Recharge.IT – Samsung phone batteries

What happens when you are trying to fix a Samsung phone but the battery is flat, and won’t charge in the phone – for various reasons? Of course, find an identical working phone – put the battery in and charge it on that phone.

A while ago, my brother gave me a Samsung Galaxy S2 to look at. The touch-screen wasn’t working, and also the battery was flat. I also have a S2 but his battery also wouldn’t charge in my phone, so I put that aside. I opened up his S2 and was able to locate the display cable, which I think also included the touch-screen – so when I removed that connector and plugged it back in, the touch-screen started working again, so he got the phone back minus the battery.

Some time later, he gave me a Samsung Galaxy S3 to look at. This one had just stopped and would not boot up. It powers up but then stays at the Samsung Galaxy SIII GT-I9300 screen. I wrote about it here.

I have the battery for the S3 here still, so I thought about charging it. If the phone doesn’t boot up, then it will not charge the battery – very unlike a laptop. While doing a few Google searches, I came across mention of a TP4056 chip that would charge Lithium batteries. On eBay, these are very cheap – so cheap, that I ordered a few, as in five. I have this idea of getting those Lithium cells, like the 16550’s and converting everything to use Lithium instead of NiCad etc.

Of course, not everything works from 3.7 Volts, so I also ordered a few DC-DC boost converters, which will take the 3.7V and get 9V or even 12V etc. Again, not everything wants 5V, so for some things, it might like 3.3V so I also got some DC-DC buck converters. Oh, wouldn’t it be nice to have boost-buck converters?

In converter nomenclature, boost means to get higher voltage, and buck is to get lower voltage – from the input voltage – got? A boost-buck converter would be able to take any input, within reason and produce any output – within certain limits of course. They are available, but not as cheap as the boost or buck converters. Anyway, I am getting off topic.

So, these TP4056 chargers came in eventually. They can take an input voltage and produce up to 4.2V to charge a lithium cell. The charger also has a mini-USB connector on it, so I plugged in my GPS charger that can output 5V at 1A and tried it out.

I made a little jig to fit the battery and some copper wire, sort-of spring loaded to connect to the battery terminals, then used a couple of jury-rig wire clips to connect the battery to the charger. The TP4056 is set to charge at 1A which should be fine, since most phone batteries are more than 1Ah in size.


Jury rigged lithium battery charging system

The S3 battery charged ok, even though it is a 3.8V Lithium-Ion battery. Now I have a fully charged S3 battery – what do I do with it, ok – later. I thought I would try the dead S2 battery, so I connected that one, and to my surprise – it started charging. I had previously tried to charge that battery with a specialized battery charger that could handle lithium batteries, but it had failed to charge.

Now, those of you who are know something about lithium batteries will say that this won’t fully charge a 3.8V battery. Of course, the end-point full charge of a 3.8V lithium battery will be about 4.35V whereas the 4.2V is for a 3.7V lithium battery – I certainly agree, however the difference in charge level is only small – perhaps 90+% of charge, and not 100%.

Let me tell you a little secret, which most of you know anyway. A lithium battery has a certain lifetime – defined as the number of full charge cycles. Let us say, for instance that it is 1000. Most of us, will need to charge the phone almost daily – which means that in about 3 years, if we left it to charge overnight, and in the morning – the phone was fully charged, that is a charge cycle. I didn’t finish, in about 3 years or so, the capacity of the battery will be diminished – it may start to happen in 2 years, and if you are lucky, in 3 years or so. By then of course, most people have already upgraded the phone.

So if everyone knows this, how is it a secret? The secret is – what if we don’t fully charge the battery? I.e. for a 3.7V battery that has a full charge voltage at 4.2V – what if we charged it only to 4.1V – and similarly for a 3.8V battery that has a full charge voltage at 4.35V, what if we only charged it to 4.2V? We actually wouldn’t be using up charge cycles – it’s like driving without the odometer clicking over. Theoretically, that battery would still be in top condition even after 10 years! The reason is business – we want you to replace the battery, so that we can sell batteries. We want you to replace the phone since it is getting old, and the new phone can run a lot more apps than the old one. It is just that simple.

Recondition.IT – Thurlby LA-160A Logic Analyzer – Part 1

Towards the end of last year, I came across an interesting circuit board on eBay. It was the CY7C68013A-56 EZ-USB development board – made by Lcsoft. Perhaps made is too strong a word, let’s say “designed” by Lcsoft, and copied by the myriad of asian suppliers. Anyway, it was less than AU$8 including shipping, so I ordered one. In due course, it came, but by then – as usual – I was tied up with other things.

Over the last couple of days, I was sorting things out, and I pulled out my Thurlby LA-160A Logic Analyzer from my cupboard. This logic analyzer was bought at great expense back in either 1985 or 1986. This one was badged by RS Components and was 16-bit capable, with various clock and trigger inputs – very versatile and economical at the time, compared with others that there were available and completely unaffordable, at least to a small business.

I was doing repairs on computers at the time, mainly Commodore 64’s and the IBM PC/XT clones. From memory, it didn’t get used a lot, and still has the plastic that covered the display. Being on a small budget, I elected to make the data pods for it instead of buying them. Ok – to stop digressing, I powered the LA-160A up and could see the display go through a check of all the segments, then LA160A .32 was displayed, telling me that it says that it is a LA-160A and the rom version is 32. Shortly afterwards, it said ready – but then a short while later, started checking the display again, then coming back to LA160A…

It looks like something is slightly amiss with it, so I had a quick check of Google, as we usually do, and found an article about the Nicad battery, and how it could leak. Definitely after 30 years or so, a Nicad battery will most likely have self-destructed, so it was time to open it up and take a look.


Nicad failure

For sure, the battery looked a bit worse for wear – the negative terminal was corroded. Not only that, it looks like the electrolyte leaking out of the battery has travelled quite a distance.


Under the board

Here the tracks under the battery appear also to be corroded, as in eaten away under the PCB coating. I had to remove the battery, which was easier said than done – the positive terminals were easy to desolder, but the negative terminal wouldn’t. I did manage to get it out finally and then it was time to inspect the damage.


LA-160A controller board

The top of the board shows where the electrolyte has followed the path of corrosion, a process called wicking where the liquid moves into small gaps, caused by corrosion. I could see that the corrosion has reached pin 11 of the 74LS02N chip on the right, then the track in the other direction has gone under the two resistors, under the 6116 static ram, then all the way to the empty 28-pin socket (for an option rom) where pin two is corroded.

The corrosion will not stop and must be cleaned. I cleaned the bottom of the board first, since there was not much to be done, except that the tracks were larger.


Corroded ground tracks cleaned (sort of)

I removed the 6116 chip, then desoldered the 74LS20 and both the 6116 socket and the option rom socket. After doing this, I continued the cleaning process – by using methylated spirits with cotton tips to clean the tracks that were corroded – to try to neutralize the electrolyte. Once it was dry, I used a small flat screwdriver, and a fibreglass pen to remove the majority of the corrosion, then cleaned again with metho. Once I was happy with it, I gave the board a clean using isopropyl alcohol cleaning wipes (as the metho leaves a white deposit).


controller board after cleaning

Now it looks better. I could see that the corrosion had been moving in the direction of the LA160 32 eprom, so it looks like I caught it in time to prevent any major damage.

The next steps to do will be as follows:

  1. Repaint the cleaned tracks with a PCB Resist Touch Up paint, preferably in green. This will protect the tracks.
  2. Refit the 24-pin ic socket for the static ram and install the 6116 chip again.
  3. Fit a 14-pin ic socket for the 74LS02N.
  4. Check if I have stock of the 74LS02N, if not – then order a couple – I like to keep spares.
  5. Check continuity for all connections relating to the damaged tracks. Jumper wires to be soldered in place as needed to fix damaged connections.
  6. Order a replacement battery 2.4V 100mAh. Nicad ones are not available, but a NiMH 2.4V 140mAh battery is available at one of my usual suppliers. If I do this, then I need to ensure that the logic analyzer is turned on every couple of months or so, to keep the battery charged up. It is usually a flat battery that starts leaking, plus of course – old age.

I have decided not to install a 28-pin option rom socket for the simple reason that I don’t have the LR-64 option rom for this logic analyzer. If I do get hold of one and want to install this, it would be a simple matter of installing the socket at that time. Also leaving the socket out would allow me to inspect the corroded tracks to confirm that the corrosion is no longer progressing.

By the way, the LA-160A will capture 16-bit data at 10MHz sampling rate. The little CY7C68013A board will be able to capture 8-bit data at 25MHz – an example of new technology at less than a hundredth of the cost of the LA-160A. For about $100 I could get a logic analyzer that can capture 34 bits at 125MHz – maybe that is for another day.

Anyway, this is part 1, with more to follow.

P.S. During my Google search, I found a site that talked about the battery and had a newer rom version 50 available for download, and from another site

found a service manual for this LA-160A. To try out the version 50, I will need a 2764A eprom or perhaps a 2864A eeprom. The 2764A is uv-erasable, but I don’t have a uv eraser, so the 2864A being electrically-erasable would probably be better. Anyway, it depends on what is available and from where.

[Edit]  After checking my stock of integrated circuits and finally finding a 74LS20N, I found that I had misread the IC and actually needed a 74LS02N, of which I do have plenty. Updated the above article with 74LS02N. I should wear my glasses.

Review.IT – When apples ain’t apples!

Further to my reprogramming of the BIOS for my HP EliteBook 2530p, I did some further research since I generally research things before I order bits from eBay.

The Atmel AT26DF321-SU chip used for the BIOS in the HP EliteBook 2530p is in fact a SOIC-8 package – however, it is based on the EIAJ standard which was 5.2mm across the body when I measured it with my digital caliper. The other standard is JEDEC which measures 3.9mm across the body when I measured some other SOIC-8 chips. In actual fact SOIC and SOP are often taken to be the same package.

Now, here is when it gets a bit confusing. SOIC packaging refers to pin spacing of 1.27mm however SOP is supposed to be for less than 1.27mm pin spacing – understand? If you were to design printed circuit boards, you will often need to actually obtain the components in order to do so, or have to go through tons of datasheets to verify package sizes – correct? Actually, not so – most people would use software that would pick up these details when you choose the part number of the item you are placing on the circuit board, so a SOIC-8 package should be the right one, or is it?

My research has shown that the standard JEDEC SOIC-8 package would be about 3.9mm across the body. The EIAJ SOIC-8 package would be about 5.4mm across the body. For higher pin counts, like SOIC-16, there is actually a package that is 7.5mm across the body. The good thing is that the pin spacing is the same – at 1.27mm for SOIC.

I found also that there is a mini-SOIC or sometimes called a micro-SOIC that has pin spacing of 0.5mm, so be careful of what you are actually seeing – don’t just pick up on the SOIC and assume 1.27mm pin spacing.

Interestingly enough, the datasheet for the Atmel AT26DF321-SU also refers to the chip as being a plastic small outline package, or PSOP.

Anyway, the chip adapter socket that I bought is actually for SOIC-8 and SOP-8 when referring to the JEDEC package and for 1.27mm pin spacing. I just couldn’t use it for my chip because I needed a EIAJ socket – oh well, at least I can use it for other SOIC-8 chips. This means that I didn’t actually buy the wrong adapter socket, just didn’t read the Atmel datasheet fine print sufficiently.

Reprogram.IT – HP EliteBook 2530p Bios Eeprom

A while ago, a HP EliteBook 2530p came into my possession. The internal hard disk drive had been erased and the Bios Setup screen was password locked. I was able to determine that the Bios version was F.10 which was very old. F.22 was the latest version available on HP’s website – which I duly downloaded at the time.

The Bios password is quite complicated in these laptops – nothing like the usual desktop. This password and associated settings are stored within an internal Eeprom – which is an Electrically Erasable Programmable Read Only Memory – quite a mouthful. After a bit of examination of the laptop – I noticed what appeared to be an IC socket near the wifi cables when the memory cover was removed. I was able to work out how to open the socket after a bit of fiddling – it pays to be careful as the slightest wrong move can break the latch.

Fortunately, it was a case of push down on the cover, then slide towards the front of the laptop and with a small click – the socket cover unlatches. Underneath was an Atmel AT26DF321-SU. This is a 32-megabit 2.7V serial firmware dataflash memory chip, in an 8-pin SOIC package. Essentially, it is a SPI Serial Eeprom and can operate at up to 3.6V – ok, now to find a programmer.

After a bit of research, I determined that it would be possible to use a Raspberry Pi to access the chip – but I then found on eBay, a CH341A 24, 25 series programmer that was able to program this AT26DF321 eeprom. I decided there and then to order one, since it was only $5.69. I also ordered a replacement AT26DF321-SU at $5.18, then a 8-SOIC test clip socket adapter ($6.59) plus a 8-SOIC to DIP-8 socket adapter for $1.61. Then it was just a matter of waiting for these items to arrive.

Within the next month, these parts all came in – but as I was doing some other things, these parts got placed on the to-do shelf. A couple of days ago, I thought it was time to look at the laptop – and it wouldn’t turn on, flat battery. Anyway, after charging I confirmed that it was able to boot up – from a test version of Windows 7 that I put onto it. It’s a test version because it keeps complaining that it wants to be activated.

I was able to find on the internet, where someone had placed a dump of the eeprom for just this 2530p laptop and it was for a F.12 Bios version – great. I pulled out an old XP laptop and connected the CH341A to it, installed the driver and ran the program. I was able to choose 25 series, then Atmel, and finally to choose the AT26DF321. Next was to connect the chip – that is when I found that the 8-SOIC to DIP-8 socket adapter wasn’t what it was, but actually a SOP-8 to DIP-8 adapter. My chip is too big to fit in the socket, so I proceeded to use the test clip which fortunately worked. The test clip is usually for accessing eeproms that I still on the motherboard, but it works just as well with loose chips.

Ok, new chip connected – click the Detect button, and it interrogates the chip – it found something, so that I did a read of the chip – which only took a short time. Good, no smoke and basically I see a screen full of FF characters denoting a blank chip. That is when I noticed a button called Blank – which checks if the chip is blank, fantastic. Next step, removed the old eeprom and read the contents and save it to a file. I will probably need that when I update the data. Anyway, new chip back into the test clip, then open the F.12 dump file and program the new chip. This time, it took longer then said that chip and data is the same – fantastic. Pop the chip back into the laptop and switch on.

Not good – a red warning that the machine is not in a committed state, then below that “Invalid serial number”. I read on the internet, that I would need a program called CPQTAG.EXE to update these fields, but while I was searching for it – I had a look at the dump of the original eeprom. I could see various sections containing a serial number, model number, sku number etc, so thought I would transfer some of this data across – however it wasn’t in the same place, of course, due to a different Bios version. Since I had a F.22 Bios version, I decided to update the Bios first, then make the changes.

Late last night, I was able to download a version of CPQTAG.EXE – I had a look at the program with a hex editor – to check that it was actually the right program, this time it was. I downloaded another one earlier but when I examined it, it didn’t look right – seemed to contain certificate information similar to what Windows has, so thought that it was likely to be a rogue program, designed to replace your certificates, install a trojan or two – so this was deleted quick smart. You really must be careful when downloading programs from the internet where the source can be untrusted.

This morning, I had a go at using CPQTAG while booted from a USB stick – it runs from Dos and I had a bootable Windows 98 USB stick available. I was able to do a few things, then managed to lock the bios by running a command out of step. No matter, just erase the old chip and reprogram it with my current version of F.22 which of course I saved a copy of, after I upgraded the Bios.

To keep a long story short – here are the steps that I had to do. I had already updated the eeprom with the model number, SKU number and put back the original UUID, so all I needed to do was to update the serial number so that it stops complaining, then commit the machine state.

cpqtag write serial XXXXXXXXXX      where the X’s are the required serial number

cpqtag write me on    to enable the Management Engine

cpqtag reboot me    then the machine reboots and I boot back to the usb stick

cpqtag write vpro on

cpqtag reboot vpro   then the machine reboots again, and I boot back to the usb

By now the warning message is gone, and so is the invalid serial number message.

A quick check of cpqtag read vpro shows that the Vpro Configuration now shows VPro Enabled, Descriptor locked, Management Engine enabled, and Flash Protection Override disabled. This is good as this was the previous setting when I ran cpqtag on the original eeprom.

Why did I need to go through this exercise?  It’s because I wanted to verify the Bios settings so that I can do things like enable Virtualization Technology and UEFI Boot mode. I also disabled the Ambient Light sensor, which was causing the screen to be very dim, when it first boots up. Here is a photo of all the bits that I had bought from eBay.


CH341A programmer with test clip, socket adapter, eeprom and pencil

Next on the agenda for this laptop – since the internal 1.8″ disk drive is not readily obtainable, to install Ubuntu Linux onto it as I already have a few Windows laptops.



P.S. The photo above is to show the disk drive, a Toshiba MK2533GSG with a 2.5″ Sata disk drive sitting nearby for a size comparison. These tiny disk drives are no longer manufactured, so in the future, I would have to go the SSD way – get something like the Addonics ADMS18SA 1.8″ mSata adapter together with a mSata SSD drive.