I need help with Sonic toothbrush hacking

I am wondering if any of the experts here could answer any of these questions with the limited information that I can provide

Information that I have:

The Philips toothbrush has a two minutes turn off timer!

a 30 second quad spacer (brief pause of vibration) every 30 seconds

The pcb has a TI MSP430G2412 microcontroller ( http://www.ti.com/product/msp430g2412 ) with the additional markings of “ 21K G4 “ and “ AS&F A ” on it.

It drives an electromagnet that consists of two coils, at approximately 1 KHz

Most of this and some more is visible on the pictures of the pcb and the assembly that I included.

My QUESTIONS are:

1, What is the easiest way to disable or change the 2 min power off timer??

(I very much would prefer not to reprogram or to replace the microcontroller, but if there is no other way than )

2, Is it possible to reprogram this specific controller and if yes is it possible to do so without disordering it?

I know it is a long shot, but I hope that one of you creative people can help me with a solution.
Thank you very much for your time spent thinking about this!

 

You cant change the timer as it will be in the micro programme, so unless you have the source code, your stuffed!.

 

Thank you for your reply even if it is not the one that I am waiting for.
If it is not possible to change it I will gladly settle for circumventing disabling it by some other non programmatic means.

Any second opinions on the subject?

PLEASE!

 

You might start by recreating the schematic. It should be straight forward if it is a 2-layer board. If it is a 4-layer board with signal traces on the internal layers it will be substantially more difficult. It will take you a while but you might learn something in the process.

The bad news for you is that I did not see an obvious connector where a programming fixture for the processor might be attached. Unlike numerous remote controls that have an "obvious" 6-pin ICSP adapter for Atmel parts.

 

Dave has it right - the timer will most likely be done on the microcontroller.

You might be able to read the program that is on the uC, but a binary file isn't too much use unless you want to wade through opcodes and determine where the timer is being setup and modify that, then reprogram the uC.

That is all of you are very lucky, there will probably be a code protect feature that prevents you from reading or writing over the memory.

 

You might start by recreating the schematic. It should be straight forward if it is a 2-layer board. If it is a 4-layer board with signal traces on the internal layers it will be substantially more difficult. It will take you a while but you might learn something in the process.

The bad news for you is that I did not see an obvious connector where a programming fixture for the processor might be attached. Unlike numerous remote controls that have an "obvious" 6-pin ICSP adapter for Atmel parts.

It looks like the pads on the underside of the PCB are the programming interface (TDIO, TCLK, VDD, GND)...

 

Why would you ever want to disable a power off timer on a toothbrush?

 

Good catch. TI has JTAG programming tools that might be useful, but you won't know if the code protect feature is on until you try it. The slightly good news is that after you erase the part, you will have a blank slate to work with and you can knock yourself out doing your own bare metal programming.

Of course you could just as easily buy an evaluation board and do the same thing -- probably for less money than a sonicare!

 

You could add a multivibrator that fires every 90 seconds that shorts the power supply through a 10 ohm resistor and restarts the microcontroller. That way it will never reach the 2 minute time-out.

 

Why would you ever want to disable a power off timer on a toothbrush?

Maybe he is one of them, responsible of cleaning all the teeth.

 

I would start with drawing the pinout of the 20-pin MSP430G2412. Not all the pins are used.

Try to identify the function of all the pins that are connected.

Next I would examine each pin with an oscilloscope as the toothbrush is running.

With that information you can write your own code.
Then I would unsolder the existing MCU and replace it with a blank MCU programmed with the new code.

Very doable.

 

The MSP430G2412 does indeed have a code protection feature, and I can almost guarantee it's been activated. You're best off buying a new one and replacing the old one with it (after you're certain you will be able to replicate the old one): http://www.digikey.com/product-detail/en/MSP430G2412IPW20/296-29607-5-ND/2597248

 

All for a toothbrush... Some people/requests amaze me..

 

Hey! It's not just any old toothbrush. It's a sonic toothbrush. Cleaning your teeth with it immediately transcends you from the plane that is our reality. Every mortal being in possession of this device has failed at explaining the experience, for our language lacks the descriptivism required. Legend tells of your eyes being opened to the wonders of eight dimensional dirt flying from the cracks of your teeth. Dental floss flows over liquid gums as your tongue melts into putty. Why are the teeth speaking German? Children cry from the top of stairs as toothpaste explodes from your nostrils like so many powdered tears. The brush extends its hairs like so many tendrils of tooth filling.

...And then the toothbrush stops, for the adventure of bliss has been timed by its creators to exactly 2 minutes and no longer.

THIS is why we must destroy the timer limiting us.

TheComet

 

All for a toothbrush... Some people/requests amaze me..

Pushing a button a second time must be overwhelmingly difficult.

For a list of other obstacles that our friends and neighbors have in their modern lives, see: http://first-world-problems.com/

I feel the need to donate to some foundation to help our OP.