Help identify component on wireless therm board

[rickrump]

I am trying, probably fruitlessly, to debug a non-operational wireless thermometer. We have this projection atomic time/temp clock that projects the time and indoor/outdoor temp on our ceiling. We loved it so much we bought 3 of them - as they would fail! (I know, we should have suspected the design.) The indoor clock/temp works fine. But the outdoor temp is very intermittent. When you put in the batteries and press the reset button, the red led will blink and SOMETIMES you will get a few cycles of outdoor temp showing up on the indoor unit. Have tried distance, new batteries, full reset of both units, etc. So bravely I disassembled it and found the attached board. On the back of the board is a small metal can soldered to the board - looks like a crystal case with HR433C on it. (X2 on the board just below the middle coil.) Only 3 (Chinese) hits for the part number on Google but I think this is the 433MHz wireless transmitter.

With my handy-dandy Bus Pirate, I was ready to see what protocol they used to transmit the temperature. So my questions are:

1) where would you begin to troubleshoot this?

2) What the heck is the black round dot in the center of the board. Is that some kind of security cover for an ASIC or something so it can't be reverse engineered?

Thanks for any help. (If I can't get THIS to work, maybe I dump the outdoor unit and switch to an XBee and figure out where to inject the data stream in the indoor unit. But I would still need to figure out the protocol.)

Wireless Therm-em.jpg (391.22 KiB) Viewed 5114 times

Thanks,

Rick

[hlantz]

Black blobs of resin are normally officially there for "protection so that ICs don't get damaged"; but yeah, you're right, it's to prevent the competition (and, to a lesser extent, tinkerers like us) from figuring out how things are built.

With the amount of PCB traces going into it, I'm gonna guess it's some form of microcontroller. Especially if you have identifed something that might be the transceiver on the back of the card.

Interesting project to work on, though - I hope you will figure it out!

[Philly]

I would start by resoldering the collector on the transistor on the bottom left of the pic, the joint looks a little iffy. Got any better pics?

[rickrump]

Here's a photo from the other direction with the light subdued a bit. I looked at that solder connection with a magnifying glass and it is bright and shiny. Looks good.

Rick

[Zener]

The blob is epoxy encapsulant, over a "COB" mounted die. (chip on board). The transistor there is likely actually the temp sensor. It appears some water leaked in? It looks like some rust stains.

[rickrump]

The yellow in the upper left corner is a coating on the PC board. You'll notice it's also in the upper right corner where the black and red power leads come in from the battery.

The RTD is actually on the other side of the batteries at top, with holes in the plastic case to allow the air to circulate (but an o-ring seal to keep water out. The blue leads in the upper left go to the RTD.

Rick

[Philly]

Have you tried resoldering each connection? Only about 5 mins work there

[richms]

Here is guts of the outdoor sensor for a wireless station I got off ebay to reverse engineer the protocol to get logging

http://picasaweb.google.com/richms/TemperatureLogger#

Same sounding metal can, its part of the RF circuit. At the bottom of the square it is on is 2 connections that was from the micro to the transmitter which is where I tapped into it to sample the RF protocol to reverse engineer. See if you can find the same type of point in your one and use your soundcard or buspirate to see what is happening there.

You might be able too use some pre existing arduino code to decode it, I found that the lacrosse one was virtually identical to the protocol used on those timing wise, these are just shorter and I have no idea how to calculate the CRC so have not bothered for now..

So, if you are wanting to keep using the projector, then a 433MHz transmitter module (the cheap ones of those seem to be fine) and the protocol should be less hard to do than reciveing it. can you put up pics of what the device looks like when working? I was thinking of getting a projector one off ebay but past experience with a projector clock has made me rethink that...

[rickrump]

@richms
Thanks for the info. 2 things:

1) Do you want a picture of the LCD on the front of the receiving clock/temp display OR do you want a picture of what it projects on the ceiling? (That's a little difficult since it has to be dark to see it.)

2) Can you post the make/model of the temperature sender to have the Picassa Google pictures of? I'd like to find one and try it.

Rick

[richms]

The projected part is of more interest to me.

180534740095 on ebay is the same guy I got it off, he did more sensors for US$6.50 each. The sensors make up a random number 0-FF when powered up and the indoor part will show the first 3 that it sees from when you put batteries in which was a pain to get them showing the ones I wanted on the indoor things since I got 2 indoors and 6 sensors all up.

Im using a 433MHz reciver from a remote control extender because the cheap ebay one I got didnt seem to like the slow data rate of the weather stations - they have some form of AGC in them and the maximum high or low time was too long for it, so it got noise at the ends of bits.

Design has come from here http://www.freetronics.com/products/433 ... ver-shield but I have just wired into the IR repeater's reciever rather than move the 433 reciever to the arduino since the final project will be done with a bare avr to make it small enough to go into an old clock radio with an LCD.

[JohnDowdell]

The "metal can" is almost definitely a single port SAW resonator.

wikipedia briefly mentions resonators under this page if anyone is interested in the physics but it wont help you diagnose the unit:
[url]http://en.wikipedia.org/wiki/Surface_acoustic_wave[url]

The popular frequency around 433Mhz tends to be 433.92Mhz.
Modulation for data with these circuits tends to be OOK (on/off keying). i.e. either the rf circuit is transmitting a "carrier" on 433.92 or not.

Epcos has a good app note on saw resonators. Most relevant will be the schematic at the end
http://www.epcos.com/web/generator/Web/Sections/ProductCatalog/SAWComponents/AutomotiveElectronics/OnePortResonators/PDF/PDF__AN1,property=Data__en.pdf;/PDF_AN1.pdf

I think resistor R12, a 33K (marked 333) is probably going to be your guy. check which side goes to the smd transistor(kind of hidden under a coil in your photo). My bet is that the other side of the R12 goes towards the "blob".

From what i've seen, the bus pirate can diagnose a number of protocols and interfaces. Don't be surprised if the manufacturer has gone for a proprietary protocol. Also, manchester encoding is a popular encoding method for this type of transmitter. Will bus pirate diagnose manchester? There are a few types of manchester encoding though.

There's a number of vendors that sell cheap (<$10) 433.92Mhz receiver modules if you wanted to use that as a diagnosis tool.
Also, I have a cheap 'n nasty radio frequency counter i got off ebay (~$30 - ~50)that i use to check if such an rf circuit is transmitting. You'll probably find that if you apply VCC through a 33k to the same place where the r12 connects to the transistor, you can probably get the transmitter to fire up a carrier on 433.92Mhz. That's if the RF circuit works at all. When i use this method with my frequency counter, it shows 433.92Mhz (or thereabouts) on the display.

Is it possible to manually prompt the device to transmit a report. I guess it would be difficult to diagnose if the data only got sent out once every ten minutes or something.
I take it the blue wires at the designator "RT" on the board go to a thermistor sensor? If the unit only transmits reports on temperature changes, i guess you could heat up then cool down the sensor.

JD

[rickrcomm]

@johndowdell - thanks for the great tips. I will pursue them

@richms - attaching pics of clock/temp projection (and box and front.) Brand is Ravinia. Bought from Walgreen banned for $20. I have three (I liked them!) One does not project any more but otherwise works fine. Would sell for $10 & shipping. Email me if you are interested.

Ceiling pic in dark was HARD! It shows the temp in large letters - alternating indoor and outdoor (when it works right! ;^>) Time is below temp in smaller font. Temp on from of clock also alternates indoor/outdoor.

Rick

clock on ceilingem.jpg (12.78 KiB) Viewed 4959 times

clock box-em.jpg (44.49 KiB) Viewed 4959 times

clock front-em.jpg (25.89 KiB) Viewed 4959 times

[richms]

I cant see anything but a black square here on this lousy LCD...

How large are the letters? Can it focus? Im just worried that it will be fixed focus so depending on where its going, it will be too unfocused to see.

The sensors I got with that weather station transmit every few seconds for the first min or so when you put the batteries in, then go back to sending it every 1 min roughtly. You can provoke a transmission by removing and reinstering the batteries which will restart it doing it every few seconds, but with a new random ID.

It doesnt seem to be quite random, I dont know how many codes it will choose from, I have had a couple of double ups of the codes when I was setting up 6 of them.

[rickrcomm]

The projected character size ranges from about 4" if you project straight up to over a foot if you slant it across the room (trig!) It gets dimmer as it gets bigger (optics!) Yes, it has a focus adjustment on the optical projection tube. I also noticed a feature I had never noticed before: it stores the max and min outside and inside temps. I always thought that was a brightness of the screen LCD and that it didn't work too well. But the manual doesn't talk about that feature.

[martin_bg]

Here is guts of the outdoor sensor for a wireless station I got off ebay to reverse engineer the protocol to get logging

http://picasaweb.google.com/richms/TemperatureLogger#

You might be able too use some pre existing arduino code to decode it, I found that the lacrosse one was virtually identical to the protocol used on those timing wise, these are just shorter and I have no idea how to calculate the CRC so have not bothered for now..

richms, I have the same sensor as yours. I can't read it using the LaCrosse code, do you care to show your code?

Thanks