Reverse Engineer a LED Message Board

Thread Starter

SJU

Joined Oct 15, 2011
6
Hello Everyone,
I am trying to learn about circuit design, embedded programming and reverse engineer a LED message panels to create an upgrade system.
What I have to play with
I recently discover five LED message systems with each comprised of four display panels - 3 general with a fourth panel used as clock. The first three panels consist of 2 rows 9 columns with Red Only LED Matrix PARA LIGHT C-5580SRD 5x8. The fourth display sign (2 rows 6 columns) PARA LIGHT C-5580SRD (5 x 8). All panels is powered by 9 volts and daisy chained by 10 wire connection.
The controller or interpreting board uses a Z80 CPU and M27C512-12F1 as custom ROM.
Web Search - A web search did not locate the company for a DIGITAL FAX. Several produced a similar system, but the cost of updating and support seemed steep.
Information
The documentation for setting up the units shows a dedicated computer software creates the message then transmits the information to RS232 port then converted to a RS485 (4-wire phone line) to the unit. The units could be daisy chained to each other to create a broad messaging system.
It seems the unit was built in late 1999 or 2000 (discovered from documentation for wiring a compute to the unit). I took a series of photos and iPhone video of the controller and a display board. They can be reviewed at http://gallery.me.com/stevenulbrich/100040

I am looking for any help and insight.

Steven
 

colinb

Joined Jun 15, 2011
351
Maybe if you had a specific question you could get better answers.

It looks like these display panels are of a fairly standard design, with shift registers (74164), Darlington transistor arrays (ULN2003A), for some reason a 4000-series CMOS shift register thrown in (4094, why mixed with 74164 ICs?), ...

The Darlington arrays drive the columns and the discrete PNP Darlington TIP107s at the bottom drive the whole row, since the discrete transistors can supply much more current and they might have to drive 8 LEDs or so at a time.

Charged with enough curiosity, one could fairly straightforwardly fully reverse-engineer the schematic from the boards.
 

THE_RB

Joined Feb 11, 2008
5,438
Just start feeding data into the serial input and see what it does!

If it has a Z80 and a ROM it may have a ascii lookup inbuilt, so each ascii character you send will be displayed and scrolled on the display. There may also be some control codes in the low ascii numbers that turn on features like flashing etc.
 

Thread Starter

SJU

Joined Oct 15, 2011
6
Colinb,

Thank you for the information, it one more step to my understanding. I am still working out my specific questions.

At this point, the first control board is not responding. I no idea how long they were sitting in storage. So the idea of pushing data to the RJ11 port is not an option. Granted, I could look at the other system, but I want to look at this one fully before doing any damage.

Please Understand I'm a noob at this. I feel so stupid. My background is software development, networking and databases. I'm so out of my element, but feel like this could be so fun.

Question

1. By applying power to the unit (9 volt) on the back of the unit. How should I go about transmitting data to the serial port on the back. image of connection

At a basic level, I want to light up 1 or all of the LEDS. I have removed the power supply. It is a 120 AC to 9V DC system.



Steven
 

colinb

Joined Jun 15, 2011
351
Please Understand I'm a noob at this. I feel so stupid. My background is software development, networking and databases. I'm so out of my element, but feel like this could be so fun.
Don't worry, you'll get there if you're curious and persistent. Be curious. Ask questions and try to discover the answers. I'm formally educated mainly as a software developer too, but you'll find it very useful to know both hardware and software. If you ever work on a project that involves both hardware and software pieces, you'll be invaluable because you will be able to interface between the hardware and software teams, most of which (I've found) don't have much experience in the other field.

At this point, the first control board is not responding. I no idea how long they were sitting in storage. So the idea of pushing data to the RJ11 port is not an option. Granted, I could look at the other system, but I want to look at this one fully before doing any damage.
Question

1. By applying power to the unit (9 volt) on the back of the unit. How should I go about transmitting data to the serial port on the back. image of connection

At a basic level, I want to light up 1 or all of the LEDS. I have removed the power supply. It is a 120 AC to 9V DC system.
OK, so you have two systems, one of which doesn't respond to your input on the serial interface on the control board? How do you know if it is responding? Do you have a software program to control it? You'll need to know baud rate and the protocol format in order to talk.

Do you know the RJ11 (?) jack's pinout? It looks like four wires. Usually serial needs just three: ground, TxD (transmit data) and RxD (receive data). It might be that the other wire is the logic voltage for I/O level matching, but I can't say for sure. You'll need to know if the control board requires RS-232 (±(3 V – 15 V)) or logic level (0 V/5V or so). If it's meant to interface with a user's computer, it's likely to have RS-232 levels. It would likely be very hard to reverse engineer the control protocol without a working system to observe.

It you want to use the LED matrix boards without the stock control board, you'll obviously have to understand the 10 pin connector between matrix boards. The matrix boards may configured as daisy-chained serial shift registers, but based on the octal bus transceiver (74HC245N) it is likely 8-bit parallel data being clocked in. That only leaves 2 pins... one is probably the data clock, the other might be ground, or possibly it is a frame synchronization signal -- if power is coming from another source, then signal ground reference is possibly established from that shared power source.

What are those counter ICs doing? These type of integrated LED matrices require multiplexing due to the way they are wired: you can only fully address one row or column at a time, so you must scan it rapidly to make the desired pattern appear (persistence of vision effect). These counter ICs probably control the multiplexing scanning rows or columns.

Question on the photos:
Do you have two different LED matrix boards? I see in IMG_1011_1 some TIP107 Darlington transistors (TO-220 package) with reference designators TR13, TR12, TR11, TR10, TR9. However, I don't see these same TO-220 transistors on other photos, such as IMG_0969 “LED Matrix Front”. I'm a bit confused. Any chance you could post some high resolution shots showing the entire front and back of the matrix board front a direct top-down angle? The pics on your album are a bit small, having been scaled down for the web album. (You can upload big images to ImageShack or other sites.)
 

Thread Starter

SJU

Joined Oct 15, 2011
6
I hope that I can clarify. I discovered 5 systems at work. They came from a site that was closing down. It was the hope that the LED message boards could be used at my site. Unfortunately, they came without software or the RS233 to RS485 adapter. This is based physical installation documents (old fax). A review of the message boards showed a note “Bad Controller Board.” Therefore, it became the natural candidate to work with.

A review of the documentation shows:
· Baud Rate can be selected on the controller board from 9600, 4800, 2400 or 1200.
· Termination Jumper of Open or Terminated @200 OHMS
· ID selection from 1 – 8

The protocol is not known.

Do you know the RJ11 (?) jack's pinout? It looks like four wires. Usually serial needs just three: ground, TxD (transmit data) and RxD (receive data). It might be that the other wire is the logic voltage for I/O level matching, but I can't say for sure. You'll need to know if the control board requires RS-232 (±(3 V – 15 V)) or logic level (0 V/5V or so). If it's meant to interface with a user's computer, it's likely to have RS-232 levels. It would likely be very hard to reverse engineer the control protocol without a working system to observe.
Scanning and uploading documents tomorrow. It might help with the connection from a computer to the message board.


If you want to use the LED matrix boards without the stock control board, you'll obviously have to understand the 10 pin connector between matrix boards. The matrix boards may configured as daisy-chained serial shift registers, but based on the octal bus transceiver (74HC245N) it is likely 8-bit parallel data being clocked in. That only leaves 2 pins... one is probably the data clock, the other might be ground, or possibly it is a frame synchronization signal -- if power is coming from another source, then signal ground reference is possibly established from that shared power source.
The message board consists of 4 boards. The first three panels are for user-defined messages and the last is for a clock. The circuit design of the first 3 is slightly different from the 4th. The message panels are connected by metal plate and screw that allows grounding point. The same 10-wire pin connector is used from panel to panel.

I will make a short video of complete message board showing the controller and LED panel layout.


Question on the photos:
Do you have two different LED matrix boards? I see in IMG_1011_1 some TIP107 Darlington transistors (TO-220 package) with reference designators TR13, TR12, TR11, TR10, TR9. However, I don't see these same TO-220 transistors on other photos, such as IMG_0969 “LED Matrix Front”. I'm a bit confused. Any chance you could post some high resolution shots showing the entire front and back of the matrix board front a direct top-down angle? The pics on your album are a bit small, having been scaled down for the web album. (You can upload big images to ImageShack or other sites.)


Yes, the system has two different LED matrix boards I will upload higher resolutions pictures to Flicker website.

Again thank you

Steven
 

Thread Starter

SJU

Joined Oct 15, 2011
6
Hi,

I was able to use a different controller board to light up the LED Panels (Clock and Message) with the start up routine.

Detail Images of the LED and Controller Boards - http://www.flickr.com/photos/sju-apprentice/collections/

The Active Message Board section has a AVI showing the message boards

With the controller board working is there a way to capture and understand how the LED panels are being controlled?

Steven
 

Thread Starter

SJU

Joined Oct 15, 2011
6
Hello Everyone,

Any recommendations, after reviewing the image and videos of how to reverse engineer the controller board to something more up to date?

:)

Steven
 

colinb

Joined Jun 15, 2011
351
Hi Steven,
Thanks for posting all the images and videos. I haven't had a chance yet to study them in great detail, but I thought it was interesting that the last panel with the time showed an odd '=' (equals sign) like “3=:45”.

What would you like to do with the boards? Do you want to create your own controller? This may be the only way to make the boards useful since you don't have the PC software to interface with the controller. (If you did, you could then sniff the RS-232 communications to reverse engineer the serial protocol. But without working comms to sniff, it's essentially impossible to reverse engineer this protocol.)

Hopefully I'll have a chance to look at the boards in greater depth and maybe I can tell you something useful.

Does the clock board display anything when not connected to the controller? I'm curious why it is so different from the other boards. Perhaps it has its own character generation circuitry on-board while the other boards receive full bitmapped data from the controller.
 

Thread Starter

SJU

Joined Oct 15, 2011
6
colinb

I hope to replace the controller board to generate the Clock and Message Area. The communication to the board would use the ZigBee network to all the office to post message quickly.:D

I will try powering the boards without the controller tomorrow.

I have been googling the individual IC.:rolleyes:

The clock is controller by a M5832 IC for the date and time.

The LED panels are using a Darlington Array Register ULN2003A and HD74HC164. 8-bit Parallel-out Shift Register

Hope this helps
 

colinb

Joined Jun 15, 2011
351
I've been looking at your chip close-up photos and they provide some good shots of the ICs. But, it's really hard to trace out the circuits because the ICs and especially the LED matrices are covering traces, and you would need some very clean full-board shots of both front and back side of the board in order to trace connections from top to bottom. The top and bottom layer images would need to be precisely overlaid so that these through-connections could be matched up between sides.

If you really want to learn how the board works and make it useful, since you have multiple systems that are at the present completely useless, I suggest you might have to sacrifice one board for science. After desoldering the LED matrices and other components, the bare circuit board should be fairly straightforward to trace and analyze. (See [1].)

Sources

[1] PCB Reverse Engineering by John Armistead

[2] Reverse engineering PCBs with Photoshop

[3] Instructable: how to reverse engineer a schematic from a circuit board
 
Top