Posted on Leave a comment

Multifunction LCD Power Meter MHF-8020P

LCD Unit
LCD Unit

I recently came across these on eBay, so I thought I’d grab one to see how they function, with all the metrics they display, there’s potential here for them to be very useful indeed.
One of the best parts is that no wiring is required between the sensor board & the LCD head unit – everything is transmitted over a 2.4GHz data link using NRF24L01 modules.
Above is the display unit, with it’s colour LCD display. Many features are available on this, & they appear to be designed for battery powered systems.

Monitor PCB
Monitor PCB

Another PCB handles the current & voltage sensing, so this one can be mounted as close to the high current wiring as possible.

Monitor PCB Microcontroller
Monitor PCB Microcontroller

The transmitter PCB is controlled with an STM8S003F3 microcontroller from ST Microelectronics. This is a Flash based STM with 8KB of ROM, 1KB of RAM & 10-bit ADC. The NRF24L01 transceiver module is just to the left.
There’s only a single button on this board, for pairing both ends of the link.

Output MOSFET
Output MOSFET

The high current end of the board has the 0.0025Ω current shunt & the output switch MOSFET, a STP75NF75 75v 75A FET, also from ST Microelectronics. A separate power source can be provided for the logic via the blue terminal block instead of powering from the source being measured.

LCD Unit Rear
LCD Unit Rear

Here’s the display unit, only a pair of power terminals are provided, 5-24v wide-range input is catered for.

LCD Unit PCB
LCD Unit PCB

Unclipping the back of the board reveals the PCB, with another 2.4GHz NRF24L01 module, and a STM8S005K6 microcontroller in this case. The switching power supply that handles the wide input voltage is along the top edge of the board.

Unfortunately I didn’t get any instruction manual with this, so some guesswork & translation of the finest Chinglish was required to get my head round the way everything works. To make life a little easier for others that might have this issue, here’s a list of functions & how to make them work.

LCD Closeup
LCD Closeup

On the right edge of the board is the function list, a quick press of the OK button turns a function ON/OFF, while holding it allows the threshold to be set.
When the output is disabled by one of the protection functions, turning that function OFF will immediately enable the output again.
The UP/DOWN buttons obviously function to select the desired function with the cursor just to the left of the labels. Less obviously though, pressing the UP button while the very top function is selected will change the Amp-Hours display to a battery capacity icon, while pressing DOWN while the very bottom function is selected will change the Watts display to Hours.
The round circle to the right displays the status of a function. Green for OK/ON Grey for FAULT/OFF.

  • OVP: Over voltage protection. This will turn off the load when the measured voltage exceeds the set threshold.
  • OPP: Over power protection. This function prevents a load from pulling more than a specified number of watts from the supply.
  • OCP: Over current protection. This one’s a little more obvious, it’ll disable the output when the current measured exceeds the specified limit.
  • OUT: This one is the status of the output MOSFET. Can also be used to manually enable/disable the output.
  • OFT: Over time protection. This one could be useful when charging batteries, if the output is enabled for longer than the specified time, the output will toggle off.
  • OAH: Over Amp-Hours protection. If the counted Amp-Hours exceeds the set limit, the output will be disabled.
  • Nom: This one indicates the status of the RF data link between the modules, and can be used to set the channel they operate on.
    Pairing is achieved by holding the OK button, selecting the channel on the LCD unit, and then pressing the button on the transmitter board. After a few seconds, (it appears to scan through all addresses until it gets a response) the display will resume updating.
    This function would be required if there are more than a single meter within RF range of each other.

I’ve not yet had a proper play with all the protection functions, but a quick mess with the OVP setting proved it was very over-sensitive. Setting the protection voltage to 15v triggered the protection with the measured voltage between 12.5v-13.8v. More experimentation is required here I think, but as I plan to just use these for power monitoring, I’ll most likely leave all the advanced functions disabled.

Posted on Leave a comment

IC Decapping: The Process

As I’ve been posting some photos of decapped ICs lately, I thought I’d share the process I use personally for those that might want to give it a go 😉

The usual method for removing the epoxy package from the silicon is to use hot, concentrated Nitric Acid. Besides the obvious risks of having hot acids around, the decomposition products of the acid, namely NO² (Nitrogen Dioxide) & NO (Nitrogen Oxide), are toxic and corrosive. So until I can get the required fume hood together to make sure I’m not going to corrode the place away, I’ll leave this process to proper labs ;).

The method I use is heat based, using a Propane torch to destroy the epoxy package, without damaging the Silicon die too much.

TMS57002 Audio DSP
TMS57002 Audio DSP

I start off, obviously, with a desoldered IC, the one above an old audio DSP from TI. I usually desolder en-masse for this with a heat gun, stripping the entire board in one go.

FLAMES!
FLAMES!

Next is to apply the torch to the IC. A bit of practice is required here to get the heat level & time exactly right, overheating will cause the die to oxidize & blacken or residual epoxy to stick to the surface.
I usually apply the torch until the package just about stops emitting it’s own yellow flames, meaning the epoxy is almost completely burned away. I also keep the torch flame away from the centre of the IC, where the die is located.
Breathing the fumes from this process isn’t recommended, no doubt besides the obvious soot, the burning plastic will be emitting many compounds not brilliant for Human health!
Once the IC is roasted to taste, it’s quenched in cold water for a few seconds. Sometimes this causes such a high thermal shock that the leadframe cracks off the epoxy around the die perfectly.

All Your Die Belong To Us
All Your Die Belong To Us

Now that the epoxy has been destroyed, it breaks apart easily, and is picked away until I uncover the die itself. (It’s the silver bit in the middle of the left half). The heat from the torch usually destroys the Silver epoxy holding the die to the leadframe, and can be removed easily from the remaining package.

Decapped
Decapped

BGA packages are usually the easiest to decap, flip-chip packages are a total pain due to the solder balls being on the front side of the die, I haven’t managed to get a good result here yet, I’ll probably need to chemically remove the first layer of the die to get at the interesting bits 😉

Slide
Slide

Once the die has been rinsed in clean water & inspected, it’s mounted on a glass microscope slide with a small spot of Cyanoacrylate glue to make handling easier.

Some dies require some cleaning after decapping, for this I use 99% Isopropanol & 99% Acetone, on the end of a cotton bud. Any residual epoxy flakes or oxide stuck to the die can be relatively easily removed with a fingernail – turns out fingernails are hard enough to remove the contamination, but not hard enough to damage the die features.

Once cleaning is complete, the slide is marked with the die identification, and the photographing can begin.

Microscope Mods

I had bought a cheap eBay USB microscope to get started, as I can’t currently afford a proper metallurgical microscope, but I found the resolution of 640×480 very poor. Some modification was required!

Modified Microscope
Modified Microscope

I’ve removed the original sensor board from the back of the optics assembly & attached a Raspberry Pi camera board. The ring that held the original sensor board has been cut down to a minimum, as the Pi camera PCB is slightly too big to fit inside.
The stock ring of LEDs is run direct from the 3.3v power rail on the camera, through a 4.7Ω resistor, for ~80mA. I also added a 1000µF capacitor across the 3.3v supply to compensate a bit for the long cable – when a frame is captured the power draw of the camera increases & causes a bit of voltage drop.

The stock lens was removed from the Pi camera module by careful use of a razor blade – being too rough here *WILL* damage the sensor die or the gold bond wires, which are very close to the edge of the lens housing, so be gentle!

Mounting Base
Mounting Base

The existing mount for the microscope is pretty poor, so I’ve used a couple of surplus ceramic ring magnets as a better base, this also gives me the option of raising or lowering the base by adding or removing magnets.
To get more length between the Pi & the camera, I bought a 1-meter cable extension kit from Pi-Cables over at eBay, cables this long *definitely* require shielding in my space, which is a pretty aggressive RF environment, or interference appears on the display. Not surprising considering the high data rates the cable carries.
The FFC interface is hot-glued to the back of the microscope mount for stability, for handheld use the FFC is pretty flexible & doesn’t apply any force to the scope.

Die Photography

Since I modified the scope with a Raspberry Pi camera module, everything is done through the Pi itself, and the raspistill command.

Pi LCD
Pi LCD

The command I’m currently using to capture the images is:
raspistill -ex auto -awb auto -mm matrix -br 62 -q 100 -vf -hf -f -t 0 -k -v -o CHIPNAME_%03d.jpg

This command waits between each frame for the ENTER key to be pressed, allowing me to position the scope between shots. Pi control & file transfer is done via SSH, while I use the 7″ touch LCD as a viewfinder.

The direct overhead illumination provided by the stock ring of LEDs isn’t ideal for some die shots, so I’m planning on fitting some off-centre LEDs to improve the resulting images.

Image Processing

Obviously I can’t get an ultra-high resolution image with a single shot, due to the focal length, so I have to take many shots (30-180 per die), and stitch them together into a single image.
For this I use Hugin, an open-source panorama photo stitching package.

Hugin
Hugin

Here’s Hugin with the photos loaded in from the Raspberry Pi. To start with I use Hugin’s built in CPFind to process the images for control points. The trick with getting good control points is making sure the images have a high level of overlap, between 50-80%, this way the software doesn’t get confused & stick the images together incorrectly.

Optimiser
Optimiser

After the control points are generated, which for a large number of high resolution images can take some time, I run the optimiser with only Yaw & Pitch selected for all images.

Optimising
Optimising

If all goes well, the resulting optimisation will get the distance between control points to less than 0.3 pixels.

Panorama Preview
Panorama Preview

After the control points & optimisation is done, the resulting image can be previewed before generation.

Texas Instruments TMS67002
Texas Instruments TMS67002

After all the image processing, the resulting die image should look something like the above, with no noticeable gaps.

Posted on Leave a comment

Huawei E160E USB HSDPA Modem

E160E Modem
Huawei E160E Modem

Here’s an old HDSPA 3G USB modem stick that I got with a mobile phone contact many years ago. As it’s now very old tech, and I have a faster modem, not to mention that I’m no longer with Orange (Robbing <expletive>), here’s a teardown of the device!

Cover Removed
Cover Removed

The top shell is just clipped into place, while a pair of very small screws hold down the orange piece at left to hold the PCB stack in the casing. Not much to see here, but it’s clear that there’s a lot crammed into a very small space.

PCB Assembly
PCB Assembly

Here’s the PCB stack removed from the outer casing. The main antenna is on the right, attached with another small screw. Every IC on the boards is covered with an RF can. No problems there, pliers to the rescue!

SD Card Slot
SD Card Slot

Here’s the top PCB, all the shields have been removed. On the left is a Qualcomm PM6658 Power Management IC with integrated USB transceiver. This is surrounded by many of the power management circuits.
The integrated SD Card slot is on the right side. with what looks to be a local switching regulator for supply voltage. This might also provide the SIM card with it’s power supply.

PSU & SIM Contacts
PSU & SIM Contacts

The other side of the top board reveals more power management, with another switching regulator, and a truly massive capacitor at the top edge. I’m guessing this is a solid Tantalum.

Main Chipset PCB
Main Chipset PCB

The other PCB holds the main chipset & RF circuits. On the left here is a Samsung MCP K5D1G13ACH IC. This one is a multiple chip package, having 1Gbit of NAND Flash & 512Mbit of mobile SDRAM.
To it’s right is a Qualcomm RTR6285 RF Transceiver. This IC supports multiband GSM/EDGE/UMTS frequencies & also has a GPS receive amplifier included.
At bottom right is an Avago ACPM7371 Wide-Band 4×4 CDMA Power Amplifier. The external antenna connector is top right.

Main Chipset PCB Reverse
Main Chipset PCB Reverse

On the other side of the main PCB is a Qualcomm MSM6246 Baseband processor. Not sure about this one as I can’t find anything resembling a datasheet. Another micro-coax connector is in the centre, probably for factory test purposes, as it’s not accessible from the outside.
Just above the coax connector is a Qorvo RF1450 SP4T (single-pole 4-throw) High Power (34.5dBm) GSM RF Switch.
Upper right is an Avago FEM-7780 UMTS2100 4×7 Front End Module.
Under that is an RFMD RF3163 Quad-Band RF Power Amplifier Module.