# Need help reverse engineering and understanding a small circuit

I am an electronic student, and one day I opened an energy meter I have at home called EM21, and found out that its body is comprised of two major components:

• The meter body, that connects to the grid and measures voltage and current (in theory, it has all the intelligence of the meter)
• The LCD display, that shows the user real-time information about the measurements (dumb, has enough intelligence to control the LCD, push-buttons and request the body for voltage/current/power info using induction)

The awesome thing here is that the LCD component is powered by the body, and communicates with the body, using nothing more than induction (contactless).

[LCD with buttons]-----coil  <magnetism magic>  coil-----[meter body]


In a couple of hours I've tried to reverse the circuit that uses coupling to provide energy to an LCD screen with buttons, and at the same time, that coupling is used as a contactless communication channel.

This was the end result:

simulate this circuit – Schematic created using CircuitLab

Thank you Transistor and /u/eyal0 @ Reddit for organizing the connections

And these are the photos of the real cannibalized circuit:

• FRONT (open in one tab)
• BACK (open in another tab, and then commute between both, they are aligned with each other)
• FRONT Labeled
• PWR SRC The coil that is used to power the circuit (body powers LCD circuit through it) and for communication

(can you check if I got the diagram correctly?)

Thank you /u/InductorMan @ Reddit for pointing me out the C4/R4 mistake I had in the diagram.

I have some questions about the inner workings of this for which I can't find an answer:

1. How can the coil be supplying the ATMEGA with DC current? How come VCC is directly connected to one of the coil's ends and it doesn't fry the ATMEGA?

2. What is the role of Q1?

3. What is the WB2 component?

4. What ATMEGA pins are used for communication? How can I "listen" to them (with an oscillo) and discover the communication protocol?

5. What are the AVCC and AREF doing the way they are wired in the diagram?

6. How can I easily find the values of the capacitors and the zeners?

Thanks!

• You really should redraw this with the ground at the bottom and the power rail at the top. To make sense of the signalling, try a loop of wire on a scope probe held in the area of the suspected coupling. Jul 11, 2017 at 14:01
• What way have you embedded the schematic? I can't edit it without CircuitLab membership and it's too small to read. Simplify your schematic by adding GND symbols as close to the components as you can. R4, R5 and C4 can have their own. R5 and C5 can move over beside D1. Jul 11, 2017 at 21:31
• This resembles passive RFID tag. Apparently, WB2 is zener, for regulating voltage of power to the MCU. Q1 PE2 is classical RFID communication configuration for RFID tag, by changing the ' transformer load', causing amplitude modulation to be sensed by the body (which act in same manner as RFID transmitter). R1 D1 PE3 is communication into the MCU (from the body) by amplitude modulation (same as above, just in reverse communication direction). Typical passive RFID tag is one way only and does not have communication in this direction.
– EEd
Jul 13, 2017 at 21:22
• Basic passive RFID configuration is as first diagram of readingrat.net/rfid-tag-block-diagram/… Modulator and de-modulator are the into_MCU and out_of_MCU communication of the poster's circuit
– EEd
Jul 13, 2017 at 21:29
• See the classic book (the first comprehensive book on this topic) published by JOHN WILEY & SONS, LTD., RFID Handbook, Klaus Finkenzeller, ISBN 0-471-98851-0, page 38 (load modulation Q1), page 47 (block diagram), page 78 communication sensing by transmitter (body in the posters question), P130 amplitude modulation, P173 two way communication, same as poster's circuit.
– EEd
Jul 13, 2017 at 21:48

The RF induction to DC power components must be selected carefully for mutual coupling and impedance, yet the resonance is very low Q~1 .

Using a transformer with 200uH primary coil (not given) same as Receive coil same turns, ratio=1 but Mutual Coupling reduced to an optimistic 75% with 20Vpp input and 15Voutpp (no load) sweeping from 50k to 250kHz. Charging appears to work well (from my recent analysis now) in the ~100~200kHz range, forced by my estimate of coil inductance from photo and experience with RFID's and WPT ( wireless Power transfer)

With Zener, D2 and C2, 220uF cap I chose C3 over a wide range and settled on 5nF. Without C3 and the above settings it reached 5V in 50ms and with C3 in half the time, 25ms (implying low Q). Since the initial state of C2=0V lowers the (diode ESR)/Xc(f)=Q impedance ratio wrt. LC ( ie low Q), there is no resonance and it is under-damped with lots of ripple current , starting under 0.5A(rms) (greatest at the lowest frequency of my range implies impedance) then reducing Ipk as it charges up, but Ipk still many times DC load.

With these values in theory 200uH & 5nF it ought to resonate just above 100kHz but in practice with a switched load impedance Zener to 220uF cap it worked the same for anything above 100kHz implying a very low Q using a 1K load R and 220 ohms for X(f) for LC with pulse currents. (non-linear)

If you want to play with the values, go here. If not familiar with Falstad, point to waveform highlights the part being scoped and visa versa with Max/min values on each trace and I also selected Max Scale, which auto-adjusts like AC coupling but still shows actual DC max values and shows in slow-motion real-time but adjustable with slider and Options>other options

I assumed the SOT23 was a 5.6V zener.

This just analyzes the wireless LF to DC path. Not efficient but with a switch on the XFMR output it seems to be near matched for max power transfer. All caps are implied as lossless, unless you add Rs. 1G Ohm R's were added just for scope tracing and 1 ohm input ESR for measuring input impedance.

Remember ground is just a 0V reference to a floating circuit. If I make them common, the output goes from -5V to 0V.

Reducing the input from 20Vpp to 18Vpp increases the charge to 5V time by double. The interesting top right scope trace is the 220uF ac voltage amplified full scale at stead-state with a very small 5mA load. The rising voltage indicates DC charging in the middle of the f range from 100~200kHz is fairly constant slope I=CdV/dt then decays downwards outside at outer ends of the FM test sweep power signal. Since my sweep was a not bidirectional, it is a sawtooth log f Sweep.. From this we see the voltage transfer function by the cap charge voltage from the half wave Zener rectification. Although a sweep to DC is not shown, the selection of C3= 5nF couples the Zener to the C2=220 uF and it's voltage rise at the low f end implies the current and impedance of the inductive coupling.

The Falstad simulation applies all given component properties and laws of physics.

That's concludes my analysis and is consistent with my expectations, now.

## "Ballpark" Assumptions for 100kHz~200kHz operation

• given C3=220uF ( assumed low ESR)
• coil Ls=200uH, Primary, Lp not shown, assumed same L with 1:1 ratio coupling factor = 0.75
• C2= 5nF ( assumed low ESR)
• D2 Zener must be 11.5V~12V to get 5Vdc efficiently , used 12V
• SOT23 , assumed to be 5.6V clamp not critical, for OVP.

D2 is a half wave rectifier that creates DC from the transformer to provide power to the CPU. C1 and C3 are in parallel and smooth the DC with the unknown component probably being a zener diode or shunt regulator to control the supply voltage to the circuitry.

Although it looks unusual being in the negative rail D2 is probably arranged like that so that the voltages are convenient for sensing and driving the transformer with Q1 for back communication.

C3 resonates the transformer to the frequency of the carrier used for transferring power and communications. I would expect a frequency in the 100-200kHz range.

The AC signal passes through D1 to pin PE1 on the CPU for the communication. The combination of D1 and R1 limit the voltage that the CPU sees to acceptable values.

Q1 is used for the CPU to send data back to the base unit. When it is told to conduct by the MCU putting PE1 high it drives the voltage from C1 across the secondary of the transformer - the base unit will be able to pick that up.

I suspect it implements a half duplex sequence where the base unit transmits some data by varying duty cycle of the signal into the transformer which at the same time will put energy into C2 to power the front panel.

The transmitter will then stop sending and wait for the front panel to send information back to the base unit. The sequence will then repeat. The sequence has to be be performed fairly quickly (10s or 100s of times per second) as the front panel is operating entirely from the energy in C1 during the time it is sending information back to the base unit.

Since AREF is connected to ground it implies the ADC is not being used - it is normally recommended to leave it open though.

• A zener diode in a SOT23? Jul 11, 2017 at 15:31
• @nemewsys - I agree a bit unusual - what else could be across the supply rails? Shunt regulator? Jul 11, 2017 at 15:41
• Zeners in SOT23 packages are common; the power requirement of this circuit is small. Jul 11, 2017 at 16:31
• I think C3 is actually there to tune the inductor to a suitable resonance. Other then that I concur, a neat implementation of nearfield comms. Jul 11, 2017 at 18:04
• @DanMills - that was a typo (I couldn't read the schematic very well) I had already fixed that. I meant C2 of course. Jul 11, 2017 at 20:55