Open Source and Hardware Engine Management Systems (ECUs)

I recently fell down a rabbit hole of car modding videos on YouTube. Most/all the videos I watch involve engine modifications, and there inevitably comes a time where the car gets a new tune on a Dyno in order to realize the potential afforded by the mods.

Tuning a modern car involves tweaking parameters in the engine management system, or engine control unity (ECU). Budget builds often make use of the OEM ECU that originally came with the engine (which may or may be the engine originally installed in the chassis) but the addition of forced induction via a turbo or supercharger to a normally aspirated engine usually calls for an aftermarket ECU.

Aftermarket ECUs offer another advantage for older vehicles; by using existing engine sensors, and perhaps adding a few more, a lot of engine control functions can be consolidated in the ECU, rendering various vacuum controls and mechanical linkages unnecessary. This can help clear space in a crowded engine bay, and also improve reliability, serviceability and, potentially performance, fuel economy and emissions.

From my research, tuning an OEM ECU may involve hundreds of dollars in software and hardware. A modern aftermarket unit suitable for upgrading a four cylinder engine starts at about $850, and one can spend more than twice that for an advanced feature set and the ability to run sequential ignition and fuel injection on a six or eight cylinder engine.

The prices of aftermarket ECUs aren’t outrageous compared to the cost of parts or labor for a big project, but they start looking more substantial if you plan to do most of the work yourself while scavenging parts as cheaply as possible. This got me wondering about whether there was a community of people either developing open source firmware for common OEM ECUs, or perhaps custom hardware.

It didn’t take too much looking to find two active projects with healthy communities around them, Speeduino and rusEFI.

Speeduino has been around since X. In 2017 it was a finalist for the hack a day prize. The author, Josh Stewart started out by using Arduino based hardware to run a lawnmower engine. By now it’s been used to run a variety of engines with 4-8 cylinders. The hardware is based on an Arduino Mega. It adds a robust automotive power supply, protection for the I/O channels and driver circuitry suitable for ignition coils, fuel injectors and other components.

A board capable of sequential fuel injection and ignition on 4 cylinder engines is available assembled for under $200. A unit that is plug-compatible with the ECU on a first generation Miata is available for ~$250, including an external housing.

Interestingly (to me), the Speeduino firmware takes advantage of the Arduino build environment and some libraries. This has enabled people to port the firmware to more capable ARM-based Arduino-like devices, like the Teensy. These ARM based platforms afford the possibility of more advanced peripherals, like CANbus controllers, more memory for data logging, and more headroom, allowing things like unlimited software timers to replace a limited number of hardware timers on the ATMEGA.

I think RusEFI has been around since, at least, 2013. There are already some great hardware options. $270 gets you a unit with a robust waterproof case and someone is gearing up to sell a board capable of running sequential ignition and fuel injection on a V-12 engine.

Both systems (currently?) rely on 3rd-party commercial software for the tuning process, but the software, Tuner Studio, is available for less than $100.

I could do a much longer post, but this post is long enough, so, this is where it ends.

Apple Store Feedback

I recently visited an Apple Store to get my MacBook Pro’s “butterfly” keyboard replaced. After the visit I received a survey asking about the experience. I ended up writing a long (considering the context) critique, and thought I’d also post it here.

It’s too noisy and chaotic. The chaotic feeling is partially due to the noise, but also because the design of the store doesn’t offer affordances for customers with differing levels of experience and differing priorities.

When I go to an Apple store, I generally have a sense of urgency, otherwise, I’d be handling things through the Internet and mail.

I’ve been to the Apple store for service 2-3 times in the past 12-24 months, and yet, I’m still not confident in my understanding of what needs to happen when I’m in the store. Where do I need to go? Who do I need to talk to? Is that a black shirt, or a dark navy blue shirt?

I go to an Apple store because I have some sort of problem I need to solve, either with a purchase, or by getting service or tech support. When I walk through the door, I should start feeling calmer. Instead, I feel more agitated. When I leave, I should feel, if not satisfied, then at least relieved. Instead I have lingering agitation.

There are too many people doing too many things in an undifferentiated space. I imagine that having classes sharing that space is supposed to invite people in to the session. Maybe it does, but it also adds amplified noise to the entire space. The fractured repetition of a Garage Band class is literally crazy-making for those in the service/support area. It makes conversations difficult, and makes waits seem longer.

I am happy, though, with the latitude that the support staffer had to make things right with the manufacturing defects in my out-of warranty computer. I’d prefer the keyboard just worked and the screen didn’t have growing blemishes, but one of the reasons I stick with Apple is that I know you’ll make things right.

IoT Software Notes

I’m trying to get my head around all the IoT “hub” software options. I’m focusing on software that runs locally, rather than proprietary cloud services like IFTTT.

List o’ IoT Softwares

Open Source


  • Hubitat (link) Proprietary gateway that works without “the cloud.” Provides API for apps and drivers and SmartThings compatable scripting language. Ships with support for with ZigBee, ZWave and IP based devices.
  • Phillips Hue Bridge
  • Samsung SmartThings Hub (link). Closed source running on proprietary hardware HUB, but extensible and works with both Samsung and 3rd Party IoT hardware over Zigbee, WiFi and Z-Waver


Home Assistant

“Open source home automation that puts local control and privacy first. Powered by a worldwide community of tinkerers and DIY enthusiasts.”

Has native (python) HomekKit support


Homebridge is opensource software built on Node.js.

It describes itself as “HomeKit support for the impatient”

It provides a path to Apple HomeKit support for a variety of 3rd party ecosystems, like Samsung SmartThings by emulating the HomeKit API.

People have provided plug-ins and guides to enable all sorts of useful integrations.


Mozilla Webthings Gateway


Other Notes

Wyze Cam Notes

A year or so ago I bought a Wyze Cam to try out. I’d wanted an IP camera for a while, but with the exception of a ~$15 Gearbest special, I’ve deemed them all too expensive to experiment with. The Wyze Cam was different. It had a good reputation, and was available for $20 + shipping. So, I bought one. My first impressions of the hardware and image quality were favorable, the software, less so.

It’s clear to me that Wyze was trying to differentiate itself on a combination of low price and ease of use. They focused on a few simple scenarios as a route to ease-of-use. The Wyze Cam wasn’t/isn’t a typical security/surveillance camera, intended for watching home and exterior property. Instead it was more a personal, indoor surveilance camera. The Wyze Cam debuted as the sort of thing you could use to check in on your child sleeping or playing elsewhere in your house, or see which of your dogs was knocking stuff off the kitchen counter.

The software, both the camera firmware, and the smartphone app needed to access the camera, was basic, but capable enough to serve these scenarios. The camera firmware could identify motion using crude techniques. The firmware used the motion detection capability to trigger a cascade of events. Motion triggered the camera to upload 5s of video before the motion was detected and 5s after to Wyze’s cloud service. It could also store the same video locally, if there was an SD card on the camera.

Their cloud service can send notifications of new video clips to the smartphone app, from which the stored video can be viewed. The app also allows viewing of the live stream remotely over any Internet connection, can view video stored on a self-provided TF card in the camera itself when on the local network, and also allows viewing of video clips stored in the cloud over the previous two weeks.

Wyze was successful in delivering these basic features, but the overall experience was a bit clunky. Getting the camera connected to my local WiFi was relatively painless, and once connected, access when I was away from home just worked (except for a few occasions when it didn’t work at all). Accomplishing things in the app often took more steps than seemed necessary and some actions were hit-or-miss.

The (free) cloud service also imposed limits on how often video clips could be uploaded, presumably in order to manage the cost to Wyze of offering the free service. After a clip was recorded, the camera waited ~10m before motion could trigger recording of a different clip. This would probably be fine for keeping watch on the interior of one’s home while away at work, or vacation, but, combined with other limitations made the camera considerably less useful for keeping watch on the outside.

The camera firmware allows some coarse tuning of the motion detection. You can adjust how much the image has to change before triggering. You can also limit motion detection to a (rectangular) subset of the camera’s field of view. The utility of these limited settings really depends on the specifics of the scenario you are trying to accomplish. If you want to keep close track of who visits your porch, you can limit the motion detection region and turn the sensitivity down enough to minimize false positives from car headlights, the sun going behind a cloud, or moths flitting around, but then you loose any utility for seeing who is leaving dog crap in your yard.

Another limitation is that browsing the video stored locally is clunky. There is no way to scrub though in faster than realtime. You just have to jump forward manually and wait for the network to catch up. If you want to see more than 10s around a motion event you have to take note of the time of the triggered event, then switch to viewing stored video, then navigate to the proper time — there is no shortcut to jump from a stored 10s to the same time in the locally stored continuously recorded video with a single tap.

These limitations were enough that I stopped using the camera and just left it running on the assumption that if some event was severe enough, like, say, an animal sacrifice on my front lawn, I might go to the trouble of trying to find and view whatever the camera captured.

That assumed that the camera captured anything at all. I had trouble with the camera crashing or loosing track of the TF card and not recording video again until I noticed and rebooted the camera, and/or ejected and reinserted the card.

There have been some other severe annoyances, too. You have to log-in to Wyze’s service to use your camera, even though the only scenarios that require an account are sharing access with another person. Worse, the login expires after some number of days without use. Once your login expires the app doesn’t take advantage of FaceID on iOS for a quick login; you have to type your password in.

Recently, after more than six months of disuse I decided to try the camera again — I’d grown fed-up with people leaving their dog’s bagged crap in my waste bins, particularly when they put it in the recycling or yard waste bins.

Logging in to the app is still more tedious than it should be. Some operations are smoother and less hit-or-miss than they were, but I still find that a number of actions take more steps than they really should.

In the end, the Wyze Cam didn’t catch anyone in the act, but it did catch someone behaving like someone might if they were about to put poorly-bagged dog crap in my yard waste bin before the clip cut out.

It’s still tedious to review the continuously captured video from the TF card. Pulling the TF card is difficult, because of where and how the camera is mounted, so I’m limited to using the clunky, slow UI in their iOS app. I can’t download an hour or days worth of video quickly to my phone for easier/faster review using a native UI on my phone or computer; I can only “record” the stored video in real time. — if I want to download an hour worth of of video, I need to start “recording” in the app and leave it running for an hour. Ridiculous.

Wyze has made one major improvement since I first got the camera, though. Earlier this year they added “person” detection to the firmware, using software licensed from a third party. Once enabled, it works by waiting for the camera to detect motion, then software running on the camera does further processing to see if the captured footage contains a human being (generic). If it does, the captured clip is marked as containing a person. Notifications can then be limited to clips that contain a person. The list of captured clips also notes whether or not a person is detected.

I want to underscore a few important details about the person detection. First, it runs entirely on the camera, which means that it isn’t being used to help train some big tech companies Artificial Intelligence brats, like some sequel to the Handmaid’s Tale (unless you submit clips for review on an individual basis). Second, doesn’t identify specific people, just the presence of a generic human being.

The accuracy is quite good, too. I’ve seen very few false positives (detected a person when there is no person) or false negatives (didn’t detect a person when motion was detected and there was a person in-frame).

The motion detection works well-enough that I’ve turned on notifications. At this point, though, more than half of the people detected are walking by with dogs, which isn’t something I need to know about right away. I think i’m going to adjust the motion detection region and limit it to my porch. I won’t be able to use the camera to catch dog crap offenders, but it’ll be good for checking to see who is at the front door, and what packages have been delivered.

Wyze does still have the option of making their camera useful for outdoor surveillance. My understanding is that the crude motion detection is a result of the limited motion detection support provided by the SoC (system on chip) and the SDK the manufacturer provides. The SoC isn’t very powerful, but the fact that it can run person detection algorithms in near realtime means that it is powerful enough to do simpler image processing. It should be possible to filter motion detection through non-rectangular regions, and/or adjust and apply the detection sensitivity on a region by region basis. It should also be possible to better filter false positives caused by insects attracted to the camera’s infrared illuminator LEDs at night.

For $20, Wyze Cam is an interesting product, and it is even a useful product for some scenarios. If my dog was still living, I’d probably have a few Wyze cams just to see what it does when we aren’t at home and it wasn’t sleeping. I may be picking up a few more Wyze Cams soon though, because we’ve started thinking we might be ready for new dog.

Solar Panel Notes

I’ve been tinkering with a small, semi-potable solar setup and have an eye to upgrading it. These are my notes. My facts my be incorrect, they are certainly incomplete.

My system is currently configured as:

  • 18W, 18v flexible Sunpower panel.
  • CN3791 MPPT charge controller
  • LiIon battery pack(s) made from 1S20P Samsung 28A 18650 cells. Configured as two packs of 1S6P and one pack of 1S8P, each with a cheap protection board. Estimated capacity is ~150Wh
  • ~15W 6v folding, portable panel, made from Sunpower cells. I’ve added a bypass for the buck converter that supplies regulated 5V USB so I can use it with MPPT controllers.
  • 21W 6V folding, portable panel, made from Sunpower cells. I’ve added a XT30 connection so I can swap in different loads, including the original 5v USB buck regulator, a different buck regulator, or an MPPT controller.
  • These folding panels are hooked up parallel, they are connected to another CN3791 MPPT charger.
  • Both chargers are connected in parallel to the battery bank. This could have some weird effects, particularly as the pack reaches 4.2v and goes into constant voltage mode.

The panels are not optimally deployed. They are lying flat, and due to trees, etc, only get unobstructed sun for ~4-6 hours a day. In this arrangement, peak power for the 18W panel has been about 10-12W.

The 6v panels are even more suboptimally deployed due to sitting on the floor of a window platform for cats, which means they are obscured at times by the frame and even the 18W panel which rests above them.

I also have a laminated ~6W 5V Sunpower panel that is currently unused. It originally had a buck regulator to power USB devices, but I removed it and replaced it with a quick release terminal so I can use it directly with a battery charger.

I’d like to move up to 100-200W of panel capacity before a new wave of Trump’s dumbass tarifs hit. Options in consideration:

  • Rigid mono or polycrystalline panels.
    • Polycrystalline is currently slightly cheaper per nameplate wattage, but maybe not enough to be compelling. Currently <$1/W.
    • Pro: Cheapest option. Con: Since I’m not making a permanent installation, the fact their weight and fragility of the glass is a concern.
  • Flexible panels. Lots of options, most of them dubious.
    • The cheapest flexible panels are available at a ~20-50% premium over rigid panels.
      • Use PET encapsulation on the sun-facing side, which isn’t suitable for constant environmental exposure.
      • Use cell constructions that don’t hold up to flexing and don’t deal well with microcracks that develop in the silicon wafer due to flexing.
      • Use panel interconnects that won’t hold up to flexing.
    • Quality flexible panels are 2-3x as expensive as cheap rigid panels.
      • Use EFTE top layer for long life and durability.
      • Use primarily Sunpower, but occasionally Day4 or Merlin cells which are well suited for the challenges of flexible substrates.
      • Use rugged, flexible interconnects.
    • Folding flexible panels.
      • One, common variety uses ~6v, 7W subpanels connected in parallel to power a 5V USB buck regulator. The subpanels are made from twelve Sunpower offcuts in series. These are typically encapsulated in PET and sewn into ballistic nylon covers with cardboard for added stiffness. Newer designs use EFTE and may forgo the fabric construction a fully laminated construction and a panel thickness of 2-3 millimeters..
      • $1W at the low end, >$2W for branded products like Anker or RavPower.

Background Information

  • Panel Basics
    • Solar panels are constructed from multiple photovoltaic (PV) solar cells in series.
    • A typical PV solar cell has an optimal voltage of about 0.5-0.6v, which is determined by the bandgap of the doped silicon junction.
    • The number of cells assembled in series determines the panel voltage.
    • Panel voltages are generally matched to their intended application.
      • Six cells in series (6S) are well suited for 3V electronics of the sort powered by two Alkaline cells in series or a single lithium metal cell (like the ubiquitous CR2032 button cell.
      • Ten (5V) to twelve (6V) PV solar cells in series are typically used to charge/power 5V USB devices by way of a buck-converter voltage regulator. These configurations are also well suited to charging Lithium Ion batteries, which are used in smartphones and most other battery-powered devices that can be charged from USB.
      • Panels made from 32-36 cells in series are common. They have an optimal voltage of 18V, but are often labeled as 12v because they are used to charge 12v lead acid batteries without a regulated charging circuit. The are also used with LiIon batteries in conjunction with a suitable charging controller. ~100W, 18V panels are often connected in series for higher-voltage and higher powered systems, including AC systems
      • 150-300W panels with 50-72 PV cells in series are also used in larger installations.
    • Panel Construction
      • Panels are assemblies of multiple, electrically interconnected, solar cells. They protect the component PV cells from the elements, and provide support when deploying and mounting the cells
      • Rigid
        • Framed Laminate panels sandwich the cells and their interconnects between glass and a sturdy backing material. The laminated panel is then held in an aluminum frame to enhance rigidity, provide protection, support and points of attachment for mounting the panel.
        • Cast panels are typically under a few watts of power. They seal the cell in protective epoxy or another cast resin.
      • Flexible
      • Laminated

GL-Inet GL-MT-300Nv2 Power Consumption

Today I updated the firmware on my GL-Inet MT-300N v2 “Mango” travel router, and while I had it out I decided to measure its power consumption.

For those who don’t know, a travel router makes it easier to securely use a temporary internet connection, like that provided by a hotel, and share it among multiple devices. The hardware specs on the GL-MT-300Nv2 are modest, but sufficient, it is compact (about the volume of a deck of playing cards), and inexpensive ($20.49 on Amazon). The firmware is based on a recent release of OpenWRT with a UI optimized for use as a travel router. For those who want it, the standard OpenWRT Luci interface is available.

I decided to test the power consumption because my tiny solar power station (~18W panel, 120Wh LiIon battery), was generating more power than it could store and I’d already finished charging my phone for the day. As I unplugged my phone’s charging cable, I noticed that the USB-powered router was right there, so I plugged it in instead and reset my USB power meter.

Once the router started up and I connected my laptop to it over wifi, I noted the power consumption was about ~1.3-1.5W. I ran an Internet speed test from my laptop and the power consumption bumped up slightly. After an hour, the cumulative power consumption was ~1.4Wh. I connected the router to ethernet to see if that made an obvious difference in the power consumption; it didn’t.

Based on these crude measurements, I think it’s safe to say that the GL-Inet GL-MT-300Nv2 uses less than 2W on average. That means that, if necessary, it could run for >3h off a typical small USB power bank, and could probably run directly off a ~$15 6-7W solar panel with USB output through most of a summer day.

I didn’t check the power consumption while using the router as a VPN gateway, which is probably the most CPU intensive use of a travel router. The manufacturer’s specs for power input are 1A @ 5v, which works out to 5W, so thats the limit on peak power draw, and would only be reached during the peaks of VPN use. Peak VPN speeds are in-turn limited by the CPU’s performance, which limits peak VPN speed to ~10Mbps.

$2 Bluetooth Tracker / Finder / Tag Teardown

Some research into the present and near-future state of indoor locating technology led me, inevitably, to Bluetooth Low Energy (BLE) beacons. Bluetooth Low Energy led me, inevitably, into a short digression into Bluetooth “tags” for finding lost items like keys.

I just received a couple such tags I ordered from AliExpress for less than two dollars, each, and I made a video showing what’s inside when you open them up.

Yeah, I misspelled “bauble” in the title sequence.

These Bluetooth tags for finding lost items appeared on the market at about the time that Bluetooth Low Energy (Bt 4) started appearing in the latest smartphones. I don’t know who was first on the market, though I’ve seen the suggestion that the idea may have originally come from Nordic Semiconductor, one of the biggest companies dedicated to making chips for low-powered RF applications. I do know that Tile is probably the dominant vendor at this point.

The basic Bluetooth key finder “tag” is a small device, the size a condom packet, or a matchbook that can be carried on a keychain. Inside there is a small circuit board with a Bluetooth SoC (system on chip), a microswitch, battery, a pezioelectric speaker, and a few supporting components.

When it is powered on, the tag transmits to “advertise” itself. When it is advertising itself, a companion app, running on a smartphone can detect it and connect to it.

Once connected, the app periodically checks the signal strength of the tag. If the signal drops below a preset threshold, or is lost entirely, the app will notify the user, allowing them to stop what they are doing and find the object before they become too far separated from each other. The tag may start “chirping” automatically to make it easier to find. If the user needs help finding the tag while still nearby they can also use the app to instruct the tag to start chirping.

The system also works in the opposite direction. If the user is carrying the tag on a keychain in their pocket or purse, then the automatic chirping will warn them that they’ve become separated from their phone. If they realize they can’t find their phone when they are still nearby, they can also push the button on the tag to trigger a sound on the phone in order to make the phone easier to locate.

This basic functionality seems enough to be useful to people who loose track of things a lot. At this point, its available for less than $2, if one knows where to shop. For that price, one gets a functional but crummy app. The app may have added functionality, like the ability to use GPS to map the location where the phone was last able to communicate with the tag. This could be useful to determine you left your keys at the gym, rather than the office.

Tile, and others have gone further, in order to justify charging $20, rather than $2, and also to enhance their competitive position. If you use one of Tile’s tags, then, if your tag and your phone become separated, Tile’s app, working with their backend system, can check to see if any other Tile user’s phones “see” your tag, and then let you know where.

This tag-finding network sounds clever, but I wonder how well it works, and how useful it really is, particularly given the potential privacy concerns. It’s certainly possible to implement in a way that preserves privacy. In fact, Apple recently described the outlines of one such system they are developing to help people find lost or stolen Apple devices, extending their “Find My” app from iPhones to Apple Bluetooth devices, like AirPods, and also beyond WiFi range for Macintosh computers.

Apple is also rumored to be working on their own Bluetooth tag to allow keys and other objects to be tracked by the system. This might explain why Tile has recently partnered with a number of Bluetooth silicon makers, including Nordic, to extend the Tile network to third-party devices.

Back to the $2 tags I took apart, a few things of note:

The first has a teardrop-shaped case. The printed instructions point to the cTracing app. It shows up as “ITAG” using a general purpose bluetooth scanning app. Inside, I found a model XTR-FTQ-3432 PCB with V1.2, dated in 20181105. The SoC is from a Shanghai design house called Beken, and the part is BK3431.

Back in 2015, Brian Khuu tore down a tag that used the same case. His tag came, packaged for retail, in a box labeled iTag. Inside he found a different IC, labeled as ST17H25. One of the commenters identified it as a Telink TLSR8266 F512. It is actually a Lenze ST17H25. The two are quite similar, down to the names of the authors associated with revisions of the datasheet. It’s a bit overkill for this application, with a 14-bit ADC and, microphone input.

In any case, they’ve switched to a different SoC now. The BK3431 has a more limited I/O, making it more similar to the Lenze ST17H26, which is what I found in the second tag.

The second tag’s case has the shape of a rounded off square. There is a slot that a small lanyard can be looped through. Inside, it looks very much like the device pictured in this teardown on the Simply Soldered blog, which also uses the ST17H26 on a model RB-FD02 PCB. There have been some changes since then, though I’m not sure what they are. The PCB in my devices is V1.9, dated 20180606, the earlier teardown shows PCB V1.2, dated 20151212. I see some differences in component placement around the crystal and the antenna. I don’t know about accompanying differences in the schematic and if I took the time to check, and found some, I wouldn’t know the significance.


Ravpower USB PD Powerbank Teardown

A couple of years ago I bought a Ravpower 30W USB PD powerbank with one USB Type-C port, and two regular 5v USB ports.

It was a little quirky. Sometimes it would start charging itself from the laptop until I held the button down for 5s. At some point the behavior started getting worse, to the point that last summer I left a poor review. The seller contacted me quickly, and I had a replacement within a week. The replacement fixed the problem.

That left me with the defective unit. Today, I decided to take it apart and see what’s inside.

The highlights are:

  • A sturdy ABS case
  • 8x LG F1L 18650 cells
  • One PCB
    • Sonix SN8F57 8-bit 8051-based microcontroller
    • Cyprus CYPD2122 USB PD port controller
    • Southchip SC8802 buck-boost charge & discharge controller
      • Regulation of voltage and current for lithium ion battery charging for 1s-6s battery packs (4.2-25.2v)
      • Charging current to 10A!
      • Input voltage from 2.7-30v
      • Output to load from 2-30v & 60W

The pack sells for ~$75. To put things in perspective, you can buy eight FL1 cells for $4.41/each, which works out to about $35. That price drops to $3.56 each through a grey-market seller if you buy a thousand at a time. Ravpower is almost certainly paying less than that.

You can see more in the YouTube video I shot of the process:


What IC does the MH KC24 USB QC2/3 Buck Module Use?

I want to know what IC is used on this MH-KC24 USB power module I received.

This module, like the MH-CD42 module I looked at recently, has a single IC with unhelpful markings. Since the IC on that board appears to be from Injoinic Technology, I thought the IC on this module might share the same origin.

I reviewed the product offerings on their English language site and thought the ICs for car chargers looked the most promising. Based on the summary specifications, the IP6505 fills the bill. This IP6505-based module certainly carries the same supporting components, and the IC shares the same footprint.

The IC combines an efficient synchronous buck converter and logic for negotiating power delivery using a variety of USB charging protocols. My primary interest is in Apple 2.4A/12W charging, but it also supports Qualcomm’s QC2 & QC3 protocols, which is popular among android smartphones using Qualcomm’s SoCs.

I see that their IP6518 IC, which supports 45W USB PD charging is available on inexpensive modules, too.

What IC does the MH-CD42 battery/5v power board use?

I just received a USB / LiIon power module I paid ~$2, including shipping, for on AliExpress. The model is given as MH-CD32 (link goes to what I think is the original manufacturer, though I purchased it from another seller with cheaper shipping).

The board is supposed to be an all-in-one solution for powering a 5v (ie USB powered) device from a lithium ion battery pack. I suspect the IC was originally designed for use in a USB powerbank. The basic features are:

  • Charging of 3.7v nominal, 4.2v max, lithium ion batteries.
    • 5v charging input, 2.1A max charing current
    • Battery protection for over current, over voltage and over temperature (for the charging IC, at least, there is no provision for a thermistor to sense pack temperature)
  • 5v output, up to 2.1A
  • 4-level battery “fuel gauge”
  • Power path management: when the module is externally powered, it can power the load and charge the battery with any excess power from the supply.
  • Control input that can switch the output on, or off, suitable for control by a microcontroller.
  • 100uA quiescent current.

It accomplishes this all with a single 8-pin IC, a dozen discrete passives (an inductor, eight ceramic capacitors, three resistors), four LEDs and a microswitch. All in all, it looks like a useful module.

I’m curious about what IC it uses. The package has markings, but they aren’t useful; it’s marked MH CD42, which is the model number of the module. Nothing strange about that, except that Google searches don’t turn up anything, no Chinese datasheets, just more product listings for the module.

Ordinarily, the first couple of letters of a chip marking echo the name of the manufacturer, but in this case, they instead they echo the name of the module manufacturer “MH-ET.” It isn’t uncommon that manufacturers “sand” the IC package to obscure it’s origin. In this case though, it seems that MH-ET has either remarked the chips or, more likely, had the packages custom marked.

If I were a competitor, and this were a product that had some combination of a large market, a high margin and a high selling price, I could go to great lengths to discover the true origin of the integrated circuit. I’d start by gathering the basic details of the product and using that to infer the specs of the IC. There isn’t much guess work in this case, because the product is a manifestation of the the capabilities of the IC, and its typical for the sellers to use the ICs specs when describing the module, even when the implementation cuts corners that may compromise the specs.

I’d use the specs I gathered to search catalogs and databases for similar ICs and compile a list of candidates. If my goal is to produce a competitive product in terms of cost and capabilites, I’d investigate pricing of the candidates and if any of them met the functional and cost requirements, that might be the end of it.

If I couldn’t find an equivalent chip, or if I wanted to improve my negotiating postion, or if I was involved in making or selling a competing IC, I’d dig deeper. I’d look more closely at the details of the IC, the specific package, the functions of each pin, the details of the circuit connected to each pin and I’d compare them to the documentation available for candidates I’d previously identified based on basic specifications.

Beyond that, I could order samples of the candidates and test their behavior against that of that of samples of the unknown chip. Or, perhaps I’d use chemical or mechanical means to extract the silicon ship from the enclosing package and then examine it under a microscope before and after stripping away layers of metalization on the IC. This might show me markings like a date code, part number, or logo. It would certainly show me the gross and fine structure of the circult. All of them would help me find the true origin of the integrated circuit.

I’m not going to do that though, in fact, I’ve already spent more time writing about it than I’d like to spend on what I am going to do.

Rather than going to those lengths, I’m going to take a shortcut that I happen to have available to me: I remember seeing a similar module on eBay a few months ago and I remember that the IC on that module had a distinct an unfamiliar manufactuer logo on it.

It took a little longer than I expected, but I found the ebay listing, or one like it. There IC lacks a distinctinve logo, but it does have a clear part number “IP5306,” and that part number leads to a catalog listing on a distributor’s site, a datasheet and the manufactuer, a company called Injoinic Technology.

The PCB layouts are very similar. The IC pinouts seem identical. I tried tracing out the circuit, but I could only get so far without removing components. The only real question are pins 6 & 7.

My 4.5 digit multimeter shows ~0Ohms resistance between them, suggesting they are on the same node of the circuit. However, if the IC on my MH CD42 board is the same or equivalent to the one on the IP5306, then those pins should actually be on two separate nodes of the circuit. Pin 7, on the left, should be connected directly to the near side of the inductor, while pin 6 should be connected to the far side of the inductor, by way of the low-value 500mOhm resistor you can see in the photograph.

IP5306 Typical Application Circuit

It wouldn’t be hard to pull off some components and replace them later, or it shouldn’t be, but I always seem to hit a snag on the easy jobs, like loosing a tiny component, or delaminating part of a trace. Fortunately, I have a nice Keithley 2000 6.5 Digit DMM. It’s serious overkill for most stuff, and measuring miliohms isn’t its forte, but it only took 30s to boot up (it actually has a Motorola 68030 process, like an old Mac ][, or SE/30 computer), and less time than that to show that the path from Pin 6 to Vbatt had 500mOhm higher resistance than the path from Pin 7.

So, my conclusion is that the MH CD42 IC is actually an Injoinic Technology IP5306. It’s possible that it is a “clone,” or that they both actually come from a third party, or are otherwise derived from the masks and foundry. It may also be true that there is another IC on the market that defined the specs and pinout and that a very narrow market niche has emerged around it. I already know more than I need to know, and if you’ve read this far, then you know it, too.