shield – Experimental Engineering

Posted on June 1, 2018April 29, 2018 by The Engineer — 5 Comments

Vodafone Mobile WiFi R207 Teardown

Here’s one of the old modems from my spares bin, a Vodafone Mobile WiFi R207. This is just a rebranded Huawei E5330. This unit includes a 3G modem, and a WiFi chipset, running firmware that makes this a mini-router, with NAT.

The back has the batter compartment & the SIM slot, with a large label showing all the important details.

A couple of small Torx screws later & the shell splits in half. All the electronics are covered by shields here, but luckily they are the clip-on type, and aren’t soldered direct to the PCB.

Once the shield has been removed, the main chipset is visible underneath. There’s a large Spansion MS01G200BHI00 1GBit flash, which is holding the firmware. Next to that is the Hi6758M baseband processor. This has all the hardware required to implement a 3G modem. Just to the right is a Hi6521 power management IC, which is dealing with all the power supplies needed by the CPU.
The RF section is above the baseband processor, some of which is hiding under the bits of the shield that aren’t removable.

There’s a socket onboard for a standard Mini-SIM, just to the left of that is a Hi6561 4-phase buck converter. I would imagine this is providing the power supplies for the RF section & amplifier.

Not sure what this section is for, all the parts are unpopulated. Maybe a bluetooth option?

The other side of the PCB is pretty sparse, holding just the indicator LEDS, button & the WiFi Chipset.

The chipset here is a Realtek part, but it’s number is hidden by some of the shield. The antenna connection is routed to the edge of the board, where a spring terminal on the plastic case mounted antenna makes contact.

Posted on March 15, 2018March 15, 2018 by The Engineer — Leave a comment

Raspberry Pi 3 Model B+ Initial Tests & Benchmarks

Yesterday, the Raspberry Pi community got a nice surprise – a new Pi! This one has some improved features over the previous RPi 3 Model B:

Improved CPU – 64-Bit 1.4GHz Quad-Core BCM2837B0
Improved WiFi – Dual Band 802.11b/g/n/ac. This is now under a shield on the top of the board.
Improved Ethernet – The USB/Ethernet IC has been replaced with a LAN7515, supporting gigabit ethernet. The backhaul is still over USB2 though, so this would max out at about 300Mbit/s
PoE Support – There’s a new 4-pin header, and a matching HAT for power over ethernet support.

The USB/LAN Controller is now a BGA package, supporting gigabit ethernet. The USB connections are still USB2 though, limiting total bandwidth. This shouldn’t be much of an issue though, since anything over the 100Mbit connection we’ve had previously is an improvement.

The CPU now has a metal heatspreader on top of the die, no doubt to help with cooling under heavy loads. As far as I know, it’s still the same silicon under the hood though. The WiFi radio is under the shielding can to the top left, with the PCB trace antenna down the left edge of the board.

The power supplies are handled on this new Pi by the MaxLinear MxL7704, from what I can tell from MaxLinear’s page, it seems to be somewhat of a collaborative effort to find something that would do the best job, since they apparently worked with the Foundation to get this one right. This IC apparently includes four synchronous step-down buck regulators that provide system, memory, I/O and core power from 1.5A to 4A. An on-board 100mA LDO provides clean 1.5V to 3.6V power for analog sub-systems. This PMIC utilizes a conditional sequencing state machine that is flexible enough to meet the requirements of virtually any processor.

The bottom of the PCB has the Elpida 1GB RAM package, which is LPDDR2, along with the MicroSD slot.

A quick benchmark running Raspbian Lite & a SanDisk Ultra 32GB Class 10 SD card gives some nice results:

Raspberry Pi Benchmark Test
Author: AikonCWD
Version: 3.0

temp=45.1'C
arm_freq=1400
core_freq=400
sdram_freq=500
gpu_freq=300
sd_clock=50.000 MHz

Running InternetSpeed test...
Ping: 45.278 ms
Download: 151.50 Mbit/s
Upload: 9.52 Mbit/s

Running CPU test...
 total time: 11.3003s
 min: 4.48ms
 avg: 4.51ms
 max: 44.50ms
temp=56.4'C

Running THREADS test...
 total time: 10.2161s
 min: 3.94ms
 avg: 4.08ms
 max: 21.49ms
temp=59.6'C

Running MEMORY test...
Operations performed: 3145728 (2418384.67 ops/sec)
3072.00 MB transferred (2361.70 MB/sec)
 total time: 1.3008s
 min: 0.00ms
 avg: 0.00ms
 max: 9.99ms
temp=60.7'C

Running HDPARM test...
 Timing buffered disk reads:  66 MB in  3.01 seconds =  21.91 MB/sec
temp=51.5'C

Running DD WRITE test...
536870912 bytes (537 MB, 512 MiB) copied, 34.6011 s, 15.5 MB/s
temp=46.7'C

Running DD READ test...
536870912 bytes (537 MB, 512 MiB) copied, 23.5404 s, 22.8 MB/s
temp=45.6'C

AikonCWD's rpi-benchmark completed!

Posted on August 6, 2016August 1, 2016 by The Engineer — Leave a comment

Motorola Cordless DECT Phone Teardown

Another random teardown from the junk box time!
Here’s an old Motorola DECT landline phone, no use to me as I’ve not used a landline for many years.

Not much on the back, other than the battery compartment for a pair of AAA rechargables. The base unit contains the charger.

Here’s the main PCB removed from it’s casing. There’s not really much going on, one of the main ICs, which is probably a microcontroller, is a COB device, so no part numbers from there. There’s a row of pads for programming the device at the factory. The RF section is on a dedicated IC, a DE19RF19ZCNC from DSP Group. I couldn’t find much on this part, but it’s one of a range of DECT/VoIP DSP devices.

Inside the base unit is a similar board, just without the keypad. Main microcontroller is again a COB device, the RF IC is under the shield.

Removing the shield reveals the same IC as in the handset, only this PCB has a pair of antennas.

Posted on November 2, 2015November 2, 2015 by The Engineer — Leave a comment

Alpha Networks WMP-N06SA MiniPCI Wireless N Card

Here’s a quick look at one of the now surplus cards from my old networking system, a MiniPCI Wireless interface card.

This is an older generation card, one of the first with Wireless N support on 2.4GHz.

Network PHY & firmware EEPROM. Power supply stuff is over to the left.

Inside the shield is the RF Transceiver IC & it’s associated RF power amplifier ICs for each antenna. These power amplifiers are LX5511 types from Microsemi, with a maximum power output of +26dBm.

Posted on October 31, 2015 by The Engineer — 2 Comments

Cisco EA6700 / Linksys AC1750 Router

Since the boat was still running it’s internal network on 10/100M speeds, an upgrade was decided on, the internal WiFi signal strength was also pretty poor further than a few feet from the NOC.

The new router is a Cisco/Linksys AC1750 model, with gigabit networking, and full 802.11ac 2.4/5GHz Wireless. This router also has a built in media server, print server, USB3 & USB2.

Teardown time! Here’s the router with the cover removed. Most of the fun stuff is hidden under the shields, but these aren’t fully soldered down & the covers are removable. The 6 antennas can be seen spaced around the edge of the housing, the main CPU is under the large heatsink upper centre. The radio power amplifier stages are underneath the shields, while the main RF transceivers are just outside the shields.

Wireless N is provided by a Broadcom BCM4331, this provides full dual-band 3×3 802.11n support. Being 3×3 it is actually 3 separate transceivers in a single package, to get much higher throughput rates of 600Mbit/s.

Wireless AC is provided by it’s sister IC, the BCM4360, with throughput speeds of 1.3Gbit/s. Both of these transceiver ICs connect back to the main CPU via PCI Express.

To get increased range, there are a trio of Skyworks SE5003L +23dBm 5GHz power amplifier ICs under the shield, along with the TX/RX switching & antenna matching networks. Heatsinking for these is provided by a sink screwed to the bottom side of the PCB. The outputs to the antennas can be seen at the top of the image.

The 2.4GHz section is fitted with a trio of Skyworks SE2605L +23dBm 2.4GHz power amplifiers, with a similar heatsink arrangement under the board. Unlike the 5GHz section, the 2.4GHz antenna feeds are soldered to the PCB here instead of using connectors.

The main CPU is a BCM4708 Communications Processor from Broadcom, as for the other Broadcom chips in this router, very little information is available unless under NDA, but I do know it’s a dual core ARM Cortex A9 running at 1GHz, with built in 5-port gigabit ethernet switch.

Working RAM for the processor is a Hynix H5TQ2G63DFA 256MB part.

More to come on the installation of the new networking, with it’s associated 4G mobile gateway connection system.

73s for now!

Posted on July 31, 2015 by The Engineer — Leave a comment

Lethal Chinese Mains Adaptors

With every piece of Chinese electronics I obtain, mainly Baofeng radios, they come with a Europlug-type power adaptor, and a universal plug adaptor for the mains.

The charger units aren’t too bad, there’s a fair amount of isolation between the primary & secondary, and even though they’re very simple & cheap, I can’t see any immediate safety problems with them.

The plug adaptors, however, are a different matter. These things are utterly lethal!

Here’s the inside of the PSU. It’s just a very simple SMPS, giving an output of 10v 500mA. The fuse is actually a fusible resistor.

Here’s the back of the PCB with the SMPS control IC. I can’t find any English datasheets for this part unfortunately.

Here’s the dangerous adaptor. There’s no safety shield, so the live parts are exposed.

Here’s the adaptor split apart. The output contacts are on the left, and rely just on pressure to make contact with the brass screws on the mains input pins to provide power.
This is a very poor way to get a connection, a dirty or worn contact here would create a lot of heat if any significant power is pulled through, and could quite possibly result in a fire.

Not surprisingly, I bin these things as soon as I open the box, and charge all my radios with a 12v charging system.

Posted on July 22, 2015July 28, 2015 by The Engineer — 1 Comment

Aritech VV602 Vault Vibration Sensor

Here’s a rather unique device for protecting safes & vaults from attack by thefts.

It’s an Aritech VV602 seismic detector, based on piezoelectric sensors. Not surprisingly, this unit is covered in tamper sensors as well. There are several different sensor types in use:

Piezoelectric vibration sensing
Thermal sensing
Magnetic sensing
Manual Tamper Switches

Above is the main unit, with the thermal sensor. This is just a thermal fuse, very commonly used in everything from room heaters to hairdryers. This one triggers at 84°C. The adjustment pot is also visible here.

Above is the magnetic mounting plate used to attach the device to the safe. These units are apparently mounted over the keyhole of the safe to protect the lock, so they need to be easily removable to access the safe. This is a very strong magnet & it isn’t possible to pull it from a metal object without triggering the sensor.

Above is the piezo vibration sensor, bonded to the backplate. When the unit receives vibration or shock, this transducer generates a voltage, which is fed to the control logic below.

Here’s the reverse of the main PCB with the control logic ICs. These are basic logic gates, with a couple of comparators. One of the tamper switches is in the bottom left corner.

Main PCB with the connection terminals. Another tamper switch is in the top left corner, the solid-state relay is under the shield, next to the magnetic tamper switch. (Reed switch).
Some adjustment is provided for sensitivity. I’ve not found much of a difference in sensitivity though when it’s set to different levels.

Magnetic reed switch tamper on the right. Main output solid-state relay on the left under the shield.

This unit was given to me after it apparently went faulty. But on applying power it seems to work fine. Must be those experts again 😉

Posted on July 14, 2012July 14, 2012 by The Engineer — 1 Comment

MicroVision ShowWX+ HDMI Laser Pico Projector

Here’s the teardown of the projector itself! On the right is the info label from the projector, which covers the flex ribbon to the VGA/composite input board below.

This unit is held together with Allen screws, but is easy to get apart.

Here’s the insides of the projector, with just the top cover removed. The main board can be seen under the shielding can, the Micro HDMI connector is on the left & the MicroUSB connection is on the right. The USB connection is solely for charging the battery & provides no data interface to the unit.

On top of the main board is the shield can covering the PicoP Display Engine driver board, this shield was soldered on so no peek inside unfortunately!

The laser module itself is in the front of the unit, the laser assemblies are closest to the camera, on the left is the Direct Doubled Green module, in the centre is the blue diode, and the red diode on the right. Inside the module itself is an arrangement of mirrors & beamsplitters, used to combine the RGB beams from the lasers into a single beam to create any colour in the spectrum.

Here is the module innards revealed, the laser mounts are at the top of the screen, the green module is still mounted on the base casting.
The three dichroic mirrors in the frame do the beam combining, which is then bounced onto the mirror on the far left of the frame, down below the MEMs. From there a final mirror directs the light onto the MEMs scanning mirror before it leaves through the output window.

A trio of photodiodes caters for beam brightness control & colour control, these are located behind the last dichroic turning mirror in the centre of the picture.

This is inside the green laser module, showing the complexity of the device. This laser module is about the size of a UK 5p coin!

And here on the left is the module components labelled.

Here is the main PCB, with the unit’s main ARM CPU on the right, manufactured by ST.

User buttons are along the sides.

Other side of the main board, with ICs that handle video input from the HDMI connector, battery charging via the USB port & various other management.

Posted on July 8, 2012 by The Engineer — Leave a comment

Cisco 2G Fibre Channel SFP Module

2G Fibre Tranciever — 2G Fibre Transceiver

Here is a 2Gbit Fibre Channel transceiver from Cisco Systems in SFP module format.

Here the shield has been removed from the bottom of the module (it just clips off). The bottom of the PCB can be seen, with the copper interface on the left & the rubber boots over the photodiode & 850 nm laser on the right.

Here the PCB has been completely removed from the frame, the fibre ends slide into the rubber tubes on the right.

Top of the PCB, showing the chipset. There are a pair of adjustment pots under some glue, next to the chipset, presumably for adjusting laser power & receive sensitivity. The laser diode & photodiode are inside the soldered cans on the right hand side of the board, with the optics required to couple the 850nm near-IR light into the fibre.

Posted on February 26, 2011February 10, 2011 by The Engineer — 1 Comment

Combo Microwave

Here are the internals of a cheap Microwave/Convection Oven combo. Electronics bay is pretty much the same as a standard microwave, with the magnetron, transformer & diode/capacitor voltage doubler, with the addition of an extra fan & a pair of nichrome elements to provide the convection oven function.

Convection blower which keeps the cooking vapours & smoke away from the elements, & circulates the hot air around the cooking chamber. This is a 12v DC centrifugal type blower.

The elements are inside this steel shield, air duct extends from the centre.

This oven has a pair of thermal switches on the magnetron.

The usual capacitor/diode voltage doubler in the magnetron power supply. The transformer is visible to the left.

Electronic controller PCB. This has a pair of relays that switch the elements & the magnetron transformer.

Posted on February 24, 2011February 10, 2011 by The Engineer — Leave a comment

PCMCIA Ethernet Card

An old Xircom Ethernet card for a laptop. This uses the old 50 pin PCMCIA interface.

Rear of the card with the MAC address & card spec details.

PCB removed from the outer shield. Xircom ethernet chipset centre. Special socket on the right fits a RJ-45 adaptor lead.

Posted on February 20, 2011February 10, 2011 by The Engineer — Leave a comment

Garmin eTrex

Pocket sized GPS navigator. Here is shown the greyscale dot matrix LCD.

Serial interface on the back of the unit. Pinout from left is +3v, Rx, Tx, GND.

PCB Removed from the casing. RTC backup battery in the centre of board, CPU & flash ROM on the left. GPS chipset is under the shield on the right.

Front of the PCB, GPS antenna on the right, LCD panel left.

LCD folded back from the PCB. Driver IC can be seen attached to the ribbon.

LCD Panel backlight. Requires 200v AC at 20kHz to glow green.

GPS chipset with the shield removed.

Posted on August 26, 2010 by The Engineer — Leave a comment

Nokia 7110

Another phone from the mid 90s. This is the nokia 7110.

Here the slider is open showing the keypad.

Here the battery is removed, a Li-Ion unit.

The battery cell & protection circuit removed from the casing.

This is the rear of the PCB removed from the housing. Data & charging ports on the right hand side f the board.

Front of the PCB with the RF sections at the left hand side & the keypad contacts on the right.

Closeup of the RF sections of the board, big silver rectangular cans are VCO units.

Closeup of the top rear section of the PCB, with SIM cnnector, battery contacts, IR tranciever at the far left. Bottom centre is the external antenna connector.

The logic section of the board, Large chip is CPU, to right of that is the ROM storing the machine code. Other chips are unknown custom parts.

The Mic & the loudspeaker removed from it’s housing.

LCD from the front of the unit, SPI interfaced. Flex PCB also contains the power button, loudspeaker contacts & a temperature sensor.

The scroll wheel removed from the front housing.

Tiny vibration motor removed from the rear housing, alerts the user to a text or phone call.

Posted on August 25, 2010 by The Engineer — Leave a comment

Ericsson GA628

Here is a phone from the mid 90s, the Ericsson GA628. Here visible is the front of the unit with keypad, & single line monochrome LCD for number display.

Here the battery is removed from the phone, showing the SIM card socket. At the top under the antenna stub is the socket for an external antenna.

Here the front is removed from the phone, PCB on left, rear of keypad on right. Microphone is at bottom of keypad, with speaker at the top. Top right of the PCB is the ringer buzzer, left is shield for RF amplifier.

Here is the back of the main PCB, RF sections on left & centre. Processing & memory on right.

This phone had a Ni-Mh battery, before Li-Ion batteries were introduced.

The LCD from the front of the phone is shown here. A simple dot matrix single line unit.