• Tapping into communication

    Jim • 01/17/2022 at 03:59 • 0 comments

    WARNING: WHEN PLUGGED IN, THERE ARE HIGH VOLTAGES INSIDE THE CASE THAT CAN CAUSE FIRE OR FATALITIES, EVEN FOR "GROUND" POINTS. ALWAYS UNPLUG AND WAIT FOR CAPACITORS TO DISCHARGE BEFORE OPENING THE CASE.

    In the last post, we identified a 4-conductor ribbon cable that could be a good starting point for reverse engineering the induction cooktop. Looking at the boards where the ribbon cable connects to the board, each of the signals are actually very well marked in the silkscreen:

    It's apparent that the first wire is ground, the second is +5V supply, and the RXD/TXD wires suggest a UART interface between the control board and the driver board. If we can tap into the UART lines to decipher the protocol, we would be able to communicate with both boards.

    The cooktop has a non-isolated power supply, which means even low-voltage lines like +5V or even GND are not at earth ground potential. If we probe these lines directly, we can expose ourselves to dangerous power line voltage. To make the RXD/TXD lines safe to probe, I chose to use an Analog Devices ADUM1285 optocoupler to isolate both channels, and brought only the isolated lines to outside of the cooktop case, where I connected them to a logic analyzer.

    And indeed, the RXD/TXD lines show the UART protocol running at 9600 baud rate. The control board first sends a packet consisting of 10 bytes. Immediately after that, the driver board responds with another packet also consisting of 10 bytes. This ping-pong sequence repeats 10 times every second, even while the cooktop is idle.

    Now that we can see the communication between the driver and control boards, the focus for the next post will be to decipher the packet protocol, and to make some sense out of the data!

  • Initial teardown

    Jim • 01/11/2022 at 03:51 • 0 comments

    WARNING: WHEN PLUGGED IN, THERE ARE HIGH VOLTAGES INSIDE THE CASE THAT CAN CAUSE FIRE OR FATALITIES. ALWAYS UNPLUG AND WAIT FOR CAPACITORS TO DISCHARGE BEFORE OPENING THE CASE.

    I recently bought a AmazonBasics 1800W induction cooktop for making hot pot in the winter. While inexpensive, the cooktop only comes with basic functionality (I guess the AmazonBasics brand is fitting). Even its existing functionality like constant-temperature mode doesn't seem to work very well. That's when I got the idea of hacking the cooktop to improve and extend its functionality. Right now, the vision is to be able to monitor and control the cooktop from my phone.

    A quick search on the web revealed several similar projects:

    I'm sure these resources will come in handy during this project.

    Opening the cooktop only involves unscrewing four screws. Once opened, there are three major components inside:

    • Control board that contains buttons, LEDs, the 7-segment display, etc.
    • Inductive coil that transfers energy to the cooking pan.
    • Driver board underneath the coil that drives the coil.

    On the other side of the control board is a BYD BF6912AS11 microcontroller. On the other side of the driver board is a CHK S011 controller, designed specifically for induction cooktops. Between the control board and the driver board is a 4-conductor ribbon cable, which seems like a good point to start reverse engineering. That'll be the focus for the next post!