Project Logs

Collapse

• PCB reverse engineering done

  Florian • 01/26/2022 at 13:43 • 0 comments

  I certainly took my time but after long hours of tracing PCB tracks in Paint.net, identifying components and putting everything together in Kicad I finally ended reverse engineering the 2 PCBs there is in this video intercom.

  To help me achieve my others objectives I then proceeded to identify which portions of the schematic where responsible for dealing with:

  1. the audio coming from the entrance panel and going to the room monitor speaker
  2. the audio coming from the door unit and going to the same room monitor speaker
  3. the audio of the room monitor microphone and sending it to the entrance panel
  4. the audio of the room monitor microphone and sending it to the door unit
  5. generating the chime and sending it to the room monitor speaker but also to the door unit

  For the sake of clarity, for each of the above I created a simplified schematic with only the components and connections that seemed to be relevant and compiled those 5 schematics in one big Kicad file (see FILES section for download).

  Here is for example the portion of the overall schematic that deals with 1.

  Thanks to those simplified schematics, I now have a pretty good idea of how this video intercom works and where in the future I should connect to in order to record the audio going between the entrance panel, door unit and room monitor. Also where to connect in order to inject a signal audio and have it played by the entrance panel or door unit.

  While tracing back PCB tracks, I noticed that apart from the video signal, the remaining data and audio signals are going directly into a big IC branded with the manufacturer name (that I wasn't able to identify). Certainly a custom IC but next to it is the microcomputer (the one I referred to in my previous log) and after a close inspection, I found traces going only between those 2 ICs... so I guess they talk to each other?

  I went through the microcomputer datasheet and checked the main function of each of the connected pins and it looks promising:

  Next course of action will be to add some wires here and there so I can easily connect my logic analyzer or oscilloscope. Then probe for signals in situ, to confirm a few of my hypothesis but also learn what those 2 ICs are saying to each other.

• Found a donor, transplant successful

  Florian • 01/22/2022 at 03:29 • 0 comments

  While reverse engineering the mainboard PCB, I've been thinking about how to achieve my first objective that is to change the display for a bigger one. After a few measurements, some research and some considering I came up with the following requirements:

  1. should be between 3.5 and 4 inches
  2. shouldn't consume more than the actual display
  3. shouldn't be too expensive
  4. should display the video rapidly after powering on

  I then tried to list all available solutions I could think of:

  • car monitor with AV input (like those cheap ones sold on Aliexpress)
  • small FPV monitor
  • monitor removed from a product (PSP, another video intercom, ...)

  Having one of those cheap car monitor, I tried it but the video would turn completetly white just a few seconds after appearing on the display. Also, it took a few seconds for the video to be displayed and the power consumption was around 180mA, almost double the one of the actual display.

  So I threw away the car monitor idea and knowing too less about FPV monitors, I focused on finding a product from which I could harvest a display module. First thing I thought was: "Find another old video intercom with a display of proper size". So I went on mercari and Yahoo Auctions and started to look for video intercoms under 2500 yens. I created a simple list (brand, model, year, functionnal/broken, price) and then looked for each item specifications in order to get details about the display.

  And I ended up buying for 820 yens this Aiphone broken video intercom with a 4 inch display. 

  When creating my list I noticed that old video intercom would tend to be quite thick, surely because they use display module. This one was about 4cm thick, almost as thick as mine and sure enough:

  A separate PCB with 3 potentiometers was connected to the middle connector of this display so I searched for the datasheet of the closest IC to this connector (IR3Y29BM made by SHARP) and confirmed the following connections:

  Finally, after confirming that it consumes less than 90mA I installed it instead of the actual 2.5 inch one and tested it: video appeared instantly and even without connecting the separate PCB (the one with 3 potentiometers) it worked fine.

  Only downside, this 4 inch display module looks like it is not gonna fit in the actual video intercom... Might need to look for a 3.5 inch instead...

• A little correction thanks to my new "toy"

  Florian • 01/08/2022 at 06:32 • 0 comments

  I've been playing a lot with my new "toy" and it performs better than I expected. Here is a little comparison of the kind of details I can obtain with it:

  Left is from the photo I took with my Galaxy S10, right from one took with my document camera. Note that I didn't set the document camera zoom to its maximum when taking this photo, which means that at full zoom I could have a photo with even more fine details.

  Yesterday, I spent some time photographing the front and back of the video intercom PCB. I set the document camera zoom at almost its maximum and ended up with more than 100 photos to stich together. For that, I used Image Composite Editor which managed to stich everything together perfectly after just a few tweaks. In Paint.net, I deformed a little bit each photo so that both side vias and through holes aligned perfectly and then proceeded to check my previous board reverse engineering work. I found out that I missed some very important connections: 

  As seen in the above picture, IC201 that powers the video demodulating IC200 and the display module with 12V DC is enabled/disabled by IC600, which is a 8 bit CMOS microcomputer (a M38039G4HHP made by RENESAS). The new Kicad schematic can be found in the FILES section.
  

• Off topic: new toy for reverse engineering

  Florian • 01/03/2022 at 03:00 • 0 comments

  A few months ago, I started to reverse engineering the main PCB. Having only my Galaxy S10 as a photography device, as usual I took the best photo I could with it, imported it in Paint.net and worked on tracing back the PCB pattern. However, despite the Galaxy S10 camera specifications to be quite good, the board being relatively big, after zooming in a bit here is the maximum details I could have:

  Not impossible to work with, but rather difficult. I would often see myself confirming the PCB pattern by directly checking the board, which made the reverse engineering process tedious and quite inefficient. I decided it was time to update my photography method but as I didn't want to spend a lot of money, rather than buying a good camera with a stand I looked for an alternative and ended buying this:

  This is a document camera, also known as a visual presenter. To put it simply, it's a digital version of an overhead projector. This one is a P30HD made by ELMO, a Japanese company specialized in document cameras. I got it for just 3500 yens on Yahoo Auctions and chose this particular model for a good reason: of all second hand document cameras I could find, this model has the most powerfull optical zoom (x16). Here is a list of all second hand document cameras I found with their respective main specifications.

  The P30HD also has a HDMI output, an onboard screen, a D-SUB input and output port, a SD card/USB flash drive saving feature (need the remote to use it), a light and can be connected to a PC via ImageMate software (free proprietary software).

  To give you an idea of the optical zoom performance, here is a short video demonstrating the zoom capability (recorded via ImageMate software).

• So that's what it's for...

  Florian • 07/10/2021 at 03:02 • 0 comments

  Using LTspice XVII I simulated the part of the circuit of the display module I didn't understand what its purpose was. For the composite video signal source, I used the NTSC voltage source published here by Bordodynov. 

  And here is the simulation results:

  So it's look like this circuit is adding a small offset to the original signal, making it completely positive (no more signal falling under 0V). As I know nothing about video signal, I assume there is AC and DC coupling for video composite signal and that small module display works only with DC coupled signal?

  To help me understand better, I looked for some litterature and found those:

  • Analog - ADALM2000 Diodes and Diode Circuits (2e. AC Coupling and DC Restoration)
  • maxim integrated - GET A GRIP ON CLAMPS, BIAS AND AC-COUPLED VIDEO SIGNALS
  • Analog Devices - AN-1603 (Rev. 0) DC Restoration Circuit for an AC-Coupled Video Driver
  • maxim integrated - How to Level Shift Video Signals for DC-Coupled Video Amplifiers/Filters
  • RENESAS - AN1700 Video Driving Techniques for Mobile Devices
  • LINEAR TECHNOLOGY - AN57 Video Circuit Collection

  From what I understood, the composite video signal coming out of the mainboard should be AC coupled and that small circuit in the display module does a DC restoration before feeding the composite signal to the LC749880T (Image controller LSI for LCD-TV).

• Nothing when energized? Let's dig in

  Florian • 07/06/2021 at 14:25 • 0 comments

  To confirm the power voltage of the display module and so the power generated by the step-down DC-DC regulator (LM2736YMK), I plugged the intercom to main power and did some measurements with my multimeter. I mainly focus my attention on the area where the display module connects to the mainboard, which is the following:

  Unfortunately, despite the intercom being energized and being responsive when the front botton "通話/終話" was pressed, there was absolutely no voltage whatsoever in this area of the board. I thought something was wrong with my multimeter so I poked at the transformer and it's surrounding: my multimeter was working well. 

  So after this infructuous result, I decided to reverse-engineer the traces going to this CN101 connector and damn that was a lot of work! But it was totally worth it as I managed to figure out:

  • the mainboard provides 12V to the display module, which is generated from the video feed signal
  • the LM2736YMK on the display module does generate 3.3V (calculated from the datasheet)
  • the received video signal is FM modulated (demodulation IC is LA72910V from SANYO)
  • pin 5 of CN101 on the display module is connected to the brightness control potentiometer of the mainboard 

  For more details, here is an image of the schematic I created but you can find the corresponding Kicad file in the FILES section.

  My next course of action will be to simulate that circuit I didn't understand the purpose of and also see if I can connect that cheap 4.3" screen with double composite video input I bought quite a while ago. I hope it will be as easy as just connecting it to the mainboard video output to get it towork. 

• More about that display module

  Florian • 06/27/2021 at 01:27 • 0 comments

  Let's see that display module in details: 

  it is labeled "TB10126 R" (frame top side), the TFT display itself is made my AUO and labeled "06B806Z84B227I026A0U00 8501". Those keyword returned nothing on Google so let's have a look on the back.

  A 10 pin connector CN101, to which only 6 connections are made. Also, 3 big ICs (one is under the ribbon cable) which are:

  • left to CN101 connector: SANYO LC749880T ➡ Image controller LSI for LCD-TV 
  • top one: 501S417 1146MK07 MYS ➡ unknown
  • under the ribbon cable: XILINX XC9572XL ➡ High Performance CPLD

  From the SANYO image controller datasheet, one of its feature is ”CVBS, S-Video,YCbCr/YPbPr input" and a closer look at the input table shows 2 CVBS inputs, one S-Video input and one YCbCr/YPbPr input. As this controller is right next to the only connector on this display module, I traced all the pins connection with a multimeter and came up with the following schematic:

  To summarize:

  • pin 4, 6, 8 and 10 are GND
  • pin 9 is Vin (I assume 12V), which is step-down to 3.3V via a LM2736
  • pin 7 is composite video input, which goes through a... I don't know circuit and then to CVBS1 of SANYO LC749880T
  • pin 1, 2, 3 and 4 are unknown and are connected to respectively pin 2, 23, 22, 2 of the unknown IC

  Next time I will confirm the input voltage of this display module, the ouput voltage of the LM2736, simulate the circuit between the composite video input and CVBS1 to understand its function and maybe analyze the intercom mainboard's circuit to which this display module connects.

• I got myself a new toy

  Florian • 06/22/2021 at 13:34 • 0 comments

  After a quick search on mercari and Yahoo Auction, I found someone selling an used video intercom unit with a door intercom at a decent price so I bought it.

  First things first , let's see what's inside!

  A transformer, 2 pcbs and a display module? The fact that the display is a modular unit by itself is a great news. If I can find a datasheet for it I would be able to easily identify its pinout and understand how it connects to the intercom mainboard. Which would greatly help me figure out if I can easily swap the display for a bigger one.

  Here are more photos of the pcbs: first the tiny one (seen on left)

  The mainboard one:

  And the same one, but this time back side:

  In my next log, I will have a closer look to the display module, try to find some information about it and figure out its pinout.

• First, gathering information

  Florian • 06/16/2021 at 10:41 • 0 comments

  So what is it? 
  A video intercom model GAM-2MK made in 2008 by a Japanese company named Aiphone.

  A quick search on Google and here is the company site. From here, ダウンロード > 商品情報・データ・ソフトウェア and using the quick model search, we arrived to this page with all download available documents: profile sketch (DWG and DXF) and specification. No manual? Well with some help of Google again, here it is.

  From this few documents I didn't discover much:

  • the display is a 2.5inch TFT
  • this model can only be connected to a GAX system
  • its connection diagram is as follow (RA1/RA2 is the video feed, R3/R4 is the sound feed)

  Maybe I could find more information if I look for documents for the video entrance panel?
  Back to manufacturer site, a quick search with the word GAX and here is the video entrance panel. Unfortunately all there is a specification document and after reading it, nothing really useful in it.

  Well, guess I will simply look for an used video intercom that I can play with it at will. Can't really do that with the one installed in my apartment as I'm just renting the place and I don't want to risk damaging it.

View all 9 project logs