Resurrecting a dead MacBook Pro (mid-2012 13-inch, model A1278)

As seen on Hackaday!

A couple weeks ago, I picked up a dead MacBook Pro that was on its way to the recycle bin, and was curious as to whether I would be able to fix it. It had a note attached to it citing several issues with the computer: the display doesn’t work, the battery doesn’t charge, one of the USB ports doesn’t work, and it won’t load an operating system. It certainly didn’t look particularly promising, but I felt it would be a good way to test my skills in component-level repair – with a pretty nice prize if I succeeded.

Triage

The computer I picked up is a mid-2012 MacBook Pro by Apple; it is the A1278 model with a logic board number of 820-3115-B, and it comes with an i7-3520M CPU and 8 GB of DDR3 RAM – however, the hard drive was taken out of the computer by the time I received it. As previously noted, the computer had a laundry list of issues that were certainly the reason the original owner decided to discard their computer – a laptop that doesn’t boot nor have a display isn’t a particularly useful one.

Connecting a MagSafe AC adapter to the computer revealed even more issues: even though the unit was already noted that it wouldn’t charge, I noticed there was no LED indicator on the power adapter’s plug, and the computer wouldn’t power on, even with external power connected; the only sign of life was one of the LED level indicators rapidly flashing when I pressed the button. With this functionality test being unsuccessful, I decided to open up the computer to see what else was wrong…

Troubleshooting & Diagnosis

Unscrewing the bottom cover revealed what horrors the computer had experienced. There was clear evidence that it had suffered from liquid damage: rampant corrosion around the LCD connector and some of the power circuitry, and some of the corrosion deposits were even left on the computer’s bottom cover! If you watch Louis Rossmann’s videos, you would know that liquid damage rarely is an easy fix, especially when high-voltage LED backlight circuitry gets involved.

Liberal use of a 70% isopropyl alcohol solution and a brush was able to scrub away all the corrosion on the computer’s logic board, and the results were not pretty:

Many PCB test pads were either corroded or entirely gone, the backlight fuse (and its pads) were nowhere to be found, and some ICs were missing entire pins! Whatever was spilled on this area of the MacBook certainly had some corrosive properties to it, and it looks like nothing was done to stop the initial damage. With a schematic and board-view software in hand, it was time to investigate what particular components had suffered damage.

Power Supply

Before any device can perform any useful functions, it needs power. I reconnected the AC adapter and started to check the voltages around the DC input jack and its surrounding support circuitry. Since I was able to press the MacBook’s battery indicator and get some response when connected to power, I knew that the main input fuse was intact, and that the SMC (System Management Controller) chip was receiving power via the PP3V42_G3H rail and functional; the G3H (G3-Hot) designation means that the power rail is always on, even if the computer is otherwise turned off. I checked the voltage at the DC jack’s ADAPTER_SENSE line, which is normally at approximately 3.3 volts and uses the 1-Wire protocol to communicate with the power adapter and control the LED on the power adapter’s MagSafe plug. To my surprise, it was at a staggering 16 volts, which meant that something was shorting the DC input voltage (about 16.5 volts) onto a low-voltage communication line – no wonder there wasn’t any LED indicator when I plugged it in! A multimeter measurement found about 2 kOhms of resistance from the power line to the communication line. Thankfully the MacBook’s logic board features a MAX9940 1-Wire overvoltage protection chip, which is rated to protect against voltages as high as 30 volts. I scavenged another DC input connector from an older, dead MacBook which shared the same connector and pinout. After connecting this to the logic board, I found that I got a green LED upon connecting the AC adapter, and the CPU fan started spinning; this is a very good sign as this means the main power circuitry is intact. Measuring the CPU’s Vcore voltage revealed a voltage of about 0.8 volts, which is normal for a modern laptop CPU. With the “heart” of the computer checked out, it was time to focus on the area most affected by the water damage.

LCD & Backlight

Examining the backlight connector and its surrounding circuitry revealed significant damage to many components and the PCB itself. The power supply pins on the LCD connector showed a significant amount of corrosion, and I was concerned that the backlight’s output voltage (up to 52 volts!) could have made its way through all the corrosion residue and damaged critical data lines between the display and the graphics controller. I noticed the backlight fuse (F9700, a 3-amp 0603-size fuse) had gone more than just open-circuit – I couldn’t even find the fuse or its corresponding PCB pads initially! I then probed the LCD connector and found that the display’s 3.3-volt power lines were open-circuit; the corrosion had eaten through the traces between the connector and its decoupling capacitors nearby. Using a diode-mode measurement on the FPD-Link (often called LVDS) lines revealed that the connections were intact; there weren’t any anomalous readings or short-circuits on those lines, the DDC (Display Data Channel) lines, and the 3.3-volt power lines.

Due to the high voltages used to drive LED backlights, I had my suspicions on U9701 (a Texas Instruments LP8550 LED backlight driver). It’s a tiny ball-grid array (BGA) package, and attempts to clean the chip from its edges didn’t seem to do much. Its corrosion looked limited at first – only the feedback line’s probe point was lost – but I was sure the chip was on its last legs (or is it balls?).

Power Management

The LCD connector is in close proximity to the computer’s DC input and its “PPBUS_G3Hot” power rail, which is always on (even if the computer is otherwise turned off), which exacerbates any corrosion due to liquid damage due to its high voltage. Further examination revealed significant corrosion on the outside of the CPU’s high-side current sense resistor (R5400), and the current-measurement pins (pins 4 and 5) on U5400 (a Texas Instruments INA213 current-sense amplifier) were completely gone! Clearly there was no way to salvage that component.

There was significant damage to the SMC’s DC input voltage sense circuitry (“VD0R”), with pins 3 and 4 of Q5490 (an ON Semiconductor NTUD3169CZ complementary pair of N-channel and P-channel MOSFETs) being completely eroded away, much like U5400’s current-sense pins; this part of the circuit uses a P-channel MOSFET to switch on a resistive voltage divider, allowing the SMC to measure what the voltage is on its MagSafe input connector. Also, many of the probe points related to that circuit were also completely eroded, revealing dark pits instead of silver-plated copper pads.

FireWire

The FireWire circuit wasn’t spared from the carnage, either. Pins 3 and 4 on Q4262 (a Diodes Incorporated BSS8042DW complementary MOSFET pair) were also severely damaged; these pins are used to quickly disable the FireWire power output transistor (Q4260, an ON Semiconductor FDC638P P-channel MOSFET) in case of a “Late-VG event“. This occurs if the ground pins of the FireWire connector are mated too late when plugging in a device – this creates a dangerous overvoltage condition on the FireWire data lines, as up to 30 volts briefly find a return path through the data lines, risking damage to the device and host controller. I wasn’t as concerned with this circuit, as I don’t have any FireWire peripherals, and the circuit in its current state simply means the FireWire port will be unable to disconnect power if a bad cord is plugged in.

Thunderbolt

The area that had the least liquid damage was C3897, which belonged to U3890 (a Linear Technologies LT3957, a 15-volt boost converter for the MacBook’s T29 chip and Thunderbolt interface). All this area needed was a bit of corrosion cleanup.

USB Port

During the functionality tests, I noticed the metal casings of the USB port were getting very hot to the touch, and I nearly burned myself on U4600 (a Texas Instruments TPS2561, a dual-channel load switch with internal current limiting)! I found a short-to-ground problem on a power line on one of the USB ports, which explains the symptom listed on the note. I desoldered the chip, initially thinking the issue was in the chip itself, but the fault remained. I narrowed the problem down to C4695, a 10-microfarad ceramic capacitor that had short-circuited internally; this caused the TPS2561 to go into current-limiting mode, which turns the chip into a resistor and dissipate copious amounts of heat into the PCB, which made its way to the USB ports (and then my fingers – ouch).

Hard Drive Cable

During the repair process, I was able to install Mac OS X Lion to a SATA SSD, but soon found the MacBook unable to recognize SSDs, despite hard disk drives showing up just fine! As it turns out, the A1278 is notorious for bad HDD cables, with even replacements failing within months of installation. This appeared to be caused by chronic frictional damage, as the cable is sandwiched between the hard drive and the MacBook’s rough aluminum casing – even regular use of the laptop was found to create hairline cracks in the cable. Thankfully replacements are relatively inexpensive, and a little bit of Kapton tape as a barrier against the casing was the “vaccine” against future cable failures.

Repairs

With all of the problems written down, it was time to start fixing up the MacBook. Time to break out the hot air rework station, soldering iron, solder, magnet wire, and plenty of flux!

DC Input Jack

I desoldered the DC input jack, and found there was a lot of corrosion residue bridging the +16.5-volt power line to the ADAPTER_SENSE 1-Wire communication line.

With some isopropyl alcohol and some scrubbing with a small brush, I was able to clean up the corrosion and resoldered the jack into place. A quick multimeter test found that there was no more 2 kOhms of resistance from the power to the data line, and I was able to get an LED indication when I plugged in the AC adapter, including an orange light that indicates the battery is charging.

LCD Connector

I wanted to determine if the display was still functional, so I first focused my attention to the LCD connector, even if I had to eschew the LED backlight for a bit.

I ran a jumper wire from L9004 to pins 2 and 3 of the LCD connector; this belongs to PP3V3_LCDVDD_SW_F, which provides the 3.3-volt power to run the LCD panel except the backlight. After cleaning out the flux and corrosion on the logic board’s connector as well as the LCD cable, I was able to get an image on the display!

USB Port

With the faulty component identified, I replaced C4695 with an identically-rated 10-microfarad 6.3-volt X5R ceramic capacitor in an 0603-sized package. After replacing the capacitor, the USB port was fully functional again!

Current-Sense Amplifier

After ordering both the INA213 and LP8550 from Texas Instruments, it was only a few days before they arrived in the mail. I desoldered the dead chip from the logic board, cleaned up the pads with some flux and desoldering braid, and installed the new chip. Running Apple Service Diagnostic tools showed that the current-sensing circuit was working correctly.

DC Input Voltage Divider Switch

I didn’t want to buy another transistor pair for Q5490, so I replaced the P-channel half with an ON Semiconductor NTK3142P P-channel MOSFET that I salvaged from an older donor MacBook logic board. I scraped away some solder mask on one of the broken traces heading to the SMC’s voltage divider so I could solder the transistor’s drain terminal to it, and used magnet wire to connect the transistor’s gate and source to their corresponding locations across R5491. R5494, leading to PM_SUS_EN, was found to have a 0-ohm resistor that was open-circuit; this was easily bypassed with a wire jumper across the resistor’s original pads. After cleaning off the flux and performing continuity measurements, I measured the voltage at the SMC’s voltage divider resistors and got a valid voltage reading when I plugged in the AC adapter.

LED Backlight Driver

The LP8550 was up next for repair. I took a 2-amp 0603-sized fuse from a dead hard drive, and used some magnet wire to reattach it to the remnants of F9700, which was a 3-amp fuse originally; note that it’s far safer to use a fuse of a smaller rating instead of a larger one, should a circuit fault still exist.

Tracing the other lines to the LP8550 revealed that R9731 (leading to PPBUS_SW_LCDBKLT_PWR) was open-circuit at a via, which was easily bridged with some solder and magnet wire. R9010 (leading to PPBUS_SW_BKL) was open as well.

After reinstalling the fuse, I actually got the backlight working! However, upon a power cycle I heard a snap, saw a puff of smoke, and lost the original backlight chip. Chances are there was indeed some corrosion residue had caused 50-odd volts to end up on a more sensitive pin on the LP8550. I used an Xacto knife to lightly scratch an outline around the chip, then used copious amounts of flux and desoldered the dead chip with my hot air rework station; I also removed the fuse to help in further troubleshooting to ensure that there weren’t any short-circuits to ground on the backlight circuit. I cleaned up the area with leaded solder and some solder wick, and cleaned up the residual flux in anticipation of the new chip’s installation.

The chip was remarkably easy to install – just get the A1 ball lined up according to the board view, and heat the board to the right temperature. After thoroughly cleaning away the flux from the area, I turned on the MacBook… and let there be (back)light! I power-cycled the computer and the LED backlight remained functional! (And for the record, the fuse didn’t even blow during the entire ordeal.)

FireWire Late-VG Protection Circuit

I considered this issue to be a “WONTFIX“, as I had no use for FireWire connectivity (nor do I have the correct FireWire 800 cables anyway). If I want to sell this computer, I might install a P-channel MOSFET to replace Q4262 (see the LCD Connector section above) in a similar fashion to the DC input voltage-sensing circuitry.

Testing

It takes a little bit of Google-Fu, but with the help of a BitTorrent client, I downloaded the disk images to create an Apple Service Diagnostic (ASD) drive. This is far more sophisticated than the built-in diagnostic when you boot the computer while holding down the D key. With ASD, one has the option to use a stripped-down version of Mac OS X – in a similar vein as WinPE – or a very lightweight UEFI (Universal Extensible Firmware Interface) environment that looks very much like Mac OS 9 and earlier.

It took over half an hour, but all the tests passed without a problem, since all the sensor readings were valid. My MacBook Pro has been restored to working order! I installed Mac OS X High Sierra to a 1TB SSD, and used Boot Camp to run Windows 10 Pro as the default operating system (what can I say, I like Windows 🙂 ). The Mac Precision Touchpad driver project makes the touchpad a pleasure to use, as the built-in Boot Camp driver provides a much less-comfortable experience.

Conclusion

Much like solving a puzzle, component-level troubleshooting of modern electronics is possible, but this is only feasible if the relevant documentation exists as a good reference point. One can do without them, but the act of reverse engineering isn’t easy if one only has a non-working device.

With the help of a schematic and board view (including the open-source software OpenBoardView), one can easily find what circuits a component belongs to, and where it goes. By following the connections, one can track down the problem(s) with the board, and hopefully save a device from an untimely end in the landfill or a recycling facility.

Right to Repair

This project is an example of why I believe in the right to repair. If I didn’t have (even unofficial) access to schematics, board views, and diagnostic software, I wouldn’t have been able to bring this dead MacBook Pro back to life. However, with a little bit of electronics troubleshooting knowledge and skill, I was delighted that I diverted a discarded dysfunctional device from a demise in the dumpster. In fact, this blog post was written from the MacBook I just repaired!

Advertisements

Quick Review: Littelfuse Smart Glow automotive fuse

2015-05-09 16.29.34It Glows when it Blows! [add obligatory Michael Scott line here]

(I’m sorry. I couldn’t help myself.)

Okay, now that the lowbrow humor has been dealt with, I had to replace a car fuse because of a shorted 12-volt power socket. Luckily, I was able to replace the fuse without the circuit blowing again; however, I had used the only spare fuse in the fuse box and needed to buy some more in case the fault was to recur. Browsing my local Canadian Tire, I stumbled upon a pack of fuses that allowed for a visual check for blown fuses by simply turning on the ignition: the Littelfuse Smart Glow fuse. A 36-pack of these fuses cost about $35 Canadian, making them a bit pricier than their non-illuminated counterparts.

Construction

Closeup of fuse, LED and resistor

Closeup of fuse, LED and resistor

The Smart Glow fuse is comprised of three main components: the actual fuse (which is really just a regular automotive fuse), a 360-ohm resistor, and a dual red LED package with the diodes in inverse parallel to allow for the fuse to glow regardless of orientation. The LEDs and resistors are affixed to the fuse body using various epoxies: an opaque red epoxy to glue the components down, a conductive silver-filled epoxy to provide an electrical connection without soldering, and a clear epoxy to protect the components from damage; the fuse amperage is re-printed on top of the protective epoxy coating since the resistor and LED obscure the original fuse’s markings.

Schematic of Littelfuse Smart Glow fuse

Schematic of Littelfuse Smart Glow fuse

Performance

Simply put, this acts like any other automotive fuse would. The only difference is that the LED will illuminate if the fuse is blown, and sufficient load is still present in the circuit to provide enough current for the LED to act as a fault indicator.

Fuse blown and LED indicator lit with 5 volts

Fuse blown and LED indicator lit with 5 volts

When testing the fuse’s brightness, I found it to be quite noticeable at 5 volts and almost blindingly bright when run at 14.4 volts (the approximate charging voltage for a 12-volt car battery).

Simulation of LED indicator

Simulation of LED indicator

Running this circuit through a simulator, the LED has almost 35 mA of current running through it. Given how LEDs are typically rated for a maximum of 20 mA, this LED is not going to last long; that said, it shouldn’t need to run for a long time as the LED’s only purpose is to notify the user that the fuse needs to be replaced (and at that point the fuse and its indicator will be disposed of anyway).

Conclusion

Yes, it glows when it blows; I have nothing more to add.

(The same could be said for Rudolph the Red-Nosed Reindeer, but he’s a non-electronic entity and is therefore outside the scope of this blog. :P)

Teardown/review of Silicon Power 8GB 200x CompactFlash memory card

Hooray for nice hand-me-down SLR cameras! I finally have a better camera than the one built into my (now ancient) Samsung Galaxy S II that I use for pictures on this blog. The camera, a Canon EOS 50D, had an 8GB CompactFlash card that I was preparing to erase and reuse, and had problems trying to read out the card’s contents; a few stubborn files would refuse to copy and Explorer would simply hang until I restarted the program or unplugged the card. Additionally, when using my Hard Disk Sentinel program to do a surface scan, it too would freeze when reading a certain sector on the card.

Instead of using a USB-to-CompactFlash adapter (I could not find my card reader and have not seen it for over a year now, come to think of it) I used a CompactFlash-to-PATA adapter, then a PATA-to-SATA adapter so I could directly hook up the card to my computer. In addition to having greater theoretical throughput, it allows me to view the S.M.A.R.T. diagnostic data that the card provides.

Memory card issues and performance

The diagnostic information doesn’t really provide any insight into the health of the card; none of the S.M.A.R.T. attributes are listed as critical, and many of them are listed as vendor-specific. Oh well, at least it gave me some sort of information…

After finding a copy of the card’s contents on my home server (I seem to have previously backed up the card before the corruption occurred but didn’t recall doing so until I had raked through some of my archives), I decided I’d do a full card erase and see if it would cause the card to be usable again. I called up the Surface Test in Hard Disk Sentinel and used its surface-write tool to erase the user-accessible area of the card. A few blocks seemed to write dramatically slower than the rest and repeated write tests did not resolve their sluggishness; I call shenanigans with the memory card’s controller and its reluctance in reallocating problematic sectors…

The card itself isn’t very fast. The sequential I/O of the card is good enough for casual photography, but I would definitely not use this card in an embedded system that uses a CompactFlash as a sort of mini-SSD; even though it shows up in my system as a hard drive (non-removable), its random I/O is quite sluggish and its random write speed is worse than that of a standard hard disk drive.

Teardown

The card itself is a sandwich of aluminum plates, a plastic case and the PCB assembly that holds the controller, Flash memory and the CompactFlash connector. A hobby knife run under the aluminum plate was able to separate the plate from the plastic body; some glue and a couple clips were the only things holding the card together.

The card’s controller is a Phison PS3006, which sports a PCMCIA (and therefore CompactFlash) interface with True IDE (or plain PATA) support. It contains an 8051 microcontroller core with a few components to assist with interfacing with the Flash memory, such as a hardware ECC (error correction code) engine and a small amount of SRAM for a buffer.

The datasheet for the PS3006 doesn’t provide information on the S.M.A.R.T. attributes, nor does it indicate what type of Flash wear-leveling is provided. Given the controller’s limited computing capabilities, I’m thinking it uses a less-complex but less-reliable form of wear leveling, known as dynamic wear leveling (see Micron’s application note for more information). It’s less capable of dealing with memory wearout, but doesn’t require the computing overhead of static wear leveling (which proper SSD controllers use to keep performance up).

The memory is an Intel 29F32G08AAMD2 device, which is an asynchronous MLC NAND Flash memory chip. There are two installed on this card with another two footprints on the PCB being unpopulated, suggesting that the 16GB version of this card has all four footprints populated.

Conclusion

Given the simplicity of the card, I don’t really have much else to add about this card. Either way, it’s lost my trust with regards to holding my photos. I bought a NOS Disk 16GB CF card from Amazon as well as a SanDisk Extreme 32GB, and plan to use the latter to hold my photos, with the former mainly being a simple curiosity of the construction of a card from a lesser-known manufacturer. Hopefully those will also provide S.M.A.R.T. data, as I prefer Flash-based storage devices with some sort of S.M.A.R.T. data capability. (Is it an insatiable thirst for knowledge? A means of doing regular ‘check-ups’ on my storage device? Probably the latter, but maaayyyybe the former as well. 🙂 )

Teardown of Kentli PH5 1.5 V Li-Ion AA battery

June 17, 2015 – Performance analysis/review HERE!

After having an entire month of dormancy on this blog, I’m finally beginning to cross off the blog posts on my “Pending” list.

Last year, I made a blog post talking about Kentli’s lithium-ion based AA battery that has an internal 1.5 volt regulator. The first order never arrived, and the second one had arrived a few months ago but I never got to actually taking one of the cells apart. That changes today.

Cell overview

The battery itself looks like a regular AA battery, except for the top positive terminal. There’s the familiar ‘nub’ that constitutes the 1.5 volt output, but also has a recessed ring around it that provides a direct connection to the Li-ion cell’s positive connection for charging.

 

After peeling the label, we are met with a plain steel case, save for the end cap that appears to be laser spot-welded. Wanting to take apart the cell with minimal risk of shorting something out inside, I used a small pipe cutter to gently break apart the welded seam. Two revolutions and a satisfying pop sound later, the battery’s guts are revealed.

Battery internals

The PCB that holds the 1.5 volt regulator is inside the end cap, with the rest made up of the Li-ion cell itself. Curiously enough, the cell inside is labeled “PE13430 14F16 2.66wh” which is interesting in more than one way. First of all, the rated energy content of the cell is less than what’s on the outside label (2.66 watt-hours versus 2.8), and the cell inside is actually a Li-ion polymer (sometimes called a “Li-Po” cell) type; I was expecting a standard cylindrical cell inside. Unfortunately, my Google-fu was unable to pull up any data on the cell. I might attempt to do a chemistry identification cycle on the cell and see if TI’s battery database can bring something up.

Battery circuitry

The end cap’s PCB uses a Xysemi XM5232 2.5 A, 1.5 MHz synchronous buck converter to provide the 1.5 volt output. According to the datasheet, it is a fully integrated converter with all the power semiconductor components residing on the chip itself. The converter is rated for 2.5-5.5 volt operation, well within the range of a Li-ion cell. Additionally, it has a rated Iq (quiescent/no-load current) of only 20 microamps. The buck converter’s 2.2 microhenry inductor is magnetically unshielded which may cause some increased EMI (electromagnetic interference) emissions, but I don’t have the equipment to test this.

I was looking around for the battery’s protection circuit, and found it on the flex PCB that surrounds the Li-ion cell. It uses a Xysemi XB6366A protection circuit which, like the buck converter, is a fully-integrated device; there are no external protection MOSFETs for disconnecting the cell from the rest of the circuit.

Performance analysis

December 14, 2015 – After extensive and detailed analysis (148 MB of text files!), I’ve analyzed the battery’s voltage and output capacity, which can be viewed HERE (lots of pretty graphs; check it out!).

The data doesn’t stop there. It took almost three years to track the cell’s self-discharge, but the data is finally in. The final report is available here, but previous installments are available here (Part 1), here (Part 2), here (Part 3)here (Part 4) and here (Part 5).

Looking inside a (fake) iPhone 5S battery

Considering how popular the iPhone is, there’s always going to be some counterfeits out there. I’ve been out buying various iPhone batteries to build a database of each generation’s characteristics, but one model has eluded me so far: the iPhone 5S. The iPhone 5C’s battery that I bought appears to be genuine (but with its own issues), but none of the iPhone 5S batteries I’ve bought so far (4 of them at the time of writing this blog post) were genuine. All of these fakes look like a genuine battery at first glance, but all of them share a few common traits.

Battery teardown

The fake battery sports the usual iPhone battery information, complete with some dot-matrix printed data and a data-matrix barcode. It’s labeled with a capacity of 1560 mAh and 3.8 volts nominal voltage.

Comparison between real and fake iPhone 5S battery

Comparison between real and fake iPhone 5S battery

The connector itself has two points for soldering the connector to provide durability. However, with the fake batteries, they are not soldered down. The two spots on the ends of the connectors are dark with a small point visible inside it (that point is the reinforcement pin on the connector). If this connector is installed in an iPhone, it will probably not come out without either damaging the battery’s connector, or worse, leave the plastic connector piece inside the phone, requiring tweezers to remove.

Connector lifted off with a hobby knife

Connector lifted off with a hobby knife

iPhone 5S and 5C battery pinout

iPhone 5S and 5C battery pinout

Removing the black protective tape reveals an iPhone 4 battery fuel gauge board. The connector is soldered to this board, with four solder points visible.

iPhone 4 battery PCB with soldered-on flat flex connector

iPhone 4 battery PCB with soldered-on flat flex connector

Pulling out the PCB  reveals another characteristic of these fake batteries: the positive terminal is cut short, with another metal section being clumsily spot-welded to the stub on the cell.

Note how the battery tab is poorly welded to the PCB.

Note how the battery tab is poorly welded to the PCB.

Battery fuel gauge data

The battery fuel gauge requires proper programming to accurately indicate the battery’s charge status. Because of this, each iPhone battery generation has its own specific configuration.

The fake iPhone battery retains the programming for the iPhone 4’s battery, which is a designed capacity of 1420 mAh, using a bq27541 fuel gauge running version 1.25 firmware. The data inside it is often that of a used/recycled battery as well.

This data can be (partially) read out directly from the iPhone with a tool such as iBackupBot, but more data can be read if the battery is read with another tool. I have the EV2400 from Texas Instruments to read this out on a PC, but this data can be read out with a USB-to-TTL serial port, a logic gate (a logic inverter) and a small MOSFET transistor.

I created a small tool that uses this circuit to interface with the fuel gauge and read out its data. Check it out here.

Using my tool, this is the report for one of these fake batteries. Note how it is identified as an iPhone 4 battery. Don’t be fooled by the calculated state of health. It’s not accurate for this battery as the fuel gauge still thinks it’s still inside an iPhone 4 battery pack.


**** START OF HDQ BATTERY LOG REPORT ****
HDQ Gas Gauge Readout Tool version 0.9 by Jason Gin
Date: 9/30/2014
Time: 0:52:24
Serial port: COM26

Battery Identification
========================
DEVICE_TYPE = 0x0541, FW_VERSION = 0x0125, DESIGN_CAPACITY = 1420 mAh
Battery's configuration matches that of a standard iPhone 4 battery.

Basic Battery Information
===========================
Device = bq27541 v.1.25, hardware rev. 0x00B5, data-flash rev. 0x0000
Voltage = 3804 mV
Current = 0 mA
Power = 0 mW
State of charge = 45%
Reported state of health = 0%
Calculated state of health = 99.3%
Cycle count = 14 times
Time to empty = N/A (not discharging)
Temperature = 27.9 °C (80.3 °F) (3009 raw)
Designed capacity = 1420 mAh
Heavy load capacity = 628/1410 mAh
Light load capacity = 673/1455 mAh

Advanced Battery Information
==============================
Capacity discharged = 0 mAh
Depth of discharge at last OCV update = ~778 mAh (8768 raw)
Maximum load current = -200 mA
Impedance Track chemistry ID = 0x0163
Reset count = 11 times

Flags = 0x0180
Flag interpretation:
* Fast charging allowed
* Good OCV measurement taken
* Not discharging

Control Status = 0x6219
Control Status interpretation:
* SEALED security state
* SLEEP power mode
* Constant-power gauging
* Qmax update voltage NOT OK (Or in relax mode)
* Impedance Track enabled

Pack Configuration = 0x8931
Pack Configuration interpretation:
* No-load reserve capacity compensation enabled
* IWAKE, RSNS1, RSNS0 = 0x1
* SLEEP mode enabled
* Remaining Capacity is forced to Full Charge Capacity at end of charge
* Temperature sensor: External thermistor

Device name length = 7 bytes
Device name: bq27541

**** END OF HDQ BATTERY LOG REPORT ****

Looking inside an iPhone 5 battery

In the wake of my previous teardowns of the iPhone 4 and 4S batteries, I went onto eBay and Amazon (realizing that they finally have Amazon Prime student rates up in Canada) and bought a few iPhone 5 and 5S batteries. Although I was primarily interested in trying to get the gas gauge information out of the batteries, I had a secondary reason. The Nexxtech Slim Power Bank (a subject of a separate blog post) uses a pair of 3.8-volt Li-ion polymer batteries, and they seemed to be be suspiciously similar in size to what is used in the iPhone 5. But enough of that, we’re here for the iPhone 5 battery in particular!

Battery Casing

The iPhone 5 battery measures 3.7 mm in thickness, 3.2 cm in width and 9.1 cm in length. This particular model, made by Sony, has a model ID of US373291H, with the six digits corresponding to the cell’s dimensions. This cell has a labeled capacity of 1440 mAh at a nominal 3.8 volts, with a maximum charge voltage of 4.3 volts. I tried to read the data matrix barcode on the cell but my barcode scanning app on my phone refused to recognize it. I might try to scan and sharpen the barcode later but it’s not something that’s of a high priority to me.

Battery Teardown and Pinout

The board itself is rather interesting. The protection MOSFETs used to switch the battery’s power are chip-scale packages and are glued down with epoxy, same with the gas gauge itself. This means that I can’t easily replace it with a rework station if the need arises. The board includes the gas gauge, thermistors, protection circuitry and still has room for a polyfuse for extra over-current protection.

iPhone 5 battery PCB layout

iPhone 5 battery PCB layout

The pinout of the iPhone 5 battery is pretty much the same as of the iPhone 4 and 4S. You have Pack-, NTC Thermistor, HDQ and Pack+. In this particular model of battery, the gas gauge is a bq27545 (labeled SN27545), but has basically the same feature set as the iPhone 4/4S’ bq27541. With this information, I soldered to the small terminals on the connector (the actual connectors for this battery haven’t arrived yet since it takes so long to receive items from China on eBay), and hooked it up to my trusty Texas Instruments EV2400 box.

iPhone 5 battery pinout

iPhone 5 battery pinout

Battery Data

iphone 5 firmware versionAnd once again, we’re presented with an obscure firmware revision. The latest bq27545-G1 firmware is only version 2.24, but this chip has version 3.10. After forcing GaugeStudio to accept this gauge as a -G1 version, we’re once again presented with a sealed chip. Let’s try to unseal it with the default key…

... aaaaand nope. No dice with 0x36720414, unlike last time.

Nope. No dice with 0x36720414, unlike last time.

… and I get the dreaded “Unseal Key” prompt. Cue the dramatic Darth Vader “NOOOOO” here. Maybe Apple read my previous post and decided to change the default keys this time (Hey Apple, if you read this, make the iPhone 6’s gas gauge have the default keys again)! This means that not only can I not access any of the juicy details of this battery, but I cannot update its firmware to a more… conventional version either. I could try brute-forcing it, but trying to hack a key with a 32-bit address space over a 7 kbps bus… uh, no. That’s not going to happen. I’d probably have better luck reverse-engineering Apple’s battery code but I doubt they have any facility to do in-system firmware updates for the gas gauge.

Data captured from GaugeStudio

Data captured from GaugeStudio

Now for some rather… interesting details of what we can access. The design capacity of this battery, according to the gas gauge, is 1430 mAh, same as the iPhone 4S and also 100 mAh less than what’s written on the label. That, and the full charge capacity of this battery is 1397 mAh out of the gate. The gauge seems to be an insomniac (it won’t enter Sleep mode even when the battery is not hooked up to any load), and it seems to have less features despite having a higher firmware version (I’m sure the internal temperature isn’t 131 degrees C…), and the Pack Configuration register doesn’t bring up any sensible data.

Battery… conspiracy?

One thing that I haven’t confirmed is whether or not this battery had been tampered with before I received it. I bought this particular battery from eBay and it was listed as new. It had some adhesive residue but no obvious sign of being peeled off from another iPhone. The cycle count is set to 1, and because the gas gauge is sealed, I can’t read any other data like the lifetime data logs. There is a chance that this battery isn’t new and that the seller had somehow changed the data memory and sealed the chip with a non-default key, but I need to wait until some other batteries arrive in the mail and perhaps try reading out batteries taken out directly from some iPhone 5s. Until then, it’s only speculation as to why this chip is sealed with a different key.

The next victims specimens: an iPhone 5S battery, a “new” iPhone 4 battery, and an Amazon Kindle battery.

Review, teardown and analysis of Charging Essentials USB wall outlet

(UPDATE: March 2, 2015 – I’ve picked up a pair of the newer tamper-resistant versions of this wall outlet. A review and teardown on that unit is coming up; stay tuned!)
(UPDATE 2: May 29, 2016 – Scratch that on the first tamper-resistant model; it had the same performance as the one mentioned here. Also, Costco has released a 3.1A version of this outlet, and is currently under review.)

About a week ago I bought a set of wall outlets from Costco that integrate two USB charging ports into a standard Decora-type receptacle. It’s marketed to replace your traditional AC adapter, allowing other appliances to be plugged in while charging your portable electronics.

The outlet is made by Omee Electrical Company, but curiously enough this particular model, the OM-USBII, wasn’t listed on their site. The packaging itself bears the name Charging Essentials, with a logo that looks like a USB icon that’s had one Viagra too many. The packaging states that the outlet has:

  • “Two 5VDC 2.1A ports for more efficient charging in less time”
  • “Smarter USB charging with special chip designed to recognize and optimize the charging requirements of your device”
  • “Screw-free wall plate snaps into place for a more clean, modern appearance”

The second note is of particular importance to me. If it’s true, that means it might be using some USB charge port controller like TI’s TPS251x-series chips. But I’m not one to have blind faith in what’s written on the packaging. Let’s rip this sucker apart!

The outlet has a snap-on coverplate which may look sleek but could hamper removal of this outlet later on if needed. I was curious as to why one couldn’t just use a regular screw-on coverplate, and it turns out it’s because the mounting flange doesn’t have any tapped screw holes; you physically can’t use screws on this because the manufacturer didn’t want to go to the effort to make holes that can accept screws!

The casing is held together with four triangle-head screws in a weak attempt to prevent opening of the device. I had a security bit set on hand so this posed no hindrance to me. Upon removing the cover, the outlet seems rather well built. However, after removing the main outlet portion to reveal the AC-DC adapter inside, I quickly rescinded that thought.

The converter seems relatively well-built (at least relative to some crap Chinese power supplies out there). Some thought was put into the safe operation of this device, but there’s almost no isolation between the high and low voltage sides, and the DC side of this adapter is not grounded; the “ground” for the USB ports floats at 60 volts AC with respect to the mains earth pin. The Samxon brand caps are also pretty disappointing.

As for the USB portion of this device, I had to remove some hot glue holding the panel in place. After a few minutes of picking away at the rubbery blob, I was able to pull out the USB ports.

… and I found LIES! DIRTY LIES! There is no USB charge port controller, contrary to what the packaging claims. It just uses a set of voltage dividers to emulate the Apple charger standard, which could break compatibility with some smartphones. Ugh, well let’s put it back together and take a look at it from the performance side of things. At least the USB ports feel pretty solid…

To measure the voltage-current characteristic of the outlet, I rebuilt my bq27510-G3 Li-Ion gas gauge board so it had better handling of high current without affecting my current and voltage measurements. The reason I used this is because the gauge combines a voltmeter and ammeter in one chip, and by using the GaugeStudio software, I could create easy, breezy, beautiful V-I graphs.

Using a Re:load 2 constant-current load, I slowly ramped up the load current while logging the voltage and current data to a CSV file for analysis in Excel.

overall vi graphThis charger’s… okay. It has surprisingly good regulation up to 2.3 amps, but after that point the AC-DC converter basically brickwalls and the voltage plummets to 3 volts. That said, this also means that this outlet is not a set of “two 2.1A USB ports”. You can charge one tablet but you won’t be able to charge a tablet along with another device simultaneously.

Bah, I’ve had it with this wall outlet. Looks like this one’s gonna be returned to Costco in the next few days. This outlet may be adequate for some people, but for me it’s a disappointment.

Pros:

  • Solid USB ports
  • Good voltage stability (up to 2.3 amps, enough to charge ONE tablet)
  • Apple device compatibility

Cons:

  • Annoying coverplate design
  • Does not meet rated current output, will not charge 2 tablets or 1 tablet + another device
  • Does NOT have a “smart charging chip” despite being stated on packaging, some devices (eg. BlackBerry) will refuse to charge from these ports
  • Power supply for USB seems cheap
  • USB port is not grounded – if a short-circuit happens inside the power supply it can be a shock hazard to you

(Part 2 of 2) Microdrive Adventures: Looking into (and butchering) the Hitachi Microdrive and Seagate ST1 CompactFlash hard drives

(Part 1 viewable here)

Content advisory: electronics gore! 😀

refundI sent screenshots from Hard Disk Sentinel to the seller of the microdrives, and they refunded my money but didn’t want the drives back. Even then, it’d probably be a good idea to destroy the drives since re-use of them would be a bit… fraudulent after getting refunded. I decided to throw the drives around to see how well they’d hold up to physical abuse.

The Microdrive died when I whipped it against the concrete floor of my basement, go figure. The impact was strong enough to bend the steel frame but not enough to shatter the glass hard disk inside. Obviously, the disk didn’t spin up or enumerate in Hard Disk Sentinel. Now that the drive’s murder has been accomplished, it’s autopsy time!

The Seagate ST1 was put through a similar treatment, but it died much less gracefully when plugged in. The main controller chip (I think) shorted internally, and after about 15 seconds of being powered up, it released the magic smoke. The board’s plastic liner was melted where the chip shorted out. The drive internals weren’t much different than the Hitachi drives so I didn’t bother taking pictures of the drive’s insides.

After the damage was done, the drives were promptly put in a small plastic bag to be put in an electronics recycle bin.

(Part 1 of 2) Microdrive Adventures: Looking into (and butchering) the Hitachi Microdrive and Seagate ST1 CompactFlash hard drives

A few weeks ago I decided to hop onto eBay and buy a couple microdrives for fun. If you haven’t heard of the term, a microdrive is a hard disk drive that fits into a CompactFlash slot. These were intended to be the future in mobile storage, with 20 GB drives being the biggest around 2006. Of course, these drives proved to be very delicate, and besides, now we get 128 GB microSD cards!

The drives I purchased appeared to be pulled from some old iPod minis. The seller tried to remove the Apple logo with some sort of solvent, but left the smudges behind.

The problem with the iPod mini drives is that their CompactFlash interface is disabled. That is, the drive is really just a PATA drive in a CompactFlash’s body. Few devices that aren’t PCs support CompactFlash cards in this mode.

Being the curious type, I popped the drives into my Sony Clie NX73V, which I still carry with me even though it’s 11 years old 🙂 . It has support for CompactFlash Type I and II (thin and thick, basically), and, according to the properties window in the OS, uses the ATA protocol to talk to the cards. This means it should interface with the cards just fine… right?

First, I popped the Hitachi Microdrive in my Clie. One second after inserting the card, I see a question mark in the memory card’s taskbar icon. No dice.

Then, I moved on to the Seagate ST1. It spun up, but the Clie hung for about 30 seconds before finally displaying “The card cannot be recognized”. However, it did at least enumerate with the OS and I could pull up the manufacturer and model number of the drive.

Hm, well those ideas were dashed pretty quickly. Later, I bought a CompactFlash-to-PATA adapter, and a PATA-to-SATA adapter so I could hook it up to my laptop. From there, I used Hard Disk Sentinel (great software, by the way!) to analyze the drives and see if they have S.M.A.R.T. health reporting…

… and they do, alright! In fact, the drives I purchased were both soon to be dead. The Seagate drive had hundreds of bad sectors and a failing disk head/head actuator. The Hitachi drives had so many reallocated sectors that the drive literally ran out of spares. Too bad the Microdrive didn’t report how many sectors were reallocated though…

The drives themselves were in really bad shape, as seen below:

In the next part, I’ll show the aftermath of both drives. (Content Advisory: electronics gore)

Tearing down and modifying the Mars RPB60 power bank

A while ago I mentioned purchasing a very cheap battery pack that obviously didn’t live up to expectations. However, I didn’t get a chance to write about a more capable power bank, the Mars RPB60. It was branded as a SoundLogic/XT power bank, and holds 4400 mAh of battery capacity, with two USB ports (one labeled for 1 amp and 2.1 amps) and a micro-USB power input.

The power bank

The power bank from the outside looks pretty nondescript, with two USB ports, a micro-USB input, a button and four blue LEDs. Initially it seemed that there wouldn’t be any easy way to open up the casing without damaging it, so I tried to pry away the plastic covers at the ends. Doing so revealed plastic plates held in with small Phillips screws. Disassembly from that point was a cinch.

Removing covers reveals hidden screws

Removing covers reveals hidden screws

The PCB portion of the pack is of a stacked design. The two halves are connected with a set of small pin headers, with one side being the main DC-DC converter and USB output, and the other being the “gas gauge” and charging circuitry. The reason I put the phrase ‘gas gauge’ in quotes is that it’s only going by pure voltage thresholds, making it inaccurate when under load (like charging a phone and tablet, for example).

2014-01-05 00.25.02The main microcontroller is an unmarked 14-pin SOIC (likely an OTP-based PIC clone) and a TP4056 Li-Ion charging IC. The DC-DC converter is a DFN package that I couldn’t find any data on, but from what I can tell it integrates the DC-DC converter control circuitry and the switching MOSFETs.

2014-01-05 00.26.41

Blurry photo of microcontroller/charger PCB, taken with a potato for a camera. 😛

2014-01-05 00.27.16 Cells

The cells themselves seemed to be of good quality, but the bastards at Mars decided to black out the branding and model number of the cells! However, I was unphased at their attempt to cover up what cells they were using. With a careful cleaning with flux remover and some Kimwipes, I found that this pack uses ATL INR18650 cells with a DW01-based protection circuit. These cells hold 2200 mAh each, and the INR prefix means that these are high-power cells intended to provide heavy output currents. This is desirable as a 10 watt load like an iPad would definitely put heavy strain on the batteries. Considering the good cells they used, I don’t understand why they’d want to hide the markings on the cells (and in a half-assed way too!)…

The initial capacity was at about 4800 mAh (greater than the rated capacity 😀 ) with an average ESR of about 63 milliOhms. However, after a dozen charge-discharge cycles, the capacity has decreased to 4630 mAh and has an average internal resistance of 190 milliOhms. I’ve got a feeling charge cycle endurance may be an issue with this battery pack. Time will tell…

Gas gauge hacking

Since this battery pack didn’t have the gas gauge capabilities I wanted (voltage threshold-based gauging isn’t enough!), I decided to put in my own. I built a small bq27541-V200 gauge board with an external thermistor and current-sense resistor, using the breakout board itself to hold all the SMD passive components required for the gauge to function. The thermistor is taped to the cells to get an accurate temperature reading, and the current-sense resistor is attached in series between the cell’s negative terminal and the negative contact of the protection circuit.

Gas gauge chip added

Gas gauge chip added

This is where the hacking happens. I connected the I2C lines to the left USB port’s data lines. The voltage divider used for Apple devices is very high-resistance and makes for good I2C pullup resistors. The device still appears as a normal device charger but works just fine when the I2C signals are hidden behind the USB lines.

Quirks

However, the design for my gauge is definitely not the best one. I noticed that with heavy use (and not even one full discharge cycle), the gauge had reset 4 times without me knowing. Of course, I’m not expecting great performance from this gauge since it’s extremely susceptible to EMI (long wires looping around are just asking for trouble 🙂 ) in its current state. Given how I basically hacked this together in a matter of a few hours, it works well enough. Next up is to go into Altium Designer and make a proper gas gauge board with good EMI and RFI mitigation (and perhaps sell them on Tindie; the hobbyist community needs better gas gauges and stop being so paranoid about Li-Ion batteries).

Further testing showed that certain phones put pulses on the USB lines which has occasionally caused the bq27541 to crash and reset as well.

Additionally, I’ve noticed that the DC-DC converter circuit is quite inefficient. It has 5-7 mA of quiescent current draw and has about 60-80% efficiency. At a full charge, it will take only one month before all the charge is drained from the cells and the protection circuit disconnects the cells.

Future plans

Since this battery pack has a nicely built casing, I intend to gut the battery pack, design new PCBs inside with good DC-DC conversion, an Impedance Track-based fuel gauge, and an onboard microcontroller with some battery-logging capabilities (perhaps to an EEPROM or an SPI Flash ROM), accessible through the micro-USB port. I also plan to use some higher-capacity cells, like the 3400 mAh Panasonic NCR18650B.

If not, then at least I want to replace the microcontroller with one that will read the bq27541’s state of charge readings and display them on the LED bar graph.

Looking inside an iPhone 4/4S battery

A classmate of mine had a couple broken iPhones that he ‘relieved’ of their batteries and let me take a look at them. Being the curious type I peeled away the outer layers of tape to reveal the protection circuit. I spotted a current sense resistor, and  that got me thinking…

… can it be? Yes, I found a bq27541 fuel gauge chip inside the battery! After fooling around with the battery, I found out that the battery is using the HDQ interface.

iphone battery pinoutThe HDQ bus, which stands for ‘High-speed Data Queue’, is a single-wire communications bus used by TI fuel gauges. It’s similar to Maxim’s 1-Wire protocol but runs with different protocols and timing. It operates at 7 kilobits per second (so much for ‘high speed’ right? 😛 ) and a refresh of the data memory in the TI software can take almost half a minute. However, it’s good enough for occasional polling (like every minute or so) since it’s unlikely that the gauge will be read from every second.

The bq27541(labeled BQ 7541) in the iPhone battery runs an unusual firmware version. It’s running version 1.35 and doesn’t match with any release on TI’s website. The gas gauge is sealed so initially it seems like gaining access to the Data Flash memory would be impossible. However, in non-Apple fashion, the gauge’s passwords are left at the default; 0x36720414 and 0xFFFFFFFF for the unseal and full-access keys, respectively (and it’s not the first time Apple’s done this!). Since the firmware version is unknown, I told bqEVSW to treat the chip as if it were the bq27541-V200. I then saved only the calibration, capacity, resistance and lifetime data.

Updating the firmware over HDQ was a nightmare. It took over a dozen tries for each of the two batteries I had, and the update process took 45 minutes (!) to update the bq27541 to the V200 firmware. At one point, it seemed as if I bricked the chip, but a power-on reset of the chip by shorting the cell very quickly 😀 sent the device into ROM mode (ie. firmware-update mode). From there I used bqCONFIG to update the firmware, and it was successful! Now I could use GaugeStudio to interface with the gauge rather than the unsightly bqEVSW software.

bq27541 updated to version 2.00

bq27541 updated to version 2.00

Given how long it took for me to update the firmware of the gauge, I have doubts that iPhones will update their batteries’ firmware in-system. Hell, the iPhone OS ignores the bq27541’s State of Charge readings and substitutes its own. Nice going, Apple!

Now to start going through cell phone recycling bins to pull out dead iPhone batteries for their gauges…

Tearing down and analyzing a cheap-ass “Xtreme” $3.50 external phone battery

I was shopping around at this electronics liquidation store and stumbled upon a couple cheap buys: A “1900 mAh” external phone battery and another 4400 mAh pack (which will be the subject of another post and teardown). The batteries were originally priced at $7 and $38 respectively, but they were on sale at half price. For $3.50, I was curious enough about the 1900 mAh battery’s real capacity that I bought it anyway, expecting to be disappointed.

The pack itself is roughly half the size of a typical smartphone and about 1.5 times thicker. The casing itself has no screws; the manufacturer decided it was too expensive to use screws so they simply ultrasonic-welded the case shut. After about half an hour with a plastic spudger tool, I was able to crack the case open.

2014-01-05 00.11.26The soldering quality, surprisingly, is pretty good for a sub-$10 device, save for a bunch of hand-soldered components with flux residue left behind. The circuit board is made up of a battery protection circuit (yes, they actually put one in!), an ME2108A-50 boost converter,  something I’d assume to be a charging circuit, and an LM324 op-amp as a “gas gauge” (if you could even call it that!).

2014-01-05 00.11.36The cell appears to be a thicker version of a typical cell phone battery. It’s similar in size to something like a Nokia BL-5C which is a 1020 mAh cell, and is 5.6 mm thick. The cell in the charger is 7.7 mm thick. The charger’s cell is only 37.5% thicker but should have 190% of the capacity… yeah, no. This is not going to be very promising, given how the spot-welded nickel strips literally fell off the cell when I tried to desolder it from the PCB.

After soldering some 20-gauge solid wire to the terminals and hooking it up to a bq27425-G2A fuel gauge chip, I noticed that it reported that the fully-charged voltage is 4.25 volts. This charger tries to squeeze the most out of the cell by overcharging it! Granted, a Li-Ion cell’s maximum terminal voltage is 4.25 volts but it shouldn’t settle down to this voltage after charging!

1900 mah charger overvoltageAfter performing a few learning cycles to determine capacity and resistance, the cell holds merely 1370 mAh. The internal resistance is about 85 milliohms, which tells me that at least they used a relatively fresh cell in this charger and not just some recycled cell (*cough* UltraFire *cough*).

1900 mah charger graphI knew from the get-go that this battery was going to be a let-down, and I was right. But hey, for $3.50 I get a half-decent 1370 mAh cell and a few scrap chips (no way I’m reusing that battery’s PCB as-is!). But my verdict: Avoid this battery pack if you intend to use it to, I dunno, charge your phone. 😛

Skin-Deep Authenticity: Tearing down a “genuine fake” Samsung Galaxy S II battery

When you have the same smartphone for almost 3 years, it’s likely that your original battery’s not going to last as long as the service contract. And as long as you’re not an iPhone user you will probably look into a replacement or spare battery.

coverMy first replacement cell was a 2-pack of “1800 mAh” batteries for $5. These had 66% of the stated capacity and TI’s Impedance Track gauge said that the DC internal resistance was about 250 milliOhms. That’s… pretty terrible. Those two cells quickly led their end in a battery recycling bin. My next two were “genuine” cells from eBay. They cost about $12 each and had rather authentic-looking labels on them too. Their performance was pretty good, but one of them became all bloated so I decided I’d take a look at the cell that’s inside. I peeled off the label, and the truth comes out…

2014-01-01 04.53.39This battery was an outright lie in terms of capacity! 1350 mAh is about 80% of the 1650 mAh capacity that was written on the outer label. The cell’s manufacturer is unknown, but the battery markings read “BMW-524655AR 1350mAh 2012.09.03.1110”. Wait, look at that manufacturer date. Something’s fishy…

2014-01-01 04.53.54The outer label states a manufacture date of July 20, 2012. The internal cell states one of September 3, 2012. Unless this battery was manufactured in a time-bending factory, then these batteries certainly aren’t genuine.

Next up was the protection circuit. The “genuine fake” battery uses a DW01 protection IC and uses a generic 8205A dual NFET for swiching. And there wasn’t even a thermistor; the PCB uses a 1.5k ohm resistor to simulate one. A genuine board uses a single SMD package that integrates the FETs and the protection IC.

Below is a comparison of the protection board of a fake battery and a “genuine fake” one. At least the “genuine fake” uses the same black appearance of the original.

The “genuine fake” battery, after only 2 months of usage (not even 20 charge cycles’ worth), became so swollen that I can’t keep the back cover on. Running this battery through a bq27425-G2A battery gas gauge determined that the real capacity of the battery is a paltry 944 mAh, with an average internal resistance of 187 milliOhms. Absolutely pathetic.

samsung galaxy s ii replacement battery old ra graphGoes to show you get what you pay for. But some things may be more deceiving than others…

Reverse-engineering the Toshiba Tecra R840’s battery interface… the long way

Since the summer I’ve been all about interfacing with smart batteries. All the laptops I’ve had, I’ve deciphered the pinouts for. However, our college-supplied laptops, the Toshiba Tecra R840, has eluded me for over a year. The IT department didn’t allow me to obtain an old battery pack for disassembly (not like I was expecting them to 🙂 ), so instead I looked at disassembling the laptop to find out the interface. The reason I decided to take apart the laptop as opposed to the battery, is that the laptop is generally able to be taken apart and re-assembled without leaving permanent marks; batteries are often ultrasonically welded and can only be opened with brute force or a hot knife.

Laptop bottom cover removed and powered by battery

Laptop bottom cover removed and powered by battery

After removing many screws and popping the bottom of the laptop apart, I looked to the battery connector to find out the pinout.

Close-up of battery connector

Close-up of battery connector

The PCB had an unpopulated spot for some 3-terminal ESD protection diode, and this was a hint that these two pins were what I was looking for. I soldered some wires to the pins and a third ground wire, and attached them to a pin header. I used a logic analyzer to examine the signals (if any) that passed through the connector.

toshiba battery

Logic analyzer trace of initial battery insertion

And I hit pay dirt, or so I thought. I was able to find out that there indeed was communication between the battery and the laptop. However, the fun ends there. Looking closely at the I2C transactions, I could see that the battery wasn’t speaking the normal SBS (Smart Battery System) protocol. Testing with my Texas Instruments EV2400 confirmed that this isn’t a smart battery. It appears that the battery likely only contains an EEPROM for some battery information storage but lacks any real means of gas gauging. That would probably explain why battery life is abysmal on these machines!

Toshiba battery not detected with smart battery hardware/software

Toshiba battery not detected with smart battery hardware/software

I was able to mostly figure out the pinout for the battery, but what has yet to be seen, is which pins provide power to the EEPROM chip, as it seems that it is not powered internally.

Currently known battery pinout

Currently known battery pinout

Sometime later I’ll have to delve further into the contents of the EEPROM, or try and obtain one of these batteries for disassembly. We’ll just have to see.

Tearing down a Razer Orochi Bluetooth gaming mouse

Today, I randomly felt like I should take apart my Razer Orochi gaming mouse to see what’s inside. I figured that if I’m going to take it apart, I should document it.

So I did.

2013-05-12 16.26.39

The Razer Orochi is a laptop gaming mouse made by a company called Razer. They make a lot of gaming products like keyboards, mice and headsets. My brother has a bunch of Razer gaming devices (keyboard, headset and mouse) but this is my only Razer product that I own. The Orochi has a detachable micro-USB cord and also has Bluetooth support.

Looking inside, it appears that Razer definitely built this device to a price point. There are only 4 screws holding the device together (T6 Torx screws) and the rest are held together with plastic posts, with some components having the end posts melted to form a “weld” which might hamper repair efforts later if need be.

As for the electronics inside the mouse, there is a Freescale MC9S08JM60 8-bit HC08-architecture microcontroller, housing a 48 MHz CPU, 60 kB of program Flash memory, 4 kB of SRAM, 256 bytes of USB buffer RAM, a full-speed USB interface (12 Mbps), a real-time clock (I doubt that’s being used :)), an 8-pin keyboard interrupt module, and a few other peripherals expected of any general microcontroller (ADC, hardware serial interfaces, etc.). Bluetooth support is provided by a Broadcom BCM2042 module, which is advertised as being a single-chip device providing the HID (Human Interface Device) class and a full Bluetooth stack. It has its own 8051 8-bit CPU, 20 kB of internal SRAM, 8 kB of its own flash memory for configuration data, keyboard inputs, LED and LCD display drivers, quadrature decoders and a bunch of other features which are likely to be unused.

I was intending to replace the LEDs in the mouse (blue is such an ugly colour for LEDs) but it appears that the one on the mainboard is a red/blue bi-colour LED and the one in the scroll wheel is encased in plastic which has the end post melted in lieu of a screw.

Oh well, at least I was able to take a look inside this little piece of plastic and electronics.

Making Use of a Motorola Smart Card – Part 2

(Disclaimer: Smart card piracy is a very bad thing. This set of blog posts is NOT intended to further illegal hacking of paid services, but is merely a personal record of my research, which is not being done for any financial reasons but is only done for personal leisure. Besides, these cards won’t help you break scrambled TV signals, so don’t bother trying it :))

In between pulling all-nighters goofing off doing college homework and trying to stay marginally sane and/or healthy, I’ve been doing some more research into the cards. This time, I was a bit more invasive with my approach. However, I’ve found out a bit more about the card’s brains this way.

I’ve torn open one of the cards and taken a peek inside. The chip itself is a bit different in that the epoxy backing is molded much like a regular chip as opposed to the drop of epoxy used in many newer cards. The chip itself is pretty big, at 6mm x 4mm and with 0.1 mm thickness; the center gold pad is the entire area of the card.

There are many methods of getting the plastic off of a chip, and the more professional labs use fuming nitric acid (very nasty stuff) but one easy way to do so at home is using a blowtorch to burn the epoxy and simply chip it off with a toothpick. If it’s burnt thoroughly enough, the epoxy will just fall off the chip, revealing the pretty silicon underneath. I used a small butane torch to heat up the chip, which was done outside and on a piece of ceramic tile (safety first! :)) After a bit of picking at the chip, I was able to see the inner workings of the smart card’s chip.

I see 4 large blocks on the die but can’t tell much more without a microscope, and a 10x jewelry loupe only goes so far. My best guess is that the 4 blocks encompass the CPU, RAM, program ROM and maybe some EEPROM storage. There’s 14 pads on the chip; 5 pins are used for the contacts, maybe 2-3 for the radio interface, and the others might be for factory testing or programming  but it’s speculation at best.

Now hopefully my college prof won’t mind me using the classroom microscope later this week 🙂