The other day I was given a random pile of car electronic parts from the scrap bin at the local garage, so I decided to do a few teardowns. This first one is a Temic Central Locking / Immobiliser module from a Mercedes van. Judging by the 125kHz stamped on the label, this also has RFID capability.
PCB
The casing just unclips, revealing the PCB. Surprisingly for an automotive module, there is no conformal coating on this (they’re usually heavily coated in protective lacquer to prevent moisture ingress).
Microcontroller
The large IC from Motorola I’m assuming to be a microcontroller, but I didn’t manage to find anything from the markings. There’s not much else in here apart from some glue logic, and what I think is the 125Khz toroidal antenna in the top left corner.
I was recently given a pretty nice LED backlit 1080p LG monitor, with the instruction that it wouldn’t power on correctly. The monitor would power on as far as the standby light, but when fully powered on, would flash the backlight momentarily then shut down. A power supply issue was immediately suspected.
LCD Logic Board
I popped the covers off the monitor itself first, thinking that it was an electrolytic gone bad in the backlight DC-DC converter. Not to mention the fact that cracking into a wall-wart type of PSU is only occasionally possible without the use of anger & large hammers. (Cracking the glue with the handle of a screwdriver doesn’t work so well when the factory went a bit nuts with the glue/ultrasonic welder). As can be seen in the photo, there’s not much inside these monitors, the logic is a single-chip solution, the rest of the PCB is dedicated to supplying the power rails for the various circuits. On the left is the power input & the DC-DC converter for the backlight, along with the DC-DC converter supplying the logic circuits. None of the capacitors here are damaged, everything looks good.
I then measured the output of the PSU, which under no load was the correct 19v DC. However applying any load caused the output voltage to drop like a proverbial brick. Applying a full load of 1.3A saw the output voltage drop so severely that the PSU tripped on it’s UVLO.
200mA Load
At 200mA of load the factory PSU is already dropping to 18v, with a 5.3kHz switching frequency appearing.
500mA Load
At higher load the frequency increases to 11.5kHz & the output voltage has dropped to 11.86v!
750mA Load
750mA was as high as I could make the supply go without it tripping itself out – the UVLO circuit trips at 9v. 12.6kHz is now riding on the severely low DC at this point.
PSU Ratings
The power supply is supposed to be rated at 1.3A at 19v, however with this fault it’s getting nowhere near that. The LG brand is on this PSU but it’s contracted out to Shenzen Honor Electric Co. Ltd.
Output Electrolytic
Here’s the problem with this PSU. The output electrolytic has ballooned. I don’t have an ESR tester, but this cap has gone way past it’s sell-by date. It’s position right next to the heatsink with the output rectifier diodes has probably cooked it. The PSU isn’t that badly built for a Chinese one – there’s plenty of creepage distance on the PCB & even a couple of isolation slots.
Well it’s time for a new DMM. After the last pair of eBay El-Cheapo Chinese meters just didn’t last very well, I decided a proper meter was required. This one is a Tenma 72-10405, stocked by Farnell for under £60. Not quite as many festures as the cheapo Chinese meters, but I expect this one to be a bit more reliable.
PCB Rear
Since I can’t have anything without seeing how it’s put together, here’s the inside of the DMM. (Fuse access is only possible by taking the back cover off as well. The 9v PP3 battery has a seperate cover).
PCB Rear Bottom
He’s the input section of the meter, with the 10A HRC fuse & current shunt for the high-amps range. The other fuse above is for the mA/µA ranges. The back cover has a wide lip around the edge, that slots into a recess in the front cover, presumably for blast protection if the meter should meet a sticky end. The HRC fuses are a definite improvement over the cheap DMMs, they only have 15mm glass fuses, and no blast protection built into the casing.
There are some MOVs for input protection on the volts/ohms jack, the jacks themselves are nothing more than stampings though.
PCB Rear Top
Not much at the other side of the board, there’s the IR LED for the RS232 interface & the beeper.
PCB Front
Most of the other components are on the other side of the PCB under the LCD display. The range switch is in the centre, while the main chipset is on the left.
DMM Chipset
The chipset of this meter is a FS9922-DMM3 from Fortune Semiconductor, this is a dedicated DMM chipset with built in ADCs & microcontroller.
Time foe some more retro tech! This is a 1980’s vintage CCD-based VHS camcorder from Panasonic, the NV-M5. There are a lot of parts to one of these (unlike modern cameras), so I’ll split this post into several sections to make things easier to read (and easier to keep track of what I’m talking about :)).
Left Side
The left side of the camera holds the autofocus, white balance, shutter speed & date controls.
Left Side ControlsLens Adjustments
The lens is fully adjustable, with either manual or motorized automatic control.
Rear Panel
The back panel has the battery slot, a very strange looking DC input connector, remote control connector & the earphone jack.
Top Controls
The top panel of the camera holds the main power controls, manual tape tracking & the tape transport control panel.
Viewfinder
The viewfinder is mounted on a swivel mount. There’s a CRT based composite monitor in here. Hack ahoy!
Camera Section
Process Board Assembly
Here’s the camera section of the camcorder, and is totally packed with electronics! There’s at least half a dozen separate boards in here, all fitted together around the optics tube assembly.
AWB PCB
On the top of the assembly is the Automatic White Balance PCB. Many adjustments here to get everything set right. Not much on the other side of this board other than a bunch of Op-Amps. The iris stepper motor is fitted in a milled opening in the PCB, this connects to one of the other PCBs in the camera module.
AWB Sensor
Here’s the AWB sensor, mounted next to the lens. I’m not all to certain how this works, but the service manual has the pinout, and there are outputs for all the colour channels, RGB. So it’s probably a trio of photodiodes with filters.
Focus & Zoom Motors
Focus & Zoom are controlled with a pair of DC gear motors. The manual operation is feasible through the use of slip clutches in the final drive pinion onto the lens barrel.
Process Board
The main camera section process board is above. This board does all the signal processing for the CCD, has the bias voltage supplies and houses the control sections for the motorized parts of the optics assembly. There are quite a few dipped Tantalum capacitors on pigtails, instead of being directly board mounted. This was probably done due to space requirements on the PCB itself.
Under the steel shield on this board is some of the main signal processing for the CCD.
Optics Assembly
The back of the optics tube is a heavy casting, to supress vibration. This will be more clear later on.
Position Sensor Flex
The position of the lens elements is determined by reflective strips on the barrel & sensors on this flex PCB.
Sub Process Board
There’s another small board tucked into the side of the tube, this hooks into the process PCB.
Process Delay Line
According to the schematic, there’s nothing much on this board, just a delay line & a few transistors.
Piezo Focus Disc
Here’s the reason for the heavy alloy casing at the CCD mounting end of the optics: the fine focus adjustment is done with a piezoelectric disc, the entire CCD assembly is mounted to this board. Applying voltage to the electrodes moves the assembly slightly to alter the position of the CCD. The blue glass in the centre of the unit is the IR filter.
IR Relective Sensors
The barrel position sensors are these IR-reflective type.
Iris Assembly
The iris is mounted just before the CCD, this is controlled with a galvanometer-type device with position sensors incorporated.
Iris Opening
Pushing on the operating lever with the end of my screwdriver opens the leaves of the iris against the return spring.
Tape Transport & Main Control
Main Control Board
Tucked into the side of the main body of the unit is the main system control board. This PCB houses all the vital functions of the camera: Power Supply, Servo Control, Colour Control,Video Amplifiers, etc.
Tape Drum
Here’s the main tape transport mechanism, this is made of steel & aluminium stampings for structural support. The drum used in this transport is noticeably smaller than a standard VHS drum, the tape is wrapped around more of the drum surface to compensate.
Tape Transport
The VHS tape sits in this carriage & the spools drive the supply & take up reels in the cartridge.
Main Control PCB
Here’s the component side of the main control PCB. This one is very densely packed with parts, I wouldn’t like to try & troubleshoot something like this!
Main PCB Left
The left side has the video head amp at the top, a Panasonic AN3311K 4-head video amp. Below that is video processing, the blue components are the analogue delay lines. There are a couple of hybrid flat-flex PCBs tucked in between with a couple of ICs & many passives. These hybrids handle the luma & chroma signals.
Top left is the capstan motor driver a Rohm BA6430S. The transport motors are all 3-phase brushless, with exception of the loading motor, which is a brushed DC type.
Delay Line
Here’s what is inside the delay lines for the analogue video circuits. The plastic casing holds a felt liner, inside which is the delay line itself.
Internal Glass
The delay is created by sending an acoustic signal through the quartz crystal inside the device by a piezoelectric transducer, bouncing it off the walls of the crystal before returning it to a similar transducer.
Main PCB Centre
Here’s the centre of the board, the strange crystal at bottom centre is the clock crystal for the head drum servo. Why it has 3 pins I’m not sure, only the two pins to the crystal inside are shown connected on the schematic. Maybe grounding the case?
The main servo controls for the head drum & the capstan motor are top centre, these get a control signal from the tape to lock the speed of the relative components.
Main PCB Right
Here’s the right hand side. The main power supply circuitry is at top right, with a large can containing 4 switching inductors & a ferrite pot core transformer. All these converters are controlled by a single BA6149 6-channel DC-DC converter controller IC via a ULN2003 transistor array.
The ceramic hybrid board next to the PSU has 7 switch transistors for driving various indicator LEDs.
The large tabbed IC bottom centre is the loading motor drive, an IC from Mitsubishi, the M54543. This has bidirectional DC control of the motor & built in braking functions. The large quad flat pack IC on the right is the MN1237A on-screen character generator, with the two clock crystals for the main microcontroller.
Erase Head
The full erase head has it’s power supply & oscillator on board, applying 9v to this board results in an AC signal to the head, which erases the old recording from the tape before the new recording is laid down by the flying heads on the drum.
Audio Control PCB
The Audio & Control head is connected to this PCB, which handles both reading back audio from the tape & recording new audio tracks. The audio bias oscillator is on this board, & the onboard microphone feeds it’s signal here. The control head is fed directly through to the servo section of the main board.
Drum Motor
The motor that drives the head drum is another DC brushless 3-phase type.
Hall Sensors
These 3 Hall sensors are used by the motor drive to determine the rotor position & time commutation accordingly.
Stator
The stator on this motor is of interesting construction, with no laminated core, the coils are moulded into the plastic holder. The tach sensor is on the side of the stator core. This senses a small magnet on the outside of the rotor to determine rotational speed. For PAL recordings, the drum rotates at 1500 RPM.
Motor Removed
Not much under the stator other than the bearing housing & the feedthrough to the rotary transformer.
Head Disc
The heads are mounted onto the top disc of the drum, 4 heads in this recorder. The signals are transmitted to the rotating section through the ferrite rotary transformer on the bottom section.
Head Chip
The tiny winding of the ferrite video head can just about be seen on the end of the brass mounting.
Capstan Motor Components
The capstan motor is similar to the drum motor, only this one is flat. The rotor has a ferrite magnet, in this case it wasn’t glued in place, just held by it’s magnetic field.
Capstan Motor Stator
The PCB on this motor has a steel backing to complete the magnetic circuit, the coils for the 3 motor phases are simply glued in place. The Hall sensors on this motor are placed in the middle of the windings though.
Again there is a tach sensor on the edge of the board that communicates the speed back to the controller. This allows the servo to remain locked at constant speed.
Viewfinder
Viewfinder Assembly
As usual with these cameras, this section is the CRT based viewfinder. These units take the composite signal from the camera to display the scene. This one has many more pins than the usual viewfinder. I’ll hack a manual input into this, but I’ll leave that for another post.
Viewfinder Circuits
Being an older camera than the ones I’ve had before, this one is on a pair of PCBs, which are both single-sided.
Main Viewfinder Board
The main board has all the power components for driving the CRT & some of the adjustments. The main HV flyback transformer is on the right. This part creates both the final anode voltage for the tube & the focus/grid voltages.
Viewfinder Control PCB Top
The viewfinder control IC is on a separate daughter board in this camera, with two more controls.
Control IC
The control IC is a Matsushita AN2510S, this has all the logic required to separate the sync pulses from the composite signal & generate an image on the CRT.
Viewfinder CRT Frame
The recording indicator LEDs are mounted in the frame of the CRT & appear above the image in the viewfinder.
Viewfinder CRT With Yoke
Here the CRT has been separated from the rest of the circuitry with just the deflection yoke still attached.
M01JPG5WB CRT
The electron gun in this viewfinder CRT is massive in comparison to the others that I have seen, and the neck of the tube is also much wider. These old tubes were very well manufactured.
Viewfinder Optics
A simple mirror & magnifying lens completes the viewfinder unit.
Here’s a useful buck-boost DC-DC converter from eBay, this one will do 36v DC at 6A maximum output current. Voltage & current are selected on the push buttons, when the output is enabled either the output voltage or the output current can be displayed in real time.
Display PCB
Here’s the display PCB, which also has the STM32 microcontroller that does all the magic. There appears to be a serial link on the left side, I’ve not yet managed to get round to hooking it into a serial adaptor to see if there’s anything useful on it.
Display Drive & Microcontroller
The bottom of the board holds the micro & the display multiplexing glue logic.
Main PCB
Not much on the mainboard apart from the large switching inductors & power devices. There’s also a SMPS PWM controller, probably being controlled from the micro.
These solar flowers were being sold off at my local Tesco, a pair of them appeared thanks to my child 😉
They have a small solar panel on top, when they’re exposed to bright light, the flower & leaves move as if they’re being blown in a breeze.
Since one of them didn’t work, I figured I’d tear it down.
Solar Cell
The solar cell on the top is similar if not identical to that used on a cheap calculator.
Controller
Not much to the control PCB. Just an electrolytic for smoothing the DC coming from the solar cell & a COB IC.
Electromagnet Coil
The IC drives this coil of extremely fine wire, glued to the base of the housing. Attached to the green plastic arm should be a magnet – this one has never worked as the magnet is missing. at 50p a piece, a magnet would cost me more than the whole device. So it’s the bin for this one.
Here’s an oddity from the 1980’s – a CRT-based portable TV, with a very strangely shaped tube. Sony produced many types of flat CRTs back in the 80’s, with the electron gun at 90° to the curved phosphor screen.
Front Panel
The front panel has the display window, along with the tuning & volume indicators. Unfortunately since analogue TV transmissions have long been switched off, this unit no longer picks up any transmissions off the air, but it can be modified to accept a composite video input.
Back Panel
The back panel has the battery compartment & the tilt stand.
Certification
The certification label reveals this unit was manufactured in May 1984, 32 years ago!
Spec. Label
Rated at 6v, ~2.1W this device uses surprisingly little power for something CRT based.
Battery Holder
The battery holder is a little unique, this plastic frame holds 4 AA cells, for a 6v pack.
Battery Compartment
The battery holder slots into the back of the TV, there’s also an extra contact that the service manual mentions is for charging, so I assume a rechargeable 6v battery pack was also available.
Front Panel Removed
Removing a pair of pin-spanner type screws allows the front glass & screen printed CRT surround to be removed. Not much more under here other than the pair of screws that retain the CRT in the front frame.
Back Cover Removed
Here’s the back cover removed, after unscrewing some very small screws. As per usual with Sony gear, the electronics is extremely compacted, using many flat flex cables between the various PCBs. The main PCB is visible at the back, this has all the deflection circuitry, RF tuner, Video IF, Audio IF, video amplifier & composite circuitry.
CRT Electron Gun & Flyback Transformer
Lifting up the main board reveals more PCBs – the high voltage section for the CRT with the flyback transformer, focus & brightness controls is on the left. The loudspeaker PCB is below this. The CRT electron gun is tucked in behind the flyback transformer, it’s socket being connected to the rest of the circuitry with a flat flex cable.
CRT Rear
Here’s the back of the CRT, the phosphor screen is on the other side of the curved glass back. These tubes must require some additional deflection complexity, as the geometry will change as the beam scans across the screen. There’s a dynamic focus circuit on the schematics, along with extensive keystone adjustments.
Sony 02-JM Flat CRT
Here’s the tube entirely extracted from the chassis. The EHT connection to the final anode is on the side of the tube bell, the curved phosphor screen is clearly visible. The one thing I can’t find in this CRT is a getter spot, so Sony may have a way of getting a pure enough vacuum that one isn’t required.
I’d expect the vertical deflection waveforms to be vastly different on this kind of CRT, due to the strange screen setup. Not much of a beam movement is required to move the spot from the top to the bottom of the screen.
HV Module
No doubt to keep the isolation gaps large, all the high voltages are kept on a separate small PCB with the flyback transformer. This board generates the voltages for the electron gun filament, focus grid & the bias to set the beam current (brightness) as well.
Bare CRT
Here the deflection yoke has been removed from the CRT, showing the very odd shape better. These tubes are constructed of 3 pieces of glass, the bell with electron gun, back glass with phosphor screen & front viewing window glass. All these components are joined with glass frit.
Electron Gun
The electron gun in the neck looks to be pretty much standard, with all the usual electrodes.
Viewing Window
Here’s a view from the very top of the CRT, the curve in the screen is very obvious here. The electron beam emerges from the bell at the back.
FD-20 Schematic
Here’s the full schematic of the entire TV, I extracted this from a service manual I managed to find online.
More to come on hacking this unit to accept a standard composite video input, from something such as a Raspberry Pi!
Here’s a modern LED bulb, that unfortunately decided to disassemble itself within a few minutes of being installed in a light fitting! The base plastic snapped off the main aluminium body at the screw posts!
Input Rectifier
The PCB in the base holds nothing but the input components. Above is the bridge rectifier.
Fusible Resistor
The other side of the PCB has a 10Ω fusible resistor, for protection.
LED PCB
The LED PCB itself has the driver IC, which is a CYT3000A linear constant current IC, that runs direct from full-wave rectified mains. The single resistor sets the LED current, but there aren’t any smoothing capacitors on the DC rail, so this bulb would flicker a lot.
Another random teardown from the junk box time!
Here’s an old Motorola DECT landline phone, no use to me as I’ve not used a landline for many years.
Battery Compartment
Not much on the back, other than the battery compartment for a pair of AAA rechargables. The base unit contains the charger.
Main PCB
Here’s the main PCB removed from it’s casing. There’s not really much going on, one of the main ICs, which is probably a microcontroller, is a COB device, so no part numbers from there. There’s a row of pads for programming the device at the factory. The RF section is on a dedicated IC, a DE19RF19ZCNC from DSP Group. I couldn’t find much on this part, but it’s one of a range of DECT/VoIP DSP devices.
Base Unit PCB
Inside the base unit is a similar board, just without the keypad. Main microcontroller is again a COB device, the RF IC is under the shield.
Main Chipset
Removing the shield reveals the same IC as in the handset, only this PCB has a pair of antennas.
Time for another teardown! I managed to fish this Sky+ box out of a skip, but to protect the guilty, all serial numbers have been removed.
These are pretty smart devices, with DVR capability on board.
Ports 1
There’s a lot of ports on these units, from RS-232 serial, POTS modem, eSATA, HDMI, USB, Ethernet, SCART, Optical, digital outputs & even composite video.
Ports 2Ports 3Top Panel
Removing the top plastic cover reveals the operation buttons & the built in WiFi adaptor, which is USB connected to the main logic board.
Front Panel
The PCB on the front of the chassis has all the indicators, and the IR Receiver for the remote.
Cover Removed
Removing the top shield of the chassis reveals the innards. The PSU is on the top right, 500GB SATA disk drive in the bottom centre. The main logic PCB is top centre.
Logic PCB
Here’s the main logic PCB. The massive heatsink in the middle is cooling the main SoC, below.
SoC
The main SoC in this unit is a Broadcom BCM7335 HD PVR Satellite System-On-Chip. It’s surrounded by it’s boot flash, a Spansion GL512P10FFCR1 512Mbit NOR device. It’s also got some DRAM around the left edge.
Smart Card Reader
The smart card reader is on the PSU PCB, the controller here is an NXP TDA8024
PSU PCB
The PSU itself is a pretty standard SMPS, so I won’t go too far into that particular bit. The logic PCB attaches to the large pin header on the left of the PSU, some of the analogue video outputs are also on this board.
There’s also a Microchip PIC16F726 microcontroller on this PCB, next to the pin header. Judging by the PCB traces, this handles everything on the user control panel.
Power Supplies
Some local supplies are provided on the logic board for the main SoC, the IC in the centre here is an Allegro A92 DC-DC converter. I didn’t manage to find a datasheet for this one.
LNB Front End
The RF front end for the satellite input is a Broadcom BCM3445 Low Noise Amplifier & Splitter, again not much info on this one.
RS232 Section
The standard MAX232 is used for the serial interface. I imagine this is for diagnostics.
Modem
The POTS modem section is handled by a Si2457 System-Side device & Si3018 Line-Side device pair.
Here’s another Eberspacher control unit, this time from an ancient D5W 5kW water heater. The system in this case is just flaky – sometimes the heater will start without fault & run perfectly, then suddenly will stop working entirely.
The error codes are read on these very old units via an indicator lamp connected to a test terminal. In this case the code was the one for Overheat Shutdown.
Considering this fault occurs when the heater is stone cold, I figured it was either a fault with the sensor itself or the ECU.
Temperature Sensor
The temperature sensor is located on the heat exchanger, right next to the hot water outlet fitting. I’m not sure what the spec is, but it reads exactly 1KΩ at room temperature.
ECU PCB
The PCB is held into the aluminium can by means of crimps around the edge that lock into the plastic terminal cover. Inserting a screwdriver & expanding the crimps allows the PCB to be slid out.
Casing Crimps
The factory date stamp on the microcontroller dates this unit to March 1989 – considerably older than I expected!
Unlike the newer versions that use transistors, this ECU has a bunch of PCB relays to do the high current switching of the water pump motor, fan motor & glowplug.
Overall the board looks to be solidly constructed, with silicone around all the larger components.
ECU PCB Solder Side
Here’s the solder side of the PCB, which has a generous coating of sealant to keep moisture out.
Bad Joint Closeup
Looking at the solder joints for the row of relays on the top side of the PCB, it looks like that there’s some dry joints here.
I suspect that years of vibration has taken it’s toll, as the relays are otherwise unsupported. It wouldn’t be possible to use silicone to secure these devices as they are completely open – any sealant would likely stop them from operating.
Resoldered Joints
Using a very hot soldering iron I managed to get the joints to reflow properly, using lots of flux to make sure the conformal coating didn’t interfere with the reflow.
Recently my phone decided it was going to die a battery-related death, and having not found much useful information on the Great Google, (all the information I could find, was hinting at many issues from firmware to a faulty motherboard, nobody seems to have actually done any investigation into similar issues), I decided to dig into the phone to try & repair the problem.
Broken Flex
The phone would work correctly for a while, then with the slightest movement or knock, would spontaneously switch off, and not turn back on without being whacked on a hard surface.
This symptom pointed me at a power connection problem. After removing the back of the phone (glass & heavily glued in place, so an awkward process), This was what I was presented with on the cell flex PCB.
In the above photo, the positive connection to the flex is fractured just after the solder joint with the BMS board.
Flex Repair
I managed to scrape some of the insulation off the flex PCB & solder a jumper on to restore power. Unfortunately, this repair generated another fault, where the battery level was always shown at 50%, and plugging into a USB supply wouldn’t charge the phone. The other two pins on the cell are for communication & temperature sensing, clearly one of these traces was also broken in the flex.
The above photo has a pair of very small wire tails as well, for connecting an external charger.
50% Battery
Here’s a screenshot of the phone with the original cell, even though it’s at about 4.15v (virtually fully charged). The battery management is having trouble talking to the phone, so for safety reasons, the charging logic refuses point-blank to charge the thing up.
Flex Cable
The connector on the cell & phone motherboard is absolutely tiny, so I didn’t fancy attempting to solder on any bridge wires to try & bypass the broken flex.
Battery BMS
The cell BMS has some intelligence on board, besides the usual over-current, over-charge & under-charge protection. The very small IC on the right has a Microchip logo, and the marking FT442, but I was unable to dig up any datasheets. The current sense resistor is directly connected to this IC, along with the main power FET to the left.
BMS Reverse
On the other side of the BMS board is another IC, again unidentifiable, and what looks like a bare-die, or CSP IC.
At this stage I figured the only way forward was to buy a new battery, eBay turned one up for less than £5. Above is the new battery fitted to the phone, datestamped 2014, so definitely old stock.
100% Battery
Booting the phone with the new battery quickly lets me know the fix worked, with a 100% reading & the ability to again charge properly!
Since this phone has been in my drawer for some time, I figured it was time for a teardown. (It’s never going to see any more use).
The back cover on these phones is easily removed, as it’s just clipped on.
Motherboard
Once the back cover is removed, the Li-Polymer cell is exposed, along with the logic board. Pretty much all of the PCB is under RF shields.
Motherboard RemovedBattery Management
Under the small RF can on the back of the board is the battery management circuitry & the charger. There’s an extra connection to the cell for temperature monitoring. Just under that circuitry is the eMMC flash storage.
Just to the left of the battery circuit is the NFC transceiver IC, from NXP.
Battery Flex
The cell is connected to the main board with a FFC, with a very small SMT connector, although not as small as the more modern Xperia series phones.
RF Section
The other side of the mainboard holds the large RF transceiver section, with a Qualcomm RTR8600 multiband transceiver IC. In the bottom corner is a Skyworks SKY77351-32 Quad-band power amplifier IC, along with 3 other power amplifier ICs, also from Skyworks.
Gyro & Audio Codec
The top corner of the board holds the various sensors, including an Invensense MPU-3050 3-axis gyro. To the right of that is the Audio Codec, a WCD9310 from Qualcomm.
Logic & CPU Section
Everything is controlled from the last section on the board, with the main CPU & RAM in a PoP (Package-On-Package) configuration. Under the main CPU is the main power management IC, also from Qualcomm. No datasheet for this one unfortunately, but it gives it’s purpose away by being surrounded by large inductors & capacitors.
Here’s a useful tool for the kit, a digital angle gauge/protractor. These use a silicon sensor to show the number of degrees the unit is out of level.
Magnets!
Magnets are provided in the base, so the tool can attach to any ferrous surface.
Battery Box
Power is provided by a single AAA cell.
Main PCB
Removing the rear cover reveals the brains of the unit, and there’s not much to it at all. The main microcontroller is a CoB-type device, so no part numbers available from that one.
Sensing Element
The IC to the left of the main microcontroller is the sensing element. There’s no markings on this inclinometer IC so I’m not sure of the specs, but it will be a 3D-MEMS device of some sort.
Power Supply
The other side of the PCB has the power supply for the logic, and a serial EEPROM, probably storing calibration data.
When I ordered the tiny USB soldering iron, I decided a proper iron upgrade would be a good idea. Looking around for something that didn’t require AC mains power turned up the TS100, a Chinese design, that unusually is actually very good! Above is the handle itself, with it’s small OLED display & two operation buttons.
This iron is controlled by a STM32 ARM microcontroller, the firmware & schematics are completely open-source.
DC Input Jack / USB Port
The bottom end of the iron has the main DC input jack, designed with laptop chargers in mind (DC input range from 10v-24v). Above that is the micro USB port for programming.
Heating Element Socket
The iron tips slot into the other end, many different tip types & shapes are available. The one supplied was the simple conical tip.
Standby Screen
Plugging the iron into some power gets a standby screen – it doesn’t just start heating immediately, for safety.
Heating
The left hand button starts the heater, which on a 24v input voltage gets to operating temperature well within 10 seconds.
Temperature Stable
The right hand screen icon changes when the temperature has stabilized. The control PCB has an integrated accelerometer, leaving the iron hot for a few minutes triggers a timeout & it powers down. Once picked up again, the heater instantly restarts.
The operating temperature is adjustable with the pair of buttons, from 100°C to 400°C.
Different Bits
Here’s a selection of bits for the iron. The design is very similar to the Hakko T15 series of irons, but these are a much shorter version. Like the Hakko versions, the actual tips aren’t replaceable, once the bit burns out, the entire assembly is replaced.
TS100 Soldering Iron
Here’s the iron fully assembled. The entire device is about the same length as just the heating element from a Hakko T15!
Magnetic tape is the medium of choice for my offline backups & archives, as it’s got an amazing level of durability when in storage. (LTO Has a 30 year archival rating).
For the smaller stuff, like backing up the web server this very site runs on, another format seemed to suit better. Above is a HP DDS4 tape drive, which will store up to 40GB on a cassette compressed.
I picked this format since I already had some tapes, so it made sense.
Data Plate
Here’s the info for those who want to know. It’s an older generation drive, mainly since the current generation of tape backup drives are hideously expensive, while the older ones are cheap & plentiful. Unfortunately the older generation of drives are all parallel SCSI, which can be a expensive & awkward to set up. Luckily I already have other parallel SCSI devices, so the support infrastructure for this drive was already in place.
Option Switches
On the bottom of the drive is a bank of DIP switches, according to the manual these are for setting the drive for various flavours of UNIX operating systems. However it doesn’t go into what they actually change.
Controller PCB
The bottom of the drive has the control PCB. The large IC on the left is the SCSI interface, I’ve seen this exact same chip on other SCSI tape drives. Centre is a SoC, like so many of these, not much information available.
Drive Frame
Removing the board doesn’t reveal much else, just the bottom of the frame with the tape spool motors on the right, capstan motor bottom centre. The bottom of the head drum motor is just peeping through the plastic top centre.
Head Drum
Here’s the head drum itself. These drives use a helical-scan flying head system, like old VHS tape decks. The top of the capstan motor is on the bottom right.
Cleaning Brush
Hidden just under the tape transport frame is the head cleaning brush. I’m not sure exactly what this is made of, but it seems to be plastic.
Loading Motor
A single small DC motor with a worm drive handles all tape loading tasks. The PCB to the bottom left of the motor holds several break-beam sensors that tell the drive what position the transport is in.
Tape Transport Mech
Here’s the overall tape transport. The PCB on top of the head drum is a novel idea: it’s sole purpose in life is to act as a substrate for solder blobs, used for balancing. As this drum spins at 11,400RPM when a DDS4 tape is in the drive, any slight imbalance would cause destructive vibration.
Tape Transport
Here’s the drive active & writing a tape. (A daily backup of this web server actually). The green head cleaning brush can be better seen here. The drive constantly reads back what it writes to the tape, and if it detects an error, applies this brush momentarily to the drum to clean any shed oxide off the heads. The tape itself is threaded over all the guides, around the drum, then through the capstan & pinch roller.
Since the 4×18650 battery pack supplied with my Cree head torch is pretty shit, even by China’s standards, I figured something I could put my own cells into would be a better option. An eBay search turned up these battery boxes, not only with a direct battery output for my torch, but also a USB port for charging other devices when I’m low on charge.
LED Capacity Indicator
The output to the lamp connector is directly connected to the battery, through the usual Lithium Ion protection, but the USB output is controlled from a single power button. Battery charge condition is displayed on 3 LEDs. Not sure why they used blue silicone for the seal & then used green LEDs… But it does work, even if a little dim.
Label
Essential information. Does claim to be protected, and from the already existing electronics for the USB this would be expected in all but the cheapest crap.
An IP rating of IPX4 is claimed, yet just above that rating is a notice not to be used in water. Eh?
This is sealed with an O-Ring around the edge of the top cap & silicone seals around the cable & retaining screw. I did test by immersion in about 6″ of water, and it survived this test perfectly fine, no water ingress at all.
Interconnect Straps
The casing holds a PCB at the bottom end with the cell straps.
Screw Post
Someone wasn’t that careful at getting the brass screw insert properly centred in the injection mould when they did this one. It’s mushed off centre, but i’s solidly embedded & doesn’t present any problems to usability.
Cell Springs
The top cover holds the cell springs & the electronics.
Button & Cable Seal
Removing the pair of screws allows the top cap to open up. The cable, button & LEDs are robustly sealed off with this silicone moulding.
Top Removed
Here’s the PCB, not much on the top, other than the power button & battery indicator LEDs.
Electronics
Desoldering the cell springs allows the PCB to pop out of the plastic moulding. There’s more than I expected here!
Bottom left is a DC-DC converter, generating the +5v rail for the USB port, this is driven with an XL1583 3A buck converter IC.
Bottom right is the protection IC & MOSFETs for the Lithium Ion cells. I wasn’t able to find a datasheet for the tiny VA7022 IC, but I did manage to make certain it was a 7.4v Li-Ion protection IC.
Top right is a completely unmarked IC, and a 3.3v SOT-23 voltage regulator. I’m assuming that the unmarked IC is a microcontroller of some sort, as it’s handling more than just the battery level LEDs.
A pretty decent 4-core cable finishes the job off. For once there’s actually some copper in this cable, not the usual Chineseuim thin-as-hair crap.
Here’s another Dyson teardown, in my efforts to understand how marketing have got hold of relatively simple technology & managed to charge extortionate amounts of money for it.
This is the DC35, the model after the introduction of the brushless digital motor.
Back Cap Removed
On this version the mouldings have been changed, and the back cover comes off, after removing the battery retaining screw. It’s attached with some fairly vicious clips, so some force is required. Once the cap is removed, all the electronics are visible. On the left is the motor itself, with it’s control & drive PCB. There’s another PCB on the trigger, with even more electronics. The battery connector is on the right.
Trigger PCB
Here’s the trigger PCB, which appears to deal with DC-DC conversion for powering the brush attachments. The QFN IC with yellow paint on it is an Atmel ATTiny461 8-bit microcontroller. This is probably controlling the DC-DC & might also be doing some battery authentication.
“Digital Motor”
Here’s the motor & it’s board. The windings on the stator are extremely heavy, which makes sense considering it’s rated at 200W. The main control IC is a PIC16F690 from Microchip. Instead of using an off the shelf controller, this no doubt contains software for generating the waveforms that drive the brushless motor. It also appears to communicate with the other PCBs for battery authentication.
Stator
Desoldering the board allows it to be removed from the motor itself. The pair of windings are connected in anti-phase, to create alternating North-South poles depending on polarity. Since the existing controller is unusable due to software authentication with the other parts, I might have a go at building my own driver circuit for this with an Arduino or similar.
Blower Assembly
The blower assembly is simple plastic mouldings, pressed together then solvent welded at the seam.
Impeller
The impeller is just a centrifugal compressor wheel, identical to what’s used in engine turbochargers.
Motor Control Board
The inside face of the control PCB holds the 4 very large MOSFETs, IRFH7932PbF from International Rectifier. These are rated at 30v 20A a piece, and are probably wired in a H-Bridge. There’s a bipolar Hall switch to sense rotor position & rotation speed, and an enormous pair of capacitors on the main power bus.
Motor Control Board Reverse
Not much on the other side of the PCB other than the microcontroller and associated gate drive stuff for the FETs.
Battery Pack Opened
The battery pack is similar to the DC16 in it’s construction, a heavily clipped together plastic casing holding 6 lithium cells. In this one though there’s a full battery management system. The IC on the top of the board above is a quad Op-Amp, probably for measuring cell voltages.
Battery BMS Bottom
The other side of the BMS board is packed with components. I wasn’t able to identify the QFN IC here, as it’s got a custom part number, but it’s most definitely communicating with the main motor MCU via I²C over the two small terminals on the battery connector.
I recently came across these on eBay, so I thought I’d grab one to see how they function, with all the metrics they display, there’s potential here for them to be very useful indeed.
One of the best parts is that no wiring is required between the sensor board & the LCD head unit – everything is transmitted over a 2.4GHz data link using NRF24L01 modules.
Above is the display unit, with it’s colour LCD display. Many features are available on this, & they appear to be designed for battery powered systems.
Monitor PCB
Another PCB handles the current & voltage sensing, so this one can be mounted as close to the high current wiring as possible.
Monitor PCB Microcontroller
The transmitter PCB is controlled with an STM8S003F3 microcontroller from ST Microelectronics. This is a Flash based STM with 8KB of ROM, 1KB of RAM & 10-bit ADC. The NRF24L01 transceiver module is just to the left.
There’s only a single button on this board, for pairing both ends of the link.
Output MOSFET
The high current end of the board has the 0.0025Ω current shunt & the output switch MOSFET, a STP75NF75 75v 75A FET, also from ST Microelectronics. A separate power source can be provided for the logic via the blue terminal block instead of powering from the source being measured.
LCD Unit Rear
Here’s the display unit, only a pair of power terminals are provided, 5-24v wide-range input is catered for.
LCD Unit PCB
Unclipping the back of the board reveals the PCB, with another 2.4GHz NRF24L01 module, and a STM8S005K6 microcontroller in this case. The switching power supply that handles the wide input voltage is along the top edge of the board.
Unfortunately I didn’t get any instruction manual with this, so some guesswork & translation of the finest Chinglish was required to get my head round the way everything works. To make life a little easier for others that might have this issue, here’s a list of functions & how to make them work.
LCD Closeup
On the right edge of the board is the function list, a quick press of the OK button turns a function ON/OFF, while holding it allows the threshold to be set.
When the output is disabled by one of the protection functions, turning that function OFF will immediately enable the output again.
The UP/DOWN buttons obviously function to select the desired function with the cursor just to the left of the labels. Less obviously though, pressing the UP button while the very top function is selected will change the Amp-Hours display to a battery capacity icon, while pressing DOWN while the very bottom function is selected will change the Watts display to Hours.
The round circle to the right displays the status of a function. Green for OK/ON Grey for FAULT/OFF.
OVP: Over voltage protection. This will turn off the load when the measured voltage exceeds the set threshold.
OPP: Over power protection. This function prevents a load from pulling more than a specified number of watts from the supply.
OCP: Over current protection. This one’s a little more obvious, it’ll disable the output when the current measured exceeds the specified limit.
OUT: This one is the status of the output MOSFET. Can also be used to manually enable/disable the output.
OFT: Over time protection. This one could be useful when charging batteries, if the output is enabled for longer than the specified time, the output will toggle off.
OAH: Over Amp-Hours protection. If the counted Amp-Hours exceeds the set limit, the output will be disabled.
Nom: This one indicates the status of the RF data link between the modules, and can be used to set the channel they operate on.
Pairing is achieved by holding the OK button, selecting the channel on the LCD unit, and then pressing the button on the transmitter board. After a few seconds, (it appears to scan through all addresses until it gets a response) the display will resume updating.
This function would be required if there are more than a single meter within RF range of each other.
I’ve not yet had a proper play with all the protection functions, but a quick mess with the OVP setting proved it was very over-sensitive. Setting the protection voltage to 15v triggered the protection with the measured voltage between 12.5v-13.8v. More experimentation is required here I think, but as I plan to just use these for power monitoring, I’ll most likely leave all the advanced functions disabled.
This camera has now been retired after many years of heavy use. Exposure to a 3-year old has caused severe damage to the lens mechanism, which no longer functions correctly.
Rear Panel
Pretty much standard interface for a digital camera, with a nice large LCD for it’s time.
Front Cover Removed
With the front cover removed, the lens assembly & battery compartment is exposed.
Rear Cover Removed
Removing the rear cover exposes the LCD module & the main PCB, the interface tactile switches are on the right under a protective layer of Kapton tape.
Main Chipset
Flipping the LCD out of it’s mounting bracket reveals the main camera chipset. The CPU is a NovaTek NT96432BG, no doubt a SoC of some kind, but I couldn’t find any information. Firmware & inbuilt storage is on a Hynix HY27US08561A 256MBit NAND Flash, with a Hynix HY5DU561622FTP-D43 256Mbit DRAM for system memory.
I couldn’t find any info on the other two chips on this side of the board, but one is probably a motor driver for the lens, while the other must be the front end for the CCD sensor input to the SoC.
Main PCB Reverse
The other side of the PCB handles the SD card slot & power management. All the required DC rails are provided for by a RT9917 7-Channel DC-DC converter from RichTek, an IC designed specifically for digital camera applications.
Top left above the SD card slot is the trigger circuitry for the Xenon flash tube & the RTC backup battery.
Main PCB Removed
Once the main PCB is out of the frame, the back of the lens module with the CCD is accessible. Just to the left is the high-voltage photoflash capacitor, 110µF 330v. These can give quite the kick when charged! Luckily this camera has been off long enough for the charge to bleed off.
Sensor
Finally, here’s the 7-Megapixel CCD sensor removed from the lens assembly, with it’s built in IR cut filter over the top. I couldn’t find any make or model numbers on this part, as the Aluminium mounting bracket behind is bonded to the back of the sensor with epoxy, blocking access to any part information.
Die images of the chipset to come once I get round to decapping them!
As I’ve been posting some photos of decapped ICs lately, I thought I’d share the process I use personally for those that might want to give it a go 😉
The usual method for removing the epoxy package from the silicon is to use hot, concentrated Nitric Acid. Besides the obvious risks of having hot acids around, the decomposition products of the acid, namely NO² (Nitrogen Dioxide) & NO (Nitrogen Oxide), are toxic and corrosive. So until I can get the required fume hood together to make sure I’m not going to corrode the place away, I’ll leave this process to proper labs ;).
The method I use is heat based, using a Propane torch to destroy the epoxy package, without damaging the Silicon die too much.
TMS57002 Audio DSP
I start off, obviously, with a desoldered IC, the one above an old audio DSP from TI. I usually desolder en-masse for this with a heat gun, stripping the entire board in one go.
FLAMES!
Next is to apply the torch to the IC. A bit of practice is required here to get the heat level & time exactly right, overheating will cause the die to oxidize & blacken or residual epoxy to stick to the surface.
I usually apply the torch until the package just about stops emitting it’s own yellow flames, meaning the epoxy is almost completely burned away. I also keep the torch flame away from the centre of the IC, where the die is located.
Breathing the fumes from this process isn’t recommended, no doubt besides the obvious soot, the burning plastic will be emitting many compounds not brilliant for Human health!
Once the IC is roasted to taste, it’s quenched in cold water for a few seconds. Sometimes this causes such a high thermal shock that the leadframe cracks off the epoxy around the die perfectly.
All Your Die Belong To Us
Now that the epoxy has been destroyed, it breaks apart easily, and is picked away until I uncover the die itself. (It’s the silver bit in the middle of the left half). The heat from the torch usually destroys the Silver epoxy holding the die to the leadframe, and can be removed easily from the remaining package.
Decapped
BGA packages are usually the easiest to decap, flip-chip packages are a total pain due to the solder balls being on the front side of the die, I haven’t managed to get a good result here yet, I’ll probably need to chemically remove the first layer of the die to get at the interesting bits 😉
Slide
Once the die has been rinsed in clean water & inspected, it’s mounted on a glass microscope slide with a small spot of Cyanoacrylate glue to make handling easier.
Some dies require some cleaning after decapping, for this I use 99% Isopropanol & 99% Acetone, on the end of a cotton bud. Any residual epoxy flakes or oxide stuck to the die can be relatively easily removed with a fingernail – turns out fingernails are hard enough to remove the contamination, but not hard enough to damage the die features.
Once cleaning is complete, the slide is marked with the die identification, and the photographing can begin.
Microscope Mods
I had bought a cheap eBay USB microscope to get started, as I can’t currently afford a proper metallurgical microscope, but I found the resolution of 640×480 very poor. Some modification was required!
Modified Microscope
I’ve removed the original sensor board from the back of the optics assembly & attached a Raspberry Pi camera board. The ring that held the original sensor board has been cut down to a minimum, as the Pi camera PCB is slightly too big to fit inside.
The stock ring of LEDs is run direct from the 3.3v power rail on the camera, through a 4.7Ω resistor, for ~80mA. I also added a 1000µF capacitor across the 3.3v supply to compensate a bit for the long cable – when a frame is captured the power draw of the camera increases & causes a bit of voltage drop.
The stock lens was removed from the Pi camera module by careful use of a razor blade – being too rough here *WILL* damage the sensor die or the gold bond wires, which are very close to the edge of the lens housing, so be gentle!
Mounting Base
The existing mount for the microscope is pretty poor, so I’ve used a couple of surplus ceramic ring magnets as a better base, this also gives me the option of raising or lowering the base by adding or removing magnets.
To get more length between the Pi & the camera, I bought a 1-meter cable extension kit from Pi-Cables over at eBay, cables this long *definitely* require shielding in my space, which is a pretty aggressive RF environment, or interference appears on the display. Not surprising considering the high data rates the cable carries.
The FFC interface is hot-glued to the back of the microscope mount for stability, for handheld use the FFC is pretty flexible & doesn’t apply any force to the scope.
Die Photography
Since I modified the scope with a Raspberry Pi camera module, everything is done through the Pi itself, and the raspistill command.
Pi LCD
The command I’m currently using to capture the images is:
raspistill -ex auto -awb auto -mm matrix -br 62 -q 100 -vf -hf -f -t 0 -k -v -o CHIPNAME_%03d.jpg
This command waits between each frame for the ENTER key to be pressed, allowing me to position the scope between shots. Pi control & file transfer is done via SSH, while I use the 7″ touch LCD as a viewfinder.
The direct overhead illumination provided by the stock ring of LEDs isn’t ideal for some die shots, so I’m planning on fitting some off-centre LEDs to improve the resulting images.
Image Processing
Obviously I can’t get an ultra-high resolution image with a single shot, due to the focal length, so I have to take many shots (30-180 per die), and stitch them together into a single image.
For this I use Hugin, an open-source panorama photo stitching package.
Hugin
Here’s Hugin with the photos loaded in from the Raspberry Pi. To start with I use Hugin’s built in CPFind to process the images for control points. The trick with getting good control points is making sure the images have a high level of overlap, between 50-80%, this way the software doesn’t get confused & stick the images together incorrectly.
Optimiser
After the control points are generated, which for a large number of high resolution images can take some time, I run the optimiser with only Yaw & Pitch selected for all images.
Optimising
If all goes well, the resulting optimisation will get the distance between control points to less than 0.3 pixels.
Panorama Preview
After the control points & optimisation is done, the resulting image can be previewed before generation.
Texas Instruments TMS67002
After all the image processing, the resulting die image should look something like the above, with no noticeable gaps.
I did a little more digging into the PSU circuitry of the small coin counting machine, and it’s even more strange than I thought!
The part I originally thought was a transformer on the PSU board is in fact a DC-DC converter module!
DC-DC Converter
Here’s the device after desoldering it from the PCB. It turns out that instead of a transformer, it’s an inductor.
Hiding Control Electronics
Underneath is the controller electronics, with an COB controller & the switching transistors are under a protective covering of silicone.
Mains Transformer
Driving this whole lot of PSU randomness is the mains transformer, with a secondary voltage of 35v.
The only reason I can think of that the manufacturer went to this much expense with the power supply is stability – a coin counting machine that miscounts due to power supply surges, sags & spikes wouldn’t be very much use. It’s not likely I’ll see anything similar again, unless I manage to get hold of something like medical grade equipment.
Here’s some teardown photos of an old De La Rue coin counter, used in businesses for rapid counting of change into large bags.
Mechanism
An overview of the whole mechanical system of the counter. Coins are loaded into the drum at the rear of the machine, which sorts them into a row for the rubber belt to pick up & run through the counter. The coin type to be sorted is selected by turning the control knobs on the right.
The control knobs adjust the width & height of the coin channel so only the correct sized coins will be counted.
PSU & Switching
The counter is driven by a basic AC induction motor, the motor power relay & reversing relay is on this PCB, along with the 5v switching supply for the main CPU board.
The SMPS on this board looks like a standard mains unit, but it’s got one big difference. Under the frame next to the main motor is a relatively large transformer, with a 35v output. This AC is fed into the SMPS section of the PSU board to be converted to 5v DC for the logic.
I’m not sure why it’s been done this way, and have never seen anything similar before.
The edge of the coin channel can be seen here, the black star wheel rotates when a coin passes & registers the count.
Controller PCB
Here’s the main controller PCB, IC date codes put the unit to about 1995. The main CPU is a NEC UPD8049HC 8-bit micro, no flash or EEPROM on this old CPU, simply mask ROM. Coin readout is done on the 4 7-segment LED displays. Not much to this counter, it’s both electronically & mechanically simple.
Counter Sensor
Coin counting is done by the star wheel mentioned above, which drives the interrupter disc on this photo-gate. The solenoid locks the counter shaft to prevent over or under counting when a set number of coins is to be counted.
Motor Run Capacitor
Under the frame, here on the left is the small induction motor, only 6W, 4-pole. The run cap for the motor is in the centre, and the 35v transformer is just visible behind it.
Main Motor Drive
Main drive to the coin sorting mech is through rubber belts, and bevel gears drive the coin drum.
Here’s an old HDSPA 3G USB modem stick that I got with a mobile phone contact many years ago. As it’s now very old tech, and I have a faster modem, not to mention that I’m no longer with Orange (Robbing <expletive>), here’s a teardown of the device!
Cover Removed
The top shell is just clipped into place, while a pair of very small screws hold down the orange piece at left to hold the PCB stack in the casing. Not much to see here, but it’s clear that there’s a lot crammed into a very small space.
PCB Assembly
Here’s the PCB stack removed from the outer casing. The main antenna is on the right, attached with another small screw. Every IC on the boards is covered with an RF can. No problems there, pliers to the rescue!
SD Card Slot
Here’s the top PCB, all the shields have been removed. On the left is a Qualcomm PM6658 Power Management IC with integrated USB transceiver. This is surrounded by many of the power management circuits.
The integrated SD Card slot is on the right side. with what looks to be a local switching regulator for supply voltage. This might also provide the SIM card with it’s power supply.
PSU & SIM Contacts
The other side of the top board reveals more power management, with another switching regulator, and a truly massive capacitor at the top edge. I’m guessing this is a solid Tantalum.
Main Chipset PCB
The other PCB holds the main chipset & RF circuits. On the left here is a Samsung MCP K5D1G13ACH IC. This one is a multiple chip package, having 1Gbit of NAND Flash & 512Mbit of mobile SDRAM.
To it’s right is a Qualcomm RTR6285 RF Transceiver. This IC supports multiband GSM/EDGE/UMTS frequencies & also has a GPS receive amplifier included.
At bottom right is an Avago ACPM7371 Wide-Band 4×4 CDMA Power Amplifier. The external antenna connector is top right.
Main Chipset PCB Reverse
On the other side of the main PCB is a Qualcomm MSM6246 Baseband processor. Not sure about this one as I can’t find anything resembling a datasheet. Another micro-coax connector is in the centre, probably for factory test purposes, as it’s not accessible from the outside.
Just above the coax connector is a Qorvo RF1450 SP4T (single-pole 4-throw) High Power (34.5dBm) GSM RF Switch.
Upper right is an Avago FEM-7780 UMTS2100 4×7 Front End Module.
Under that is an RFMD RF3163 Quad-Band RF Power Amplifier Module.
These units are used to broadcast local audio, such as from a public address system or local microphone. They accomplish this by producing a modulated magnetic field that a hearing aid is capable of picking up.
Back Panel
Not many controls on this bit of equipment. A bi-colour LED for status indications, a microphone, external audio input, charging input & a power switch.
Internals
Popping the cover off reveals a small lead-acid battery, 2.1Ah at 12v. This is used when the loop is unplugged.
Main PCB
Here’s the main PCB, which takes care of the audio & battery charging. The inductive loop itself is just visible as the tape-covered wire bundle around the edge of the casing.
Audio & Power Input
Here’s the input section of the main PCB. The microphone input is handled by a SSM2166 front-end preamplifier from Analog Devices.
Power Amplifier
This audio is then fed into a TDA2003 10W Mono Power Amplifier IC, which directly drives the induction coil as if it were a speaker. Any suitable receiving coil & amplifier can then receive the signal & change it back into audio.
If you’ve found my content useful, please consider leaving a donation by clicking the Tip Jar below!
All collected funds go towards new content & the costs of keeping the server online.
