Interesting Switch Autopsy

We put a lot of trust into some amazingly cheap components, sometimes that trust is very undeserved. Long gone are the days when every electronic component was a beautifully constructed precision lab instrument.  As [Rupert Hirst] shows, this can be a hard lesson to learn for even the biggest companies.

[Rupert]’s Nexus 5 was suffering from a well known reboot issue. He traced it to the phone’s power switch. It was always shorting to ground, even though it clicked like it was supposed to.

He desoldered the switch and pried the delicate sheet metal casing apart. Inside were four components. A soft membrane with a hard nub on the bottom, presumably engineered to give the switch that quality feeling. Next were two metal buckles that produced the click and made contact with the circuit board, which is the final component.

He noticed something odd and  busted out his USB microscope. The company had placed a blob of solder on the bottom buckle. We think this is because steel on copper contact would lead to premature failure of the substrate, especially with the high impact involved during each switching event.

The fault lay in the imprecise placement of the solder blob. If it had been perfectly in the middle, and likely many phones that never showed the issue had it there, the issue would have never shown up. Since it was off-center, the impact of each switching event slowly deposited thin layers of solder onto the copper and fiberglass. Finally it built up enough to completely short the switch.

Interestingly, this exact problem shows up across different phone manufacturers, somewhere there’s a switch company with a killer sales team out there.

Tour De Force Battery Hacking

Lithium-Ion batteries are finicky little beasts. They can’t be overcharged, overdischarged, overheated, or even looked at funny without bursting into flames. Inside any laptop battery pack, a battery charge controller keeps watch over all the little cells, and prevents them from getting damaged.

Of course, any “smart” device will sometimes make the wrong choices, and then it’s up to us to dig inside its brains and fix it. When [Viktor] got a perfectly good battery pack with a controller that refused to charge the batteries, he started off on what would become an epic journey into battery controllers, and the result is not just a fixed battery, but a controller-reprogramming tool, software, and three reversed controller chips so far.

devbBattery controller chips speak SMBus, and [Viktor] started out by building a USB-SMBus tool. It’s a clever use of a cheap eBay development board for a Cypress CY7C68013A USB microcontroller. Flashed with [Viktor]’s firmware and running his software on the host computer, a SMBus scan is child’s play.

The rest of the story is good old-fashioned hacking: looking for datasheets, reading industry powerpoints, taking wild guesses, googling for passwords, and toggling the no-connect pins while booting the controllers up. We’re not going to argue with results: the bq8030, R2J240, and M37512 controllers have all given up their secrets, and tools to program them have been integrated into [Viktor]’s SMBusb tool.

In short, this is one of the nicest hard-core hacks we’ve seen in a while. Kudos [Viktor]! And thanks for the SMBus tool.