CO Detector Hack – Part 2
Now that I have headers and pins soldered on the CO detector, I’m ready to start taking some measurements with my test equipment. As I mentioned before, I prefer to use them in a certain order. First I’ll start by taking resistance measurements with my multimeter.
One of the header pins is labeled GND1. I want to test if this ground is common to some other points on the board. Besides the negative battery terminal, this pin was also common with another pad labeled TP2. TP2 is located on the lower edge of the board, next to the positive terminal of SEN2 (the component that looks like a brown AA battery). Lastly, SW1 had a common ground on the top side of the switch.
Next I’ll take voltage measurements using GND1 as my reference. Here are the results of the readings.
Battery Positive Terminal, 9 VDC
SENS2 Negitive Terminal, 300 mVDC
SENS2 Positive Terminal, 300 mVDC
VPP1, 3.3 VDC
VDD1, 3.3 VDC
ICSPDATA/RS232, 60 mVDC
ICSPCLK/TRIG, 0 VDC
F3, 0 VDC
F2, -30 mVDC
H1-A, 0 VDC
H1-B, 0 VDC
H1-C, 0 VDC
LED1-A, 3.3 VDC
LED1-B, 3.3 VDC
SW1, 3.3 VDC
With my initial continuity and voltage readings done, I’m ready to take measurements with the oscilloscope. I’m using a Paralax Prop Scope that I’ve had for several years. It requires using Windows to run, but it is cost effective.
All of my readings were using GND1 as the reference. The LED1-B red onboard indicator LED had a steady 3.3 VDC reading, this changed to 0 VDC when it was lit. During an alarm test, this led flashes 4 times with a 100 ms on / off cycle. The LED1-A mirrored the behavior of LED1-B.
The H1-A, B, and C terminals are connected to the buzzer alarm. The readings on these terminals during an alarm event was on average 5 VDC. The multimeter missed this reading, but it was easy to see this with the oscilloscope.
The last and most interesting reading was from the ICSPDATA/RS232 terminal. Here I saw a data stream that had a peak reading of 3.3 VDC. It was easy to see the packet length using the oscilloscope. The packets are 40 ms bursts that occur at roughly 1 second intervals.
Now with my intial readings done, I’m rather comfortable using my logic analyzer on the CO Detector to find out more details. I’m using a Saleae logic analyzer.
I connected ground from the logic analyzer to the GND1 pin on the CO Detector. Then I connect lead 7 from the logic analyzer to teh ISCPDATA terminal on the CO Detector. I set my trigger to rise since the standby state is zero, then started my capture. I went through all of the available analyzers in the software and settled on Async Serial with the default values. None of the data seemed to make sense, so I’m not absolutely sure that I’m using the correct protocol.
At any rate, I saved my sample and I can revisit this at a later time. From what I’ve gathered, ISCP is used to program PIC chips after the board is manufactured. Based on the board design and what appears to be missing components, I’m going to assume that this board is capable of other features. This link provided me some insights about ISCP, http://pic-microcontroller.com/understanding-icsp-pic-microcontrollers/
Now with the board headers and terminals in place, I’m ready to interface devices to the CO Detector.