This inexpensive motion sensor from X-10 was giving false ON commands, and I decided
to see what was inside.  I was intrigued that it contained a variant of my favorite Microcontroller, and I
thought the hardware had good hacker potential.

The HawkEye and the EagleEye are of identical electrical design. 
The case of the EagleEye makes it weather resistant.

Direct link to X-10's image of the sensor
X-10 web page for this device.

Circuit Description

Photo of circuit board inside the motion sensor.  The unit is controlled by a 12C508 PIC and contains
an RF transmitter, two pushbuttons, two LEDs, a pyroelectric motion sensor, and is powered by 2 AAA batteries.

The schematic of the circuit board. The values of capacitors are in uF, and resistors
in Ohms (unless where noted).  Numbers in bold were sent to me by Bart McCormick ( on 9/05.  I have not verified them.  Thanks to him.

Starting in the top left, the power supply section consists of the two AAA batteries and the C11 electrolytic capacitor.  The C19 ceramic is the bypass cap for the PIC.  Below it in the schematic is the Sun Sensor, which employs a standard Cadmium Sulfide cell to detect the light level.  Its resistance drops with increasing light, thus the output at the jumper R1 goes low when it is daytime.  That is connected to pin 5 of the PIC, which also serves as the control input for the red LED.  Due to the high value of R14, the Sun Sensor is unable to provide much sink current to turn on TR4 to light the LED, but the PIC (with its totem-pole output) is able to do that without difficulty.  Presumably, the code in the PIC programs pin 5 as in input to sense the light level, but drives it low to turn on the red LED.

The Motion Sensor portion in the top right starts with the output from a pyroelectric sensor that connects to the U2A TLC27 Op-Amp.  This, along with the RC following it formed by C12 and R18, is configured as a band-pass filter with a peak pass frequency of about 1 Hz and a peak voltage gain of about 233 (47dB).  The result of a SPICE simulation is shown below.  The plot is the ratio of the input voltage of U2B over the input voltage of U2A.

Plot of MS14A bandpass filter
Characteristics of band-pass filter formed by U2A, C12, R18 and associated components.
The filter peak is around 1Hz and 47dB (gain of ~233).

The output of U2A is then threshold detected by U2B, which feeds pin 7 of the PIC via a 1Meg resistor.  This latter pin also serves double duty, and provides current to light the Green LED when the internal code drives it high.  Pin 3 of the PIC forms an enable signal for the threshold detector.  From observations of the operation of the circuit, this line goes high (disabling the threshold detector) for 10 seconds after every X-10 command sent via RF.  The need for this disable is unclear.  Also, why this disable function is not performed in software inside the PIC (and thus saving one pin) is not clear to me either.

Key components of the motion detector are the three RC pairs around U2A.  To ignore false triggers associated with slow thermal events, we could shift the peak of the band-pass higher in frequency.  This can be done by decreasing the value of the capacitors.  More on that is mentioned in the modification section below.

Sensitivity could in principle be increased by decreasing R5, however range is controlled geometrically by the arrangement of the fresnel lens in front of the pyroelectric sensor, and increasing the gain could degrade the reliability of the sensor in terms of false trigger events.

The transmitter is keyed by pin 2 via R3.  It is perhaps possible to control the power level with R3, but since I did not bother with tracing the transmitter itself, I do not know for sure.  That section is encased in wax to stabilize the components, and I did not want to destroy this particular unit by disturbing it.  Perhaps I will trace this section in the future.

The other parts of the circuit such as the two switches for the user interface are minor, and not worth much mention.  The microcontroller is a 12C508 from Microchip, and uses its internal RC oscillator, which means it is running at around 4MHz, or about 1MIPS.  I would think that its code is protected, and that reading it would be fruitless.  It is worth noting that the 1 minute expected duration for the OFF command delay was really about 70 seconds with this particular sensor.

Project Log

modified band-pass filter
Modified band-pass filter response.  The peak frequency is now shifted up to 3.3Hz.
Ed,Thank you very much for your MS14A page, it has been a lot of help.

The pictures below are a recent purchase of something X10 pro is calling the PMS03 outdoor motion sensor. In reality, it is the MS16A Active Eye motion sensor.  Two components, RX and URX, seem to take it from a MS14A to a MS16A.  R16 is removed from the board and the white jumper wire grabs ahold of the two added components. URX adjusts the off delay time from 1 to 60 minutes when the delay time has been set to the 1 blink mode only. A new capacitor was added down around the coil, I'm not sure what that is all about, perhaps bypassing?
The back side of the board contains two surface mount resistors R19 and R20 and a couple of surface mount capacitors up in the RF area. Both resistors would differ with your on line schematic. R20 is 1K on this board and you show 1M. R19 is a 470 ohm resistor in series with the green LED, you show a diode (with R19 label) in that location. The other difference is R1, (to the left of the green LED). It is shown as zero ohms on the schematic, a 68 ohm resistor is in that location. Your board picture shows the same 68 ohm resistor.

Thank you again for all of your X10 stuff, I've enjoyed it. It is stuff you can get no where else.



Other X-10 Schematics

Main Home Automation Page

Back Home