Mystery Box

[Fred Fuque]

Suppose you had a mystery box with 6 buttons on the top and a
4-conductor cable coming out the back. You know that the other end of
the cable is connected to an embedded microcontroller, but you don't
know what's inside the mystery box itself (and you can't open the
box).

Using an oscilloscope, you observe that the 4 wires in the cable have
the following voltages when the system is powered on:

Wire 1 has 5VDC relative to Wire 2.
Wire 2 appears to be a ground.
Wire 3 has ~9VDC relative to Wire 2.
Wire 4 has 5VDC relative to Wire 2.

You also observe that the voltages on wires 1 and 4 change when you
press the buttons:

When no buttons are pressed, wires 1 and 4 have 5V as noted
previously.
When button 1 is pressed, wire 1 drops to 4V.
When button 2 is pressed, wire 1 drops to 3V.
When button 3 is pressed, wire 1 drops to 0V.
When button 4 is pressed, wire 4 drops to 4V.
When button 5 is pressed, wire 4 drops to 3V.
When button 6 is pressed, wire 4 drops to 0V.

What's your best guess regarding the circuit inside the box?

 

[wolahr]

On Mar 10, 5:04 am, Fred Fuque <fu...@hotmail.com> wrote:

Suppose you had a mystery box with 6 buttons on the top and a
4-conductor cable coming out the back.  You know that the other end of
the cable is connected to an embedded microcontroller, but you don't
know what's inside the mystery box itself (and you can't open the
box).

Using an oscilloscope, you observe that the 4 wires in the cable have
the following voltages when the system is powered on:

Wire 1 has 5VDC relative to Wire 2.
Wire 2 appears to be a ground.
Wire 3 has ~9VDC relative to Wire 2.
Wire 4 has 5VDC relative to Wire 2.

You also observe that the voltages on wires 1 and 4 change when you
press the buttons:

When no buttons are pressed, wires 1 and 4 have 5V as noted
previously.
When button 1 is pressed, wire 1 drops to 4V.
When button 2 is pressed, wire 1 drops to 3V.
When button 3 is pressed, wire 1 drops to 0V.
When button 4 is pressed, wire 4 drops to 4V.
When button 5 is pressed, wire 4 drops to 3V.
When button 6 is pressed, wire 4 drops to 0V.

What's your best guess regarding the circuit inside the box?

Is this your lab homework or something?

 

[Varactor]

On Mar 10, 6:04 pm, Fred Fuque <fu...@hotmail.com> wrote:

Suppose you had a mystery box with 6 buttons on the top and a
4-conductor cable coming out the back.  You know that the other end of
the cable is connected to an embedded microcontroller, but you don't
know what's inside the mystery box itself (and you can't open the
box).

Using an oscilloscope, you observe that the 4 wires in the cable have
the following voltages when the system is powered on:

Wire 1 has 5VDC relative to Wire 2.
Wire 2 appears to be a ground.
Wire 3 has ~9VDC relative to Wire 2.
Wire 4 has 5VDC relative to Wire 2.

You also observe that the voltages on wires 1 and 4 change when you
press the buttons:

When no buttons are pressed, wires 1 and 4 have 5V as noted
previously.
When button 1 is pressed, wire 1 drops to 4V.
When button 2 is pressed, wire 1 drops to 3V.
When button 3 is pressed, wire 1 drops to 0V.
When button 4 is pressed, wire 4 drops to 4V.
When button 5 is pressed, wire 4 drops to 3V.
When button 6 is pressed, wire 4 drops to 0V.

What's your best guess regarding the circuit inside the box?

It's useless or broken.

Cheers

 

[Fred]

In message
<1a7a5080-cc93-4afc-b29b-73aeb2a4fc64@e3g2000vbe.googlegroups.com>,
jrwalliker@gmail.com wrote:

What's your best guess regarding the circuit inside the box?

Six switches and some resistors.

OK, but wired how? A set of SPST momentary switches, each wired
between +5V and GND through a resistor?

This encoding technique has been
used in automotive applications to minimise the number of connections
that need to cross slip rings or flexible interconnects when getting
signals from the steering wheel of a vehicle.

In this case, it's the control box for a radar detector:

http://www.magazinultau.ro/images/produse/detectoare_radar/Detector-radar-Escort-Passport-9500ci--57358.jpg

I want to replace the original control module with switches that look
more "factory" but I'm having trouble figuring out how to wire it.

Thanks for your help!

 

What's your best guess regarding the circuit inside the box?

Six switches and some resistors. This encoding technique has been
used in automotive applications to minimise the number of connections
that need to cross slip rings or flexible interconnects when getting
signals from the steering wheel of a vehicle. The microcontroller
probably had a couple of spare adc channels available. It avoids EMC
issues associated with digital multiplexing on unshielded wires and is
very cheap.

John

 

[ehsjr]

Fred Fuque wrote:

Suppose you had a mystery box with 6 buttons on the top and a
4-conductor cable coming out the back. You know that the other end of
the cable is connected to an embedded microcontroller, but you don't
know what's inside the mystery box itself (and you can't open the
box).

Using an oscilloscope, you observe that the 4 wires in the cable have
the following voltages when the system is powered on:

Wire 1 has 5VDC relative to Wire 2.
Wire 2 appears to be a ground.
Wire 3 has ~9VDC relative to Wire 2.
Wire 4 has 5VDC relative to Wire 2.

You also observe that the voltages on wires 1 and 4 change when you
press the buttons:

When no buttons are pressed, wires 1 and 4 have 5V as noted
previously.
When button 1 is pressed, wire 1 drops to 4V.
When button 2 is pressed, wire 1 drops to 3V.
When button 3 is pressed, wire 1 drops to 0V.
When button 4 is pressed, wire 4 drops to 4V.
When button 5 is pressed, wire 4 drops to 3V.
When button 6 is pressed, wire 4 drops to 0V.

What's your best guess regarding the circuit inside the box?

3 ---+-------------------------+
| |
[R] [R]
| |
+---+----+----+---Wire1 +---+----+---+---Wire4
| | | | | | | |
[R][PB1][PB2][PB3] [R][PB4][PB5][PB6]
| | | | | | | |
| [R] [R] | | [R] [R] |
| | | | | | | |
2 ---+---+----+----+-----------+---+----+---+

6 N/O pushbuttons and 8 resistors.

Ed

 

[Fred]

In message <Pwxtl.2408$%u5.40@nwrddc01.gnilink.net>, ehsjr
<ehsjr@NOSPAMverizon.net> wrote:

What's your best guess regarding the circuit inside the box?

3 ---+-------------------------+
| |
[R] [R]
| |
+---+----+----+---Wire1 +---+----+---+---Wire4
| | | | | | | |
[R][PB1][PB2][PB3] [R][PB4][PB5][PB6]
| | | | | | | |
| [R] [R] | | [R] [R] |
| | | | | | | |
2 ---+---+----+----+-----------+---+----+---+

6 N/O pushbuttons and 8 resistors.

Thanks, Ed.

One thing I forgot to mention: there is 5V present on 1 and 4 even
when the control module is unplugged from the main unit (i.e. the
embedded micro with the two ADC channels is supplying 5V on these
lines even though they are apparently outputs from the control module
to the micro). Is the above circuit consistent with this observation?

Thanks again!

 

[Jasen Betts]

On 2009-03-10, jrwalliker@gmail.com <jrwalliker@gmail.com> wrote:

What's your best guess regarding the circuit inside the box?

Six switches and some resistors. This encoding technique has been
used in automotive applications to minimise the number of connections
that need to cross slip rings or flexible interconnects when getting
signals from the steering wheel of a vehicle. The microcontroller
probably had a couple of spare adc channels available. It avoids EMC
issues associated with digital multiplexing on unshielded wires and is
very cheap.

I've seem it used in a VCR too, some even had 2.5mm sockets on the
back you could plug a resistor array based remote control into.

but the remote used only 2 wires.

You don't even need a full ADC, a RC multivibrator is enough,

 

[Jasen Betts]

On 2009-03-10, Fred <fuque@hotmail.com> wrote:

In message
1a7a5080-cc93-4afc-b29b-73aeb2a4fc64@e3g2000vbe.googlegroups.com>,
jrwalliker@gmail.com wrote:

What's your best guess regarding the circuit inside the box?

Six switches and some resistors.

OK, but wired how? A set of SPST momentary switches, each wired
between +5V and GND through a resistor?

This encoding technique has been
used in automotive applications to minimise the number of connections
that need to cross slip rings or flexible interconnects when getting
signals from the steering wheel of a vehicle.

In this case, it's the control box for a radar detector:

http://www.magazinultau.ro/images/produse/detectoare_radar/Detector-radar-Escort-Passport-9500ci--57358.jpg

I want to replace the original control module with switches that look
more "factory" but I'm having trouble figuring out how to wire it.

Wire 1 has 5VDC relative to Wire 2.
Wire 2 appears to be a ground.
Wire 3 has ~9VDC relative to Wire 2.
Wire 4 has 5VDC relative to Wire 2.

You also observe that the voltages on wires 1 and 4 change when you
press the buttons:

When no buttons are pressed, wires 1 and 4 have 5V as noted
previously.
When button 1 is pressed, wire 1 drops to 4V.
When button 2 is pressed, wire 1 drops to 3V.
When button 3 is pressed, wire 1 drops to 0V.
When button 4 is pressed, wire 4 drops to 4V.
When button 5 is pressed, wire 4 drops to 3V.
When button 6 is pressed, wire 4 drops to 0V.

What's your best guess regarding the circuit inside the box?

to decode these use 'view source' in the options menu,

3 ---+
|
10K
|
1 ---+-----+--------+--------+
| | | |
12K 22K 8.6K |
| | | |
| O | O | O |
| | 1 | 2 | 3
| O | O | O |
| | | |
2 ---+-----+--------+--------+


3 ---+
|
10K
|
4 ---+-----+--------+--------+
| | | |
12K 22K 8.6K |
| | | |
| O | O | O |
| | 4 | 5 | 6
| O | O | O |
| | | |
2 ---+-----+--------+--------+


where K is not nececarrily kilohms but is a constant.

measure resistance from 3 to 2 while buttons 3 and 6 are depressed.
divide that by 5 to find 'K'.

 

[Jasen Betts]

On 2009-03-11, Fred <fuque@hotmail.com> wrote:

In message <Pwxtl.2408$%u5.40@nwrddc01.gnilink.net>, ehsjr
ehsjr@NOSPAMverizon.net> wrote:

What's your best guess regarding the circuit inside the box?

3 ---+-------------------------+
| |
[R] [R]
| |
+---+----+----+---Wire1 +---+----+---+---Wire4
| | | | | | | |
[R][PB1][PB2][PB3] [R][PB4][PB5][PB6]
| | | | | | | |
| [R] [R] | | [R] [R] |
| | | | | | | |
2 ---+---+----+----+-----------+---+----+---+

6 N/O pushbuttons and 8 resistors.

Thanks, Ed.

One thing I forgot to mention: there is 5V present on 1 and 4 even
when the control module is unplugged from the main unit (i.e. the
embedded micro with the two ADC channels is supplying 5V on these
lines even though they are apparently outputs from the control module
to the micro). Is the above circuit consistent with this observation?

possibly.

disconnect it and then measure it again,

 

[Fred]

In message <gp8aa1$i6p$2@reversiblemaps.ath.cx>, Jasen Betts
<jasen@xnet.co.nz> wrote:

One thing I forgot to mention: there is 5V present on 1 and 4 even
when the control module is unplugged from the main unit (i.e. the
embedded micro with the two ADC channels is supplying 5V on these
lines even though they are apparently outputs from the control module
to the micro). Is the above circuit consistent with this observation?

possibly.

disconnect it and then measure it again,

OK, I did that, and verified that there is 5V present on 1 and 4 even
when the control module is unplugged. I also noticed something else:
the voltage on 3 also varies.

Let me backtrack a bit.

The control module has a total of 6 buttons: an on/off button on top,
and 5 buttons on the front.

http://www.magazinultau.ro/images/produse/detectoare_radar/Detector-radar-Escort-Passport-9500ci--57358.jpg

It's not apparent from the photograph, but the 5 buttons on the front
are back-lit with little blue lights. The "SENS," "MRK," "VOL," and
"BRT" buttons are lit as a group, and the "MUTE" button is lit
independently of the other 4. The main unit makes the Mute button
flash when radar is detected.

While I was poking around with the 'scope I discovered that when the
main unit is "off" (it's not completely powered off since it is still
supplying 5V to wires 1 and 4) there is 0V present on wire 3. When the
unit is turned "on" and the 4 corner buttons are lit, wire 3 has
~4.5V, and when all 5 buttons are lit ~9V is present on wire 3.

All of this seems to suggest that the voltage on wire 3 is only used
to light the buttons and is not the source of the voltage present on 1
and 4. Somehow the 5V on 1 and 4 serves as both a reference voltage
for the switches and the input to the ADC.

 

[ehsjr]

Fred wrote:

In message <gp8aa1$i6p$2@reversiblemaps.ath.cx>, Jasen Betts
jasen@xnet.co.nz> wrote:


One thing I forgot to mention: there is 5V present on 1 and 4 even
when the control module is unplugged from the main unit (i.e. the
embedded micro with the two ADC channels is supplying 5V on these
lines even though they are apparently outputs from the control module
to the micro). Is the above circuit consistent with this observation?

possibly.

disconnect it and then measure it again,


OK, I did that, and verified that there is 5V present on 1 and 4 even
when the control module is unplugged. I also noticed something else:
the voltage on 3 also varies.

Let me backtrack a bit.

The control module has a total of 6 buttons: an on/off button on top,
and 5 buttons on the front.

http://www.magazinultau.ro/images/produse/detectoare_radar/Detector-radar-Escort-Passport-9500ci--57358.jpg

It's not apparent from the photograph, but the 5 buttons on the front
are back-lit with little blue lights. The "SENS," "MRK," "VOL," and
"BRT" buttons are lit as a group, and the "MUTE" button is lit
independently of the other 4. The main unit makes the Mute button
flash when radar is detected.

While I was poking around with the 'scope I discovered that when the
main unit is "off" (it's not completely powered off since it is still
supplying 5V to wires 1 and 4) there is 0V present on wire 3. When the
unit is turned "on" and the 4 corner buttons are lit, wire 3 has
~4.5V, and when all 5 buttons are lit ~9V is present on wire 3.

All of this seems to suggest that the voltage on wire 3 is only used
to light the buttons and is not the source of the voltage present on 1
and 4. Somehow the 5V on 1 and 4 serves as both a reference voltage
for the switches and the input to the ADC.

That changes almost nothing:

-----------------
| Main Unit |
| Gnd +5 +5 +9* |
| | | | | |
| | [R] [R] | |
|__|___|___|___|__|
2| 1| 4| |3
| | | +----------------------+------> to corner lights
| | | |
| | +---------------------+ [Zd]
| | | |
| | | +-----> to remaining light
| | |
| +---+----+----+ +---+----+---+
| | | | | | | | |
| [R][PB1][PB2][PB3] [R][PB4][PB5][PB6]
| | | | | | | | |
| | [R] [R] | | [R] [R] |
| | | | | | | | |
+---+---+----+----+-----------+---+----+---+


The +9 in the diagram has a * next to it - apparently it
can be 0v, +5V or +9V per your revised measurements.

Logically, the circuit is about the same - the change is
in the voltage you measured at wire 3, and the location
of the resistors in the main unit instead of the control
unit.

Ed

 

[Jasen Betts]

On 2009-03-12, Fred <fuque@hotmail.com> wrote:

In message <gp8aa1$i6p$2@reversiblemaps.ath.cx>, Jasen Betts
jasen@xnet.co.nz> wrote:

One thing I forgot to mention: there is 5V present on 1 and 4 even
when the control module is unplugged from the main unit (i.e. the
embedded micro with the two ADC channels is supplying 5V on these
lines even though they are apparently outputs from the control module
to the micro). Is the above circuit consistent with this observation?

possibly.

disconnect it and then measure it again,

OK, I did that, and verified that there is 5V present on 1 and 4 even
when the control module is unplugged. I also noticed something else:
the voltage on 3 also varies.

Let me backtrack a bit.

The control module has a total of 6 buttons: an on/off button on top,
and 5 buttons on the front.

http://www.magazinultau.ro/images/produse/detectoare_radar/Detector-radar-Escort-Passport-9500ci--57358.jpg

It's not apparent from the photograph, but the 5 buttons on the front
are back-lit with little blue lights. The "SENS," "MRK," "VOL," and
"BRT" buttons are lit as a group, and the "MUTE" button is lit
independently of the other 4. The main unit makes the Mute button
flash when radar is detected.

While I was poking around with the 'scope I discovered that when the
main unit is "off" (it's not completely powered off since it is still
supplying 5V to wires 1 and 4) there is 0V present on wire 3. When the
unit is turned "on" and the 4 corner buttons are lit, wire 3 has
~4.5V, and when all 5 buttons are lit ~9V is present on wire 3.

All of this seems to suggest that the voltage on wire 3 is only used
to light the buttons and is not the source of the voltage present on 1
and 4. Somehow the 5V on 1 and 4 serves as both a reference voltage
for the switches and the input to the ADC.

that makes sense, eg:

+5V ----+
|
R
|
input---+----- > to buttons (wire2 or 4)


but really you should measure the control unit in isolation,

in particular measure wire-to-wire resistance with the different
buttons pressed.

the layout of a circuit to get the same behavior should be fairly
obvious.

duplicating the illumination could be a little harder.

 

[Fred]

In message <gpapd0$d12$1@reversiblemaps.ath.cx>, Jasen Betts
<jasen@xnet.co.nz> wrote:

but really you should measure the control unit in isolation,

in particular measure wire-to-wire resistance with the different
buttons pressed.

Sorry, I misunderstood what you were asking.

I measured ~3.0 Kohms between 1 and 2 when the "Mute" button is
pressed, and open circuit at all other times. Similarly, there is ~1.5
Kohms between 2 and 4 when the "On/Off" button is pressed, and open
circuit at all other times. None of the other 4 buttons change any
resistance readings.

Does this mean that only the "On/Off" and "Mute" buttons are passive,
whereas the other 4 buttons have some active circuitry behind them?

duplicating the illumination could be a little harder.

Fortunately I don't care about duplicating the illumination behavior.
If my substitute buttons are capable of being illuminated, I'd rather
have them light up at the same time as the rest of the instrumentation
in the car.

 

[Jasen Betts]

On 2009-03-13, Fred <fuque@hotmail.com> wrote:

In message <gpapd0$d12$1@reversiblemaps.ath.cx>, Jasen Betts
jasen@xnet.co.nz> wrote:

but really you should measure the control unit in isolation,

in particular measure wire-to-wire resistance with the different
buttons pressed.

Sorry, I misunderstood what you were asking.

I measured ~3.0 Kohms between 1 and 2 when the "Mute" button is
pressed, and open circuit at all other times. Similarly, there is ~1.5
Kohms between 2 and 4 when the "On/Off" button is pressed, and open
circuit at all other times. None of the other 4 buttons change any
resistance readings.

Does this mean that only the "On/Off" and "Mute" buttons are passive,
whereas the other 4 buttons have some active circuitry behind them?

previously you called the buttons 1, 2, 3, 4, 5, and 6

are "on-off" and "mute" buttons that produce a 0V output, or something else?

duplicating the illumination could be a little harder.

Fortunately I don't care about duplicating the illumination behavior.
If my substitute buttons are capable of being illuminated, I'd rather
have them light up at the same time as the rest of the instrumentation
in the car.

 

[Fred]

In message <gpd1ps$66f$5@reversiblemaps.ath.cx>, Jasen Betts
<jasen@xnet.co.nz> wrote:

On 2009-03-13, Fred <fuque@hotmail.com> wrote:
In message <gpapd0$d12$1@reversiblemaps.ath.cx>, Jasen Betts
jasen@xnet.co.nz> wrote:

but really you should measure the control unit in isolation,

in particular measure wire-to-wire resistance with the different
buttons pressed.

Sorry, I misunderstood what you were asking.

I measured ~3.0 Kohms between 1 and 2 when the "Mute" button is
pressed, and open circuit at all other times. Similarly, there is ~1.5
Kohms between 2 and 4 when the "On/Off" button is pressed, and open
circuit at all other times. None of the other 4 buttons change any
resistance readings.

Does this mean that only the "On/Off" and "Mute" buttons are passive,
whereas the other 4 buttons have some active circuitry behind them?

previously you called the buttons 1, 2, 3, 4, 5, and 6

are "on-off" and "mute" buttons that produce a 0V output

Yes.

 

[Fred]

It occurs to me that maybe I don't need to *replace* the control
module; perhaps augmenting it will do. My goal with all of this is to
not have an obvious and easily-recognizable radar detector control
module sitting out in the open for cops and/or thieves to see. The
problem with simply tucking the control module away in the ashtray or
the center armrest is that I will need to hit the "Mute" button
occasionally while driving, and I'll want to be able to do that
without having to open up some cubbyhole or take my eyes off the road.

So I thought of this:

+------+ +-------+
| | | |
| C M |1------+------->| |
| o o | | | |
| n d |2---------+---->| M U |
| t u | | | | a n |
| r l |3-------------->| i i |
| o e | | | | n t |
| l |4-------------->| |
| | | | | |
+------+ | | +-------+
| |
| |
[R] | (R = 3Kohms)
| |
| o |
| |
| o |
| |
| |
+--+

I could continue to use the original control module, but tuck it away
inside the armrest so that it's out of sight. I could then tap into
two of the wires and add a new momentary pushbutton switch in parallel
to provide a readily-accessible Mute button. This new button could
easily blend in and look "factory," achieving the desired goal of
stealth. Meanwhile, the other buttons are still available, and since I
don't need to change the settings very often (and not at all while the
car is moving) it's not a problem to have those buttons hidden away.

Any obvious problems with this approach? Would anything blow up if I
were to foolishly press both the real Mute button and my new
"piggyback" Mute button at the same time?