reverse engineering lcd display factory

The current marketplace allows hobbyists to easily find inexpensive, well-documented displays, but what if you wanted to interface with something more complicated, such as the screen on an iPod Nano 6? [Mike] has given us a detailed and insightful video showing his process for reverse engineering a device with little-to-no documentation. Here he covers the initial investigation, where one scours the web in search of any available information. In [Mike’s] example, the display uses an MIPI D-PHY interface, which he has never worked with. He learns that the MIPI Alliance will provide design specs in exchange for a signed NDA (Non-Disclosure Agreement) and a modest $8000 fee. Nice.

[Mike] shows off some serious hardware hackery, tackling some extremely difficult soldering in order to set up a proper test platform. He then demonstrates how to use a rather awesome oscilloscope to better understand the display protocol. We found it fascinating to see the video signals displayed as waveforms, especially when he shows how it is possible to count the individual binary values. The amount of information he uncovers with the oscilloscope is nothing short of amazing, proving these little devices are more complex than they seem.

Next check the display response by changing the signal inputs and recording the response. You don’t need to record everything the display does just if it changes or not and if the display goes out. Since Pin 1 is negative voltage and no signal, and pin two is 0 voltage and no signal we can assume they are Vss. and ground.

Pin 3 and 4 are fixed high so start with Pin 5 checking one pin at a time, fix the voltage too high, or in this case 2.3 volts and observe what happens to the display.

Record the response of pin 5 then move to Pin 6 fixing it to high then observe the response on the display and record it. Continue with this process for pin 7 and pin 8. The changes on the display were funky symbols in the alphanumeric segments and random lighting up of the custom bar. You may notice the response only affects the custom bar or the alphanumeric bars make note of that because the pin data inputs may be bar specific.

Starting with Pin 3 start checking one pin at a time, fix the voltage to low or in this case 0 volts and observe what happens to the display. Pin 3 and 4 when set low shut down the display, pins 5 to 8 when set to low or 0 volts made different symbols in the alphanumeric segments, and different random lighting up of the symbols in the custom bar.

A large share of our business originates from customers who need our LCD reverse engineering services for a replacement display module. Their current supplier has discontinued the LCD series or no longer supplies Liquid Crystal Displays.

A short time ago a customer contacted our technical engineering support department and asked if we could develop a 40x2 custom character LCD display to replace a module that their previous supplier had discontinued. They required our LCD reverse engineering services to provide a drop-in equivalent including EL backlight and exact pin-out.

This display is much larger than most character LCD displays with a length of 9.8 inches and a width of 1.5 inches. Its character height is a little over ½ inch.

This large character display is a good solution for products that need to be read at a distance. This includes industrial, test and measurement, scales and many outdoor applications.

Although the standard display configuration is with an EL (Electro-luminescent) backlight, the character display can be manufactured with a LED (Light Emitting Diode) backlight.

EL backlights are AC (Alternating Current) driven which means there needs to be an inverter on the LCD or on the customers PCB to convert the DC (Direct Current) to AC. This adds cost and requires real estate on the PCB.

EL backlights now have a higher minimum order quantity of 500 displays per build. Focus is able to hold inventory in our Chandler warehouse if necessary.

EL backlights are limited in their size, when a larger backlight is required, a CCFL (Cold Cathode Fluorescent Lamp) is required. The challenge is that CCFL backlights in LCDs have been phased out.

LEDs can create hot and cold spots under the LCD glass. Most of the time the light can be ‘smoothed’ out with a diffuser, but the brighter the LED backlight is driven, the greater the chances of hot spots.

Character displays can be built in a variety of background and backlight colors. The photos below present a sampling of different options. Available colors include:

The standard operating temperature range for this character display is -20C to 60C, but it is possible to build the display as a wide temperature version that will operate from -30C to 70C.

If the display needs to operate to a lower temperature than -30C, it would be necessary to add a heater. Contact Focus Displays for help with your custom LCD heater.

The standard, stock display is built as a positive mode, but can be built as a negative mode.Positive mode means that there are dark letters on a light colored background.

Below are photos of two character displays in both positive and negative mode. Positive mode is standard, but the character LCD can be built as negative mode

The negative mode version requires the backlight to be on for the display to be readable, and is not the best solution for battery and solar powered products.

FSTN monochrome LCD displays contains a retardation film applied to the STN display to produce a black and white display. The film produces a higher contrast and wider viewing angle than STN or TN.

STN monochrome LCDs require less power and are less expensive to manufacture than TFT’s. They produce a sharper contrast then TN but less sharp then FSTN. Basic color options are Gray, Blue and Yellow/Green (most common). Other colors are available through the use of filters.

TN monochrome LCDs is the lowest cost of the three options. Contrast is not as sharp as STN and FSTN. Primary color options are black letters on a gray background. Other colors are available through the use of filters.

As mentioned at the beginning of the article. Focus Displays is able to design and build an equivalent character LCD to take the place of a discontinued display. Sometimes it may require LCD reverse engineering services.

Many times a one-time tooling or NRE (Non-Recurring Engineering) fee is required. This tooling fee is much lower for segment, character and monochrome graphic displays than it is for OLEDs (Organic light emitting diode) and TFT"s (thin-film-transistor).

The first step is for the customer to send Focus Displays the datasheets for the LCD they were using. If the customer does not have a current datasheet or there is a concern that it may not be accurate, Focus may be able to ‘estimate’ a cost from a photo.

Most LCD displays require some type of on-board controller driver processor. There are many companies that manufacture LCD IC’s. The challenge is that a controller from one company may not be 100% compatible with the controller from a second company.

Focus Display Solutions provides off-the-shelf standard displays as well as custom LCD design services to help companies replace their current LCD. Call Focus now (480-503-4295) if you need LCD reverse engineering services. Or fill out the contact form.

I first saw this screen on the ZBD EPOP 900 electronic shelf label (ESL). Thought it is going to be fun just reverse engineer them, so I bought a few of them:

The PCB is not very complex, it is a small 2-layer PCB, with only one TI CC1110 MCU controlling everything. With some tracing, it is clear how the LCD is connected to the MCU. MCU also has control of the LCD voltage regulation and LCD bias generation. These are important information that will be used later.

M (Also called FR), a signal only present on passive matrix LCDs, defines the polarity of the driver. Toggle this pin would switch the output polarity. Screens are driven in AC by toggling this pin to avoid polarization.

There are some additional help I can get from the LCD"s ribbon cable, by following the trace there I can know which pins are for the segment, and which pins are for the common.

Well it might sound like it was quite easy reverse engineer it, it was not. I wasn"t aware that the voltage was controllable (thus not aware that I have the voltage entirely wrong), and I didn"t realize that both P15 and P17 are both LP at first, caused lot of confusion at first. At the end I spent lot of time fighting with air. I am glad eventually I have sorted everything out.

The LCD display control a diplay driver IC which controls both the DATA and SCAN lines. The vertical lines usually the DATA lines and the horizontal lines are the SCAN lines. My main interres was how manufacturers can make such a small edge around the active area of the display. If you think about this the usual mobile phone display has more than 1000-4000 vertical pixels, but the edge of the display is not more than a millimeter or two.

OLED display logic driving is simillar compared to LCD, but the fundamental difference the OLED pixels need current driving till for the LCD enough voltage driving.

My main focus here also was the row pixel driving circuit (scan lines), which are takes place on the very edge of the display around 1mm wide. This circuit fundamentaly work the same way as on the LCD display it has shift registers which scans through the rows one after an other. The complecity comes from the current driving which for Samsung displays has pixel driving compensation circuit as well.

To be able to see the better the tft layer of the display I had to etch away the top metal layer, which was the sub-pixel anode contacts and on the scan drive curcuit had a metal mesh shilding possibly. On the next two picture width are 100um across the image, just for scale.

But all components have a service life, and a manufacturing lifetime. And when your part goes out of production and then your spares-bin runs dry, sometimes keeping your machine running requires some deeper problem solving. When you work in the public-facing technology sphere (theatre, museum work, retail displays, etc), a lot of the solutions are literally one-of-a-kind, even if they"re constructed from commercial parts.

The Lascar EM32-4-LED is a four-digit seven-segment panel mount LED display meant for general-purpose data display. Its small digit size (.39" tall), machined aluminum housing, small footprint (32.5mm diameter punchout) and NEMA 4X/IP67 made it a compact choice for anyone needing to display a single value with 4 digits of precision. It also had the ability to drive four external LEDs, for additional status or process indicators.

A piece of equipment I"ve been working on recently had just such a LASCAR display installed a few years back to serve as a timer. I""m going to have to be a little vague about the specifics of the equipment itself, but since this post is focused on technical process and not the piece itself, I think I can safely share enough details for the following to make sense:

The piece is an interactive object that triggers some actions and servos, demonstrates a physical phenomenon, and then takes about 25 seconds to cool back down before can be used again. The user is presented with a green illuminated button to activate the system - when the system is in active or cooling down, the illuminated button turns red. But because it"s not entirely clear from the action of the device alone when it will be cool enough for use, a countdown timer (two digits) is displayed on the EM32 display, counting the number of seconds until we"re good to run again.

Sadly, this particular EM32 display died shortly after LASCAR decided the product hit its End of Life. What"s more, I"m currently without the ability to modify the programming of the PLC that"s driving the whole shebang. In order to maintain the functionality of the piece, it became necessary to build a device that would ingest the existing signals being sent by the PLC, interpret them, and drive a newly crafted 7-segment display of some kind.

In our case, the EM32-4 is unique enough that there are no major variants. The paragraph mostly tells us what we already know - it"s a 4-digit, 3 decimal point display in a metal bezel. But it does call out the "optional external LEDs." While it"s unclear at this point exactly what this means, it"s useful to make note of these surprises early on, as they"ll often explain a what-the-heck-is-that moment late in the datasheet.

In our case, there"s only 6 lines, but 6 important lines they are. We learn that this is a 5V part, but can run at up to 9V so we can"t assume we"ll have 5V power available. Nominal power  usage is ~20mA, so the power available on existing supply lines may be limited. The operating and storage temperature ranges are typical. VLED is a a bit confusing - does this refer to the display itself, in which case we have no real purpose for this voltage? Or perhaps it refers to the voltage available for the external LEDs.

Finally, there"s a Reset pin for soft-resetting the data displayed - this would be useful if the end product was configured so the displayed retained power when the controller turned off - the controller could simply reset the display (or many displays in parallel) to ensure that no data was present for a fresh start.

One of the starting placing for replacing this display was the possibility that there might be some driver circuitry driving ageneric 7-segment display. If the display itself was still good, perhaps we can simply replace the driver and have a visually identical display. Those hopes were dashed, however, when I opened up the EM32-4 LED to find...

An OEM 4-LED - the power behind the throne - it"s the same product, right down to the block diagram, but in a DIP-style package. The EM32-4, it turns out, is the OEM-4 with a nice aluminum case and terminal blocks. And the back of the OEM-4 is epoxy-blobbed together, so even if we were to break into the thing, there"s a good chance everything is wirebonded all the way to nowhere and back. Reusing the display on this thing is a non-starter.

We can now see in much more detail that, yes indeed, the display is based around an internal shift register architecture, with bits being clocked in and held in the device. We can see that there"s a start bit ("1") and the 35 data bits we saw in the EM32"s datasheet, so we"ll need to clock 36 physical bits into the device, whereupon it will automatically load the data (presumably into the data latches and output buffer). Then in 30 ns it will automatically reset and be ready The clock timing, which is listed as 500 Khz nominal, can in theory be pushed to 2 MHz if the 500 ns cycle time (250 ns + 250 ns) can be believed. (Not that we"re hoping it"s that high). We can also get some detail about the external reset signals and the data input timing.

Remember, all this sleuthing is with a goal -  not of driving an EM32, but of creating a display controller which takes the place ofan EM32 in a specific installation. Any details we can deduce from the datasheets will help us narrow down where we begin with our investigation of the controller itself.

At first blush the circuit diagram appears to tell us what we already know - there"s a shift-register LED driver inside this thing that"s taking clocked data in and driving LEDs on the downstream side. But there are actually two key things to note here - while I had assumed the VLED pin was only for the external LED"s, it"s actually the anode connection for all the segments of the display! This means that connecting it isn"t optional for driving external LEDs, it"s mandatory if we want the OEM-4 to work. Looking back at the block diagram from the EM32, we can understand the purpose of the built-in regulator shown there.

Now we don"t have to try to deducing the bit-order from what we think the data stream is displaying, we can build that data into our programming from the beginning. Thank goodness, since I"d never actually seen this display in action before I undertook the task to replace it!

In the next post, we"ll start probing the signals coming from the controller, building a version of the display in software, and testing some theories about how the display operates.

In the previous post I had the chance of discovering and documenting most of what there is to learn about the communication between the LCD unit and the master ESC (speed controller) that drives the e-Scooter rear motor.

This is interesting information for anyone willing to build something that interfaces directly with these components. For example if the user wants to write an app that captures the speed information and other status data, knowing the serial protocol is of great use in order to implement a Bluetooth module that acts as man in the middle, and sends the data to a smartphone. Alternatively one might be interested in building a hardware device that fully replaces the LCD unit, e.g. exposing a fancy TFT LCD display with more features than currently provided by these units.

Because I didn"t want to leave this topic incomplete, I decided to keep on digging and try to figure out what was that mystery byte B05 sent by the LCD in every transmitted frame. Because its value would both change erratically, and because I could not find how the gear data was being sent to the ESC, I got intrigued and suspected that this information had to be contained in this byte and sent with some form of encryption.

Thinking back about the frame sent by the ESC, where I assumed that byte B03 was just an offset for providing entropy to other bytes of the payload, I decided to run the same type of analysis on the sequence of this "entropy" field, and I realized that just like in the LCD frame, albeit different, it was a pattern that also varied according to the frame:

Taking this information into consideration, I changed the two Python scripts (one for the LCD and one for the ESC frames) to decrypt the fields based on these two key maps. And to my satisfaction, this was correct. I could now understand what was the "mystery" field. It was nothing more than (as I suspected) the encoded gear value. As I varied the gear in the LCD unit, I would obtain the following values in binary:Gear 1 - 0b00000101

This information is valid for the LCD and Speed Controller manufactured by the company named Jipin(often also labeled as J&P). As I have mentioned in a previous post, this frame follows the same overall structure as the QS-S4 display, even though the meaning of the fields is not entirely the same in the latter.

As I could not find any information from the vendor regarding how the LCD screen of my scooter communicates with the speed controllers, and because I was curious and interested in knowing how feasible it would be to in the future integrate this LCD with a different speed controller, I decided to do this analysis on my own.

The first step was to remove and open the LCD display. While it is not the same and has no model identification on it other than the reference JPY803B in the PCB (the only thing that I know is that it belongs to the Jipinmanufacturer, sometimes also labelled as J&P or JP), it is externally very similar to the QS-S4 display. Internally the board is different and the micro-controller chip has a different identification on it.

It is a pretty versatile device, as it is adjustable and tolerates a maximum of 100 Volts of input voltage. Even though this LCD unit is normally powered from the 67.2 Volts battery supply, I was able to run it successfully at 12 Volts. Considering the specs on the electrolytic capacitors at the input, it is likely that this LCD display can be powered from a 72 Volts battery without much of a problem.

The second aspect I only spotted after cleaning the board with isopropyl alcohol and figuring out with a magnifier that I had accidentally removed a bodge solder bridge that seems to have been done because of poor PCB etching (which left a trace open). Upon testing the device without putting the bridge back in place, a few segments in one of the digits would not appear on the LCD.

While testing the LCD outside of the scooter, I measured the sensor signal varying between 0.7 and 3.8 Volts as I pressed between 0 and full throttle. The measured low value is a slightly more conservative than the value reported by the manufacturer, but the conditions (i.e. strength of the magnet and proximity to the sensor) might contribute to the differences.

Now that I knew the pin assignments, my next objective was to figure out something more about the serial communication. As such I first connected this LCD display to a 12 Volt power supply, and tapped into the TX pin of its serial port (blue wire) with an oscilloscope. I could see that as the device is turned on, it continuously tries to send messages:

Because another user had success with the similar QS-S4 LCD display (more details here), by inspecting the transmission occurring at 1200 bps, I decided to start with the same bit rate (although I could have inferred it from analysing the signal captured on the oscilloscope, I was lazy and tried that first). And, surprisingly the received frames seemed consistent in format with the messages that this user obtained with his QS-S4.

The only varying bytes (and here the display was not connected to the scooter) were byte 2, which appears to be the sequence number of the frame, and byte 5 which contains values that vary in a seemingly random pattern. Byte 7 (value 0x46) and byte 10 (value 0x02) don"t vary and are consistent (could be a coincidence) with the P08 parameter (0x46 = 70%) and the current speed setting at the time.

In a next iteration I will be tapping the communications while the LCD display is connected to the speed controllers, and try to figure out more information about the communications protocol and the meaning of the fields in each frame.

Reverse engineering in manufacturing and engineering is used for a wide variety of reasons. By taking apart engineering equipment or a manufactured product and discovering the materials it is made from and how it works, we can help a business determine and improve production processes, enhance product effectiveness, and protect patents.

We serve businesses across all industry sectors and work to your unique requirements, whether it’s a simple component or a complex piece of engineering equipment that needs analysis.

The benefits of reverse engineering are many and our findings can help you determine future production techniques and material selection as well as reduce research and development.

By partnering with Intertek, our reverse engineering services in manufacturing and engineering can help improve both your product and competitive edge in the market.

But it has started me down a rabbit-hole of looking into LCD Panel technologies, as there are a lot of otherwise cool 486 laptops out there (or even older) that could possibly be capable of color, if not an Active Matrix Panel.

STN Monochrome screens typically have 14-16 pin connections on a single wire, the 14 pin units don"t have an on-board ballast on the screen for the CCFL backlight(s). Those with more pins do. I did some digging and found a article on salvaging LCDs and found a general pinout to go by that might work....typically it consists of sync for halves of the screen - https://www.instructables.com/Salvaging-Liquid-Crystal-Displays-LCDs/

DTSN Screens are similar but include 2 Latches - per the Sharp LM64C031 640x480 9.4" LCD Single Scan STN LCD Pinout below - this is a Color LCD - it has 18 pins and the Ballast for the backlights, I assume, is an external part.

The Graphics chipset is likely near the center, on the other side of the board. The connectors are right under the keyboard, and like the NEC Versa, there are THREE of them, each going to their own connectors. These three plug into a board inside the screen assembly that splits off into one 14 pin cable that runs to the LCD, and then a series of chokes and a transformer for the power to the CCFL backlight. The idea I have is if I can figure out the pinout to the graphics cables, and match the data lines up to a NLt6448AC30 - I could very likely put a TFT Active Matrix NEC panel in this laptop computer. The screw holes even seemed to match (are industrial panels standardized in hole placement?).

Reverse engineering can help you to totally rethink your manufacturing process and help you improve it. However, developing new solutions is not always easy and can be time-consuming. This is exactly where 3D technologies come to the rescue.What exactly is reverse engineeringand how can combining it withAdditive Manufacturing revolutionize your production methods? Let’s find out!

Reverse engineering, otherwise known as back engineering, is amethod of learning by taking apart human-made objects in order to learn how it was produced without any preview knowledge of it. This process can be applied to different things, from electric devices to programming code.

The purpose of reverse engineering isnot really to copythe part but tolearn how it was producedandgain knowledge of the manufacturing process. That allows improving the part or finding new solutions.

There are many advantages when it comes to using 3D technologies for back engineering purposes. They can highly improve product development and prototyping stage, which affects the final product. 3D scanning and 3D printing are the main methods beneficial for reverse engineering. How can they be used?

In order to examine an object for reverse engineering applications, 3D scanning comes in very handy. It will allow you to get an exact image of it in virtual reality.3D scanners will produce a mesh, digital representation of the part in question build of triangles. MostCAD softwaredoesn’t work with mesh objects as it’s not precise.

Once you have a precise 3D model, you can add to it any adjustments needed.CAD and 3D modeling softwarewill allow you torun different stress testsandpredict the behavior of different parts, exposing their weak and strong points. This is a huge advantage over traditional methods. Thanks to 3D scanning and CAD software you will be able toshorten the development stagefrom weeks to just days. Additionally, it brings the costs downas you don’t have to produce as many prototypes, you can test different solutions within the computer! Speaking of prototypes, let’s see how 3D printing and reverse engineering can improve them.

Thanks to reverse engineering you willdeeply examine the objectdiscovering the development methods behind it. You will gain knowledge which will help you to understand how the object can be modified and improved. You already know that 3D scanning and 3D modeling will allow you to create a digital version of the object, edit it and test it.

Although Additive Manufacturing technologies are well known to be reliable for rapid prototyping, they actually came a long way since. Thanks to reverse engineering and many options available for 3D printing, you can produce fully functional parts. Your manufacturing process will be more efficient and faster, additionally can be improved by bringing many costs down.