Tagged: Reverse Engineering Toggle Comment Threads | Keyboard Shortcuts

  • schoolie 12:43 am on June 17, 2013 Permalink | Reply
    Tags: , , , Reverse Engineering   

    Hacking the Heath/Zenith SL-5408 to run on DC 

    I’ve used the Zenith SL-5408 motion activated security light as a motion detector for my Bird Blaster. In version 1.0, I couldn’t get the detector to work off battery power, even though the whole circuit runs at 5V levels. Now that I’ve acquired a little more electronics equipment and knowledge, I thought I’d take another crack at powering the detector from a low voltage source.

    I started this round of reverse engineering by drawing out the power supply circuit in Eagle, adding components until I had reached the point where regulated 5V was present in the circuit. At this point, I didn’t notice anything that I hadn’t noticed the last time around. It was fairly obvious where the 5V supply originated, and that the PIR and timing circuit only used the 5V supply. The schematic is shown below. The 22 pin connection shown on the right is the point where the chip on board processor (the brains of the motion detector) is soldered in at a right angle to the main circuit board.

    SL-5408 Motion Detector Power Supply Circuit

    (Read the rest of this post…)

    • Kenney 1:07 pm on July 30, 2013 Permalink | Reply

      Great hack ! I have done a similar one to turn the output into a switch and delete the 120v . Good to know these can be hacked to use DC . How can I reduce the test function to 1second?

      • schoolie 2:51 pm on July 30, 2013 Permalink | Reply

        You’re wanting the output to remain active for one second instead of the stock five seconds right?

        If you’re using the arduino like I have in this post, you could just read in the output from the detector, then output a 1 sec signal through a separate relay or transistor controlled by the arduino. The only catch is that the detector will still reset on it’s normal schedule.

        I’ve also wondered if sending a faster clock signal to the detector would work. For example, sending a 300Hz square wave instead of a 60Hz square wave may reduce the test time from 5 sec to 1 sec. This would only work an the detector I used, and may not work at all :).

        What motion detector are you using?

    • Kenney 3:36 pm on July 30, 2013 Permalink | Reply

      Pretty sure its the same home depot Heath, I’ll have to double check. My setup is to scare deer out of the yard with stored rainwater (city water to expensive) and compressed air. I get a lot of false detections during the day with clouds causing cooler and hotter spots.
      OK with using 110v in and hack for switched out. But with the 5 second on and continual false starts would like to cut it back using less air/water. Looking at a time delay so it will cycle maybe 30 seconds before it would restart. Think Arduino is the only answer?

      • schoolie 3:55 pm on July 30, 2013 Permalink | Reply

        Something like the 555 circuit I used for the bird blaster should be adequate. The circuit in that post has 2 second ON time with control pulses at the beginning and end. I don’t think it would be too hard to incorporate a 30 second reset delay.

        What are you using to control the water flow or compressed air? That will determine what the control singals need to look like. Are you currently just using the motion detector’s relay?

        • Kenney 4:41 pm on July 30, 2013 Permalink | Reply

          Yes, just using the relay in the motion detector. Looks like I need to incorporate your 555 controlling circuit. Now all I need is to learn to read the schematic.

          • schoolie 5:00 pm on July 30, 2013 Permalink | Reply

            Honestly, using the Arduino may require less investment of time and materials if you’re new to electronics.

            If you’re looking to learn how this stuff works, starting with the 555 is definitely the way to go. If you just want a result, Arduino may result in less frustration 🙂

    • Kenney 8:02 pm on July 30, 2013 Permalink | Reply

      Knowing what I need, which arduino kit would you recommend? I have two motion sensors hooked to one 25vac ( blind spot) sprinkler valve. Pretty sure 12vdc would operate it if need be.

      • schoolie 11:10 pm on July 30, 2013 Permalink | Reply

        The standard Arduino Uno R3 is the simplest choice for getting started. You can get it at RadioShack or sparkfun.com. You’ll also need some resistors, an NPN transistor, a diode, and a relay with a 5v coil to actuate the valves. A 12v adapter that fits the Arduino’s power jack would be handy as well. Add a breadboard to build the circuit on (or proto board if you want to solder, maybe just skip the board entirely and solder the components directly together) and you’re good to go :-).

        Your motion detector will need to have the relay modded too if you haven’t already done so.

    • Kenney 7:56 am on July 31, 2013 Permalink | Reply

      Lots of good info, has me headed in the right direction to tweek this thing the way I want it.
      Many Thanks

      • schoolie 3:48 pm on July 31, 2013 Permalink | Reply

        Great. I’d love to hear how things go if/when you work on it.


  • schoolie 7:57 pm on March 27, 2013 Permalink | Reply
    Tags: , , Reverse Engineering   

    MC-2100 Control Algorithms – What I’ve learned so far… 

    I was helped out immensely by receiving a reverse engineered schematic of the MC-2100. That enabled me to examine and begin to understand how the hardware of the controller worked together to control the motor. However, it didn’t have much to say about the algorithms contained in the Cypress PSoC serving as the controller’s brain.

    Throughout the process of developing a control circuit to drive the controller, I’ve learned quite a bit about the software in the PSoC, and I’d like to share the information. The best way I can think to accomplish that is to document the timeline of my testing, and comment on the results. There’s a lot to read here, but if you’re trying to figure this thing out, I think it will be helpful. Here goes!

    (Read the rest of this post…)

    • Stuart 9:39 pm on May 5, 2013 Permalink | Reply

      My treadmill quit working and I noticed something from your article. My red LED is solid which you say means no speed voltage. When I try to start the machine it powers the motors for about a second then shuts down. Where does the voltage come from? Any idea which component went bad? How far from the magnet or whatever is on the roller for the sensor should the sensor be? I hope you can answer any of these questions. Thanks for reading.

      • schoolie 10:24 am on May 14, 2013 Permalink | Reply

        Stuart, does the indicator LED blink at all when the motor turns? If not, I’m not sure what’s going on.

        The speed command signal comes from the console over the blue wire on the MC-2100 connector. The speed sensor signal comes into the MC-2100 through the two pin connector labeled HD7.

        You can confirm that the speed sensor is working by disconnecting it from the board, and measuring the resistance across the sensor (you’ll have to stick a small pin or wire into each hole in the connector, and measure across them). The resistance should be very high most of the time, and drop to near zero for a bit each time the magnet on the roller passes by the sensor.

      • daniel 4:17 pm on October 12, 2013 Permalink | Reply

        how did you fix this problem?

        • schoolie 9:20 am on October 14, 2013 Permalink | Reply

          Unfortunately, I haven’t done much more work on the board that has the software messed up. What problems are you experiencing?

      • Reinhardt 4:12 am on February 17, 2014 Permalink | Reply

        Having the exact same problem. The main supply transformer fuse blew while someone was using it (required to convert line input to 110-120V AC). I replaced it, selected a program, and noticed the Drive Motor turning for a while, then shuts down (if I remember correctly the LED was permanently on afterwards). Tried to have a look at the LED a second time around, but the fuse blew again… I guess I’ll get a few hundred more fuses to try and figure it out. It’s a shame about the LED not “working” if the motor’s disconnected.
        Any advice on how to proceed? Like most people….I only have a multimeter…lol, what a pain.

        • Reinhardt 6:58 am on February 17, 2014 Permalink | Reply

          Forgot to mention, I already tested the speed sensor, and it functioned as you described.
          More tests I’ve done/ things encountered:
          1) When I plugged in the power, the dash lit up (without the magnet (key) connected), and the motor started, blowing the fuse. This only happened the “first” time I connected the power.
          2) Replaced the fuse again: The dash lit up again, then turned off. Connected the magnet, and everything displayed correctly. Tried to set a slow speed….motor started, blowing the fuse.
          3) So….disconnected the motor…repeat, fuse didn’t pop.
          Figuring the problem lies with the Dash Controller…which will be a pain to fix….
          Whats the best way to test the motor? Can I leave it connected to the belt, and use a 12V battery? Assume I should add a fuse in there too

        • Reinhardt 2:34 pm on July 23, 2014 Permalink | Reply

          Hi. I actually forgot about this post, and thought I’d share some info just in case someone else experienced the same problem.

          The fuse being blown was caused by a blown MOSFET (Q2). I replaced it, but Q2 blew again (once the treadmill sped up), causing a short circuit, blowing the main fuse. I then replaced Q2 as well as the MOSFET driver (U5), and the bus capacitor (C5) (because it was a bit swollen, which usually means it’s reached it’s EOL). The treadmill is running now 🙂

          Hope this helps someone.

      • Daniel Kaspo 8:11 pm on August 14, 2018 Permalink | Reply

        Hey Stuart, I’m in the exact same boat. If anyone else ends up in this predicament, I found a YouTube video of a user who had the exact same issue and at the end showed some resistors he replaced to fix it. I can’t confirm this works, but it seems like it did for him.

    • John- 1:49 pm on December 3, 2014 Permalink | Reply

      I have a MC-2100 and treadmill motor that I’d like to use on my milling machine.
      Schoolie or Terry, are either of you willing to sell one of these or do you know where I could purchase one ready to use?

  • schoolie 9:35 pm on January 13, 2013 Permalink | Reply
    Tags: CAD, , , Reverse Engineering,   

    Making a Paintball Gun from Scratch – Design 

    After selecting the Smart Parts Ion as the basis of our paintball gun project, the next phase was to get the design details worked out. Designing on paper is a lot more efficient that trying to work out details in metal as we were doing when we started the project.

    The main goal of this part of the project was to get detail drawings made of each component, with the analysis to back them up and ensure the gun will function as desired. Ideally, this work would be done in a solid modeling package with detail drawing support. At the time, I hadn’t found a good solution that was in my price range … I mean free. Fortunately, I stumbled upon Creo Elements/Direct Modeling Express, which fit the bill nicely. I’d highly recommend checking it out if you’re looking for a solid modeling CAD program for hobby work.

    With the CAD question answered, we needed to get started on the design. Again, ZDSPB.com was a great resource. The cross-sections, animations, and functional descriptions were extremely helpful, and enabled us to reverse engineer the Ion without having access to one.

    Instead of simply copying the design, we wanted to make a few changes along the way. Our design should operate on 90 psi and uses standard NPT fittings rather than microline. These changes facilitate hooking the marker up to an air compressor, and minimize the cost of hardware we have to purchase. Using an air compressor should allow us to do some initial testing of the firing assembly without having to make or buy a high pressure regulator like you’d find in a regular paintball gun. We also simplified a few areas of the gun to better suit the limited capabilities of my shop.

    The drop in pressure required some math to determine the required dump chamber volume. Without going into too much detail, we put together a spreadsheet to calculate the velocity of the paintball as a function of chamber volume and operating pressure. It’s surely not exact, but it should be close enough to work. Here’s the predicted projectile velocity as a function of time for 80 psi in the dump chamber in our design:

    (Read the rest of this post…)

  • schoolie 12:15 pm on November 12, 2012 Permalink | Reply
    Tags: , , , , , Reverse Engineering   

    MC2100 PWM Controller Schematic 

    Just a quick update. I haven’t finished the permanent driver board, but thought I’d upload a better version of the schematic. I’m currently trying to decide if I’ve messed up the MC-2100, or if my soldering just sucks. At this point, I’m getting the motor to come on, but not consistently like it was with my breadboarded circuit. The indicator LED will flash 5 or six times, and the motor starts turning, then the LED goes back solid like it’s not getting signal, and the motor slows back down. I’ve had a couple of occasions where the motor will run up to full speed, so it’s at least close. I can at least confirm that this circuit worked on the breadboard, as shown in the previous post.

    Schematic of PWM Driver

    I also wanted to post a few of the relevant files I’ve found pertaining to the MC2100.

    Here’s the document that describes how the controller is interfaced with the treadmill, and the function of each pin of HD2 on the MC2100.  This is essentially the same file that James linked to in the comments on my previous post.

    The following file has been extremely helpful in troubleshooting the MC2100 itself as I’ve messed it up along the way.  The file was provided by a member of the Home Shop Machinist forums in this thread.

    Reverse Engineered Schematic


    Check out the rest of the MC-2100 Project Here

    • Darrel 12:01 pm on February 6, 2013 Permalink | Reply

      You might have opened my eyes now with this cheers

      • schoolie 12:06 pm on February 6, 2013 Permalink | Reply

        Great. Hopefully it’s helpful. Let me know if I can clear anything up!

    • chris 1:40 pm on March 30, 2014 Permalink | Reply

      hey, i’m trying to do the same thing. wondered if i could ask you a couple questions… chris

    • Ian Grant 11:57 am on April 1, 2014 Permalink | Reply

      Very impressed by your expertise and wondered if you’d be kind enough to help me.
      I have a treadmill with the MC2100.
      The belt motor is definitely OK and I think the MC2100 is ok too.
      It seems that the console is not sending the right signals.
      Occasionally I will get it to run and the led blinks as it should.
      The only functionality I’m trying to achieve is control of the motor and even 0-5mph would be OK.
      What inputs to HD2 are required to make this happen?
      Any help would be hugely appreciated – the wife is desperate to get back on her treadmill and I need the brownie points!
      Thank you

      • schoolie 9:23 am on April 2, 2014 Permalink | Reply

        Hi Ian, the best simple circuit I’ve come up with to replace the console is in this post. It uses a 555 timer and a comparator to generate a ~50ms period variable duty cycle 5v square wave. The HD2 connections are shown on the schematic. The circuit uses a potentiometer as the user input.

        Let me know if you have any questions, or if the schematic doesn’t make sense to you.


        • Ian Grant 8:42 pm on April 3, 2014 Permalink | Reply

          Hi Brian,
          Many thanks for your reply – much appreciated.
          Prior to your reply, I’d drilled down a bit deeper and came across Terry’s circuit which I’ve bought the bits for and have started to build, but maybe I should have gone for the one you suggested – or maybe either will work Ok.
          I’m very rusty on all this stuff. I’m a 65yr old Brit currently in America – where are you located out of interest?
          I’m immensely grateful for this blog (without which I wouldn’t have been able to get started!) and for the input of you fine folks

    • schoolie 10:38 pm on April 3, 2014 Permalink | Reply

      Terry’s circuit should work fine as well, they’re just two different ways to accomplish the same basic goal. I’m in central Indiana. Let me know if you run into any problems asking the way. It’s cool to see people using this stuff 🙂


Compose new post
Next post/Next comment
Previous post/Previous comment
Show/Hide comments
Go to top
Go to login
Show/Hide help
shift + esc