Reverse Engineering an Electric Blanket

My electric blanket has a "feature" that I really hate. It turns off automatically after "8 hours". I put "8 hours" in quotation marks, because I don't believe that's true. It seems like it often turns off much earlier than that. I can't say for sure because I've never measured it. Either way, it's an annoying feature. I like to sleep for 8 to 9 hours, I like to turn my blanket on 15 minutes before going to bed so it's warm when I get in, and I like my blanket to stay on for a little while in the morning so I'm not freezing when I wake up.

With that in mind, I cracked open my electric blanket's control module and did some sleuthing. I knew that there had to be a timer or counter chip somewhere in it, so I started by identifying all of the chips. The first chip I checked was the 14-pin chip in the top-center of the board. (It's a one-sided board.)

That chip turned out to be a quad comparator. No dice. Next, I checked the 14-pin chip on the left side of the board. It was a programmable timer! I found the part's datasheet and set to work.

Upon first inspection, it looked like pins 4 (NC=no connect), 5 (AR=automatic reset), 6 (MR=master reset), 9 (Q/~Q SEL), 11 (NC=no connect), and 12 (A), and 13 (B) were left floating. "Easy!" I thought. "I can just short MR to VDD to hold the chip in reset mode. That way the counter will never increment, and the blanket will never turn off!"

I was wrong, unfortunately. After shorting MR to VDD, I plugged the blanket in to the wall and turned it on. And nothing happened. The blanket stayed cold. I undid my modification and tested the blanket again. It worked. At least I hadn't broken it.

I decided I needed to look at the circuit a little more closely. Armed with my trusty multimeter, I investigated. The circuit below shows what I found.

I thought that MR was floating, but I was wrong. That was a bad assumption. None of the pins were left floating. They were just connected to VDD or VSS under the chip where I couldn't see them. My modification actually shorted VDD to VSS! Luckily I didn't damage the circuitry supplying power for the blanket's logic chips.

To really modify the blanket well, I had to understand exactly how it was working. I consulted the datasheet more.

Pins A and B are high, so that means the counter will count to 2^16 (or 65536). Rtc is 2.26 MΩ and Ctc is 220 nF. Using the formula on page 6 of the data sheet, I calculated the counter's frequency.

f = 1/(2.3×Rtc×Ctc)

f = 1/(2.3×2.26e6×220e-9)

f = 0.874 Hz

That corresponds to a period of 1.14 seconds per count.

The data sheet says

...after 2^(n−1) counts the RS flip−flop sets which causes the output to change state.

So that means the blanket will turn off after 2^(16-1)*1.14 seconds = 10.4 hours. Huh? That's strange. But wait, if we use the frequency instead of the period, then we get 2^(16-1)×0.87 seconds = 8.0 hours. That matches up with the claimed 8 hours.

I think that the electrical engineer that designed this accidentally used the frequency instead of the period when calculating the values for Rtc and Ctc.

The counter's manufacturer foresaw customers trying to use their part this way, and they put a lower limit of 1 kHz on the counter's frequency formula. The blanket manufacturer decided to use the counter outside of its recommended range. That explains why it seemed like the blanket didn't always turn off after the same amount of time.

So how could I modify the circuit in an easily reversible way so that the blanket would never turn off? Well, if I short RS, the counter's input, to VDD or VSS, then the counter would never increment. This is safe because the resistors RS and Rtc limit the current drawn from the chip, and the input current of RS is certainly less than the current headroom of the blanket's power supply.

There were test pads on both RS and VDD, so I cut a short length of wire and soldered it down. After shorting RS to power, I tested the blanket again. It got hot! Now that the counter can't count anymore, it will never change its Q output and turn off the blanket! The picture below shows the modification I made. (It's the extra green wire.)