Reverse engineering an automatic air freshener spray machine

There are lots of commercial electronic products available in the market with simple to intermediate to complex and more complex circuit designs. Now to clarify how they works we have to study the circuit and try to apply our existing knowledge to figure it out, this is generally known as reverse engineering also known as hardware hacking. Practically reverse engineering is a way to progress further and to explore different short techniques which can be very fruitful in our future designs.

In this hack, I tried reverse engineering an automatic air freshener spray machine picked up from the junk. The machine works on two AA batteries i.e on 3 volts. It was not working at first, I unscrewed it and found the the battery connector leads got rusty, cleaned it up but still no response.

It got a motor gear attachment to increase the torque to press the nozzle of the air freshener can, there are two LEDs and two buttons one is for ON and OFF another is to set the timer which are 9 mins, 18 mins and 36 mins. I took out the circuit and cleaned it with thinner then found that the main problem is in the power input of the PCB, two pads got uprooted causing a discontinuous path to the main circuit so I fixed it and then it respond.

So, the main function of this instruments is to spray the air freshener in the selected time intervals. The green LED blinks in each second 540 times in case of 9 mins interval then the motor is ON for 2 seconds providing enough torque to push the nozzle down and stops then the backward force applied by the nozzle pushes the gear back to the initial position, when the motor is on the red LED turns on. So using my multimeter and oscilloscope I went for a deeper understanding of the behavior of the IC as the manufacturer scratched out the name and part number of the IC. After observing the circuit for half an hour, I made a schematic and as per my assumption it is a 8 pin microcontroller running on 3 volts.

Most of my assumptions matched when I probed the circuit to my oscilloscope. The pin configurations are –

  • Pin 1. Vcc i.e it is connected to +3 volts.
  • Pin 2. This pin is unused in this circuit.
  • Pin 3. Its connected to the base of a NPN transistor having a 100 Ω current limiting resistor in series.
  • Pin 4. It is connected to the delay selection switch and pulled down to ground with a 100 KΩ resistor which provides the delay of 36 mins.
  • Pin 5. It is connected to the 18 mins delay.
  • Pin 6. The green LED is connected in this pin.
  • Pin 7. It is connected to the 9 mins delay.
  • Pin 8. It is the ground pin of the microcontroller.

Observations made :

  1. I probed Pin.3 of the circuit and switched it on and got a pulse which is 2 seconds high that means at starting the motor turns on for 2 seconds.
  2. The delay selector switch pulls the corresponding pins high.
  3.  Pin.6 is programmed like a decade counter the connected green LED blinks in the interval of 1 second in that interval the pin goes low(ground), the current passes through the green LED to ground turning the LED on for one second. And after 1 second it shifts one bit like a decade counter. It covers 12 shifts 9 times for 1 minute. According to my assumption, a counter counts the 12 shifts x 9 and increases its count value correspondingly. Another counter is set to count the minutes, whenever the second counter hits 9 mins. Pin.3 again sends a 2 second high pulse to the motor.

  • The NPN transistor is working as a switch and it delivers the sufficient current needed to drive the motor. A diode is connected in reverse bias in parallel with the motor to protect the transistor from the current peaks formed due to electro magnetic energy stored in the motor coil.
  • The 10uF electrolytic capacitor is connected in parallel with the ON/OFF button to filter the noise due to button debouncing and 0.01uF ceramic disc capacitors filters the noise of the power supply.
Written by : Subhadeep Biswas

Analog temperature detector using uA741 OPAMP

What is an “OPAMP”?

Fig1 (b)

An operational amplifier (or an op-amp) is an integrated circuit (IC) that operates as a voltage amplifier. An op-amp has a differential input. That is, it has two inputs of opposite polarity. An op-amp has a single output and a very high gain, which means that the output signal is much higher than input signal.


Vout = AOL[(V+) – (V-)],

Where AOL = Open loop gain of opamp



Ideal characteristics of a OPAMP:
1. Opamp has high input impedance & low output impedance.
2. Zero common mode gain or infinite common mode rejection.
3. Infinite open loop gain AOL.
4. Infinite bandwidth.

** opamp is used as differentiator, integrator, comparator, current – voltage converter, voltage- current converter, etc.

Parts List for the circuit :

1. IC LM35, Opamp (LM741)
2. Resistance- 10K, 470 ohms(2), 2K pot.
3. LED (red, green)
4. Wires
5. Bread board
6. Digital Multimeter
7. 12 v Battery


Circuit Diagram of the project & -Vcc should be grounded

Theory: This project uses IC LM35 as a sensor for detecting accurate centigrade temperature. Linearity defines how well over a range of temperature a sensor’s output consistently changes. Unlike thermistor, linearity of a precision IC Sensors are very good of 0.5°C accuracy and has wide temperature range. It’s output voltage is linearly proportional to the Celsius (Centigrade) temperature.

The LM35 is rated to operate over a -55° to +150°C temperature range. It draws only 60 µA from its supply, it has very low self-heating, less than 0.1 °C in still air. LM35 Operates from 4 to 30 volts. Output of IC is 10mv/degree centigrade. For example if the output of sensor is 280 mV then temperature is 28 °C. So by using a Digital multimeter we can easily calculate the degree temperature. For trigger point you should set the voltage of pin 2 of IC 741 by using preset or potentiometer. Our aim of this project is not to construct a thermometer but to activate or deactivate a device at a particular margin temperature. For simplicity we have used 2 LEDs for indication of both low (Green) and high (Red) temperature.

Working principle: The output of IC2(LM35) increases in proportional to the temperature by 10 mV/°C , this varying voltage is feed to a comparator configuration of IC 741 (OP Amplifier). At first we set sensitivity (set a voltage by varying the 2KΩ pot) at pin no.2 . If we consider that the sensitivity voltage as V1 & The output of LM35 (pin no. 3) as V2, then we can describe easily that what is happening. If voltage V1> V2 ,then the output of the comparator at +Vsaturation , then the green LED is on and the red LED is off. When the temperature increases that the output of LM35 is also increases, after a certain time when voltage V2 cross the voltage V1 then the output of the comparator at –Vsaturation , then the red LED is on and green LED if off. When V1=V2 then the output is 0 and two LED is in off state. We have used IC741 as a non-inverting amplifier. As a comparator the output voltages will be

                                   Vout  = +Vsat   when V1>V2
                                               = -Vsat    when V1<V2
                                               =  0           when V1 = V2 

Bread board setup
Written by : Sourav Tamli 

The Dark Detector

/Basic concept

This blog will go through one of the useful applications of npn transistor & the voltage divider circuit. The npn transistor BC547 is configured to work as a switch.

So from the datasheet of BC547 transistor we can see that the maximum value of Vbe(on) is 0.7 V. That means if the base to emitter voltage is less than 0.7 V, no current will flow through collector to emitter of the transistor and it will remain off. When Vbe will be greater than 0.7 V, current will flow from collector-emitter, switching on the transistor. Now if a load is connected to the collector it will be switched on. Now in this circuit we implemented a voltage divider, the output of the voltage divider is connected to the base of the BC547. The voltage divider is the combination of a resistance and LDR.

/The voltage divider circuit
Voltage Divider Circuit
Voltage Divider Circuit


It is a very useful circuit which is implemented in different applications. The combination of R1 & R2 will affect Vout.Vout = Vin.(R2/R1+R2) so if we want to make 5V to 2.5V, R1 must be equal to R2. Here we take R1 = R2 = 1KΩ, and it gives perfect 2.5V.





/The Dark Detector Circuit
Dark Detector Circuit

Here the output of the voltage divider which is generally a combination of R1 & LDR is connected to the Base of the BC547 & a white LED is connected to the  Collector. The 220Ω resistance limits the current and prevents the LED from getting damaged.

When light falls on the LDR the resistance offered by LDR is very low. Let, R1 = 220 KΩ & R(LDR) = 4.6 KΩ. If Vin is 9V then voltage on the Base of BC547 = 0.184 V which is less than 0.7V so the BC547 is now off and the LED will not glow. Now when it is dark the resistance offered by LDR is very high in order of MegaΩ. Suppose practically R(LDR) = 150KΩ so Base voltage of the BC547 is 3.648V which is greater than 0.7V. Now current will flow from C-E of the BC547 & the LED will glow.

There are different sizes of LDR available in the market. Sometimes small LDRs don’t work properly in the circuit, so to increase the sensitivity connect two small LDRs in parallel or change the value of R1 which can be calculated from the Voltage Division formulæ.


8 7

I’ve made a video describing some basic concept of a NPN transistor, this project is described well in the video.

Written by : Subhadeep Biswas

Making a simple FM Transmitter

FM Transmitters are that type of gadget which gives you the feelings of a RJ. You can make your own short-range radio channel and air any songs, audio clips as well as your voice in the form of radio frequency. The transmission process is done by following steps which are audio pre amplification followed by modulation then transmission. There are two types of modulation Amplitude Modulation(AM) & Frequency Modulation(FM) both are the part of Radio Frequency (RF). 88 MHz to 180 MHz is generally known as the FM Band.

Audio signal from media player, microphones are very low level signal, of the order of mill volts. This extremely small voltage needs to be first amplified. A common emitter configuration of a bipolar transistor produces an amplified inverted signal.

Another important aspect of this circuit is the oscillator circuit. This is a LC oscillator where energy moves back and forth between the inductor and capacitor forming oscillations. It is mainly used for RF application.

When this oscillator is given a voltage input, the output signal is a mixture of the input signal and the oscillating output signal, producing a modulated signal. In other words, the frequency of the oscillator generated circuit varies with the application of an input signal, producing a frequency modulated signal.

A simple Fm Transmitter Circuit

Some details about the design of the circuit :

1.Selecting the Vcc : This circuit uses a NPN Bipolar Junction Transistor (2N3904) or you can use BC547 or equivalent. The Vceo of the transistor is 40V so minimum Vcc is 9V.

2.Selecting the Capacitor C1 : The capacitor modulates the current going through the transistor. A large value indicates bass or low frequency whereas small value indicates treble higher frequency. Here 1uF, 25V electrolytic capacitor is used.

3.Selecting L1 & C4 : Here L1 & C4 is the oscillator known as LC oscillator. Frequency of oscillation is obtained from the formula, f = 1/(2Π√LC). 

Here is some pictures of my complete and decorated setup :

breadboard setup
Breadboard setup
decorated setup1
Decorated setup1
Complete setup
Written by : Subhadeep Biswas


The Light Dependent Resistor

Light Dependent Resistor or LDR :

The LDR is also known as the Photo-resistor or Photo-cell, a light controlled variable resistance which exhibits photo conductivity. Ideally it behaves as a wire having a zero resistance when the incident light intensity increases as well as much higher resistance value when the intensity decreases. So, we can say that under bright light, resistance is very low & in darkness resistance is very high or infinite ideally.


This image shows how LDR looks like. There are different sizes available in the market. It is made of a high resistance semiconductor. The red track on the LDR is a layer of Cadmium Sulphide (CdS). Practically LDRs are not polarized.

Area of Application :

There are a large numbers of applications that can be done by using LDRs such as an automatic street light which turns on itself when the sun sets, a morning alarm which senses the morning light and initiate the alarm, many security applications like the laser alarm, it can also be applied as solar tracker, a line follower robot also uses a LDR to sense the black line etc.

Following images will describe the variance of Resistance as well as the circuit symbol & some test result:

Variance of resistance with respect to light
under light
Resistance value in front of a CFL in the order of 200KOhm
in darkness
Resistance value when the CdS track is blocked

–The most simple circuit that you can do using a LDR–

street light
Light controlled switching circuit

This simple circuit is the primary stage of LDRs applications later it can be modified as a automatic street light. When LDR is uncovered then LED is in OFF state and when covered LED is in ON state. So it may be a perfect system for street lighting. Here the BC547 transistor is working as a switch. So the results are quite satisfactory…

under light
When the torch is pointed towards the LDR
When the torch is removed from the LDR

So, this is how we can use LDR in a circuit. Also we can construct sensors as a physical parameter (light) is being converted to resistance value.

Written by : Subhadeep Biswas


LM35 Temperature Sensor

Active Analog Temperature Sensors :

There are varieties of analog temperature sensors around us. The main function of a active analog temperature sensor IC is to provide an output as voltage which is proportional to the temperature of the surroundings. Few of them are LM34, LM35, TMP 35/36/37, MCP9071 etc. These devices does not require any external calibration. A simple ADC (Analog to Digital Conversion) required for digital processing. 


Quick overview on the LM35 Analog Temperature Sensor


LM35 Temperature Sensor


  • Low cost, well available Analog Temperature Sensor
  • Calibrated directly in ° Celsius (Centigrade)
  • Linear + 10 mV/°C Scale Factor
  • 0.5°C Ensured Accuracy (at +25°C)
  • Rated for Full −55°C to +150°C Range
  • Low Self-Heating
  • Low impedance output, 0.1W for 1 mA Load
  • Operates from 4 to 30 V
  • Also suitable for Remote Applications



 Pin Configuration : Pin 1 : +Vcc (4 to 20 V ) , Pin 2 : Output, Pin 3 : Ground (GND)

LM35 pinout
LM35 Pin Configuration




It is very interesting to work with new things, when a primary stage of testing success brings mental satisfaction on the work & we go for more advanced implementation which increases the knowledge & allow us to think and face practical.

As LM35 is calibrated  directly in ° Celsius (Centigrade), so using only a multimeter it can be used as a digital thermometer for both Basic Centigrade Temperature Sensor & Full-Range Centigrade Temperature Sensor. Fig. 1 & Fig. 2 describes the circuit for those.


circuit 1
Basic Centigrade Temperature Sensor
circuit 2
Full-Range Centigrade Temperature Sensor


The Basic one on the breadboard

Breadboard Setup

Breadboard wiring


Use heat sink tubes for insulation between three pins

Time to test!

room temperature
Normal Room Temperature which is 32.8 ° C
Increase in room temperature when a hot object is placed near the sensor (36.3 ° C)
Temperature decreasing to room temperature when hot object is removed

Leave a reply if I missed anything! 

Written by : Subhadeep Biswas

The 555 Timer

The NE555 Timer



NE555 Timer


The 555 Timer IC(Integrated Circuit) is generally a versatile IC for timer operations. Designing a simple oscillator, timer, pulse generator, flip-flop can be done using this IC, also a well available cheap IC in the original bipolar & also in low power CMOS types. This revolutionary chip was introduced in 1971 by Hans Camenzind under contract to Signetics & became world-wide as electronics hobbyists & engineers found it’s vast area of applications. The IC reduces the space of 25 transistors or 2 comparetors, 2 diodes, 15 resistors. From the internal block diagram, there is three ‘R’ resistances present having value 5 Kilo-Ohm that’s why it is known as the 555 timer.

Internal Block Diagram

Pin Functions :

  1. PIN 1 : Pin 1 or the Ground pin is for ground reference voltage (0 V).
  2. PIN 2 : Pin 2 or the Trigger pin goes high and a timing interval starts when this input falls below 1/2 of Control voltage (hence TRIG is typically 1/3 VCC, CTRL being 2/3 VCC by default, if control is left open).
  3. PIN 3 : Pin 3 or the output pin is driven to approximately 1.7 V below +Vcc or GND.
  4. PIN 4 : Pin 4 or the Reset pin, a timing interval may be reset by driving this input to GND, but the timing does not begin again until RESET rises above approximately 0.7 volts. Overrides Trigger which overrides Threshold.
  5. PIN 5 : Provides “control” access to the internal voltage divider (by default, 2/3 VCC).
  6. PIN 6 : The timing (OUT high) interval ends when the voltage at Threshold is greater than that at CTRL (2/3 VCC if Control is open).
  7. PIN 7 : Output which may discharge a capacitor between intervals. In phase with output.
  8. PIN 8 : Positive supply voltage, which is usually between 3 and 15 V depending on the variation.

Modes Of Operation:

There are three modes of operations Monostable Mode, Astable(Free-Running) Mode & Bistable Mode or the Schmitt Trigger.

Monostable Mode :

Monostable Mode

When the circuit is turned on, the output is LOW and a brief negative pulse

on pin 2 will make the output go HIGH for a period of time determined by
the value of R and C. If pin 2 is low for longer than this period, the output
will remain HIGH while pin 2 is LOW and immediately go LOW when pin 2
goes HIGH.

Applications : Applications include timers, missing pulse detection, bouncefree switches, touch switches, frequency divider, capacitance measurement, Pulse Width Modulation (PWM) etc.

Astable(Free-Running) Mode : 

Astable Mode

The capacitor C charges via R1 and

R2 and when the voltage on the
capacitor reaches 2/3 of the supply, pin
6 detects this and pin 7 connects to 0v.
The capacitor discharges through R2
until its voltage is 1/3 of the supply and
pin 2 detects this and turns off pin 7 to
repeat the cycle.
The top resistor is included to prevent
pin 7 being damaged as it shorts to 0v
when pin 6 detects 2/3 rail voltage.
Its resistance is small compared to R2
and does not come into the timing of
the oscillator.

Applications : The 555 can operate as an oscillator. Uses include LED and lamp flashers, pulse generation, logic clocks, tone generation, security alarms, pulse position modulation and so on. The 555 can be used as a simple ADC, converting an analog value to a pulse length. E.g. selecting a thermistor as timing resistor allows the use of the 555 in a temperature sensor: the period of the output pulse is determined by the temperature. The use of a microprocessor based circuit can then convert the pulse period to temperature, linearize it and even provide calibration means.

Bistable Mode :


The bi-stable 555 has two steady states. SET turns ON the LED and
RESET turns the LED off. The 555 comes on in reset mode as Pin2 does
not see a LOW to SET the 555.

Applications : The 555 can operate as a flip-flop, if the DIS pin is not connected and no capacitor is used. Uses include bounce-free latched switches.

Example Project :

Here is a simple configuration of the 555 Timer used as a low frequency oscillator. Both values of resistances(R) is 10K & the capacitor value is 10uF,40 V. Or it can be used as a LED flasher circuit having delay of 2.2 seconds between each flash. If one 0f the resistor is replaced by a 10K pot then there will be also an option for reducing or increasing the time interval.

Low frequency oscillator or Timer Circuit (2.2s)
Breadboard Setup
Written by : Subhadeep Biswas

Using the Breadboard

The Breadboard 

For an electronics hobbyist as well as an engineer the breadboard is the primary platform to deal with. The white dotted board is used to test electronics circuits before soldering it permanently. 

Advantages of using the Breadboard:

  1. For testing whether a circuit is working or not.
  2. Experimenting by replacing old components with a new one having different value.
  3. Breadboard reduces time of soldering.
  4. Testing different IC operations in a short time.
  5. Low cost & well available.

How a Breadboard looks like?

This is how the most used Breadboard looks like there are also lot of variations in sizes.

What inside a Breadboard?

 The upper & lower both two rows are connected horizontally. They are used as power supply terminals, they are not continuous. The middle portion of both supply terminals are not connected so we have to use jumper wires to make it continuous on both sides.

The other terminals below the supply terminals are connected vertically, these terminals is the prototyping terminal.

Setting up Breadboard for your very first project :

A neat & clean work on Breadboard can give mental satisfaction, make good impression, saves time also it can make all of the connections understandable. So if there is something wrong anyone can correct it easily. Use jumper wires (Single Core) to make connections. Remove insulation of the wire using a wire stripper. Jump terminals as shown below hence you get the upper and lower rows connected. So it will be easy to power components or devices from anywhere of the Breadboard.

Some tips & tricks :
  • Try to use less jumper wires as possible to make the platform neat & clean.
  • Place ICs carefully. After placing the IC on the breadboard press it’s both end and then in the middle.
  • Try to remove sufficient insulator from wire not more not less otherwise two conductors closer to each other can make short circuit.
  • Remove ICs with care. Use a needle pass it through the middle channel of the breadboard and remove the IC.

Happy Prototyping!