Davis Weather Wizard - Hacking the Serial Port



<><><><><><><><><><><><>

<>~PART ONE~ <>

NO USER SERVICEABLE PARTS INSIDE





Oh my,  it seems we are out of warranty!

*VOID* Hey now ~ look where they put the screw!

 If the truth be told - this is not the first time I was inside this unit. When I bought it the original unit none of the keys worked, so I returned it to the store to exchange it for this last remaining unit they had on the shelf.  But, when I got it home and found some of the keys were stuck I knew it would be fruitless to drive the 40mi. round trip to Fry's to return this second one. 

So, I did the logical thing - opened it up.  All it needed to fix it was that ribbon cable on the lower left corner of the unit had to get re-seated. (this is really why the label was so wrinkled in the first photo)

Late 20th century technology?

 Yeah, this reminds me of a device I designed in the late '90s.  Hybrid surface mount and through hole technologies.  I  had to smile when I opened this thing, I remember that device used the Intel 80C188 processor which only came as a Quad flat pack surface mount part. At that time, my bosses were terrified we could not work with such fine pitched parts. That part lead spacing looks gigantic compared to the stuff I work with now! 

The big square multi pin surface mount IC  is the microprocessor.  (Hummm... is it the old '188?   It is from the same era, but it's doubtfull as this one looks like it is a flash ROM part...I am pretty sure that one needed an external ROM part.....any clues?)


The first interesting thing is the parts that are missing.  It appears that this "NEW UNIVERSAL BOARD"  could also contain a barometric pressure and humidity sensors for the unit that Davis marketed as the "Perception II Model 7400".   As far as I know, they never had a "combo unit" that did all three parameters with  Wind, Barometer and Humidity.  Also, there are spots for for LEDs for back lighting the LCD display. I would love to have the schematic for this thing but it is not needed for this exercise!  The problem is to figure out which of the pins on  the weatherlink connector ( J3 Below)


The second thing we notice is there are no components which would like +/- 12V of a standard RS232 serial port.  It is all CMOS and LS - TTL 5V compatible hardware.   Most of the other components appear to be for analog switching and signal amplifiers.

Davis Wizard's Connectors

One other interesting thing to note is the layout.  The connectors sit right on top of the LCD display, making the circuits very difficult to trace, although I suspect that they simply go to ports on the processor so tracing will not lead us to the conclusion which goes to TxD or RxD.

DigiKey A9091-ND  CONN MOD 4-4 FLAT

The first task was to build a cable.  I found that the 4P/ 4C-connectors are not very common.  If you look carefully at most telecom connectors which were used for wired telephone extension cords they are actually 6 -position with 4-circuits,  the little 4p/4c connector cables you find typically have only the center two positions wired for handset plugs. 

The cable was a little more challanging to crimp as all I had were 6P crimper but the 4C 6P seeemed to do the job.

I used an unsoldered RJ9 connector on the 6P end to probe the wires.

Snooping with a DVM shows a few bits of possibly useful info.  Actually, the colors are a bit arbitrary, just happen the way I built this cable, but some of these readings may be the tell we need to get stuff out of the Wizard!  So for the 4 (P)ositions; we can see two have some (C)ircuit voltage values, P3 is most likely the ground connection, it traces back to the  (-) on the 9V battery and all the large tin plate on the circuit board, which is what I was really searching for, but I measured the other s as well.  P2 is connected to a  positive voltage 7.8V to be exact, and seems to be coming from the voltage regulated output (VR1 on the circuit board)  

Ah, So...  P2 may either be a driven line (output?) or the power source for an attached module.  The other positions P1 and P4  have a fractional voltage associated with them ~0.7 V  which can either be inputs or outputs, too early to determine at this stage, but they seem to be connected to something.  The other possibilities for example are; there needs to be a loop back combination of some of these signals ( i.e. one grounded or +) to signal the data logger is attached or a pull up resistor for an open collector output driver... Even a simple 4-wire hack can get complicated!

☺☺☺

Looking again at the serial protocol documents from Davis leads me to believe that the Wizard default seems to use a 2400 8/n/1 serial protocol.  It is easy to test multiple serial rates but this will be my starting point.

   if ( strcmp (argv [1], "1200") == 0 )
      initialize_serial_port (0x83);
   else
/*
  2400 baud, 8 data bits, no parity, one stop bit...
*/

Also, it is not clear that the Vantage's TEST<LF> instruction is even included in the earlier models.  What is for sure, that this is a very primitive communications protocol and even one bit difference in the serial data will most likely yield no response, a quiet protocol with no other prompts to indicate a bad command...sneaky. 

The only sequence I see that may let us know for sure we are in if we send a LF  (0x0A) we expect a LF CR (0x0A 0x0D) response. I checked all my serial program's settings (Procomm and TeraTerm - which I happen to have on my laptop)  there is no way to produce this single hex digit 0x0A sequence



It gets worse... the example programs don't even allude that that is included in the earlier models!  We do see an interesting commented out code snippet though... maybe hex 44 will produce an interesting output?:

//    put_serial_charnw (0x44);
    
//    printf ("'%c'\n", get_serial_charnw ());

So we may need to build a more complex command such as LOOP to see if it is alive!

      else if ( strncmp (line, "loop", 4) == 0 )
          {
          put_serial_string ("LOOP");
          a =  5;                           // Default 5 times.
          sscanf (line, "%s %u", command, &a);
          send_unsigned ((unsigned) (65536 - a));
          put_serial_char (0x0d);
          printf ("%x\n", get_serial_char ());

Which looks something like: "LOOP<0xFFFB><0x0D>"

...but I found a gem of a serial program which allows even sending these types of more complex commands:

http://sourceforge.net/projects/realterm/

SO the next tool I will need is a RS232 to 5 volt converter and trial and error on these found circuits to see if we can wake up the sleeping Wizard!

~Stay tuned~

New Rain Gauge for Davis Weather Wizard



Works!



Here is the first recorded rain event.  This modified unit works even better than I expected from the earlier post. The 0.09" was the exact amount reported from the official total taken less than 2 miles from this location, not the 0.02" per tip as the Acurite documentation stated which would have meant this would have been the indicated count for 0.18"   So this means the bucket volumes are compatible!

The patient arrives on the workbench! The tipping buckets attach through an interesting bit of injection molding genius.  The theory is similar to the water tight doors on the Titanic.   There is a high wall of plastic  water dam surrounding the electronics and tipping bucket assembly;  with no gasket of any kind!  The whole thing clamps to the bottom of the unit which is open to the wet world to let the water drain out from the buckets. 

   I guess if the water level tops the watertight doors, you are sunk anyway.

 Two small screws hold the electronics to the battery enclosure, the gap is where the water dam goes.  The spring is the antenna and the reed switch ( the part we need) is the little glass tube in the center of the board.

Transmitter

The plan was to ditch the electronics and just wire to the switch.  I changed the approach slightly when I saw the mounting for the reed switch was in fact part of the circuit board.  I guess I could have proceeded by removing the reed switch and hot gluing it to the top of the assembly, but in the interest of time and to keep the original alignment, and not introducing any axial rotation, to the switch, opted to leave the circuit board in place.   Passing the cable simply requires a small hole located where there is no interference to clamping the assembly together... It was a little hard to drill this right angle hole so I ended up chipping the plastic a bit, no harm though.

 Passing the cable through the assembly took a little thought so as to minimally compromise the water rejection scheme.

The wiring looks straightforward, I attached the grounded wired (RED / BLACK ) to the (-) side of the battery terminal ~ which worked OK

The "hot" side was originally wired as shown here, which in fact will NOT work as shown without a slight modification to the circuit board. 

If the "top" end of the reed switch remains connected to the rest of the transmitter circuit there is a low impedance path to ground, low enough anyway, that the counts will Not get detected by the Wizard! This is why we test! 

The battery was low on the camera so I did not get a pic of the modification but you can simply cut the lead as it enters the circuit board and attach the wires to the free end of the lead.  A dab of hot melt will hold the assembly together as the upper lead will no longer be connected to the board.  Alternatively, you can figure out which trace on the circuit board needs to be cut to keep the leads on the bottom side of  the board ~ it is up to you depending on how much circuit board re-work you are comfortable with.  Either way, should be fine.

The cable passes through the outer shell into the battery compartment and into the electronics compartment. With a reasonable service loop of wire; hot melt does the sealing for a water tight cable entry.