Project Logs

Collapse

• PCB reverse engineering done

  Florian • 01/26/2022 at 13:43 • 0 comments

  I certainly took my time, but after long hours of tracing PCB tracks in Paint.net, identifying components, and putting everything together in Kicad, I finally finished reverse-engineering the two PCBs in this video intercom.

  To help me achieve my other objectives, I then proceeded to identify which portions of the schematic were responsible for handling:

  1. the audio coming from the entrance panel and going to the room monitor speaker
  2. the audio coming from the door unit and going to the same room monitor speaker
  3. the audio from the room monitor microphone and sending it to the entrance panel
  4. the audio from the room monitor microphone and sending it to the door unit
  5. generating the chime and sending it to the room monitor speaker as well to the door unit

  For clarity, I created a simplified schematic for each of the points listed above, including only the relevant components and connections. I then compiled all five schematics into one large Kicad file (see the FILES section for download).

  Here is, for example, the portion of the overall schematic that deals with 1.

  Thanks to these simplified schematics, I now have a solid understanding of how this video intercom works and where I should connect in the future to record the audio between the entrance panel, door unit, and room monitor. I've also identified where to connect to inject an audio signal and have it played by the entrance panel or door unit.

  While tracing back the PCB tracks, I noticed that, apart from the video signal, the remaining data and audio signals go directly into a large IC branded with a manufacturer name that I wasn't able to identify. It's likely a custom IC. However, next to it is the microcomputer (the one I mentioned in my previous log), and after a close inspection, I found traces going between just these two ICs... So, I guess they communicate with each other?

  I went through the microcomputer's datasheet and checked the main function of each of the connected pins, and it looks promising:

  The next course of action will be to add some wires here and there so I can easily connect my logic analyzer or oscilloscope. Then, I’ll probe for signals in situ to confirm a few of my hypotheses and also learn what those two ICs are communicating with each other.

• Found a donor, transplant successful

  Florian • 01/22/2022 at 03:29 • 0 comments

  While reverse engineering the mainboard PCB, I've been thinking about how to achieve my first objective: replacing the display with a larger one. After taking a few measurements, doing some research, and considering various factors, I came up with the following requirements:

  1. should be between 3.5 and 4 inches
  2. shouldn't consume more than the actual display
  3. shouldn't be too expensive
  4. should display the video quickly after powering on

  I then tried to list all the possible solutions I could think of:

  • a car monitor with AV input (like those cheap ones sold on Aliexpress)
  • a small FPV monitor
  • a monitor removed from another product (PSP, another video intercom, ...)

  Having one of those cheap car monitors, I tried it, but the video would turn completely white just a few seconds after appearing on the display. Also, it took a few seconds for the video to show up, and the power consumption was around 180mA, almost double that of the actual display.

  So, I discarded the car monitor idea. Since I knew too little about FPV monitors, I focused on finding a product from which I could harvest a display module. The first thing I thought was: "Find another old video intercom with a display of the proper size." I then went on Mercari and Yahoo Auctions to search for video intercoms priced under 2500 yens. I created a simple list (brand, model, year, functional/broken, price) and then looked up each item's specifications to gather details about the display.

  And I ended up buying this broken Aiphone video intercom with a 4-inch display for 820 yens.

  When creating my list, I noticed that old video intercoms tend to be quite thick, likely because they use a display module. This one was about 4 cm thick, almost as thick as mine, and sure enough:

  A separate PCB with three potentiometers was connected to the middle connector of this display, so I searched for the datasheet of the closest IC to this connector (IR3Y29BM made by SHARP) and confirmed the following connections:

  Finally, after confirming that it consumes less than 90mA, I installed it in place of the actual 2.5-inch one and tested it: the video appeared instantly, and even without connecting the separate PCB (the one with the 3 potentiometers), it worked fine.

  The only downside is that this 4-inch display module looks like it won't fit in the actual video intercom... I might need to look for a 3.5-inch one instead...

• A little correction thanks to my new "toy"

  Florian • 01/08/2022 at 06:32 • 0 comments

  I've been playing around a lot with my new "toy," and it performs even better than I expected. Here’s a little comparison showing the kind of details I can now capture with it:

  On the left is the photo I took with my Galaxy S10, and on the right is the one taken with my document camera. Note that I didn’t set the document camera zoom to its maximum when taking this photo, meaning that at full zoom, I could capture even more fine details.

  Yesterday, I spent some time photographing both the front and back of the video intercom PCB. I set the document camera zoom to nearly its maximum and ended up with over 100 photos to stitch together. For that, I used Image Composite Editor, which managed to stitch everything perfectly after just a few tweaks. In Paint.net, I adjusted each photo slightly to ensure the vias and through holes on both sides aligned perfectly, then proceeded to review my previous reverse engineering of the board. I discovered that I had missed some very important connections:

  As seen in the picture above, IC201, which powers the video demodulating IC200 and the display module with 12V DC, is controlled by IC600. IC600 is an 8-bit CMOS microcomputer (a M38039G4HHP made by RENESAS). The updated KiCad schematic can be found in the FILES section.
  

• Off topic: new toy for reverse engineering

  Florian • 01/03/2022 at 03:00 • 0 comments

  A few months ago, I started reverse-engineering the main PCB. Using only my Galaxy S10 as a photography device, I took the best photo I could, imported it in Paint.net and traced back the PCB pattern. However, despite the relatively good camera specifications of the Galaxy S10, the board being quite large, after zooming in a bit this is the maximum details I could achieve:

  Not impossible to work with, but rather difficult. I would often see myself confirming the PCB pattern by directly checking the board, which made the reverse engineering process tedious and quite inefficient. I decided it was time to update my photography method but as I didn't want to spend a lot of money, rather than buying a good camera with a stand I looked for an alternative and ended buying this:

  This is a document camera, also known as a visual presenter. To put it simply, it's a digital version of an overhead projector. This particular model is a P30HD made by ELMO, a Japanese company specialized in document cameras. I bought it for just 3500 yens on Yahoo Auctions and chose it for a good reason: of all second-hand document cameras I found, this model offers the most powerful optical zoom (x16). Here's a list of all second-hand document cameras I found, along with their respective main specifications.

  The P30HD also features an HDMI output, an onboard screen, a D-SUB input and output port, a SD card/USB flash drive saving feature (need the remote to use it), a light and the ability to connect to a PC via ImageMate software (free proprietary software).

  To give you an idea of its optical zoom performance, here is a short video demonstrating the zoom capability (recorded using ImageMate software).

• So that's what it's for...

  Florian • 07/10/2021 at 03:02 • 0 comments

  Using LTspice XVII, I simulated the part of the display module circuit whose purpose I didn't fully understand. For the composite video signal source, I used the NTSC voltage source published here by Bordodynov. 

  And here is the simulation results:

  So it looks like this circuit is adding a small offset to the original signal, making it completely positive (no more signal falling under 0V). Since I know nothing about video signals, I assume there is AC and DC coupling for the composite video signal, and that the small display module works only with a DC-coupled signal?

  To help me understand better, I looked for some literature and found these:

  • Analog - ADALM2000 Diodes and Diode Circuits (2e. AC Coupling and DC Restoration)
  • maxim integrated - GET A GRIP ON CLAMPS, BIAS AND AC-COUPLED VIDEO SIGNALS
  • Analog Devices - AN-1603 (Rev. 0) DC Restoration Circuit for an AC-Coupled Video Driver
  • maxim integrated - How to Level Shift Video Signals for DC-Coupled Video Amplifiers/Filters
  • RENESAS - AN1700 Video Driving Techniques for Mobile Devices
  • LINEAR TECHNOLOGY - AN57 Video Circuit Collection

  From what I understand, the composite video signal coming out of the mainboard should be AC-coupled, and that small circuit in the display module performs DC restoration before feeding the composite signal to the LC749880T (Image Controller LSI for LCD-TV).

• Nothing when energized? Let's dig in

  Florian • 07/06/2021 at 14:25 • 0 comments

  To confirm the power voltage of the display module—as well as the output of the step-down DC-DC regulator (LM2736YMK)—I powered up the intercom and took some measurements using my multimeter. I focused primarily on the area where the display module connects to the mainboard, which looks like this:

  Unfortunately, even though the intercom was powered and responded when pressing the front "通話/終話" button, I couldn’t detect any voltage around the display module connection area. I initially suspected an issue with my multimeter, but after probing the transformer and nearby components, I confirmed the multimeter was working just fine.

  Since the initial measurements came up empty, I decided to reverse-engineer the traces going to the CN101 connector—and wow, that was a lot of work! But totally worth it. Here's what I discovered:

  • the mainboard provides 12V to the display module, and interestingly, this is derived from the video feed signal
  • the LM2736YMK on the display module does regulate down to 3.3V (as confirmed by calculations from its datasheet)
  • the video signal is FM modulated (the demodulation is handled by SANYO LA72910V IC)
  • pin 5 of CN101 connects to the mainboard's brightness control potentiometer 

  For more details, here is the schematic I created. You'll also find the Kicad file in the FILES section.

  My next step will be to simulate that part of the circuit I didn’t fully understand yet, to figure out its exact purpose. At the same time, I want to test the cheap 4.3" screen I bought a while ago—it has dual composite video inputs, so I’m hoping it’ll be as simple as hooking it up to the mainboard’s video output. Fingers crossed it works without too much hassle!

• More about that display module

  Florian • 06/27/2021 at 01:27 • 0 comments

  Let’s take a closer look at the display module: 

  The display module is labeled "TB10126 R" on the frame’s top side. The TFT display itself is made by AUO and marked with "06B806Z84B227I026A0U00 8501". Unfortunately, searching those keywords on Google didn’t yield any useful results, so I turned to the back of the module for more clues.

  There’s a 10-pin connector (CN101), but only 6 of the pins are actually connected. There is also 3 large ICs (one of them partially hidden under the ribbon cable):

  • left to CN101 connector: SANYO LC749880T ➡ Image controller LSI for LCD-TV 
  • top one: 501S417 1146MK07 MYS ➡ unknown
  • under the ribbon cable: XILINX XC9572XL ➡ High Performance CPLD

  From the SANYO image controller datasheet, one of its feature is ”CVBS, S-Video,YCbCr/YPbPr input" and a closer look at the input table shows 2 CVBS inputs, one S-Video input and one YCbCr/YPbPr input. As this controller is right next to the only connector on this display module, I traced all the pins connection with a multimeter and came up with the following schematic:

  To summarize:

  • pin 4, 6, 8 and 10 are GND
  • pin 9 appears to be Vin (likely 12V), which is stepped down to 3.3V via an LM2736
  • pin 7 is the composite video input, which goes through a... I don't know circuit and then to CVBS1 of the SANYO LC749880T
  • pin 1, 2, 3 and 4 are unknown - they connect to pin 2, 23, 22 and 2 of the unidentified IC

  Next time, I plan to confirm the input voltage of the display module, measure the output voltage of the LM2736, and simulate the circuit between the composite video input and the CVBS1 pin to better understand its function. I might also start analyzing the intercom mainboard circuitry to see how it interfaces with the display module.

• I got myself a new toy

  Florian • 06/22/2021 at 13:34 • 0 comments

  After a quick search on Mercari and Yahoo Auctions, I found someone selling a used video intercom unit along with a door intercom at a decent price—so I went ahead and bought it.

  First things first , let's see what's inside!

  A transformer, two PCBs, and a display module?

  The fact that the display is a standalone module is great news. If I can find a datasheet for it, I should be able to identify its pinout and understand how it connects to the intercom’s mainboard. That would make it much easier to figure out whether I can swap it for a larger display.

  Here are more photos of the pcbs: first the tiny one (seen on left)

  The mainboard one:

  And the same one, but this time back side:

  In my next log, I’ll take a closer look at the display module, try to dig up some information about it, and work on figuring out its pinout.

• First, gathering information

  Florian • 06/16/2021 at 10:41 • 0 comments

  So, what is it? 
  It's a video intercom, model GAM-2MK, made in 2008 by a Japanese company called Aiphone.

  A quick Google search and here is the company's website. From there, ダウンロード > 商品情報・データ・ソフトウェア and using the quick model search feature, we arrived to this page with all tbe download available documents: profile sketches (DWG and DXF) and product specifications. No manual though? Well with a bit more help from Google, here it is.

  From these few documents, I didn't learn much:

  • the display is a 2.5inch TFT
  • the model can only be connected to a GAX system
  • the connection diagram is as follow (RA1/RA2 carry the video signal, R3/R4 the sound signal)

  Maybe I could find more information by looking for documents related to the video entrance panel?
  Back on the manufacturer's site, a quick search with the word GAX and here is the video entrance panel. Unfortunately, there’s only a specification sheet available—and after reading through it, there’s nothing particularly useful.

  Well, I guess the best approach now is to find a used video intercom I can experiment with freely. I can’t really mess with the one installed in my apartment since I’m just renting, and I’d rather not risk damaging it.

View all 9 project logs