Microchip – Experimental Engineering

Posted on July 1, 2016June 27, 2016 by The Engineer — Leave a comment

Sony Xperia Z3 50% Battery Problems

Recently my phone decided it was going to die a battery-related death, and having not found much useful information on the Great Google, (all the information I could find, was hinting at many issues from firmware to a faulty motherboard, nobody seems to have actually done any investigation into similar issues), I decided to dig into the phone to try & repair the problem.

The phone would work correctly for a while, then with the slightest movement or knock, would spontaneously switch off, and not turn back on without being whacked on a hard surface.
This symptom pointed me at a power connection problem. After removing the back of the phone (glass & heavily glued in place, so an awkward process), This was what I was presented with on the cell flex PCB.
In the above photo, the positive connection to the flex is fractured just after the solder joint with the BMS board.

I managed to scrape some of the insulation off the flex PCB & solder a jumper on to restore power. Unfortunately, this repair generated another fault, where the battery level was always shown at 50%, and plugging into a USB supply wouldn’t charge the phone. The other two pins on the cell are for communication & temperature sensing, clearly one of these traces was also broken in the flex.
The above photo has a pair of very small wire tails as well, for connecting an external charger.

Here’s a screenshot of the phone with the original cell, even though it’s at about 4.15v (virtually fully charged). The battery management is having trouble talking to the phone, so for safety reasons, the charging logic refuses point-blank to charge the thing up.

The connector on the cell & phone motherboard is absolutely tiny, so I didn’t fancy attempting to solder on any bridge wires to try & bypass the broken flex.

The cell BMS has some intelligence on board, besides the usual over-current, over-charge & under-charge protection. The very small IC on the right has a Microchip logo, and the marking FT442, but I was unable to dig up any datasheets. The current sense resistor is directly connected to this IC, along with the main power FET to the left.

On the other side of the BMS board is another IC, again unidentifiable, and what looks like a bare-die, or CSP IC.

At this stage I figured the only way forward was to buy a new battery, eBay turned one up for less than £5. Above is the new battery fitted to the phone, datestamped 2014, so definitely old stock.

Booting the phone with the new battery quickly lets me know the fix worked, with a 100% reading & the ability to again charge properly!

Posted on March 3, 2016 by The Engineer — 61 Comments

Dyson DC35 “Digital” Teardown

Here’s another Dyson teardown, in my efforts to understand how marketing have got hold of relatively simple technology & managed to charge extortionate amounts of money for it.
This is the DC35, the model after the introduction of the ~~brushless~~ digital motor.

On this version the mouldings have been changed, and the back cover comes off, after removing the battery retaining screw. It’s attached with some fairly vicious clips, so some force is required. Once the cap is removed, all the electronics are visible. On the left is the motor itself, with it’s control & drive PCB. There’s another PCB on the trigger, with even more electronics. The battery connector is on the right.

Here’s the trigger PCB, which appears to deal with DC-DC conversion for powering the brush attachments. The QFN IC with yellow paint on it is an Atmel ATTiny461 8-bit microcontroller. This is probably controlling the DC-DC & might also be doing some battery authentication.

Here’s the motor & it’s board. The windings on the stator are extremely heavy, which makes sense considering it’s rated at 200W. The main control IC is a PIC16F690 from Microchip. Instead of using an off the shelf controller, this no doubt contains software for generating the waveforms that drive the brushless motor. It also appears to communicate with the other PCBs for battery authentication.

Desoldering the board allows it to be removed from the motor itself. The pair of windings are connected in anti-phase, to create alternating North-South poles depending on polarity. Since the existing controller is unusable due to software authentication with the other parts, I might have a go at building my own driver circuit for this with an Arduino or similar.

The blower assembly is simple plastic mouldings, pressed together then solvent welded at the seam.

The impeller is just a centrifugal compressor wheel, identical to what’s used in engine turbochargers.

The inside face of the control PCB holds the 4 very large MOSFETs, IRFH7932PbF from International Rectifier. These are rated at 30v 20A a piece, and are probably wired in a H-Bridge. There’s a bipolar Hall switch to sense rotor position & rotation speed, and an enormous pair of capacitors on the main power bus.

Not much on the other side of the PCB other than the microcontroller and associated gate drive stuff for the FETs.

The battery pack is similar to the DC16 in it’s construction, a heavily clipped together plastic casing holding 6 lithium cells. In this one though there’s a full battery management system. The IC on the top of the board above is a quad Op-Amp, probably for measuring cell voltages.

The other side of the BMS board is packed with components. I wasn’t able to identify the QFN IC here, as it’s got a custom part number, but it’s most definitely communicating with the main motor MCU via I²C over the two small terminals on the battery connector.

Posted on July 25, 2015 by The Engineer — Leave a comment

Uniden UBC92XLT Teardown

One bit of my equipment that I’ve never looked into is my scanner, a handheld Uniden unit. I got this when Maplin Electronics had them on special offer a few years ago.

Here’s the scanner itself, roughly the same size as a usual HT.

Here the back cover has been removed, and the main RF board is visible at the top of the stack. Unfortunately the shielding cans are soldered on this unit, so no looking under there 🙁
On the right hand side of the board next to the antenna input is the main RF filter network, and it’s associated switching. The RF front end is under the shield closest to the front edge.

On the other side of the PCB is the Volume & Squelch potentiometers, along with a dedicated 3.3v switching supply. An NJM2360A High Precision DC/DC converter IC controls this one. A 3.3v test point is visible next to the regulator.

Here’s the backside of the RF board, some more interesting parts here. There’s a pair of NJM3404A Single Supply Dual Op-Amp ICs, and a TK10931V Dual AM/FM IF Discriminator IC. This is the one that does all the back-end radio functionality. The audio amplifier for the internal speaker & external headphone jack is also on this PCB, top left. A board-to-board interconnect links this radio board with the main control board underneath.

Here’s the front of the control PCB, nothing much to see here, just the LCD & membrane keypad contacts.

And here’s the reverse side of the control board. All the interesting bits are here. The main microcontroller is on the right, a Renesas M38D59GF, a fairly powerful MCU, with onboard LCD drive, A/D converter, serial interface, 60K of ROM & 2K of RAM. It’s 6.143MHz clock crystal is just below it.
The mating connector for the RF board is in the centre here.

There is also a Microchip 24LC168 16KB I²C EEPROM next to the main microcontroller. This is probably for storing user settings, frequencies, etc.

The rest of this board is dedicated to battery charging and power supply, in the centre is a dual switching controller, I can’t figure out the numbers on the tiny SOT23 components in here, but this is dealing with the DC 6v input & to the left of that is the circuitry for charging the NiMH cells included with the scanner.

The last bit of this PCB is a BU2092FV Serial In / Parallel Out 4 channel driver. Not sure what this one is doing, it might be doing some signal multiplexing for the RF board interface. Unfortunately the tracks from this IC are routed on the inner layers of the board so they can’t be traced out.