View previous topic :: View next topic |
Author |
Message |
Gabriel
Joined: 03 Aug 2009 Posts: 1067 Location: Panama
|
OT- Weird TX/RX circuit |
Posted: Sat Jun 25, 2016 6:50 pm |
|
|
Code: |
3.3V
___
|
<
< 4.7k
<
out ______________|____PIN_C2
| <
| < 1k
| <____PIN_C7
| |
| |-------[(------GND
|
|----------------[(------GND
|
Sorry for the bad ASCII art...
I'm trying to reverse engineer a Temp control display for an A/C unit.
20pin PIC (not really visible) no Comms driver chip, just the circuit above.
Looks like they are using one line for TX RX -
has anybody seen this before? ideas?
G. _________________ CCS PCM 5.078 & CCS PCH 5.093
Last edited by Gabriel on Sat Jun 25, 2016 9:22 pm; edited 2 times in total |
|
|
asmboy
Joined: 20 Nov 2007 Posts: 2128 Location: albany ny
|
|
Posted: Sat Jun 25, 2016 8:52 pm |
|
|
i don't know of any 20 pin pic that has HDW rs232 on either pin c2 or c7 - do you ?
and are you meaning to say there are capacitors to ground in the rough schemo ?
you show c7 going to ground through one of them and the other is on the
OUT line?
nonsensical as a com circuit IMHO or seriously mis-drawn.
DSxxxx battery clock chips are a case of
a common peripheral SPI type comm part - where
send/recv line is quite commonly tied on many models
using a single connection.
i'm kinda stumped here by way too little info - and maybe wrong info shown to boot.....
but your schemo is not suggesting any comm function to me. |
|
|
Gabriel
Joined: 03 Aug 2009 Posts: 1067 Location: Panama
|
|
Posted: Sat Jun 25, 2016 9:25 pm |
|
|
The caps are 2200pf....
Im trying to make the "art" better... but its not working out.
I looked for uarts on 20pin pic prior to the original post.
I didnt find one either...
G. _________________ CCS PCM 5.078 & CCS PCH 5.093 |
|
|
Mike Walne
Joined: 19 Feb 2004 Posts: 1785 Location: Boston Spa UK
|
|
Posted: Sun Jun 26, 2016 3:41 am |
|
|
What's shown could be low baud rate software UART.
Assume:-
1) This is connected to an identical circuit via Output.
2) Pin C7 is set as RX.
3) Pin C2 is set as TX.
4) TX pin is either
a) Set as O/P when talking and I/P when listening.
OR
b) Set effectively as Open Drain, and Off when listening.
Should work over short distances.
Mike
I'm looking to do something similar for my house C/H.
I want to avoid re-wiring the cable to the sensor.
I also want to add a display where there is just a sensor now.
Last edited by Mike Walne on Sun Jun 26, 2016 3:47 am; edited 1 time in total |
|
|
Ttelmah
Joined: 11 Mar 2010 Posts: 19546
|
|
Posted: Sun Jun 26, 2016 3:42 am |
|
|
It's not at all clear what is happening. You have a pin labelled 'out', yet think there is some form of bi-directional communication?. This pin is on what?. What makes you think the connection is bi-directional?.
There are ways of communicating. For instance the pin could be a variable current source. Then C7 is pulled low, and released, and then the processor times how long it takes till C2 is seen as 'high'. It'd actually be a slightly pointless way of doing this, since on the PIC, a single pin could be used as both input and output. Possibly a 're-code' of a design for a chip with fixed I/O. What is seen on the pin?. |
|
|
temtronic
Joined: 01 Jul 2010 Posts: 9245 Location: Greensville,Ontario
|
|
Posted: Sun Jun 26, 2016 5:26 am |
|
|
I'm with Mike on this as I've seen similar stuff decades ago when you had to get 'creative' in communications.
The 1K between the pins is for protection, the caps for 'filtering' any noise, 4k7 a pullup.
It'll be interesting to put a scope on the 'out' pin and try to decode the datastream. By pressing known buttons, perhaps you can see what the data 'looks' like. If it's propriatory, you may need a 2nd pot of coffee before the night is over !!
Crazy thing is that I wonder what 'hits' Google will find regarding the device !
You may NOT be the first to reverse eng. it.
Jay |
|
|
Mike Walne
Joined: 19 Feb 2004 Posts: 1785 Location: Boston Spa UK
|
|
Posted: Sun Jun 26, 2016 6:05 am |
|
|
You've got 4k7 & 2n2s in your circuit.
These give ~10us time constant.
You should be able to get baud rates in the low k's.
(probably plenty for the application.)
Mike |
|
|
Ttelmah
Joined: 11 Mar 2010 Posts: 19546
|
|
Posted: Sun Jun 26, 2016 8:19 am |
|
|
What I was pointing out is that the third pin being labelled 'out', must be wrong.
'Other device I/O', or something similar would make sense. 'out' doesn't....
Then the odds are that the communication is slow. Don't get me wrong, but if this dates from some years ago, speeds like 110bps, were common.
The starting point must be either identifying the other part (or the whole unit), and searching for data on this, or getting a scope on the signal, and looking.
A lot of things used other forms of communication, than simple serial. For instance open collector pulse width trains.
It might well be an open collector type serial, with the 'transmit' pin being given a software serial stream, modulating just the TRIS bit (as is used for I2C). Only data, or some measurements will actually tell us/you. |
|
|
Gabriel
Joined: 03 Aug 2009 Posts: 1067 Location: Panama
|
|
Posted: Sun Jun 26, 2016 8:29 am |
|
|
Hi guys thanks for your hep on this.
A couple of things:
This is a display used to control an air handler on a chilled water system....on a yacht (i work with yachts)... so yes short distances, 20 ft max due to cable routing.
There is No labling on the 3 pin screw terminal, the "out" name on that pin is given by me...might have been better to call it "in/out"
I am assuming bidirectional coms because i see 2 PIC pins being used, which although not necesary for bi-directional, seems like a good assumption.
The On/ Off button on the display is directly tied to MCLR.
So it seems like the PIC is always powered waiting for something on this "out" pin....
The pin remains High during power-up and stays high when any of the 5 buttons are pressed.
Im assuming its bidirectional because it seems to be waiting for something and because it somehow needs to tell the Air handler what to do.
To be clear, there is no movement on this pin.... it just stays high waiting for something.
I can only see the back of the PIC since its a through hole part sandwiched between the PCB and the LCD... What ive measured matches a 20 pin Pic based on oscillator location, power pins, and MCLR. Plus i know this company likes PIC on most of their products.
Specific lable on the cap 222k. They do not apear to be polarized.
All of their othere A/C products use PICs And use NO comm driver..
G. _________________ CCS PCM 5.078 & CCS PCH 5.093 |
|
|
Ttelmah
Joined: 11 Mar 2010 Posts: 19546
|
|
Posted: Sun Jun 26, 2016 8:47 am |
|
|
My guess is that it may be as simple as the pin being pulsed low, when the unit wants the PIC to do something, and the PIC then holds the same line low, till it has finished. |
|
|
Gabriel
Joined: 03 Aug 2009 Posts: 1067 Location: Panama
|
|
Posted: Sun Jun 26, 2016 8:48 am |
|
|
Forgot to mention:
Yes, ive googled extensively... its a pretty niche market product and this particular model is for european boats.... 250 usd 5 button display... not something your average hacker gets easily so no edaboard or hackaday posts on this screens or products in general.
Yes, ive checked whats on the pin with my Scope....nothing.
If i had a sample of the signal i would not be asking if anyone had seen a similar IO circuit or clues as to what its doing.
Its a CONDRIA display.
Condria is a brand owned by the Dometic corporation, in the Americas Crusair is prevalent, Condria for Europe.
The specific model is not on their website somehow.
This came of a 2016 Azimuth 60...so its not old, but it might have been developed a long time ago.
These systems havent changed in years... all pics ive found on the damaged stuff we pull out are 8bit 16F...low end. _________________ CCS PCM 5.078 & CCS PCH 5.093 |
|
|
Ttelmah
Joined: 11 Mar 2010 Posts: 19546
|
|
Posted: Sun Jun 26, 2016 9:12 am |
|
|
What is the model name/number?. (and of the air handler).
Condaria (not Condria) control panels are often 'custom' to particular boat manufacturers. However the interface on the actual handlers are standardised. |
|
|
Gabriel
Joined: 03 Aug 2009 Posts: 1067 Location: Panama
|
|
Posted: Sun Jun 26, 2016 10:15 am |
|
|
Condaria... yes... i never say/read that right, damn.
No specific model on the display just the numbers 530700010, 23 24 25, 0573... no reference on the Cond'A'ria website.
Air handler: AP1
my idea is to repurpose the display for a comercial space with several AC Units.... i can build the controls but building a pretty display is out of my manufacturing league.
Mr. T, im getting a hint that you have some boating industry knowledge.....please tell me you are one of the engineers developing for this company!.... it might explain their preference for PIC! It would be awesome to know they use CCS too!
G. _________________ CCS PCM 5.078 & CCS PCH 5.093 |
|
|
Ttelmah
Joined: 11 Mar 2010 Posts: 19546
|
|
Posted: Sun Jun 26, 2016 12:40 pm |
|
|
Don't work in that industry, but was sailing down at Cowes, only last week. Funnily a friend down there is a boat surveyor, who does things like assessing electronics, engines etc., in boats.
The AP1, can be controlled by units like:
<http://www.condaria.com/English/Products/Top-Climate-MBS6/>
They adjust the blower speed, and then can use a separate solenoid valve, or simple 'start/stop' on the blower.
The only control directly to the AP1, is blower speed. This is normally just a DC voltage (0-10v).
However they do several versions, Some designed for 'dumb' control, and some with their own display panel. It sounds as if you perhaps have one of the latter.
Have a look at their wiring diagrams:
<https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&cad=rja&uact=8&ved=0ahUKEwinzNyep8bNAhWH1RoKHVKfCb0QFggvMAI&url=http%3A%2F%2Fwww.dometic.com%2FQBankFiles3%2FEPiServer%2FDometic%2FUS%2FManuals%2FMarine-manuals%2FAir-Conditioning%2FChilled-Water-Air-Conditioning%2FDometic-Chilled-Water-Air-Handler-Wiring-Diagrams-Complete-2295B_15333.pdf&usg=AFQjCNEkdP9cIH2RJ-xNLqE90sJ9_bGPEA>
This covers just about all the Dometic units.
and:
<https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=19&cad=rja&uact=8&ved=0ahUKEwjinfKAq8bNAhXGDcAKHWmlATwQFgheMBI&url=http%3A%2F%2Fwww.dometic.com%2FQBankFiles3%2FEPiServer%2FDometic%2FIE%2FCatalogs%2FMarine%2F2624-Dometic-Marine-Superyacht-Catalog-Web_13619.pdf&usg=AFQjCNFzUAA203NlJaF2yuC9tF3w7Ay0tQ&bvm=bv.125596728,d.ZGg>
Is the 'product catalog' for the range. You may see the controller involved.
It might be the older MBS controller (think it was the MBS4). A web search on this may find a picture. |
|
|
asmboy
Joined: 20 Nov 2007 Posts: 2128 Location: albany ny
|
|
Posted: Sun Jun 26, 2016 7:49 pm |
|
|
if it was in front of me - i'd watch the in/out line you identified with
something as simple as Tektronix TDS1002B DSO-
do some stuff with the unit in question and capture the timeline
of what actually happens in a working installation..
Last edited by asmboy on Mon Jun 27, 2016 12:22 pm; edited 2 times in total |
|
|
|