Breaking Vac

A few months ago, I decided to go and shop for a new handheld vacuum. I love these things. Nowadays, models are really powerful and easy to handle, and they’re a great thing to have around!

After my painful learning experience of learning about the incompatibility between Makita’s G and LXT batteries not long after acquiring a Makita DCL180ZB, I was ready to break up with my Makita fan-boy attitude and go for something else.

I was looking around, and even if I was suspicious a bit, a Bosch vacuum caught my eye: the Bosch BHN24L.

Let me give you a brief review: it’s OK. It’s powerful and has a washable filter, though I would like to assault the engineer who decided that it should have no external feature that you could use to mount it somewhere, like on the wall. The vacuum is pretty pricey (~110€), and for the price, it would’ve been nice if they gave a bit bigger repertoire of accessories. Ah, wait, they sell 40€ kit with some plastic dongles in a nice eggbag¹? Ah, you can only love the Germans!

Enough tool review; here is the story of how I blew it up.

Expensive smoke generation

So I was using this vacuum around, and one benefit of the largest voltage model is the sheer lifetime of a charge. It took so long to drain the battery that I was placing its charging block left and right until… Until I didn’t find it anymore.

Look, at the ripe age of 32, my memory doesn’t work as well as it used to, and I was wondering around the house to find a power adapter.

Doesn’t matter, I will just use my lab supply!

I said and proceeded to my lab. I fished out a barrel connector from my basket of parts and wired it up to my big switching power supply.

They at least kindly noted the adapter voltage on the vacuum’s bottom of the label: 27V. I didn’t care to carefully set the current on the power supply, as my assumption was that the charger IC would regulate the current. In hindsight, there was also 500mA written next to the 27V, and let me tell you, that was there for a reason. So I connected everything together and turned on the power supply.

Then I heard the poof and started to smell the characteristic aroma of toasted electronics.

Post mortem

After the panic, I’ve started noticing some signs of life:

• The white LED on the top of the device kept blinking. This was a good sign that some MCU was still alive.
• The device still drew some power, albeit very small, around ~5mA. I believe that was mainly the white LED at the top.
• You could still turn it on! This was great news again, as it signaled that most of the internals were intact, yet I knew that the clock was ticking.

So it was time for an autopsy and a possible resurrection.

Taking it apart

Taking apart the vacuum was a pain in the ass. It is a typical clamshell design, where next to a few screws, a lot of plastic clamps hold the device together. After wrestling with the casing, finally, it opened up, and I could take the main board out.

The PCB coating is probably silicone-based. It’s slighly frosted outer surface made reverse engineering almost impossible. Nevertheless, it was a great indicator of damage, as next to the two black transistors in the bottom right corner, the coating opened up. Probably as a side effect of the transistors heating up significantly and bursting out.

Look at that top transistor! That’s some catastrophic damage; one of its leads was literally melted out of the case.

From the two transistors, the bottom one still had some readable markings on it. After much guessing, I identified the transistor as a P-channel MOSFET, namely a Rectron RM60P04Y-T. Let’s just appreciate how power-dense this transistor is: it’s a -60V MOSFET with an advertised Rds(on) of 120-170mΩ (depending on the V(GS)), and it’s in a microscopic SOT-23 package. These are respectable characteristics for such a small package.

On the other hand, the MOSFET probably doing the actual battery-to-motor connection is a CJAC13TH06. You can see that the form factor plays a role, as this much larger package has an Rds(on) of 2.2-3.0mΩ.

Reverse engineering

Removing the entire coating seemed like too much of a hassle and a dangerous one: picking around with a toothpick still does not guarantee that you won’t accidentally rip off some components. The drawback is that through the coating:

• following traces is hard
• poking around with a multimeter is not possible

At first, I started to poke around the lower, more intact transistor. After learning that it’s a P-channel MOSFET and seeing how thick traces are connected to it, I already suspected it was part of a low-side switch. This was confirmed by the fact that the source of the transistor was connected to the power input.

The higher transistor was a different story, though. It didn’t have any evident high current traces connected to it, and its traces quickly became tangled in the forest of resistors to the left of it. This made it hard to figuring out the exact path of the traces leading to it.

Picking the candidates

Despite the lower transistor being identified, the upper one was still a mystery. Being in my indecision, I started to look around the PCB. I’ve noticed how widespread placed the RM60P04Y-T MOSFETs were. They are placed all around the PCB.

Hah, they probably engineered their way around using a different MOSFET, so they don’t need another reel in their pick-and-place machine!

Armed with this gut feeling, I decided to risk it and try to drop in the same MOSFET in both places. I already had a dying vacuum; what else did I have to lose?!

Ordering parts

Finding parts was not a big deal. The original link to the transistor was from Mouser, and I could order it from there, but I didn’t feel like ordering 7500 of them to just have 2. So I decided to go with AliExpress and ordered a 10-pack of NCE60P04Y, which seemed to be functionally equivalent to the original one (at least on paper).

After an eternity, they’ve arrived.

(De/Re)soldering

Initially, I wanted to use my hot air station to do the whole rework process. Well, not long after desoldering, which went uneventful, my hot-air station blew up.

So here I was, with a dying vacuum and a hot-air station that had just died. Luckily, I have a soldering iron with some fine tips and a few years of experience, so I’ve decided to go with the old-school way.

I will leave the teaching about SMD soldering to the experts, but I would categorize my results as OK considering the feature size.

Plugging it in

After so much trouble, we arrived at the moment of truth: plugging this poor vacuum in with its now-found adapter (ouch…) and see if it’s charging at all.

IT DOES!

The white LED pulses with a comforting slow pace, telling me the device is charging. Looking at my socket power meter, it says the device draws around 15W of power, and no smoke is generated in the process. I took the opportunity to measure how hot the transistors get.

It seems that the transistors are getting warm but definitely not overheating.

All in all, I left the device charging up, and now it’s time to cover the PCB back up and assemble the vacuum back together.

Recoating the PCB

I don’t consider myself a handheld vacuum connoisseur, but I’ve worked on a few of them before. This vacuum’s design was peculiar, as it exposed the PCB to much higher levels of dust and dirt than the others. Basically, all electronic components share a single airway of the vacuum engine.

Therefore, I’ve decided to recoat the PCB with my type of accessible conformal coating… hot glue. I was surprised how well the glue flowed onto the surface, and you can use the tip of the gun as a sort of ironing tool. Although its looks may not be the best, it will do the job of protecting the PCB from dust. It’s not unthinkable that the dust could cause a short circuit (depending on what you are vacuuming), which could cause catastrophic damage.

This is the sad part of this article

To recoat the PCB, I’ve disconnected everything and coated the pieces as shown. When I reassembled everything, I was met with something unusual.

That LED didn’t used to be red…

Well, I said, it cannot be that bad. Probably I’ve connected something out of order, and the MCU already got power, and didn’t sense something.

Oh boy, was I wrong! After a fair amount of fiddling around, disassembling, and reassembling, I’ve concluded that this is a persistent issue. Looking at the manual p.49, I’ve identified that the problem can be associated with “Over-/undertemperature”. Even though I doubt that any over (especially under) temperature event happened. My best guess is that in my connection/disconnection fury, I made the device lock itself in a permanent error state.

Conclusion

Well, my disappointment is immeasurable, and my day is ruined. I hoped when I started writing this article meanwhile doing the repairs that I can show you a nice success story. That being said, I find it important to document failures; it feels rare nowadays, and I think it’s a good way to learn - even if it’s a letdown.

Some takeaways, which might have been spoiled, as I’m warning ahead the impatient: connect the battery the last. Still, this conclusion is just speculation from my end, and I’m sad to not deliver a definite answer.

Wait for a freakin’ second; I still have a warranty on this thing… Can… can I just send it back?

Let’s see what the Bosch technician will say when this lands on their desk.²

Appendix A: Engineer yelling at right-to-repair shaped clouds

After the Red-LED-of-Death, I was just scouting the PCB for some interesting bits. I figured that the processor is a HR8P506FHNK. It’s a basic Chinese Cortex-M0 processor; not much to see here.

Next to the processor were two interesting header groups:

• A GND, VCC, RST, SDA, SCK group. By name, it suggested this was an I2C bus, though it smelled like a programming port.
• A TX, RX pair, which was probably a UART port.

I wondered if I could use either of these to gain insight into what’s happening.

Checking the UART

To get started, I’ve picked my first fight with the UART. Even before connecting a proper USB-to-serial adapter, I connected my oscilloscope to the TX line to see if there was any activity.

Sadly, after flicking the vacuum’s switch, I only saw a constant 5V (i.e., high) on the line. A high level on TX means that the UART is active but idle. There is not a single bit leaving the device.

Checking the SWD

For people knowing embedded electronics, SDA and SCK is nothing new: it’s I2C, a common protocol for peripherals. But it didn’t make sense for that header being I2C: it is not used for programming, neither communication with the outside world. Also, why is there a RST (i.e., reset) pin on the header? All lines were pointing towards this being a programming port.

Translating the documentation yielded the answer: the SWD is multiplexed with the I2C ports, so the headers are only I2C in their names, and they are used for programming. So, to get to the end of this, I dusted off my J-Link programmer, a versatile ARM programming and debugging interface, and got wiring.

Setting up the wiring was not a big deal, but the results were disappointing. The programmer could not connect to the device. This suggested to me that after flashing the device in the factory, the SWD pins were disabled, and the device was locked down.

I’ve verified that the programmer works by wiring an iconic STM32 Blue Pill lying around in the box. The programmer immediately picked up the device…

Closing thoughts

You know, you could always read the threads about (and probably there are still examples) hacking all sorts of devices through physical access.

I think we all know the joke that the S stands for Security in IoT. Or the endless stories of routers hacked by just soldering on a serial cable and logging in with a default password.

The sad news for us folks who have the means and will to try fixing their stuff is that the industry is getting better at paying attention to locking down their devices. Let’s face it: flipping a bit in a register to lock further access down is only a matter of QC and paying attention to what your (probably offshored) engineering team does.

I guess Bosch had some secret sauce how to turn on a switch between the battery and the motor.

Thanks for staying around, and see you around.