I have a problem. If I go to a swap meet , or even a particularly well stocked yard sale, I feel compelled to buy something. Especially if that something happens to be an oddball piece of electronics. While on the whole I’m a man of few vices, I simply can’t walk away from a good deal; doubly so if it has a bunch of buttons, LEDs, and antennas on it.
Which is exactly how I came into the possession of a Catel CPT300 restaurant paging system for just $20 a few months ago. I do not, as you may have guessed, operate a restaurant. In fact, as many of my meals take the form of military rations eaten in front of my computer, I’m about as far away from a restaurateur as is humanly possible. But I was so enamored with the rows of little plastic pagers neatly lined up in their combination charging dock and base station that I had to have it.
The man selling it swore the system worked perfectly. Even more so after he plugged it in and it didn’t do anything. But appearances can be deceiving, and his assurance that all the pagers needed was a good charge before they’d burst back to life seemed reasonable enough to me. Of course, it hardly mattered. The regular Hackaday reader at this point knows the fate of the CPT300 was to be the same whether or not it worked.
Incidentally, those cute little pagers would not burst back to life with a good charge. They may well have burst into something, but we’ll get to that in a moment. For now, let’s take a look at a gadget that most of us have used at one time or another, but few have had the opportunity to dissect.
But First, a Mystery
There’s not a whole lot to see on the outside of the CPT300 base unit. Sixteen slots in the top for charging the pagers, and a simple membrane keypad on the front that lets you select which unit you want to send a signal to. With nothing else of any great interest on the outside, I went right to removing the heavy metal plate that makes up the base of the unit.
Inside there were several pages of note paper folded up, along with a healthy application of red electrical tape. Presumably the PCB had been shorting out on the base’s metal plate, so somebody went in and added a bit of insulation. The pieces of paper were blank, except for one that had what appeared to be a street address and a phone number written on it.
The address had no city or state, but the area code for the phone number came up as being in Brooklyn, New York. That put us at an apartment building about a block away from the Coney Island Boardwalk. It’s probably safe to assume the CPT300 wasn’t in use there, but if we allow our imagination to wander a bit, maybe whoever lives in the apartment ordered some takeout from the restaurant this device came from. Perhaps the slip of paper with the address and number, as well as a few blank pages behind it, later caught the eye of somebody who was looking for an insulator to fix the intermittent short in their paging system. Of course we’ll never know for sure, but stranger things have happened.
A Barebones Base
With that bout of sleuthing behind me, I got back to taking apart the base of the CPT300. But as it turns out, there was probably more excitement to be had browsing Google Maps for restaurants in Brooklyn. The design and execution of this device could easily pass for a prototype or someone’s personal project, complete with overflowing solder and bodge resistors.
Functionally, the base station is very simple. Under the keypad there’s a STC15F204EA microcontroller that reads the status of the buttons to see which pager the user wants to wake up. Once you press a button, the corresponding binary sequence is sent to the bog-standard 433 MHz transmitter module located on the charging board. A simple four wire ribbon cable links the charging board with the control board in the top half of the case.
This ribbon cable makes a perfect place to attach the logic analyzer to snoop on the communication between these two devices. Using the On-off keying (OOK) decoder in PulseView, we can see the actual binary signal that will ultimately be sent out over the air for the pagers to receive.
After pressing a few buttons and comparing the intercepted binary, it was easy to find the device identifier. Only the final 4 bits ever changed, which gives us exactly 16 possible combinations; precisely how many pagers are supported by each CPT300 base station.
Puffed Up Pagers
With the base station thoroughly examined, it was time to turn my attention to the individual pagers. As mentioned previously, the pagers were all completely unresponsive even after being left to charge, so I was curious about what was keeping them all silent. My first assumption was that the base station simply wasn’t transmitting, but the logic analyzer seemed to indicate that it was. So why weren’t the pagers responding? As soon as I opened the first pager, I had my answer.
If you’ve spent any time working with lithium-ion polymer (LiPo) batteries, you’ll likely see the problem immediately. For those who haven’t, I’ll give you a hint: the battery shouldn’t be puffed up like a silver marshmallow.
We’ve previously talked about the chemistry involved, but the short version is that a mistreated LiPo can experience electrolyte decomposition which fills the pack with flammable gases such as hydrogen and oxygen. So not only are these batteries shot, but they’re dangerous and need to be carefully disposed of. I checked the rest of the pagers, and almost all the batteries are swollen to some degree. Suddenly that $20 seems like it might not have been such a great deal after all.
So what constitutes mistreatment of a LiPo battery? The usual culprits are overcharging or discharging too deeply. Since all of the batteries seem to have been damaged in the same way, that lead me to believe there was some flaw in the pager’s design. My first thought was that the batteries were getting overcharged, so let’s take a close look at the power circuitry and try to find out what’s going on.
Following the yellow traces from left to right, we see that the pager’s positive charging pad is connected to a 78M05 regulator (marked in purple). Rather than put the regulation in the charger itself, it was probably cheaper to put lower-capacity regulators in each pager. So while the voltage on the base station’s charging rails varies significantly depending on how many pagers are currently docked, the 78M05 in the pager makes sure it always has a stable 5 V. From there, it goes into a LTC4054-LTH7 (blue), which is a very common lithium battery charging chip that’s designed to run from 5 V USB. After the LTC4054, the trace connects to the same side of the slide switch that runs directly into the battery connector.
So the charger seems put together well enough, but what happens when the pager is removed from the base station and the battery starts discharging? With the switch slid to the on position, we see from the red traces that power goes directly into a 7333-A regulator (green) that provides 3.3 V for the pager’s electronics. Which means that as long as the switch is on, the regulator and everything it’s powering is connected directly to the battery.
Under normal circumstances, this wouldn’t really be a problem. The electronics probably don’t draw a whole lot of current to begin with, and the pagers would be getting recharged every night anyway. Besides, the internal electronics on a quality LiPo battery pack should cut-out when the cells approach their design minimum voltage, usually around 3 V.
But when I tested a few of the packs, some had dropped all the way to 1.7 V. It could have been months, or even years, since anyone had tried to charge these batteries. Combine that with poor storage conditions (such as keeping them in a hot garage or attic), and you’ve got a recipe for irreparable damage.
Can You Hear Me Now?
So what else is inside one of these pagers other than a small explosive device? Not a whole lot. Half the board is entirely empty; it’s clear that these devices were made this size for user convenience rather than necessity. Each pager has a buzzer, array of LEDs, and a small pager motor at its disposal for notifications, and documentation from the Catel site says that you can configure which one it will use with a series of button presses.
There’s a 16 pin device which is clearly a microcontroller of some sort, but unfortunately it’s completely devoid of any markings. There’s an unpopulated four pin header right next to it though, so perhaps something interesting could be gleaned that way. Incidentally, the documentation says you can pair the pagers by holding a small button on the front until the LEDs begin to flash, so they don’t need to be physically reprogrammed if you wanted to switch their numbers around.
To pick up the signal from the base station, the pagers use a Micrel MICRF211 receiver operating at 433.92 MHz. One interesting thing to note is the rather jaunty position of the external 13.52127 MHz crystal. As best I can tell, it’s mounted this way because they realized it was positioned so close to the MICRRF211 and associated passives that they might short out against the can. Rather than redo the board, they just tipped the crystal over a bit. I checked the other pagers, and yes, they’re all like this.
Lessons Learned
I’ve ordered a handful of batteries for the pagers, and once installed, I’m fairly confident they’ll come back to life. When everything is working again, I think that the CPT300 would be an interesting subject for some further exploration. Specifically, I’d like to use it as a case study for working with unknown 433 MHz devices. For example, comparing what a logic analyzer on the board sees to an over the air capture from a Software Defined Radio. Most of my teardowns end up as a pile of spare parts but I think there’s still some life left in this one, so keep any eye out for its return.
More importantly, this teardown is a reminder that you need to be careful when picking up old devices that use internal lithium batteries. Putting these pagers back on charge without checking the health of the battery packs was a mistake, and could have started a fire if one of them ruptured. So if you’re looking at an interesting gadget that doesn’t have an easily accessible battery, assume it’s shot until you’re able to get inside it and verify its safe to use. A $20 swap meet find isn’t worth losing your house over.