Jump to content
Sign in to follow this  
Followers 4
savant9

Dissecting the Chirp

Recommended Posts

After seeing many unanswered questions, plus a bunch of my own, I wanted to find out a few things about the Garmin Chirp.

 

As we already know the chirp gets locked to the first unit that programs it. Surely there is a debug/test connection somewhere on the device that could be used to override this, given the right programmer. But how to access it? Lets take a look. The chirp is quite well sealed, but there is a sticker under the battery area that is easily removed. Under this sticker we see 11 contacts.

 

DSC_0105.jpg

 

Bingo. Now the question is, what are these connected to? There is no real way to know without a more detailed understanding of the hardware inside. As this is a well sealed unit, you cannot open it without destruction of the housing. A few minutes of careful dremel work and it is open. For those that aren't aware of how small these things are I have included a Canadian quarter for size comparison. And for those who are unaware of the size of a Canadian quarter, its the same size as a US quarter.

 

DSC_0107.jpg

 

The battery side doesn't reveal too much to us. We see that it is made by Dynastream Innovations. This isn't really surprising as they are the company that created the ANT protocol, and are owned by Garmin. I find the copywrite 2007 interesting. I have speculated before that the chirp is basically the same hardware as the Garmin Footpod. It shares the same housing at any rate. More on this later.

 

The only other things to note about this side are the battery contacts, large ground plane, many traces and vias, but otherwise unpopulated. The two unmasked vias are labeled TXD and RST. Well RST goes directly to Pin #11 and Pin #1 goes to the ground plane. 2 contacts identified, only 9 to go. Lets take a close look at the other side.

 

DSC_0109.jpg

 

This side is much more interesting. Too hard from that image to read the markings on the components but they are:

 

The larger black square is the micro controller. It is a Texas Instruments MSP430F2350 datasheet here

 

The smaller black square is the wireless transceiver. It is a Nordic Semiconductor nRF24L01 datasheet here

 

There are also a couple crystals and assorted capacitors and resistors, and the unmasked antenna. Note the unpopulated area in the center of the PCB? More speculation on my part, but I believe that this could be where the accelerometer is located if this were a FootPod.

 

Thats all I have for now, I will continue to follow the traces and read the datasheets to determine the remainder of the pin connections. Later this week I will update with more findings.

Share this post


Link to post

Great work! Thanks for posting this -- and I look forward to more installments.

Share this post


Link to post

I look forward to hearing more. Reading through your post I was expecting some revelation about hacking or programming the Chirp. Quick! Hook some devices up to those terminals and tell us what you find.

 

Hopefully, they are not easily hackable, as that would lead to theft.

 

Chirp Plug:

iPhone Chirp support is currently #12 on the list. A few more votes could push it into top ten:

http://feedback.geocaching.com/forums/7527...e-app?ref=title

Share this post


Link to post
Note the unpopulated area in the center of the PCB? More speculation on my part, but I believe that this could be where the accelerometer is located if this were a FootPod.
Cool. The first thing I noticed in your pics was the cut out around that unpopulated area. My guess was vibration reduction for that part. I guessed mic, speaker or accelerometer. So I guess we both guessed accelerometer. Does removing the battery reset the owner id?

Share this post


Link to post
The first thing I noticed in your pics was the cut out around that unpopulated area.
Could also be for functional or EMI reasons - the idea being to cut the ground plane everywhere except back under the traces that follow it - although I'd have to say, routing the thing out like that looks like a bit of overkill. Keeps recirculating currents from other parts from causing noise on a sensitive part. Edited by ecanderson

Share this post


Link to post

To the OP. It would certainly be interesting to see what happens if that RST line is taken to ground during battery insertion ... wonder if it would still remember whose Garmin it belongs to?

Share this post


Link to post
The first thing I noticed in your pics was the cut out around that unpopulated area.
Could also be for functional or EMI reasons - the idea being to cut the ground plane everywhere except back under the traces that follow it - although I'd have to say, routing the thing out like that looks like a bit of overkill. Keeps recirculating currents from other parts from causing noise on a sensitive part.

Interesting guesses, more please. How about this? The missing part is a vibration detector tuned to the frequency that little "diving board" vibrates at. The cut out vibrates; the pedometer counts a step.

Share this post


Link to post

If the mounting area of the accelerometer was tuned to the natural resonate frequency of a foot step then you would get multiple (resonance) pulses out of the accelerometer with each foot step. This would be highly undesirable. In the vibration world we try hard to keep away from this condition because resonance exaggerates vibration. Most accelerometers have a fixed output of 100mv/g at a very wide frequency bandwidth. There would be no need to try to make it vibrate at a fixed frequency.

Share this post


Link to post
Does removing the battery reset the owner id?

no it remembers all details of the programming without power.

Share this post


Link to post

Here are the pinouts from left to right for the top picture. Almost all pins go directly to the MCU.

 

1: -3v

2: unknown appears to go to RST through a small component, via comes through under MCU

3: MCU pin 10 (TA1)General-purpose digital I/O pin/Timer_A, compare: Out1 output

4: MCU pin 36 (TMS)Test mode select. TMS is used as an input port for device programming and test.

5: MCU pin 37 (TCK)Test clock. TCK is the clock input port for device programming and test.

6: MCU pin 35 (TDI/TCLK)Test data input or test clock input. The device protection fuse is connected to TDI/TCLK.

7: +3v

8: MCU pin 34 (TDO/TDI)Test data output port. TDO/TDI data output or programming data input terminal

9: MCU pin 14 (CAOUT/TA0/CA4)General-purpose digital I/O pin/Comparator_A output/Timer_A, capture: CCI0B

input/Comparator_A input

10: MCU pin 32 (TBOUTH/ACLK)General-purpose digital I/Opin/switch allPWMdigital outputs to high impedance -- Timer_B3:TB0

to TB2/ACLK output

11: MCU pin 38 (RST/NMI)Reset input, nonmaskable interrupt input port.

Share this post


Link to post

To the OP. It would certainly be interesting to see what happens if that RST line is taken to ground during battery insertion ... wonder if it would still remember whose Garmin it belongs to?

 

This is something I do plan to try, but I want to do a few other tests prior to this.

Share this post


Link to post

Well, reset clears no data. It appears that pulling the RST pin low during data transfer just pauses the transfer, which then resumes quickly after going open on the RST.

 

Un-exciting video below.

 

th_3a016c02.jpg

Share this post


Link to post
Well, reset clears no data.

Didn't figure it would, but it's good to know that you can't easily clear one of these things with a simple jumper. No doubt all of the important stuff in NVRAM can't be cleared without appropriate strings from the other end no matter what happens. That's good both from a "robustness" and security standpoint.

Share this post


Link to post

So, in summation and just to be clear and all, all this Übergeek falderall jibberjabber convo means that it's, umm, "cool", right?

Ü I gots me one too. Might hang it on my xmas tree. :anitongue:

Share this post


Link to post

Do you have any JTAG tools to talk to the Boundary Scan port?

Share this post


Link to post
Do you have any JTAG tools to talk to the Boundary Scan port?
Assume you're talking to the OP. I've got JTAG tools, but have nothing in the way of an application for that manufacturer, much less that chip. Looks like it's time to do some searching to see who's distributing locally.

Share this post


Link to post
Do you have any JTAG tools to talk to the Boundary Scan port?
Assume you're talking to the OP. I've got JTAG tools, but have nothing in the way of an application for that manufacturer, much less that chip. Looks like it's time to do some searching to see who's distributing locally.

 

I do have various JTAG tools and apps. I have a Ti Launchpad which may or may not be able to work with the MCU. I just have to find it, or order another, as they are dirt cheap.

Share this post


Link to post

just an idea, but many years ago to knock the lock function off on a sony mars bar phone you covered all the pins with tin foil, this would reset the phone and it was ready to use again minus the lock. would covering all pins do the same on this?

Share this post


Link to post

just an idea, but many years ago to knock the lock function off on a sony mars bar phone you covered all the pins with tin foil, this would reset the phone and it was ready to use again minus the lock. would covering all pins do the same on this?

 

And what about smashing it with a hammer ? :)

Share this post


Link to post

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
Sign in to follow this  
Followers 4

×
×
  • Create New...