Hotpoint Aquarius FDW60 dishwasher controller board

Some information on the Hotpoint Aquarius FDW60 dishwasher controller board for anyone interested in DIY repairs. The following was gleaned from an evening of poking around. I'm not certain about anything here, but hopefully it might be of use to someone else. If you have any feedback please post a comment at the end of this posting.

Warning: if the dishwasher power switch is on this board will have live mains (230V) PCB traces which are a shock hazard. Only access this board if you know what you are doing. It may also void your warranty.

The underside of the controller board. The large chip is the MCU (Renesas 6433662B94H). The triacs near the connector at the bottom of the photo are a 4 Amp STMicroelectronics T4-0560 (large triac on left) and 5 smaller triacs: Z7SY424 (also ST Microelectronics, but sorry can't find the datasheet). The triacs are located on the neutral (N) side of the load so the inputs to these triacs float at 230V AC when off.

I don't know what the 8 pin IC to the left of the MCU is – I'm guessing an EEPROM. The microswitch is the "Delayed Start" front panel button. The connector at the top-right connects the LEDs and switches on the left side of the dishwasher's front panel. The large traces at the bottom left provide power for the water heater.

This photo is the top side of the controller board. Visible are: black relay for heater on left. Buzzer (black disc in the center). The white wire pair connecting to the board at the bottom of the photo is (I believe) the water intake flow meter. The black wire pair I guess to be a temperature sensor. The blue component just above the barcode label is a combined crystal/capacitor for the MCU clock. Misc components to the left of the board are a mains to DC power supply for the low voltage electronics.

The 4 pin header to the right of the buzzer seems to be a diagnostics port. Pins on this header from left to right connect to the MCU's NMI, RXD, TXD. The last pin I'm not sure about. I thought ground would be the obvious choice, but I was seeing -5V on RXD and TXD relative to this pin. Maybe it's a +5V. This needs to be investigated further another time.

This is a close up shot of the MCU. The first digit is a '6' is difficult to see in this photo. The marking is 6433662B94H.

This is what I could figure from the mains voltage (230V AC) connector on the controller board:

White, Gray and Brown are sense wires (MCU senses presence of 230V AC or not).  Blue,  Red/Blue, Black, Violet, Red and Cyan drive a load (motor or actuator).

Orange	Provides 230V AC power to the board.
White	Sense: ? water pressure -- it can sense if wash arm is obstructed
Gray	Sense: Salt related ?
Brown	Sense: float switch on drip tray – triggered in the event of a leak
Blue	Wash pump motor
Red/Blue	Lower wash arm valve
Black	Drain pump
Voilet	Salt related?
Red	Water intake valve
Cyan	Detergent release door

Other information:

My 'howto' on unsticking the FDW60 drain pump:
http://jdesbonnet.blogspot.com/2010/11/hotpoint-aquarius-fdw60-drain-pump.html

Interesting dishwasher application note from Renesas:
http://am.renesas.com/applications/consumer/home_appliance/dishwasher/dishwasher.jsp

Excellent dishwasher hack here ("Arduino Controlled Dishwasher"):
http://www.neonsquirt.com/dishwasher.html

Please add any additional information or corrections in the comments below. Thanks!

Why does my tooth brush have a wireless network?

My toothbrush (Braun Oral-B 5000) has been displaying a nagging "Replace brush head" message recently. I initially though nothing of it. Almost all consumer electronics will nag you when some consumable needs changing.

But then I thought: how does it know? It's not like the head is wired in. It's deliberately detachable for cleaning. There are no electrical contacts. Could it be there is a RFID chip in the head and a RFID reader in the tooth brush?

Sure enough the Braun Oral-B 5000 features a RFID reader and RFID chips in the heads – a toothbrush area wireless network!

Out of curiosity I wrapped about 1 meter of magnet wire (about 30 turns) around the head and connected it to an oscilloscope. There is a strong excitation signal at about 13MHz for about a second after the brush is powered up.

A quick google of  "13MHz RFID" does reveal that 13.56MHz is popular RFID frequency. Unfortunately decoding this signal seems involved. There is an open hardware sniffer project here: http://www.openpcd.org. However I don't really have the time or incentive to hack my toothbrush right now.

An oscilloscope trace from the coil wrapped around the toothbrush head. A strong signal of about 75ns period is observed for about 1 second after the brush is switched on.

Sanitas SBM30 (aka HL868BA) teardown

The next step of my Ambulatory Blood Pressure Monitor (ABPM) project is to move from a wrist cuff monitor to an upper arm cuff which is far more practical for ABPM. My local Lidl store just had a Sanitas SBM30 upper arm cuff BP monitor on special offer. So I bought one. I was pleasantly surprised to find that it is almost identical to the HL168Y which my previous modification was based on. (Indeed the fine print on the box states that it is identical to the HL868BA).

As it is likely to be a few months before I can post an update on my ABPM project, I've provided some tear down photos and some technical information about this device in case anyone else would like to modify it.

Opening the device:

Before proceeding to open, be aware that this is likely to void your warranty. It may also comprise the reliable operation of the device. So if you require this for medical reasons I would advise you get a separate device for experimentation and clearly label which is which.

At the bottom of the device two screws need to be removed. The top and bottom parts of the case can then be separated. There are 6 plastics clips (is that the right word?) located at the left center and right of the top and bottom.

Once the top is removed, the rubber button contacts can be lifted off. Next remove screws at the top of the LCD holder. Carefully remove the LCD from the white holder. Be careful not to damage the LCD or the cable which attaches it to the PCB. This will expose two more screws under the LCD. Removing those screws allows the white LCD holder to be removed. Now the top of the PCB is exposed. Unfortunately the LCD is permanently connected to the PCB. It will not be easy to reconnect if it is detached for any reason.

Test pads:

Unlike the HL168Y where the test pads are scattered around the PCB, the test pads on this device are conveniently brought together exposed through a slot in the battery compartment. The pitch is 2.54mm. In theory this should facilitate the construction of a cable to mate with these test pads. Any suggestions on how to accomplish this would be greatly appreciated. Please email jdesbonnet at gmail dot com if you have any suggestions.

Test pads TP8 and TP10 are for power and ground respectively, so any such cable can dispense with the need for batteries. Perhaps the connector can be attached to the battery compartment cover. TP 1 to 4 are directly connected to the front panel buttons. Pulling these low is the same thing as depressing a button. TP15 and TP18 can be used to snoop on read/write traffic to the EEPROM (see earlier posts on how to do this).

TP1	"Mode" button. Pull to 0V to activate.
TP2	"Set" button. Pull to 0V to activate.
TP3	"Memory" button. Pull to 0V to activate.
TP4	"Start" button. Pull to 0V to activate.
TP5	?
TP8	+5V / battery
TP10	0V
TP15	EEPROM I2C bus SCL
TP18	EEPROM I2C bus SDA

The MCU:

This is similar or identical to the MCU in the HL168Y. The chip marking first line reads 86CX23, the second line HLEEF7. It seems to be a custom chip made by the Health and Life Co (the "HL"). I have no doubt it's based on some standard core. But beyond that I have no clue what's going on inside... nor is it necessary to know for my application.

The EEPROM:

The device uses the EEPROM chip to store blood pressure records and a few configuration variables. This chip is a ST Microelectronics 24C08WP. This is the same 8 kbit (1 kbyte) chip used in the HL168Y. I didn't get a chance to verify if the memory map is the same as that documented for the HL168Y. I would be surprised if it differed. The data can be accessed by passively snooping on the bus SCL and SDA lines (TP15 and TP18). I've documented a way of doing this in this blog post.

The following is a description of the HL168Y (and presumably the HL868BA also) memory map:

Blood pressure records  are 8 bytes long starting at address 0x0010 and are always 8 byte block aligned. First record is stored at 0x0010, next at 0x0018 etc.

byte 0	month 1 .. 12
byte 1	day of month 1 .. 31
byte 2 bit 7	Hour of day pm flag. am if clear.
byte 2 bits 3:0	12 hour clock time
byte 3	minutes 0 .. 59
byte 4 bits 7:4	the hundreds decimal digit of systolic BP in mmHg
byte 4 bits 3:0	the hundreds decimal digit of diastolic BP in mmHg
byte 5 bits 7:4	the tens decimal digit of systolic BP in mmHg
byte 5 bits 3:0	the least significant decimal digit of systolic BP in mmHg
byte 6 bits 7:4	the tens digit of diastolic BP
byte 6 bits 3:0	the least significant digit of diastolic BP in mmHg
byte 7	heart rate in bpm (beats per minute)

Locations 0x0000 to 0x000f are reserved for other things. I haven't figured out what they are all for yet.

Location 0x0007 is the number of BP records in memory.

The pneumatics:

The pneumatics comprises a pump, electrically activated release valve, a slow release valve and a pressure sensor (on the PCB). The configuration is identical to that of the HL168Y which I have documented here.

More tear down photos are here:
http://picasaweb.google.com/jdesbonnet/ABPMProject

If you have any questions or information to contribute, please do not hesitate to contact me by email: jdesbonnet at gmail dot com.