6
\$\begingroup\$

I wanted to poke around one of those sub-10$ smart bands, so I got a couple of them. I opened it and I was able to identify some major components from the SMD markings, including a Dialog DA14580 MCU, XC6206 3V 200mA LDO VReg, XT4054 Battery Charger IC, ...

This smart band acts as a pedometer, so my best guess is it's using a tiny accelerometer. There's this chip marked 3FL MS, that is either a 4x4 BGA array, or an LGA-12 / LGA-14 / LGA-16 package (I can see 4 shiny solder points under each side of the chip), and I think that's it. Sorry for the pic quality, that's the best I can do with this homemade webcam microscope.

enter image description here

Searching the marking led nowhere, but fortunately, there are test points for i2c, and I was able to confirm that my cheap logic analyzer works (I was able to decode the i2c traffic for the SSD1306 OLED Display). I can see two other addresses : 0x1E & 0x18.

0x1E is only used when the watch boots up, and the MCU only writes to this chip.

0x18 however is constantly polled, approximately every 0.8 seconds, and there's a lot of read from the MCU. This should be my accelerometer.

0x18 seems to be the address used by ST micro for their line of accelerometers, so far so good, but I can't find any datasheet with registers corresponding to the traffic I'm seeing.

The i2c capture can be found here : https://gist.github.com/melka/ac3150315e38d3e691aa3cb7923fdbbd

The most interesting one would be standy.csv, since it only show the "cycle" of polling that 0x18 chip.

I've been searching all of ST's datasheets for this magical 0x3F register that would send back 30 bits of data, but I can't find anything.

What would be the next step in identifying this chip ?

edited : added photo

\$\endgroup\$
3

1 Answer 1

Reset to default
5
\$\begingroup\$

This is a Bosch accelerometer, likely the BMA223 or a variant. Key points:

  • Recommended land pattern has four traces coming out on each of two opposite sides (and two traces on each of the remaining sides).
  • Packaging marking for the BMA223 is XXX/•MX where X are internal codes. (The M is the only thing I noticed distinguishing this from other Bosch accelerometers.)
  • 0x18 is the default address for the BMA223.
  • The 0x3F register is the FIFO_DATA register, which can be read in a burst to read the contents of the FIFO.
  • The first write to 0x18 in your trace is to 0x14, with value 0xB6, which is the software reset command for this chip.
\$\endgroup\$
2
  • \$\begingroup\$ Looks like a pretty good candidate, thanks. When the watch is reading the data, it starts by reading 0x0E, the FIFO_STATUS register, and the accel responds with a fill level of 0x1E or 30 in decimal, therefore the 30 bits of data when reading the FIFO_DATA reg. It starts to make sense. I'll try to poke around the 0x00 register to see if I get a chip ID. Just curious : did you find this chip just with the information provided and some pretty nifty google-fu or have you already worked with Bosch chips and it rang a bell ? \$\endgroup\$
    – melka
    Nov 14, 2017 at 9:07
  • 2
    \$\begingroup\$ @melka Haven't worked with Bosch accelerometers before, though I have looked at them for some parts. After some failed googling, I found this by going through DigiKey's listing of accelerometers to see if I could find a match for the address or markings. Eventually I noticed a different Bosch accelerometer which had the right address but a different letter than "M" on the package; this let me narrow my search to only their parts. \$\endgroup\$
    – Abe Karplus
    Nov 14, 2017 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.