EEVblog #682 - Ness D16X Alarm Panel Repair - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: November 10, 2014, 11:35:59 am
content: Part teardown, part repair, Dave looks at an Australian designed and manufactured Ness D16X alarm panel that has failed.What's that smell?Can it be fixed?How do you repair solder mask on a PCB?, or add solder mask to your own home etched PCB's?And another look at PCB spark gaps.Datasheets:Fairchild F8http://en.wikipedia.org/wiki/Fairchild_F8Holtek DTMF Receiverhttp://www.holtek.com/english/docum/comm/9170.htmMaxcap Capacitors:http://www.maxcap.com.my/guideline.htmlEpcos MOVshttp://www.epcos.com/inf/70/db/var_11/SIOV_Leaded_StandarD.pdf

author: moemoe
author_rank: Regular Contributor
timestamp: November 10, 2014, 11:51:17 am
content: Here is your Temp Rating: 85°C

author: EEVblog
author_rank: Unknown
timestamp: November 10, 2014, 12:42:09 pm
content: Quote from: moemoe on November 10, 2014, 11:51:17 amAh, missed that on the camcorder monitor.

author: mux
author_rank: Regular Contributor
timestamp: November 10, 2014, 12:54:30 pm
content: Why did you need to repair this one? Where was it from? Who used it?

author: skyline_stu
author_rank: Newbie
timestamp: November 10, 2014, 12:56:53 pm
content: I've used that same solder mask-it really needs to be a thin layer as you've suggested.I think the micro's a Fujitsu H8-538 rather than a Fairchild device..And on the phone line it's more likely a gas discharge arrestor.

author: German_EE
author_rank: Super Contributor
timestamp: November 10, 2014, 01:36:22 pm
content: Cut traces to isolate the damaged area and then build a small daughter board to hold everything from the input MOVs to the bridge rectifier. The hole in the PCB can be repaired with epoxy to prevent any more carbonized PCB escaping. I suspect that the single trace from the AC input is to monitor the mains supply, drive a 'mains fail' LED and switch over to battery power.

author: free_electron
author_rank: Super Contributor
timestamp: November 10, 2014, 01:40:10 pm
content: Thats not a fair hild cpu but a Fujitsu ...

author: Fungus
author_rank: Super Contributor
timestamp: November 10, 2014, 03:34:30 pm
content: Dremel out the middle bit. Couple of wires from the PTCs to the rectifier...job done!

author: SeanB
author_rank: Super Contributor
timestamp: November 10, 2014, 04:14:32 pm
content: Lost mains neutral in the supply system, and was exposed to 300VAC or more as it was the low current phase. Transformed to around 25V and this cooked the Transorb that was across the 17VAC rail.The 7805 is the battery charge circuit, used with the ground lifted 9V1 by a pair of resistors to charge the battery with 13.8V, relying on the 7805 current limiting and overheat protection to protect the battery. The junction of the resistors to the 7805 ground pin is connected to the collector of a transistor, which is turned on every 15 minutes to turn the charger circuit off via the reverse blocking diode, so the MCU can read the battery voltage using a voltage divider on the board connected to an input of a multiplexer feeding the internal ADC. This is used to detect a failing battery so it will show a failure on the panel, and not fail silently with power off.The keyboard link allows you to connect both multiple keypads and input extenders, so that you can have more than 16 inputs ( up to 48/64 inputs most likely with 2 extra expanders) on the same control panel. Lots you can do as well, like partition it. or you have certain inputs connected to fire alarms which operate 24 hours, and cannot be bypassed, or you can use it as a UL listed fire alarm.

author: djQUAN
author_rank: Frequent Contributor
timestamp: November 10, 2014, 04:26:53 pm
content: Hi Dave,Was thinking of sending you an email again but decided to join the forum instead, so here's my first post here. Please be nice to meI just saw your vid on the repair and would like to comment on a few thingsAs per some comments, the uC is a Fujitsu brand. It has a different "F" than fairchild. A google image search confirmed thisThe part is an MB89F538 (http://www.alldatasheet.com/datasheet-pdf/pdf/153408/FUJITSU/MB89F538-201PV.html) 8bit uC.Also, the part that has burned is most probably a ceramic capacitor for EMC/EMI. You have the two caps from each line to ground and then a third across the AC input.In my previous work, for fire hazard reasons, we use two ceramic capacitors in series to prevent a direct short across the supply line causing a fire. With two in series, if one fails, the other will work fine no problem in the application.What I think happened here could be that the cap experienced a voltage spike across the lines or that it is cracked in the first place after thermal cycling or board flexing causing an internal short which resulted to a direct short on the AC input line then causing the cap to burst into flames. (Yes, I have caused the same type of flame on a project when I subjected an axial MLCC with voltage spikes.)Also, with regards to the MOV not being populated in the daughter board, we used to design everything into the PCB and populate everything in the initial design. After testing, we remove parts to save cost and check the performance if it still meets the requirements. If it still does, then we leave the part off in the next revisions up to the mass production stage.-Raymond

author: stitch
author_rank: Regular Contributor
timestamp: November 10, 2014, 04:41:10 pm
content: The lettering on the PCB suggests that the designers intended the alarm to be oriented opposite of what Dave thinks it should have been. If so, then the black residue isn't airborne soot at all, but rather downward flowing melt from maybe the case of the failed device. Maybe in such an orientation, the heat stovepiped up the heat sink, produced that "bit of charring on the cap", and overheated the device that failed.

author: SeanB
author_rank: Super Contributor
timestamp: November 10, 2014, 06:21:13 pm
content: Every alarm panel I have seen has the wiring at the bottom, with the board mounted right at the top of the case so you can fit the 12V 7.2Ah battery in the bottom, with all the wiring going to the cable exit in a mass of spaghetti with all colours. No other way, as you really want that battery at the bottom so when it does pop the gunk runs down and not across the board.

author: Switching Power
author_rank: Contributor
timestamp: November 10, 2014, 06:24:44 pm
content: Maybe i have it wrong but when the input voltage gets above 70V RMS the two MOVs to ground are basically in series and would absorb any spikes above 70V.

author: gardner
author_rank: Regular Contributor
timestamp: November 10, 2014, 06:30:52 pm
content: How many layers in that board? Is there a short in the internal layers?You never showed us the back of that section. What's it look like?EDIT -- there is a quick look at the back at 03:00 or so, and a frame or two without Dave's hand in the way.I was trying to see what J4 is about -- it looks like connecting the system ground to mains earth or leaving it isolated -- as here.

author: SeanB
author_rank: Super Contributor
timestamp: November 10, 2014, 06:49:22 pm
content: Quote from: Switching Power on November 10, 2014, 06:24:44 pmTrue, but I would bet that MOV across the rails is going to be a 25VAC part, as the main capacitor is a 30V part, so it will definitely blow apart at 70VAC input. 25VAC part will start to clamp hard at around 30VAC, and this will give around 40VDC across the capacitor. Not optimal for long life, but most capacitors will withstand a 30% overvoltage for a few minutes ( solid tantalum being the exception, along with OSCON as well) without going bang. You often see a capacitor with a rating of say 35VDC with a surge voltage of 42V permissible. Most might withstand a 50% overvoltage for 10 minutes ( way longer than the time it should take the mains fuse to fail from the moderate overcurrent from the transient suppressor) with no ill effect, and possibly a few will show visible signs of bulging, or a blown safety vent.The MOV devices to ground are there for lightning protection, along with the dual gas discharge tube on the telephone line side. Very common for high voltages to be induced onto phone lines and onto power lines, and to couple through the house wiring. The MOV's and GDT units are there to clamp this to a safe level, and couple the overvoltage to ground ( the installation also recommends a short high current lead to a grounded metal structure in a building, or to a dedicated ground rod outside or a copper or steel water pipe, to reduce impedance of this earth lead) safely. The spark gaps handle the internal iring spikes, note that the resistors used there on the inputs are not low voltage SMD devices but MELF packages that have a higher voltage rating and better surge capability.As the alarm will have to be directly on the incoming phone line ( it has to be the first device so the relay can pull in to disconnect the inside wiring from the line to seize it under any circumstance) it will be exposed to all incoming spikes.

author: sunnyhighway
author_rank: Frequent Contributor
timestamp: November 10, 2014, 07:26:32 pm
content: Quote from: gardner on November 10, 2014, 06:30:52 pmFull bottom vieuw:Close-up:

author: electronic_eel
author_rank: Regular Contributor
timestamp: November 10, 2014, 07:38:45 pm
content: Quote from: djQUAN on November 10, 2014, 04:26:53 pmThat would be my guess too.I have seen several MLCCs that went from ok to explosion or big flame after a year or two of use. I guess they crack through thermal stress, flexing of the board or improper solder profile during production.The crack is not a dead short but low ohmic, so the power supply doesn't shut off but continues to deliver power, heating up the cap more and more till the flames come out.The solution is either a very strict and tight current limit (e.g. an electronic fuse) or using two caps in series as Raymond suggested.

author: Yansi
author_rank: Super Contributor
timestamp: November 10, 2014, 07:45:28 pm
content: Have not seen the whole video yet (still watching), but Dave, you sure the two blue things are MOVs? In the silk there is Y10, Y11.. common way to mark Y series safety capacitors (Y1 or Y2 - 2 to 4 kV rated, I don't rember the exact value). Or have you read and decoded the part number?//EDIT: Meh, really MOVs ! O0But hey, thank you for some good video, about electronics, not that awful solar stuff. I look forwar for the next video!

author: Dave Turner
author_rank: Frequent Contributor
timestamp: November 10, 2014, 08:15:30 pm
content: Surely in practice this wouldn't be economical to repair.However if it must be repaired and given the depth of burn damage I'd grind out all the damaged substrate including the tracks.Then I'd use a compatible filler to reinforce the remaining board to the same thickness as there is a mounting hole at the corner. Then I'd create a small board to bond over the repaired substrate to mount the missing components and link to the existing connections.How would you solve the problem if the unit MUST be repaired?

author: PA0PBZ
author_rank: Super Contributor
timestamp: November 10, 2014, 08:36:03 pm
content: So if you mix charred pcb with liquid soldermask it turns low R

author: moemoe
author_rank: Regular Contributor
timestamp: November 10, 2014, 09:16:16 pm
content: Quote from: Dave Turner on November 10, 2014, 08:15:30 pmNot only this, here (germany) it would surely loose it's VdS approval and therefore your insurance could refuse to pay.

author: Vito_R
author_rank: Regular Contributor
timestamp: November 10, 2014, 10:09:51 pm
content: Ness is calling those small light bulbs "Current Limiting Globes" actually a cheap way they decided to go to regulate the battery charge current instead of designing a separate circuit. The installation manual describes how it works:Current Limiting GlobesThe current limiting globes serve to regulate battery charging current.When the battery is fully charged the globes will not glow. Theglobes will glow slightly when recharging the battery after a shortpower outage. If the globes glow very brightly the battery is drawingexcessive current and may be faulty, or the battery is connected inreverse.

author: ludzinc
author_rank: Unknown
timestamp: November 10, 2014, 11:44:54 pm
content: Quote from: SeanB on November 10, 2014, 04:14:32 pmHi SeanBI always wondered how alarm panels did this - my panel at home is currently (intermittently) bitching about it's battery failing. Time to swap it out.But, you know, effort....

author: EEVblog
author_rank: Unknown
timestamp: November 11, 2014, 12:19:11 am
content: Quote from: Dave Turner on November 10, 2014, 08:15:30 pmFrom a business point of view, no. From a personal point of view, it's $200 for a replacement board.QuoteA slot as I said should be enough for bodge fix.But yeah, an entire replacement board, or dug out and refilled with epoxy etc are more professional methods.Any way you do it it's still a bodge though.

author: EEVblog
author_rank: Unknown
timestamp: November 11, 2014, 02:38:23 am
content: Thanks for a viewer submitted photo, I can confirm it is an MLCC used.Clearly it has failed short circuit and heated up enough to catch on fire!I think this is potentially serious issue, and I have contacted Ness about it.

author: adh
author_rank: Contributor
timestamp: November 11, 2014, 02:40:00 am
content: The keypad interface is probably not any reasonable long reach interface, but straight TTL-level I2C or something similar. Running TTL-level (I2C or otherwise) signals across long runs of some dodgy cable seems to be quite popular in alarm systems. I had even seen board marked something like "Remote zone extender" (in the same box there was bunch of random DSC boards, but I'm not sure if this particular one was DSC-branded) that was essentially 7805+PCF8574 with pins broken out to screw terminals.

author: EEVblog
author_rank: Unknown
timestamp: November 11, 2014, 03:12:35 am
content: Quote from: adh on November 11, 2014, 02:40:00 amYes, must be single ended, otherwise 4 terminals would be needed for clock and data.Seems crazy!

author: EEVblog
author_rank: Unknown
timestamp: November 11, 2014, 03:13:38 am
content: Quote from: EEVblog on November 11, 2014, 02:38:23 amFYI, Ness responded within minutes and it has gone to R&D for investigation.

author: Vito_R
author_rank: Regular Contributor
timestamp: November 11, 2014, 03:24:22 am
content: Quote from: EEVblog on November 11, 2014, 03:13:38 amGlad to see they are taking that issue very seriously. I could imagine what could happen if those flames could potentially ignite other materials in the panel box. We techs often leave wiring lists / diagrams on paper in those panel boxes for any troubleshooting needed in the future.

author: EEVblog
author_rank: Unknown
timestamp: November 11, 2014, 03:27:37 am
content: Quote from: Vito_R on November 11, 2014, 03:24:22 amYes, paper is very common inside panels like this, behind the front panel only inches from the board.

author: stitch
author_rank: Regular Contributor
timestamp: November 11, 2014, 03:49:08 am
content: Quote from: Vito_R on November 11, 2014, 03:24:22 amWhile they're at it, maybe they can change the cover photo on the D16 User Manual.The manual has a cover photograph of the board posing in exactly the position that Dave warns against.https://www.bensecurity.com.au/docs/D16_user_rev4.5.pdf

author: djQUAN
author_rank: Frequent Contributor
timestamp: November 11, 2014, 05:45:02 am
content: Quote from: djQUAN on November 10, 2014, 04:26:53 pmQuote from: EEVblog on November 11, 2014, 02:38:23 amDo I get an award?

author: mattinx
author_rank: Newbie
timestamp: November 11, 2014, 01:20:34 pm
content: Just one of those odd quirks - right after Dave posts this video, one of my friends posts this link which happens to illustrate how you'd deal with the same problem affecting a slightly larger section of board:http://home.comcast.net/~rburn/PCB-rework/

author: johnk
author_rank: Contributor
timestamp: November 11, 2014, 05:43:15 pm
content: That was an interesting video again, as always.Dave mentioned that the sensor inputs have to be terminated with a 2.2k resistor. I don't know if you guys think that it's wrong to post public about such ideas, but it set me thinking how such a sensor could be deactivated.One could try to remove the isolation of the two sensor wires with a knife (one cable just once, the other one at two spots). Then he could connect a amp-meter between the cuts on the one wire, cut the wire between and add a volt-meter between the two wires. Through the current and voltage he could calculate the resistor, that is needed to terminate the sensor input.Then he could place a high-value (like 100*R) potentiometer (set to 0 Ohm) in the cut wire and remove the amp-meter. Also he would have to add a potentiometer in series with a resistor of the calculated value between the two wires (parallel to the sensor-input connections), while the potentiometer has, again, a high value and is set to max. R this time.Then the potentiometers could be adjusted - keeping an eye on the voltmeter - so that at the end the sensor is completely isolated and instead of it a resistor terminates the sensor input connections.PS: He could of course also be she

author: SeanB
author_rank: Super Contributor
timestamp: November 11, 2014, 06:58:04 pm
content: The resistor values are commonly known, just you can either use a 3k3 resistor for a single zone, or use a pair of resistors if you are splitting zones ( which is a pain to troubleshoot) of 3.74k and 6.98k. From the outside you do not know which system has been selected for the install, and if you get it wrong the alarm will activate. The window on the comparator in the MCU is very small.http://www.interlogix.com/_/assets/library/I-NX8E-IM%20Rev%20C%20Installation%20Manual.pdfInstall an resistor values are page 8.Common in alarm systems to make sure the wiring is not accessible in any case, and often the installers are lazy and install the resistors in the panel, as opposed to the correct method of putting them in the actual sensors.

author: Rasz
author_rank: Super Contributor
timestamp: November 11, 2014, 07:29:38 pm
content: Quote from: Dave Turner on November 10, 2014, 08:15:30 pmCountry:UK - figuresthis is 10-30 minutes of work, either cut it out or bypasshere on 12 layer board?? ?????!?? 2.

author: Monkeh
author_rank: Super Contributor
timestamp: November 11, 2014, 07:47:56 pm
content: Quote from: Rasz on November 11, 2014, 07:29:38 pmBlindly attacking a PCB with a Dremel he can't keep control of. Country: Russia. Figures.

author: EvilGeniusSkis
author_rank: Regular Contributor
timestamp: November 11, 2014, 08:19:03 pm
content: Dave, you forgot the links to this thread In the youtube description and on the eevblog.com post. also for repair I'd make up a daughter board and completely bypass the burned section. Maybe see if Ness will swing a replacement board your way for reporting a potentially life-threatening problem. (the board looks like the cost comes from low production volumes)

author: Agent24
author_rank: Regular Contributor
timestamp: November 12, 2014, 09:40:42 am
content: Quote from: PA0PBZ on November 10, 2014, 08:36:03 pmThat was my thought also.

author: Yago
author_rank: Frequent Contributor
timestamp: November 12, 2014, 11:53:15 am
content: Quote from: Dave Turner on November 10, 2014, 08:15:30 pmHi DaveHad a similar idea and never tried:I considered, etching and drilling the section from suitable clad board and grafting into the damaged board.Bond with the correct epoxy, chamfer the edges of "hole" and "graft" to key to each other, perhaps re-enforce with glass tape.Or possibly re-lay grp straight on the board to repair (obviously need releasable former).Never did try, and really am unaware of the correct materials.

author: TheBay
author_rank: Unknown
timestamp: November 12, 2014, 10:36:09 pm
content: You guys should use Ademco/Honeywell galaxy over in Aus

author: Vito_R
author_rank: Regular Contributor
timestamp: November 12, 2014, 11:57:31 pm
content: Quote from: TheBay on November 12, 2014, 10:36:09 pmI agree, I've been using those Ademco(now bought by Honeywell) panels for over 20 years and they are rock solid reliable.

author: EEVblog
author_rank: Unknown
timestamp: November 13, 2014, 02:06:30 am
content: FYI, I've been invited to Ness next Tuesday. Will hopefully get some video.

author: EvilGeniusSkis
author_rank: Regular Contributor
timestamp: November 13, 2014, 02:34:16 am
content: Quote from: EEVblog on November 13, 2014, 02:06:30 amthey might even give you a new board for free

author: Yago
author_rank: Frequent Contributor
timestamp: November 13, 2014, 01:13:24 pm
content: Missed those vids on PCB repair earlier, doh!Why did the Russian guy cut the PCB? (no it's not a lead-in for a two line gag!)

author: TeaNTronics
author_rank: Contributor
timestamp: November 13, 2014, 02:18:58 pm
content: hey, check this out:http://hackaday.com/2014/11/13/extreme-repair-of-a-burnt-pcb/there is a guy there who made extreme repair to his amplifier board of his JBL L8400P subwoofer,he had a hole in the board due to electrolyte released from caps, etching hole in the board.and btw in the end they mention dave's Ness D16X fix

author: German_EE
author_rank: Super Contributor
timestamp: November 13, 2014, 03:36:25 pm
content: That is an impressive piece of work.

author: sunnyhighway
author_rank: Frequent Contributor
timestamp: November 15, 2014, 09:00:07 pm
content: Quote from: johnk on November 11, 2014, 05:43:15 pmGood thinking, but don't quit your day-job.You would have been detected by one of the sensors before you can even touch one of the cables, because they are all inside the secured area.

author: VK3DRB
author_rank: Super Contributor
timestamp: November 16, 2014, 06:44:20 am
content: It looks like a TVS was the device in the board. Incidentally, heat does NOT rise in a heatsink- it travels in all directions without concern to orientation. There is a slight effect from heat rising in the air around it, and yes having the cap below it is better than above.A mate opened a TV repair shop some years ago. I used to drop around Thursday night to help with the difficult bugs, getting paid in non-taxable beer and pizza. It was a lot of fun. One day someone dropped a colour TV around because he had thrown it at his house mate in a fit of rage. I was going to try to fix it the following week. The following Thursday I dropped in and my mate said don't worry - the owner's house mate had murdered the TV set owner. We left the TV for a while in case it was going to used as evidence. In the end I tried to fix it, but I threw it out... the entire main PCB had broken in two and there were too many tracks to try to repair. Some things just cannot be fixed.

author: electronic_eel
author_rank: Regular Contributor
timestamp: November 16, 2014, 11:53:33 am
content: Quote from: sunnyhighway on November 15, 2014, 09:00:07 pmLet's say you are able to sneak an articulated arm or similar into the secured area and to the alarm cables.How would it help to know the values of the resistors? The comparator in the alarm system will react to resistance changes within microseconds or at least milliseconds.You won't be able to cut the cable and place a resistor between the wires in that time. And you can't pierce the wire and place a resistor in between before cutting: you'd parallel the resistors which is easily detectable by the comparator.

author: EEVblog
author_rank: Unknown
timestamp: November 16, 2014, 12:02:26 pm
content: Quote from: VK3DRB on November 16, 2014, 06:44:20 amNo, it's just a regular MLCC capacitor.

author: SeanB
author_rank: Super Contributor
timestamp: November 16, 2014, 12:04:13 pm
content: Quote from: EEVblog on November 16, 2014, 12:02:26 pmI thought the days of flaming ceramics was over.............

author: miguelvp
author_rank: Super Contributor
timestamp: November 16, 2014, 08:28:43 pm
content: Quote from: electronic_eel on November 16, 2014, 11:53:33 amEven if I told you my alarm box is inside the master bedroom walking closet, is your articulated arm going to be long enough and open the closet, the panel and well many other things?I'm pretty sure someone that robs for a living has other methods or they can just buy the panel and study it.

author: SeanB
author_rank: Super Contributor
timestamp: November 16, 2014, 08:47:12 pm
content: Quote from: miguelvp on November 16, 2014, 08:28:43 pmIs there a set of sensors in your roof space, as that is the common way to disable the alarm.

author: miguelvp
author_rank: Super Contributor
timestamp: November 16, 2014, 09:50:11 pm
content: exactly, that's why an articulated arm makes no sense at all, they just need access to the box, once there a resistor value being posted in here is not going to make a differenceEdit: but johnk has a point because the resistor value is at the sensor level, I guess I missed that, there go all my valuables.

author: stitch
author_rank: Regular Contributor
timestamp: November 18, 2014, 12:10:10 am
content: Quote from: VK3DRB on November 16, 2014, 06:44:20 amYes, that's the idea, but this heat sink was shaped like a chimney and the 7805 was not firmly connected to it - no heat sink compound.So the heat sink could be acting more like a chimney than a heat sink.

author: Teemo
author_rank: Regular Contributor
timestamp: November 20, 2014, 11:44:23 pm
content: So it was the ceramic cap... In my experience in production I have seen it to be quite common for a supply decoupling MLCCs to fail on some products. Usually it was good short under a Ohm but sometimes it was up to 100 Ohms. Not exactly sure why it happened, my best guess is that those caps do not like large current spike when initially charging up, or current spike when shorting the charged cap.

author: johnwa
author_rank: Frequent Contributor
timestamp: November 21, 2014, 10:23:42 am
content: Quote from: electronic_eel on November 16, 2014, 11:53:33 amOK, let's assume that physical access to the wiring is possible, and that the alarm panel is sensing DC voltage levels. (Dave did mention multiplexing, but this should not be a problem provided it does not occur too quickly). Now, strip a length of one of the conductors, solder a small value resistor across, and then cut the wire bypassing the resistor. The resistor value is chosen to be small enough that it doesn't disturb the loop enough to trigger the alarm. (The end-of-line resistors will be 1% tolerance at best, so there should be some margin available).The resistor can be used to sense the current flowing in the loop. This can be amplified with an op-amp, and imposed across the lines, effectively creating a synthetic resistor equal in value to the EOL resistor.With the loop intact, the op-amp will not provide any output current. But as soon as the loop is cut, the op-amp will instantly take up the current that was flowing through the resistor. Provided that the system is fast enough, the alarm panel will not notice the difference. (The sensing circuit cannot be too quick to raise the alarm, otherwise it would be vulnerable to EMI)Though, I expect anyone who could make this work has better things to be doing than breaking into houses...