BMS – Experimental Engineering

Recently my phone decided it was going to die a battery-related death, and having not found much useful information on the Great Google, (all the information I could find, was hinting at many issues from firmware to a faulty motherboard, nobody seems to have actually done any investigation into similar issues), I decided to dig into the phone to try & repair the problem.

The phone would work correctly for a while, then with the slightest movement or knock, would spontaneously switch off, and not turn back on without being whacked on a hard surface.
This symptom pointed me at a power connection problem. After removing the back of the phone (glass & heavily glued in place, so an awkward process), This was what I was presented with on the cell flex PCB.
In the above photo, the positive connection to the flex is fractured just after the solder joint with the BMS board.

I managed to scrape some of the insulation off the flex PCB & solder a jumper on to restore power. Unfortunately, this repair generated another fault, where the battery level was always shown at 50%, and plugging into a USB supply wouldn’t charge the phone. The other two pins on the cell are for communication & temperature sensing, clearly one of these traces was also broken in the flex.
The above photo has a pair of very small wire tails as well, for connecting an external charger.

Here’s a screenshot of the phone with the original cell, even though it’s at about 4.15v (virtually fully charged). The battery management is having trouble talking to the phone, so for safety reasons, the charging logic refuses point-blank to charge the thing up.

The connector on the cell & phone motherboard is absolutely tiny, so I didn’t fancy attempting to solder on any bridge wires to try & bypass the broken flex.

The cell BMS has some intelligence on board, besides the usual over-current, over-charge & under-charge protection. The very small IC on the right has a Microchip logo, and the marking FT442, but I was unable to dig up any datasheets. The current sense resistor is directly connected to this IC, along with the main power FET to the left.

On the other side of the BMS board is another IC, again unidentifiable, and what looks like a bare-die, or CSP IC.

At this stage I figured the only way forward was to buy a new battery, eBay turned one up for less than £5. Above is the new battery fitted to the phone, datestamped 2014, so definitely old stock.

Booting the phone with the new battery quickly lets me know the fix worked, with a 100% reading & the ability to again charge properly!

Here’s another Dyson teardown, in my efforts to understand how marketing have got hold of relatively simple technology & managed to charge extortionate amounts of money for it.
This is the DC35, the model after the introduction of the ~~brushless~~ digital motor.

On this version the mouldings have been changed, and the back cover comes off, after removing the battery retaining screw. It’s attached with some fairly vicious clips, so some force is required. Once the cap is removed, all the electronics are visible. On the left is the motor itself, with it’s control & drive PCB. There’s another PCB on the trigger, with even more electronics. The battery connector is on the right.

Here’s the trigger PCB, which appears to deal with DC-DC conversion for powering the brush attachments. The QFN IC with yellow paint on it is an Atmel ATTiny461 8-bit microcontroller. This is probably controlling the DC-DC & might also be doing some battery authentication.

Here’s the motor & it’s board. The windings on the stator are extremely heavy, which makes sense considering it’s rated at 200W. The main control IC is a PIC16F690 from Microchip. Instead of using an off the shelf controller, this no doubt contains software for generating the waveforms that drive the brushless motor. It also appears to communicate with the other PCBs for battery authentication.

Desoldering the board allows it to be removed from the motor itself. The pair of windings are connected in anti-phase, to create alternating North-South poles depending on polarity. Since the existing controller is unusable due to software authentication with the other parts, I might have a go at building my own driver circuit for this with an Arduino or similar.

The blower assembly is simple plastic mouldings, pressed together then solvent welded at the seam.

The impeller is just a centrifugal compressor wheel, identical to what’s used in engine turbochargers.

The inside face of the control PCB holds the 4 very large MOSFETs, IRFH7932PbF from International Rectifier. These are rated at 30v 20A a piece, and are probably wired in a H-Bridge. There’s a bipolar Hall switch to sense rotor position & rotation speed, and an enormous pair of capacitors on the main power bus.

Not much on the other side of the PCB other than the microcontroller and associated gate drive stuff for the FETs.

The battery pack is similar to the DC16 in it’s construction, a heavily clipped together plastic casing holding 6 lithium cells. In this one though there’s a full battery management system. The IC on the top of the board above is a quad Op-Amp, probably for measuring cell voltages.

The other side of the BMS board is packed with components. I wasn’t able to identify the QFN IC here, as it’s got a custom part number, but it’s most definitely communicating with the main motor MCU via I²C over the two small terminals on the battery connector.

Tag: BMS

Sony Xperia Z3 50% Battery Problems

Dyson DC35 “Digital” Teardown