Looking for info on this IC

[pyroesp]

Hello,

I'm looking for information on this IC:
SBL3060E
Japan
TE
304U1D09

It's a 64pin QFP IC in a remote control from Carrier (this one -> https://remotecontrolhouse.files.wordpress.com/2010/04/carrier-505.jpg )
This is the remote control for the AC in my room.
The IC has an LCD driver built-in, maybe an RTC or a timer with ext clock capabilities, maybe an ADC, and a bunch of IO for pushbuttons and IR LED.
The IC operates from 2xAAA batteries.

I guess it's a microcontroller. It has what looks like a 32kHz crystal oscillator (typical cylinder shape osc) on pins 17 and 18.
It also has a 3 pin resonator which looks like it's 4MHz, connected on pins 15 and 16.
There's also an unpopulated 2x5 pin header connector, where 1 row (5 pads) is connected to pin 39. The other 5 pads are connected to pins 40, 41, 42, 43 and 44.
The LCD driver connections are from what I can see pins 49 to 64 and 1 to 10.
Pin 11 is ground and Vcc looks like it's on pin 14.
Pins 12 and 13 could very well be analog inputs as there is a 3 SMD resistors (code 224) voltage divider. Maybe for a low battery detection ?


I'm curious to see if I can extract the firmware out of it or some other kind of information out of the header connections.

On a side note I've been trying to decode the IR and have been somewhat successful at it (got the mode and temperature and other things) but some of it I can't figure out.


Any info on this is greatly appreciated.

EDIT: What I've managed to find so far are Schottky diodes (with part number SBL3060)

[Back2Volts]

EDIT: What I've managed to find so far are Schottky diodes (with part number SBL3060)

Unfortunately that does not make much sense.

[stj]

what's your end goal, making another remote - or using a pc or similar.

[pyroesp]

Turning on/off the AC depending on a few things:
- temperature
- time
- day
- room door closed
- gsm (sms) activated
- ... ?

[stj]

did you check the LIRC database in case it's already been documented?

[Buriedcode]

Might be better off just buying a replacement.

https://www.alibaba.com/product-detail/big-size-remote-control-for-carrier_1420588862.html

If its just the remote control part you want (not the display) and the original remote is still function - be it in pieces or otherwise - then there are plenty of Arduino libraries for picking up common IR protocols.  You could then use this to make a replacement.  Something I've had to do several times for equipment (not using an arduino though, just some low power PIC's).

[pyroesp]

did you check the LIRC database in case it's already been documented?

Couldn't find Carrier on there.

Might be better off just buying a replacement.

https://www.alibaba.com/product-detail/big-size-remote-control-for-carrier_1420588862.html

If its just the remote control part you want (not the display) and the original remote is still function - be it in pieces or otherwise - then there are plenty of Arduino libraries for picking up common IR protocols.  You could then use this to make a replacement.  Something I've had to do several times for equipment (not using an arduino though, just some low power PIC's).

The remote is fine and I prefer not using arduinos.
I can replicate the signal, but some of the data I do not know what it is or does or what triggers a change of bits.

[Buriedcode]

Then you'll have to decode it manually

I doubt the remote gets a signal back, as feedback, so the display should just be showing what you're setting. So I would first scope the output looking for the sort of channel coding it uses, and how many "'bits" (in quotation marks because it could be manchester,/biphase, PPM, or PWM) and use a microcontroller to read the codes for every button.  Perhaps displaying it on an LCD or sending to a terminal so you can see when it receives a packet, and what that is - that way you can map buttons to codes, and also check if it only transmits IR when you've set something, or if it does it for every button.  Can be a fair bit of work, but its often doable.

Also it could just be a generic microcontroller, in which case the datasheet won't help much with functionality.

[pyroesp]

Then you'll have to decode it manually

I did decode it, but not for all the bits.
It looks like NEC, so it has a start pulse with an ON time of 8.4ms and OFF time of 4.2ms.
A logic 1 is 512µs ON time and 1.6ms OFF time.
A logic 0 is 512µs ON time and 536µs OFF time.

From a few test, in normal mode (there's an extended (?) IR code), the remote sends 5 bytes, for ex:

Code: [Select]

C0 76 17 C0 2D
Byte 1 (C0): XXXX 000Y
- X changes but I do not know what triggers the change
- Y might be the extended mode (have not tested that fully)
Byte 2 (76): XXXY YZZZ
- X is the AC mode : auto, warm, cold, dehumidifier, etc
- Y is fan speed: slow, medium, max
- Z is fan position
Byte 3 (17): Temperature value in hex, so 23(°C) decimal
Byte 4 (C0): X100 000
- X is for turning on or off the AC
- The rest of the bits I haven't seen them change, ever
Byte 5 (2D): Checksum made from all 4 bytes

Those 5 bytes are sent 3 times, every time, with a 150ms space between each data packet.
The data is not sent for each button press, but waits until you finish.

So I've got most of it and I can replicate the code, but there's still that first nibble I'd like to know what it does.
If I remember correctly the extended mode sent at least 4 or 5 extra bytes which I haven't taken the time to decode.
The extended mode is used, among other things, for setting like a timer for when to start and stop during the day.

I thought it could have been fun and interesting to try and reverse the firmware of the IC, if at all possible, but I can't find any info on it...

[SeanB]

I think that is actually a Samsung remote controller, as They did make some for other manufacturers, and the last Carrier remote I took apart has a Samsung branded microcontroller on it. it has a RTC, and it has the ambient temperature sensor as well on it, which is used in conjunction with the return air temperature to adjust the room temperature.

[pyroesp]

I'll have to probe that header connector see if I can get anything out of it, 'cause I can't find a single thing on this IC.