Saturday, January 21, 2012

Davis Weather Wizard - Hacking the Serial Port


<><><><><><><><><><><><>
<>~PART ONE~ <>




NO USER SERVICEABLE PARTS INSIDE



Oh my,  it seems we are out of warranty!

*VOID* Hey now ~ look where they put the screw!
 If the truth be told - this is not the first time I was inside this unit. When I bought it the original unit none of the keys worked, so I returned it to the store to exchange it for this last remaining unit they had on the shelf.  But, when I got it home and found some of the keys were stuck I knew it would be fruitless to drive the 40mi. round trip to Fry's to return this second one. 

So, I did the logical thing - opened it up.  All it needed to fix it was that ribbon cable on the lower left corner of the unit had to get re-seated. (this is really why the label was so wrinkled in the first photo)

Late 20th century technology?




 Yeah, this reminds me of a device I designed in the late '90s.  Hybrid surface mount and through hole technologies.  I  had to smile when I opened this thing, I remember that device used the Intel 80C188 processor which only came as a Quad flat pack surface mount part. At that time, my bosses were terrified we could not work with such fine pitched parts. That part lead spacing looks gigantic compared to the stuff I work with now! 

The big square multi pin surface mount IC  is the microprocessor.  (Hummm... is it the old '188?   It is from the same era, but it's doubtfull as this one looks like it is a flash ROM part...I am pretty sure that one needed an external ROM part.....any clues?)


The first interesting thing is the parts that are missing.  It appears that this "NEW UNIVERSAL BOARD"  could also contain a barometric pressure and humidity sensors for the unit that Davis marketed as the "Perception II Model 7400".   As far as I know, they never had a "combo unit" that did all three parameters with  Wind, Barometer and Humidity.  Also, there are spots for for LEDs for back lighting the LCD display. I would love to have the schematic for this thing but it is not needed for this exercise!  The problem is to figure out which of the pins on  the weatherlink connector ( J3 Below)


The second thing we notice is there are no components which would like +/- 12V of a standard RS232 serial port.  It is all CMOS and LS - TTL 5V compatible hardware.   Most of the other components appear to be for analog switching and signal amplifiers.
Davis Wizard's Connectors
One other interesting thing to note is the layout.  The connectors sit right on top of the LCD display, making the circuits very difficult to trace, although I suspect that they simply go to ports on the processor so tracing will not lead us to the conclusion which goes to TxD or RxD.
DigiKey A9091-ND  CONN MOD 4-4 FLAT




The first task was to build a cable.  I found that the 4P/ 4C-connectors are not very common.  If you look carefully at most telecom connectors which were used for wired telephone extension cords they are actually 6 -position with 4-circuits,  the little 4p/4c connector cables you find typically have only the center two positions wired for handset plugs. 



The cable was a little more challanging to crimp as all I had were 6P crimper but the 4C 6P seeemed to do the job.

I used an unsoldered RJ9 connector on the 6P end to probe the wires.

Snooping with a DVM shows a few bits of possibly useful info.  Actually, the colors are a bit arbitrary, just happen the way I built this cable, but some of these readings may be the tell we need to get stuff out of the Wizard!  So for the 4 (P)ositions; we can see two have some (C)ircuit voltage values, P3 is most likely the ground connection, it traces back to the  (-) on the 9V battery and all the large tin plate on the circuit board, which is what I was really searching for, but I measured the other s as well.  P2 is connected to a  positive voltage 7.8V to be exact, and seems to be coming from the voltage regulated output (VR1 on the circuit board)  

Ah, So...  P2 may either be a driven line (output?) or the power source for an attached module.  The other positions P1 and P4  have a fractional voltage associated with them ~0.7 V  which can either be inputs or outputs, too early to determine at this stage, but they seem to be connected to something.  The other possibilities for example are; there needs to be a loop back combination of some of these signals ( i.e. one grounded or +) to signal the data logger is attached or a pull up resistor for an open collector output driver... Even a simple 4-wire hack can get complicated!


☺☺☺


Looking again at the serial protocol documents from Davis leads me to believe that the Wizard default seems to use a 2400 8/n/1 serial protocol.  It is easy to test multiple serial rates but this will be my starting point.


   if ( strcmp (argv [1], "1200") == 0 )
      initialize_serial_port (0x83);
   else
/*
  2400 baud, 8 data bits, no parity, one stop bit...
*/


Also, it is not clear that the Vantage's TEST<LF> instruction is even included in the earlier models.  What is for sure, that this is a very primitive communications protocol and even one bit difference in the serial data will most likely yield no response, a quiet protocol with no other prompts to indicate a bad command...sneaky. 

The only sequence I see that may let us know for sure we are in if we send a LF  (0x0A) we expect a LF CR (0x0A 0x0D) response. I checked all my serial program's settings (Procomm and TeraTerm - which I happen to have on my laptop)  there is no way to produce this single hex digit 0x0A sequence



It gets worse... the example programs don't even allude that that is included in the earlier models!  We do see an interesting commented out code snippet though... maybe hex 44 will produce an interesting output?:

//    put_serial_charnw (0x44);
    
//    printf ("'%c'\n", get_serial_charnw ());


So we may need to build a more complex command such as LOOP to see if it is alive!


      else if ( strncmp (line, "loop", 4) == 0 )
          {
          put_serial_string ("LOOP");
          a =  5;                           // Default 5 times.
          sscanf (line, "%s %u", command, &a);
          send_unsigned ((unsigned) (65536 - a));
          put_serial_char (0x0d);
          printf ("%x\n", get_serial_char ());



Which looks something like: "LOOP<0xFFFB><0x0D>"

...but I found a gem of a serial program which allows even sending these types of more complex commands:

http://sourceforge.net/projects/realterm/

SO the next tool I will need is a RS232 to 5 volt converter and trial and error on these found circuits to see if we can wake up the sleeping Wizard!


~Stay tuned~

No comments:

Post a Comment