Reverse engineering the Fluke WireView identifiers

[andtfoot]

After recently purchasing the Fluke LinkRunner AT 2000 (thanks to TopLoser  ), I looked at getting more of the cable identifiers. After seeing the price (>$400).... bugger that.
I thought I'd see if I could make my own.

I was fully expecting some termination resistors, and maybe an EEPROM with the identifier number stored.

Instead I got this (please excuse blurry phone pics; my camera is at work):






I scanned the circuit board and whipped up a quick overlay:




I'll be figuring out the circuit shortly.
In the meantime, has anyone got any ideas on how the Identifier number might be set on this? There are 1 to 6 available, and this is #1.

[amyk]

The value of the resistors, almost certainly.

[dfmischler]

If it isn't the resistors then the units could be wired differently to the connector (i.e. three diodes could provide a three bit binary code quite easily).

[mikeselectricstuff]

Once you have a schematic I suspect it will be fairly obvious which parts will be used to distinguish units - almost certainly either a resistor value or a ratio of 2 resistor values,

[mcinque]

>400$?  This is the evidence that some manufacturers tend to easily overprice their accessories not for their quality but only because their brands are well known. 

[andtfoot]

>400$?  This is the evidence that some manufacturers tend to easily overprice their accessories not for their quality but only because their brands are well known. 

I should clarify, the $410 is for a set of 5 (#2 to #6), but that still means $82 each... 


I tend to agree with the suggestions of the resistors being used to set the number. I've thrown together a schematic, but with no values yet. For some reason what measure doesn't seem to match the markings. e.g:
R1 (the one on the far right of the top picture) measures 25.07k, but marked 390 (39R) or 39C(?) maybe
R6 and R9 measure 10.6k, but are marked 1432 (14.3k)
R12 measure 3.836k, but is marked 57B (?)

I might pull a couple out of circuit to double check, but I wouldn't have thought these would be affected.

[mikeselectricstuff]

Letters are equivalent to digits : 57B = 572 = 5K7
Low readings will be due to the parallel combinations
A bit puzzled about the large R's, unless it's a test load for 48V PoE

[mcinque]

I should clarify, the $410 is for a set of 5 (#2 to #6), but that still means $82 each... 

Much better  But still overpriced!

[andtfoot]

Letters are equivalent to digits : 57B = 572 = 5K7
Low readings will be due to the parallel combinations
A bit puzzled about the large R's, unless it's a test load for 48V PoE

Rightio, thanks.
I wouldn't have thought a resistor such as R1 would be affected by any parallel combinations. I'll have to double check after I've had a nap...
The Linkrunner measures PoE, but I don't think it spits out any. That said, these identifiers appear to be used across a few products so maybe something else does.


If I were to have a hunch based on an uneducated guess  I'd say that the Schottky diodes are being used as comparators of sorts; the voltage dividers made by the resistors are used to set which diodes are forward biased.
Another possible theory is that the large resistors are being used as a precision reference (why else would you have series-parallel like that of the same value, apart from increasing power capacity). Maybe the comparison between this and the other resistors is done at the LinkRunner end.

First thing I'll probably do after figuring out values is breadboard it and see if I can get a copy working. Then I can tinker......

[tinhead]

Letters are equivalent to digits : 57B = 572 = 5K7
Low readings will be due to the parallel combinations
A bit puzzled about the large R's, unless it's a test load for 48V PoE

wrong, 57B ist not 5k7 but 3k83

http://www.talkingelectronics.com/projects/ResistorsMadeEasy/SMD-Resistors-EIA-Markings.html

[andtfoot]

Letters are equivalent to digits : 57B = 572 = 5K7
Low readings will be due to the parallel combinations
A bit puzzled about the large R's, unless it's a test load for 48V PoE

wrong, 57B ist not 5k7 but 3k83

Could you please explain how you got that so I can see if it matches with the rest?

Edit: Hmm, found something that explains it a bit:
www.marsport.org.uk/smd/res.htm

[TopLoser]

Letters are equivalent to digits : 57B = 572 = 5K7
Low readings will be due to the parallel combinations
A bit puzzled about the large R's, unless it's a test load for 48V PoE

wrong, 57B ist not 5k7 but 3k83

Could you please explain how you got that so I can see if it matches with the rest?

http://www.hobby-hour.com/electronics/eia96-smd-resistors.php

Glad you like your new LinkRunner!

[andtfoot]

Ok, here is the latest with the values read off the components. I've also rearranged it a bit to try and find patterns in how the components are connected.

[andtfoot]

I finally found some schottky diodes and sat down with the breadboard.

I don't have the correct value resistors, so I tried the closest values I could:


Not close enough apparently...


I'll get a bunch of the correct resistors and try again (and double check my breadboard mess  ).
I couldn't measure the capacitors (value too small for my DMM), so I took a punt with 22pF ceramics. Maybe this is a good excuse to pick up an LCR meter, not that the value should be important. 

[amyk]

Could all the stray capacitance/inductance of a breadboard be enough to upset it?

[andtfoot]

Could all the stray capacitance/inductance of a breadboard be enough to upset it?

It's possible. I did connect the original module through the breadboard and it worked fine there, but it's obviously a lot neater.
I was hoping whatever signals it uses would be quite robust, given it may have to go ~100m of cable in normal usage. Some of the resistors are a fair bit out, so it can't hurt to try that first.

[Rerouter]

Just to pretty it up if you get anywhere with it, heres my take on the circuit,

[andtfoot]

Just to pretty it up if you get anywhere with it, heres my take on the circuit,

Thanks. The general layout looks like it will be easier to find patterns with. 
It looks like I'll probably concentrate on the 4 right-hand resistors (R4, R11, R12, R15) to start with.
One small error though, is the missing RJ-45 shield and how the last diode connects to it.


On other news....

Like a bought one! 
I started by compacting it all and shortening the wires; no good. Then swapped the resistors out for combinations that got me within 100R or so.
It means I can churn out a bunch of #1 units if I feel like.

Next step will be grab some scope shots, and start swapping values. I might also disconnect a few diodes one at a time to see if them conducting or not is determining the ID.

[andtfoot]

First bit of random discovery:

I can get the ID to change from #1 to #5 if I disconnect this wire going to pin 3 of D2.

[andtfoot]

First scope shots, with ground on pin 8, and probe on pin 1.
Idle, there seem to be random pulses (which aren't there when the tester is turned off). Could be something to do with the network testing side of things.


This is when doing a test:

[Rerouter]

based on the arrangement, try measuring across 4 and 5, i would imagine that should just be a fixed voltage,

(also i mistook that 9 to be 8, so the diode that curls around the right on my diagram is the diode to case)

[andtfoot]

based on the arrangement, try measuring across 4 and 5, i would imagine that should just be a fixed voltage,

(also i mistook that 9 to be 8, so the diode that curls around the right on my diagram is the diode to case)

Measuring with probe on 4, ground on 5.

No random pulses (which makes sense if it is a network testing signal).

[andtfoot]

I've had a fiddle around, swapping the 4 resistors going to the diodes, reversing the diodes, changing value of that series/parallel resistor set, etc.
No luck apart from that #1 -> #5 when disconnecting a wire thing (probably just coincidental) I posted earlier.

To be honest, I'm pretty lost where to start looking or what to try. Has anyone got any ideas they could throw at me please?


I've also ordered a batch of circuit boards from ITead matching the existing one. First time I have done that, so at least it's still a good learning experience. 

[Rerouter]

try moving the diodes connection from 6 to 7

and / or R4's connection to pin 6,

my head is screaming at me about the non symmetry in the diodes center connection

[tonyv]

Hi AndtFoot !

I'm also an owner of a LRAT2000, it is an outstanding piece of equipment. I also share your thoughts about that those little WireView adapters are very expensive, and actually overpriced.

I also own a Microscanner2. Its included cap/lid is also the receiver, if used with the LRAT2000 it is detected a WireView1, i will extract it and photograph it for you so you can compare.

But i discovered something, the integrated reception port of the LRAT2000 (the lateral RJ45 port) is detected as Wireview 7 with the Microscanner2 !!!

I think that you should open your unit and verify that portion of the circuit, i think that you may find a clue there.

Hope that this project is still alive !