Teardown Medical Digital Thermometer
2017-10-10 | By All About Circuits
License: See Original Project
1. The Thermometer
The thermometer can take readings from two places; the ear and the head. Both readings are important when making a medical determination on an individual as they can indicate fevers and infections. Since this device has only one temperature sensor, ear readings require the front attachment to be removed.
The digital thermometer
The ear temperature reading configuration
The head temperature configuration The unit has a small LCD display, two buttons, and a battery compartment on the underside. It is held together with several internal screws which can be found when the batteries are removed. Opening the unit up also requires that the head attachment be removed.
The battery compartment showing the first screw hole
Batteries removed showing the second screw hole
With the screws removed, opening the unit requires a small amount of pressure and leverage as the rest of the casing is held down with reusable plastic tabs (found in many other products). Opening the unit up revealed the main PCB as well as the peripherals that make this product work.
The thermometer opened up
2. The Main PCB
The main PCB is held down with two small screws and removing these revealed more internal parts, the underside of the PCB, and a piezoelectric disc.
The underside of the PCB, the piezo element, and the temperature sensor
The top side of the PCB reveals two tactile switches (for taking ear / head measurements), the main LCD display, a few wire connections, and a 6 pin unpopulated socket. The backlight for the LCD has three wires with different colors (black, red, and green) and interestingly, the PCB has the colors written on the connector pads. This is done to ensure that factory workers solder the wires to the correct pads. The PCB is gold plated which suggests that there is a level of care for the end product as gold plating is an expensive step but significantly improve soldering.
The top side of the main PCB
The display separated into its constituent parts
The 6 pin unpopulated header is most likely a programming interface where the PCB itself is fitted into a programming jig with pogo pins that push into the header pads. When using programmable ICs in a product a manufacturer has two options that they can take. The first option is to contact the IC producer directly and have pre-programmed ICs directly shipped to them. However, this can be expensive and also makes it difficult to update firmware that may contain errors. The second option is to put a blank IC into the final product and flash the firmware in the factory itself but this requires a header and test jig. This, however, exposes the IC to hackers and tinkerers who may find ways to read the firmware and create clone devices (however, pre-programmed devices can also suffer from this).
The suspected programming header
The underside of the PCB contains many surface mount parts including capacitors, resistors, and ICs. The main controller that powers the thermometer is a chip-on-board style which prevents us from knowing what the IC actually is. This method is useful to manufacturer for two reasons; firstly, they can hide the IC part numbers so it becomes more difficult to reverse engineer the product and secondly, chip-on-board ICs are cheaper than packaged ICs.
The PCB underside
The chip-on-board controller
While we don’t know for sure what part lies under the epoxy we can, however, make an educated guess! As it turns out, the header that we saw on the topside is indeed a programming port! But we are even more lucky that this PCB is only a two layer kind which means we can observe the traces and find out what they do.
The programming header underside
This programming port has 6 pins in a straight line which strongly suggests a PIC programming port such as the PICKIT3. If this is a PICKIT3 header then the pads should connect to the following signals:
The PICKIT3 pinout
If we study the header we can see a resistor between pin 1 and pin 2 which is a classic sign of a MCLR resistor. The topside of the PCB shows the tactile switch connecting to one of the pins on the header which is valid in PIC designs as the programming pins are commonly shared with IO ports. The tactile switch is also connected to pin two which would imply that this switch is an active high assuming that this is indeed a PICKIT3 connector. Therefore, the device under the black epoxy will most likely be a PIC18F range which use all three programming lines (PGD, PGC, and PGM).
Next to the main controller is a 24C02A which is a two wire serial EEPROM whose size is 2K organized as 256 bytes of 8 bits. It seems strange that a device that takes temperature readings uses a serial EEPROM but this EEPROM may contain calibration data that correctly applies offsets to the readings to produce a more accurate reading.
The 24C02
The last interesting feature on the underside of the PCB is a through hole component that has been soldered directly to surface mount pads. This suggests that the factory may have struggled to source the surface mount equivalent of the inductor and so went with a through hole version directly soldered to the pads.
The inductor soldered directly to the PCB
3. The Temperature Sensor
The temperature sensor has three wires that connect to the main PCB with two being labeled as TS and TP. The sensor itself sits in a brass tube with a polished metal top that has a small hole for IR radiation to hit the sensor. However, this is a teardown so two pliers quickly saw the module taken apart to reveal the internal parts. It turns out that the sensor is just a PIR like sensor with two of the leads shorted together but the base appears to be made of gold or is at least gold plated.
The temperature sensor
The sensor dismantled
Have questions or comments? Continue the conversation on TechForum, DigiKey's online community and technical resource.
Visit TechForum