Posted on Leave a comment

“SolarStorm” eBay 4x 18650 Battery Pack

Pack Top
Pack Top

Since the 4×18650 battery pack supplied with my Cree head torch is pretty shit, even by China’s standards, I figured something I could put my own cells into would be a better option. An eBay search turned up these battery boxes, not only with a direct battery output for my torch, but also a USB port for charging other devices when I’m low on charge.

LED Capacity Indicator
LED Capacity Indicator

The output to the lamp connector is directly connected to the battery, through the usual Lithium Ion protection, but the USB output is controlled from a single power button. Battery charge condition is displayed on 3 LEDs. Not sure why they used blue silicone for the seal & then used green LEDs… But it does work, even if a little dim.

Label
Label

Essential information. Does claim to be protected, and from the already existing electronics for the USB this would be expected in all but the cheapest crap.
An IP rating of IPX4 is claimed, yet just above that rating is a notice not to be used in water. Eh?
This is sealed with an O-Ring around the edge of the top cap & silicone seals around the cable & retaining screw. I did test by immersion in about 6″ of water, and it survived this test perfectly fine, no water ingress at all.

Interconnect Straps
Interconnect Straps

The casing holds a PCB at the bottom end with the cell straps.

Screw Post
Screw Post

Someone wasn’t that careful at getting the brass screw insert properly centred in the injection mould when they did this one. It’s mushed off centre, but i’s solidly embedded & doesn’t present any problems to usability.

Cell Springs
Cell Springs

The top cover holds the cell springs & the electronics.

Button & Cable Seal
Button & Cable Seal

Removing the pair of screws allows the top cap to open up. The cable, button & LEDs are robustly sealed off with this silicone moulding.

Top Removed
Top Removed

Here’s the PCB, not much on the top, other than the power button & battery indicator LEDs.

Electronics
Electronics

Desoldering the cell springs allows the PCB to pop out of the plastic moulding. There’s more than I expected here!

Bottom left is a DC-DC converter, generating the +5v rail for the USB port, this is driven with an XL1583 3A buck converter IC.

Bottom right is the protection IC & MOSFETs for the Lithium Ion cells. I wasn’t able to find a datasheet for the tiny VA7022 IC, but I did manage to make certain it was a 7.4v Li-Ion protection IC.

Top right is a completely unmarked IC, and a 3.3v SOT-23 voltage regulator. I’m assuming that the unmarked IC is a microcontroller of some sort, as it’s handling more than just the battery level LEDs.

A pretty decent 4-core cable finishes the job off. For once there’s actually some copper in this cable, not the usual Chineseuim thin-as-hair crap.

Posted on 70 Comments

Dyson DC35 “Digital” Teardown

DC35
DC35

Here’s another Dyson teardown, in my efforts to understand how marketing have got hold of relatively simple technology & managed to charge extortionate amounts of money for it.
This is the DC35, the model after the introduction of the brushless digital motor.

Back Cap Removed
Back Cap Removed

On this version the mouldings have been changed, and the back cover comes off, after removing the battery retaining screw. It’s attached with some fairly vicious clips, so some force is required. Once the cap is removed, all the electronics are visible. On the left is the motor itself, with it’s control & drive PCB. There’s another PCB on the trigger, with even more electronics. The battery connector is on the right.

Trigger PCB
Trigger PCB

Here’s the trigger PCB, which appears to deal with DC-DC conversion for powering the brush attachments. The QFN IC with yellow paint on it is an Atmel ATTiny461 8-bit microcontroller. This is probably controlling the DC-DC & might also be doing some battery authentication.

"Digital Motor"
“Digital Motor”

Here’s the motor & it’s board. The windings on the stator are extremely heavy, which makes sense considering it’s rated at 200W. The main control IC is a PIC16F690 from Microchip. Instead of using an off the shelf controller, this no doubt contains software for generating the waveforms that drive the brushless motor. It also appears to communicate with the other PCBs for battery authentication.

Stator
Stator

Desoldering the board allows it to be removed from the motor itself. The pair of windings are connected in anti-phase, to create alternating North-South poles depending on polarity. Since the existing controller is unusable due to software authentication with the other parts, I might have a go at building my own driver circuit for this with an Arduino or similar.

Blower Assembly
Blower Assembly

The blower assembly is simple plastic mouldings, pressed together then solvent welded at the seam.

Impeller
Impeller

The impeller is just a centrifugal compressor wheel, identical to what’s used in engine turbochargers.

Motor Control Board
Motor Control Board

The inside face of the control PCB holds the 4 very large MOSFETs, IRFH7932PbF from International Rectifier. These are rated at 30v 20A a piece, and are probably wired in a H-Bridge. There’s a bipolar Hall switch to sense rotor position & rotation speed, and an enormous pair of capacitors on the main power bus.

Motor Control Board Reverse
Motor Control Board Reverse

Not much on the other side of the PCB other than the microcontroller and associated gate drive stuff for the FETs.

Battery Pack Opened
Battery Pack Opened

The battery pack is similar to the DC16 in it’s construction, a heavily clipped together plastic casing holding 6 lithium cells. In this one though there’s a full battery management system. The IC on the top of the board above is a quad Op-Amp, probably for measuring cell voltages.

Battery BMS Bottom
Battery BMS Bottom

The other side of the BMS board is packed with components. I wasn’t able to identify the QFN IC here, as it’s got a custom part number, but it’s most definitely communicating with the main motor MCU via I²C over the two small terminals on the battery connector.

Posted on 14 Comments

Dyson DC16 Handheld Teardown

DC16
DC16

The Dyson DC16 is one of the older handheld vacuums, before the introduction of the “Digital Motor”. (Marketing obviously didn’t think “Switched Reluctance Motor” sounded quite as good).

These vacuums have a very large DC brush motor driving the suction turbine instead, the same as would be found in a cordless power tool.

Control PCB
Control PCB

Popping the front cap off with the ID label, reveals the brains of the vacuum. The two large terminals at the right are for charging, which is only done at 550mA (0.5C). There are two PIC microcontrollers in here, along with a large choke, DC-DC converter for supplying the logic most likely. The larger of the MCUs, a PIC16HV785, is probably doing the soft-start PWM on the main motor, the smaller of the two, a PIC16F684 I’m sure is doing battery charging & power management. The motor has a PCB on it’s tail end, with a very large MOSFET, a pair of heavy leads connect directly from the battery connector to the motor.
Just out of sight on the bottom left edge of the board is a Hall Effect Sensor, this detects the presence of the filter by means of a small magnet, the vacuum will not start without a filter fitted.

Battery Pack
Battery Pack

The battery pack is a large custom job, obviously. 4 terminals mean there’s slightly more in here than just the cells.

Battery Cracked
Battery Cracked

Luckily, instead of ultrasonic or solvent welding the case, these Dyson batteries are just snapped together. Some mild attack with a pair of screwdrivers allows the end cap to be removed with minimal damage.

Cells
Cells

The cells were lightly hot-glued into the shell, but that can easily be solved with a drop of Isopropanol to dissolve the glue bond. The pack itself is made up of 6 Sony US18650VT High-Drain 18650 Li-Ion cells in series for 21.6v nominal. These are rated at a max of 20A discharge current, 10A charge current, and 1.3Ah capacity nominal.
There’s no intelligence in this battery pack, the extra pair of terminals are for a thermistor, so the PIC in the main body knows what temperature the pack is at – it certainly gets warm while in use due to the high current draw.

Motor
Motor

Hidden in the back side of the main body is the motor. Unfortunately I wasn’t able to get this out without doing some damage, as the wiring isn’t long enough to free the unit without some surgery.

Turbine
Turbine

The suction is generated by a smaller version of the centrifugal high-speed blowers used in full size vacuums. Not much to see here.

Unofficial Charger
Unofficial Charger

Since I got this without a charger, I had to improvise. The factory power supply is just a 28v power brick, all the charging logic is in the vacuum itself, so I didn’t have to worry about such nasties as over-charging. I have since fitted the battery pack with a standard Li-Po balance cable, so it can be used with my ProCell charger, which will charge the pack in 35 minutes, instead of the 3 hours of the original charger.

Posted on Leave a comment

Multifunction LCD Power Meter MHF-8020P

LCD Unit
LCD Unit

I recently came across these on eBay, so I thought I’d grab one to see how they function, with all the metrics they display, there’s potential here for them to be very useful indeed.
One of the best parts is that no wiring is required between the sensor board & the LCD head unit – everything is transmitted over a 2.4GHz data link using NRF24L01 modules.
Above is the display unit, with it’s colour LCD display. Many features are available on this, & they appear to be designed for battery powered systems.

Monitor PCB
Monitor PCB

Another PCB handles the current & voltage sensing, so this one can be mounted as close to the high current wiring as possible.

Monitor PCB Microcontroller
Monitor PCB Microcontroller

The transmitter PCB is controlled with an STM8S003F3 microcontroller from ST Microelectronics. This is a Flash based STM with 8KB of ROM, 1KB of RAM & 10-bit ADC. The NRF24L01 transceiver module is just to the left.
There’s only a single button on this board, for pairing both ends of the link.

Output MOSFET
Output MOSFET

The high current end of the board has the 0.0025Ω current shunt & the output switch MOSFET, a STP75NF75 75v 75A FET, also from ST Microelectronics. A separate power source can be provided for the logic via the blue terminal block instead of powering from the source being measured.

LCD Unit Rear
LCD Unit Rear

Here’s the display unit, only a pair of power terminals are provided, 5-24v wide-range input is catered for.

LCD Unit PCB
LCD Unit PCB

Unclipping the back of the board reveals the PCB, with another 2.4GHz NRF24L01 module, and a STM8S005K6 microcontroller in this case. The switching power supply that handles the wide input voltage is along the top edge of the board.

Unfortunately I didn’t get any instruction manual with this, so some guesswork & translation of the finest Chinglish was required to get my head round the way everything works. To make life a little easier for others that might have this issue, here’s a list of functions & how to make them work.

LCD Closeup
LCD Closeup

On the right edge of the board is the function list, a quick press of the OK button turns a function ON/OFF, while holding it allows the threshold to be set.
When the output is disabled by one of the protection functions, turning that function OFF will immediately enable the output again.
The UP/DOWN buttons obviously function to select the desired function with the cursor just to the left of the labels. Less obviously though, pressing the UP button while the very top function is selected will change the Amp-Hours display to a battery capacity icon, while pressing DOWN while the very bottom function is selected will change the Watts display to Hours.
The round circle to the right displays the status of a function. Green for OK/ON Grey for FAULT/OFF.

  • OVP: Over voltage protection. This will turn off the load when the measured voltage exceeds the set threshold.
  • OPP: Over power protection. This function prevents a load from pulling more than a specified number of watts from the supply.
  • OCP: Over current protection. This one’s a little more obvious, it’ll disable the output when the current measured exceeds the specified limit.
  • OUT: This one is the status of the output MOSFET. Can also be used to manually enable/disable the output.
  • OFT: Over time protection. This one could be useful when charging batteries, if the output is enabled for longer than the specified time, the output will toggle off.
  • OAH: Over Amp-Hours protection. If the counted Amp-Hours exceeds the set limit, the output will be disabled.
  • Nom: This one indicates the status of the RF data link between the modules, and can be used to set the channel they operate on.
    Pairing is achieved by holding the OK button, selecting the channel on the LCD unit, and then pressing the button on the transmitter board. After a few seconds, (it appears to scan through all addresses until it gets a response) the display will resume updating.
    This function would be required if there are more than a single meter within RF range of each other.

I’ve not yet had a proper play with all the protection functions, but a quick mess with the OVP setting proved it was very over-sensitive. Setting the protection voltage to 15v triggered the protection with the measured voltage between 12.5v-13.8v. More experimentation is required here I think, but as I plan to just use these for power monitoring, I’ll most likely leave all the advanced functions disabled.

Posted on Leave a comment

General Electric A735 Digital Camera Teardown

Front
Front

This camera has now been retired after many years of heavy use. Exposure to a 3-year old has caused severe damage to the lens mechanism, which no longer functions correctly.

Rear Panel
Rear Panel

Pretty much standard interface for a digital camera, with a nice large LCD for it’s time.

Front Cover Removed
Front Cover Removed

With the front cover removed, the lens assembly & battery compartment is exposed.

Rear Cover Removed
Rear Cover Removed

Removing the rear cover exposes the LCD module & the main PCB, the interface tactile switches are on the right under a protective layer of Kapton tape.

Main Chipset
Main Chipset

Flipping the LCD out of it’s mounting bracket reveals the main camera chipset. The CPU is a NovaTek NT96432BG, no doubt a SoC of some kind, but I couldn’t find any information. Firmware & inbuilt storage is on a Hynix HY27US08561A 256MBit NAND Flash, with a Hynix HY5DU561622FTP-D43 256Mbit DRAM for system memory.
I couldn’t find any info on the other two chips on this side of the board, but one is probably a motor driver for the lens, while the other must be the front end for the CCD sensor input to the SoC.

Main PCB Reverse
Main PCB Reverse

The other side of the PCB handles the SD card slot & power management. All the required DC rails are provided for by a RT9917 7-Channel DC-DC converter from RichTek, an IC designed specifically for digital camera applications.
Top left above the SD card slot is the trigger circuitry for the Xenon flash tube & the RTC backup battery.

Main PCB Removed
Main PCB Removed

Once the main PCB is out of the frame, the back of the lens module with the CCD is accessible. Just to the left is the high-voltage photoflash capacitor, 110µF 330v. These can give quite the kick when charged! Luckily this camera has been off long enough for the charge to bleed off.

Sensor
Sensor

Finally, here’s the 7-Megapixel CCD sensor removed from the lens assembly, with it’s built in IR cut filter over the top. I couldn’t find any make or model numbers on this part, as the Aluminium mounting bracket behind is bonded to the back of the sensor with epoxy, blocking access to any part information.

Die images of the chipset to come once I get round to decapping them!

Posted on Leave a comment

Chinese CO Meter – The Sensor Cell

As the CO meter I bought on eBay didn’t register anything whatsoever, I decided I’d hack the sensor itself apart to make sure it wasn’t just an empty steel can. It turns out that it’s not just an empty can, but there are some reasons why the thing doesn’t work 😉

Cell Disassembled
Cell Disassembled

The cell was crimped together under the yellow shrinkwrap, but that’s nothing my aviation snips couldn’t take care of. The photo above shows the components from inside.

End Cap
End Cap

The endcap is just a steel pressing, nothing special here.

Filter
Filter

Also pretty standard is the inlet filter over the tiny hole in the next plate, even though it’s a lot more porous that I’ve seen before in other sensors.

Working Electrode Components
Working Electrode Components

Next up is the working electrode assembly, this also forms the seal on the can when it’s crimped, along with insulating it from the counter electrode & external can. The small disc third from left is supposed to be the electrode, which in these cells should be loaded with Platinum. Considering where else they’ve skimped in this unit, I’ll be very surprised if it’s anything except graphite.

Counter Electrode
Counter Electrode

Next up is the counter electrode, which is identical to the first, working electrode. Again I doubt there’s any precious metals in here.

Backplate
Backplate

Another steel backplate finishes off the cell itself, and keeps most of the liquid out, just making sure everything stays moist.

Rear Can & Reservoir
Rear Can & Reservoir

Finally, the rear of the cell holds the reservoir of liquid electrolyte. This is supposed to be Sulphuric Acid, but yet again they’ve skimped on the cost, and it’s just WATER.

It’s now not surprising that it wouldn’t give me any readings, this cell never would have worked correctly, if at all, without the correct electrolyte. These cheap alarms are dangerous, as people will trust it to alert them to high CO levels, when in fact it’s nothing more than a fancy flashing LED with an LCD display.

Ironically enough, when I connected a real electrochemical CO detector cell to the circuit from the alarm, it started working, detecting CO given off from a burning Butane lighter. It wouldn’t be calibrated, but it proves everything electronic is there & operational. It’s not surprising that the corner cut in this instance is on the sensor cell, as they contain precious metals & require careful manufacturing it’s where the cost lies with these alarms.

Posted on Leave a comment

De La Rue Coin Counting Machine Followup – PSU Oddness

I did a little more digging into the PSU circuitry of the small coin counting machine, and it’s even more strange than I thought!
The part I originally thought was a transformer on the PSU board is in fact a DC-DC converter module!

DC-DC Converter
DC-DC Converter

Here’s the device after desoldering it from the PCB. It turns out that instead of a transformer, it’s an inductor.

Hiding Control Electronics
Hiding Control Electronics

Underneath is the controller electronics, with an COB controller & the switching transistors are under a protective covering of silicone.

Mains Transformer
Mains Transformer

Driving this whole lot of PSU randomness is the mains transformer, with a secondary voltage of 35v.

The only reason I can think of that the manufacturer went to this much expense with the power supply is stability – a coin counting machine that miscounts due to power supply surges, sags & spikes wouldn’t be very much use. It’s not likely I’ll see anything similar again, unless I manage to get hold of something like medical grade equipment.

Posted on Leave a comment

De La Rue Coin Counting Machine

Here’s some teardown photos of an old De La Rue coin counter, used in businesses for rapid counting of change into large bags.

Mechanism
Mechanism

An overview of the whole mechanical system of the counter. Coins are loaded into the drum at the rear of the machine, which sorts them into a row for the rubber belt to pick up & run through the counter. The coin type to be sorted is selected by turning the control knobs on the right.
The control knobs adjust the width & height of the coin channel so only the correct sized coins will be counted.

PSU & Switching
PSU & Switching

The counter is driven by a basic AC induction motor, the motor power relay & reversing relay is on this PCB, along with the 5v switching supply for the main CPU board.
The SMPS on this board looks like a standard mains unit, but it’s got one big difference. Under the frame next to the main motor is a relatively large transformer, with a 35v output. This AC is fed into the SMPS section of the PSU board to be converted to 5v DC for the logic.
I’m not sure why it’s been done this way, and have never seen anything similar before.
The edge of the coin channel can be seen here, the black star wheel rotates when a coin passes & registers the count.

Controller PCB
Controller PCB

Here’s the main controller PCB, IC date codes put the unit to about 1995. The main CPU is a NEC UPD8049HC 8-bit micro, no flash or EEPROM on this old CPU, simply mask ROM. Coin readout is done on the 4 7-segment LED displays. Not much to this counter, it’s both electronically & mechanically simple.

Counter Sensor
Counter Sensor

Coin counting is done by the star wheel mentioned above, which drives the interrupter disc on this photo-gate. The solenoid locks the counter shaft to prevent over or under counting when a set number of coins is to be counted.

Motor Run Capacitor
Motor Run Capacitor

Under the frame, here on the left is the small induction motor, only 6W, 4-pole. The run cap for the motor is in the centre, and the 35v transformer is just visible behind it.

Main Motor Drive
Main Motor Drive

Main drive to the coin sorting mech is through rubber belts, and bevel gears drive the coin drum.

Posted on Leave a comment

Huawei E160E USB HSDPA Modem

E160E Modem
Huawei E160E Modem

Here’s an old HDSPA 3G USB modem stick that I got with a mobile phone contact many years ago. As it’s now very old tech, and I have a faster modem, not to mention that I’m no longer with Orange (Robbing <expletive>), here’s a teardown of the device!

Cover Removed
Cover Removed

The top shell is just clipped into place, while a pair of very small screws hold down the orange piece at left to hold the PCB stack in the casing. Not much to see here, but it’s clear that there’s a lot crammed into a very small space.

PCB Assembly
PCB Assembly

Here’s the PCB stack removed from the outer casing. The main antenna is on the right, attached with another small screw. Every IC on the boards is covered with an RF can. No problems there, pliers to the rescue!

SD Card Slot
SD Card Slot

Here’s the top PCB, all the shields have been removed. On the left is a Qualcomm PM6658 Power Management IC with integrated USB transceiver. This is surrounded by many of the power management circuits.
The integrated SD Card slot is on the right side. with what looks to be a local switching regulator for supply voltage. This might also provide the SIM card with it’s power supply.

PSU & SIM Contacts
PSU & SIM Contacts

The other side of the top board reveals more power management, with another switching regulator, and a truly massive capacitor at the top edge. I’m guessing this is a solid Tantalum.

Main Chipset PCB
Main Chipset PCB

The other PCB holds the main chipset & RF circuits. On the left here is a Samsung MCP K5D1G13ACH IC. This one is a multiple chip package, having 1Gbit of NAND Flash & 512Mbit of mobile SDRAM.
To it’s right is a Qualcomm RTR6285 RF Transceiver. This IC supports multiband GSM/EDGE/UMTS frequencies & also has a GPS receive amplifier included.
At bottom right is an Avago ACPM7371 Wide-Band 4×4 CDMA Power Amplifier. The external antenna connector is top right.

Main Chipset PCB Reverse
Main Chipset PCB Reverse

On the other side of the main PCB is a Qualcomm MSM6246 Baseband processor. Not sure about this one as I can’t find anything resembling a datasheet. Another micro-coax connector is in the centre, probably for factory test purposes, as it’s not accessible from the outside.
Just above the coax connector is a Qorvo RF1450 SP4T (single-pole 4-throw) High Power (34.5dBm) GSM RF Switch.
Upper right is an Avago FEM-7780 UMTS2100 4×7 Front End Module.
Under that is an RFMD RF3163 Quad-Band RF Power Amplifier Module.

Posted on Leave a comment

Portable Hearing Induction Loop

Induction Loop
Induction Loop

These units are used to broadcast local audio, such as from a public address system or local microphone. They accomplish this by producing a modulated magnetic field that a hearing aid is capable of picking up.

Back Panel
Back Panel

Not many controls on this bit of equipment. A bi-colour LED for status indications, a microphone, external audio input, charging input & a power switch.

Internals
Internals

Popping the cover off reveals a small lead-acid battery, 2.1Ah at 12v. This is used when the loop is unplugged.

Main PCB
Main PCB

Here’s the main PCB, which takes care of the audio & battery charging. The inductive loop itself is just visible as the tape-covered wire bundle around the edge of the casing.

Audio & Power Input
Audio & Power Input

Here’s the input section of the main PCB. The microphone input is handled by a SSM2166 front-end preamplifier from Analog Devices.

Power Amplifier
Power Amplifier

This audio is then fed into a TDA2003 10W Mono Power Amplifier IC, which directly drives the induction coil as if it were a speaker. Any suitable receiving coil & amplifier can then receive the signal & change it back into audio.

Posted on Leave a comment

Nanoptix “Spill-Proof” Thermal Receipt Printer

Nanoptix Spill-Proof Thermal Printer
Nanoptix Spill-Proof Thermal Printer

I have yet another receipt printer, this one appears to be brand new. It’s possibly the smallest thermal 80mm printer I have at the moment, and has both USB & Serial interfaces.

Controller PCB
Controller PCB

There’s not much to these printers at all. Removing a single screw allows the case halves to separate, showing the guts. The controller is based around a Texas Instruments TMS320VC5509AFixed-Point DSP. It’s associated Flash ROM & RAM are to the right.
Power supply is dealt with in the top right of the PCB, with the interface ports further left.

Print Head
Print Head

Here’s the thermal mechanism itself, with the large print head. The stepper motor to drive the paper through the printer is just peeking out at top right. The paper present sensor is just under the left hand side of the print head.

Posted on Leave a comment

Turnigy Accucell 6 Multi-Chemistry Charger

Accucell 6
Accucell 6

A lot of the electronics I use & projects I construct use batteries, mainly of the lithium variety. As charging this chemistry can be a little explosive if not done correctly, I decided a proper charger was required. This charger is capable of handling packs up to 6 cells for Lithium, and up to 20v for lead-acids.

External Connections
External Connections

The usual DC input barrel jack on the left, with an external temp sensor for fast charging NiCd/NiMH chemistry batteries. The µUSB port registers under Linux as USB HID, probably so drivers aren’t required. Unfortunately the software is Windows only, but it doesn’t provide anything handy like charging graphs or stats. Just a way to alter settings & control charging from a PC. On other versions of this charger there’s a setting to change the temp sensor port into a TTL serial output, which would be much handier.

Output & Balance
Output & Balance

The other side of the charger has the main DC output jacks & the pack balancing connections.

Cover Removed
Cover Removed

Here’s the top cover removed from the charger, showing most of the internals. A standard HD44780 LCD provides the user interface, the CPU & it’s associated logic is hidden under there somewhere.
The PCB has nice heavy tracks to handle the 6A of current this charger is capable of.

Balancing Network
Balancing Network

The output side of the board. Here the resistive pack balancing network can be seen behind the vertical daughter board holding the connectors, along with the output current shunt between the DC output banana jacks & the last tactile button.

Main Logic
Main Logic

Unfortunately the LCD is soldered directly to the board, and my desoldering tool couldn’t quite get all the solder out, so time to get a bit violent. I’ve gently bent the header so I could see the brains of the charger. The main CPU is a Megwin MA84G564AD48, which is an Intel 8081 clone with USB support. Unfortunately I was unable to find a datasheet for this part, and the page on Megwin’s site is Chinese only.

I was hoping it was an ATMega328, as I have seen in other versions of this charger, as there are custom firmwares available to increase the feature set of the charger, but no dice on this one. I do think the µUSB port is unique to this version though, so avoiding models with that port probably would get a hackable version.
There’s some glue logic for controlling the resistor taps on the balancing network, and a few op-amps for voltage & current readings.

Power Switching Devices
Power Switching Devices

All the power diodes & switching FETs for the DC-DC converter are mounted on the bottom of the PCB, and clamped against the aluminium casing when the PCB is screwed down. Not the best way to ensure great contact, but Chinese tech, so m’eh.

Posted on Leave a comment

Mini Teardown: Eberspacher 701 BT Controller

It’s well known that there are two versions of the 701 type controller available for Eberspacher heaters, the version with the blue logo is the official un-restricted model, while the version with the white logo is a version built for BT that restricts the heater to 1 hour runtime & has no diagnostics built in.
As these devices are microcontroller driven, I assumed that the hardware would be the same, only the code running in the micro being the bit that Eberspacher changed. This option would certainly have been the lowest cost.

Controller PCB Rear
Controller PCB Rear

Here’s the PCB removed from the plastic housing. There are definitely some differences that I can tell. As the un-restricted version has an extra wire for the diagnostic serial interface, and this board has no unpopulated parts, the PCB is definitely a different version.
In the centre is a Microchip PIC16C622 microcontroller, the OTP version in this case for cost reductions. (I may try reading the binary from this chip in the future, chances are it’s code protected though).
Below the micro is an NXP PCF8577C 32-segment LCD controller, this has an I²C interface to the PIC.
The temperature control function on these heaters is done via applying a resistance to one of the control lines, between 1750Ω-2180Ω, ±80Ω. (Very odd values these, not to mention no standard components can create this range easily, bloody engineers >_<). This is accomplished in hardware with a BU2092F I²C shift register from Rohm, which is connected to a bank of resistors. The microcontroller will switch combinations of these into the circuit to get the range of resistances required.
The rest of the circuit is local power regulation & filtering.

Controller PCB Front
Controller PCB Front

There’s not much on the other side of the PCB, just the LCD itself & the contacts for the buttons.

Posted on Leave a comment

eBay Mini Gear Pump Teardown

Mini Pump
Mini Pump

I got one of these to test since I’ve been in need of some small DC pumps for fluid transfer use. At £2 I can definitely afford to experiment.

DC Motor
DC Motor

On the eBay listing, these pumps are rated at 3-12v DC, (I thought that was a bit wide of an operating range), I looked up the motor, an RS-360SH on Mabuchi’s website, they only have models in this range rated at 7.2v & 24v. Judging by the size of the windings on the armature & the fact that after a few minutes operation on 12v it gets rather hot, I’m going to say this is the 7.2v motor.

Pump Gears
Pump Gears

Removing the screws releases the end cover & the pair of gears inside. This operates like any other hydraulic gear motor, albeit with much wider tolerances. It has no capability to hold pressure when the power is removed, and can be blown through easily.
Flow & pressure under power are quite good for the pump’s size, even though it’s noisy as hell.

Posted on Leave a comment

Totally Wicked Forza / JoyeTech eVIC 60W Teardown

Display
Display

I’ve been a vaper now for many years, after giving up the evil weed that is tobacco. Here’s my latest acquisition in the vaping world, the JoyeTech eVIC 60W. This one is branded by Totally Wicked as the Forza VT60.

18650 Cell
18650 Cell

Powered by a single 18650 Li-Ion cell, this one is a Sony VTC4 series, 2100mAh.

Under the battery a pair of screws hold the electronics in the main cast alloy casing.

OLED Display
OLED Display

After removing the screws, the entire internal assembly comes out of the case, here’s the top of the PCB with the large OLED display in the centre.

USB Jack
USB Jack

On the right side of the board is the USB jack for charging & firmware updates. The adjustment buttons are also at this end.

Output
Output

On the left side of the board is the main output connector & the fire button. Unlike many eCigs I’ve torn down before, the wiring in this one is very beefy – it has to be to handle the high currents used with some atomizers – up to 10A.

PCB Reverse
PCB Reverse

Removing the board from the battery holder shows the main power circuitry & MCU. The aluminium heatsink is thermally bonded to the switching MOSFETs, a pair under each end. The switching inductor is under the gap in the centre of the heatsink.

DC-DC Converter
DC-DC Converter

A close up of the heatsink shows the very slim inductor under the heatsink.

Microcontroller
Microcontroller

The main MCU in this unit has a very strange part number, which I’ve been unable to find information on, but it’s probably 8081 based.

Posted on Leave a comment

Duratool ZD-915 12v Conversion

Inkeeping with everything else in my shack being low voltage operated, I had planned from the outset to convert the desoldering station to 12v operation. It turns out this has been the easiest tool to convert in my shack so far.

PSU Outputs
PSU Outputs

The factory SMPS is a fairly straightforward 18v 12A unit, with only a single small oddity: the desoldering gun’s heating element is controlled from inside the supply.

Iron MOSFET
Iron MOSFET

Next to the output rectifier on the heatsink is a large MOSFET, in this case a STP60NF06 from ST Micro. This is a fairly beefy FET at 60v & 60A capacity, RDS On of <0.016Ω.
This is driven via an opto-isolator from the main logic board. I’ve not yet looked at the waveform on the scope, but I suspect this is also being PWM’d to control temperature better when close to the set point.

Iron Element Controller
Iron Element Controller

Rather than fire up the soldering iron & build a new element controller circuit (Lazy Mode™), I opted to take a saw to the original power supply. I cut the DC output section of the PCB off the rest of the supply & attached this piece back to the frame of the base unit. I also added a small heatsink to the MOSFET to make sure it stays cool.

12v Power Supply
12v Power Supply

Since the fan & vacuum pump are both already 12v rated, those are connected directly to the DC input socket, that I’ve installed in place of the original IEC mains socket. The 18v for the heating element is generated by a 10A DC-DC converter, again from eBay.

Oddly, the iron itself is rated at 24v 80W, but the factory supply is only rated to 18v. I’m not sure why they’ve derated the system, but as the station already draws up to 10A from a 13.8v supply, increasing the voltage any further would start giving my DC supplies a problem, so it can stay at 18v for now.

Posted on 3 Comments

Duratool ZD-915 Vacuum Desoldering Station Teardown

For a long time I’ve needed a decent vacuum desoldering tool, as I do much stripping of old PCBs for random parts.
Solder wick works well for most things, but it’s expensive & can be fiddly. It also doesn’t keep very long as the copper braid oxidises & after that point it never seems to work particularly well, even when soaked in fresh flux.

Desoldering Station
Desoldering Station

As usual eBay to the rescue! I managed to pick this one up for £80.

Vacuum Pump
Vacuum Pump

Removing the lid reveals the internals. Front & centre is the vacuum pump, with the mains supply behind it. There’s also a very noisy cooling fan at the back. Not sure why since the unit never gets warm enough to actually warrant a fan.

PSU
PSU

On the other side is the PSU. This is an 18v 12A rated SMPS, with a bit of custom electronics for controlling the iron element. Mounted to the back case is a small black box, more to come on this bit.

PSU Board
PSU Board

Cracking the case of the PSU reveals a pretty bog-standard SMPS, with a surprising amount of mains filtering for a Chinese supply. The DC outputs are on the right.

20160101_111613

From the rail markings, this is clearly designed to output some more voltage rails – possibly for other models of unit. In this case though, a single 18v rail is present. The iron’s element connects directly to the supply, controlled via an opto-isolated MOSFET.

Chinese Voltage Regulation
Chinese Voltage Regulation

As both the fan & the vacuum pump motor are 12v devices, some provision had to be made to reduce the 18v from the power supply to a more reasonable value. Inside the black plastic box are a pair of 1Ω 5W power resistors, connected in series. The output from this connects to the fan & vacuum pump. Because cheap, obviously.

Controller
Controller

Finally, here’s the controller PCB, the main MCU is an 8081 derivative, with a Holtek HT1621B LCD controller for the front panel temperature readout. Iron temperature is achieved by a thermocouple embedded in the heater, I imagine the potentiometer on the left side of the PCB is for calibration.

Posted on 2 Comments

Roku LT Teardown

 

Roku LT
Roku LT

Here’s another retired piece of tech that we used to route media from the NAS to the main TV. It was retired since it’s inability to support XBMC/Kodi & having some crashing issues.

Main PCB
Main PCB

After attacking the case with the screwdriver (Torx in this case), the main board comes out. The CPU in this looks *very* familiar, being a PoP device. There are unpopulated places for an ethernet interface & USB port here.

Flash & CPU
Flash & CPU

After a little digging is turns out the CPU in this device is a BCM2835, with 256MB of RAM stacked on top. It’s a Raspberry Pi! Even the unpopulated part for Ethernet is the same SMSC LAN9512!
There’s 32MB of Flash for the software below the CPU.
On the far right of the board is a Broadcom BCM59002IML Mobile Power Management IC.

WiFi Chipset
WiFi Chipset

On the bottom of the PCB is the WiFi chipset, a Broadcom BCM4336, this most likely communicates with the CPU via SDIO. There’s also a section below for a Bluetooth chipset.

 

Posted on Leave a comment

Pancake Vibration Motor Teardown

For a while I’ve wondered how these pancake type (AKA “Shaftless”) vibration motors operate, so I figured I’d mutilate one to find out.

Pancake Vibration Motor
Pancake Vibration Motor

These vibrators are found in all kinds of mobile devices as a haptic feedback device, unlike older versions, which were just micro-sized DC motors with an offset weight attached to the shaft, these don’t have any visible moving parts.

Cover Removed
Cover Removed

These devices are crimped together, so some gentle attack with a pair of snips was required to get the top cover off.
It turns out these are still a standard rotary DC motor, in this case specifically designed for the purpose. The rotor itself is the offset weight, just visible under the steel half-moon shaped section are the armature coils.

Weighted Rotor
Weighted Rotor

The armature lifts off the centre shaft, the coils can clearly be seen peeking out from under the counterweight.

Commutator
Commutator

The underside of the armature reveals the commutator, which in this device is just etched onto the PCB substrate, the connections to the pair of coils can be seen either side of the commutator segments.

Brushes
Brushes

The base of the motor holds the brushes in the centre, the outer ring is the stationary permanent magnet. These brushes are absolutely tiny, the whole motor is no more than 6mm in diameter.

Posted on Leave a comment

Quickie Teardown – ShopGuard Anti-Theft Tag

ShopGuard Anti-Theft Tag
ShopGuard Anti-Theft Tag

Everyone at some stage must have seen these EAS security tags in shops, usually attached to clothing with a steel pin. As some of this year’s presents had been left with the tags attached, I had to forcibly remove them before wrapping could commence.

Reverse Side
Reverse Side

These are just a plastic disc about 50mm in diameter, with an internal locking mechanism & RF tag inside.

RF Coil
RF Coil

After some careful attack with a saw around the glue seam, the tag comes apart into it’s halves. The RF coil & it’s ceramic capacitor can be seen wrapped around the outside of the tag. The capacitor in this case isn’t even epoxy dipped to save that extra 0.0001p on the manufacturing price. In the top centre is the pin locking mechanism, enclosed in a small plastic pill.

Lock Pill
Lock Pill

Popping off the back cap of the lock shows it’s internals.

Ball Bearing Lock Assembly
Ball Bearing Lock Assembly

The lock itself is very simple. The centre section, held in place by a spring, carries 3 small ball bearings. The outer metal frame of the lock is conical in shape.

When the pin is pushed into the tag, the conical shape of the lock chamber causes the ball bearings to grab onto it, helped by the action of the spring that pushes the ball bearing carrier further into the cone.
This also means that any attempt to force the mechanism causes it to lock tighter onto the pin.
In normal operation, removal is achieved by a strong magnet that pulls the ball bearing carrier back slightly against it’s spring, allowing the pin to disengage & be pulled out.

This design is incredibly simple & cheap to make, and gains it’s locking strength from friction alone.

I would consider the RF coil being around the outer edge of the device a bit of a security risk – a quick chop with a sharp pair of wire cutters would disable the tag’s alarm functionality instantly. Making the coil slightly smaller & keeping it out of reach of the edge of the tag would help in this regard.

Posted on Leave a comment

Electronic Lighter – eBay Freebie

With a recent order from a Chinese seller on eBay, this little gadget was included in the package as a freebie:

Electronic Lighter
Electronic Lighter

I’ve not smoked for a long time, so I’m not too sure what use I’m going to find for this device, but it’s an electronic lighter!

Pyromaniac Mode
Pyromaniac Mode

Pushing the slider forward reveals a red-hot heater, mounted in the plastic (!) frame.

Charging Mode
Charging Mode

Pushing the other way reveals a USB port to charge the internal battery.

Core Removed
Core Removed

A couple of screws releases the end cap from the cover & the entire core unit slides out. Like all Chinese toys it’s made of the cheapest plastic imaginable, not such a good thing when heat is involved.

Heating Element
Heating Element

The element itself is a simple coil of Nichrome wire, crimped to a pair of brass terminals. The base the heater & it’s terminals are mounted to is actually ceramic – the surround though that this ceramic pill clips into is just the same cheap plastic. Luckily, the element only remains on for a few seconds on each button push, there’s no way to keep it on & start an in-pocket fire, as far as I can see.

Main PCB
Main PCB

The main PCB clips out of the back of the core frame, the large pair of tinned pads on the left connect to the heater, the control IC has no numbering of any kind, but considering the behaviour of the device it’s most likely a standard eCig control IC.

LiPo Cell
LiPo Cell

The other side of the board has the USB port on the right, the Lithium Polymer cell in the centre, and the power button on the left. The cell itself also has no marking, but I’m guessing a couple hundred mAh from the physical size.

 

Posted on Leave a comment

LB-Link USB Wireless-N Adaptor Teardown

I needed a decent WiFi adaptor for my latest Pi LCD project, so after trawling eBay for cheapy USB adaptors, I found this one.

USB WiFi Dongle
USB WiFi Dongle

Unlike most USB WiFi radios these days, it actually has a proper RP-SMA antenna connector, not the low-gain built in jobbies that never seem to work too well.
There are a few versions of this adaptor, all of which seem to use the same casing, there’s a button push cut into the plastic for a WPS button that doesn’t exist on this model. This is fine, as I don’t enable WPS on any of my network equipment anyway. (It’s insecure, and can be cracked in minutes).

MAC Address
MAC Address

Here’s the rest of the essential details, the model is BL-LW08-AR, rated at 300Mbit/s.

PCB Reverse
PCB Reverse

Here’s the PCB removed from the casing, there are a pair of PCB antennas on here, but they’re not connected to the RF circuitry in this model, the links are missing.

Chipset
Chipset

The chipset used is a Realtek RTL8191SU, there isn’t much more in this device, as it’s all built into the silicon.

 

Posted on 2 Comments

Fire Angel CO-9D Carbon Monoxide Detector Teardown

Fire Angel CO-9D CO Detector
Fire Angel CO-9D CO Detector

This detector has now been retired from service since it’s a fair bit out of date. So here’s the teardown!

Information
Information

Unlike older detectors, this unit has a built in battery that never needs replacing during the life of the sensor, so once the unit reaches it’s expiry date it’s just trashed as a whole.

Cover Removed
Cover Removed

4 screws hold the cover on, here’s the internals of the detector. There’s a 3v CR123A LiMnO² cell at the right for power, rated at 1500mAh. A 7 year life is quite remarkable on a single cell!
The sensor is just to the left of the lithium cell, and is of quite unusual construction. Previous CO sensor cells I’ve seen have been small cylinders with a pair of brass pins. This one appears to use a conductive plastic as the connections. These sensors contain H²SO⁴ so they’re a bit hazardous to open.
There are no manufacturer markings on the sensor & I’ve not been able to find any similarly shaped devices, so I’m unsure of it’s specifications.
The alarm sounder is on the left, the usual Piezo disc with a resonator to increase the loudness.

Microcontroller
Microcontroller

The brains of the device are provided by a Microchip PIC16F914 microcontroller. This is a fairly advanced device, with many onboard features, and NanoWatt™ technology, standby power consumption is <100nA according to Microchip’s Datasheet. This would explain the incredible battery life.
The choke just at the right edge of the photo is actually a transformer to drive the Piezo sounder at high voltage.

PCB Reverse
PCB Reverse

Here’s the PCB with the LCD frame removed. Not much to see on the this side, the silence/test button top right & the front end for the sensor.

Sensor Front End Amplifier
Sensor Front End Amplifier

Here’s a closer look at the front end for the CO sensor cell itself. I haven’t been able to decode the SMT markings on the SOT packages, but I’m guessing that there’s a pair of OpAmps & a voltage reference.