What IC does the MH-CD42 battery/5v power board use?

I just received a USB / LiIon power module I paid ~$2, including shipping, for on AliExpress. The model is given as MH-CD32 (link goes to what I think is the original manufacturer, though I purchased it from another seller with cheaper shipping).

The board is supposed to be an all-in-one solution for powering a 5v (ie USB powered) device from a lithium ion battery pack. I suspect the IC was originally designed for use in a USB powerbank. The basic features are:

  • Charging of 3.7v nominal, 4.2v max, lithium ion batteries.
    • 5v charging input, 2.1A max charing current
    • Battery protection for over current, over voltage and over temperature (for the charging IC, at least, there is no provision for a thermistor to sense pack temperature)
  • 5v output, up to 2.1A
  • 4-level battery “fuel gauge”
  • Power path management: when the module is externally powered, it can power the load and charge the battery with any excess power from the supply.
  • Control input that can switch the output on, or off, suitable for control by a microcontroller.
  • 100uA quiescent current.

It accomplishes this all with a single 8-pin IC, a dozen discrete passives (an inductor, eight ceramic capacitors, three resistors), four LEDs and a microswitch. All in all, it looks like a useful module.

I’m curious about what IC it uses. The package has markings, but they aren’t useful; it’s marked MH CD42, which is the model number of the module. Nothing strange about that, except that Google searches don’t turn up anything, no Chinese datasheets, just more product listings for the module.

Ordinarily, the first couple of letters of a chip marking echo the name of the manufacturer, but in this case, they instead they echo the name of the module manufacturer “MH-ET.” It isn’t uncommon that manufacturers “sand” the IC package to obscure it’s origin. In this case though, it seems that MH-ET has either remarked the chips or, more likely, had the packages custom marked.

If I were a competitor, and this were a product that had some combination of a large market, a high margin and a high selling price, I could go to great lengths to discover the true origin of the integrated circuit. I’d start by gathering the basic details of the product and using that to infer the specs of the IC. There isn’t much guess work in this case, because the product is a manifestation of the the capabilities of the IC, and its typical for the sellers to use the ICs specs when describing the module, even when the implementation cuts corners that may compromise the specs.

I’d use the specs I gathered to search catalogs and databases for similar ICs and compile a list of candidates. If my goal is to produce a competitive product in terms of cost and capabilites, I’d investigate pricing of the candidates and if any of them met the functional and cost requirements, that might be the end of it.

If I couldn’t find an equivalent chip, or if I wanted to improve my negotiating postion, or if I was involved in making or selling a competing IC, I’d dig deeper. I’d look more closely at the details of the IC, the specific package, the functions of each pin, the details of the circuit connected to each pin and I’d compare them to the documentation available for candidates I’d previously identified based on basic specifications.

Beyond that, I could order samples of the candidates and test their behavior against that of that of samples of the unknown chip. Or, perhaps I’d use chemical or mechanical means to extract the silicon ship from the enclosing package and then examine it under a microscope before and after stripping away layers of metalization on the IC. This might show me markings like a date code, part number, or logo. It would certainly show me the gross and fine structure of the circult. All of them would help me find the true origin of the integrated circuit.

I’m not going to do that though, in fact, I’ve already spent more time writing about it than I’d like to spend on what I am going to do.

Rather than going to those lengths, I’m going to take a shortcut that I happen to have available to me: I remember seeing a similar module on eBay a few months ago and I remember that the IC on that module had a distinct an unfamiliar manufactuer logo on it.

It took a little longer than I expected, but I found the ebay listing, or one like it. There IC lacks a distinctinve logo, but it does have a clear part number “IP5306,” and that part number leads to a catalog listing on a distributor’s site, a datasheet and the manufactuer, a company called Injoinic Technology.

The PCB layouts are very similar. The IC pinouts seem identical. I tried tracing out the circuit, but I could only get so far without removing components. The only real question are pins 6 & 7.

My 4.5 digit multimeter shows ~0Ohms resistance between them, suggesting they are on the same node of the circuit. However, if the IC on my MH CD42 board is the same or equivalent to the one on the IP5306, then those pins should actually be on two separate nodes of the circuit. Pin 7, on the left, should be connected directly to the near side of the inductor, while pin 6 should be connected to the far side of the inductor, by way of the low-value 500mOhm resistor you can see in the photograph.

IP5306 Typical Application Circuit

It wouldn’t be hard to pull off some components and replace them later, or it shouldn’t be, but I always seem to hit a snag on the easy jobs, like loosing a tiny component, or delaminating part of a trace. Fortunately, I have a nice Keithley 2000 6.5 Digit DMM. It’s serious overkill for most stuff, and measuring miliohms isn’t its forte, but it only took 30s to boot up (it actually has a Motorola 68030 process, like an old Mac ][, or SE/30 computer), and less time than that to show that the path from Pin 6 to Vbatt had 500mOhm higher resistance than the path from Pin 7.

So, my conclusion is that the MH CD42 IC is actually an Injoinic Technology IP5306. It’s possible that it is a “clone,” or that they both actually come from a third party, or are otherwise derived from the masks and foundry. It may also be true that there is another IC on the market that defined the specs and pinout and that a very narrow market niche has emerged around it. I already know more than I need to know, and if you’ve read this far, then you know it, too.

Bluetooth LE Notes on iBeacons and Bluetooth Tags/Trackers

I’ve been researching indoor location technoglogy which has lead me to looking more closely at the cost and effort of implementing Bluetooth Beacons, like Apple’s iBeacon or Google’s now unsupported Eddystone protocol. That led me to Bluetooth “Trackers,” “Tags” or “Key Finders.” There are also BLE sensor tags and fitness trackers. These are my barely edited notes.

Cheap Modules

There are a huge number of cheap Bluetooth ≥4 modules on eBay and AliExpress. Some are bare modules that include a Bluetooth SoC, an antenna, and supporting circuitry intended for integration into a larger device. Others are, more or less, finished devices. The have cases, and battery holders or connectors for an external USB power supply. They also often have demo firmware and apps.

Tracker devices are available for less than $2, with shipping, but they have unknown or poorly documented SoCs and repurposing them may be difficult or impossible.

For more flexible modules with well documented and supported SoCs from Nordic and TI, prices start at $4 for a basic coin cell powered device with Bluetooth 4LE support and go upward for more recent chips with support for later Bluetooth version and/or cases for more durable installation. Bare modules for incorporation into devices are available for less than $2.

  • Shenzen Wellicorp: fixed and portable beacons with waterproof housings using nRF51, nRF52 and TI CC2541 SoCs.
  • Bejing Aprilbrother: DA14580, nRF52 & TI based fixed and portable beacons and sensors.
  • Radioland Technologies TI nRF and Dialog based beacons. Available from 3rd party sellers on AliExpress, like Shenzhen Duoweisi Tech
  • Holyiot Sensors and beacons based on nRF51 & nrRF51. Also
  • Minew sensors, beacons and electronic shelf lables based on nRF51 & nRF52 and, TI BLE SoCs. Their beacons were used for Google’s first public Eddystone demo. They sell BLE 5 capable beacons for $10 + shipping, with a three unit minimum order.

Bluetooth Profiles of Interest

  • Proximity
  • Find Me

Common Bluetooth SoCs

Their are a variety of manufacturers of Bluetooth SoC, but Texas Instruments and Nordic Semiconductor seem the most common.

MfgModelIntroNotableMCU
Texas InstrumentsCC2540Oct 2010BLE v4, v5, USB 8051
CC2541Jan 2012BLE v4, v58051
CC2640Feb 2015BLE v4.2, v5Ctx-M3
CC2640R2FDec 2016BLE v4.2, v5Ctx-M3
Nordic SemiconductorNRF518222014?BLE v4.1-4.2Ctx-M0
NRF52810BLE 5Ctx-M4
NRF52811BLE 5.1
+ direction finding
Ctx-M4
NRF52832BLE 5Ctx-M4F
DialogDA14580

Texas Instruments

TI has updated SDKs for some of its BLE v4 ICs that are v5 certified for the subset of v5 features that the IC supported in v4.

TI’s BLE SoC all support a variety of peripherals relevant to sensor node applications. Some have integrated switching power supplies.

Nordic Semiconductor

Like TI, Nordics SoC’s support a variety of peripherals relevant to sensor node applications, and some have buck converters.

Nordic has a proprietary protocol called ANT which can also run on some of their SoCs at the same time as BLE.

Nordic’s nRF5 SDK includes sample applications for iBeacons, and proximity tags.

Others

  • Dialog? DA14580

Elsewhere

ToDo

Or not, but I’m at least noting them

  • Battery life estimates
  • NFC for proximity based pairing
  • UWB for?
  • Sensor/fitness tags
  • “Finder” app ecosystems
  • WeChat Shake
  • Bt 5 Advertising Enhancements — Use of more channels for advertising packets, reducing interference. Extended advertising lets advertisements use a larger payload (in another channel), allowing more info to be conveyed in beacon applications.

CN3791 MPPT Solar Li-Ion Charger Module Hinky Circuit.

Last year, I paid about $3.66, with shipping, for this solar-powered MPPT lithium ion battery charging module on eBay to use with my small solar panels and scavenged 18650 batteries. It has some issues.

First off, the version I purchased/received is intended for 9v solar panels and I wanted to use it with a ~6v panel. This is set with a resistor divider. Careful study of photos from product listings showed that the divider was implemented using the same resistor value for the high segment of the divider, changing only the value of the lower segment’s resistor to change the setpoint.

The high segment had a value of 178KOhm and the low ranged from ~42KOhm for a 6v panel down to 12.6KOhm for an 18V panel. I didn’t have any SMD resistors of suitable value in my supplies, and I couldn’t find any I could scavenge on any surplus PCBs. I decided to use a trimpot instead. I had a variety on hand, and it would allow me to experiment on the optimal clamping voltage for the panel I had on hand, and an 18V panel I’d ordered. I chose a 200KOhm trim pot with the idea that approximating the total resistance of the existing divider would help preserve the stability of the control loop. If I were going to do it again, I’d probably choose a different configuration to minimize the impact of the pot’s temperature sensitivity. A simple choice would be ~20KOhm trimpot, configured as a variable resistor (short the wiper to one terminal) used it to replace the low segment, leaving the 178KOhm resistor in place.

After adding the potentiometer, I connected the battery and panel and adjusted the potentiometer until I maximized the charging current. I was a little surprised by how low the panel voltage was, and so I started poking around. The first thing I checked was the voltage drop across a P-Channel MOSFET on the panel input. I was surprised to find that it was 500mV, though knowing that, I wasn’t surprised the IC was noticeably warm. The panel was dissipating 1/10th of the panel voltage over the MOSFET!

Some of the photos on some of the product listings showed a simpler circuit, without anything in the panel input current path. My guess is that the MOSFET and accompanying resistor and diode were added in a revision in order to protect the circuit in case the panel polarity was accidentally reversed, and/or to block leakage of charge from battery through panel at night. A schottky diode would accomplish the same thing more simply, but with a voltage drop of ~300mV. Properly implemented, a MOSFET based “ideal diode” would have an effective resistance of ≥ 50mOhm, and a voltage drop of ≥ 50mV at the ~1A max current my panel could deliver.

I’m not completely sure how the circuit was intended to work, but clearly, it wasn’t doing the job. I wondered if it would work properly if I was using the module with a 9V manual, as intended, but that didn’t seem possible, either. The panel + was connected to the MOSFET’s source, the rest of the circuit to the drain, and the gate was connected to the drain via a resistor and diode. By my reasoning:

  • that the gate would ≅the potential of the drain
  • the voltage drop from source to drain should be as close to 0V as possible in order to maintain the efficiency of the curcuit
  • therefore, Vgs would/should approximate 0V
  • but it won’t because the Vgs threshold for the MOSFET was ~2V!

I wasn’t sure how to fix the circuit, but I was sure that the gate needed to be pulled down to a lower voltage, so I cut the trace connecting the resistor the drain and connected it to ground instead. It worked well enough that the voltage drop over the input MOSFET went from 0.5V to a trivial number. I’m pretty sure though that I didn’t fix the protection function.

I’ve since received another version of the module which has revised the input circuit. The diode and parallel resistor connecting the gate and drain are still used, but there as another resistor which connects to the charging indication pin on the CN3791, and in so doing. This pin is open drain. When the battery is charging, it is pulled low, lighting the charge indicator LED AND pulling the input MOSFET gate low. Vgs ≅ -Vpanel ≅ Vs ≅-6V, turning the MOSFET fully on.

Thinking through this further… if the battery is charged and the panel is illuminated the gate will approximate the potential of the input MOSFET drain and, since the only load on the panel is the quiescent current of the module, then Vsd ≅ 0V ≅ Vgs and so the MOSFET will be off, save any current through the body diode.

If the panel is dark and the battery is charged then Vd of the input MOSFET will, at most, be at battery voltage (Vbatt), Vs will be ~0v, Vg will ≅ Vd, Vgs ≅ Vd and the input MOSFET will be off.

If the panel is reversed Vs will be below GND and well below Vg ≅ Vd ≅ Vbatt so Vgs will be Vbatt + Vpanel, and the MOSFET will be off. Note: This means that reverse polarity with an ~18V nominal panel would exceed the Vgs maximum of 20V for the TPC8107 MOSFET used at the input.

If I get around to it I’ll draw a schematic and add it to this post.

Digoo IP Camera Teardown and Links

I was just looking at unfinished posts and noticed that I’d taken, but not published, a bunch of notes I’d made earlier this year in hopes of hacking better firmware onto the Digoo BB-M2 WiFi PTZ Security Camera.I gave up on the quest, but here are my notes, with minimal editing.

Someone mentioned that the Chinese language page for Netcam360 has a link to the IPC-SDK. When I downloaded it and looked inside, I saw client-side code, but there was also a self-extracting archive called “HSmartLink Win32 SDK” and I remembered the PCB marking started with “HSL.” Searching for HSmartLink brings up hsmartlink.com, which, among other things, has IP webcams! The i9812 looks like a good match for my camera!

Unfortunately, no sign of any firmware updates. I checked the .cn version of the site too. It doesn’t seem as up to date on products (i9812 isn’t listed), and while there is more info in support section, it is still quite sparse. Page that looks like it is intended to link to downloads hasn’t been updated since 2015

Company is “Shenzhen Hsmartlink Technology Co. Ltd”

FCC Database listing for company

So what is the relationship to NetCam360 (check whois & IP ) and they mysterious APKLink?

Nmap Pobe

Starting Nmap 7.40 ( https://nmap.org ) at 2017-02-06 18:38 PST
Nmap scan report for 10.31.1.124
Host is up (0.0043s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
23/tcp open telnet
81/tcp open hosts2-ns
MAC Address: E0:B9:4D:8F:61:6C (Shenzhen Bilian Electronicltd)

Nmap done: 1 IP address (1 host up) scanned in 0.49 seconds

Teardown Inventory

Photos

Ingenic

Module with Mediatek MT7601UN

Unknown

  • 15UDN8WY, ULN2803AG 18Pin in 2-row SMD
  • Darlington Transistor Array: http://www.ti.com/lit/ds/symlink/uln2803a.pdf
  • Probably used for driving PT motors

Atmel 542

  • 24C02N, SU27D
  • AT24C02
  • Two-wire serial EEPROM (2K)

Vertical PCB

  • SF1810-002, www.sufeitech.com. PCB antenna?

oosilicon or dosilicon?

Other

Balight 21W Folding Solar Panel USB Charger Partial Teardown

I picked up a 21W, 3-panel Balight folding solar panel-based USB charger from Amazon for ~$36 a couple of weeks back. It uses high-efficiency SunPower Maxeon cells much like similar 20-21W panels from AukeyAnker and dozens of obscure brands. All of them have the same basic construction. They are all made from nylon ballistic cloth. Each fold has a panel made from two SunPower cells encapsulated in a flexible waterpoof sheet. The panels provide power via two 5v USB ports, which presumably have some sort of voltage regulator.

I wanted to know more about how the chargers worked. In particular, I wanted to know if they were wired in series, or parallel because I wondered if it was worth trying to tap into the raw output, before the USB regulator to reduce power conversion and resistive losses for some applications.

I thought I’d be able to get the information I needed by finding someone documenting a teardown of their own panel on YouTube or a blog post. Despite the dozens of variants from dozens of brands and a handful of manufactures though, I didn’t find what I was looking for.

So, I decided to dig up a seam ripper and open my panel far enough to get a look at the wiring, and tap in to it upstream of the voltage regulator.

The panels appear to be wired together with some sort of woven wire conductor. I had some hope that all the cells would be wired in series, to give a nominal panel voltage of 18v. Based on what I could see, and measuring the voltage before the regulator in full sun, it looks like each panel is wired in series, for 6v nominal voltage, and then the panels are wired together in parallel. I was disappointed at first, but this arrangement makes sense in upon further thought.

Using a 2s3p configuration means that the input voltage into the switching regulator should be pretty close to the 5v (actually, 5.2v with enough sun and a light enough load) output of the USB power regulator, which will typically have higher conversion efficiency than 12 or 18 volts. It also means that the manufacturers can stock one converter for everything from a 7W single-panel charger, up to a 28w 4 panel charger without the converter having to support a wide range of input voltages. Perhaps most importantly, it means that partial shading of one panel shouldn’t have a disproportionate impact on the power output of the entire array.

The only downside is that resistive losses in the cabling will be higher with lower voltage and higher current, but that the interconnects aren’t more than a foot or so, the resistive losses shouldn’t be too high.

As for the converter itself, I may look at it more closely and add some more details, but, a few initial observations:

  • The PCB design has extensive ground planes on top and bottom, tied together with vias.
  • Both outputs are served from a single buck-converter (step-down) power supply based on a Techcode TD1583, which is a 380 KHz fixed frequency monolithic step down switch mode regulator with a built in internal Power MOSFET.
  • It looks like only port 1, at the top right in my photo, has the data lines connected, which suggests that it is the only one with fast-charge coding.
  • IC U2 looks like it has its markings sanded off. I notice though that one of its pins is connected to the enable pin on the TD1583, leading me to think that it is responsible for cycling the output to make sure devices draw as much power as possible when the panel voltage rises again after clouds or an object reducing the light falling on the array pass. I don’t know if it is a MCU, some sort of timer, or comparator, or what, though.

There you go. I can’t be sure that other folding solar arrays like this one are wired in the same way, but if they only support a 5v output, I suspect they will be. I hope this proves useful to someone besides me.