Posted on 5 Comments

Vodafone Mobile WiFi R207 Teardown

Vodafone Mobile WiFi R207
Vodafone Mobile WiFi R207

Here’s one of the old modems from my spares bin, a Vodafone Mobile WiFi R207. This is just a rebranded Huawei E5330. This unit includes a 3G modem, and a WiFi chipset, running firmware that makes this a mini-router, with NAT.

Specs
Specs

The back has the batter compartment & the SIM slot, with a large label showing all the important details.

Cover Removed
Cover Removed

A couple of small Torx screws later & the shell splits in half. All the electronics are covered by shields here, but luckily they are the clip-on type, and aren’t soldered direct to the PCB.

Chipset
Chipset

Once the shield has been removed, the main chipset is visible underneath. There’s a large Spansion MS01G200BHI00 1GBit flash, which is holding the firmware. Next to that is the Hi6758M baseband processor. This has all the hardware required to implement a 3G modem. Just to the right is a Hi6521 power management IC, which is dealing with all the power supplies needed by the CPU.
The RF section is above the baseband processor, some of which is hiding under the bits of the shield that aren’t removable.

SIM Socket
SIM Socket

There’s a socket onboard for a standard Mini-SIM, just to the left of that is a Hi6561 4-phase buck converter. I would imagine this is providing the power supplies for the RF section & amplifier.

Unpopulated Parts
Unpopulated Parts

Not sure what this section is for, all the parts are unpopulated. Maybe a bluetooth option?

PCB Reverse
PCB Reverse

The other side of the PCB is pretty sparse, holding just the indicator LEDS, button & the WiFi Chipset.

Realtek WiFi Chipset
Realtek WiFi Chipset

The chipset here is a Realtek part, but it’s number is hidden by some of the shield. The antenna connection is routed to the edge of the board, where a spring terminal on the plastic case mounted antenna makes contact.

Posted on Leave a comment

Raspberry Pi 3 Model B+ Initial Tests & Benchmarks

Raspberry Pi 3 Model B+
Raspberry Pi 3 Model B+

Yesterday, the Raspberry Pi community got a nice surprise – a new Pi! This one has some improved features over the previous RPi 3 Model B:

  • Improved CPU – 64-Bit 1.4GHz Quad-Core BCM2837B0
  • Improved WiFi – Dual Band 802.11b/g/n/ac. This is now under a shield on the top of the board.
  • Improved Ethernet – The USB/Ethernet IC has been replaced with a LAN7515, supporting gigabit ethernet. The backhaul is still over USB2 though, so this would max out at about 300Mbit/s
  • PoE Support – There’s a new 4-pin header, and a matching HAT for power over ethernet support.
Chipset
Chipset

The USB/LAN Controller is now a BGA package, supporting gigabit ethernet. The USB connections are still USB2 though, limiting total bandwidth. This shouldn’t be much of an issue though, since anything over the 100Mbit connection we’ve had previously is an improvement.

CPU & Radio
CPU & Radio

The CPU now has a metal heatspreader on top of the die, no doubt to help with cooling under heavy loads. As far as I know, it’s still the same silicon under the hood though. The WiFi radio is under the shielding can to the top left, with the PCB trace antenna down the left edge of the board.

Power Controller
Power Controller

The power supplies are handled on this new Pi by the MaxLinear MxL7704, from what I can tell from MaxLinear’s page, it seems to be somewhat of a collaborative effort to find something that would do the best job, since they apparently worked with the Foundation to get this one right. This IC apparently includes four synchronous step-down buck regulators that provide system, memory, I/O and core power from 1.5A to 4A. An on-board 100mA LDO provides clean 1.5V to 3.6V power for analog sub-systems. This PMIC utilizes a conditional sequencing state machine that is flexible enough to meet the requirements of virtually any processor.

PCB Bottom
PCB Bottom

The bottom of the PCB has the Elpida 1GB RAM package, which is LPDDR2, along with the MicroSD slot.

A quick benchmark running Raspbian Lite & a SanDisk Ultra 32GB Class 10 SD card gives some nice results:

Posted on Leave a comment

Motorola Cordless DECT Phone Teardown

Motorola DECT Phone
Motorola DECT Phone

Another random teardown from the junk box time!
Here’s an old Motorola DECT landline phone, no use to me as I’ve not used a landline for many years.

Battery Compartment
Battery Compartment

Not much on the back, other than the battery compartment for a pair of AAA rechargables. The base unit contains the charger.

Main PCB
Main PCB

Here’s the main PCB removed from it’s casing. There’s not really much going on, one of the main ICs, which is probably a microcontroller, is a COB device, so no part numbers from there. There’s a row of pads for programming the device at the factory. The RF section is on a dedicated IC, a DE19RF19ZCNC from DSP Group. I couldn’t find much on this part, but it’s one of a range of DECT/VoIP DSP devices.

 

Base Unit PCB
Base Unit PCB

Inside the base unit is a similar board, just without the keypad. Main microcontroller is again a COB device, the RF IC is under the shield.

Main Chipset
Main Chipset

Removing the shield reveals the same IC as in the handset, only this PCB has a pair of antennas.

Posted on Leave a comment

Alpha Networks WMP-N06SA MiniPCI Wireless N Card

Here’s a quick look at one of the now surplus cards from my old networking system, a MiniPCI Wireless interface card.

Card Overview
Card Overview

This is an older generation card, one of the first with Wireless N support on 2.4GHz.

PCI Chipset
PCI Chipset

Network PHY & firmware EEPROM. Power supply stuff is over to the left.

RF Transceiver
RF Transceiver

Inside the shield is the RF Transceiver IC & it’s associated RF power amplifier ICs for each antenna. These power amplifiers are LX5511 types from Microsemi, with a maximum power output of +26dBm.

Posted on 2 Comments

Cisco EA6700 / Linksys AC1750 Router

Cisco EA6700
Cisco EA6700

Since the boat was still running it’s internal network on 10/100M speeds, an upgrade was decided on, the internal WiFi signal strength was also pretty poor further than a few feet from the NOC.

The new router is a Cisco/Linksys AC1750 model, with gigabit networking, and full 802.11ac 2.4/5GHz Wireless. This router also has a built in media server, print server, USB3 & USB2.

PCB Overview
PCB Overview

Teardown time! Here’s the router with the cover removed. Most of the fun stuff is hidden under the shields, but these aren’t fully soldered down & the covers are removable. The 6 antennas can be seen spaced around the edge of the housing, the main CPU is under the large heatsink upper centre. The radio power amplifier stages are underneath the shields, while the main RF transceivers are just outside the shields.

2.4GHz Transceiver
2.4GHz Transceiver

Wireless N is provided by a Broadcom BCM4331, this provides full dual-band 3×3 802.11n support. Being 3×3 it is actually 3 separate transceivers in a single package, to get much higher throughput rates of 600Mbit/s.

5GHz Transceiver
5GHz Transceiver

Wireless AC is provided by it’s sister IC, the BCM4360, with throughput speeds of 1.3Gbit/s. Both of these transceiver ICs connect back to the main CPU via PCI Express.

5GHz Power Amplifiers
5GHz Power Amplifiers

To get increased range, there are a trio of Skyworks SE5003L +23dBm 5GHz power amplifier ICs under the shield, along with the TX/RX switching & antenna matching networks. Heatsinking for these is provided by a sink screwed to the bottom side of the PCB. The outputs to the antennas can be seen at the top of the image.

2.4GHz Power Amplifiers
2.4GHz Power Amplifiers

The 2.4GHz section is fitted with a trio of Skyworks SE2605L +23dBm 2.4GHz power amplifiers, with a similar heatsink arrangement under the board. Unlike the 5GHz section, the 2.4GHz antenna feeds are soldered to the PCB here instead of using connectors.

Main CPU
Main CPU

The main CPU is a BCM4708 Communications Processor from Broadcom, as for the other Broadcom chips in this router, very little information is available unless under NDA, but I do know it’s a dual core ARM Cortex A9 running at 1GHz, with built in 5-port gigabit ethernet switch.

CPU RAM
CPU RAM

Working RAM for the processor is a Hynix H5TQ2G63DFA 256MB part.

More to come on the installation of the new networking, with it’s associated 4G mobile gateway connection system.

73s for now!

Posted on Leave a comment

Lethal Chinese Mains Adaptors

With every piece of Chinese electronics I obtain, mainly Baofeng radios, they come with a Europlug-type power adaptor, and a universal plug adaptor for the mains.

The charger units aren’t too bad, there’s a fair amount of isolation between the primary & secondary, and even though they’re very simple & cheap, I can’t see any immediate safety problems with them.

The plug adaptors, however, are a different matter. These things are utterly lethal!

Baofeng PSU
Baofeng PSU

Here’s the inside of the PSU. It’s just a very simple SMPS, giving an output of 10v 500mA. The fuse is actually a fusible resistor.

PCB Reverse
PCB Reverse

Here’s the back of the PCB with the SMPS control IC. I can’t find any English datasheets for this part unfortunately.

Universal Travel Adaptor
Universal Travel Adaptor

Here’s the dangerous adaptor. There’s no safety shield, so the live parts are exposed.

Internals
Internals

Here’s the adaptor split apart. The output contacts are on the left, and rely just on pressure to make contact with the brass screws on the mains input pins to provide power.
This is a very poor way to get a connection, a dirty or worn contact here would create a lot of heat if any significant power is pulled through, and could quite possibly result in a fire.

Not surprisingly, I bin these things as soon as I open the box, and charge all my radios with a 12v charging system.

Posted on 1 Comment

Aritech VV602 Vault Vibration Sensor

Here’s a rather unique device for protecting safes & vaults from attack by thefts.

It’s an Aritech VV602 seismic detector, based on piezoelectric sensors. Not surprisingly, this unit is covered in tamper sensors as well. There are several different sensor types in use:

  • Piezoelectric vibration sensing
  • Thermal sensing
  • Magnetic sensing
  • Manual Tamper Switches
Sensor Unit
Sensor Unit

Above is the main unit, with the thermal sensor. This is just a thermal fuse, very commonly used in everything from room heaters to hairdryers. This one triggers at 84°C. The adjustment pot is also visible here.

Mounting Plate
Mounting Plate

Above is the magnetic mounting plate used to attach the device to the safe. These units are apparently mounted over the keyhole of the safe to protect the lock, so they need to be easily removable to access the safe. This is a very strong magnet & it isn’t possible to pull it from a metal object without triggering the sensor.

Piezo Sensor
Piezo Sensor

Above is the piezo vibration sensor, bonded to the backplate. When the unit receives vibration or shock, this transducer generates a voltage, which is fed to the control logic below.

Control Logic
Control Logic

Here’s the reverse of the main PCB with the control logic ICs. These are basic logic gates, with a couple of comparators. One of the tamper switches is in the bottom left corner.

Main PCB
Main PCB

Main PCB with the connection terminals. Another tamper switch is in the top left corner, the solid-state relay is under the shield, next to the magnetic tamper switch. (Reed switch).
Some adjustment is provided for sensitivity. I’ve not found much of a difference in sensitivity though when it’s set to different levels.

Reed Tamper
Reed Tamper

Magnetic reed switch tamper on the right. Main output solid-state relay on the left under the shield.

This unit was given to me after it apparently went faulty. But on applying power it seems to work fine. Must be those experts again 😉

Posted on 1 Comment

MicroVision ShowWX+ HDMI Laser Pico Projector

Info
Info

Here’s the teardown of the projector itself! On the right is the info label from the projector, which covers the flex ribbon to the VGA/composite input board below.

This unit is held together with Allen screws, but is easy to get apart.

 

PicoP Display Engine
PicoP Display Engine

Here’s the insides of the projector, with just the top cover removed. The main board can be seen under the shielding can, the Micro HDMI connector is on the left & the MicroUSB connection is on the right. The USB connection is solely for charging the battery & provides no data interface to the unit.

On top of the main board is the shield can covering the PicoP Display Engine driver board, this shield was soldered on so no peek inside unfortunately!

Laser Module
Laser Module

The laser module itself is in the front of the unit, the laser assemblies are closest to the camera, on the left is the Direct Doubled Green module, in the centre is the blue diode, and the red diode on the right. Inside the module itself is an arrangement of mirrors & beamsplitters, used to combine the RGB beams from the lasers into a single beam to create any colour in the spectrum.

Module Innards
Module Innards

 

Here is the module innards revealed, the laser mounts are at the top of the screen, the green module is still mounted on the base casting.
The three dichroic mirrors in the frame do the beam combining, which is then bounced onto the mirror on the far left of the frame, down below the MEMs. From there a final mirror directs the light onto the MEMs scanning mirror before it leaves through the output window.

A trio of photodiodes caters for beam brightness control & colour control, these are located behind the last dichroic turning mirror in the centre of the picture.

Green Module Cavity
Green Module Cavity

This is inside the green laser module, showing the complexity of the device. This laser module is about the size of a UK 5p coin!

Green Module Labeled
Green Module Labeled

 

 

 

 

 

And here on the left is the module components labelled.

 

Main PCB Top
Main PCB Top

Here is the main PCB, with the unit’s main ARM CPU on the right, manufactured by ST.

User buttons are along the sides.

 

Main PCB Bottom
Main PCB Bottom

Other side of the main board, with ICs that handle video input from the HDMI connector, battery charging via the USB port & various other management.

 

 

Posted on Leave a comment

Cisco 2G Fibre Channel SFP Module

2G Fibre Tranciever
2G Fibre Transceiver

Here is a 2Gbit Fibre Channel transceiver from Cisco Systems in SFP module format.

Shield Removed
Shield Removed

 

 

 

 

 

 

Here the shield has been removed from the bottom of the module (it just clips off). The bottom of the PCB can be seen, with the copper interface on the left & the rubber boots over the photodiode & 850 nm laser on the right.

PCB Bottom
PCB Bottom

Here the PCB has been completely removed from the frame, the fibre ends slide into the rubber tubes on the right.

PCB Top
PCB Top

 

 

 

 

 

Top of the PCB, showing the chipset. There are a pair of adjustment pots under some glue, next to the chipset, presumably for adjusting laser power & receive sensitivity. The laser diode & photodiode are inside the soldered cans on the right hand side of the board, with the optics required to couple the 850nm near-IR light into the fibre.

Posted on 1 Comment

Combo Microwave

Electronics Bay
Electronics Bay

Here are the internals of a cheap Microwave/Convection Oven combo. Electronics bay is pretty much the same as a standard microwave, with the magnetron, transformer & diode/capacitor voltage doubler, with the addition of an extra fan & a pair of nichrome elements to provide the convection oven function.

Convection Fan
Convection Fan

Convection blower which keeps the cooking vapours & smoke away from the elements, & circulates the hot air around the cooking chamber. This is a 12v DC centrifugal type blower.

Convection Element
Convection Element

The elements are inside this steel shield, air duct extends from the centre.

Thermal Cutouts
Thermal Cutouts

This oven has a pair of thermal switches on the magnetron.

Capacitor & Diode
Capacitor & Diode

The usual capacitor/diode voltage doubler in the magnetron power supply. The transformer is visible to the left.

Controller
Controller

Electronic controller PCB. This has a pair of relays that switch the elements & the magnetron transformer.

Posted on Leave a comment

PCMCIA Ethernet Card

Front
Front

An old Xircom Ethernet card for a laptop. This uses the old 50 pin PCMCIA interface.

Rear
Rear

Rear of the card with the MAC address & card spec details.

PCB
PCB

PCB removed from the outer shield. Xircom ethernet chipset centre. Special socket on the right fits a RJ-45 adaptor lead.

Posted on Leave a comment

Garmin eTrex

Front
Front

Pocket sized GPS navigator. Here is shown the greyscale dot matrix LCD.

Interface
Interface

Serial interface on the back of the unit. Pinout from left is +3v, Rx, Tx, GND.

PCB Back
PCB Back

PCB Removed from the casing. RTC backup battery in the centre of board, CPU & flash ROM on the left. GPS chipset is under the shield on the right.

PCB Front
PCB Front

Front of the PCB, GPS antenna on the right, LCD panel left.

LCD Removed
LCD Removed

LCD folded back from the PCB. Driver IC can be seen attached to the ribbon.

Electroluminescent Panel
Electroluminescent Panel

LCD Panel backlight. Requires 200v AC at 20kHz to glow green.

GPS Reciever
GPS Reciever

GPS chipset with the shield removed.

Posted on Leave a comment

Nokia 7110

Front
Front

Another phone from the mid 90s. This is the nokia 7110.

Slider Open
Slider Open

Here the slider is open showing the keypad.

Battery Removed
Battery Removed

Here the battery is removed, a Li-Ion unit.

Battery
Battery

The battery cell & protection circuit removed from the casing.

Rear Of PCB
Rear Of PCB

This is the rear of the PCB removed from the housing. Data & charging ports on the right hand side f the board.

Front Of PCB
Front Of PCB

Front of the PCB with the RF sections at the left hand side & the keypad contacts on the right.

RF Sections
RF Sections

Closeup of the RF sections of the board, big silver rectangular cans are VCO units.

SIM Connector
SIM Connector

Closeup of the top rear section of the PCB, with SIM cnnector, battery contacts, IR tranciever at the far left. Bottom centre is the external antenna connector.

CPU
CPU

The logic section of the board, Large chip is CPU, to right of that is the ROM storing the machine code. Other chips are unknown custom parts.

Mic & Speaker
Mic & Speaker

The Mic & the loudspeaker removed from it’s housing.

LCD
LCD

LCD from the front of the unit, SPI interfaced. Flex PCB also contains the power button, loudspeaker contacts & a temperature sensor.

Scroll Wheel
Scroll Wheel

The scroll wheel removed from the front housing.

Vibra-Motor
Vibra-Motor

Tiny vibration motor removed from the rear housing, alerts the user to a text or phone call.

Posted on Leave a comment

Ericsson GA628

Front
Front

Here is a phone from the mid 90s, the Ericsson GA628. Here visible is the front of the unit with keypad, & single line monochrome LCD for number display.

Battery & Rear
Battery & Rear

Here the battery is removed from the phone, showing the SIM card socket. At the top under the antenna stub is the socket for an external antenna.

Front Removed
Front Removed

Here the front is removed from the phone, PCB on left, rear of keypad on right. Microphone is at bottom of keypad, with speaker at the top. Top right of the PCB is the ringer buzzer, left is shield for RF amplifier.

Main PCB
Main PCB

Here is the back of the main PCB, RF sections on left & centre. Processing & memory on right.

Battery
Battery

This phone had a Ni-Mh battery, before Li-Ion batteries were introduced.

LCD
LCD

The LCD from the front of the phone is shown here. A simple dot matrix single line unit.