Posted on 8 Comments

Virgin Media Superhub 2 Teardown

I recently got the latest upgrade from Virgin Media, 200Mbit DL / 20Mbit UL, and to get this I was informed I’d have to buy their latest hardware, since my existing CPE wouldn’t be able to handle the extra 5Mbit/s upload speed. (My bullshit detector went off pretty hard at that point, as the SuperHub 2 hardware is definitely capable of working fine with 20Mbit/s upload rates). Instead of having to return the old router, I was asked to simply recycle it, so of course the recycling gets done in my pretty unique way!

Mainboard
Mainboard

The casing of these units is held together by a single screw & a metric fuckton of plastic clips, disassembly is somewhat hindered by the radio antennas being positioned all over both sides of the casing. Once the side is off, the mainboard is visible. The DOCSIS frontend is lower left, centre is the Intel PUMA 5 Cable Modem SoC with it’s RAM just to the lower right. The right side of the board is taken up by both of the WiFi radio frontends, the 5GHz band being covered by a Mini PCIe card.

Atheros Gigabit Switch
Atheros Gigabit Switch

The 4 gigabit Ethernet ports on the back are serviced by an Atheros AR8327 Managed Layer 3 switch IC, which seems to be a pretty powerful device:

The AR8327 is the latest in high performance small network switching. It is ultra low power, has extensive routing and data management functions and includes hardware NAT functionality (AR8327N). The AR8327/AR8327N is a highly integrated seven-port Gigabit Ethernet switch with a fully non-blocking switch fabric, a high-performance lookup unit supporting 2048 MAC addresses, and a four-traffic  class Quality of Service (QoS) engine. The AR8327 has the flexibility to support various networking applications. The AR8327/AR8327N is designed for cost-sensitive switch applications in wireless AP routers, home gateways, and xDSL/cable modem platforms.

Unfortunately most of the features of this router are locked out by VM’s extremely restrictive firmware. With any of their devices, sticking the VM supplied unit into modem mode & using a proper router after is definitely advised!

Intel Puma 5 CM CPU
Intel Puma 5 CM CPU

The cable modem side of things is taken care of by the Intel PUMA 5 DNCE2530GU SoC. This appears to communicate with the rest of the system via the Ethernet switch & PCI Express for the 5GHz radio.

Atheros WiFi SoC
Atheros WiFi SoC

The 2.4GHz radio functionality is supplied by an Atheros AR9344 SoC, it’s RAM is to the left. This is probably handling all the router functions of this unit, but I can’t be certain.

Atheros LAN PHY
Atheros LAN PHY

A separate Ethernet PHY is located between the SoC & the switch IC.

 

5GHz Radio Card
5GHz Radio Card

The 5GHz band is served by a totally separate radio module, in Mini PCIe format, although it’s a bit wider than standard. This module will probably be kept for reuse in another application.

Power Supplies
Power Supplies

All down the edge of the board are the multiple DC-DC converters to generate the required voltage rails.

MaxLinear MXL261 Frontend
MaxLinear MXL261 Frontend

The DOCSIS frontend is handled by a MaxLinar MXL261 Tuner/Demodulator. More on this IC in my decapping post 🙂

The Unknown One
The Unknown One

I’ve honestly no idea what on earth this Maxim component is doing. It’s clearly connected via an impedance matched pair, and that track above the IC looks like an antenna, but nothing I search for brings up a workable part number.

2.4GHz Frontend
2.4GHz Frontend

The RF switching & TX amplifiers are under a shield, these PA chips are SiGe parts.

Atheros 5GHz Radio
Atheros 5GHz Radio

Pretty much the same for the 5GHz radio, but with 3 radio channels.

Posted on Leave a comment

eBay Flyback High Voltage PSU

Flyback PSU
Flyback PSU

I have found myself needing some more in the way of High Voltage supplies of late, with the acquisition of the new He-Ne laser tubes, so I went trawling eBay for something that would be suitable to run these tubes. (I currently only have a single He-Ne laser PSU brick, and they’re notoriously hard to find & rather expensive).
This supply is rated at 1kV-10kV output, at 35W power level. Unfortunately this supply isn’t capable of sustaining the discharge in a large He-Ne tube, the impedance of the supply is far too high. Still, it’s useful for other experiments.
The flyback-type transformer clearly isn’t a surplus device from CRT manufacture, as there are very few pins on the bottom, and none of them connect to the primary side. The primary is separately wound on the open leg of the ferrite core.

Drive Electronics
Drive Electronics

The drive electronics are pretty simple, there’s a controller IC (with the number scrubbed off – guessing it’s either a 556 dual timer or a SMPS controller), a pair of FDP8N50NZ MOSFETs driving the centre-tapped primary winding.
The drive MOSFETs aren’t anything special in this case: they’re rated at 500v 8A, 850mΩ on resistance. This high resistance does make them get rather hot even with no load on the output, so for high power use forced-air cooling from a fan would definitely be required.

Test Setup
Test Setup

Here’s the supply on test, I’ve got the scope probes connected to the gate resistors of the drive MOSFETs.

Waveforms
Waveforms

On the scope the primary switching waveforms can be seen. The FETs operate in push-pull mode, there’s a bit of a ring on the waveform, but they’re pretty nice square waves otherwise.

Arc
Arc

At maximum power on 12v input, about 25mm of gap is possible with an arc.

Posted on Leave a comment

Wouxun KG-UV950P RF Connector Replacement

In my original review, I noted that this radio was supplied with a SO-259 socket for the antenna connection.
However I’m less than fond of these, due to their non-constant impedance, which can cause signal loss issues at VHF/UHF. Because of this, I’ve replaced it with a high quality N-type connector. These connectors are much better, as they are a constant 50Ω impedance, they’re weather resistant, and being rated to 11GHz, are more than sufficient for a radio that will only do up to 70cm.

RF Output Jack
RF Output Jack

Here can be seen the point where the connection is made to the PCB.
I’ve already replaced the socket in this photo. The pair of solder pads either side of the central RF point were soldered to wings on the back of the original SO-259. As there are a pair of screws, also connected to the ground plane, there have been no signal issues with just using the frame of the radio as the ground point. Shown below is the original socket, with the ground wings.

Original SO-259
Original SO-259

Finally, here is the back of the radio with it’s shiny new N connector.

New Connection
New Connection

Chassis mount connectors are pretty standard, so this new connector fits perfectly into the same recess of the original. Looks like factory fitted!

I am now standardising on N connectors for everything in my radio shack, next on the project list for conversion is the SWR meter I recently acquired.

Stay tuned for more!