«

»

UNI-T UT325 Thermometer Teardown

In the review of this thermometer I said that it was a weird Chinese product. And here’s why: despite of the poor firmware and software functionality it has pretty interesting and very “hackable” innards.

Let’s begin..

First of all, you need to open the battery compartment, which is held by one screw. And what’s interesting, they’ve used not self-tapping screw, but threaded insert with a normal screw. This construction you would usually find in some more “high-end” products.

Next, you have six self-tappers: two on the top, one in the middle and three smaller on the bottom, behind battery compartment cap.

And we’re finally inside!

On the back it has cheap al-foil/paper shield which connected to the ground with a spring sticking out of the center of the board.

Then if you will look at the board markings, everywhere is written UT320. They obviously have made only one board layout and just changing some of the components for different versions of the device, which is pretty common.

Assembly quality is very good, and you can notice how clean the board is. There’s no flux residue on the board, except on the hand-soldered connectors, wires and buzzer.

Click on the picture below to see the board in high resolution.

This is where the things starting to get interesting.. This thermometer is based on MSP430 (MSP430FE427) microcontroller from Texas Instruments, which is de facto standard for low-power applications, like hand-held measuring equipment and such.

For analog section they have used AD8552 zero-drift, rail-to-rail operational amplifier from Analog Devices and LM358 low-power op-amp.

I didn’t have a time to do proper reverse-engineering but I guess, that 74HC4066 quad bilateral switches is used as a part of tone generator for buzzer(please, correct me if I’m wrong).

Then, under MSP430 we have 24LC515 512K Serial EEPROM, where all the settings and logged data is stored.

Unfortunately I didn’t find datasheet for CH9325, which is some kind of serial-to-USB converter, or something like that. If you know what exactly that is, please write that in comments down below.

And finally on top between those two thermocouple connectors – there’s an NTC temperature sensor which you can’t fully see, because of the top plastic “cap”.

The board itself is held by six self-tappers and the display is pushed against the case by the board through two conductive rubber contact strings.

In order to see what’s going on under the display, I had to desolder the backlight panel, which was held in two places(backlight anode and cathode).

On the top there is some flux residue left from hand-soldering those thermocouple connectors. But since thermocouples have relatively low impedance, I don’t think that this flux residue will inject any measurement error. So, I guess, that’s fine.

Under the display you’ll find HOLTEK HT1621B, which is a special LCD controller which used to drive the display. It takes commands from MSP430 trough the serial interface.

Hackable?!

I think, that this thermometer is really easily hackable and it should definitely be hacked!

First of all it has very popular MSP430 processor. Next, it has double-sided board which could be reverse engineered really easy, plus all the components, except that USB interface converter are well-known and the datasheets are easily accessible.

If CH9325 datasheet would not be found, someone can try to reverse engineer the protocol, which software use to talk to the thermometer and vice versa. If not, there’s an easy brute-force method – desolder that chip and put there any USB-to-UART converter breakout board(luckily, there’s a lot of free space). Like, for example FT232RL or PL2303.

And finally, instead of just test points for programming MSP430, they’ve actually put a full-sized JTAG connector to the right from the chip! And a little bit down and to the left, you can see 5 test points for debugging serial communications between processor and LCD driver! Just hook up your logic analyzer or oscilloscope and you’re all set!

So, if you learning MSP430 family and want to try to work on some real hardware – this is your chance! The price of this thing is comparable to some of the simple MSP430 development boards, but unlike working with development boards you would have a real goal to achive – to write firmware that log measurements from both channels simultaneously and to add much more memory points, which could be done in software alone.

Unfortunately I don’t know how to work with MSP430 and I don’t have a time to learn that :( But maybe someone would want to make an open-source thermometer firmware – that would be cool!

P.S. And I’m not trying to convince you to write firmware for this thing, so that I can use it. No. I just think that this could be a really cool and interesting project to work on!

Datasheets:

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>