Hack Into a Timer AC Socket

About the timer socket:

This timer ac socket can mount on the normal AC socket, and other domestic appliance can further plug on it, there is a button and a few LED indicating time: 2hour, 4 hour, etc, when you press the button, LED will light up and switch accordingly so you know the time is set up, when the set time is reached, the socket will disconnect. It is cheap only 2-3 USD.

Purpose:

We bought this item for testing, and aslo we will see if it is possible to attached our wifi modules or bluetooth(BT) modules directly into it to enable wifi or BT control, make a simple product revolution.

Reverse Engineering on PCB and Working Principle:

The PCB is very simple, only one side, a few parts, to do the reverse engineering, we use multimeter to check all the connection, all the same connection which also called net are picked and write down, I will simply call them A, B, C, D … etc only the N and L wires which means Neutral and live wires from the AC.

AC to DC part:

The design firstly have a RC buck ? (not sure how to call correctly in english) circuit to step down the voltage from 220V AC to 5V AC, a 0.33uf safety capacitor (yellow one) used here, accompanying with a 1M discharge resistor. And after these two there is another current limited big resistor to prevent pulse and shock.

Furthermore, 4pcs of 1N4007 made the AC to DC voltage rectifying circuit. Now 5V voltage are supplied via A (should be GND) and D (should be VCC) network, as shown in schematic. 220UF capacitor and zener diode keeps the voltage stabilized and safe for human. From D to B, there is a 2K resistor, not very sure what it is doing here, but final operational voltage for IC is from B.

The final IC has a button and a few LEDs around, and its pin 8 (on schematic pin 14) controlled the final relay, don’t know what is the IC now but should be not difficult to find out. Also a S9014 transistor is functioning as a switch transistor.

Updates: On A and D point, the output voltage at 25.5V, and 1N4749A is the 24V regulator diode.And from D to B point, the resistor keeps the voltage down from 24V to 2.77V for the IC use, a 5.1V/0.5W diode here for regulating but still 2.77V.

Here is the schematic and the back side of PCB:

Hacking

We are adding wires to the net B, net A, signal controlling net for the relay, so there are three wires, that fits to VCC, GND and GPIO pin of wifi or BT module.Not yet finished

Disassembly

And here are our disassembly process, check more details about this product:

The final result:

After attach our bluetooth module on it, it can not be booted up, so we realized the problem is this RC buck circuit already designed to provide limited current for load which is the IC only at 20mA, it can not provide any extra current for other things (BT module need 40mA peak, and 20mA average), it is a cheap good design but not able to allowed us to hack anymore.

And some tools and parameters for this capacitive dropper can find here on our wiki page.