Help ID this Microchip IC (PIC?) - Page 1
Forum section: electronics / general

author: sokoloff
author_rank: Super Contributor
timestamp: July 07, 2021, 12:07:40 am
content: Anyone know which Microchip IC this is?Looks to me likeNGM V1.2 (e8)Microchip logo 152894UApplication is on a sprinkler controller valve actuator, but that doesn't really matter here.

author: sokoloff
author_rank: Super Contributor
timestamp: July 07, 2021, 12:23:41 am
content: From probing the PCB, it seems like the pinout is similar to the PIC16F18323 and family. (Power and GND at 1 and 14. 1, 4, 12, 13, and 14 are pulled to a programming header.)But I can't find anything for those specific markings.I'm trying to reverse engineer the board function, including reprogramming the micro (or replace if I must) to drive a set of sprinklers under serial control from an ESP32.This sprinkler module (Hunter ICM-600) seems to take power and likely a serial connection from the main board. I'm not interested in using (nor do I have, but would buy if I needed to to RE it) the main unit.I'm basically using these commercial modules as "they figured out all the protection from the sprinkler wires network in the yard; all I need to do is stimulate them to control my valves".In an ideal world, the micro can be read, but even in a non-ideal world, I can probably figure out how to write enough code from scratch from my purposes. (If they're OTP, then I need to either RE the protocol or replace the chip.)

author: Ian.M
author_rank: Super Contributor
timestamp: July 07, 2021, 12:38:54 am
content: Just about *ALL* 14 pin PICs in Microchip's 'Low Pin Count' 8 bit product range (aka: LPC PICs) use that pinout. Ones in the 'Baseline' family don't hade a device ID, and reading out the device id of a PIC without knowing its device family is problematic anyway, as some need 12.5V on /MCLR to enter programming mode, others only want 8.5V and the current generation don't use any elevated voltage but use a code. (IIRC the most common is a 32 bit code of the bits of the ASCII charactersMCHPbut it can be LSB first or MSB first depending on the family and there may also be preamble or postamble bits.TLDR it will be *TOUGH* to figure out what PIC Microchip have house marked for the OEM. Unless you get lucky replacement may be the only viable option.

author: sokoloff
author_rank: Super Contributor
timestamp: July 07, 2021, 01:08:38 am
content: Ugh. I was prepared for that, but hoping for easier, of course.I've bought 6 of the modules, needing only 4 of them to work for my application. (I figured 4 for production, 1 for a spare, and 0-1 to destroy in reverse engineering.)

author: Ian.M
author_rank: Super Contributor
timestamp: July 07, 2021, 05:00:27 am
content: Commercial products almost invariably have firmware readout protection enabled, as although its minimally effective against serious cloning efforts, the four digit cost of getting the far east die level 'crackers' on the job stops a lot of the dumber and cheaper people in their distribution chain getting 'ideas'! Even if you figure out the PIC, and 'acquire' a dump of the firmware, you'll still have to wade through the 💩 code . . .Time to bite the bullet and reverse engineer a schematic for it. It appears to have six identical channels, so it shouldn't be too tough as you've only got to figure out a sixth of everything to the right of the notched at the MCU end.That's the 'Upper' board, what's on the (presumably) 'Lower' board connected by J3, as that's where I suspect its comms live.Once you have the schematic, populate the ICSP headers, pick a 14 pin LPC PIC with on-chip debug silicon, remappable peripherals, and oodles of resources, swap out the MCUs and get to coding new firmware.

author: sokoloff
author_rank: Super Contributor
timestamp: July 07, 2021, 01:50:04 pm
content: I've already beeped out the board for what I need and the programming from scratch would not be overly difficult I don't think. As you say, it's 6 copies of a simple circuit to drive a triac and some lightning protection elementsI'm also going to see if I can snag a secondhand base unit and intercept the comms from the actual base unit. They're very likely serial of some sort (and slow and unencrypted), and that would allow me to not have to crack open the commercial modules at all. Buying the modules first was a shot in the dark to see "hey, maybe this is going to go smoother than I think". Instead it's about as expected.(And thanks for the thoughtful comments.)

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 07, 2021, 05:13:51 pm
content: Quote from: Ian.M on July 07, 2021, 05:00:27 amThat's what I would do as well. As suggested above, it's very likely a custom part, and likely one with a ROM mask. Re-implementing code yourself on a standard pin-compatible PIC MCU sounds like the reasonable option here.

author: voltsandjolts
author_rank: Unknown
timestamp: July 09, 2021, 11:36:25 am
content: It's worth doing some internet searches, some code out there already which might be helpful.https://opensprinkler.com/https://github.com/seb821/OpenSprinkler-Firmware-Hunter/blob/master/hunter.cpphttps://www.hackster.io/sshumate/hunter-sprinkler-wifi-remote-control-4ea918https://github.com/esquiloio/lib/blob/master/buses/hunter/hunter.nutDisclaimer - I have no knowledge of sprinkler systems, this is just random examples I found.

author: sokoloff
author_rank: Super Contributor
timestamp: July 09, 2021, 12:58:17 pm
content: Thanks, @voltsandjolts! Looks like esquilo itself is long-dead, but the code and technique looks promising to adapt (or at least speed up the protocol reverse engineering).