Reverse Engineering: The KW203 USB Detector

Since I decided to take apart the other USB Charger Doctor unit to determine how it worked, my curiosity could only be satisfied if I took apart this unit as well.

DSC_9464

Out of the two units, this was the pricier, more sophisticated and featureful unit. As I only had one of these in my possession, I really didn’t want to take it apart first. But after gaining a little more confidence in my “homegrown” hot-air rework technique, I decided I’ll take this one apart even if it kills it. It’s only a loss of ~AU$7 if I destroyed it, and I was willing to bet that I could take it apart without killing it.

De-Populating the Board

One nice feature is that the upstream USB connector cable is terminated in a socket and plug, and easily detaches from the board. Because of the design of the board with two USB connectors, and two displays, there’s a sizable amount of desoldering to do.

DSC_9496

One positive is that the holes themselves are fairly big, so desoldering the through-hole components with braid alone is possible. The flux residue from the “no clean” desoldering braid burns to a charred colour, which looks bad, but is perfectly fine. When removing the 7-segment displays, it seems I may have slightly pulled the through-hole via plating because the solder didn’t completely remove, but it wasn’t a major issue since the majority of the plating is still there (and when filled with solder, it should be just fine).

DSC_9497DSC_9498

It didn’t help that the pins on the 7-segment displays were cut very irregularly and bent to fit the holes at the factory. This only added to the de-population challenge.

DSC_9494

While the braid was satisfactory, there were a few stubborn holes with solder that liked to stick. I decided to do the “re-solder” and de-solder trick, which eventually worked, but you can see the frosty appearance of the pad where lead-free and leaded 60/40 solder mixed. It’s interesting the silk screening shows which way the 7-segment displays go, despite them being only mountable in one direction due to the odd pins.

DSC_9499I did have to get the hot air gun out to de-populate the IC, which came off easily, to reveal some markings underneath that make no real sense to me.

But even then, I realized through a preliminary attempt to trace the board, that this board is confusing!

I was constantly being flummoxed by vias, some of which are very thin, some of which were “supposed to be there” but then wasn’t actually manufactured, and planes which seemed to be islands without any source driving them. I reasoned this could only be because of obscuration by the remaining components, so I got out a tweezer and my hot air gun and took off the last few big chips, leaving only resistors and capacitors. This means only one thing – time to trace!

DSC_9500

Tracing Out the Design and Features

After about an hour, and three redraws (to produce something that’s easier to follow), I’ve managed to produce a schematic. I’ve actually eliminated the un-populated pads from this drawing as it makes it easier to follow. As usual, I’ve colour coded certain nodes to make the schematic easier to follow – I actually like this myself, as it’s much easier to digest at a glance.

detectorschematic2

From looking at the design, it’s possible to see these interesting design choices and features:

  • This unit uses a 0.01 ohm surface mount resistor as a shunt, and it is inline with the ground line to measure the current consumed by both the pass-through USB port and the charge-only USB port.
  • The charge only USB port has its D+ and D- lines routed to a set of 10 pads for surface mount resistors, which allows for combinations of pull-up and pull-down on each line and resistance between lines. This arrangement allows for configuration to most charging protocols. In this unit, a 0-ohm surface mount resistor is mounted between D+ and D- meaning it’s configured for USB Dedicated Charger.
  • A 3-terminal 3V regulator (marked 78U30) is used to supply the voltage to the ICs, thus it’s capable of running at a wide range of voltages. A protection “clamp” diode is provided in the case the ground is higher than the output voltage.
  • Voltage sensing seems to be done via a voltage divider, with the measured voltage over the 2kohm resistor also being “held up” by a capacitor to reduce the reading varying due to noise/ripple.
  • The current sensing relies on an external SGM8551XN precision rail-to-rail opamp amplifier set for 48x non-inverting amplification (as expected, due to the small burden resistor value). This is then fed into the main IC.
  • The 7-segment displays are 3-digit type with 11-connections. These are common-cathode type. The IC uses them in multiplexed mode, with each segment data line connected between the two displays, but the segment cathodes connected to separate pins. This results in the chip drawing only one character at a time across the two displays, and cycling quickly enough to allow persistence-of-vision to appear as a solid display.

Unfortunately, as every pin has been consumed by a function, it doesn’t seem likely that there is any potential to hack or modify the unit. It’s a very efficient utilization of the footprint – 18 pins to drive two 3-digit displays, and two analog inputs. It could be a microcontroller or an ASIC, we can’t easily tell.

The chip itself is obviously a display driver, with internal current limiting for the LED segments, and probably a multiplexer and ADC to handle the two analog inputs. It seems pretty similar to the other USB charger doctor, with the exception of a different display configuration and different division/voltages expected for the current and voltage sensing.

Observing its Outputs

In order to check what the circuit’s outputs look like, I had to reassemble the unit. A few more blasts of hot air, and resoldering the through-hole components left me with a once-again functioning board. It is very very dirty with burnt and regular amber coloured flux residue, but that doesn’t affect its functionality so I didn’t bother to try cleaning it. I decided to give the unit a little helping hand by adding some tin to the tinned traces to reduce the resistance marginally. This should improve its performance.

DSC_9501

Hooking up Channel A to the DP drive on one display, and Channel B to the Cathode 1 on the same display, it’s possible to observe the voltage on the decimal point output which lights up once per cycle. As the Picoscope is run off USB, and shares the ground with the device, we have to rely on math to determine the voltage on the actual DP diode (by A-B).

detector-segment-drive

It seems this is classic multiplexed 7-segment display in action. At the beginning of the display cycle, the decimal point drive goes positive, and the corresponding cathode goes negative to result in a positive voltage across the diode causing it to light. Then for the next three segments, the decimal point drive stays low, as it isn’t lit, and the cathode remains high as the particular digit isn’t being addressed.

Then, the decimal point drive goes positive again, as it’s trying to light the decimal point for the other (current) display, but since the cathode remains high, the diode still doesn’t see forward bias and remains off. Similarly, three more digits are pumped out, before the cycle repeats.

This happens at a very fast 362.5Hz rate. The resultant voltage can be seen in the purple trace – going positive for one digit, then negative/near zero for the rest. It is notable that it seems the outputs themselves possess enough resistance that they can be used to drive the LEDs directly when the Vcc is 3V without burning them out. The resistance is visible in the way that when the cathode is driven low, the voltage isn’t exactly zero, and when the segment is driven high, it doesn’t exactly hit 3v either.

Conclusion

Curiosity gets the better of me, so I decided to take it apart and study how it’s connected and how it works. It looks to be a purpose-driven chip, without any additional outputs or debug terminals to look at, so that’s a little disappointing, but it’s nice to be reminded of the design principles which it follows in terms of 7-segment display driving. This one uses a few more components than the others – notably requiring an op-amp to provide a strong enough current sense signal for the display driver chip. It also doesn’t utilize an external precision shunt voltage regulator, instead opting for a three-terminal regulator, although the chip itself may have its own internal reference.

In all, another good experience, and definitely handy for gaining some confidence in SMD “rework” (for disassembly and reassembly). It seems that if you have a proper PCB, it’s not so hard after all.

About lui_gough

I'm a bit of a nut for electronics, computing, photography, radio, satellite and other technical hobbies. Click for more about me!
This entry was posted in Electronics and tagged , , , , , , . Bookmark the permalink.

10 Responses to Reverse Engineering: The KW203 USB Detector

  1. rasz_pl says:

    isopropyl alcohol will clean that flux off easily

    • lui_gough says:

      Well, a little rubbing won’t hurt, but it’s really down to cosmetics. The Multicore brochures have always stated that it’s fine to leave the burnt flux behind for “additional joint protection” – whatever that means :).

      Thanks for the note about the STM series micros as I wasn’t aware of their use in voltage meters – the package looks similar but it’s not the right number of pins. I wonder if this is one of their own Chinese “home grown” micros or whether it’s an ASIC. I suppose the answer would only come about if I had a microscope and bothered to decap the chip or X-ray it.

      – Gough

    • Jeff M says:

      Thank you for the schematic!! Mine (exact same product) was showing a steadily decreasing voltage reading (amps OK) over time. I left it plugged in for months, and it had decreased to less than a volt. I ordered a new, but different kind as I liked having the info of the charging and cord differences.

      But what the heck, I’ll open it up and take a look… only could see no obvious defect nor determine visually what was going on, and no obvious blown parts. Using your schematic however I could check the resistances and voltages in circuit. The regulator was pumping out 3.0v, and the divider was giving an unexpectedly low input to the unnamed IC. The resistance measures showed the 2K resistor was only giving .5K resistance. This is a very unusual failure mode for a resistor, which made me think it was the IC or some other connection or component intermingling, but the connections from your circuit showed 0 resistance to the expected other connections from the questionable resistor. I had a 2K SMD (larger than the one installed, but I had a 0805 size and tried it) that I dropped in place on the pads and resoldered. Low and behold it worked just great! It also tested in place at 2.0K ohms. Some of the reasons for a resistor to fail in this mode hypothesized rosin under the resistor could have slowly degraded and alloed some current to flow under/around it, but I could not verify. I tried to to reflow it with hot air and retest but is showed the same resistance before and after. Some info said that carbon based resistors could exhibit this mode but I didn’t think an SMD component was carbon based. I scratch my head on why (it didn’t show heat, and I since it didn’t “just blow” and degraded over a long time period) but I am so glad your schematic enabled me to put a simple DMM to the pieces and diagnose the issue.

      Thanks for the circuit that enabled me to troubleshoot the failed component. At $10 replacement value, the joy of being able to troubleshoot and repair this trivial piece of gear was much more satisfying than any use I’ll get out of it, especially since I have a more capable one coming, but it really was a satisfying exercise for me to apply my hobby electronics skills having never taken calculus or electronics in school. A business major’s small success! Thanks again for posting your schematic, and I even learned a thing or two about how you broke down the schematic in your tear down.

      • lui_gough says:

        Great stuff to hear, and I’m glad I could be of help. Indeed a resistor *losing* value rather than going open circuit seems odd. SMD types are likely to be either carbon composition or metal film based, so maybe there is some impurity in the metal that led to some “whisker” growth causing reduced resistance by parallel path, or a problem with the sealing which may have led to humidity and any trace chemicals in the air having a reaction with the material inside or increasing conductance due to the reactant materials being more conductive. As a simple voltage divider, it seems to be unlikely that it could ever be overstressed (i.e. over-voltaged) to have arced/fused internally, so curious failure indeed!

        Your rosin theory seems possible too – maybe the remnant corrosive flux had a part to play in removing the paint-coat outer letting the insides become exposed.

        – Gough

  2. rasz_pl says:

    btw I was expecting Stm8s003 just like in those $2 hackable voltage meters from ebay

  3. rasz_pl says:

    depends on a flux, old school Rosin (brown stuff) is fine, water soluble ones are not

    http://www.circuitnet.com/experts/67321.shtml

    and this is china bottom of the barrel products, so you can never be sure they really went with no clean flux :/

    isopropyl alcohol is made out of magic:
    http://youtu.be/jAYpSBgHxlU?t=8m54s

    back to microcontrollers, STM8 started to show up in those cute cheap voltmeters first
    http://smokedprojects.blogspot.ca/2013/08/i2c-led-display-from-hacked-voltmeter.html
    http://www.ebay.com/itm/Mini-0-50V-DC-3-Wire-LED-Blue-Digital-Volt-Meter-Voltmeter-Ammeter-Voltage-/161288305061

    then it migrated to combo volt/ammeters
    http://www.ebay.com/itm/New-Dual-LED-Digital-Voltage-Current-Display-Voltmeter-Ammeter-Panel-Gauge-HTE-/151326741761

    later buck converter modules

    http://www.ebay.com/itm/CC-CV-Step-down-Charge-LED-Driver-Voltmeter-Ammeter-Module-5A-Adjustable-Power-/251624585838

    and now we got whole lab smps supplies based on this chip ๐Ÿ˜ฎ
    http://www.eevblog.com/forum/testgear/switching-power-supply-gopher-cps-3010-30v-10a
    http://www.ebay.com/itm/160W-32V-5A-Precision-Adjustable-DC-Digital-Switching-Power-Supply-110V-220V-US-/271588666050

    I love those fast small steps of shenzhen innovation. With any luck we will have ~$30 lab power supplies in 5-10 months.

    • lui_gough says:

      Indeed, the stuff I use is Multicore branded, Henkel made quality rosin fluxed solder. This spool I’ve had for ages, and I just got another :).

      How very interesting – the power supply itself looks tiny but semi-reasonable. Like the Manson switching supplies I use, it can hardly be called precision (i.e. voltage only in 0.1v steps, and current limiter with a fair amount of overshoot on shorting). I suspect these units will perform much the same. The price is very inviting, and it’s less than half the price of the Hong Kong supplies, so that’s pretty cool.

      With any luck, they won’t make too much audible noise, have decent ripple output (the Manson ones seem to) and won’t have catastrophic random failures. The pervasiveness of “off brand” Chinese caps tend to make me a little nervous on the low end, but considering the hobbyists aren’t going to be hammering their gear at full load 24/7, it might be good enough.

      Thanks for opening my eyes to these developments! It is definitely exciting, but I find sometimes when they take it a little too far, that’s when the fun is all ruined (e.g. lies in their ratings, like “generic” ATX desktop power supplies).

      – Gough

  4. Pingback: Investigation: How Accurate is that 3.5 digit Multimeter? | Gough's Tech Zone

  5. greg says:

    Thanks for the schematic. It helped me fix a voltage reading issue with mine (consistently 25-50 mV low). The culprit was the 15k potential divider resistor on the voltage sensing input. On inspection, it was physically chipped and reading about 16k. Replaced it and it was fine.

    Incidentally, the marking on the chip on my sample was not scrapped off. It’s an Elan EM78P372N, datasheet here:
    http://www.emc.com.tw/eng/database/Data_Sheet/8BIT/EM78P372N.pdf

Error: Comment is Missing!