Hikvision - Surge damaged POE Repair

[moped]

I recently picked up a Hikvision DS-7608NI-E2/8P from a security company that was clearing out unused/old equipment. I was able to work with Hikvision to get the password reset, but the eight POE ports were all dead. No blinking/diagnostics on startup, no power to any cameras.

I took a look at the POE Information on the NVR interface and it indicated that each port was using 3059.1w of energy for a total combined draw of 24473w. This device supports 120w total, so this was a clear indication that something was likley awry with the POE side of the NVR.

The next logical step was inspecting the board, so I opened up the case

See the issue?

TVS9 = Transient Voltage Supression Diode. It's visibly cracked. This thing took one heck of a surge.


A primer on Diodes and how to test them will probably be useful here. Diodes are used to control the direction of current flow. Current passing through the diode can only go in one direction, called the forward direction. Kind of like a one way valve. Every diode has an anode (+) and cathode (-) side. Current can flow from the anode (+) side to the cathode (-) side, but not in reverse. The cathode side of a diode (SMD or through the hole) will have a line on it.

Testing a diode is relatively easy:

1. Turn the multimeter to continuity/ohm testing mode. Connect red to anode (+) side black to cathode (-) side. You should see some resistance - continuity tester should not beep.
2. Connect the red to cathode (-) and black to anode (+) side. You should see no connection at all (meter should show the same thing when leads are connected to nothing and not touching eachother).
3. If your continuity tester beeps or you show no resistance when connected either way, it's bad. If you are doing test #1 above and don't see any connection (same readings when connected either way), it's bad.

In this case (as well as every other case I've seen with TVS/VR diodes) it failed to short - meaning it was shorted out/not blocking any connections. Even without visible damage I would have been able to at least test the TVS/VR diodes using the steps above.

Here is a primer on TVS diode failure:

https://www.vishay.com/docs/88440/failurem.pdf

If you have a single port that isn't working, it could be one of the other rectangular diodes you see in the picture here -- Voltage Rectifier diodes. If you run through the steps above and everything looks good (but it's still not working), you're probably going to need to do some testing with an ohmmeter. You will need to compare readings between VR diodes that have the same rating (numbers printed on them) - or you may have to go look up a datasheet for a diode (if there is no identical one available for testing).

There are VR diodes on the front and back of the 8 port POE boards:

Both TVS and VR diodes can be found on the four channel (and other) units as well. In the pic below you can see the TVS diode next to the capacitor (upper right) and then several VR diodes between there and the ports. (ignore the red arrow)

So the TVS diode that was blown in my unit was labeled with two numbers - bottom was 5PGG (which is the rating for the diode). Borne component. Cross referencing Borne's data sheet reveals that the exact OEM TVS diode is a Borne 5.0SMDJ58A. Littelfuse makes an identically rated/sized diode (same part number), so I picked up a few from Mouser ($1.96 each).

I highly recommend the purchase of a cheap Hot Air Rework station for surface mount device (SMD) work. It will make your life a lot easier if you occasionally do this kind of repair work. No risk of burning other components, the board, melting off pads, etc. You can pick one up for $50 online.

This is a good tutorial for a rework station - the only thing worth noting is that during removal you can speed things up considerably by applying solder paste to existing pads/connections. This will help to eliminate any pulling/rocking IC/SMD components with tweezers to see if they are hot enough to remove:



The first step was to remove the failed component. Flipping it over, you can see that the crack extends around the bottom and that there are melted metal bits from the diode hanging out of the cracks.

Important: We talked about the line being printed on the cathode side of a TVS/VR earlier. When you remove the TVS/VR, pay close attention to which side has the line on it. The replacement part needs to be installed in the same orientation/direction.

Cleaned up, solder paste and new SMD installed (prior to heating)

Back in business, for <$2 in parts.

 

[alastairstevenson]

Brilliant!

 

[tangent]

Nice. No need to shrink all your images quite so much though. You never know, a higher res image of a circuit board may help someone else solve a different problem.

 

[Valiant]

Good to see people are still able to do component level repair.

 

[gpower07]

I have a 16 channels with death poe. in my unit it has Q6085PGG. I can't find it online.

 

[moped]

I have a 16 channels with death poe. in my unit it has Q6085PGG. I can't find it online.

5PGG should indicate the diode rating - this is the same diode that is listed in my post.

Cross reference from Littelfuse:
http://m.littelfuse.com/~/media/ele...ittelfuse_tvs_diode_5_0smdj_datasheet.pdf.pdf

5PGG = unidirectional

 

[TonyR]

+1 to what @alastairstevenson and @Valiant said...kudos!

I did troubleshooting and component replacement of discrete digital (bipolar) and RTL, DTL & TTL 14-pin and 16-pin IC's back in the 70's and 80's when it was perhaps easier from a standpoint of de-soldering, etc. , PC boards had only 2 sides and there was no SMD's. You made it look like child's play!

I can now see the big hole on the underside of that SMD when you flipped it over after removal. It "took one for the team" when the surge came in.

 

[moped]

PC boards had only 2 sides and there was no SMD's. You made it look like child's play!

I really can't say enough about the hot air rework station. A little solder paste, a little hot air, and you can remove SMD components with tweezers. It also works really well on through the hole/board components with several leads - you can heat the entire area (instead of removing solder from one pad/lead at a time w/a standard iron + solder sucker). The paste also helps to hold the new component in place - greatly reduces the chance you will knock something a little crooked with the tip of your iron. You just have to be mindful of the components around where you are working (don't want to melt the plastic off a capacitor) and the airflow speed (don't want to blow everything else off the board when the solder melts).

I've been using the rework station more often than my iron lately, even for non-SMD work (tinning tips of wires, splicing, etc). Works really nicely for heat shrink tubing and decal removal as well

 

[bp2008]

Nice write-up + pictures. Reminds me of watching Louis Rossmann on YouTube. He's really big on teaching component-level repair. I'm too damn lazy and don't have enough failed components for it to be worth my time to learn :/

 

[moped]

Nice write-up + pictures. Reminds me of watching Louis Rossmann on YouTube. He's really big on teaching component-level repair. I'm too damn lazy and don't have enough failed components for it to be worth my time to learn :/

I usually break down and do component level repair/troubleshooting when I can't buy a replacement part/board or the overall cost for the item or replacement part is up there. I would rather repair if I can, replace if I have to (or it makes more fiscal sense).

My neighbors house got hit by lightning and my 70" Sharp Aquos wouldn't power on afterward - the culprit was a $3 VR diode on the power supply board ($200ish for a used power supply board). TVS/VR diodes are the most common item that I see with surge damage. Since we don't really have TV/electronic repair shops around anymore, you can pick up surge damaged electronics in the summer (craigslist, etc) for next to nothing. Definitely some opportunity to repair+flip for some extra pocket change. I did this with a 60" TV last year - picked up for $40, repaired for <$5, and sold for $400.

 

[bp2008]

I can see how a person could build a business out of doing that

 

[gpower07]

FIXED. Thank you.

 

[trucams]

That was great! This is why IPCT is an awesome resource site.

 

[rufunky]

Nice save from what otherwise would have most likely ended up in the trash. I too dabble in component level repairs. It's always a good feeling breathing life back into something.

 

[Guan]

Excellent post OP. Any other suggestions if the TVS diode seems to be ok?

I have a similar problem with a Hickvision DS-7732NI with 16 PoE ports.
When I switch it on, during its boot-up checks, both the data and power led's on all the PoE ports flash on and off.
With any PoE cameras plugged in, the Channel Status reads either 'Resistance is too low' or 'Port short circuited' and neither power or data led's light up.



When I separately power any of the IP cameras, both data and poe lights, light up and it works as it should but the channel status remains unchanged.
I've tried following the suggestion above, but the diode in mine seems to be ok.
Does anyone have any suggestion as to anything else I can try before I give up and go down the 16 port active PoE injector route?

 

[crw030]

Without a schematic it may be harder to fix unless it's something obvious (like a cap blown in half).

However, I'd maybe start by tracing the ports that say they are short circuited, since short circuits are simpler to trace, looking for a component those ports share starting from the network port (with the system unplugged) and moving along the traces.

 

[Guan]

Without a schematic it may be harder to fix unless it's something obvious (like a cap blown in half).

However, I'd maybe start by tracing the ports that say they are short circuited, since short circuits are simpler to trace, looking for a component those ports share starting from the network port (with the system unplugged) and moving along the traces.

Not exactly sure what I'm looking for. All 16 PoE ports give the same error. It's a 32 camera unit so it can support an additional 16 networked IP cameras, so I may just use it that way instead and use a PoE injector to make use of the 16 onboard ports.
Each of the four chips seem to control 4 PoE ports each. I've checked all the small VR diodes and they seem fine.
Going to remove the board to have a look at the back of it.

 

[crw030]

Not exactly sure what I'm looking for. All 16 PoE ports give the same error.

I misunderstood your prior post, so you can get the "Resistance is too low" and "Port short circuited" message on any of the 16 ports by plugging in a camera? If so I would lean towards something they have in common, like their POE power circuit.

However, without a schematic that's going to be much harder than finding a blown component.

That chip "81FB-22NL" is apparently an RJ45 AutoMDIX transformer chip. (see: Shanghai YDS Tech 81FB-22NL - PDF Datasheet - RJ45 Transformer In Stock | lcsc.com ) I would pivot to finding where the power comes into the board and finding the power/voltage circuits instead because that would be something very likely would be shared among several ports.

It would also help to find someone that has a completely working model, as sometimes if you suspect a circuit taking a measurement from a known good board could confirm if you are on the right track. But also could be dangerous to go poking around in a live device without knowing what you are doing.

I think your plan to add an external POE device would be a logical next step if you aren't seeing anything obvious, just to see if the networking portion of the device are functional. If the problem is just in POE delivery then that would be a workaround that won't get you electrocuted!

 

[Guan]

Hikvision PoE NVR owner wanted!
Looking at the back of the Hickvision circuit board I assumed I'd found the culprit. However, it looks like the 5v voltage regulator can be used with or without the middle leg/pin.
I'm also not sure if that 78M05-HK voltage regulator has anything to do with supplying power to the PoE ports. Even though there is a solder point for the middle leg, I'd like to know for sure if it's meant to be there before I attempt to solder one in.

 

[tigerwillow1]

The center pin is ground, most certainly needs to be connected, and probably is connected. The center pin is connected to the heat sink surface on the top of the chip that appears to be soldered. If in doubt, check it with an ohmmeter. That short pin is likely zero ohms to the pad it isn't soldered to.