Hacking the buzzerbox

[Mika]

Hello Everyone,

I'm a newbie here and started picking up electronics about a half year ago, not very intensely as I haven't a lot of time. I'm normally a software dev!

Anyhow I have this project here where Im trying to modify my buzzer box inside my apartment to connect to this bluetooth module I have so I can control it over bluetooth. I've attached a picture of the back of the box, this wiring goes directly into the wall. As to where it goes I'm not 100%.

These are the tests I've run so far, I've unplugged both red wires going into slot 1 and found that everything still functions normally as far as I can tell, the talk button may be off but others work.
I've checked for a circuit between the 2 and 4 (I think 4 is ground) which is activated it seems when someone buzzes and 3 and 4 form a circuit when the listen is activated or door is buzzed, but I still haven't figured out the door buzz key.

If anyone has any ideas on what I can do next to figure this out or where I would start that would be great as I'm a bit lost now

I've also noticed the 3 and 4 circuit takes a few seconds for the multimeter to register when holding listen, the multimeter shows numbers increasing then it beeps as it registers a full circuit.

Buzzer Box

 

[Tha fios agaibh]

Frist guess: Looks like 1 and 2 are your audio. (twisted pair) when you press talk the speaker works like a microphone. When in listen mode audio goes the other way to your speaker. Pin 4 is from the call button in the lobby that buzzes on your receiving end.
I couldn't upload the pdf for Is-489
(I believe that's what you have) there is some info that might help you.

 

[Mika]

Thanks for the info, I didn't know that the audio transmited two way like that. So if it's wired like this could you technically hack it to talk to other suites? 0.o
This is the schematic I found when I searched that however I'm not sure what 3 is then, is it just the ground?

In either case I think that all I would need to do is hook into 4 and the ground (possibly 3) to detect the buzzer then, is it possible the door works inverse similar to voice (reversing current causes door to open)? I'm not so sure where I would put a circuit to intercept the voice/allow talk and also press the door, I think these are the last mysteries!

Again I appreciate all the info

 

[dorke]

This "suite station " is a powerless unit.
The speaker function was correctly described by @Tha fios agaibh above.

On the photo of the board you have "+SP" marked,that is the plus of the speaker

Number 2 is the audio common-the only un-switched connection, connected permanently to +SP.

Number 4 is the "call"(It is a uni-directional incoming signal-buzz sound,unique-one per suite) .

Numbers 1 is the "audio line out"(It is a uni-directional outgoing mic signal,twisted with Number 2 since it is low level).

Number 3 is the "control and audio in" .
For audio it can be as simple as a "gnd" for the speaker and number 2 will feed the signal.
control= "door " pressed ,shorts it to number 1,that will be identified by the main entry circuit to open the door.
How it actually operates is un-clear needs more investigation.


Note that you can press keys together,
interesting to see what are the effects of that,hop they designed it not to cause damage though...

Here is the schematics I made of it:

 

[Mika]

Thanks for all that info @dorke that's amazingly helpful, especially the schematic. So to detect the speaker going off I could slot something between speaker negative and 4, there is a black wire going from speaker to pcb so I'm assuming that's it.

The last step is figuring out the control. What's the best option for figuring it out? Using my multimeter to intercept the connection and figure out what it's emitting and what changes happen?

I have also pressed 2 at once but nothing happens

Also if 2 is the only one directly connected to the speaker I assume that's a source of power I could use to power my inventions!

 

[dorke]

Let's start from the end.

As I said it is a powerless unit.
Number 2 isn't a source of power(D.C), it is part of the audio circuit (A.C).

You can try to find D.C voltages between all pins combinations while no button is pressed(using the DMM in DCV range),I guess there are non.

If by "the speaker going off" ,you refer to the call sound,
the sound that identifies someone is at your door (Is it a buzz,a tune,other?).
then that sound should be detected by rectifying the A.C on the speaker itself,
to produce a logic level signal,
that signal should be considered valid only if no button is pressed(especially not "Listen").

Use the DMM in ACV to trace the audio signals in Call/Talk/Listen over the speaker and on the pins.
Someone should help you in Listen,and you should do the talk in "talk",
better yet use a signal sound like a smart phone etc. there are some nice applications to generate sounds.

Check pin-3 Vs. Pin-1 and Vs. Pin-2 and Vs. Pin-4 do it in both DCV and ACV.
For " Door" pressed and "Talk" pressed.

Hopefully we can make something out of those measurements.

 

[Tha fios agaibh]

Good insights @dorke

It looks to me as the Ma amplifier simply outputs a tone (Not unique) on term Z that is directed via the appropriate call button in the lobby.

The arrows on this diagram (Not necessarily yours, but credit goes to google images) show the direction the audio is traveling.

I would take a different approach rather than trying to check voltages with a dmm;
Make note of where the wires go by labeling them and then disconnect all connections and remove the call buzzerbox.
From there You should be able to follow the traces and switch connections (continuity) to determine how the circuit is laid out.

 

[Mika]

12 v (DC) runs between 1 -> 2, 1 -> 3, 1 -> 4. I put the pos on 1 and then put the neg on 2, 3 and 4 pressing each button at each connection. All of them react in some way except listen.


For talk
======
1 -> 2 - is drops to 8.5ish
1 -> 3 - is drops to 0
1 -> 4 - is drops to 8.5ish
2 -> 3 - stays at 0
4 -> 2 - goes 0 to .1
4 -> 3 - goes 0 to .1

For Door
=======
1 -> 2 - is drops to 0
1 -> 3 - is drops to 0
1 -> 4 - is drops to 8.5ish
3 -> 2 - goes from 0 - 8.5ish
3 -> 4 - goes from 0 - 8.5ish
2 -> 4 - stays at 0

When someone buzzes
==================
1 -> 2 -> stays at 12
1 -> 3 - Is drops to 10
1 -> 4 - Is drops to 10

With everything off there is a small ac voltage going between 4 -> 3 that is constantly changing, I'm thinking this is voice in. Voice out may be 0 -> 2 as the ac power is changing while I talk when the talk button is pushed.

These were all the readings I could find.
@Tha fios agaibh I'm not sure what you mean, the buzzer box goes into the wall, or do you mean read the actual circuit board itself by detaching it?

 

[Tha fios agaibh]

Reading voltages can be misleading and wouldn't be my first approach.
I suggest disconnecting from wall to isolate and try to check how pushing the buttons interacts (continuity) with the terminals and the traces on the circuit board itself.

Post a picture of the entire board, both sides if possible. Then draw what you see and have determined by continuity checks on paper until you have the is489 circuit drawn out.

Once you know what you have on your end will make the rest of the wiring easier to understand.

Btw, it's doubtful that you will be able to talk to your neighbors because you'd have to have access to their wire #4

 

[dorke]

Reading voltages can be misleading and wouldn't be my first approach.
I suggest disconnecting from wall to isolate and try to check how pushing the buttons interacts (continuity) with the terminals and the traces on the circuit board itself.

Post a picture of the entire board, both sides if possible. Then draw what you see and have determined by continuity checks on paper until you have the is489 circuit drawn out.

Once you know what you have on your end will make the rest of the wiring easier to understand.

Btw, it's doubtful that you will be able to talk to your neighbors because you'd have to have access to their wire #4

The schematics I posted at #4 is what I made of @Mika 's actual board(from the photos).
There is nothing there but 3 simplest N.O. push-buttons.
That can be checked, a photo of the other side to verify should be enough(no other components).
I wouldn't disconnect it.

 

[dorke]

View attachment 37679 Good insights @dorke

It looks to me as the Ma amplifier simply outputs a tone (Not unique) on term Z that is directed via the appropriate call button in the lobby.

The arrows on this diagram (Not necessarily yours, but credit goes to google images) show the direction the audio is traveling.

I would take a different approach rather than trying to check voltages with a dmm;
Make note of where the wires go by labeling them and then disconnect all connections and remove the call buzzerbox.
From there You should be able to follow the traces and switch connections (continuity) to determine how the circuit is laid out.

This diagram is almost identical to the one I made.
Here is the slight mod. needed(pins 1-2 "swapped).
Another note :The speaker is always connected between 2 and 4.

 

[dorke]

@Mika,
From the measurements you took at #8
It looks like there is always a DC voltage between 1 and 4 (8.5 to 12V).
This means the schematic of the "buzz"(at the entry panel) showing a switch on the #4 pin line is just a "symbolic representation".

It can probably be used to power something,how much current?probably very low.
Not directly, as it is ,but say using a LDO voltage regulator of 5V with rectifier bridge, resistor and cap(For some A.C audio isolation ).

Can you please check the AC between pins 1 and 4 with/without "Buzz" and verify DC in all situations..

Another thing to check for pins 1 and 4 DCV :
What happens if you press "door and talk together" or "door and listen together"?

 

[Mika]

@dorke sorry for the long wait on response, it took me a while to find someone who was willing to wait downstairs and press the buzzer.

So between 1 -> 4 AC it jumps to 5 when i first connect the multimeter and then to 0, when the buzzer is hit it jumps to 2

1 -> 4 DC is at 12 and drops to 10 when buzzer is pressed

2 - > 4, 2 -> 3, 3 -> 4 all seem to be the same and report `-2` so it's flowing opposite direction instead

When pressing door and talk or door and listen together only listen/talk take over and door stops working, the dc voltage drops to 0 too.

As for the current it was only like 2 microamps

 

[dorke]

So,
You can get about 9VDC or lower power from pins 1 and 4 (needs bridge rectifier+filter cap).
What specific bluetooth module do you want to operate ?

I note your measurements are not the same in different posts.

 

[Mika]

Ah that makes sense, ok I'll do that.

I may have measured a different set of pins this time! Oops.
When I get someone over I'll get them to buzz a few times again. Good to know I can power a low powered device,

I'm not sure the bluetooth module yet, I kinda just wanted to experiment a bit, get a led to light up when someone buzzes for example or such. It would also be cool to be able to read the audio/send it from a different speaker than the one provided