Reverse Engineering: The USB Charger Doctor

In my last post, I had a good look at the features of two different USB charger doctors, and went through a quick teardown. It was fascinating, especially for the blue unit, that they could make and supply such a product for under AU$2. It was a little disappointing that the chip is “unmarked”/remarked, as is normal for a highly competitive market.

rp_DSC_9479-1024x677.jpg

I was interested in trying to uncover just how this unit worked and what functions the chip was performing. Was it a microcontroller? Are there any configurable options or modifications we can made? Could we control the display or extract the data from it directly? The only way to find out was to tear it apart … again!

Teardown Redux

DSC_9485

In the last part, I managed to tear down one of my units to this level, having removed the 7-segment display with much difficulty, to reveal a chip which is mostly unmarked, but marked with 00F0105 (which doesn’t really correspond to anything I know).

For this teardown, I decided to do the same to another unit (as I had already re-soldered the above unit together), but go one step further and liberate the SMD chip off of the PCB to get a good look at how it was wired in.

DSC_9490

It seems that practice makes perfect, as I decided to go the hot air gun route, opting for high temperatures of 380 degrees C to undo the 7-segment display and a gentler 340 degrees C to get the chip to lift.

DSC_9491

Unlike last time, it’s much less “toasted” even after using the desoldering braid to clear up the holes.

Tracing a Schematic

It took about 30 minutes to trace out a schematic of how everything was connected. It was necessary to desolder the SMD to allow access to the traces underneath the chip and to view the vias. The lucky thing is that this is only a double-sided PCB, which makes it easier to trace. A torch seems to be quite handy to shine through the two sides and check where the vias meet.

schrma2

I like to do my schematics on paper, in my case, some random lined paper. This is because it’s easier to keep up with what I’m doing just to do it by hand. Then, I will try to redraw it by hand, minus the mistakes.

Unfortunately, after having drawn it once with a few mistakes, I wasn’t able to draw it any better a second time. Instead, I scanned the first attempt and then used Photoshop to improve the layout and fix some mistakes. I’ve also colour coded the nodes to make it easier to understand what is going on.

Circuit Operation

The USB connectors have the 5V+, D+ and D- wired straight through to the output plug. The GND connection is passed through a 0.05 ohm resistor, acting as the current sensing shunt.

The source voltage itself goes through a 100 ohm resistor to provide some source resistance, and then it goes to two 3-pin pads. One of them is unpopulated, and the other is populated with a component marked 431. It looks like these are likely to be different voltage reference/zener diode parts which can be used in the design depending on the component availability. In the case of the populated LM431 Adjustable Precision Zener Shunt Regulator, it’s taking the positive voltage after the 100 ohm resistor and shunting some of it to ground to keep the dark blue node hovering at 2.5v.

It’s interesting that the regulated 2.5v node isn’t directly used, but is again passed through a resistance of 220 ohms before being passed to the main IC (labelled 00F0105). This line is also attached to pin 3 on the 7-segment display, corresponding to the decimal point, which seems to be a little mystery at this time – wouldn’t this leave the decimal point on at all times?

Lets ignore this for now, and quickly mention the 7-segment display. The unit in use is a common cathode visually-multiplexed type, with four digits. As a result, it has a total of 12 connections, eight of them are segments (seven + decimal point), and four of them are the cathodes for each digit. These have been labelled on the drawing.

The IC itself is a 16-pin device, and to think it has to drive a 12-pin display doesn’t leave many pins. All of the driving pins are labelled green above – Pin 1 drives Segment B, Pin 2 drives Cathode 3, etc.

The remaining non-display dedicated pins are Pins 3, 4, 5, 12 and 13. Pin 3 is connected to the centre of a voltage divider formed by a 2k ohm and 1k ohm resistor, which results in it producing 1/3 of the input voltage. Therefore, this pin is used for Voltage Sensing. The accuracy of this arrangement is dependent on the draw of the IC and the tolerance of the resistors. It’s a design choice, given that the IC is supplied by 2.5V (maximum), that when 7V is applied to Vcc, then the voltage sent into Pin 3 is 2.33V (close to the Vcc to the IC, and reference voltage).

Pin 4 is connected to the ground of the device, which is also the positive side of the shunt. This is hence the Current Sensing input. The voltage developed will be the burden voltage of between 0v and 150mV.

Pin 5 makes a direct connection to the voltage source ground, and is hence Ground.

Pin 12 is connected to a capacitor which is connected to ground. This, through later experiments, has been determined to be a hold-up capacitor of some sort, or maybe reference voltage-store capacitor.

Finally, Pin 13 is connected to the 220 ohm resistor to the 2.5V source. There is no direct connection of the chip whatsoever to the 5V from the USB connector, so this is likely the Vcc supply.

Unfortunately, this means there are no extra pins for programming, reset, control or configuration. This doesn’t mean that the chip isn’t a microcontroller – it might well be, but it has all of it’s pins very carefully used! Oh well, no fun there, but we still have some mysteries.

Most of the pins are digital outputs to drive the LED display. There are only two analog inputs – the Voltage and Current sensing inputs, which might be multiplexed to an internal (slow) ADC with its own internal clock. Finally, there’s one mysterious capacitor (analog reference?) input …

Scoping Out the Circuit

In order to try and solve some of the mysteries and watch the circuit in action, I had to resolder the SMD chip to the board. I decided to give it a shot of hot air, but the remaining solder didn’t seem to be quite sufficient to be sure to have a good contact. As a result, I decided to use a regular old iron to add a touch more solder. It’s ugly, but it works fine!

DSC_9492

I didn’t bother to add the display, as it would have obscured access to the pins. I did re-probe the pins that were accessible after final reassembly and things seemed to operate the same. Some of the mysteries alluded to earlier are solved when I start to poke at the circuit using my trusty PicoScope 2205A.

shunt-reg-Vccvdeepblue

On this trace, I’ve got Channel A connected to the Vcc line on the IC, and Channel B connected to the Capacitor pin. This is a very telling result!

The cycling of the voltage up and down on the Vcc line seems unusual. In fact, the reason why the chip’s Vcc is connected via the resistance becomes a little clearer!

The Vcc line is also connected to the Decimal Point of the screen seems to be exploiting the operating characteristics of the LED to “share” the Vcc input in driving the Decimal Point segment. It seems that the effective load of the IC is “alternated” in time with when the decimal point is lit (first digit). So the load of the IC is low during the first digit, which causes the voltage on the Vcc line to “float” back up to near 2.5v which turns on the LED. When it’s displaying the second, third and fourth digits, the IC increases its load, so the current draw through the 220 ohm resistor is enough to make the voltage fall to about 1.9V which is insufficient to turn on the LED bright-enough to be noticed! Aha! I’ve never seen this before!

As a result, the chip probably operates fine from 1.8v up to 2.5v! But there needs to be a stable source of power somehow – so probing the capacitor line seems to show it remaining stable at 2.5v during all phases. This might be providing the reference voltage for the ADCs to keep the readings stable despite the changes in current draw in the IC.

Why they didn’t just use a capacitor to bypass the Vcc input, and use the other output to drive the decimal point on the screen seems beyond me, but it may be a restriction of the underlying chip design, or it might provide better noise immunity than the other method and that was a better tradeoff (i.e. to digital noise in the reference voltage).

This also allows us to calculate the approximate power consumption. The IC itself is fed with 2.5v through 220 ohms (which we can use as a shunt). It measured 2.497v at the first digit, which implies negligible power consumption of the IC itself. When displaying the next three digits, it’s about 1.9v indicating 0.6v drop over 220 ohms meaning a current of about 2.73mA. When LEDs are connected, this will change quite a bit.

The shunt itself is dropping about 2.5v over 100 ohms which gives us a current of 25mA wasted in the shunt. Likewise, there is a voltage divider, which eats about 5v over 3kohms which adds another 1.67mA.

So, the power consumption of everything sans LEDs is about 28.71mA.

dp-sega-id

This trace was had showing the timings of the display segment outputs. Channel A remains connected to the Vcc line at the chip, whereas Channel B was connected to the SegE output on Pin 9.

It can be seen that when showing the current, the value of 0.000 always has the E segment on, and you can see the decimal point only on for the first digit of the four. You can see the dedicated segment outputs are directly hard driving the line to the chip’s Vcc (2.5v) or 0v. This seems to be acceptable, as the chip’s total current supply is limited, and there’s likely to be enough resistance within the IC to keep the LED’s current in check. This obviates any need to have any form of current-limiting resistors to the LEDs, saving parts!

The display cycles at 246.3Hz (about 250Hz) which is pretty fast and appears visually solid.

dp-sega-vd

When it changes over to voltage mode, you can see it changes the output on SegE, as expected. It’s likely to be displaying something like 4.89U, but it’s not conclusive without seeing the other Seg-data lines.

Final Reassembly

DSC_9493

I managed to solder the display back into place, and snap the case back together. It’s a little brown, due to the flux, but it still works! Nice! And my first real attempt to play with something SMD.

Conclusion

It’s pretty cool to see what you can get for under AU$2. Unfortunately, it turned out that there was no room for modification, customization or reconfiguration. The circuit seems to make use of shunt regulation to provide a reference voltage, with the main IC operating at 2.5V. Every pin is made use of, in rather efficient manner, and an interesting scheme of sharing the Vcc line is used to drive the decimal point segment on the display. It’s always a nice surprise to see something you’ve never seen before.

It was also good fun to use the hot air rework gun to practice on something as inexpensive as this.

About lui_gough

I'm a bit of a nut for electronics, computing, photography, radio, satellite and other technical hobbies. Click for more about me!
This entry was posted in Electronics and tagged , , , , , . Bookmark the permalink.

11 Responses to Reverse Engineering: The USB Charger Doctor

  1. Pingback: Testing: Charger Doctor and USB Detector Accuracy | Gough's Tech Zone

  2. Pingback: Investigation: How Accurate is that 3.5 digit Multimeter? | Gough's Tech Zone

  3. klim says:

    Thanks for your great work on this. I guardedly must contradict your statement, that there is no room for modification, customization or configuration. I made a quick but useful hack on that device. Added two 2mm sockets to directly connect a multimeter for more accurate current measurement. With the jumper on the right you can choose between internal current measurement by LCD or external through 2mm sockets and a multi-meter.
    Take a look here: http://oi60.tinypic.com/34fimud.jpga

    • lui_gough says:

      Good work! Definitely can come in handy, although I’ve tended to butcher USB extension cables to do measurements with multimeters.

      Although technically a modification, I was more focusing on the reconfiguration/repurposing of the ASIC itself. Nonetheless, as long as you realize your accuracy is still limited by the tolerance of your SMD resistor in your unit (if you’re measuring across the resistor), and or the multimeter (if you’re cutting across the power lines and bringing them out), then you’re fine. Additionally, if you measure current with an external multimeter, you might have to consider the effect of the burden resistance in your multimeter – some of the more sensitive ranges on many meters present anywhere from 1-10 ohms, which can drop significant voltage and cause incorrect readings (as the USB device is not operating within its 4.75v-5.25v window). Adding the jumper selection may also compromise accuracy slightly because every single joint contributes resistance (20-50mohms) which adds up considering we have two extra connections in series already, and serves to reduce the voltage to the target device.

      As usual, doing things properly is no trivial task.

      – Gough

  4. ol says:

    Hi.

    Thanks for drawing shcematic. It was very interesting to look at.
    I’ve got another version of that device, slightly different.
    The main IC isn’t marked at all, but they say this is Holtek OTP MCU HT46R064B.
    If it so, the Pin 12 is a Vdd pin, the Pin 13 is a a GPI/O pin.
    Best regards.

    Ol Gor

  5. RIB says:

    The line marked “Hold-up Capacitor” also goes to +2.5v so IC pin 12 is Vdd. The capacitor is a simple power supply filter across the TL431 shunt regulator.

  6. Max says:

    Hi, i have another version with exactly the same enclosure but with display and ic on opposite sides of the pcb. The ic has nothing written on it. On the pcb is written the brand D-SUN
    See picture: http://i.imgur.com/y5LcrXJ.jpg

  7. [email protected] says:

    very good analysis! you saved me the trouble of reverse engineering this device

  8. Chris says:

    There is no way to make it shows only ampere or only voltage?

  9. Javier Muriedas says:

    Mi unit has the components below the display and the other side of pcb is white.
    The circuit is second version of this page: http://www.electroschematics.com/12052/usb-charger-doctor-unboxed/
    I was supplyed the circuit with a LM317L seris regulator @ 2,46V and changed the 2K resistor with 56K//60K for 99.9V scale. It’s for function with my small DC dummy load (USB connectors were retired). The DP is wrong in voltage measure, but… The Vdd is used like Vref and the voltage divider must adapted if supply it’s changed.
    The circuit work since 2,2V and drain 12mA (display bright reduced and precision reduced). Bigger voltages (I was suplyed to 3,3V) rise the current to 50mA with bigger brightness. At 2,4V drain 25mA.
    Thanks for yours “biopsy” articles an sorry for my bad english.

    Javier Muriedas. EA1AWY. Asturias (Spain)

Error: Comment is Missing!