Nineteen analogue inputs and one converter is a ratio that shapes the firmware more than the datasheet suggests. There is no parallelism to hide behind: every measurement is a sequence of operations on a shared resource, and each step costs time that somebody had to budget.

For a reader, that is good news. A design that has to schedule nineteen inputs through one converter leaves a record of its priorities in the sequence it chose, and a record of its circuit assumptions in the sample time it set.

One converter, many inputs

The converter is a twelve-bit successive-approximation type, fed by a multiplexer. Only one channel is converted at a time; the multiplexer selects which input reaches the sample-and-hold, the conversion runs, and the result lands in a register.

The last row is a useful landmark. A channel that measures the die temperature rather than an external signal appears in the sequence without a corresponding pin, and it is often the one entry a reader cannot explain from the schematic.

Sample time is a statement about the circuit

Before a conversion, the sample-and-hold capacitor has to charge to the input voltage. How long that takes depends on the source impedance, and the sample time is therefore a number that encodes an assumption about what is connected.

A design that sets the shortest available sample time on a channel connected to a high-impedance source produces readings that are consistently low and slightly noisy, and nothing about the code looks wrong. Finding a short sample time beside a channel whose external circuit is a large resistor is the explanation for a whole class of «the readings are always a bit off» complaints.

The reverse case exists as well: a long sample time on every channel, which costs throughput for no reason and usually indicates firmware written by copying a configuration example.

The channel list is the product

Hardware sequencing means the converter can walk a list of channels without intervention. That list is written at start-up, and its order is not arbitrary: the designer put the important measurements first, because a scan takes time and the loop repeats.

Reading the list gives the number of analogue inputs the product actually uses, in priority order. Combined with the sample times, it distinguishes the sensors by type: a channel with a long sample time and a large scaling constant is a high-impedance sensor; a channel with a short sample time and a scaling factor near one is a supply measurement.

The constants that turn counts into units

After the conversion comes the arithmetic, and on a part without a floating-point unit that arithmetic is fixed point or integer with a shift.

Each measured quantity has a scaling path: a multiply by a constant, possibly an offset subtraction, and a shift that implements the division. Those constants are the physics of the product written in integers.

A lookup table rather than a polynomial is a strong hint: it means the designer had a calibration curve measured rather than derived, which usually means the product was characterised on real units.

Calibration values stored in the array

Some designs store per-unit calibration in the data flash: a zero offset measured with a shorted input, a gain correction measured against a reference. Those values are per-device, which makes them the one part of the analogue chain that cannot be reconstructed from the code alone.

Where such values exist, they should be delivered both in the data flash image and in the report as numbers. A customer replacing a failed unit needs them, and a customer reflashing an old image onto a new part inherits the old part’s calibration unless somebody notices.

Reading the analogue section

1. Find the multiplexer and control register writes at start-up. The channel sequence is there.
2. Note the sample time field for each channel, and compare it against the sequence length: the two together give the scan period.
3. Locate the conversion-complete handling. It is either a polling loop or an interrupt on the end of the sequence.
4. Follow the arithmetic applied to the result registers. The constants are nearby, usually as an array indexed by channel.
5. Look in the data flash for a calibration block with per-unit values.

Steps one to four take an afternoon and produce a specification for the product’s measurement chain, which is frequently more useful than the disassembly.

What the deliverable contains

The return set is the code flash image, the data flash separately, the configuration words, the identification words as read, a disassembly with the converter configuration annotated, a table of the channel sequence with sample times, and the scaling constants written out as arithmetic.

That table plus the constants is the analogue half of the product, in a form an engineer can check against a schematic.

The package limit on how many channels exist is in R7FA2L1AB3CFM binary recovery. The sensing block that shares the same pins is in R7FA2L1A93CFM firmware recovery, and the reference and supply consequences in R7FA2L1A92DFM program recovery.

FAQ

Is there a factory calibration value for the converter? Not a per-channel one that replaces the design’s own calibration. Per-unit offsets and gains, where they exist, are written by production programming into the data array.

Why does sample time matter on a slow signal? Because the sample-and-hold must charge through the source impedance. Too short a time produces a low reading regardless of the signal.

Can the reference be internal? Yes, selectable. Which was chosen determines the scale of every constant and is visible in the configuration.

Conclusion

A multiplexed converter turns an analogue design into a schedule and a set of integers. The channel sequence states what the product measures and in what order; the sample times state what it believes about the circuits; the constants state what the numbers mean. All three are in the image, and together they reconstruct the measurement half of a product whose drawings are usually long gone.

Comments are closed.