, so that the components that support it can be mounted underneath including the 10uF bypass capacitor, 12Mhz crystal with two 22uF loads to ground. The remainder of the pins are used to drive the cathodes of the 16-LEDs directly. This arrangement has no explicit current limiting, so it relies on two facts to establish a “safe” level – namely that the microcontroller pin voltage would not be exactly zero volts at low if passing any decent level of current due to its internal resistance, and the fact that with the 1N4007 diode adding voltage drop from the 3V input cells, if the current was to reach a high-ish level, the 1N4007 would drop an additional 0.5-1V, and given the LEDs only reach their full 20mA current at about 1.8V, this all “works out conveniently”. I suspect the 16-LEDs are connected to sequentially numbered bits on two of the four ports on the AT89S52 which would ease programming requirements.
Nine pins on the AT89S52 remain unused, but this may just be because it was designed to use two-ports (8-bits each) for data-handling simplicity and reduce the cost/complexity of the kit. Maybe a third port could be used to add another eight LEDs as per the LED Heart design, but this might also mean that the total current limitations need to be more carefully adhered to.
The shake switch itself is a fairly simple device, consisting of a spring and a “contact”. When shaken, the spring deforms and touches the contact, closing the circuit and starting off the procedure that “blurts” out the LED light pattern.
Dumping the Chip
Just like the other AT89S52-based projects, the chip had no protection whatsoever, so its contents could be dumped directly. The image of the memory is here. The code appears to utilize just 1354 bytes of 8192 bytes available (16.6% usage), so they could have used a smaller chip or put in more modes or a better program in the first place.
A quick load of the program in IDA Pro gives a rather interesting code blob. I’m not an expert, but it seems there are clear portions of the code that handle switch inputs, resulting in loop-to-self polling it seems (e.g. code_508). There is the main part after booting which it always returns to (code_350), whereas code_377 appears to have looped increments which suggests to me that it may be “spitting out” the graphics two-bytes at a time. I’m not particularly great at this, so instead, I decided to do some other analysis.
I wanted to show images of what the stick shows when shaken, but this is relatively hard to capture. Instead, I decided to go looking in the ROM for these images. Using a method (convert8) I used with VGA BIOSes allowed me to do this (with the injection of 8-bytes null padding at the beginning).
There is a little bit of “junk data” at the beginning, but the drawn images are clearly seen. These images are actually 64 px wide per frame, by 16 px (bits) high.
The image data starts at byte 6, and is Mode 2, Mode 3 and Mode 4. Mode 1 (default after time-out or fresh boot) cycles between the latter three Chinese graphic frames. Without even being able to understand the rest of the 8051 code, it should be possible to overwrite these graphic frames and get new graphics to show. The total graphic size is 768 bytes, or about 56.7% of the ROM size.
Unfortunately, to reprogram the chip requires either an ISP programmer, or a parallel programmer like the MiniPro TL866CS which is not inexpensive when compared to the cost of the kit.
LED Drive Output
I wanted to better understand what the output to the LED looks like. Excuse the random probing resulting in the random voltages, however, it seems that a line is spit-out in about 80ms (in this case, row 3 of mode 1).
Each pixel is hence about 1.25ms of time. Due to capacitance, it seems that my measurement was slightly off.
This is a relatively simple kit to construct, as it uses only through-hole components and has only a limited number of components to mount. Its silkscreen was mostly clear, and the board quality was good although not always optimized for hand-soldering. The kit is inexpensive, and comes with exactly the right number of components, but is not particularly “useful” as supplied and is maybe a little boring. It’s more of a novelty, and one that really needs a bit of reprogramming to customize it although the equipment required to do so is rather costly by comparison.