Kia car keyless entry battery draining

[boo9]

I have kia keyless entry what drains battery after 2 weeks.
There is a 46k resistance on +/- battery pads (when + MM probe on + battery pad), and 16k when probes are reversed.
I lifted C1, C8 caps and top tact switch and the resistance on +/- battery pads still there.
I suspect top left element (yellow arrow), looks like sc-70-5 outline from the measurements (2x1.3mm)

What elements that might be ?
Some folks suggested LDO regulator like http://www.s-manuals.com/pdf/datasheet/r/t/rt9013b_richtek.pdf  but IMO the pins dont fit into existing circuit.

when looking at attached picture

right top (+) connects to battery +  (EN pin in PDF)
right middle goes to KeeLoq chip (GND in PDF)
right bottom - ground (VIN in PDF)

left bottom not connected (VOUT in PDF)
left top - to circuit section left of main chip (NC in PDF)

Anybody has  any idea what that element that might be ?

cheers

[SeanB]

Wild guess RF transistor. Try to reflow it, and clean the board properly. If you cannot get one use a donor remote to get a similar transistor.

[boo9]

This is two sideded board with smd elements on both sides. Can I reflow one side safely ? will elments facing down not fall off during reflow ?

[tautech]

Fixed a very similar after-market car key-fob for a mate recently.
One of a pair, but this one had exactly same symptons from new. Worked fine but it ate batteries.
In-circuit tests of all passives indicated they were all OK.
There is always multiple current paths for in-circuit tests, so one must use best judgement and experience.
Very carefull magnified examination revealed a tiny solder ball bridging a trace to a pin on an IC.
Flicked it out with a very pointed scalpel blade.
Fixed, no more problems.

Manufacturing QC had not even checked the current drain after assembly. 

[wagon]

I've repaired literally hundreds of remotes.  Clean the board thoroughly.  Also, check (replace!) the two switches.  Contaminants get into the insides of the switches, causing enough current to flow to flatten the battery, but not transmit a signal.  Measure the voltage across the switch contacts without the switch being pressed : it should be the same across both switches.  If the measured voltage is too different, you have a bad switch.  Really, the voltage across the open switch contacts should be about equal to the battery voltage.

[boo9]

Many thanks to everybody for suggestions,

Replaced both tact switches, looks good I think, now drain current is 1.5uA

However there is something that puzzles me

Using DM UT139C, there are two ranges for amps uA and mA,
uA range - 001.5uA
uA range - 00.15mA = 150uA !!!

the values given by each range differs 100 times !!!
Can somebody explain that ?

[Refrigerator]

Multimeters don't really measure current on the micro range too well (Dave explained it in one of his videos). Actually, for this particular reason Dave started making the µCurrent.

[boo9]

I take back what I said about 1.5uA/0.15mA measurements, I was wrong,

After I'd read Dave's writeup about uCurrent and burden voltage I went back I repeated tests with Agilent 1241
and it showed 49.5uA and 0.04mA, same value on both ranges.  Then I checked again with UT139c and got same results as with Agilent,   49.0uA and 0.04mA .

So what went wrong before when I got 1.5uA/0.150mA ? I must have connected wrong leads on my UT139c,  I remember connecting to uA/mA socket but I probably left other lead in VOhom socket.

50uA drain, assuming 220uAh  CR2032 capacity, this gives 6 month life, minus arm/disarm current bursts.

[Refrigerator]

I take back what I said about 1.5uA/0.15mA measurements, I was wrong,

After I'd read Dave's writeup about uCurrent and burden voltage I went back I repeated tests with Agilent 1241
and it showed 49.5uA and 0.04mA, same value on both ranges.  Then I checked again with UT139c and got same results as with Agilent,   49.0uA and 0.04mA .

So what went wrong before when I got 1.5uA/0.150mA ? I must have connected wrong leads on my UT139c,  I remember connecting to uA/mA socket but I probably left other lead in VOhom socket.

50uA drain, assuming 220uAh  CR2032 capacity, this gives 6 month life, minus arm/disarm current bursts.

That seems like resonable current draw.

[boo9]

> That seems like resonable current draw.

Well, the specs for the HCS362 state 1uA for standby
http://ww1.microchip.com/downloads/cn/DeviceDoc/cn_40189d.pdf

There seem to be enabling PLL signal from the HCS after button press, going to TR1 (upper part of the image) that probably (I am not sure) powers up the transmit circuit - before the HCS sends the data frames, so 50uA seems still a lot more to what I expect in standby mode.

EDIT:
I checked the voltage in left/right circuits of the HCS chip in standby mode, 0 V everywhere, which jumps to >2V when button pressed, so appears TR1 must be switching correctly power to RF part.

I measured the V on the buttons, in standby mode.
lock - 3.018V
unlock - 3.024V
battery +/-  3.024 3.034
Not sure what it means.

[tautech]

> That seems like resonable current draw.

Well, the specs for the HCS362 state 1uA for standby
http://ww1.microchip.com/downloads/cn/DeviceDoc/cn_40189d.pdf

There seem to be enabling PLL signal from the HCS after button press, going to TR1 (upper part of the image) that probably (I am not sure) powers up the transmit circuit - before the HCS sends the data frames, so 50uA seems still a lot more to what I expect in standby mode.

I agree.
In the repair I outlined earlier the remote battery would last 1 week.
The solder ball bridge created a cuurent path through passives in the PCB.
It seems possible this could still be the situation in your case.
IME there should be no perceptable battery consumption until a button is pressed.

[wagon]

> That seems like resonable current draw.

Well, the specs for the HCS362 state 1uA for standby
http://ww1.microchip.com/downloads/cn/DeviceDoc/cn_40189d.pdf

There seem to be enabling PLL signal from the HCS after button press, going to TR1 (upper part of the image) that probably (I am not sure) powers up the transmit circuit - before the HCS sends the data frames, so 50uA seems still a lot more to what I expect in standby mode.

I agree.
In the repair I outlined earlier the remote battery would last 1 week.
The solder ball bridge created a cuurent path through passives in the PCB.
It seems possible this could still be the situation in your case.
IME there should be no perceptable battery consumption until a button is pressed.

I've noticed some units have a 'higher' initial current draw that settles down to something virtually unmeasurable with my humble gear.

[boo9]

I have monitored the current for 60 secs after connecting the battery, it showed 50 uA steady, no change.

[boo9]

After two weeks the remote stopped working. Initially one button gets flakey, then stops working, then second button.
The battery has 3.062V

I lifted the HCS362 from the board, and connected only Vss/Vdd pins only per
http://ww1.microchip.com/downloads/cn/DeviceDoc/cn_40189d.pdf  app note

The drain current shows 30.7uA (micro Amps)

The spec says standby should be nominal 0.1uA, max 1uA.

Without the chip on the board, The resistance on the board between +/- battery terminals is 6m, virtually open circuit (whereas with chip on the board 16/40k)

Looks like that HCS went kaput unless someone has other ideas.

[tautech]

Does the PCB have reverse polarity protection?
An attempt to install the battery incorrectly might have popped it?

[boo9]

tautech - very likely you are correct,
No there is no reverse polarity protection on the board !
I wonder if the chip has built-in polarity protection, nothing in the PDF spec, probably dont have then.

Just for kicks I might verify that idea, I could get a blank HCS300 series chip and try if reverse polarity will fry it

cheers

EDIT: Protection diode would have 0.7V drop.
Is Polarity protection missing from the board because of the power efficiency ?

[Zucca]

Protection diode would have 0.7V drop.

I did not thought too much but this
http://en.wikipedia.org/wiki/Schottky_diode
is my suggestion if you want a protection diode.

IMO don´t mod anything. If it would be for a old lady with no clue about electronics or for production then yes, it makes sense to design a idiot proof circuit.
Shame on the EE designer for that remote BTW.

[boo9]

Good overview of methods to protect reverse polarity
Interesting method with FET transistor
http://www.instructables.com/id/Reverse-polarity-protection-for-your-circuit-with/

[boo9]

Just for kicks I might verify that idea, I could get a blank HCS300 series chip and try if reverse polarity will fry it

Today I got a blank HCS300  (specs says 2-6.3V operation, same power supply spec as for HCS362 that is broken)

- the Vss - Vdd   resistance is open, does not register  (DM+ on Vdd pin)
- the idle drain current shows 0.1uA (battery(+) on Vdd)

Any other tests I should perform on the chip before applying reverse polarity on Vss/Vdd ?
The purpose of reverse polarity is to determine such condition can/will fry the chip.

[tautech]

Try to monitor the current when applying reverse voltage.
If this was the cause of failure it will be interesting now much current the button cell supplied. 

[boo9]

On the broken chip the the reverse polairity generates around 150mA (mili Amps), which pretty quickly brings down the CR2032 battery from 3.2 to 2.x V with current rapidly (5-20 secs) decreasing from 150mA to 60-80mA, after that the battery shows 2.x V.

I had a wild idea,
I suspect the dropping voltage from 3.2 to around 3.V of broken chip causes it to stop working,
Since the HCS362 operation voltage is 2-6.3V, I could try to use broken chip with two CR2016 (20mm diameter, 1.6mm height, two of CR2016 would fit into one CR2032 holder) for total of 6.4V, it may be OK for the chip but there are PLL circuits I am not sure how would they handle voltate supply increase,  What do you think ?

[tautech]

The battery should be sacrificed on a reversed install.
Diode placed across the battery terminals so to conduct on a reversed install only.

Replace the IC, install diode and move on to the next challenge.