Posted on Leave a comment

Test Equipment Upcycling – Variable Attenuator Module

A while back I found myself in the need of an adjustable RF attenuator capable of high-GHz operation. As luck would have it I had an old Spectrum analyser on the shelf at work, which we had retired quite some time ago.

Spectrum analysers being quite capable test instruments, I knew that the input attenuation would be done with a standalone module that we could recover for reuse without too much trouble.

The attenuator module

Here’s the module itself, with the factory drive PCB removed from the bottom, showing the solenoids that operate the RF switches. There are test wires attached to them here to work out which solenoid switches which attenuation stage. In the case of this module, there are switches for the following:

  • Input select switch
  • AC/DC coupling
  • -5dB
  • -10dB
  • -20dB
  • -40dB

For me this means I have up to -75dB attenuation in 5dB steps, with optional switchable A-B input & either AC or DC coupling.

Drive is easy, requiring a pulse on the solenoid coil to switch over, the polarity depending on which way the switch is going.

Building a Control Board

Now I’ve identified that the module was reusable, it was time to spin up a board to integrate all the features we needed:

  • Onboard battery power
  • Pushbutton operation
  • Indication of current attenuation level

The partially populated board is shown at right, with an Arduino microcontroller for main control, 18650 battery socket on the right, and control buttons in the centre. The OLED display module for showing the current attenuation level & battery voltage level is missing at the moment, but it’s clear where this goes.

As there weren’t enough GPIO pins for everything on the Arduino, a Microchip MC23017 16-Bit I/O expander, which is controlled via an I²C bus. This is convenient since I’m already using I²C for the onboard display.

Driving the Solenoids

A closer view of the board shows the trip of dual H-Bridge drivers on the board, which will soon be hidden underneath the attenuator block. These are LB1836M parts from ON Semiconductor. Each chip drives a pair of solenoids.

Power Supplies

The bottom of the board has all the power control circuitry, which are modularised for ease of production. There’s a Lithium charge & protection module for the 18650 onboard cell, along with a boost converter to give the ~9v rail required to operate the attenuator solenoids. While they would switch at 5v, the results were not reliable.

Finishing off

A bit more time later, some suitable firmware has been written for the Arduino, and the attenuator block is fitted onto the PCB. The onboard OLED nicely shows the current attenuation level, battery level & which input is selected.

Posted on 3 Comments

Vodafone Mobile WiFi R207 Teardown

Vodafone Mobile WiFi R207
Vodafone Mobile WiFi R207

Here’s one of the old modems from my spares bin, a Vodafone Mobile WiFi R207. This is just a rebranded Huawei E5330. This unit includes a 3G modem, and a WiFi chipset, running firmware that makes this a mini-router, with NAT.


The back has the batter compartment & the SIM slot, with a large label showing all the important details.

Cover Removed
Cover Removed

A couple of small Torx screws later & the shell splits in half. All the electronics are covered by shields here, but luckily they are the clip-on type, and aren’t soldered direct to the PCB.


Once the shield has been removed, the main chipset is visible underneath. There’s a large Spansion MS01G200BHI00 1GBit flash, which is holding the firmware. Next to that is the Hi6758M baseband processor. This has all the hardware required to implement a 3G modem. Just to the right is a Hi6521 power management IC, which is dealing with all the power supplies needed by the CPU.
The RF section is above the baseband processor, some of which is hiding under the bits of the shield that aren’t removable.

SIM Socket
SIM Socket

There’s a socket onboard for a standard Mini-SIM, just to the left of that is a Hi6561 4-phase buck converter. I would imagine this is providing the power supplies for the RF section & amplifier.

Unpopulated Parts
Unpopulated Parts

Not sure what this section is for, all the parts are unpopulated. Maybe a bluetooth option?

PCB Reverse
PCB Reverse

The other side of the PCB is pretty sparse, holding just the indicator LEDS, button & the WiFi Chipset.

Realtek WiFi Chipset
Realtek WiFi Chipset

The chipset here is a Realtek part, but it’s number is hidden by some of the shield. The antenna connection is routed to the edge of the board, where a spring terminal on the plastic case mounted antenna makes contact.

Posted on Leave a comment

IC Decap – MaxLinear MXL261 DOCSIS3 Tuner / Demodulator

Time for more silicon pr0n! When Virgin Media supplied me with a new modem, they requested I “recycle” the old one, so naturally it got gutted for the component parts. This particular IC is the frontend of the RF tuner. Unfortunately no datasheet is available, but I did manage to find some info in a press release. The sections are clearly identifiable, the RF section is on the left, while the rest of the demodulating logic is hidden on the right under a metal layer.

MXL261 Die
MXL261 Die – Click to Embiggen!

The MxL261 is based on MaxLinear’s low-power, digital CMOS process RF and mixed-signal technology.  It is a single-die, global standards, digital cable front end with integrated splitter, two 100MHz wideband tuners, four QAM demodulators and a four-channel-wide IF output.