As was browsing EEVBlog a while ago... (I know. It's great here, but I sometimes like go look elsewhere too.) Anyway, I was browsing EEVBlog and came across an interesting post where someone had taken a Ninja SP101 domestic air fryer / pizza oven and replaced the PCB to use it for reflow soldering.
https://www.eevblog.com/forum/projects/ninja-smt-reflow-oven/msg6103711/#msg6103711
I already have a small mini-oven that's been adapted with an external controller. However I liked the way he'd gone about this - especially the way the original display and controls had been retained. I put a search for the same model on eBay and thought that it might make a nice project if a cheap one came up. Well, what do you know - a brand new one that had been dropped and dented came up for only £25, so I went for it. I fully intended for it to ba a back burner project and for it to perhaps never get finished, but once it was in the gagade I decided to give it a poke.
The original project was a total PCB replacement, but I was interested in a bit of reverse-engineering and to see if it was possible to re-use the existing PCB and replace the firmware.
The existing board consists of an STM32F031 microcontroller. This controls some relays, triacs, fans, and an internal light. It connects to a front panel with some 7-segment displays, a rotary knob and a few buttons. I know from the other project that it uses an NTC thermistor for temperature measurement, but that this reacts a little too slowly. If this is going to work then I will need to interface with all these components and also see if I can add a thermocouple.
The first thing I did was to hammer out some of the dents and get it looking respectable, if not exactly perfect. Apart from a few scars and a broken doo rhandled it did indeed work just fine.
The next thing I did was to see if I can connect to the onboard microcontroller. I found an old STM32F0Discovery board from many years ago to use as a ST-LINK and decided to see if the usefully provided debug header would reveal anything. As the oven was running from mains power I ensured my laptop was running on battery to prevent any ground loops.
STM32CubeProgrammer did indeed reveal an STM32f03x microcontroller but it had Read Out Protection (level 1) enabled. It looked like it was possible to reset the Read Out Protection bits using the programmer so I decided to give this a try.
It worked! However I shouldn't have been surprised to see that it also erased the on-board firmware. Oh well - no going back now. My air fryer is getting a new purpose in life or it's being left for dead. My reverse engineering journey is about to begin...
On to Part 2
