Well, the good news is that I got an entire day to dissect the HHB base station, and now have a much more thorough understanding of the inner workings of the device. The bad news is that I managed to kill my base station in the process, probably by mercilessly probing for continuity trying to decipher internal device connections. C’est la vie – good thing these things are cheap. I hopped on Ebay and ordered a couple of new base stations in case I manage to kill another one, should be here next week. Read on for full details!
I purchased my first HHB hardware before I had any experience with Microcontrollers. I was attracted to the device because it performed a lot of what I was looking for out of the box. The fact that Eaton had recently discontinued the service was not a major concern, as I figured that I would be able to get something out of the device, even if it was only a learning experience. My initial exploration of the device was via the serial console, and my discoveries in that area were quite heartening; at the very least I would be able to use the device to monitor the commercial sensors created by Eaton.
My attention was diverted last summer due to a number of personal issues, some of which I’ve written about on this blog. I didn’t have a lot of time for hands-on exploration, but I had boatloads of time available to read; I took advantage of this opportunity to dive headlong into the world of microcontrollers, starting with the Arduino. That lead to general microcontroller study, first with the AVR devices followed by the TI MSP430 and various PIC variants. It didn’t take a lot of experimentation before I realized that I really needed to brush up on electronics basics, as my designs often behaved oddly when fully assembled.
Fast forward nearly a year and my attention has ended up back with the Home Heartbeat hardware. It occurred to me that it might be interesting to tear down the base station, document the components, connections, and signals that I find, and see whether or not it would be possible to truly hack and extend the device.
The HomeHeartbeaat base station is an interesting device internally. The circuit board appears to be a four-layer design and contains a frightening number of vias, making it a bit more difficult to reverse-engineer. After spending some quality time with the device and a combination of my DSO, a logic probe, and my trusty multimeter I was able to track down most of the connections between components.
MCU: Atmel ATMega128L
This is the brains of the device. Bristling with I/O ports, it’s the big brother to the ATMega328 familiar to Arduino users. 128K flash, 4K EEPROM, 4K SRAM. The ATMega128 also utilizes a 256K parallel static RAM chip (ISSI IS62LV256) to provide additional working memory; Port A on the MCU is pretty much dedicated to this task. An LCX573 octal latch is also utilized in communication with this device.
RF Section: Ember EM2420
The EM2420 is a single-chip ZigBee/802.15.4 transceiver. This device is responsible with communication with wireless sensor nodes. The MCU communicates with this device via SPI.
Note that the above diagram shows a 93C46B serial EEPROM connected to the MCU; I was actually unable to validate any connections to this device. It is quite possible that the EEPROM is actually used by the EM2420 for code or device storage.
Modem: Silicon Labs si2404
Dial-up communication with the (now defunct) homeHeartbeat service was managed with a two-chip modem solution from Silicon Laboratories. This solution is a 2400bps dial-up modem with caller id capabilities, and is made up of two chips – the si2404 handles serial communication and modem logic, while the si3010 provides access to the phone line and all of the analog modulation jiggery-pokery. The MCU communicates with the modem via UART1 (pins 27 and 28); There are a handy pair of vias available on the board for easy access to these signals for logic probe monitoring.
USB/Serial Bridge: FTDI FT232BM
USB/Serial connectivity is provided via this device, which at this point has nearly universal operating system support. Since most modern machines no longer contain an old-school RS232 serial port, this is a very handy feature. The MCU communicates with this device via UART0 (pins 2 and 3).
Most of the important components of the base station are mounted on the back side of the board.
I’ve also indicated a couple of handy vias for monitoring serial communication between the MCU and the modem chipset.
J19 Appears to be an ICSP port, except that it is not wired as expected; pins 1 and 5 are connected to Rx/Tx of UART0 instead of MOSI and MISO.
ICSP Port Pinout
The two vertical bars at the top of this image are magnetic switches which correspond to magnets mounted in the case of the Eaton HomeKeys. Pins are for charging the keys; if you look at the front of the board in this location you will see a couple of tiny SMT LiPo charge devices.
I was able to monitor the serial communication between the MCU and the modem using my Saleae Logic USB Logic Analyzer and the handy Tx/Rx vias indicated on the “Back Side” picture above. Pretty standard AT command set stuff for much of it, though it’s interesting to note that during the modem initialization step the MCU uploads a large amount of data to the modem (via the AT:P… command sequence documented in the si2404 manual); this process takes about 9 seconds (!) before the modem attempts to phone home.
Some of the signals on the ATMega128 were hard to trace and remain something of a mystery. For example:
- PE2: 1 square wave pulse every 3 seconds
- PG3: 1.4Hz sine wave (sorry, I didn’t measure vPP)
- PG[0:1], PC[0:3]: Square waveforms indicating either a serial or bit-banging data stream
The last could quite possibly be related to SRAM or the mysterious EEPROM mentioned above.
On the top edge of the front of the circuit board there are two components which I was unable to successfully identify. The first component, marked as U14 on the circuit board, is stamped with identifier “R1022G50 62A9HHE”; Based upon the package, I’m assuming that it’s either a voltage regulator or provides charging support for the HomeKeys. The second component is marked as U12 and is stamped with identifier “806I 0428″; there are several test points on the circuit board surrounding this component. Again, I’m assuming that it is involved with HomeKey charging, as I didn’t see any activity on this device during my bench tests. If you’ve got any information about these components please let me know and I’ll update this post accordingly.
The HomeHeartbeat base station is surprisingly hackable. It would be quite possible to replace the firmware on the ATMega128 to perform any number of tasks, either via ICSP or through the onboard firmware (which natively supports firmware uploads). The onboard modem supports Caller ID, so this may be useful to someone who still had a landline. The most challenging aspect to hacking this device would be communicating with the Ember ZigBee chipset. Fortunately, there is no shortage of publicly available information in this arena, so that should not present an insurmountable challenge.
I purchased two new base stations to play with; the first will remain sealed and pristine, and I’ll try messing with firmware on the second. If anyone would like to help out with this endeavor, I’d be happy for the assistance!