Teardown: Mercury Remote-Controlled Socket - LEKULE

Breaking

22 Feb 2017

Teardown: Mercury Remote-Controlled Socket

In this Teardown Tuesday, we will be looking at the innards of a Mercury remote power plug that uses a remote to control power sockets.

The Power Socket

The socket device, itself, is a very clean design with no visible antenna on the outside. Only two screws are used to keep the whole thing together and they are of the security type (three prong screwdriver). This is done to prevent the average home user from gaining entry to the inner workings. (This is not to prevent the design from being copied but rather to stop people from coming into contact with mains wiring.) One other method of preventing unauthorized access is to have the entire unit in a singular mold.


The remote and socket
 
The information label found on the socket

Getting around the security screws in this teardown, however, will not be a challenge thanks to the invention of the drill press and high-speed steel bits, which are specifically designed to cut metal. Using a 5mm drill bit, the screw is completely destroyed and the unit opens up quite nicely.
The side of the socket also has a button that is used to synchronize the remote with the socket (but this is already done at the factory so it should not be required).

Security screws

Inside the Socket

The socket shows a controller which consists of a relay, a (bulky) capacitor, an LED indicator, various passive components, and an RF receiver.


Front cover removed

The PCB is held in place using two crosshead screws where one plastic knob (top right) helps to prevent the PCB from moving around (a cheap alternative to three screws).
The red wire on the far left (in the image below) is the line conductor from the mains feed (also known as the live conductor). The red wire in the middle is the switched live. The blue wire on the right is the neutral conductor. The neutral conductor here only needs to be a small piece of wire because the controller only draws a small amount of current and the neutral conductor typically does not require isolation (one exception being submerged heaters).


The PCB from above
 
Contacts for output socket

The Main PCB

The main controller is a single-sided PCB with through-hole parts on the top side and surface-mount components on the bottom side. On the top right corner of the PCB is a rubber ducky antenna which is connected to the RF module via a PCB trace.


The main PCB
 
The RF antenna (rubber ducky)

The RF module has a four-pin angled head which is soldered onto the main PCB. The pinout for the module includes the antenna, power, data, and ground. Judging by the pinout, it can be assumed that the module takes in serial data in the form of UART (as that only requires one line of communication)—but, as this module is controlled by a remote, this data line may be an output instead.
The IC that sits on the RF module is the RF83C (PDF) which is an ASK/OOK (on-off keyed) IC RF controller which has all RF tuning internally held. Considering its simplicity, the RF83C may be a great IC for hobbyists in projects that require a wireless connection but not an internet connection.


The RF module connected to the main PCB
 
The RF83C IC

The underside of the PCB shows some surface-mount parts but many of these ICs do not have ident markings. Judging by the simplicity of the product requirements, they are most likely for power control.

Underside of the PCB

The Remote

The remote is very basic with just six buttons (three sets of two). Each set of two buttons is to either turn on or turn off a switch. The system can be synced with a new socket by pressing and holding the learning button found on the side of the socket and then pressing the desired button on the remote.


The remote controller
 
Underside of the remote

The remote is held together with just one screw and a tightly-fitted lip around the plastic casing. Once removed, the inside of the remote is brought to light, revealing a very simple construction.
One nice feature of this remote is the use of tactile switches instead of a rubber membrane (which gives a nicer feel when operating).
Close observation reveals many stitching via on the PCB flood plane which covers most of the PCB. This is present to improve electromagnetic compatibility and therefore comply with FCC and CE regulations.


The remote with cover removed
 
Close-up of the switches and heavy use of a ground shielding plane

One component that caught my attention was the TO-39 cased part in the bottom right of the photo above. Initially, it was believed that the part was a transistor but, on further investigation, the R433A (PDF) is actually a surface-acoustic-wave resonator that is used to help produce the 433MHz carrier signal.


The resonator, R433A

The underside of the remote shows many surface-mount components and one IC. The IC, HS2260A-R4, is a Chinese part that does have a datasheet but is written in either Mandarin or Cantonese.
However, looking at the schematics that the datasheet provides suggest that the IC is some kind of multi-channel data encoding where switches are connected to the inputs and the IC produces an ASK/OOK on-off signal. This is then fed into the 433MHz oscillator circuit so that the receiver found in the socket can be controlled.


The underside of the remote


The HS2260A-R4

Summary

This teardown shows how basic radio control can be. The use of stitching via demonstrates the need for modern products to consider EMC and the use of security screws shows the importance of preventing unauthorized access to mains voltages.


However, what I personally will take away from this project is the 433MHz communication and rubber ducky antenna, which suggest that using such radio frequencies in hobby projects could be trivial. Maybe a project or two in the future could look at 433MHz communication and how to get different projects all cross-communicating (in a similar fashion to the IoT)!

No comments: