Controller and reverse engineering

A project log for Unity Candle

Taking the idea of a unity candle to the next level

QuinnQuinn 05/08/2014 at 15:420 Comments

I need a controller which can implement the required sequencing, implement the positive manual enable, and a lock system to prevent unauthorized use. A convenient way to do testing while adjusting parameters would also be helpful.

Digging in my parts bins I had hand paddle which was originally used with some sort of networking equipment. Not sure where I got this, but probably from a little dumpster diving. When I got it, I opened it up, and was glad to see that it used a common HD44780 LCD module, instead of integrating the LCD controller into the main electronics, so I knew it would be a good starting point to hack.

Initially I figured I would just replace the control electronics in it, wiring the LCD and membrane keypad to a controller of my choice, but I decided to do a bit more poking around. It was pretty easy to reverse engineer the circuit, and identify the connector pinout and power requirement which I didn't know and couldn't find on the web.

The insides:

(The main circuit board has only top side placement so the bottom is completely flat, as it forms the mechanical backing to the membrane keypad.)

A Linear Tech LT1281 is connected to the RJ11, and is a RS232 level shifter. For lines are connected. The main component on the board is a Philips microcontroller, SC87C451. From it's datasheet, it is easy to identify the UART RX and TX which connect to the LT1281. This allowed me to identify which of the RJ11 pins is TX and RX. The other two go to GPIO, and presumably are for RTS/CTS. Again, using the LT1281 datasheet identifies which is which.

The other two pins were power and ground. Ground was easy to identify and traced back to the ground pins of the devices. The power line went over to an area of the circuit board which was mostly unpopulated, but had a 0 ohm resistor place to connect it to another fill, which could be traced back to the 5V pins on the components.

Wiring up a RJ12/25-DB9 adaptor, wiring in 5V, and powering it up seemed successful. Pressing keys resulted in characters in a terminal window, and sending from the terminal window resulted in characters displayed on the LCD, however all quite garbled. I tested a bit with different baud and bit settings, without success, then just put a scope on the TX line out of the paddle. This confirmed 9600 baud, though it took a bit more analysis, and different button presses to determine that it is using an uncommon configuration, with 7 data bits, even parity and 1 stop bit. Switching the terminal over to this, and it worked much better. Characters sent were displayed on the LCD, and button presses on the keypad had mostly reasonable bytes sent back. I used RealTerm in debugging, which was a fabulous help as not all the button presses were printable characters. I had never used it before, but in the past occasionally had need for serial terminal program which supported other binary transactions.  RealTerm was perfect!  I went through all the keypad presses and came up with the mapping of which buttons send which bytes, including the shift and control versions. They mostly don't make sense to what the keypad is labeled, but it doesn't matter because I can just use the mapping in my program.

Given this, the paddle is actually usable pretty much as is, just needing an additional controller, inputs and outputs.

Digging around the rest of the card shows a large unpopulated section in the upper left which is presumably intended for an inverter to power an EL backlight for the LCD.

Just above the RJ11 are pads for some sort of surge device. At the left edge are pads for a surface mount SIL header with pins for power, ground, and RX/TX. There are also pads which would allow the placement of 0 ohm resistors instead of the LT1281 level shifter which would make it 5V communication on the RJ11. On the lower right was placement for a standard 7805 linear regulator in a DPAK2 package. In the above picture, I've already removed the 0 ohm jumper and placed a 7805 to convert the board to run at 12V.