I have a problem. If I go to a swap meet , or even a particularly well stocked yard sale, I feel compelled to buy something. Especially if that something happens to be an oddball piece of electronics. While on the whole I’m a man of few vices, I simply can’t walk away from a good deal; doubly so if it has a bunch of buttons, LEDs, and antennas on it.
Which is exactly how I came into the possession of a Catel CPT300 restaurant paging system for just $20 a few months ago. I do not, as you may have guessed, operate a restaurant. In fact, as many of my meals take the form of military rations eaten in front of my computer, I’m about as far away from a restaurateur as is humanly possible. But I was so enamored with the rows of little plastic pagers neatly lined up in their combination charging dock and base station that I had to have it.
The man selling it swore the system worked perfectly. Even more so after he plugged it in and it didn’t do anything. But appearances can be deceiving, and his assurance that all the pagers needed was a good charge before they’d burst back to life seemed reasonable enough to me. Of course, it hardly mattered. The regular Hackaday reader at this point knows the fate of the CPT300 was to be the same whether or not it worked.
Incidentally, those cute little pagers would not burst back to life with a good charge. They may well have burst into something, but we’ll get to that in a moment. For now, let’s take a look at a gadget that most of us have used at one time or another, but few have had the opportunity to dissect.
But First, a Mystery
There’s not a whole lot to see on the outside of the CPT300 base unit. Sixteen slots in the top for charging the pagers, and a simple membrane keypad on the front that lets you select which unit you want to send a signal to. With nothing else of any great interest on the outside, I went right to removing the heavy metal plate that makes up the base of the unit.
Inside there were several pages of note paper folded up, along with a healthy application of red electrical tape. Presumably the PCB had been shorting out on the base’s metal plate, so somebody went in and added a bit of insulation. The pieces of paper were blank, except for one that had what appeared to be a street address and a phone number written on it.
The address had no city or state, but the area code for the phone number came up as being in Brooklyn, New York. That put us at an apartment building about a block away from the Coney Island Boardwalk. It’s probably safe to assume the CPT300 wasn’t in use there, but if we allow our imagination to wander a bit, maybe whoever lives in the apartment ordered some takeout from the restaurant this device came from. Perhaps the slip of paper with the address and number, as well as a few blank pages behind it, later caught the eye of somebody who was looking for an insulator to fix the intermittent short in their paging system. Of course we’ll never know for sure, but stranger things have happened.
A Barebones Base
With that bout of sleuthing behind me, I got back to taking apart the base of the CPT300. But as it turns out, there was probably more excitement to be had browsing Google Maps for restaurants in Brooklyn. The design and execution of this device could easily pass for a prototype or someone’s personal project, complete with overflowing solder and bodge resistors.
Functionally, the base station is very simple. Under the keypad there’s a STC15F204EA microcontroller that reads the status of the buttons to see which pager the user wants to wake up. Once you press a button, the corresponding binary sequence is sent to the bog-standard 433 MHz transmitter module located on the charging board. A simple four wire ribbon cable links the charging board with the control board in the top half of the case.
This ribbon cable makes a perfect place to attach the logic analyzer to snoop on the communication between these two devices. Using the On-off keying (OOK) decoder in PulseView, we can see the actual binary signal that will ultimately be sent out over the air for the pagers to receive.
After pressing a few buttons and comparing the intercepted binary, it was easy to find the device identifier. Only the final 4 bits ever changed, which gives us exactly 16 possible combinations; precisely how many pagers are supported by each CPT300 base station.
Puffed Up Pagers
With the base station thoroughly examined, it was time to turn my attention to the individual pagers. As mentioned previously, the pagers were all completely unresponsive even after being left to charge, so I was curious about what was keeping them all silent. My first assumption was that the base station simply wasn’t transmitting, but the logic analyzer seemed to indicate that it was. So why weren’t the pagers responding? As soon as I opened the first pager, I had my answer.
If you’ve spent any time working with lithium-ion polymer (LiPo) batteries, you’ll likely see the problem immediately. For those who haven’t, I’ll give you a hint: the battery shouldn’t be puffed up like a silver marshmallow.
We’ve previously talked about the chemistry involved, but the short version is that a mistreated LiPo can experience electrolyte decomposition which fills the pack with flammable gases such as hydrogen and oxygen. So not only are these batteries shot, but they’re dangerous and need to be carefully disposed of. I checked the rest of the pagers, and almost all the batteries are swollen to some degree. Suddenly that $20 seems like it might not have been such a great deal after all.
So what constitutes mistreatment of a LiPo battery? The usual culprits are overcharging or discharging too deeply. Since all of the batteries seem to have been damaged in the same way, that lead me to believe there was some flaw in the pager’s design. My first thought was that the batteries were getting overcharged, so let’s take a close look at the power circuitry and try to find out what’s going on.
Following the yellow traces from left to right, we see that the pager’s positive charging pad is connected to a 78M05 regulator (marked in purple). Rather than put the regulation in the charger itself, it was probably cheaper to put lower-capacity regulators in each pager. So while the voltage on the base station’s charging rails varies significantly depending on how many pagers are currently docked, the 78M05 in the pager makes sure it always has a stable 5 V. From there, it goes into a LTC4054-LTH7 (blue), which is a very common lithium battery charging chip that’s designed to run from 5 V USB. After the LTC4054, the trace connects to the same side of the slide switch that runs directly into the battery connector.
So the charger seems put together well enough, but what happens when the pager is removed from the base station and the battery starts discharging? With the switch slid to the on position, we see from the red traces that power goes directly into a 7333-A regulator (green) that provides 3.3 V for the pager’s electronics. Which means that as long as the switch is on, the regulator and everything it’s powering is connected directly to the battery.
Under normal circumstances, this wouldn’t really be a problem. The electronics probably don’t draw a whole lot of current to begin with, and the pagers would be getting recharged every night anyway. Besides, the internal electronics on a quality LiPo battery pack should cut-out when the cells approach their design minimum voltage, usually around 3 V.
But when I tested a few of the packs, some had dropped all the way to 1.7 V. It could have been months, or even years, since anyone had tried to charge these batteries. Combine that with poor storage conditions (such as keeping them in a hot garage or attic), and you’ve got a recipe for irreparable damage.
Can You Hear Me Now?
So what else is inside one of these pagers other than a small explosive device? Not a whole lot. Half the board is entirely empty; it’s clear that these devices were made this size for user convenience rather than necessity. Each pager has a buzzer, array of LEDs, and a small pager motor at its disposal for notifications, and documentation from the Catel site says that you can configure which one it will use with a series of button presses.
There’s a 16 pin device which is clearly a microcontroller of some sort, but unfortunately it’s completely devoid of any markings. There’s an unpopulated four pin header right next to it though, so perhaps something interesting could be gleaned that way. Incidentally, the documentation says you can pair the pagers by holding a small button on the front until the LEDs begin to flash, so they don’t need to be physically reprogrammed if you wanted to switch their numbers around.
To pick up the signal from the base station, the pagers use a Micrel MICRF211 receiver operating at 433.92 MHz. One interesting thing to note is the rather jaunty position of the external 13.52127 MHz crystal. As best I can tell, it’s mounted this way because they realized it was positioned so close to the MICRRF211 and associated passives that they might short out against the can. Rather than redo the board, they just tipped the crystal over a bit. I checked the other pagers, and yes, they’re all like this.
Lessons Learned
I’ve ordered a handful of batteries for the pagers, and once installed, I’m fairly confident they’ll come back to life. When everything is working again, I think that the CPT300 would be an interesting subject for some further exploration. Specifically, I’d like to use it as a case study for working with unknown 433 MHz devices. For example, comparing what a logic analyzer on the board sees to an over the air capture from a Software Defined Radio. Most of my teardowns end up as a pile of spare parts but I think there’s still some life left in this one, so keep any eye out for its return.
More importantly, this teardown is a reminder that you need to be careful when picking up old devices that use internal lithium batteries. Putting these pagers back on charge without checking the health of the battery packs was a mistake, and could have started a fire if one of them ruptured. So if you’re looking at an interesting gadget that doesn’t have an easily accessible battery, assume it’s shot until you’re able to get inside it and verify its safe to use. A $20 swap meet find isn’t worth losing your house over.
>I have a problem. […]
EGA? (electronic gadget addiction)
(To understand this joke you need to know the eevblog-forum and the TEA-thread there…)
Where did you order new batteries? I’m not confident into those random Aliexpress-batteries and i’m not sure if customs of my country would appreciate… But of course i want my batteries cheap…
Oh, the new batteries are definitely random AliExpress. I don’t expect them to be any better than the original cells, but I just need a couple of pagers to work for a bit while I experiment with them. I connected the bench power supply to the battery leads on one of them and confirmed it worked, but thought that would be a bit awkward for long term use.
Am I correct in assuming the battery bay holds batteries twice as tall as the ones it shipped with? Will the cheap Ipod/mp4 player batteries fit in there?
It is exactly double, yes. The battery is 20 x 30mm, and the battery bay is 40 x 30mm. You could absolutely put a larger cell in there, I just ordered the same type since they were cheap enough and I didn’t think the added capacity would have any benefit for what I planned on doing with them.
Another comment here mentions adding additional hardware to the pagers and potentially reusing them for something more interesting though, so in that case a larger battery would be useful.
The reason the crystal is lifted from the board, is that in some cases, the solder can wick up the through hole during soldering, and short the crystal terminals to its metal case.
years ago, I had a customer that kept on having this issue, so we decided to use not plated holes for these crystals, and the problem vanished. Interestingly, it was only this customer to have this problem.
That seems…weird. I couldn’t possibly count how many crystals I’ve seen in devices over the years, and I’ve ever seen one tipped over to the side like this.
I’m not doubting your story, just wondering why this issue only pops up rarely.
You can see in the picture the reason that the crystal is tipped on this particular design. The manufacturer skimped on their PCB and didn’t tent the vias. There is exposed metal for a trace sitting underneath the metal can of the crystal. Soldering it flat runs the high risk of shorting. The correct ways to do this would be to have the visas covered in soldermask (tented) or move the via out from under the metal packaging of the crystal. Hopefully the manufacturer fixed this on s later revision so assembly could be automated on this part.
That also was my impression. Although tenting the vias traps air in them and properly plugging or covering them properly adds extra cost. The best solution in this case would have been to avoid the vias below the metal can. Solder mask also does not always count as proper insultaion anyway.
I already have seen insulating washers under metal-can crystals, but of course tilting them is cheaper.
On the controllers we produce, the crystals are always lying on their side with a tinned copper wire strap over the top soldered to the case.
The receivers are bigger than necessary so that customers don’t stick them in a pocket and walk off with them. I’ve had ones handed to me in restaurants that were the size of the cardboard tube in a roll of paper towels.
Oh, and NEVER take a dealer’s word for the health of a device. A friend bought an antique fan from a guy who swore it worked. I plugged it in and ZAP! short circuit. Fortunately I was able to rewire the thing and clean the spider nests and dead sow bugs out of its guts, and it’s a beautiful and functional piece today.
Why would they leave with them? Aren’t they waiting on a table?
Free crystals, albeit jaunty.
I wish there was an “upvote” button, just for this comment. =)
Absent mindedness I’ve done it once or twice. You get tired of waiting azad and decide to go somewhere else but forget your holding it. Usually holding something else like jacket. Hate having to walk back….
At a restaurant where I am often, the people waiting at the table are served by a waiter. Only the people who walk out to the riverside get the pagers. Which are about the size of a small mobile phone (not smartphone). So you can put them conveniently in your pocket. Which is no problem: When you fetch your food, which you have to pay in advance, you give the pager back.
Sometimes, people get tired of waiting.
Indeed.
Some restaurant pagers transmit a watchdog signal from the base station. If a receiver goes out of range, it fully flips out, with lights and vibration motor and all. They’re hard to forget.
We’re still missing the best part – a method to transmit the secret launch code to trigger all of these at once in a crowded “trendy” suburban Friday night watering hole. Oh, the mayhem…
1. sniff the base code via sdr in your favorite (or most hated?) restaurant.
2. Use SDR to broadcast said code, with the 16 different end sequences
3. ???
4. PROFIT.
(Sorry, I had to).
Oona did this a few years ago. Check out http://www.windytan.com for her dissection of the radio protocol these things use.
Doesn’t seem like it? There’s just a post about how she found some restaurant pagers that used POCSAG, which this one doesn’t appear to.
Maybe it’s documented somewhere else?
Ummm, oxygen is not flammable.
No it just makes everything else more likely to catch fire! Check out the video on youtube of the dude that took the valve off a filled O2 cylinder!
Tell that to the Apollo 1 crew…
Yes, pure oxygen by itself doesn’t burn. But it’s makes everything else burn. So for example when it’s combined with hydrogen gas inside that cell, you’ve got the makings of a torch.
This picky distinction ain’t worth much to somebody caught in an oxygen-enhanced fire.
But anyway, speaking of the whole safety side–I mean these swollen LiPo batteries are inside of basically all of our old consumer electronics. They aren’t THAT big of a risk, otherwise all our houses would be burned down. I dunno if the author’s paranoia is really warranted. I challenge anyone to find a non-Amish house without a single old, disused, mostly-discharged, puffed-up LiPo hidden somewhere inside. You’ll be fine–just don’t go stabbing it or shorting it.
On this note…what is the correct/safe/environmentally friendly/etc. way to dispose of old LiPo batteries? I’m pretty sure “chuck them in the landfill” isn’t right, so what DO you do with them?
It’s nice to see an actual lengthy article here and not just a stub pointing to a hackaday.io project and/or a yt video.
Thanks for the content. Let’s see how and when you put those babies to good use.
BTW, we put out two long-form original pieces per day, and you can always find them in the “If You Missed It” and “Our Columns” bars on the right.
The designer forgot 2 items : 1) Crystal HC49U/ should not have a vias under it ( I personally would buy the Surface mount HC49US and bend the pins down to make it thru-hole they come with plastic base insert to protect what is under ) 2) the li-po battery he purchased should have Over voltage / Under voltage IC built inside it along with NTC , or install it separately on the board DW01A+FS8205 mosfets pair for example this completely disconnect the battery pack from the system until conditions are restored , otherwise nice design
Yes, in that application a protected cell would be good. But it does not work wonders: The cell runs down, the protection switches off and the devices are in storage for another long year. -> damage
But why on earth would I want to buy a nice SMD part and then bother with bending the pins? The design is mostly SMD. I am sure the only reason to use the HC49U is that it was cheaper at that time. You also get insulating washers for the HC49U.
I see some gaming or LARP potential in this device. Setup a maze in a large building. Players have to search for objects in the maze and return them to base.
Some of the pagers are the objects. The other pagers are carried by the players. The players must retrieve their objects before the object timer or their timer runs out and the alarm goes off. Players can re-arm their timers by returning to base, with or without an object. Any player carrying an object whose timer runs out is out of the game. If a player’s timer runs out, rhey’re out of the game.
Some additional electronics would need to be added to the base station to uniquely identify the pagers upon insertion into the base. Triggering the pagers would need a Pi, Arduino etc interfaced in place of the keypad on the base station.
Plenty of room inside the pagers for additional stuff to ID them to the control system, add lights, a vibrator motor if they don’t have one. Perhaps have an early warning before the timer runs out.
With 16 pagers there could be variable numbers of players VS objects. Could do a capture the flag game. Add this to laser tag or paintball.
I have (unfortunately) been tasked (by oldest son) to repair one of these for a restaurateur buddy of his. Everything “seems” to be ok, but zip for working. What should system power supply be? Found identical systems that say either 5v, 6A or 12v, 2A. I would think the 12v would fry something, but the 5v is a squeck by.
The adapter I have is 12V @ 1A, though it’s clearly not the original one for this device (it says Netgear on it…).
But having a close look at the internals and seeing everything is regulated, it’s really not that critical. Anything between 5 and 12 volts should work fine.
I appreciate that. Since posting I found a system that says 7.5v/2A. That seems about mid-range. Where did you get batteries? They are all too dead.They are the rectangular one. 3.7v.
thanks for this article
it’s very usefull .
Did you find out how to trigger them with an SDR? We are a Point-of-sale maker (startup) and we want to trigger these from our POS directly. They sell transmitters (CTB205), but we end up with different transmitters for coaster pagers and wrist pagers (for staff). They don’t sell one that can do both. If we can combine them into one transmitter, it would save us a lot of hassle. We will do this with their permission, of course. We are partners, but we order too few at the moment for them to justify custom hardware. Thanks for the article. Raihan.
design of this pager is so useful for me