{"id":3269,"date":"2018-02-26T00:00:25","date_gmt":"2018-02-26T08:00:25","guid":{"rendered":"http:\/\/192.168.3.4\/?p=3269"},"modified":"2026-06-02T17:58:38","modified_gmt":"2026-06-03T00:58:38","slug":"co-detector-hack-part-2","status":"publish","type":"post","link":"https:\/\/www.cloudacm.com\/?p=3269","title":{"rendered":"CO Detector Hack &#8211; Part 2"},"content":{"rendered":"<p>Now that I have headers and pins soldered on the CO detector, I&#8217;m ready to start taking some measurements with my test equipment. As I mentioned before, I prefer to use them in a certain order. First I&#8217;ll start by taking resistance measurements with my multimeter.<\/p>\n<p>One of the header pins is labeled GND1. I want to test if this ground is common to some other points on the board. Besides the negative battery terminal, this pin was also common with another pad labeled TP2. TP2 is located on the lower edge of the board, next to the positive terminal of SEN2 (the component that looks like a brown AA battery). Lastly, SW1 had a common ground on the top side of the switch.<\/p>\n<p>Next I&#8217;ll take voltage measurements using GND1 as my reference. Here are the results of the readings.<\/p>\n<p><a href=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/IMG_4043_Identifiers.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-3277\" src=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/IMG_4043_Identifiers-1024x553.png\" alt=\"\" width=\"640\" height=\"346\" srcset=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/IMG_4043_Identifiers-1024x553.png 1024w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/IMG_4043_Identifiers-300x162.png 300w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/IMG_4043_Identifiers-768x415.png 768w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/IMG_4043_Identifiers-500x270.png 500w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>Battery Positive Terminal, 9 VDC<br \/>\nSENS2 Negitive Terminal, 300 mVDC<br \/>\nSENS2 Positive Terminal, 300 mVDC<br \/>\nVPP1, 3.3 VDC<br \/>\nVDD1, 3.3 VDC<br \/>\nICSPDATA\/RS232, 60 mVDC<br \/>\nICSPCLK\/TRIG, 0 VDC<br \/>\nF3, 0 VDC<br \/>\nF2, -30 mVDC<br \/>\nH1-A, 0 VDC<br \/>\nH1-B, 0 VDC<br \/>\nH1-C, 0 VDC<br \/>\nLED1-A, 3.3 VDC<br \/>\nLED1-B, 3.3 VDC<br \/>\nSW1, 3.3 VDC<\/p>\n<p>With my initial continuity and voltage readings done, I&#8217;m ready to take measurements with the oscilloscope. I&#8217;m using a Paralax Prop Scope that I&#8217;ve had for several years. It requires using Windows to run, but it is cost effective.<\/p>\n<p><a href=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Prop-Scope-USB-Oscilloscope2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3270\" src=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Prop-Scope-USB-Oscilloscope2.png\" alt=\"\" width=\"640\" height=\"640\" srcset=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Prop-Scope-USB-Oscilloscope2.png 640w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Prop-Scope-USB-Oscilloscope2-150x150.png 150w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Prop-Scope-USB-Oscilloscope2-300x300.png 300w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Prop-Scope-USB-Oscilloscope2-270x270.png 270w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>All of my readings were using GND1 as the reference. The LED1-B red onboard indicator LED had a steady 3.3 VDC reading, this changed to 0 VDC when it was lit. During an alarm test, this led flashes 4 times with a 100 ms on \/ off cycle. The LED1-A mirrored the behavior of LED1-B.<\/p>\n<p><a href=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/LED1-A_Red.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-3271\" src=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/LED1-A_Red-1024x519.png\" alt=\"\" width=\"640\" height=\"324\" srcset=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/LED1-A_Red-1024x519.png 1024w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/LED1-A_Red-300x152.png 300w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/LED1-A_Red-768x390.png 768w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/LED1-A_Red-532x270.png 532w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/LED1-A_Red.png 1916w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>The H1-A, B, and C terminals are connected to the buzzer alarm. The readings on these terminals during an alarm event was on average 5 VDC. The multimeter missed this reading, but it was easy to see this with the oscilloscope.<\/p>\n<p><a href=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/H1-A.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-3272\" src=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/H1-A-1024x519.png\" alt=\"\" width=\"640\" height=\"324\" srcset=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/H1-A-1024x519.png 1024w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/H1-A-300x152.png 300w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/H1-A-768x390.png 768w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/H1-A-532x270.png 532w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/H1-A.png 1916w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>The last and most interesting reading was from the ICSPDATA\/RS232 terminal. Here I saw a data stream that had a peak reading of 3.3 VDC. It was easy to see the packet length using the oscilloscope. The packets are 40 ms bursts that occur at roughly 1 second intervals.<\/p>\n<p><a href=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-3273\" src=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232-1024x519.png\" alt=\"\" width=\"640\" height=\"324\" srcset=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232-1024x519.png 1024w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232-300x152.png 300w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232-768x390.png 768w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232-532x270.png 532w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232.png 1916w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>Now with my intial readings done, I&#8217;m rather comfortable using my logic analyzer on the CO Detector to find out more details. I&#8217;m using a Saleae logic analyzer.<\/p>\n<p><a href=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Saleae-logic.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3274\" src=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Saleae-logic.jpg\" alt=\"\" width=\"700\" height=\"492\" srcset=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Saleae-logic.jpg 700w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Saleae-logic-300x211.jpg 300w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/Saleae-logic-384x270.jpg 384w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/a><\/p>\n<p>I connected ground from the logic analyzer to the GND1 pin on the CO Detector. Then I connect lead 7 from the logic analyzer to teh ISCPDATA terminal on the CO Detector. I set my trigger to rise since the standby state is zero, then started my capture. I went through all of the available analyzers in the software and settled on Async Serial with the default values. None of the data seemed to make sense, so I&#8217;m not absolutely sure that I&#8217;m using the correct protocol.<\/p>\n<p><a href=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232_AsyncSerial.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-3275\" src=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232_AsyncSerial-1024x541.png\" alt=\"\" width=\"640\" height=\"338\" srcset=\"https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232_AsyncSerial-1024x541.png 1024w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232_AsyncSerial-300x158.png 300w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232_AsyncSerial-768x405.png 768w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232_AsyncSerial-511x270.png 511w, https:\/\/www.cloudacm.com\/wp-content\/uploads\/2018\/02\/ICSPDATA_RS232_AsyncSerial.png 1919w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p>At any rate, I saved my sample and I can revisit this at a later time. From what I&#8217;ve gathered, ISCP is used to program PIC chips after the board is manufactured. Based on the board design and what appears to be missing components, I&#8217;m going to assume that this board is capable of other features. This link provided me some insights about ISCP, <a href=\"http:\/\/pic-microcontroller.com\/understanding-icsp-pic-microcontrollers\/\">http:\/\/pic-microcontroller.com\/understanding-icsp-pic-microcontrollers\/<\/a><\/p>\n<p>Now with the board headers and terminals in place, I&#8217;m ready to interface devices to the CO Detector.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Now that I have headers and pins soldered on the CO detector, I&#8217;m ready to start taking some measurements with my test equipment. As I mentioned before, I prefer to use them in a certain order. First I&#8217;ll start by taking resistance measurements with my multimeter. One of the header pins is labeled GND1. I want to test if this ground is common to some other points on the board. Besides the negative battery terminal, this pin was also common&#8230;<\/p>\n<p class=\"read-more\"><a class=\"btn btn-default\" href=\"https:\/\/www.cloudacm.com\/?p=3269\"> Read More<span class=\"screen-reader-text\">  Read More<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-3269","post","type-post","status-publish","format-standard","hentry","category-rd"],"_links":{"self":[{"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=\/wp\/v2\/posts\/3269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3269"}],"version-history":[{"count":4,"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=\/wp\/v2\/posts\/3269\/revisions"}],"predecessor-version":[{"id":5285,"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=\/wp\/v2\/posts\/3269\/revisions\/5285"}],"wp:attachment":[{"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudacm.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}