Reverse engineering the Melnor controller without opening it.

A project log for Hacking the Melnor 53280 into an iOT Timer

Creating a replacement for the Melnor timer, one that allows for easy timing of multiple valve units in a web interface.

laurentopialaurentopia 07/22/2018 at 22:480 Comments

The controller is connected via a cable to the valve assembly. The plug is 10mm in diameter and has 7 pins.

How does it control which valve open and close?

Let's start with finding out which pin does what.

Red = 1

White = 2

Purple = ground

Green = 3

Blue = 4

Checking with a voltmeter we can see that the colors of the male plug which is on the controller's side match, the ground is brown on the controller.

In case you buy these plugs from a 3rd party and the cables have different colors, here is the pin configuration, ground (brown) is in the center

Next, let's see what voltage need to be applied to trigger the valve. Since the controller runs on 1.5V battery in series, the controller has 3V at its disposal at full capacity, the unit can live for a very long time on two batteries so my guess is 1V is all that's needed to trigger the valves.

Note: get a clamp for soldering...

I don't have an oscillo so I'm using a logic analyzer and a cheap volt meter. 

Let's start with the logic analyzer, connect the red wire to channel 1 and the brown wire to gnd and turn on valve 1 in manual mode gives us this:

The controller has a latency of  1 second from command to signal and 5 seconds before shut down. Why? no idea, but we shall respect that.

Voltage ? The voltmeter jumps to -3V for two bleeps when opening the valve and +3V when closing the valve. I don't understand that so I'll move on directly to poking the valve unit with the ESP32...

Poking it didn't work because the esp wasn't pushing enough current so I went back to measuring the controler signal and for that, I bought a 29$ oscillo. 

The controller sends two square waves at -16V to open the valve and two square waves at +15V to close it, delta Time about 2 seconds. So they accumulate electricity to get from the battery's 3V to the control signal of 15V, this explains why there is such a latency between command and valve responding: it takes time to charge a capacitor.

Notice the rounded slope, capacitor!