-
EEVblog #36 – It’s Hardware Puzzle Time!
Posted on October 10th, 2009 68 commentsIt’s time for YOU to get involved and solve a hardware puzzle – what does this board do?
Get your reverse engineering brain into gear and win a prize.High Res images 1 2 3 4 5 6 7 8 9 10
RULES:
- Dave makes the rules and can change the rules
- The first person who (in Dave’s opinion) is the closest to guessing what this board does and how it works wins the prize, the more detail the better. The most correct may not necessarily win if enough detail is not there. I’ll let it run for a while even if someone is spot-on up front.
- No time limit, until Dave closes it that is.
- I will not reply to guesses, so no “cold”, “warm” etc
- Hints may be given in due course
- You can build upon other peoples answers and gazump them with extra detail if you think they are pretty close!
- You can guess as many times as you like68 responses to “EEVblog #36 – It’s Hardware Puzzle Time!”

-
I think this is a part of automatic telephone system.
-
I would say it’s a part of a custom automatic
testsystem. With digital and analog I/O’s.
It’s also able to send out analog waveforms for measurement.
The whole System communicate internally by a differential serial bus.Best regards from Switzerland Richard K.
-
I think it’s a kind of programmable automation controller with serial and ethernet interface.
-
There are one board for the microprocessor and the relays command system, one other for relays and one for the ethernet interface with differentials inputs devices and functions generator for FSK modulation on the ethernet line.
-
-
Pete B October 10th, 2009 at 21:31
I think it might be for testing the frequency response of cables ?
One board contains a PIC controlled DDS device and associated drivers to form a swept frequency generator.
Another board contains instrumentation amplifiers and an RMS to DC converter, feeding the PIC’s A/D converter, to measure the signal level. An XR2206 function generator generates a tone for self calibration (?)
The main board contains a relay matrix to switch the generator/receiver to the required cable ends. It’s all controlled by the Rabbit chip, which drives the relays via serial/parallel converters and has an RS232 interface.All the best from N.Wales, U.K.
Pete
-
I usually do fairly well in Bunnie’s quizzes (http://www.bunniestudios.com/blog/?p=542), but this board leaves me almost clueless. I understand the basic functionality, but I can’t see how it all works together to make a useful device… I guess I’ll wait for the solution. :/
-
The last one…
Well ok so, one of board contains series of relays for outputs controller. An other one is designed to control relays with latches (the two’s DIP40) which are commanded by a microprocessor (Rabbit 2000). On this board there are also one connector with a RS-232 input (decoded by the MAX202). Now, the top board is for the ethernet interface, with the function generator (XR2206) which modulate the signal transmitted by the differentials lines. Finally the bottom board is used to read from the differentials lines with EL2142 devices. The board uses a variable oscillator controlled by the PIC. So the system is divided in two parts : one module for the automation controller and one for the ethernet bus (or others differential bus).
Have a nice day !
Vincent (FR) -
Ok, here’s what I got from this:
At first I thought the function generator and oscillators on the top board implied that the board may be used to modulate signals into a 4MHz carrier, but I don’t think that’s what it does. The whole thing is high speed and high precision. The 5v, rx, tx and ground connection seems like a usb interface to me, yet everything else seems rs-232 based.the top board does a lot of logic and conversion.
The main board has the connectors and processor
The bottom board seems to control/convert the signalsObviously a communication device of some sort.
I think it processes digital signal, rather than analogue.Honestly, I have no idea what it is. I think the early ADSL modem comment before seems about right and fits with the time frame in which the device was designed.
Why is there a slave device for it then? Some kind of network device maybe? -
I don’t have guess, yet, but I would like to comment that you don’t see the surface mount solution for the restore at R11 on http://www.eevblog.com/images/Puzzle1-TopBoard.jpg every day!
-
yes, that’s true. sometimes it’s the best solution with the parts you have
-
-
What i see is that the main board is cotrolling the other 2. It has a port expander based in 2 shift registers w/latch.
The brain here is the rabbit microprocessor, with all the needed electronics to make it work in that small board.
Apparently the main board has a lot of digital, low speed, isolated outputs or inputs in the 2 connectors at the left of the relays. They are isolated by those reed realys; they are isolated with mu-metal, they are apparently great. The relays are controlled by the port expanders.
The main board also has an RS-232 port directly connected to the uP trough the max202.
The bottom board looks like a differential receiver from some place in the main board, probably the input lines go to the main board, are redirected to the bottom board, there they are translated there and transmitted back to the main board trough an isolated path using the bottom board relays.
that board contains some differential signal receivers, a digital controlled oscillator, the pic and the isolation cicuit. the board also has an ICSP connector for the pic.the top board looks like some class of a differential transmitter, the hc4052 is turning on and off the sine signal produced by the XR2206. there is an RMS to DC converted wich, i think, is feedbacking the microcontroller with the RMS of the signal produced(maybe all the I/O signals are some kind of morse code or another protocol turning on and off sine signals or similar).
This board is also isolated from the main with more relays. It also has an ICSP connector for the pic.
Maybe the data lines go to the main board, are transmitted to the top board and then they return decoded to the main board where the rabbit uP receives them.I think all this 3 boards are part of a military/industrial radio controlled system or long distances wired controlled system with a lot of I/O lines controlled by the data received/transmitted to and from the board. It is prepared to survive by itself in some place for years and serve as a remote controlled I/O terminal from some radio or wired signal. you can increase the amount of I/O lines by adding slave modules.
This is extemely well done and is impressively isolated, very resistant.
That’s my opinion.
-
I guess this board is a digitally controlled function generator, using a xr2206 as a VCO in a PLL with the DDS chip as the reference clock. The relays are used in an attenuator network.
Jan
-
I think this is a part of sensor array data gathering system, connected together in a network, some kind of radar maybe?
-
Ok, im realy into electronics and i know a fair bit of electronics for my age.
after looking at the HI-RES pics, i see that the first chip to be elevated (the smallest one) (daughter chip as you call it?) looks to be a timer/timing circuit because it has a quarts cristal on it (the little silver can on it)
there doesnt seem to be a bridge recterfier, so that indicates that its part of something els.im not going to google some of the cips for data sheets as i seem that is kinda cheating.
well thats all i can realy understand from it, maybe if it had any distinctive ports (such as a PS2 or ethernet) it could help me out.
i have some electronics projects in my youtube if you like.
/baddspella -
I wonder if it might be an electronic sign post controller.
With 2 LED driver chips, something like those road warning signs on a trailer.
But, why use a telecom’s chip?
-
Another thought – traffic signalling.
But are they LED, or something else.
-
Trent Ozaki October 11th, 2009 at 12:02
Are we allowed to simply post our ‘guesses’ here?
I believe this is a programmable display driver, the most likely application being caution/message signs typically used in (automobile) traffic-hazard and construction-zone warning. Master-slave functionality would be useful, to gang-together multiple displays. If it is indeed such, I hope such a design does not have any built-in routines that favor left-hand drive situations– Dave’s system might have serious consequences here in the ‘States, if so!
-
From a few minutes of looking over the boards:
The main board seems like it would be a driver/repeater for something like DMX controls for lighting. I’m gonna say high current LEDs for something bigger than a traffic sign, maybe a large stage display or shop sign; something that would need a few LED drivers/repeaters.
Other boards for input from serial device maybe, one for signal conversion.
I’ll try to make a guess in better detail some time soon.
-
Katie W October 11th, 2009 at 13:22
Given the Master/Salve configuration along with the apparent single twisted pair connection between the master and slave boards and the large number of inputs/output to the many relays indicates that this is some sort of multiplexer. The XR-2206 chip is providing the carrier likely using FSK modulation and since the chip is rated a guaranteed max operating freq of .5Mhz we can assume that whatever data is being carried on any one channel — there appear to be 32 of them — must be pretty low in frequency. Phone voice quality is would just fit into the 15Khz bandwidth. The relays would be needed to for phone line signaling and switching. The UCN5832 drives these relays via a serial input from the nearby PIC chip. The other PIC likely controls the FSK modulation scheme.
The Rabbit 2000 module seems to be on an optional add-in and has it’s own external connections. It’s software include most of the TCP/IP stack and many utilities. So it’s likely for out-of-band SMTP monitoring of board activity.
Conclusion: This is one half of a 32 channel voice PBX with SMTP optional.
-
It looks like a piece of remote test gear for testing communication circuits. I would say that the Rabbit micro is used for programmed selection of the circuit to be tested or the serial interface can be used to manually select the circuit by commanding one of the 5832a to latch a relay corresponding to the circuit under test.
It looks like both of the PICs on the two daughter boards have headers for in-circuit programming.
The board with the XR2206 and the AD637 controlled by the PIC is probably for testing noise since the XR2206 is fixed at one frequency.
The daughter board with the AD9835 controlled by the PIC on it’sboard is probably used for testing frequency response since the frequency can be controlled by the PIC.
-
TrentO October 11th, 2009 at 14:59
At first glance, I did agree with KatieW, in thinking that it might be the core of a key-system telephone switch, but I did not see any evidence of the high-voltage components required for ring-generation… Besides there aren’t enough i/o pins to justify 64 relays in such a voice network… A hybrid key system phone switch would require (some) A/D conversion prior to the switching matrix, and would perhaps negate the need for high-voltage components, but such a system would not require (as many) relays. Besides– the main attraction of telephone systems these days are automated-attendant/IVR/VM integration, and there is no evidence such support is provided– I would expect to see a fair amount of NVRAM and multiple DAC’s…. To all, especially Dave– I hope I don’t sound too much like a total dork– I am not an EE by education or profession, nor do I play one on TV…
BTW– Very cool, Dave! You even have total amateurs like me involved.
-
I would guess its a phone system (PBX) switching module. From the pictures I see an XR function generator which might be used for signaling tones, there are a bunch of switching relays arranged in pairs as in Tip and Ring maybe. Some analog circuitry and a DDS synth which does not seem to fit the PBX guess. The device is a multiplexing switch bank with a audible function (XR chip) and a DDS. Again the DDS does not seem to fit with the PBX guess.
I did not see any indications of an Ethernet port. The device does use serial RS232 for the Rabbit module which I would guess is the main controller, one of the PICs seems to provide control the the DDS and the other to the relay driver chips (40 pin).
I’m dieing to know what this thing is. I had not herd of clipping op-amps before seeing this.
-
TrentO October 11th, 2009 at 15:34
At this point, having read the other responses, and applying my own (limited) knowledge I have to believe Larry is most likely on the right track– having only a 26pin header for external i/o, into what can only be ‘an analog processing/switching’ section based on low-speed relays, coupled with a separate function generator/ (and what I can only infer as a waveform analyzer of sorts)– I think Dave’s Device (DD) is a communications line tester. I can see a need for such a device for testing long-haul multi-pin serial communications (such as RS-485.) Having the switching network in place would allow for custom loop-back and cross-connects. Having a slave device (on the other-end) would also make a lot of sense in this scenario, as would the ability to provide some sort of direct measurement, versus a purely time domain reflectometry (TDR) based system.
This sort of reminds me of the $4 c.1986 RadioShack(r) RS-232 breakout box, complete with jumper wires, coupled with the $8000 TDR our office bought, that we used ONCE.
At least it told us that the underground phone wire we though was bad, was indeed bad at 33ft.
Again apologies for not knowing the terminology– for reference I only have a c. 1991 Sears(r) multimeter.
I take back my first guess as a message-sign-display driver (unless it turns out to be correct.)
-Trent
-
I think maybe it could be a fireworks/theater device. “Scripts” are stored into the micros and they trigger the relays at a certain time. They need to use relays because lights or fireworks igniters need a lot of electricity. Also, what does that prize do, what is it?
-
Sean, the prize is discussed in an earlier video. uCurrent or microCurrent, check the eevblog youtube channel.
-
Connectors:
There are only a few I/O connectors that appear to leave the board. There’s the bright orange connector that offers power, ground, a serial interface (rs232, or rs485). Then opposite the the orange connector are two 2×13 headers, for 56 pins total. One facing up, the other down. Indicating the daughter boards (slaves) are stacked on this end. If I had to guess I would say those 5 pin right angle headers are the ICSP connectors for the Microchip parts.Serial I/O:
The RS485 would account for the master terminology meaning this could be the master device in a multi-node system allowing other nodes to be “dropped” where ever. This would also explain the rabbit. It’s likely the “brains” of the system over all since an RS485 system can run relatively fast and the rabbit would have the juice to keep up.The board with the DDS on it appears to have two video channels. Or at least the parts would suggest this. The two clamping amps, and two differential amps, by two channels (horizontal and vertical).
Then there’s also the function generator, the 8 channel ANALOG multiplexer. There’s also an RMS to DC converter for measuring AC signals.
The 64 lines of serial I/O appear to be the power behind the 74 relays. The relays seem to be switched for the most part in unison with even the same signal feeding most (see reed switch notes below).
My guess would be multiplexed video system of some sort. The brains for a video surveillance system or video broadcoast system perhaps.
Eh. It’s late. It could be something completely different all together too.
Here’s the datasheet link for the reed relays ( http://www.pickeringrelay.com/pdfs/112.pdf )
Final side note, it looks like the relays are all turned on in unison (and most have the same signal (pin #1) applied).
To the kid that said he thought looking up datasheets is cheating… Good luck reversing anything w/o knowing parts, pinouts, protocols, etc.
-
Couple of asides as well. Remember that every part on those boards has a purpose. So there’s a reason for all those amps, function generator, multiplexer, etc. These aren’t digital signals. They are analog.
Also, those reed relays are good for both (low) power, isolation and switching.
-
TrentO October 11th, 2009 at 20:35
Okay, okay, okay!!! Last guess, no make that final answer– I believe it is a transducer controller, with the back-end components necessary to create a parametric sonar array. The two daughter boards create the two requisite higher frequencies, which are then switched through the relay matrix to paired transducer units; the localized interaction of the acoustic wave pattern would generate a lower-frequency wave that would represent the actual sonar beam. Of course in this scenario, Dave’s Device would only be 1/2 of the completed gadget– a receiver of the reflected wave would also be required. I believe this device could control up to 32 transducer pairs, resulting in a very high-resolution ‘beam.’ The ultimate usage scenario of this product could vary widely, but would most likely include bioacoustics studies or underwater tomography for petroleum prospecting. Or given the non-hostile-environment construction of the board, it could simply be a ‘bench-test’ apparatus for a production sonar array– gotta know which rubber bands are the bad ones.
I can’t think of anything else that would require the output of two relatively low frequencies, that doesn’t expect any sort of signal return or post processing (to arrive at useful product.) Unfortunately, even if my premise is correct, I don’t possess the requisite EE background to enumerate the particular steps involved– I believe someone else can take this, to reverse-engineer the specific frequency ranges generated for the transducer pairs… and prove or disprove my assertion.
With this, I take back my first two guesses. I come to this after seven hours of head-scratching… 3:30am here on the west coast of the USA. This challenge of yours is definitely a good one, Dave!
-Trent
-
Jan Panteltje October 11th, 2009 at 21:40
Those are relais (Pickering), and 5832 is serial in multi I/O chip (print heads / bulbs / relays? drives the relays?
Could be some of those things to light up a light bulb in quizzes where each person in the audience has a switch.
Could be a part (master) of a large alarm system.
Could be some other form of light comntroller.
Could be from an UFO in Andromeda that got stranded
on earth 20 years ago. -
-
-
TrentO October 12th, 2009 at 09:39
I think at most, only the PIC12F existed during H.G. Well’s time… unless he went in the future to obtain PIC16F microcontrollers…!
-
-
I would think that this board (the master) connects to the slave board with a serial or Ethernet. The slave board is similar to this board except it has an array of inputs that match the output relays on this board. This would allow for long distance contact monitoring with only a few data wires.
For example in a large plant remote buildings could have a large number of points tied into a slave and the master that is mounted in a central control room would mirror the remote activity on its local relays.
-
After my first cursory glance, I also thought it was for a low resolution outdoor scrolling led marquee, after I read about the 40-pin dips, I was more certain.
However, after reading some of the other comments about the various components and TrentO’s answer (transducer controller for an underwater sonar array), I’m pretty sure that’s correct. Especially considering Dave’s talk on a previous blog about such a system. You guys should focus your entries on exactly how it works and see if you can beat out TrentO.
-
Okay, this is a controller board for a vertical seismic profiling (VSP) tool by Sercel. Most likely the GeoWave device or similar product (due to the 32-level limitation and the array of 32 relays).
The VSP tool involves at least streamer of hydrophone transducers which are lowered into a borehole. Sometimes two streamers are put down the well – one is the energy source, the other is the receiver (and this is where the master/slave aspect comes in). The source will send a signal out (this is why the need for the function generator) and the receivers pick it up. The data gathered is used to make 3d or 4d model using full-waveform finite-difference method (this is the reason for the differential amps).
-
Of course those 40-pin dips drive the relays. I’m not sure yet what the PICs are for. I would guess they are for programming/configuring the various devices (such as the function generator) on the board.
-
-
TrentO October 12th, 2009 at 09:01
Just to add some additional clarity to my vision of how Dave’s Device works– This is essentially an active sonar ‘pinger’ with upwards of 32 transducers (probably piezo-electric devices) would generate a series of sound waves of strictly defined period and intensity. Basically ping-ping-ping-ping-ping-etc. The microcontrollers would control this aspect for each tone and/or transducer type. After a given set string of pings, the unit would wait for a predefined interval before issuing another string of pings. A completely separate receiver unit, consisting of a (set of) hydrophones would receive and interpret/extrapolate the echos to form a composite image of the target. As Dave’s device lacks any significant DSP capability, and perhaps more importantly does not include environmental monitoring (to compensate for differentials in the sound carrying medium, i.e.: salinity and temperature) I assert that Dave’s Device represents the transmit-only component of the system. As such, a simple RS-485 connection would suffice to ‘program’ the unit to act per the anticipated environment– and most importantly to set the inter-ping time period and wait time. This would allow for the mapping of features that exist at varying distances from the transmitter/receiver set. More distant targets would require greater time intervals to resolve properly and limit overlapping of wave-signals. The concept of expanding this device, would really only apply to increasing the number of supported transducers– in theory, the more transducers, the better the potential imaging resolution. I believe the best analogy, external to the sonar realm, would be a phased-array radar systems, which achieve high resolution (and therefore high target identification capability) based on “fine, steerable beam” techniques. Of course the biggest physical limitation here is the resolution of the wave itself– in sonar, the wave frequency is probably <10Khz through media– radar uses radio frequencies in the multi-Ghz range (and you can also pump SERIOUS power into the RF beam.) I think a big clue to the use of Dave's Device is in the physical dimensions of the unit– the elongated shape would allow packing to a 'clean' hydrodynamically efficient package (think torpedo.)
I would expect that more current incarnations of this device would include fiber optic communications mechanisms, which seem to be in favor by the sub-surface ROV community at this time.
Of course the application of this device can be easily changed, to say– control 'surface' echo-mapping transducers. I can imagine Dave's Device controlling 64 explosive charges to discover that massive diamond deposit in the Outback. I actually thought of this application FIRST– then applied that concept to Dave's background to derive a more likely use… Hey, I'm American– I like to blow stuff up– it's what we do.
Again, sorry for the long-winded non-technical explanation of my theory. My concepts are all based on things that I have read in Popular Mechanics(tm) and from reading the display placard on the Klystron on display at Fry's Electronics in Sunnyvale, CA.
-Trent
-
I was learning towards an HVAC controller, but am now favoring a remotely operated sprinkler system.
-
TrentO October 12th, 2009 at 11:47
Other uses for Dave’s Device–
(My formal-final answer is detailed above, but I have other applications for this Device.)1. Fission-fusion weapon trigger. This cannot be real, but I believe the theory of application is sound– upon appropriate access through the Rabbit 2000 microcontroller (i.e.: access-control and fusing) an activated Device will utilize the relay banks supported by the latched drivers to trigger two sets of high-yield explosives to compress a Pu core. 32 charges + safeties would probably be sufficient to detonate 2×16 wedges of fast-detonation and even-faster-detonation explosive. Daughter card-1 controls the release of the Tritium gas boosting capsule into the primary’s core. Daughter card-2 is a testing circuit that enables testing of the explosive initiators without weapon disassembly. This one cannot be real because the speed of the relays would not be fast and reliable enough to ensure uniform compression of the primary’s core. Also, none of the components are hardened against the incident radiation that such a device would need to endure. Note– the above is based on public (Wikipedia-level) knowledge is not necessarily sensitive. Another note– I do not and never have worked for a governmental or military agency of any country.
2. Pinball machine light controller. The relay-matrix could be utilized to control a light-grid matrix on a pinball machine. Although the available current through the Device may not be sufficient to drive any significant number of lamps, the application of Jeri Ellsworth (Circuit Girl’s) Darlington-LED light setup would solve that problem. The daughter boards are simply used to sync light patterns to machine events and music. My favorite application would be to use the Device to upgrade the noisy mechanical relays in the StarTrek pinball machine from Williams.
3. Nuclear reactor SCRAM system– in the event of a liquid-cooled reactor ‘trip,’ a signal could be sent to the Device to systematically (but quickly) drop control rods to slow the neutron chain reaction. 32-64 control-lines (and ultimately control rods) seems like a very low number to accomplish this task, but rods could physically be ganged together to achieve this. Reference– “The China Syndrome (film)”
4. Pipe organ controller (or other musical instrument) the relays would control external solenoids to activate a particular musical note. The daughter cards could be used to provide different qualities to the solenoid output– maybe have an attached Xylophone (in addition to the pipe organ) that would require more rapid pulse-streams or impacts.
5. Pyrotechnics controller– specifically for fireworks. There’s been a 50+ year feud between the U.S., Japan, Australia for the best fireworks display. Of course a decent fireworks show would have channel numbers in high-hundreds to be worthwhile. So for production, Dave’s Device would need to be expanded. Of course timing + safety is extremely critical, thus the daughter boards would provide two levels of activation and synchronization to music. I believe the benchmark for consistently good shows year-over-year is the Sydney New Years show, but many of the big one-offs in the ‘States are also very intricate/complex. (It also helps, politically, to be closer to the International Date Line.)
6. Water fountain controller. The ones that they have in Disneyland are fantastic. Similar in concept the the fireworks controller above, but repeatable, factoring in the reset time of the water jets.
7. Christmas lights controller– someone has already covered this, but IMHO the most important consideration would be to differentiate the outputs (to remote, higher-power relays,) between incandescent and LED lighting– LED’s can switch faster than standard light bulbs; thus the separate daughter cards to provide appropriate timing between the two.
8. Consumer product testing apparatus. This device would systematically switch on and off a bank of devices (such as compact florescent lamps) and send a test signal between cycles to determine the failure-point. Your typical CFL may last 100,000 hours, but probably only 1000 starts. Prime example of a B.S. detector.
9. Prison-cell door control– not that I’ve spent any time “in the hole,” but I would assume that multi-level access control and timers would be required to support such a task– for example only open ‘the slasher’s’ door if the cell-block door is confirmed closed, and two-sets of keys are active in the controller; activate an alarm if any given door is open for too long.
That’s all I have for now…. And yes, I have too much spare time on my hands. -Trent
-
TrentO October 12th, 2009 at 11:56
One more– 10. MRI or CAT scan controller– control of the electromagnets in an MRI or x-Ray emitters in an CAT scan machine. This would require precise synchronization with an opposing sensor/receiver array, but probably doable given the spec’s of the components shown in Dave’s Device.
Also note of caution– don’t try #1,3 & 6 at home… #9’s probably okay if you’re into that sort of thing. -Trent
-
TrentO October 12th, 2009 at 13:23
Okay fine… I probably need professional help at this point, but ONE MORE–
11. Electromagnetically levitated train platform, or alternatively a rail-gun. A levitated train might be achievable if the ‘rotor’ + Device is on the train/carriage side. By pulsing the electromagnets, directional force could be generated, propelling the carriage. Daughter board #1 (with the AD9855) could be used to ramp-up the alternating field change frequency to provide controlled acceleration. Daughter board #2 would measure the feed-back resulting from the rotor electromagnets passing the permanent magnet’s repulsing field– as such determining the required ramp-up or slow-down control frequency, as needed. Building a rail gun is essentially the same, but typically would not require the realtime feedback of a passenger train-type application– just load ‘er up and shoot.
…I promise I haven’t consumed any ’speed’ recently. -Trent
-
Ling SM October 12th, 2009 at 21:57
Using Rabbit as it is not cheap but easy to use basically limits it to low volume application It shall it saves a lot of trouble to add communication interface for the designer and let them concentrate on the main IO interface task.
Master and slave probably points to some kind of field bus doing communication for control. And the Pic shall handle the reed relay, etc. This is either a test system with matrix to relay to do sampling, measurement or outputing test signals.
(I don’t see the high resolution picture, and guessing from what others have written) -
I know what it is generally (the top-board and relays give it away) though I don’t exactly know what its designed application was – I have a top-5 list however. The expandability puts another boundary condition on it’s likely use.
The use of Pickering rather than another brand is significant. Koto might be another brand that could have been used.
Definitely look up the ICs being used if you haven’t already. Consider how those might be used based on what they do.
I used to work for a well-known company that made these kinds of things commercially. I feel I should disqualify myself because I probably know too much (+30 years in electroncs). I also work for a company now that makes stuff like things (I’ll have to look at Pickering again for our products – we use Koto when we need relays of this type).
@TrentO – it’s not nuclear-related (they’d never use a PIC or Rabbit for one thing) – I used do that stuff in a past life – we generally used fully custom ICs we designed from scratch for the digital and very specific components analog components that aren’t widely available.
-
TrentO October 13th, 2009 at 10:03
Um, yeah… Don’t take yourself too seriously there, Jeff. Not even Uruguay would use reed-type relays for such a effort. I would scavenge copier parts first. It’s a joke!
-
TrentO October 13th, 2009 at 12:38
I _think_ Jeff is saying that it is a pulse generator w/internal sampling capability (generically speaking) but my guess as to its ultimate use to drive sonar transducers still stands… Gotta put out a lot of pings!
Jeff- I think the true spirit of this competition is to derive a complete picture from (literally) snapshots and other clues. Regardless of your familiarity with Dave’s Device (component) there’s still much to be done. Of your top-five list, which one would be your answer? Given the insight embedded in your post, I for one, would be very interested in what you come up with. Of course, seeing your complete top-five list would be especially helpful to guys like me– less technical folks who could take initial concepts and roll-them into useful applications. I am ethnically Japanese– it’s what we do (and make small-er, more intricate versions of stuff!)
[I think I'm WAY out of my league here-- Dave and Jeff have more EE capability than me, in their respective left-thumbs. Think of me as the obnoxious, over-anxious summer intern that really isn't expected produce anything. Get you guys a cup of coffee?]
-Trent
-
@TrentO
I’ve been accused to taking myself too seriously – I hyper-focused sometimes. I actually did used to work for DOE/DOD though.
When I worked for HP T&M (became Agilent) it became clear that being an “expert” often means being as little as 5 minutes ahead in knowledge from the customer and knowing how to approach a problem systematically. Knowledge is relative and the gaps not always as large as you imagine.
The older I get the more I realize how little I can ever actually know, however. It’s keeps me humble.
If you get to the Silicon Valley or Southeast Asian (Taipei/Singapore/Bangkok, specifically), I’ll buy you coffee, Trent.
@Joe Leikhim
You’ve hit most of my observations. The alarm system hypothesis fits pretty well. I was thinking of other types of “sensors” and akin applications as well. Things like strain gauge arrays or other sensor instrumentation. This could also include things like moisture, pressure or temperature sensors.
Deconstructing how I looked at it:
I happen to be a analog design guy so I gravitate to that first.
The main board has instrumentation amplifiers (AD620A), an RMS-to-DC converter (AD637) and a function generator (XP2206CP). The relays on that board could be measurement ranging switches (they are adjacent to the inst amps which look like they are arranged as a “differential” pair – odd but see below). There are also trim-pots typical for calibration.
This screams out instrumentation: AC stimulus & AC response measurement.
An RMS-to-DC suggests a signal measured that not a sine wave or the DUT would radically distort a sine wave stimulus. Probably the former.
But there are a “suspicious” pair of op amps (LM311) (differential path?) leading from the XR2206 toward the instrumentation amplifiers and RMS-to-DC converter via an XOR (74HC86).
Could we have a PLL (XORs are common for phase detectors) and product detector here? Maybe. The HC4052A is an analog mux – PLL loop bandwidth and lock-in control? Not too many other reasons for these particular functions to be here.
Makes me think autobalanced bridge LCR meter. The differential pair of instrumentation amplifiers could be product detector mixer with the OP27 to the left being the actual input amplifier.
If it’s a product detector, the RMS-to-DC also makes sense – the output would not be sinusoidal and this is simpler than, and likely more expedient than, a pair of IQ ADCs and a bunch of DSP coding.
The IC with the “Master” label is likely an ADC to measure the output of the RMS-to-DC or possibly PLL error signal. It’s the only thing missing from the picture by part number.
Also the PCB with the analog isn’t laid out for high frequency, super low level signals or high power signals.
The first usually involves impedance control (ground planes and microstrip/stripline) and shielding. The second involves guarding (paths and rings) and shielding. The last involves large current carrying paths. None of these are present. So signals operating below 200 mA, above 1 uA, no more than 1-10 MHz analog. Fits an LCR-meter-like circuit.
That’s separate from the digital clocking for the ADC – there’s 4 MHz crystal for that.
The relay array further suggest multiplexing “expensive” measurement resources. The extension of this with master-slave suggests a whole lot of test points. It looks like the >20:1 MUX fan-in based on how many relays visible.
The AC stimulus-response suggests some type of sensor or DUT that changes impedance (capacitance, inductance). Strain gauges are usually DC biased but some types can be AC biased for accuracy but less likely. Many sensor types could fall into this category. Various security alarm sensors too.
The UCN 5832 is a LED display latch/driver from Allegro. Presumably to display the current channel and/or status when the beast is running.
The Rabbit 2000 is an 8-bit embedded controller which can do networking. We use those in one of our test systems (not HP/Agilent btw) to allow modular test elements to be “stacked” in arbitrary numbers of units on a LAN. I’m guessing something similar here for the master-slave function.
Again I consider myself fully disqualified from the contest, per se. I’d rather have the prize go to someone younger who needs it.
-
TrentO October 13th, 2009 at 17:55
Jeff (Joe,)
I have no other way to put this– You’re awesome! I can actually ’see’ your brain processing this stuff. I believe, more than anyone thus far, you have met Dave’s objectives in creating this contest in the first place. Most all of the responses thus far really have been at the level of “its a duck.” You’re the only respondent that’s been willing to talk about previous field-experience to bring credibility to your assertions– I think 99% of people are much too afraid to do so. IMHO, it’s this type of frank-talk that makes Dave’s blog so appealing in the first place. Well done. Forget the coffee– I owe you a beer.
You would certainly deserve the prize for any of your solutions– no one has even come close to your thoroughness.
NOW it sounds like to me Dave’s Device really is the ‘guts’ of a automated test equipment (ATE) system– QA of production boards populated with components before they go out the door… I kind ruled this out early, because the frequency of the test signal was so limited. But your LCR meter analysis brings it all back. I now know all of my previous guesses at this point are incorrect. If Dave’s Device is an ATE driver, you deserve the prize.
You CAN’T disqualify yourself now– don’t let some wiener at my level ’sneak off’ with it.I live in the Central Valley of California, and do make it out to SV often (130mi drive.) I’ll make good on that beer, the next time you’re in town. That offer applies to Dave, as well.
-Trent (an EE hobbyist in the shadow of a ‘great one’s left thumb.)
-
I was seeing the “It’s a duck” kinds of posts also and was thinking “either these are folks joking around or they don’t really know where to begin”. The charitable explanation (which I see a lot of in the industry these days) is the latter.
I’ll be the first to say I could still be brilliantly wrong about what the board does or even how it works. My point was to show how I did my first look at the board. The above is just a hypothesis. Next would be to confirm it by trying to trace *a few* key signal paths to see if the hypothesis holds up. First rule of electronics: never assume, always “measure”.
That still doesn’t answer what it was used for but it starts to narrow the field.
-
-
-
-
Joe Leikhim October 13th, 2009 at 12:39
Based on the parts on the board, it is a tossup to me that it is some sort of multiplexed stimulus-response instrumentation piece. That said, I will throw out what I really think it is, my first guess:
I think it is a master station for a polled central alarm system. The remote or slave nodes are sequentially polled by the master station and communicate via twisted wire. The instrumentation amplifier and RMS to DC converter are provided to supervise the twisted pair. If a remote slave node is weak, a trouble indicator is created.
-
TrentO October 15th, 2009 at 09:30
What?!! REALLY?!!
(We’re talking about my Sonar-related answer, right… not the H-bomb one…?)
I’d first like to thank the Academy… and all the influential Italians that I know– Frank S., Lucio Di J. and Tom M. And of course– my dad for not get too upset at me for taking apart every electronic device in sight.
Does this mean I get to graduate up to an actual Fluke multimeter? I’m probably not worthy of an 87-V, but perhaps a Fluke 77-IV?
This was so much fun! Thanks for doing this Dave.
-Trent
-
TrentO October 15th, 2009 at 11:17
BTW– when are all the EE-groupie chicks showing up? I keep looking outside and none have arrived just yet…. Perhaps if I lived in Sweden or the UK?
-
-
Pete B October 15th, 2009 at 21:32
Well Done Trent !
I am still intrigued by the XR2206 and associated circuitry. It’s output seems to go into an XOR phase detector, having been squared up by the 311 comparators. Delay measuring circuitry, perhaps ?
Distinct lack of groupie-chicks here in the UK !!
Pete.
-
I think it is a PLC of some kind with relays for the outputs. I see some logic gate ICs.
-
Gerard October 18th, 2009 at 03:08
The small stacked board with a RS-232 transceiver under it, receives data, as I expect, from a computer system and also drives the slave boards.
A second microcontroller with the tag “MASTER” drives the 32bit serial to parallel converter with latch (112-1-A-5/2) which can adress each reed relay. It looks like that the switching pins of the relays in a row are connected parallel and the two rows are connected in series. No idea where this is for. That means that these relays are intended to do this for a specific reason.
A DDS chip (AD9835) looks to be designed as a RF demodulator, which is controlled by third microcontroller. I expect that the XR2201 and, as a mixer designed 4052 intended to be a LF demodulator.
Don’t wait to long telling us what it is… -
reverse engineering is a pain IMHO. but neccesary if you got any use for it, and fun if you just want to test your knowledge. just like this quiz. its a fun and provoke to more hobbyist into EE. IMO.
keep it up!
Leave a reply
-














DSmile October 10th, 2009 at 20:43