This tiny little board is a zero network node for an otus elevator, and it's designed to control in this particular instance uh four of these illuminated buttons. So you basically got a little button. You press it and it will actually then eliminate the button and your call is in um, but it's quite interesting, the construction of it - and this also seems to be using a proprietary network system. So, let's take a closer look at the circuit board in a larger scale, because i've already blown it up, not actually i've actually not managed to blow it up physically, but this is what it looks like on the front.

This is what it looks like on. The back. Goodness knows what it looks like inside, because it's a multi-layer circuit board, and that is quite frustrating, but on the back, basically speaking, it's the uh in this area. It's the button, filter inputs and the rest of it is largely, i think, the network control, which is very very hard to trace.

But let's take a look at the circuit board itself and what's on it, so i'm going to zoom down a bit. It's kind of interesting, it's very typical, of an industrial application. This area is covered in conformal coating. It's not an attempt to hide the numbers, it looks like numbers have been scrubbed off, but in reality it's just they've put splooge all over this and the reason they've done.

That is probably for stability, because sometimes these modules get operated in humid environments or are in a wall where water drips down onto them, and one of the problems of that is that if water drips onto the circuitry here and causes problems particularly around the oscillator area, If it caused the processor to glitch or crash, it could actually pull down the entire network and just basically stop all the landing buttons in every level from operating this. Incidentally, the four buttons, if in the case of say, for instance, the lop the landing operating panel - you'll just possibly have one of these. But in the case of the car operating panel, the cop, you might have a stack of these clipped into a little frame or a version with a lot more channels depending on the brand or you know, depending on the manufacturer and their their particular preference. I did notice the chinese were selling a version of this that looked basically at the one network, connection and power connection, but it had stack.

It had multiple sets of these and it had that repetition of this chip. This chip, incidentally uh - what's the number on it? It is gaa 31070 aaa 1 and it appears to be a microcontroller pic microcontroller, but it's been custom programmed with otis's own code and it's been given their part number on the white connector. At the side. We have the two zero bus connections.

I believe that the uh rsl, the remote serial link network is based on rs485 voltage levels, but i'm not 100 sure about that. It appears to be using otis's own protocol. I thought it was going to be canvas. I was looking for a can bus chip.

I don't even see an rs485 driver, and i have to say because this is a multi-layer pcb that you can't actually see both sides similar well, the the interior layers. It's made it very very hard to trace out. I may give it another go, but it's also. I had to put my little super extra thin gold probes, the stabby needle ones on, but trying to actually probe on one side, while probing on the other side is extremely difficult, because the probes, still you know, slip off the components it just it's been.

It's been frustrating particularly those hidden tracks, but the supply comes in 30. Volts uh has a transient suppression diode here a polarity protection diode here there's some other filter capacitors, but here is the electrolytic. Capacitor is used just to basically provide a stable local supply. That is then used to generate two 23 volt supplies.

I'd guess that the standard is probably 24 volt, but they've nudged them down by one volt. And although they've got two regulators, i think they've just split the load between two regulators, because each one is doing two connectors and that's it except this one which has a little resistive me off through a diode network. And then it's coming down. That's going to another regulator, the tl317 they're all 317s, which is local programming to set it for 5 volts.

The only other chip here on the microcontroller is an lm393, which is a comparator which is like an op-amp, but it's designed for decisive voltage comparisons and a sudden logic transition. Um. The buttons they've got a couple of uh local, smooth capacitors for those 24 volt supplies. They have basically on the pins here.

They've got uh the zero volts they've got the input from the push button, the 24 full output from the regulators and then they've got uh an output to drive the led. The output is switched by this little mosfet, which uh is driven by these four pins. Here, the microcontroller, incidentally uh i was trying to work out what it was. I've not deduced what it is yet pins.

One and fourteen are negative pins. Two three and four are positive: uh and pins. 28, 27 and 26 are the crystal um. I shall cut to the chase i'll go straight to the schematic.

I'm not i've not drawn the whole thing out, because a autism probably get quite miffed uh and uh. Also uh, it would take a very long time. This uh is the addressing switch here. This sets the address uh, where it is on the network.

Anything else worth looking in the back, not really no, there's nothing worth looking at the bag. Just uh those two resistors in that capacitor and each cluster of these is uh. The switch filtering, which i shall show you so here is a basic. This is just showing the power.

This is showing the inputs and outputs, it's not showing the network. So the 30 volts come in there's the transient suppression, diode, the transil or transorb. There is the diode for polarity, there's the smoother capacitor and there's the two regulators. In reality, these regulators they're not just fixed voltage regulators they're variable, so they've got a resistor divi resistive divider, actually setting the voltage in each of these two 23 volts that also lets them custom program.

The voltage on these then there's a little tap off through a resistor and diodes to the little five volt regulator provides a five volt supply over to the microcontroller, the microcontroller, and i got this wrong this i drew what i was expecting: a resistor and a npn Transistor in reality, let's just draw that in that's what it is. It's uh n-channel mosfet by the look of it and the output goes straight to the n channel mosfet um, it's quite odd. The the mosfet is called. What is it called? I did look for it.

Uh qg that doesn't really help when you do a search for mosfet qg. You find that qg is an abbreviation for gate charge and there's therefore appears in many data sheets. It's a terrible name for a mosfet for finding it, but anyway it looks like a mosfet. So the microcontroller one, when you push the button uh, here's the three pins on each of those outputs, the uh button.

Actually bridges it doesn't use the zero volts. I guess that's just an optional available thing, but it bridges the 23 volts to the input. Pin the button pin that is then goes through goes through a 20k resistor limit current and it forms a potential divider with this 4k 7 to bring it to a level that microcontroller can safely handle. There's also a decoupling filter capacitor to remove any noise, because there's always a risk that you're going to get well electrostatic discharge, restart and also pick up electrical noise from a cables around the vicinity of, say, lighting cables for a illuminated panel or other stuff.

Just any wire axis antenna that provides filtering but there's also another layer protection with a little a7 diode, which is uh i'll, show you in the drawing it's there, there's one next to each of these inputs and that uh means that the voltage exceeds the supply rail By about 0.6 volts, it will conduct to the supply rail and vice versa, from the zero rail. So that just stops it going well beyond the range of the microcontroller. But it is well current limited anyway, but it caps that voltage and that just filters that input. When you press this button, when you press the button, it sends a signal to the mic controller.

It says you know a button has been pressed the microcontroller most likely. Then uh sends a signal on the bi-directional serial network uh which it will have to actually command attention to that i think it jams it deliberately just to get the attention it's similar to the canvas, but it's not canvas, i don't think very strange, but uh. It sends a signal back saying: the button has been pressed and if everything is working as normal, if it's not working as normal, it won't light, but it sends a signal back to the microcontroller that says turn on the transistor and it turns on the led. That's fundamentally that i have you know for such a simple thing: it controls four buttons on a zero network.

I have spent so much time i wasted so much time trying to find that chip before someone pointed out that it looks like a otis number uh, because i've mentioned it and patreon has said any idea what this is and they said, yeah. It fits in with a load of voters, sort of part numbers, and it did turn out to be that that was the case, but an interesting little thing. I do kind of want to reverse engineer the driving of the network, but that is quite a lot of work to do um, particularly on the multi-layer board, and in a way you know, i'm so used to to me rs-485, even bi-directional, like say, for instance, uh Rdm remote device management of like the theater equipment lighting, it just uses a bi-directional rs485 interface. I'm not sure why they've chosen to go with their own proprietary standard because it it's not like when this was designed the in 2003.

It's not like you know, canvas or like rs-485 wasn't established by then, although it might just be harking back to an older standard. Uh orders do seem to have a patent on this communication protocol. That seems to be sort of a proprietary thing that they designed. So it may have actually happened, knowing otis uh, certainly all daughters.

They were quite inventive. They were always a bit pioneering. They were always sort of ahead of the crowd and designing new stuff. So it's possible that this is just a standardized network that dates back to an original design of when electronics was really just coming in and microprocessors.

But it's interesting it's a typical example. It seems well i'd expect it's otis, it's going to be well designed, but um. It's got all the sort of protection inputs. It's got the uh strangely, not so much the outputs but ultimately, probably just saying well, it's a mosfet switching led what could go wrong um but uh.

It's interesting like dividing it through the little two little voltage regulators and then another one tapped off that for that, i'm guessing the reason they chose 30 volts is because this is going to be a power and data cable coming down the shaft, so they went for A higher voltage, although this thing only it doesn't take that much current the button hold on. Let me just uh light the button up again at 23 volts. It's only about eight milliamps. This button takes but uh.

This thing here only drew about 13 milliamps in its standby state, with just uh the microcontroller running, but that's it that is the uh otis rs14 network node for controlling the call buttons in the car and in the hall um or for some other applications, i'm guessing As well, but it's quite interesting - it has matching displays and uh controllers that will also use the same serial network. But the one thing it can't do is replace the safety is like say, for instance, the switch switches in the shaft doors all have to be hardwired. Right back to the control panel, so that you can't rely on a data for that it has to be a hardwired network, so if a door gets jammed open, it's a very decisive uh signal that you know the lift shouldn't move because the door is uh. Currently, in a unknown state, but there we go interesting stuff.

.