Teardown: Bosch DS835 TriTech PIR/Microwave Motion Detector

One of the things I bought home from the recent Wyong Field Day was a Bosch DS835 TriTech motion detector. While the box was beat-up, the unit inside looked clean and the seller wanted just $5 for it, so I decided to give it a new home.

The Unit

The box itself is quite scuffed, but there’s no mistake – this is a Bosch Security Systems DS835 TriTech PIR/Microwave Motion Detector. From the date code of 886, it appears to be made in June 2008 in China.

Inside, there is a copy of the installation instructions and the detector itself. The front face has the PIR window, an LED window and a blank spot where a logo badge would normally sit. Part of the reason I purchased this detector aside from the TriTech name was because a very similar model is installed in our own house.

This is where the DS835 model name comes in – that area for the badge is actually occupied by a logo for Detection Systems on our older sensors. The Detection Systems company was purchased by Bosch in 2000, but the sensor still retains its “DS”-model designator as it is reputable.

A label at the top illustrates FCC compliance …

… the underside has a little gap for a look-down zone, and a clip latch release hole to open the detector.

The rear of the detector unit has not been breached, but has a number of areas for cables to enter/exit the unit. The unit also has bevelled edges for mounting in the corner of two walls. From this, I can only assume the detector was never installed.


To open the unit, it’s a simple matter of using a flat bladed screwdriver to release the latch and flip the unit open. The front cover shows a light-pipe for the LED indication and the PIR lens with many different segments. The lens itself can be masked from the inside, but isn’t adjustable otherwise.

Looking at the other side, it’s clear why – the top left corner has a black screw with a slot – to adjust the look-down angle, the whole PCB is slid up or down in the casing. Judging by the foam that is still inside, normally used to plug up the cable entry hole, it’s probably a brand-new sensor. We can see a limited amount of jumper-based configurability – sensitivity normal or intermediate and LED on/off. Microwave range is adjusted by a potentiometer.

There is the pyroelectric sensor which is responsible for the PIR segment, a microswitch that senses tampering with the case and the antenna for the microwave (~10GHz) radar. I suppose that could be where “TriTech” comes from – or maybe from the intelligent filtering algorithm that reduces false detections. A bi-colour LED provides feedback about which mode detected motion and whether it was tripped, with a self-test supervisory feature that reports with a blinking LED in case of microwave malfunction. Output is via a relay that is normally closed. The angled terminal blocks include some spare connections as well – but the tamper circuit and relay outputs are separate, with 12V (nominal) input on the left-most side.

Removing the whole PCB shows the rear is covered by a black plastic cover. This makes sense as vermin could cause inadvertent short circuiting between points on the PCB. There is a loop at the top, which I suspect is to hold the cable as it loops over to the terminal block.

It is possible to remove the remainder of the screws to remove the black plastic cover, but I wouldn’t suggest doing that …

It can be seen that the microwave radar section actually has a lot of similarities to a Ku satellite LNB – this is a classic dielectric resonator oscillator as evidenced by the brown “slug” of ceramic next to an microwave transistor.

Correspondingly, on the rear cover, we can see the screw that impinges onto this area to tune the frequency, as in an LNB to tune the local oscillator. Another interesting finding was the unit being powered by a PIC16C711 8-bit microcontroller, which has just 1K EPROM and 68 bytes of RAM, but other than that, there’s not much else to see aside from the LM324 quad op-amp.


While I knew what to expect from the insides of a regular PIR sensor, opening a multi-technology microwave radar-based sensor was interesting. I didn’t expect the paths of satellite LNBs to cross with motion detectors – it seems they use fundamentally similar dielectric resonator oscillator technology to create their ~10GHz oscillations which depends on high speed transistors and very precisely shaped PCB traces. The screw in the rear cover would be used to tune the oscillation frequency so that it would be at a regulatory-legal frequency.

It was also surprising to note that the PIR with all its touted intelligent filtering of false triggering runs on a Microchip PIC16C711 8-bit microcontroller, with the whole sensor consuming just tens of milliamps.

Posted in Electronics | Tagged , , | Leave a comment

Project: HX3208 (CD9088-based) SMD “Micro” FM Radio Kit

The kit drawer is like the bottomless-pit of entertainment, except that it does have a bottom and I’m slowly reaching it. You can tell because these are the kits that I’ve left behind for a later day – perhaps out of fear that I would stuff it up.

This post looks at the HX3208 (CD9088-based) SMD “micro” FM radio kit which I purchased for AU$3.22 including postage a while back. Of course, I’m not new to CD9088-based radios – I’ve already built one, but that one was not as small as this one. The allure of small size leads to a new challenge – that of numerous SMD components to handle.

The Kit

This kit comes in a stapled plastic bag …

… and like a bad case of recursion, there is another stapled plastic bag within. Already, we can see the pair of rather painfully cheap earbuds and a slightly mottled grey enclosure which looks like it could have been made of recycled plastic. At that price, I’m not complaining …

The dimensions of the case don’t seem perfectly right – the batteries seem somehow offset from the side of the casing – but having a case is better than just having a bare board.

The full bag of components include the above, which is a copious number of SMD components on tape. Extra care is necessary to make sure they don’t fling across the room, especially because the capacitors are unmarked on the package – only on the rear of the tape.

The PCB is marked HX150523 134777 on the top, where there is silkscreening. It’s a fibreglass single-sided PCB with silkscreening on both sides.

The underside is hot-air solder levelled tin finish with green solder-mask but the design of the board leaves some to be desired – where adjacent SMD pads connect, they are not separated by solder resist which makes it hard to achieve a neat finish.

But the biggest issue by far is a lack of instructions combined with a lack of markings as to values on the silkscreening. As a result, I ended up relying on the schematics from this page to get it built – with some minor discrepancies worked out by a process of elimination.


Because this kit uses SMD parts, it makes sense to mount the SMD parts first. I decided to tin the pads of the target components, line them up and then use a hot-air gun to reflow the solder. This resulted in a number of instances of excessive solder resulting in blobby looking joints. It’s important to be patient and do components one value at a time, to avoid confusing the similar-looking capacitors. The lack of solder-mask between adjacent pads resulted in some rather strange looking solder joints too.

By the time I was done with the SMD resistors and capacitors, I had mildly overheated the area near R4 with the hot air gun causing the traces to slightly lift. As a result, I mounted the IC and transistors with a fine iron instead, again applying a little too much solder.

At this stage, only the through-hole components remain – including the jumpers made from component legs as indicated on the top-side.

While most components need to be mounted as close to the board as possible to ensure adequate clearance, the exception is the LED which should stand proud of the board slightly so that it can meet the hole in the front side of the casing. Once the board is fully assembled and the wires to the battery terminals (which can be shortened) are made, then it’s time to look at installing into the case.

That being said, it is important just to double-check L1 as the fine enamelled wire doesn’t want to make good connection with the solder until the enamel is properly burned off.

Start by populating the button holes with the supplied buttons, then install the board into the bottom of the case where one screw is used to secure it to the bottom case. This is the origin of the “extra” screw noted in the page linked to earlier – there are no spares in this kit.

Then the knob base can be installed with the smaller screw securing it to the combination trimpot. Then, affix the knob cover, taking alignment into account.

Install the terminals into the approrpiate slots in the case, then tuck the wires carefully under the board in free spaces before bringing the halves together and screwing together with the two remaining screws.

The unit should look as above – neatly closed up with freely-spinning knob, freely actuating buttons and an LED visible through the hole.


Install two AAA batteries in the correct orientation, connect the earbuds, rotate the volume knob clockwise and hit the reset button followed by scan.

If all goes well, then you should be hearing some local FM stations – albeit in very poor quality due to the lacking earbuds.


The HX3208 (CD9088-based) SMD “micro” FM radio kit is one I approached with a sense of trepidation. While it is rather inexpensive, it poses a significant challenge to the unaccustomed – significant amounts of SMD soldering with components that are tiny and look visually similar. As a result, it’s good practice for those who want to do some homebrew SMD, but probably not a great experience for the beginner as there are no spares – you better not make any mistakes. As a result, it pays to go slow and do one value at a time. The lack of instructions included, slightly flimsy poorly-fitting case and slight inconsistencies between schematics and silkscreening were also downsides. The price is cheap enough as to be good entertainment, although in some places you could probably buy a fully-assembled auto-scan radio for the same price if that’s what you wanted.

Posted in Electronics | Tagged , , , , | Leave a comment

After the Beep: DSE F-8011 & ion by Telstra Digital Answering Machines

The humble voice call by telephone has been with us for many years, but with the popularity of land-lines fading, it seems that the traditional voice call may be headed towards obscurity. As a synchronous communication, it requires both caller and callee to be present at the same time to deliver the message with (normally) no record of the call unless one is intentionally made. If the callee is unavailable, their telephone would “ring out” and you’d have to call again.

One solution to this is the answering machine, with earlier machines using tape-based recording such as an endless loop compact cassette for outgoing messages and a regular compact cassette for incoming messages. Later, more compact units used just a single microcassette, spooling rapidly between the outgoing message and end-of-received-messages to achieve the same function. Finally, as processing power increased and memory prices decreased, solid-state answering machines using DRAM (and later, EEPROM/Flash) became available, although by now, the market was starting to wane.

The reason for this was that carriers started to offer their own answering machine “in the cloud network”. One such product was Telstra Messagebank, but more generically, it’s now known as voicemail. This allows extra benefits such as being able to take messages when the line is engaged or out of service, with greater capacity, quality, random-access and remote retrieval capabilities. On land-lines, this was offered as an added-cost extra, whereas on mobile phones, it is commonly included in the package as they will sometimes be switched off or out of coverage.

Of course, if you didn’t want to pay the extra and you didn’t want to miss a call, you’d have your own answering machine. I remember fondly, back in the days of my youth preparing to leave the house – one crucial step was to turn on the answering machine so we wouldn’t miss any calls.

Dick Smith Electronics F-8011

This particular unit appears to be a relatively late model DSE (Dick Smith Electronics) solid-state telephone answering machine, model F-8011. This unit was donated to me by a reader of the blog – you might be wondering why I’d even want an answering machine, let alone a DSE product. I guess I was just curious about what is inside and how it sounded – as my recollections of early solid-state answering machines were quite negative both in terms of recording time and of their audio quality. I also wanted to feature something which (perhaps) not many other people would – there’s a lot of “really vintage” telephone collectors, but is there anyone taking care of the “semi-modern” telephone stuff?

Anyway, it seems that the unit has become rather yellowed over the years, as is common with beige plastics. This particular unit is a very basic answering machine with and no handset attached. It is Made in China (like we couldn’t tell already) with a REN of 0.5.

The unit needs a 9V DC 300mA supply (none included, but a lab supply always does the trick). The cable is permanently fixed, with a phone jack looping out for a handset which can be connected in-line.

Along the side are mode switches to change the announcing mode, the rings before answer and the volume of the internal speaker.

There is a screw-secured battery flap in the rear where four AAA batteries need to be installed to provide memory back-up. As the audio is likely stored in DRAM, a loss of power would erase all memory and also cause the unit to lose the date and time.


Ever curious as to what is inside the rather light-weight unit, I decided to tear it apart right away. Four screws are removed from the base and the shells come apart with a very stiff ribbon attaching the top cover boards to the base. The ribbon is supported by some hot glue. On the single-sided paper-type PCB, we can see that this rather late model unit doesn’t even have any line relays – using an all silicon interface which is fairly impressive.

There are a few capacitors and chips, along with the switches and potentiometers at the edge. But already, there is a resistor in insulation tube – already the PCB looks a bit like a mess owing to the wires sprouting from underneath and on top of the PCB.

On this board, we can see a Zilog SL1925 One-Time Programmable Micro-Controller with 14 I/O lines. The chip has a rather diminutive 512 bytes of OTP memory and 61 bytes of RAM, running at 8MHz. To see something from the company behind the infamous Z80 CPU was a bit of a surprise.

A look on the underside of the paper PCB shows the wires tacked on the rear, along with some ceramic disc capacitors. The PCB is marked EPB768V0 REV1 – somehow it looks like they might need a couple more revisions to iron the issues out.

The top-side assembly has the mic and speaker, along with the button-boards. There is even a label which dates this to 21 September 2001 – ten days after the World Trade Centre attack in the USA. That being said, underneath the metallised cardboard, there are more delicious chips to behold.

I guess the rumours are true – I’ve heard that digital answering machines often used old surplus/recycled DRAM, sometimes those with minor bit errors to store the audio. This seems to be no exception, as a Fairchild 4MBit 70ns DRAM chip is seen, of the kind you might find on a 30-pin SIMM. As it is dated Week 4 of 1995, it is much older than the remainder of the system. It is paired with a Macronix MX93011 DSP for Digital Answering Machines chip. Further bodging can be seen in the above with the wires being an absolute mess.

It seems rather interesting that the sum total of the voice storage for outgoing and incoming messages fits within 512kiB. As a result, some compression is likely to be required – using 8kHz 16-bit 1-channel PCM, we would only be able to store 32.768 seconds of audio. If we dropped this down to 8kHz 4-bit ADPCM, we would have four times more but that is still only 131.072 seconds or just a hair over two minutes. Even with something like Intel IMA 2-bit ADPCM, we would get 262.144s or about 4.36 minutes. It seems likely there is something potentially even more sophisticated to achieve the necessary recording time – many systems were sold with 15-minutes of capacity.

The other side shows a single 7-segment LED display used to provide the message count with two LEDs for status, the remainder of the buttons and a Macronix MX93000KC Special Codec. There’s a green jumper wire here too …

In Action

At first, I grabbed a regular linear DC power supply to run the unit off, but it hums terribly, so I suspect the capacitors may not be in great shape. Instead, I attached it to a DC lab power supply, which made for less hum in the audio. Attached to my Cisco SPA112 ATA to my Raspbx for testing, the unit had very noisy audio recording for incoming messages, with a limit of one minute per incoming message and silence detection to automatically abort recording and hang-up. I tried toggling the answering mode switch but was not able to get OGM-only operation. I was not able to get the remote access to work – I did get a few “blips” but nothing I entered seemed to do much. I was able to record the audio of the system’s voice prompts using my latest telecoil receiver which picks up the magnetic fields at the speaker.

Here are some audio samples:

ion by Telstra

This particular unit was one we owned, however, I don’t recall ever using it much. Initially, I found DECT to be inferior, so we maintained the use of the “easy to eavesdrop” 30/40Mhz cordless system for a long longer than we should have. Regardless, I don’t recall how we came across the phone – perhaps there was a sale/promotion/bundle on it, as I don’t think we would have gone out of our way to buy a Telstra branded product …

Regardless, on the box, we can already see it is a relatively “stylish” retractable handset design with a minimalist base. The unit has a trendy negative-LCD (not that I think it really improves anything) and an interface that is flanked by soft-buttons much akin to how the Nokia feature-phones operated. The unit had compatibility with the Telstra Network Features, Caller ID, Message Waiting Indication, SMS, an integrated answering machine, phone book including SIM card import and hands-free capability.

I have no idea what the unit cost, but it doesn’t seem pedestrian just from the looks of it. While the manuals and other inclusions are long lost, the unit is still intact.

The unit is mostly an off-white colour, with a fairly unassuming base with two LEDs, one button and a ringer speaker, using a modified telephone jack for power.

The base is branded just “ion” along the front.

The party trick? A SIM tray on the side where a mini-SIM can be inserted for the contact import feature. The box claims this does not work for 3G SIMs, although I didn’t try it.

Another party trick is the ability for the handset to slide open to reveal the keypad.

The unit physically gets longer when this is done, with a satisfying click. It’s not quite “flip”, but it’s also a good physical tactile action that answers and hangs-up any calls.

The rear of the unit has a cut-out for the ringer speaker, with both sides featuring the Telstra logo and the earpiece featuring the tag-line of “Digital Clarity”.

The more I explore the unit, the more I like it. It seems to be rather sensible in its design. Remember the frustration of custom types of cordless phone batteries and wishing someone would just make a phone you could chuck normal batteries in? Well this is one of them! Two rechargeable AAAs are all it needs – no profiteering from spare parts here!

The power adapter is a little strange with two 6.5V DC secondaries, rated with slightly different currents.


Undoing the four screws hidden in the base, we find one PCB that is the brains of the entire operation. Littered with test points on the bottom, there are pads for an I2C/I2S connection on the front edge … rather curious.

The other side of the PCB houses the majority of the components. Again, there is no line relay, with an all silicon interface to the phone line. There is a PCB module with a shielding can over it, which is the DECT radio module. I suspect the modular approach makes switching US/EU DECT bands a matter of soldering a different module, and eases approval requirements.

The biggest chip on the board with a label of DECT68-DAMEPILL-ENGVP seems to be a Philips ARM SoC of sorts, marked SunC. Next to it appears to be some EEPROM and Flash for storing the data on the ion – no data loss when power is removed, but endurance could be a concern.

Underneath the can is a “gob top” next to what appears to be a Philips radio front-end chip of sorts. The PCB has two wire antennas in orthogonal polarisations for reception diversity.

The SIM slot and the charging pins plug into the PCB – the use of plugs makes it easy to disassemble.

The handset was much more difficult to disassemble – it’s tightly packed and I really didn’t want to break it. However, the flex gave me a good hint – Mango DECT61.

It turns out the ion by Telstra is actually the BT Mango in new clothing. I would have never guessed!

From what I could see, it seems it uses the same sort of DECT module with a single antenna at the top. Potentially the same SoC is under that copper tape – but I didn’t peel it back to check as I didn’t want to damage the unit.


The unit appears to date from about 2006, so reviving this one was as simple as plugging it in and putting batteries into the handset. The unit has a very pleasant English accent to all the prompts – no surprises given the British Telecom heritage. The display was still clear, although occasional graphical corruption did occur. Voice quality seemed rather average, as DECT uses compression which affects voice quality. Because of the similarity with menu-driven feature-phones, it was very intuitive to get along with and voice prompts were pretty much unnecessary.

However, the most interesting thing I thought I should try was the SMS feature:

The first screen shows what happens when the phone is idle. The second is the menu for the phonebook. The third illustrates the main menu – selecting TXT, I can then select to write a message, then send it. By default, the SMS service centre is 01983391 – this didn’t seem right to me as for our dialplans, we expect 10 digits for (01) 9833 91xx. I suspected two digits were missing.

I reprogrammed the SMS service centre to an internal Raspbx extension 108 – but when sending a message, I got no call. Examining the logs, the unit placed a call to 10800, so thus the ion has an implied 00 at the end! Calling 01 9833 9100 results in a number disconnected error – perhaps not available from my carrier, so I wonder if Telstra’s SMS service centre supports the ion anymore?

Regardless, I tried answering the call with a Rockwell-based modem using every combination of AT+MS (modulation select) command I could muster but the unit did not link. Instead, it always responds with a burst of FSK after a time-out and hangs up – sounding like this. It sounds like 1200bps FSK, perhaps a variant of caller-ID FSK for this specific purpose.

The unit also has a lot of interesting handset ring-tones which hail from the polyphonic generation – in order, the melodies are labelled odeon, whimsical, jaunty, pizazz, vibe, march, madcap, melody 1, melody 2, melody 3, melody 4, melody 5, chime 1, chime 2 and jazz. The base ring-tones are a much less inspiring selection of five very “square” monophonic ringing patterns.

Audio samples of the answering system are as follows:


Unfortunately, the mechanical tape variety of answering machine is not something I have anymore as the mechanisms have failed or they have been carelessly disposed of many years ago. Despite this, it was interesting to revive the answering machine and DECT system for a quick test and tear them apart to see their insides just to see what made later-model answering machines work. It was also nice to hear them again – along with the default outgoing messages and clunky voice menu systems.

The ion by Telstra was especially interesting, as a very “late” model device, it even had the ability to send and receive SMS on landlines – a feature I didn’t even know existed for residential users. I had a chance to poke about to see how it worked, but the exact details are still not known, although it seems to emit a short burst of FSK before giving up. It also has much more extensive voice prompts and non-volatile memory.

Just like many things associated with the telephone, it seems the traditional voice call is starting to fade away. Aside from this inconvenience of needing to be available at the same time, it also inducing anxiety amongst callees and is rapidly being overtaken by mobile phones with HD Voice, VoIP systems which offer higher quality and video capabilities; or asynchronous communications such as instant messaging, e-mail and SMS which offer a record of communications and time to produce a considered reply (if one is necessary) despite being somewhat less personal. Even the concept of voicemail is considered outdated, as the time taken to review them is considered unproductive and excessive.

Posted in Audio, Electronics, Salvage, Telecommunications | Tagged , , , , , | Leave a comment