Total Newb: Can I hAcK my appliance's control panel? - Page 1
Forum section: electronics / beginners

author: noxid86
author_rank: Newbie
timestamp: November 20, 2020, 12:06:42 am
content: TLDR: I have a Castle Serenity pellet stove and am wondering what it would take to intercept the signal between the control panel and the appliance to either make it wireless or be able to control it from my computer.I'm a complete electronics newb. I've never used an Arduino but I know what they are. I've never written actual software but I can speak javascript. I recently purchased a Castle Serenity pellet stove and noticed that it shipped with the control unit disconnected from the 20pin ribbon cable that connects it to the unit. Something about the fact that this particular cable looks like something I'd see inside of my computer tower triggered a series of thoughts that might be totally unrealistic and/or dangerous butI'm too curious.I hate the way this control panel looks when mounted on the unit. My first thought was "can I buy some kind of wireless transmitter that allows me to mount this to a more convenient location in the room?" that was followed by all kinds of wondering about what it would take to have my computer get a signal to it and pretend to be the control panel. Then I could program custom heat schedules and such.Now first things first : saftey - this appliance actively manages a small fire. I cant really concieve of it doing anything worse than spinning the auger relentlessly dumping way too much fuel but if I leave only a small amount of fuel in there this wont be a big deal. Im really wondering how difficult it would be to actually damage the unit in a permanent way by spoofing outputs from the 'control panel'. My guess is that the appliance has all kinds of safeguards in the firmware and that bad commands will be ignored but how to be sure?As I have no experience, my expectation would be to start out with the unit operating normally and pick a couple newbie projects to work my way up to it. But I just have absolutely no idea where to get started. The best I've been able to come up with is that I can use something called a logic analyzer to read the signals coming through that cable. My assumption is that, assuming the control unit just primarily sends a signal for each button, that without understanding the underlying code I could just mimic whatever binary gibberish I get from the control unit. Am I close? Way off?thanks in advanceUnit User Manual:https://www.castlestoves.com/Documents/Download/2011

author: Manul
author_rank: Super Contributor
timestamp: November 20, 2020, 12:51:19 am
content: It would be good if you could provide some pictures of the unit or some web links of the product.In regard to your idea, it could be anywhere from easy to very hard, there is just not enough information. You also worry about damaging the unit. It is possible. Mainly because the control panel interface is not only a data carrier, but also an electrical interface. You are not likely to damage by sending wrong commands per se, but if you electrically drive wrong signal lines, short something or give overvoltage then it may not end up well. So being careful is a must.If you want to proceed, first task is to open the control panel and do electrical reverse engineering of the interface. Which pin is ground, power, data bus, or whatever it is. Create full pinout of the connector. Analyze the interface, educate yourself if needed and proceed with further ideas.

author: Manul
author_rank: Super Contributor
timestamp: November 20, 2020, 01:34:12 am
content: Control panel has an infrared receiver for remote control. It could be exploited for creating remote control over wifi, buy using some arduino board and infrared LED. Especially if you have original remote to read codes from. But if it is not what you want, then opening the unit is the only way forward which I can imagine.

author: noxid86
author_rank: Newbie
timestamp: November 20, 2020, 01:39:25 am
content: Oh, I dont know how I didnt even think of that. But I am a bit confused as to why I would need to open the control panel. Arent all the data connections exiting it's own ribbon connector end? What information would I get from the inside that I cant get from the outside?Quote from: noxid86 on November 20, 2020, 01:39:25 amThis really is the best idea though. How on earth does one go about this?

author: Clear as mud
author_rank: Regular Contributor
timestamp: November 20, 2020, 01:49:04 am
content: Well, you wouldn't need to open anything up if you just set up something to translate from wifi and/or ethernet to the infrared signals that are normally used to remote-control it. All you would need then is some hardware capable of recording what signals come out of the remote control so you can emulate it.But, if you want to actually build a different control panel, then it is useful to open up the existing one. You don't know which ones of those 20 wires are power, which are inputs, which are outputs, whether the inputs and outputs are analog or digital. Opening it up and looking at the circuit would at least enable you to start making some educated guesses of what all those wires are for.

author: Manul
author_rank: Super Contributor
timestamp: November 20, 2020, 01:57:46 am
content: Quote from: noxid86 on November 20, 2020, 01:39:25 amAs a simplified example imagine that you see 4 mysterious wires. What to do with these wires? They are not marked or otherwise indicate their function. So you open a device which is connected on these 4 wires. You find, that inside a device these wires go to some IC. You google this IC and find out that it is USB to UART converter. So now you know for sure, that these 4 wires is an USB interface, also you can trace which wire is ground, +5V, D+ and D-. You may be able to analyze that just by tapping into the wires with logic analyzer and other tools, but it may be much more harder.

author: james_s
author_rank: Super Contributor
timestamp: November 20, 2020, 02:01:05 am
content: It's probably pretty trivial for someone who knows electronics, but that's going to be a very steep learning curve for someone with no knowledge at all. An experienced person could look inside the control panel and pretty quickly determine how it is arranged and how it communicates with the rest of the unit. If it has 20 pins my guess is that it's raw signals from buttons with all of the electronics in the other section but it's impossible to say without looking at it. If it isn't immediately obvious what benefit you'd get from opening it up to look then this is definitely way over your head so your options are pretty much live with it, find a friend who knows what they're doing, or sign up for some online classes in a program for an electronics engineer or technician.

author: Brumby
author_rank: Unknown
timestamp: November 20, 2020, 02:14:00 am
content: I can only echo the above comments - but I must point out one critical aspect in such a project that you just have to address properly: SAFETY.This is more than ensuring you don't do the wrong thing with mains, etc. but also that you don't compromise safeguards against the various things that can go wrong in the operation of the unit as is. Things that the controller may already have in hand. I always look at the safety elements that are (usually) promoted and then ask "Whatelsecould go wrong?" Having satisfactory answers is key, IMHO.As such, an IR remote interface is definitely the recommendation I would give. If it can't deliver what you want, then I'd be thinking twice - especially for someone who has very little experience.

author: noxid86
author_rank: Newbie
timestamp: November 20, 2020, 03:59:53 am
content: Thank you to everyone, these have been very helpful commentsI was confused about opening because I assumed everything could be garnered from a logic analyzer and didnt even think to examine the circuit board.IR remote interface is definitely the way to go. So Ill start looking into how that works first

author: james_s
author_rank: Super Contributor
timestamp: November 20, 2020, 05:17:56 am
content: Everything *could* be garnered with a logic analyzer, multimeter and some deductive skills, but that's vastly more difficult and time consuming than just taking a peek inside to see what's there. You'd never just connect a logic analyzer unless you were certain that the signals are all logic level. If one of the pins turned out to be for example 12V power to a relay that could damage the analyzer. In software terms using the analyzer is much like trying to reverse engineer a piece of software stimulating it in various ways, observing the output and guessing at how it works internally. It should be obvious that if you have access to the source code it's far quicker and more accurate to just look at the source.