impedance – Experimental Engineering

Posted on February 13, 2017February 4, 2017 by The Engineer — 8 Comments

Virgin Media Superhub 2 Teardown

I recently got the latest upgrade from Virgin Media, 200Mbit DL / 20Mbit UL, and to get this I was informed I’d have to buy their latest hardware, since my existing CPE wouldn’t be able to handle the extra 5Mbit/s upload speed. (My bullshit detector went off pretty hard at that point, as the SuperHub 2 hardware is definitely capable of working fine with 20Mbit/s upload rates). Instead of having to return the old router, I was asked to simply recycle it, so of course the recycling gets done in my pretty unique way!

The casing of these units is held together by a single screw & a metric fuckton of plastic clips, disassembly is somewhat hindered by the radio antennas being positioned all over both sides of the casing. Once the side is off, the mainboard is visible. The DOCSIS frontend is lower left, centre is the Intel PUMA 5 Cable Modem SoC with it’s RAM just to the lower right. The right side of the board is taken up by both of the WiFi radio frontends, the 5GHz band being covered by a Mini PCIe card.

The 4 gigabit Ethernet ports on the back are serviced by an Atheros AR8327 Managed Layer 3 switch IC, which seems to be a pretty powerful device:

The AR8327 is the latest in high performance small network switching. It is ultra low power, has extensive routing and data management functions and includes hardware NAT functionality (AR8327N). The AR8327/AR8327N is a highly integrated seven-port Gigabit Ethernet switch with a fully non-blocking switch fabric, a high-performance lookup unit supporting 2048 MAC addresses, and a four-traffic class Quality of Service (QoS) engine. The AR8327 has the flexibility to support various networking applications. The AR8327/AR8327N is designed for cost-sensitive switch applications in wireless AP routers, home gateways, and xDSL/cable modem platforms.

Unfortunately most of the features of this router are locked out by VM’s extremely restrictive firmware. With any of their devices, sticking the VM supplied unit into modem mode & using a proper router after is definitely advised!

The cable modem side of things is taken care of by the Intel PUMA 5 DNCE2530GU SoC. This appears to communicate with the rest of the system via the Ethernet switch & PCI Express for the 5GHz radio.

The 2.4GHz radio functionality is supplied by an Atheros AR9344 SoC, it’s RAM is to the left. This is probably handling all the router functions of this unit, but I can’t be certain.

A separate Ethernet PHY is located between the SoC & the switch IC.

The 5GHz band is served by a totally separate radio module, in Mini PCIe format, although it’s a bit wider than standard. This module will probably be kept for reuse in another application.

All down the edge of the board are the multiple DC-DC converters to generate the required voltage rails.

The DOCSIS frontend is handled by a MaxLinar MXL261 Tuner/Demodulator. More on this IC in my decapping post 🙂

I’ve honestly no idea what on earth this Maxim component is doing. It’s clearly connected via an impedance matched pair, and that track above the IC looks like an antenna, but nothing I search for brings up a workable part number.

The RF switching & TX amplifiers are under a shield, these PA chips are SiGe parts.

Pretty much the same for the 5GHz radio, but with 3 radio channels.

Posted on September 1, 2016August 16, 2016 by The Engineer — Leave a comment

eBay Flyback High Voltage PSU

I have found myself needing some more in the way of High Voltage supplies of late, with the acquisition of the new He-Ne laser tubes, so I went trawling eBay for something that would be suitable to run these tubes. (I currently only have a single He-Ne laser PSU brick, and they’re notoriously hard to find & rather expensive).
This supply is rated at 1kV-10kV output, at 35W power level. Unfortunately this supply isn’t capable of sustaining the discharge in a large He-Ne tube, the impedance of the supply is far too high. Still, it’s useful for other experiments.
The flyback-type transformer clearly isn’t a surplus device from CRT manufacture, as there are very few pins on the bottom, and none of them connect to the primary side. The primary is separately wound on the open leg of the ferrite core.

The drive electronics are pretty simple, there’s a controller IC (with the number scrubbed off – guessing it’s either a 556 dual timer or a SMPS controller), a pair of FDP8N50NZ MOSFETs driving the centre-tapped primary winding.
The drive MOSFETs aren’t anything special in this case: they’re rated at 500v 8A, 850mΩ on resistance. This high resistance does make them get rather hot even with no load on the output, so for high power use forced-air cooling from a fan would definitely be required.

Here’s the supply on test, I’ve got the scope probes connected to the gate resistors of the drive MOSFETs.

On the scope the primary switching waveforms can be seen. The FETs operate in push-pull mode, there’s a bit of a ring on the waveform, but they’re pretty nice square waves otherwise.

At maximum power on 12v input, about 25mm of gap is possible with an arc.

Posted on July 5, 2015 by The Engineer — Leave a comment

Wouxun KG-UV950P RF Connector Replacement

In my original review, I noted that this radio was supplied with a SO-259 socket for the antenna connection.
However I’m less than fond of these, due to their non-constant impedance, which can cause signal loss issues at VHF/UHF. Because of this, I’ve replaced it with a high quality N-type connector. These connectors are much better, as they are a constant 50Ω impedance, they’re weather resistant, and being rated to 11GHz, are more than sufficient for a radio that will only do up to 70cm.

Here can be seen the point where the connection is made to the PCB.
I’ve already replaced the socket in this photo. The pair of solder pads either side of the central RF point were soldered to wings on the back of the original SO-259. As there are a pair of screws, also connected to the ground plane, there have been no signal issues with just using the frame of the radio as the ground point. Shown below is the original socket, with the ground wings.

Finally, here is the back of the radio with it’s shiny new N connector.

Chassis mount connectors are pretty standard, so this new connector fits perfectly into the same recess of the original. Looks like factory fitted!

I am now standardising on N connectors for everything in my radio shack, next on the project list for conversion is the SWR meter I recently acquired.

Stay tuned for more!

Posted on July 2, 2015 by The Engineer — Leave a comment

Moonraker SWR270 SWR & Power Meter

As I’m building up my radio shack, I figured an SWR meter would be a handy addition to my arsenal. This is a cheap Moonraker brand meter, which also will measure RF power. Above the front of the meter is shown, with the moving coil meter movement on the left, calibration adjustment on the right & the forward/reverse power switch.

For connections, standard SO-259 jacks are provided. The casing is sturdy 1mm steel. This is good, considering it’ll probably take a beating in my portable radio bag.

Here the cover is removed, showing some of the internals. The large PCB across the back is the directional coupler.

The SO-259 connectors are bridged with a transmission line, (the track covered in solder in the image below), while there are a pair of sense lines running alongside. This main line is electromagnetically coupled to the two smaller sense lines, which are terminated at one end with resistors, with diodes at the other to rectify the coupled signal.
The termination resistors are sized to match the impedance of the sense lines.
The diodes, having rectified the coupled RF, produce DC voltages representing the value of the forward & reverse RF power. These DC voltages are smoothed with the capacitors.

The PCB is dated 19-8-2011, so it’s a fairly old design.

Here is visible the back of the user calibration adjuster, with the factory calibration trimmer.

Back of the meter movement. This is a standard moving coil type. Nothing special.

This meter will soon be modified to accept connection of an external Arduino-based SWR & power meter, which I can calibrate individually for each band.
Stay tuned for that upcoming project.

Posted on December 6, 2010 by The Engineer — Leave a comment

Southwestern Bell Freedom Phone

This is an old cordless landline phone, with dead handset batteries.

Here’s the handset with the back removed. Shown is the radio TX/RX board, underneath is the keyboard PCB with the speaker & mic. All the FM radio tuning coils are visible & a LT450GW electromechanical filter.

Radio PCB removed from the housing showing the main CPU controlling the unit, a Motorola MC13109FB.

The keypad PCB, with also holds the microphone & speaker.

Bottom of the keypad board, which holds a LSC526534DW 8-Bit µC & a AT93C46R serial EEPROM for phone number storage.

Here’s the base unit with it’s top cover removed. Black square object on far right of image is the microphone for intercom use, power supply section is top left, phone interface bottom left, FM radio is centre. Battery snap for power backup is bottom right.

PSU section of the board on the left here, 9v AC input socket at the bottom, with bridge rectifier diodes & main filter capacitor above. Two green transformers on the right are for audio impedance matching. Another LT450GW filter is visible at the top, part of the base unit FM transceiver.

Another 8-bit µC, this time a LSC526535P, paired with another AT93C46 EEPROM. Blue blob is 3.58MHz crystal resonator for the MCU clock. The SEC IC is a KS58015 4-bit binary to DTMF dialer IC. This is controlled by the µC.

Underside of the base unit Main PCB, showing the matching MC13109FB IC for the radio functions.