Anyone cracked open a Hanna checker before?

[Joekovar]

I've got a Hanna nitrite checker that I very rarely use anymore, so I'm thinking about sacrificing it for learning purposes.

I tried getting it open, but it's looking like I'll have to permanently destroy the shell to get into it.

I thought it was odd that there's an 8 pin connector on the base when at first glance it looks like the base cap is simply bringing positive from the battery into the unit. I probed each of the slots in the base cap to the positive battery tab and only get continuity between that tab and a single slot.

What are the other 7 pins for? I'm wondering if they perhaps expose serial communications for programming the firmware, factory calibration, etc. Maybe 1-2 of the pins expose the button to automation for calibration. Considering how hard, if not impossible it is to remove it from the shell.

So, before I destroy this thing, has anyone already dug into this?

 

[Dennis Cartier]

Nope, but post photos!

Dennis

 

[garbled]

My guess would be a JTAG header, or similar debug/programming port. Take a look at hackaday, they have a few good articles on reverse engineering circuits and teardowns if you haven't done one before. Would love to see pics!

 

[StlSalt]

Pics would be nice, the screen is going bad in my Phos ULR checker. I was wondering if I could just replace the LCD screen.

 

[Joekovar]

A dremel without a flexible shaft is just uncivilized.

The lid can be removed easily.


Careful not to go too deep with the cutoff wheel.


Had to work around the bottom to crack it open.


First look inside.


Some of the tabs from the white top piece are glued pretty well to the green shell. These definitely aren't meant to be opened.




No turning back now.


Insides.






Screen.


The chip.








The red numbers are the header pins in this orientation.

5 goes to -1.5vdc
4 goes to +1.5vdc
8 goes to the left most pin pointed to by the red line.




That's as far as I've gotten so far. There's a lot of information in the datasheet of the pic16F913.

 

[Joekovar]

Header #3 goes to "RB7/ICSPDAT/ICDDAT/SEG13" on the PIC.

I think header #2 goes to "RB6/ICSPCLK/ICDCK/SEG14".

The back side of that chip's not easy to probe...

 

[Joekovar]

I'm assuming that they're utilizing the code protection bits. I'm also guessing it's relatively easy to brick the checker by fiddling with it too much.

 

[Dennis Cartier]

That is very neat. Thanks for posting the pics.

All the type of components included are what I expected. It is neat that they are using of the shelf PIC's and not some custom ASIC. The sensor looks like it only uses 2 pins, so I am guessing straight photo resister. Both the LED carrier board, and sensor board look like there would be a combination of them for the other models of the Hanna checker. Each of the checkers use a slightly different wavelength of LED.

 

[Joe31415]

If you want someone that's really good at reverse engineering, look into sending it to BigCliveDotCom, this is what he does. Granted, he's in Wales or Isle of Man, so shipping might be expensive.

 

[garbled]

I would have thought it needed a color sensor, not just a simple LED. It's not a titration....

 

[Joekovar]

There's 3 traces on the LED board. The center has continuity directly to -1.5vdc, the right branches off somewhere before going through a 499 ohm resistor to -1.5vdc, the the left appears to go to a transistor.

The button pulls something to -1.5vdc, but I'm not sure what. There's no continuity between the other side of the button and any of the pins on the PIC so it's doing more than pulling an input low.

I'm really interested in the ICD capabilities of the chip. Ultimately I want to be able to capture the final reading with an Arduino.

 

[Joekovar]

Header #1 goes to VDD on the 27L2C opamp.

#6-7 head under cuvette holder somewhere. Possibly behind the LCD. I'm going to have to find my soldering iron to melt the posts that were melted to hold the cuvette holder in place.

I came across a thread mentioning an undocumented display if you hold the button when you turn it on. All of my checkers show me the model number, then a number like 1.08 or 1.07 when I try it.

I suspect this second number is a per-unit calibration factor. The firmware would generate the same reading for all alike checkers, and the result would be multiplied by this calibration factor to account for variations in component batches. I think this press and hold function exists so when someone sends their unit to Hanna because the calibration test kit says it's out of range, technicians can easily determine what checker it is in case the label has worn off, and quickly decide whether to update the firmware with a new calibration factor, or just replace the unit if the calibration factor is already far from 1.0

 

[taricha]

This is great.
I took one apart a while back and found some of the same things, but I also looked at some different things, like the LED and the optical filter on the photo detector.
The light sensor side outputs a voltage in response to light intensity even if there is no power connected, no battery in place at all.
The sensor is not very wavelength specific, the LED is very narrow, and that's what makes the checker specific.

I'll post details later when I get a chance.

 

[ReeferLou]

Probably a version of this: https://iorodeo.com/products/educational-colorimeter-kit?variant=12262607558

 

[taricha]

Here's some notes from when I took apart my Low Range Iron checker.

On mine the only part that actually had to be removed is opposite from the hinge side, where the white top piece is glued to the plastic body cover. Once the plastic tab is separated, the plastic body ought to come off the electronics.

(I figured out after cutting, that most of the cutting wasn't necessary)

This is a closeup of the Photocell and the attached filter.


This is a closeup of the LED.

The LED is a 571-2nm yellow-green with a very narrow width. FWHM is only about ~11nm wide. The wavelength is within manufacturing tolerances of 575nm which is what it’s labeled as. I checked to see if the cyan filter was being used to shift the LED peak, but it does not shift the peak by even a nm. The filter allows all LED light through. It simply blocks anything longer wavelength than the LED itself, so any fluorescence would be blocked.
Later I realized many light sensor devices have this similar cyan filter, so it's not specific to the LED, but simply to cut off the photocell from picking up extraneous IR, or other unrelated long wavelength light. If I found the correct specs for a similar photocell, these things have a sensitivity that's throughout entire visible, and very high in IR. So I think the filter is just to tame that behavior.

(Optical Properties of the LED and filter over the photocell).

I tried and mostly succeeded to run the checker through a calibration process while measuring the current and voltage. What I found was that the calibration routine is surprisingly complex.

attempting to run the disassembled checker through a measurement cycle, and though it would not finish because the room light caused a “Low Light” or "Hi Light” error, it would do the “C1”-blank checking phase. Below are the Voltage and Current performance of the
LED during the “C1” check phase. It starts, then in the long calibration It will vary the light brightness every couple of seconds for about 30 seconds. Max voltage measured was ~1.9V, minimum lit voltage ~1.8. Max current was 18mA with min lit current 10mA.
(when voltage went off the chart, is where my hands slipped)

So for calibration, It shoots a series of measurements, getting the photocell response at a bunch of different LED brightness through the blank "C1" cuvette.

 

[Sguiv6]

There’s a much easier way to open it without destroying the case

 

[Sguiv6]

Here's some notes from when I took apart my Low Range Iron checker.

On mine the only part that actually had to be removed is opposite from the hinge side, where the white top piece is glued to the plastic body cover. Once the plastic tab is separated, the plastic body ought to come off the electronics.

(I figured out after cutting, that most of the cutting wasn't necessary)

This is a closeup of the Photocell and the attached filter.


This is a closeup of the LED.

The LED is a 571-2nm yellow-green with a very narrow width. FWHM is only about ~11nm wide. The wavelength is within manufacturing tolerances of 575nm which is what it’s labeled as. I checked to see if the cyan filter was being used to shift the LED peak, but it does not shift the peak by even a nm. The filter allows all LED light through. It simply blocks anything longer wavelength than the LED itself, so any fluorescence would be blocked.
Later I realized many light sensor devices have this similar cyan filter, so it's not specific to the LED, but simply to cut off the photocell from picking up extraneous IR, or other unrelated long wavelength light. If I found the correct specs for a similar photocell, these things have a sensitivity that's throughout entire visible, and very high in IR. So I think the filter is just to tame that behavior.

(Optical Properties of the LED and filter over the photocell).

I tried and mostly succeeded to run the checker through a calibration process while measuring the current and voltage. What I found was that the calibration routine is surprisingly complex.

attempting to run the disassembled checker through a measurement cycle, and though it would not finish because the room light caused a “Low Light” or "Hi Light” error, it would do the “C1”-blank checking phase. Below are the Voltage and Current performance of the
LED during the “C1” check phase. It starts, then in the long calibration It will vary the light brightness every couple of seconds for about 30 seconds. Max voltage measured was ~1.9V, minimum lit voltage ~1.8. Max current was 18mA with min lit current 10mA.
(when voltage went off the chart, is where my hands slipped)

So for calibration, It shoots a series of measurements, getting the photocell response at a bunch of different LED brightness through the blank "C1" cuvette.

My LED is gone on my Nirtite ULR, would this work for a replacement LED?

5988160107F Dialight | Optoelectronics | DigiKey

Order today, ships today. 5988160107F – Yellow-Green 573nm LED Indication - Discrete 2V 0805 (2012 Metric) from Dialight. Pricing and Availability on millions of electronic components from Digi-Key Electronics.

www.digikey.com.au

Thanks Guys! Very interesting topic

 

[Sguiv6]

I found that with a little upwards pressure it pops right out. At first it seems like you shouldn’t be pulling it but it comes out in one piece

 

[taricha]

My LED is gone on my Nirtite ULR, would this work for a replacement LED?

5988160107F Dialight | Optoelectronics | DigiKey

Order today, ships today. 5988160107F – Yellow-Green 573nm LED Indication - Discrete 2V 0805 (2012 Metric) from Dialight. Pricing and Availability on millions of electronic components from Digi-Key Electronics.

www.digikey.com.au

That LED looks similar, but the wavelength needs to be 525nm for the ULR Nitrite checker. I'm sure there are many other parameters that need matching for this to work, but it ought to be possible.

 

[schafon]

Bumping!!
Is there someone who manage to get a reading using the debugging port?
I'm working on a cool project that I need to get the reading to Arduino / Raspberry pi