processor – Experimental Engineering

Posted on June 1, 2018April 29, 2018 by The Engineer — 5 Comments

Vodafone Mobile WiFi R207 Teardown

Here’s one of the old modems from my spares bin, a Vodafone Mobile WiFi R207. This is just a rebranded Huawei E5330. This unit includes a 3G modem, and a WiFi chipset, running firmware that makes this a mini-router, with NAT.

The back has the batter compartment & the SIM slot, with a large label showing all the important details.

A couple of small Torx screws later & the shell splits in half. All the electronics are covered by shields here, but luckily they are the clip-on type, and aren’t soldered direct to the PCB.

Once the shield has been removed, the main chipset is visible underneath. There’s a large Spansion MS01G200BHI00 1GBit flash, which is holding the firmware. Next to that is the Hi6758M baseband processor. This has all the hardware required to implement a 3G modem. Just to the right is a Hi6521 power management IC, which is dealing with all the power supplies needed by the CPU.
The RF section is above the baseband processor, some of which is hiding under the bits of the shield that aren’t removable.

There’s a socket onboard for a standard Mini-SIM, just to the left of that is a Hi6561 4-phase buck converter. I would imagine this is providing the power supplies for the RF section & amplifier.

Not sure what this section is for, all the parts are unpopulated. Maybe a bluetooth option?

The other side of the PCB is pretty sparse, holding just the indicator LEDS, button & the WiFi Chipset.

The chipset here is a Realtek part, but it’s number is hidden by some of the shield. The antenna connection is routed to the edge of the board, where a spring terminal on the plastic case mounted antenna makes contact.

Posted on March 15, 2018March 15, 2018 by The Engineer — Leave a comment

Raspberry Pi 3 Model B+ Initial Tests & Benchmarks

Yesterday, the Raspberry Pi community got a nice surprise – a new Pi! This one has some improved features over the previous RPi 3 Model B:

Improved CPU – 64-Bit 1.4GHz Quad-Core BCM2837B0
Improved WiFi – Dual Band 802.11b/g/n/ac. This is now under a shield on the top of the board.
Improved Ethernet – The USB/Ethernet IC has been replaced with a LAN7515, supporting gigabit ethernet. The backhaul is still over USB2 though, so this would max out at about 300Mbit/s
PoE Support – There’s a new 4-pin header, and a matching HAT for power over ethernet support.

The USB/LAN Controller is now a BGA package, supporting gigabit ethernet. The USB connections are still USB2 though, limiting total bandwidth. This shouldn’t be much of an issue though, since anything over the 100Mbit connection we’ve had previously is an improvement.

The CPU now has a metal heatspreader on top of the die, no doubt to help with cooling under heavy loads. As far as I know, it’s still the same silicon under the hood though. The WiFi radio is under the shielding can to the top left, with the PCB trace antenna down the left edge of the board.

The power supplies are handled on this new Pi by the MaxLinear MxL7704, from what I can tell from MaxLinear’s page, it seems to be somewhat of a collaborative effort to find something that would do the best job, since they apparently worked with the Foundation to get this one right. This IC apparently includes four synchronous step-down buck regulators that provide system, memory, I/O and core power from 1.5A to 4A. An on-board 100mA LDO provides clean 1.5V to 3.6V power for analog sub-systems. This PMIC utilizes a conditional sequencing state machine that is flexible enough to meet the requirements of virtually any processor.

The bottom of the PCB has the Elpida 1GB RAM package, which is LPDDR2, along with the MicroSD slot.

A quick benchmark running Raspbian Lite & a SanDisk Ultra 32GB Class 10 SD card gives some nice results:

Raspberry Pi Benchmark Test
Author: AikonCWD
Version: 3.0

temp=45.1'C
arm_freq=1400
core_freq=400
sdram_freq=500
gpu_freq=300
sd_clock=50.000 MHz

Running InternetSpeed test...
Ping: 45.278 ms
Download: 151.50 Mbit/s
Upload: 9.52 Mbit/s

Running CPU test...
 total time: 11.3003s
 min: 4.48ms
 avg: 4.51ms
 max: 44.50ms
temp=56.4'C

Running THREADS test...
 total time: 10.2161s
 min: 3.94ms
 avg: 4.08ms
 max: 21.49ms
temp=59.6'C

Running MEMORY test...
Operations performed: 3145728 (2418384.67 ops/sec)
3072.00 MB transferred (2361.70 MB/sec)
 total time: 1.3008s
 min: 0.00ms
 avg: 0.00ms
 max: 9.99ms
temp=60.7'C

Running HDPARM test...
 Timing buffered disk reads:  66 MB in  3.01 seconds =  21.91 MB/sec
temp=51.5'C

Running DD WRITE test...
536870912 bytes (537 MB, 512 MiB) copied, 34.6011 s, 15.5 MB/s
temp=46.7'C

Running DD READ test...
536870912 bytes (537 MB, 512 MiB) copied, 23.5404 s, 22.8 MB/s
temp=45.6'C

AikonCWD's rpi-benchmark completed!

Posted on October 31, 2015 by The Engineer — 2 Comments

Cisco EA6700 / Linksys AC1750 Router

Since the boat was still running it’s internal network on 10/100M speeds, an upgrade was decided on, the internal WiFi signal strength was also pretty poor further than a few feet from the NOC.

The new router is a Cisco/Linksys AC1750 model, with gigabit networking, and full 802.11ac 2.4/5GHz Wireless. This router also has a built in media server, print server, USB3 & USB2.

Teardown time! Here’s the router with the cover removed. Most of the fun stuff is hidden under the shields, but these aren’t fully soldered down & the covers are removable. The 6 antennas can be seen spaced around the edge of the housing, the main CPU is under the large heatsink upper centre. The radio power amplifier stages are underneath the shields, while the main RF transceivers are just outside the shields.

Wireless N is provided by a Broadcom BCM4331, this provides full dual-band 3×3 802.11n support. Being 3×3 it is actually 3 separate transceivers in a single package, to get much higher throughput rates of 600Mbit/s.

Wireless AC is provided by it’s sister IC, the BCM4360, with throughput speeds of 1.3Gbit/s. Both of these transceiver ICs connect back to the main CPU via PCI Express.

To get increased range, there are a trio of Skyworks SE5003L +23dBm 5GHz power amplifier ICs under the shield, along with the TX/RX switching & antenna matching networks. Heatsinking for these is provided by a sink screwed to the bottom side of the PCB. The outputs to the antennas can be seen at the top of the image.

The 2.4GHz section is fitted with a trio of Skyworks SE2605L +23dBm 2.4GHz power amplifiers, with a similar heatsink arrangement under the board. Unlike the 5GHz section, the 2.4GHz antenna feeds are soldered to the PCB here instead of using connectors.

The main CPU is a BCM4708 Communications Processor from Broadcom, as for the other Broadcom chips in this router, very little information is available unless under NDA, but I do know it’s a dual core ARM Cortex A9 running at 1GHz, with built in 5-port gigabit ethernet switch.

Working RAM for the processor is a Hynix H5TQ2G63DFA 256MB part.

More to come on the installation of the new networking, with it’s associated 4G mobile gateway connection system.

73s for now!

Posted on September 10, 2015 by The Engineer — Leave a comment

Opticon OPN-2001 Barcode Scanner

Random teardown time!

The OPN-2001 is a very small handheld barcode data collection device, used for stock keeping, inventory, etc.

It’s powered by an internal Li-Poly cell, at 150mAh, and has storage for 1000 barcodes in it’s internal memory.

The unit is charged via it’s USB port, the data can also be downloaded using this interface.

Here’s the bottom of the unit with it’s label. Serial number removed to protect the guilty. 😉

Here the bottom cover has been removed from the scanner, showing the internals. The barcode engine is on the left, this contains all the hardware & logic for scanning & storing the barcode data. The Li-Poly cell is under the FFC cable wrapped in foam tape for protection.

Here’s the PCB & engine assembly removed from the casing. The lower PCB appears to just handle the user interface buttons, beeper & USB power & charging circuitry. All the processing logic is on the barcode engine itself.

Here’s the back of the support PCB, with the pair of buttons for scanning & deleting barcodes. Also on this board is a 32kHz clock crystal & a Ricoh RV5C386A RTC IC. This communicates with the main processor via I²C for storing the date & time with the barcodes. At the bottom right corner are some of the power supply passives.

Here’s the other side of the support PCB, with the beeper, battery connector & the switching regulator to provide the barcode engine with 3.3v power.

Here’s the barcode engine itself, which is absolutely tiny, at roughly 20mm square. The main processor & it’s associated Flash ROM are on this PCB. The main processor has an ARM7 32bit core, with 64kB of RAM, and onboard 512kB of ROM for program & barcode storage.

Here’s the business end of the barcode engine, the mirror vibrates at 100Hz to produce the scan line. The laser diode is rated at 1mW, 650nm. This is in the deep red range.

Posted on September 2, 2015 by The Engineer — Leave a comment

USB1100 Digital Message Unit

This is basically an industrial, rugged MP3 player, in an extruded aluminium case.
They are used in commercial settings for generating telephone hold music or continual playback of background music in shops.

It’s quite a compact unit, in a nice aluminium case, designed for mounting into a comms setup. This unit will play any MP3 file, up to a maximum size of 11MB.

Here’s the user connections on the end of the unit. The device takes a standard 12v DC input, and has a single button for setup, user feedback is given through the multi-colour LED next to the power jack.
Both 8Ω & 600Ω audio outputs are provided for maximum compatibility. Volume & tone controls are also here.
On the other end of the unit is a single USB port for loading the audio files from a USB drive, and a reset button.

Here’s the single PCB removed from the casing. Unfortunately the main CPU has had it’s part number sanded off, and I can’t be bothered to try & find out what kind of processor it is at this point. To the right of the CPU are some flash ROM & SDRAM, along with the single USB port at bottom right.
The left side of the board is dedicated to audio output & voltage regulation, there are a fair few linear regulators in this unit.

Here’s the audio output side of the board, the transformer on the left is to provide the 600Ω output, the audio amplifier IC (BA5416) is just behind it. To the right are some of the main voltage regulators, a 5v one on the heatsink & a LM317.

The audio codec is a CS4271 from Cirrus Logic, a really high quality part, 24-bit resolution, 192kHz Stereo codec. Considering this is for telephone & PA systems that aren’t that high fidelity, it’s well built!

Posted on October 1, 2013 by The Engineer — Leave a comment

Rio LAHS4 Salon Laser Hair Remover

Here is a home laser hair removal unit, a Rio LAHS4. Shown above is the system overview, with the laser wand & the user controls.

Main base unit popped open reveals the main PCB, with the central processor, a PIC16F628A.

Other side of the PCB is mainly populated with power supply & filtering for the logic sections.

Cracking open the laser wand reveals a stacked pair of PCBs, a main laser controller & the capacitive sensor PCB. This capacitive sensor connects to a pair of pins on the laser head & prevents operation if the unit is not held firmly against the skin.

Front of the laser diode module with the movable lens, on a pair of voice coil actuators. Very similar to the lens positioner used in any CD/DVD player pickup assembly.
The diode in this unit is an 808nm chip, with power in the 300-600mW range most likely.

Rear of the diode module, with the connections to the diode itself & the voice coil positioner for the lens.

Other side of the wand PCB, showing the capacitive sensor board on top of the main controller board. There is another CPU on the board here, which most likely communicates with the main processor in the base through a serial connection.

Posted on August 26, 2010 by The Engineer — Leave a comment

Motorola V360v

Here is a more modern phone, the Motorola V360v. Features include Dual screens, 640×480 VGA camera, full col

our TFT Main LCD, SD-Micro slot.
Here on the back the grey scale LCD can be seen, with the camera lens to the right of the Motorola logo

Here the phone is opened showing the keypad & the full colour TFT LCD display.

Here the battery is removed from the unit, showing the SIM connector. The antenna cover is still on at the bottom.

The antenna cover has been removed in this shot, the antenna is the white section at the bottom, With the loudspeaker & the external antenna connector hidden at the right.

Here is the main PCB. Parts from left are the Bluetooth module at the top, supplied by Broadcom, the SD Card socket at the bottom. Main CPU next to that is the Freescale SC29343VKP. Above right of the CPU is the Freescale SC13890P23A Charger, Power & Audio IC. Below is the SIM card socket. Under the main CPU is the Intel Flash memory IC. ICs inside the shields are the RF sections for transmit & receive.

Rear of the display unit showing the monochrome LCD. The camera module on the bottom left. Ear speaker on the far right of the unit.

Main colour TFT LCD.

Camera module removed from the LCD unit.

The vibration motor attached to one of the LCD looms.

Posted on August 25, 2010 by The Engineer — Leave a comment

Ericsson GA628

Here is a phone from the mid 90s, the Ericsson GA628. Here visible is the front of the unit with keypad, & single line monochrome LCD for number display.

Here the battery is removed from the phone, showing the SIM card socket. At the top under the antenna stub is the socket for an external antenna.

Here the front is removed from the phone, PCB on left, rear of keypad on right. Microphone is at bottom of keypad, with speaker at the top. Top right of the PCB is the ringer buzzer, left is shield for RF amplifier.

Here is the back of the main PCB, RF sections on left & centre. Processing & memory on right.

This phone had a Ni-Mh battery, before Li-Ion batteries were introduced.

The LCD from the front of the phone is shown here. A simple dot matrix single line unit.