Hacking a Scale to Add ZigBee Goodness

My idea is to take this scale

and add ZigBee wireless so that I can automatically capture my weight on my computer without having to remember it.

OK lets backup. Why did I choose the scale above? The first reason I chose this scale is because it has an LED display. I knew this would make the task of hacking much easier because the chances would be good that the display would be 4 - 7 segment displays that I could easily read. The second reason is (after opening the box in the aisle at Target) it looked easy to disassemble, just a couple of screws holding the back on. The third reason, it was cheap, I didn't want to waste a bunch of money on something I could easily break in the process. Finally it needed to have room for the electronics so I found a scale that wasn't glass or super thin. By the way its a Taylor model 9856 if you care.

On to the hacking...

After popping off the back (yes it really was just a couple of screws) I saw the following...


Flipping up the LED I saw this...


It was almost too easy, the chips were clearly marked and the board didn't have much mystery at all except for the black epoxied MCU on the right. But, I didn't need that. I had everything I needed exposed right where I could get at it. I had two options: tap into the EEPROM or read the LEDs. I chose the later. Why? Well, after scoping the EEPROM I couldn't make heads or tails out of what was being sent, on the other hand scoping the HC164 and the four transistors it made complete sense.

Basically here is how it works. Each of the four transistors drives one digit of the LED (actually they enable the LED by switching the cathode or ground side). The HC164 receives the 7 bits that make up the digit along with 1 bit for the decimal point (see Seven Segment Display). So the process goes like this: all four transistors are turned off. The HC164 is loaded with the data for digit 1. The first transistor is then turned on for 3.5ms. It is then turned off and the next digit is shown. Over and over again. Because this is all happening in roughly 20ms per refresh it looks to our eyes that all digits are lit at the same time (persistence of vision).

So how do we know when it has the final weight? The scale I have displays a little night rider effect. "o" in the first spot, followed by "o" in the second, then third, then forth, and repeat for 3 iterations. In the firmware as soon as I see an "o" in any spot I take the last good decimal reading and send that over my ZigBee network.

Here is a shot of my prototype. I'm using an ATmega 328P (same chip used in the Arduino) to read the signals.


Here is the schematic of whats happening...


I wanted to fit everything back into the scale so I didn't have any external components so I needed to design a circuit board that would fit into the very cramped case. This is what I ended up with...


Finally a photo with everything in place...


So where do all these readings go? My computer of course. I have a ZigBee coordinator to USB adapter on my computer. I wrote a simple windows service that listens for the ZigBee traffic and if it receives a new weight it stores it in a MSSQL database. It also handles multiple users by looking at the previous weights of each user and picks the closest match. To display the data I wrote a .NET MVC web site to display pretty graphs and such, but that was trivial compared with the rest.

Schematics, Firmware, Web Site, etc. can be found here