I was just looking at unfinished posts and noticed that I’d taken, but not published, a bunch of notes I’d made earlier this year in hopes of hacking better firmware onto the Digoo BB-M2 WiFi PTZ Security Camera.I gave up on the quest, but here are my notes, with minimal editing.
Someone mentioned that the Chinese language page for Netcam360 has a link to the IPC-SDK. When I downloaded it and looked inside, I saw client-side code, but there was also a self-extracting archive called “HSmartLink Win32 SDK” and I remembered the PCB marking started with “HSL.” Searching for HSmartLink brings up hsmartlink.com, which, among other things, has IP webcams! The i9812 looks like a good match for my camera!
Unfortunately, no sign of any firmware updates. I checked the .cn version of the site too. It doesn’t seem as up to date on products (i9812 isn’t listed), and while there is more info in support section, it is still quite sparse. Page that looks like it is intended to link to downloads hasn’t been updated since 2015
Company is “Shenzhen Hsmartlink Technology Co. Ltd”
So what is the relationship to NetCam360 (check whois & IP ) and they mysterious APKLink?
Starting Nmap 7.40 ( https://nmap.org ) at 2017-02-06 18:38 PST
Nmap scan report for 10.31.1.124
Host is up (0.0043s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
23/tcp open telnet
81/tcp open hosts2-ns
MAC Address: E0:B9:4D:8F:61:6C (Shenzhen Bilian Electronicltd)
Nmap done: 1 IP address (1 host up) scanned in 0.49 seconds
I picked up a 21W, 3-panel Balight folding solar panel-based USB charger from Amazon for ~$36 a couple of weeks back. It uses high-efficiency SunPower Maxeon cells much like similar 20-21W panels from Aukey, Anker and dozens of obscure brands. All of them have the same basic construction. They are all made from nylon ballistic cloth. Each fold has a panel made from two SunPower cells encapsulated in a flexible waterpoof sheet. The panels provide power via two 5v USB ports, which presumably have some sort of voltage regulator.
I wanted to know more about how the chargers worked. In particular, I wanted to know if they were wired in series, or parallel because I wondered if it was worth trying to tap into the raw output, before the USB regulator to reduce power conversion and resistive losses for some applications.
I thought I’d be able to get the information I needed by finding someone documenting a teardown of their own panel on YouTube or a blog post. Despite the dozens of variants from dozens of brands and a handful of manufactures though, I didn’t find what I was looking for.
So, I decided to dig up a seam ripper and open my panel far enough to get a look at the wiring, and tap in to it upstream of the voltage regulator.
Bad photo of wiring
Another bad photo of wiring
USB Charger Output PCB
Backside of PCB
The panels appear to be wired together with some sort of woven wire conductor. I had some hope that all the cells would be wired in series, to give a nominal panel voltage of 18v. Based on what I could see, and measuring the voltage before the regulator in full sun, it looks like each panel is wired in series, for 6v nominal voltage, and then the panels are wired together in parallel. I was disappointed at first, but this arrangement makes sense in upon further thought.
Using a 2s3p configuration means that the input voltage into the switching regulator should be pretty close to the 5v (actually, 5.2v with enough sun and a light enough load) output of the USB power regulator, which will typically have higher conversion efficiency than 12 or 18 volts. It also means that the manufacturers can stock one converter for everything from a 7W single-panel charger, up to a 28w 4 panel charger without the converter having to support a wide range of input voltages. Perhaps most importantly, it means that partial shading of one panel shouldn’t have a disproportionate impact on the power output of the entire array.
The only downside is that resistive losses in the cabling will be higher with lower voltage and higher current, but that the interconnects aren’t more than a foot or so, the resistive losses shouldn’t be too high.
As for the converter itself, I may look at it more closely and add some more details, but, a few initial observations:
The PCB design has extensive ground planes on top and bottom, tied together with vias.
Both outputs are served from a single buck-converter (step-down) power supply based on a Techcode TD1583, which is a 380 KHz fixed frequency monolithic step down switch mode regulator with a built in internal Power MOSFET.
It looks like only port 1, at the top right in my photo, has the data lines connected, which suggests that it is the only one with fast-charge coding.
IC U2 looks like it has its markings sanded off. I notice though that one of its pins is connected to the enable pin on the TD1583, leading me to think that it is responsible for cycling the output to make sure devices draw as much power as possible when the panel voltage rises again after clouds or an object reducing the light falling on the array pass. I don’t know if it is a MCU, some sort of timer, or comparator, or what, though.
There you go. I can’t be sure that other folding solar arrays like this one are wired in the same way, but if they only support a 5v output, I suspect they will be. I hope this proves useful to someone besides me.
After ordering it, I was a bit worried I’d been scammed, because the seller never provided any tracking information, but those fears were quickly laid to rest when it arrived on my doorstep all the way from China in just 9 days!
The TDA7492 chip is used in a lot of compact, inexpensive audio amps made by various Chinese manufacturers and sold under various names on Amazon, Ebay, AliExpress, etc.
One such amp is/was the very similar looking SMSL SA-50 amplifier, which puzzled me, because when I first found the HV-50 listed on AliExpress, the seller listed it as an SMSL product. It wasn’t until I had it in hand that I realized that the eBay listing didn’t mention SMSL and there was actually no reference to SMSL anywhere on the product, or or the very thin users manual.
With some digging though, I found persuasive evidence that H&V is/was a new brand from he same company that produced SMSL. Given the price point, and product photos of the HV-50s internals, which showed signs of cost cutting, I assumed the H&V line would be a new, lower cost line, as SMSL seemed to be moving upmarket. Positioning the HV-50 as a lower cost alternative to SA-50 or A2 amps made sense when the HV-50 sold for $35-40, while the SA-50 & A2 were selling for roughly twice that. It makes less sense with the HV-50 selling for almost $60.
Looking more closely, the SA-50 seems unavailable from Chinese sellers on AliExpress and eBay these days. On Amazon, it sill goes for $60-70. The HV-50 seems to be in the process of being superseded. Aoshida, the source of my original amp seems to have both an eBay and and AliExpress presence. On AliExpress, they have a listing that pictures an HV-50 with a 24v power adapter for $42.28, shipped, but the listing is actually for a “TOE F1 TDA7492 amp” and notes that the housing may say HV-50, but it’s been “upgraded to TOE F1.” Their eBay store has a very similar listing, also for a “TOE F1 TDA7492 amp” for $53.00.
I think the HV-50/TOE F1 is a pretty good deal at $42 shipped with a power brick. At $50-60, that’s less clear. I’d probably pay another $10-15 for an SMSL SA-50. The reason? If the SA-50s shipping today are the same as those shipping a year ago (not a sure thing, given that SMSL changed the guts on the SA-36pro without warning, explanation, or acknowledgement) then they use some high quality film capacitors in key parts of the audio path.
On the other hand, the HV is clearly a cost reduced design, as I suspected from the initial product photos, and confirmed upon receipt. It uses SMD ceramic caps for all but the main power supply caps. I personally think the cheaper caps work well enough. I don’t have an SA-50 to compare the HV-50 to, but while it’s possible they would sound obviously different, I doubt the SA-50 sounds noticeably better. For $30 less than the SA-50, I think the HV-50 is an obvious choice for those on a budget. For the current $10-15, price difference, it is much less clear cut.
What remains to be seen is if the TOE F1 is actually an upgrade, and if so, in what way? Will they adopt the film caps used by the SA-50?
When powered up, a tiny click may be emitted from the connected speakers.
I noticed no obvious defects in sound quality. My main complaint is that the design & construction of the PCB-mounted RCA inputs doesn’t make good solid contact with the slotted, machined pins on some higher-quality RCA plugs, leading to noise or audo drop-outs. At first, I though the volume control pot was going bad. I ended up replacing the jacks with some gold-plated panel mount jacks with better design/construction. Interestingly enough, while the original part has trouble with higher-end RCA plugs, it has no problem at all with inexpensive stamped & rolled RCA plugs.
Speaking of connections, the speaker output binding posts are small, but work well with banana plugs, spade connectors and properly trimmed and stripped speaker wire (to avoid shorts).
There are a few important caveats about the HV-50, which may or may not apply to the TOE F1:
First, it’s important to understand that the generation of class D amplifier chips like the TDA7492 used in the HV-50, along with the more powerful TDA7498, and the comprable TPA3116, all have consistently inflated power ratings. These ratings are often used in the specs of cheap amps built around such chips.
The inflated ratings aren’t exactly inaccurate, its just that they only apply under unlikely listening conditions. They assume a power supply voltage near the top of their operating range which ends up being 24v for the TDA7492 and TPA3116. This isn’t an issue with the HV-50, which comes with a 24v supply, but can come into play when using ~19-20v laptop adapters. The tests are often performed with ~4 Ohm loads, while lots of home audio speakers are closer to 8 Ohm, and peak power output would be ~50% of the advertised number. The finally issue with the ratings is that they allow up to 10% distortion, a value that most people will find unlistenable. Values are generally also given for up to 1% distortion, which most people will find suitable. The corresponding power ratings are ~50-60% of the advertised value.
In sum then, the usable power of the HV-50 and similar amps with a suitable power supply is 50W * 50% (for 8Ohm speakers) * 60% (for reasonable distortion levels), which works out to 15w/channel. This may seem much less impressive, but it should be enough power to push most consumer bookshelf speakers close to their (and your) limits.
Second, the HV-50 does not, as claimed in the Bangood listing and elsewhere, contain parts from EPCOS, Philips, ALPS, DALE, etc. The volume control pot seems like a cheap, but adequate generic Chinese part, and the capacitors in the audio path are all SMD ceramics.
Bottom line: The HV-50 is a decent, inexpensive Class D amp if you can get it shipped with PSU for ~$40. Whether it is a good choice vs an SA-50 or similar really depends on the price difference at current market prices.
And finally, the main purpose of this post wasn’t writing a wall of text, it was sharing photos of the guts of my HV-50.
I’ve ended up with five small, inexpensive ($7-15 each) routers, running OpenWrt and only really need two of them, so I’ve been thinking of ways to use the others. One of my ideas was to get an external USB DAC, install Shairport-Sync, and use it as an AirPlay receiver for my car stereo, eliminating the need to connect an audio cable to my phone, and avoiding the mediocre sound quality of Bluetooth audio. It hasn’t quite worked out that way though…
While looking for an inexpensive (>$20), compact USB DAC with reasonable quality, I discovered there were integrated commercial products that already do what I planned to do. I already knew there were Apple-approved MFi-certified devices, but they tended to be expensive. I discovered there were cheaper devices using Shairport, but they tended to start at $30+.
Damaged while trying to open the case.
With a little more digging though, I found a device called the iReceiver, from AirMobi that sells for as little as $12!!!. According to the scant marketing materials, it has a 24-bit Wolfson DAC. I was surprised I couldn’t find anyone who’d opened one up to see what was inside. I did find an Amazon review from someone complaining that the usb power connector had broken off on theirs, and the included photo showed it had a Ralink RT5350F WiFi SoC, which gave me hope that it would be hackable. So, I bought one.
Before opening it up, I tried it out. It works as promised. It defaults to broadcasting an unsecured WiFi network. Once connected, it shows up as an AirPlay receiver in iTunes, etc. From there, you can connect it to some powered speakers, select it and start playing music. The audio quality doesn’t suck (no obvious noise, clipping, or distortion), and in my limited use, there were fewer dropouts that I’m used to with Bluetooth.
Beyond that, there are various configuration options available through a browser based interface. There are no audio-related settings at all. Most of the settings are networking related. You can rename and secure the WiFi network with a password (good), WPS (bad) and by limited connections to specific devices by MAC address (meh). You can also connect to an existing network (good), and, optionally, extend it (meh). This seems like a good point to mention that it also works as a DNLA “renderer” (DNLA is a more open standard than AirPlay, making this useful to Windows and Linux devices, and Android phones with an appropriate app)
Of course, I didn’t buy it to use it with the stock firmware, so after trying it out, I opened it up to take a look inside. In the process, I managed to tear the translucent plastic that was affixed to the top of the case with adhesive. With the trim removed, it was easy to pry off the top, revealing the single PCB inside.
The other major component is a Wolfson WM8960 CODEC to provide the audio output. This chip debuted in 2006, and includes 24-bit stereo DAC and ADC converters supporting sample rates up to 48Khz, a 40mW headphone driver, and a 1W Class D speaker driver.
Despite being a 24-bit DAC, the specified SnR of 98dBS matches that of the 16-bit TI/Burr Brown PCM2705 DAC used in the original AirportExpress, rather than of a modern, premium 24-bit DAC used in more recent AirportExpress’s. Oh well. Good enough for my purposes. Most of what I’m playing is compressed AAC files derived from 16-bit sources, and, AirPlay only passes 16-bit anyway. Beyond that, the design of the rest of the circuitry matters, and I’m not qualified to analyze it, nor am I equipped or inclined to try and measure it.
Beyond that, I see two inductors on the board (one of which is cracked). My guess is that these are part of some small switch mode power supplies, perhaps one for the digital section, and the other for the analog. There are two small LEDs to indicate device status and two momentary switches, one to reset the device, and the other to trigger WPS. It looks like it uses a single ceramic chip antenna for the WiFi.
There are a few unused pads for components, eight test points (half seemingly to do with power) and four unused holes for pin headers that I suspect provide a serial console.
That’s really it for the hardware. I’ve already started poking more deeply into the software and investigating the suspected serial console, and I hope to have another post soon documenting what I found.
I’ve passed up a few chances to get a Keithley 2001 7.5-digit multimeter on eBay for ~$500, because while that’s a pretty good deal for a Keithley 2001 in working order, it’s more than I can justify spending on a 7.5 digit multimeter that I want, but don’t need. Somehow though in my twisted psychology, spending $300 on a two-decade older 7.5-digit multimeter with known issues is perfectly acceptable, because I recently did just that.
A couple of weeks ago, I was checking eBay on my phone while waiting for an appointment and came across a new llisting for a Datron 1081 Multimeter that caught my eye. It was listed for parts or repair for $300, or best offer.
According to the description, it had been damaged in shipping, and gave an error during selftest. From the photos, it looked like the shipping damage was confined to a broken “ear” on the front of the case, and misalignment of the front panel. Definitely interesting…
Some quick googling confirmed that the 1081 was, as I thought, a 7.5-digit capable multimeter with high stability and and the ability to use an external voltage reference. I thought it would be useful for evaluating and calibrating precision voltage references, and 6.5-digit DMMs, like the Keithley 2000 and HP/Agilent/Keysight 34401a. I couldn’t find an operators manual for the 1081, but I hoped the 1071 manual I found was correct that the selftest error was with the AC measurement circuitry. I’m mainly interested in DC, so I wasn’t too concerned.
I reviewed past eBay listings on my phone to confirm that the 1081 typically goes for more than $300, checked my gut, and decided to make an offer of $200.
The seller responded within a few hours that the listing had generated a lot of interest, and counteroffered for $275. At this point, I was back home, with the ability to browse eBay without the limits of a phone. I should have taken advantage of this to investigate past listing a little more thoroughly. If I had I would have realized that some of the higher sales prices weren’t actually sales, they were expired listings that eBay wasn’t filtering properly. I didn’t though, instead I accepted the offer.
It took a few days for the seller to ship the item, and it was shipped by FedEx Ground, so it took over a week to get to me. It arrived last Friday, packed well in a Cisco router box with reused foam endpieces and packing peanuts for extra protection. It was in the physical condition I expected; the case damage was limited to an extremity, and the main enclosure was sound. I opened it up for inspection and to deal with the misaligned front panel.
The front panel is a metal plate covered with a big printed plastic sticker. The sticker holds a smoked plastic protective lens over the display. The sticker was loose at a few spots, including the protective lens, which allowed dust and exposure to further weaken the adhesive. I decided to remove it, clean it up, and reattach it.
I heated the panel with a hair dryer to loosen the adhesive, but that didn’t work all that well. I ended up peeling the outer layer and printed layers of the sticker off its backing. Some adhesive remained on on the printed surface of the label, and the backing remained stuck firmly to the metal plate. I used a plastic scraper to remove most of the backing, but getting the rest off required a razor blade, elbow grease, and solvents (“Goo Gone” worked best). I used isopropyl alcohol to clean the remaining adhesive off the back of the printed sheet. Unfortunately I think the process of peeling off the label led to some of the printed brown background along the left side of the lower edge crazing and flaking off. I considered trying to apply a new background of spray paint, but decided the risk of causing further damage wasn’t worthwhile.
Once I got everything cleaned up, I decided to use some non-corrosive silicone adhesive to stick everything back down again. I smeared a thin layer all over the back of the sticker, and around the edge of the smoked lens before lining everything up and sticking it back down, smoothing it out and wiping off any ooze. I weighted the area over the lens and let it cure for a few hours before reattaching it.
As for the electronics, there sure are a lot of them, and very few of them are electrolytic capacitors – the component most apt to fail on older equipment. I looked everything over very closely.
I was relieved not to spot any physical problems, because while everything is through-hole components, many of them are packed in very closely, and a number of them look like nothing I’ve ever seen before. Repair would be challenging.
My first Glass Capacitors
Actually, there was one problem, but one I expected to find.
The back panel was labeled at manufacture with a battery replacement date of April 1992! Either the battery hadn’t been changed, or whoever did so was too lazy to update the label. Inside I found the truth, the battery had a datecode of 1984, like most of the other components. Fortunately it still had a voltage of 3.7v, but I’ll be changing it soon.
I found a few other interesting things as I looked the device over.
The photos above feature four 1N829a temperature compensated zener diodes. Together, they make up the heart of the voltage reference. They are each numbered with a unique serial number because they were carefully aged for months (or years), then characterized for noise, stability, voltage, and the current at which they have flat temperature sensitivity. My understanding is that the four Zener are connected as two parallel series of two.
I plan to look at these in more detail in a future post, because the unique characteristics of this voltage reference may make it the most notable part of this device. The use of hand-selected temperature compensated Zener was a common practice in a variety of precision instruments at one time, even so, the use of multiple TC Zeners was unusual, as is the stability they obtained. Also by the mid-1980s, when this device was made, use of temperature stabilized burried-Zener voltage references, like the LM199 (introduced in 1976) was commonplace.
This insulated metal strip running the length of the digital board between a row of I/O bufferes, and the ribbon connectors, also caught my eye.
I found evidence of a component level repair on the AC RMS converter board. Most of the components on the AC RMS converter board, and most of the other boards, have date codes no later than mid-1984, but the Fairchild opamp in the hermetically sealed package in the photo above is dated from 1987. The GPIB board seems to date from 1985, and there are some socketed ICs on another board that have 1986 date codes, while other chips on the board are from 1982 or 1983.
Artifacts of repair can also be found on the inside of the case, where some of the melted nubs holding the RF shielding seem to have sheered off and been replaced with some glue.
After checking it over and fixing the front panel, I reassembled it, and powered it up. On the EEVBlog forum, “dacman” suggested that self-test error could simply be the result of running the tests with the “guard” switch was set to remote. I could see from the photos on the listing that it was, indeed, set to remote, and it still was when I received it, so I set it to local guard and ran the self tests. Everything passed!
After that, I did spot checks on the 100mv, 1v, 10v and 100v DC ranges using the output from my EDC 521 DC voltage calibrator. The EDC hasn’t been calibrated in years, though from my tests, it is accurate to within the combined 1year tolerances of both it and all my 6.5 digit DMMs. The readings are stable over the short term.
I’ve also done some longer term checks of a 10v signal over a period of days and found that for the most part, the peak-to-peak variation is within the 20-40uV range measured by one of my Keithley 2700s (it is a 6.5-digit meter, but in stats mode it collects and calculates 7.5-digit values) in my Seattle home, near an external wall, without any heating. Sometimes the Datron has reported a wider range than the Keithley, sometimes a narrower range. I’ll need to get logging working over GPIB soon so I can can look more closely at the trends.
In the first few days, of use, I ran into a few instances of unexpected behavior, some of which may have been user error, some of which may have been software bugs, and some of which is as of yet unexplained.
One of the first things to crop up happened while I was checking the 100v range with a 100v output. After the initial readings seemed good, I left it for a while and checked it while I worked. About 15-30 minutes in, I looked over, and it was reporting values of 110v or more, and they were changing quickly. I haven’t been using the EDC much in its 100v range, so I breifly considered the possibility that it was at fault, but a quick look at the Keithley 2700 measuring the same source showed that the voltage was still stable at 100v.
The reading on the Datron was still on the move and soon it was reporting an “Overload.” I tried changing to the 1000v range, but the Overload message remained. I cut the EDCs output and after about 30s, the Datron cleared the overload message and started giving readings again. I applied an input again (I can’t remember if it was 10v or 100v), and it again gave plausible readings. I left it for a while and continued checking it, and after a while, it was again reporting an overload. This time cutting the EDCs output didn’t clear the overload message, and I ended up power cycling it.
Since then, I’ve been focused on the 10v range, and I haven’t seen this behavior again. I have had it with a 100v input for the last 18 hours or so though, and its been solid. I’m beginning to suspect that the problem may have been the result of user error. At some point, I think I’d used a function that “zeros” the meter. I thought this worked like the relative measurement option on my Keithleys, which can give readings relative to any voltage. The Datron 1081’s feature is different. The zero-point is supposed to be set with the inputs shorted, and the value is stored and used until the next time the meter is zeroed. If it is more than a small portion of the full range (1% or so), it will give a overange error. I’m wondering if perhaps the zero-point that I or someone else previously set was near the limit, and perhaps some internal auto-correction ended up pushing things over the limit. This is just a stupid wild ass guess though. All I can be sure of is that since setting the zero point for all the ranges with the input shorted, I haven’t had this happen again.
I spotted the next problem after leaving the DMM on overnight. When I checked it the next morning, I suspected that the display had frozen because the last digit didn’t change once. I pushed a button to change the value displayed, and was treated to the above, after a minute or two, it seemed to reset itself and resume operation.
The next morning, after leaving it overnight, I again found it with a frozen display. The first button I hit produced a similar result to the previous day. I tried hitting another button (I don’t remember which) and the rest of the display segments and all the indicator LEDs on the buttons lit up too. This time, it didn’t reset itself, at least not before I got tired of waiting.
I haven’t seen this behavior since, despite leaving the unit on continuously. A few days ago though, I decided to investigate a hunch. I thought that that when I saw this problem behavior previously, I may have left the unit displaying the delta between minimum and maximum values. So, I again left it in that state, and the next morning, the display was again frozen. This suggested that my memory was correct, and that it was infact a software problem. However, the following morning, after again leaving the unit in min-max display overnight, the problem didn’t present itself. So, it seems that I still don’t have it figured out.
I’m trying to decide where to go from here.
At the very least, I’m going to power it down, open it up again, and take a close look at power supply voltages and ripple.
When I power it up again, I’ll keep an eye out for a recurrence of any of the bad behavior I observed. If so, it will suggest that some of the problems are the result of bad solder joints that act up when the unit is coming to a new thermal equilibrium.
Beyond that, i’ll do some logging over the GPIB interface to get a better sense of stability and tempco. I also need to investigate the resistance and ACV functions.
After that, I’ll have to consider whether to get it calibrated, or figure out a way to calibrate it myself. I’d also like to investigate its ability to use an external voltage reference to provide high-precision comparisons between different voltage standards. Doing so will require either figuring out a source of the (likely expensive) low-thermal-EMF rear panel connectors, or replacing them with similar performance and lower cost.
I’m also still looking for a Datron 1081/1082 Users Handbook (the 1082 is basically a 1081 with all the options). The Datron 1051/1061/1071 users handbook has been useful, because for the most part, they operate very similarly to the 1081, but there are some important differences with the digital filter, and some of the other aspects.
Last week I came across a miscategorized eBay listing for an Electronic Development Corp (EDC, now owned by Krohn-Hite) 521 DC Voltage/Current Source. It was listed in the network equipment section, with “Juniper” as the manufacturer.
The EDC 521 is a precision DC reference source with high accuracy, precision and stability, for the calibration of meters and sensors. It can output voltage in three ranges, (0-100mv, 0-10v, and 0-100v), and constant current in two ranges, 10mA and 100mA (with compliance voltages up to 100V). In each range, the precision/resolution of adjustment is 1ppm. Overall stability in Voltage mode, within the devices operating temperature range is 7.5ppm over 8 hours, 10ppm over 24 hours, 15ppm over 90 days, and 20ppm over a year. The temperature coefficient (which is included in the above estimates). It is microprocessor controlled and has a GPIB interface to allow remote control.
To achieve its basic stability, it uses an aged and selected 1N829 temperature compensated Zener diode as its primary voltage reference. This diode is driven by a stable precision current source at a current chosen to provide the best combination of temperature stability, long-term drift and low-noise for the individual diode used in each unit. Adjustments are made using a custom, precision 24-bit digital to analog converter.
The DAC works by feeding the reference voltage across a resistor divider to obtain 10 output voltages, tapped at 500mV intervals. If I understand correctly, these voltages are switched to provide analog voltages for each decade, these voltages are buffered, then then weighted and summed using some precision resistors before being fed to the output amplifier.
When the package arrived yesterday, I saw why the listing had been miscategorized — it was packed in a box for a Juniper Networks switch. That, and the sticker noting a failed calibration attempt in 2009 makes me doubt the seller’s assertion that it was “pulled from a working environment.” Not that I expected a pristine, calibrated instrument for $150.
Inside the box, I found things in a bit worse physical shape than I expected. What I thought was shadow/glare in the photo from the ebay listing, was actually a torn red filter over the LED display. And the underside of the case, which wasn’t pictured in the listing, had a huge dent.
On closer inspection, the dent didn’t reach the PCB inside, and I was able to remove the panel and hammer it out. Once inside, I found that everything had a fine coating of persistent dust. Hitting it with canned air shook some of it loose, but most of it remained.
So, I got to work rinsing it with a lot of isopropyl alcohol which I then chased off the edge of the board with canned air. After a few repetitions, the top and bottom side of the board were pretty clean. I then looked over both sides of the board closely, looking for damaged components, and cleaning out little pockets of residue.
I didn’t see any damaged components, but along the way noticed signs that the board had received some major revisions. There was an obvious bodge wire on the bottom of the PCB, but it was also clear that new holes had been drilled to receive additional components. On the top side, I found a cut trace, along with a couple of added resistors and a couple of capacitors. I haven’t traced everything out, but its obvious that the bodge wire connects to one end of the internal reference divider, and the rest of it is on the opposite end, so it would seem likely that its helping isolate the reference divider, and the voltages it produces, from noise sources.
It also appears that a number of power transistors have been replaced. Unfortunately, none of the components in question have obvious date codes, so its hard to guess when the modifications were done, and whether the transistors and the filters were added at the same time. Perhaps one of you knows how to decode the markings? First line is a Motorola logo followed by “616,” the next line is “JE350,” which is the model/part number. The datecodes on other components pretty much all date to late 1996, and the MPU board has a label with the firmware revision and is dated January 1997.
Before closing it up, I took care of the loose plastic supports for the back-edge of the PCB, which holds heavy electrolytic filter caps for the power supply. I cleaned the old, crusty, failed double-sided foam tape off and replaced it with new tape so I could stick the supports to the back of the chassis again.
I powered it up, and gave it a quick check on all the voltage and current ranges. It seems pretty close to its 1 year tolerances. I was surprised by the amount of time it took to warm up and stabilize, but when I checked the manual, I saw that the warm up time is speced at 2 hours.
I powered it down over night. This morning I set up my computer to voltage readings ever few seconds and then powered it back up. I’ll post a graph once I have a days worth of data. After that, I’m going to write a script to run through all the possible settings and log the measurements. So, more to come!
I decided to buy a USB “power bank” or backup external battery to keep in my backpack to recharge my phone or iPad when I am away from the house.
I looked at lots of options over the course of a few months before I pulled the trigger. It was hard to make the decision because their seemed to be a big variance in capacity, price, and charging rates. What finally tipped me over the edge was finding a 10,000 mAh unit that could charge external devices at 2A and recharge at 2A for $17.99. Actually, the numbers associated with the model I purchased, (KMASHI 10,000 mAh) USB specs aren’t that unusual, but often times, the devices fall short of their claimed capacity. In this case though, there was a review by someone who’d done some testing and found that it pretty much hit the mark (though it did seem to fall short in the rate it charged USB devices).
When I received the product, I was a little disappointed. It worked as promised, and seemed solidly made, but It was bigger and heavier than I’d expected, and so I decided to crack it open to find out why.
It took some effort to get it open. I thought it might be glued shut, but with a little effort, I was able to persuade some of the latching tabs that held the case together to slip free by jamming something into a seam and working it around.
This is what I found inside. As you’d expect, a good portion of the volume is taken up by the batteries, five cylindrical 18650-sized lithium ion cells. This is the reason for the size and weight of the device. First off, the cylindrical cells don’t pack together as tightly as flat-pack pouch cells found in most phones, tablets, and higher end USB battery packs. Second, their steel walled container weighs more than the plastic membrane used on flat pouch cells.
The bigger issue though is that there are five of them, which means that they must each have a capacity of only 2,000 mAh. That’s not much. 18650 cells (which stands for 18mm diameter, 65.mm length) are widely used for laptops, battery powered tools, and even Tesla automobiles. I pulled some 18650 cells out of ~5 year old laptop battery packs that are rated for 2,600 mAh and still deliver ~2,550 mAh. More recent laptops use cells with 3,000, 3,200, or perhaps even 3,400 mAh capacity, so it would be possible to build a power bank of equivalent capacity with four, or as few as three cells, with a corresponding reduction of weight and size.
On the other hand, those larger capacity cells from Panasonic, Samsung, Sony, and others, retail for $6-8/cell, and 2,600 mAh cells go for ~$3-3.50. I am sure these cells were much much cheaper.
The cell wrappers are labeled “KMASHI SO50 18650KOVL PXORXRPT 3.7V,” This doesn’t give much of a clue as to the true origin of these cells. KMASHI doesn’t appear to be an actual battery manufacturer, that comes up in other contexts. 3.7V is the typical voltage for lithium ion cells, and 18650 is a common form factor, but searches for any of the terms on the label doesn’t produce useful results. I could cut the wrap off and see if there are any clues printed on the metal, but then I’d have to rewrap the cell, which would be a pain since they are all welded together.
So, who knows what kind of cells these are, they might even be reused used cells, for all I know.
This photo shows that the cells have been spot welded together in a parallel configuration, which is commonplace in multi-cell USB battery packs. I suspect the parallel approach is typically used for a few reasons. First, it should be more tolerant of lower quality cells than the series-configuration. Second, it should pose less of a risk of frying the USB device if the voltage regulation circuit is funky. Finally, it makes it easier to charge the pack off of a USB power adapter.
Looking at the end of these cells gives another hint that these may be reused cells. From my experience, raised bottoms are unusual on 18650 batteries, and others have reported that they are often used to hide the evidence of old welds on cells that have been pulled out of assembled battery packs.
If they are reused cells, that causes me some concern. If they are good quality cells from battery packs that just sat on the shelf (aka New Old Stock), then it would be a non-issue as I have obtained cells that way myself. If they’ve actually been used, or if they are from very old packs though, thats a problem, as they could fail prematurely, and failing lithium ion batteries can be dangerous.
For completeness, I give you the printed circuit board, which is labeled as “WNT-816 Rev 1.0” and “PN:20140422” on the top. I can’t say much about the components. The two largest chips appear to have been sanded to obscure their origins. There are two other chips that have their markings which read “FS8205A,” near as I can tell, they are used for managing the discharge of lithium-ion batteries.That, and the inductor is solid-core, unlike the many hollow-core inductors I’ve seen on the powerbank PCBs they sell on Fasttech.
On the bottom, it is labeled “wesemi-816.”
I reassembled it and I’ve used it since taking it apart. It works pretty much as expected. I’ll post an update in a few weeks once I get some stuff I ordered for testing USB power sources.
Today I took apart two different 3rd party battery packs for the 2006-2008 15″ MacBook Pro. The OEM batteries had the following model numbers A1175, MA348, MA348G/A, MA348J/A, MA348*/A.
These packs probably date from early 2010.
NuPower and Lenmar batteries
The first is a Newer Technology NuPower 63Watt Hour Capacity Battery, part # NWTBAP15MBP58RS. There is a barcoded sticker on the outside with the number U091228A11753.
The second is a Lenmar, 10.8v, 60WH/5600 mAh. Model/Part LBMC348.
Superficially they look very similar, but their are some significant differences in their construction.
The NuPower has a relatively thick aluminum plate on the outer surface that is glued to the case. If I recall correctly, this glue failed prematurely and had to be redone. The bottom section of the battery pack is a single piece of plastic, though the back side is painted with a metallic paint to simulate the appearance of the original Apple battery. While this would seem to be a reasonable construction approach, one has to wonder why Apple chose to use a metal back in the first place. A metal back would be thinner than a plastic back, and also transfer heat more readily.
The Lenmar uses a thinner sheet of aluminum for its outer plate. This plate is then adhered to a thin steel sheet that has various bent tabs which catch and latch into the plastic frame of the bottom case. The plastic frame is then glued to a thin steel tray. This is closer to the construction of the original Apple battery pack
Internal view of NuPower and Lenmar battery packs
Once inside, we see a more significant difference in the construction of the two battery packs.
5,600 mAh Lithum polymer pouch cells in NuPower battery pack
Cells from Lenmar battery pack
The NuPower pack, on the left, has a single stack of three 3.7v 5,200 mAh cells. They are labeled as Yoku 3895130, 5,200 mAh/3.7v, BL9120407012749. They measure ~130x95mm and the stack of three is ~11.25mm thick.
The Lenmar pack, on the right, has 3 stacks of pouch cells, each stack is 2 cells deep, connected in parallel. They are labled as YLE 3.7v, ICS594395A280 468061801483. Each pair of cells is ~90x42mm and is also ~11.25mm thick.
I don’t have an original Apple battery around to use in a close comparison, but the Lenmar battery pack construction is much closer to my memory of the stock Apple battery, both in terms of cell configuration, and assembly. I’m still not sure what to make of the absence of a metal back on the NuPower battery. I thought perhaps the Apple and LenMar batteries used the metal back to accommodate a slightly thicker battery, but that doesn’t seem to be the case, since the thickness of the cells in both the Lenmar and NuPower packs is 11.25mm. I don’t know how thick the cells are in an original Apple battery, but I suspect that the metal is there for better heat transfer, and its omission seems like an undesirable bit of cost cutting.
Looking more closely at the cells, I see that Yoku is a battery manufacturer based in Fujian, China. I’m going to guess that the “3895130” gives the dimensions of the cell, 3.8x x95x130mm, which pretty much matches with the dimensions I measured. I don’t know what the remaining number is, but my guess is that it is a manufacturing lot code.
YLE is manufacturer based in Shenzen, China. and ICS594395A280 is a documented part number for a 5.9x43x95mm 2,800 mAh/3.7v cell.
Interesting that the nominal capacity of the Lenmar cells are higher than the cells used in the NuPower, but NuPower claims theirs is a 63 Watt-hour battery, while Lenmar only claims 60 Wh. At this distance though, what I know is that the Lenmar pack is well and truly dead. Two of the parallel packs had voltages ~1v, which is dangerously low. The remaining pair of cells was ~2.6v, which might still be safe to use, though I’d have to put it through testing to see how much of the rated capacity remains. The NuPower still works, and the cells were at something close to 3.7v each. The estimated capacity of the pack, as reported by System Information, is quite low though, perhaps 50% of original, which is why I decided to tear it open in the first place.
I’m not sure what I’m going to do next, other than recycling the low cells. I’ll probably set the good cells aside until I get a hobby charger that I can use to analyze them and decide whether they are worth keeping to power misc projects.
I’m also going to look into buying replacement cells and rebuilding the packs, provided that the price is right and the seller is reputable. I could just order a replacement for the whole pack, but I’d be a bit concerned about getting old stock at this late date.