tech.am

Just today UPS dropped off (well, I intercepted the driver in mid-flight, but that’s a different story) the Jawbone Bluetooth headset I was waiting for – and boy, does it work wonders! This has to be the best implemented piece of DSP technology I have seen. If you don’t believe in ‘official’ demos and blurb from jawbone.com (they are true), just check out this audio recording [WAV, 48kHz, 1.7MB]. The first part is recorder using my Mac with an unsquelched radio about 30cm from the headset, with the DSP turned off. I then turn it on, and the audio is recorded perfectly, with barely a hint of the background noise.

How do they do it? I’ve not opened this baby up, as it’s too good-looking (and expensive), but it seems that they combine two directional microphones with a vibration sensor (the small white dot you see on the picture) that picks up bone-transmitted voice from your jaw (thus the name). By matching the vibrations, which are not enough to actually record sound, with the incoming audio from the microphones, they can take away the extra noise very effectively. I should know, as in my previous job, one of our biggest problems was noise and echo cancellation (I was responsible for electronics R&D at SouthWing, designing and testing Bluetooth headsets and other accesories) – and we could never completely kill feedback echo, and noise – forget it. Our designs were in the top league as far as audio quality and noise went, but try what I just did today and the whole recording would have been like the first half.

Good job, Aliph!

You probably have seen the video on YouTube about a molten Fonera, apparently due to overheating, which shows the plastic case completely deformed. Gizmodo (also in spanish) and other sites are also reporting on this. As usual, Fon has censored the post on their forums that broke the story, but alas, thanks to their partners at Google, here is a cached version. Even Martin Varsavsky seems worried about this. It seems the damage is obviously from heat, but could it have come from the Fonera itself?

I, and others, have our doubts about wether this video is a fake stunt, or a true story. It is true that the Fonera overheats, much more than would be expected from a consumer-electronics product, but to the point of causing physical damage to the plastic case?

The heat problem

Heat in electronics mostly comes from dropping voltage by converting current into it, in our case, the voltage regulator in the Fonera drops 5V to 3.3V at 500mA, resulting in the dissipation of 850mW. That’s right, we are dumping 850mW right into the atmosphere in the form of heat. This brings the operating conditions very close to the maximum ratings for this regulator, which has a maximum rated thermal resistance of 90ºC/W, my calculations put the operating conditions at 88ºC/W. Additionally, the wireless section of the Fonera is also converting a lot of energy into heat.

The measurements

After I finished my tests, I got a comment from Pobletewireless, regarding his own measurements of the heat problem, which are shown in very cool thermographs (no pun intended!) – much nicer than my rather rudimentary method.

I measured the temperature of the Fonera using a thermocouple connected to a Fluke 123 Scopemeter via an 80TK thermocouple module. The thermocouple was placed in between the heatsink and RF shield, the case closed, and the Fonera powered, as can be seen in this picture:

After 10 minutes operating normally, the temperature had risen to an average of 72ºC, with a peak of 80ºC.

The second batch of measurements were performed drilling four small holes to allow the thermocouple into the casing, the locations are shown in the following picture:

Maximum temperature at one corner was 43ºC. Next, an attempt was made to melt the white lid of the Fonera, by exposing it to a high temperature airflow from a paint-stripping gun, and at the same time, applying slight pressure from below. The thermocouple was used to measure at which point the plastic became maleable, and deformation started. At around 100ºC, the plastic was soft enough that a solid object could change its shape – this is in line with ABS plastic thermal properties, which state a deflection temperature around 100ºC, depending on specific material composition.

As the deflection point test resulted as expected, the lid was then exposed to an airflow at 280ºC for two minutes. The result of this exposure is shown in the pictures below:

It’s obvious that some deformation has taken place, with discoloration and charring on the point where heat was directly applied. However, the front side of the lid had mostly retained its shape.

Conclusions

The Fonera does indeed run very hot, much hotter than it should, if anything, for the good of the internal parts. Electronic components are sensitive to heat, with maximum ratings given by each manufacturer in terms of storage and operating conditions. The higher the temperature, the lower the service life of any given component. Some are affected more than others, most notably, electrolytic capacitors have a high sensitivity to heat, as it can evaporate the electrolyte quicker, causing it to fail. The capacitors in the Fonera are made by Taicon, a taiwanese manufacturer, and are max-rated for 105ºC. From the datasheet [PDF], at this temperature, the capacitor will fail after some 2000 hours, around 83 days. Following Arrhenius’ Law, and since the area around the capacitors was found to be at around 52ºC, their expected life would be 7800 hours, or about 325 days – what a coincidence, almost a full year, after which your warranty has expired. Comparing the Fonera to a Meraki Mini, one realises that there is a serious design flaw, as apart from the Mini having a switched-mode regulator, the wireless section shares exactly the same design as the Fonera. The temperature measured outside the casing of the wireless section indicates that the junction temperature of the components inside has to be ridiculously high. So, one conclusion is that the Foneras will eventually fail due to overheating, and it will probably happen sooner than later.

On the deformation / melting video – in my opinion, it’s not real. At least, it couldn’t have happened without the Fonera reaching temperatures around the whole casing that would have caused some components to blow up (for example, the capacitors). The Fonera could not have undergone such an extreme temperature, and still function as shown on the video. The temperature gradient between the heatsink and one corner of the case is almost 2:1, thus, to reach a deformation temperature of say 200ºC at the corner, the heatsink must have been running at 400ºC! A final bit of evidence – the sticker. If you look closely at the video, the sticker on the bottom of the Fonera looks almost unscathed. Here is a picture of what it looks like after applying a 250ºC airflow for 30 seconds, which causes the plastic to deform:

Obviously, a more prolongued exposure would have damaged it even more. In all honesty, I would love to get more details from the guy who made the video, as it stands right now, I’d call it a hoax.

Reading an article in The Register by Bill Ray, he thinks the Apple iPhone will fail, actually, fail badly. I somewhat doubt his conclusions.

The main argument to support his analysis is that since network operators have to like the phone, then Apple has to do a good job convincing them. Remember the ROKR? It was rather a failure due to the fact it could only be loaded with iTunes music over cable, and thus mobile operators were left out of attractive data chargers levied when buying music directly from the phone. There was even speculation that Apple allowed it to launch on purpose, to protect their audio player market.
Where Bill goes wrong in my opinion is that the handset market is heavily controlled in the US, but not in Europe – go to any shop in the latter and you will have a very large variety of handsets to buy unsubsidized. Why? Because a lot of people value the ability to switch operators as they see fit, without having to enter into contracts involving their soul. In the US, there isn’t a culture of operator hopping, but rather of staying with one just to get a phone $50 or $100 cheaper.

One thing I have never understood is why people get themselves tied into a two year contract for a $50 saving. If they worked out how much they could save by moving operators taking advantage of special offers, they may think twice.

There is a very large number of paths Apple could follow, first, they have a nice distribution network with excellent shops placed in key areas, second, they have a large and loyal crowd of followers, who would probably not mind paying an unsubsidized device, and third, there are already a number of MVNOs and fixed-line operators that are willing to take a bite from the large networks. As for the subsidy, I wonder…are iPods subsidized by anyone? Apple costumers are used to pay for quality, and in my view, the iPhone will be no different.

The guys at Pobletewireless have been busy with the Fonera lately, and have now posted a step-by-step hack to add a DB9 connector that allows easy access to the built-in serial port, without having to make IDC cable headers and so on. [Link]

The hack gives access to the console, with which you can do all sorts of nice and interesting things.

Went to my local Vodafone store to pick up the new Huawei E220 HSDPA USB modem, which with a 49 Euro monthly contract gives you 1GB of transfer at 1Mbps maximum, and free mobile to fixed landline calls – pretty good deal if you ask me. For 59 Euro you get 5GB of transfer, at the full 3.8Mbps that HSDPA offers. These are theoretical rates, as they will depend on a number of factors, such as how many people are also using the same cell, your coverage and the quality of the link.
We can argue all we want about how convenient WiFi is, being omnipresent et al, but in reality, it’s rather hard to get connected while on the road. Let’s examine the following scenarios, and you tell me the chances of getting connected over WiFi:

• Riding the train or bus home.
• Getting a lift from a friend in his/her car.
• Opening your laptop at a random location (cafeteria, bar, etc. that you haven’t before scouted for open WiFi).
• On a plane, waiting for the next free takeoff slot that you hope the pilot won’t miss because he was checking the fatness of his wallet.

Let’s be honest – free open WiFi is great once you have identified the locations where you can get connected, such as a friend’s house or the local coffee shop. Other solid commercial alternatives make it easier to find WiFi, as they tend to be present at well-known locations. Walk into any Starbucks or hotel, and you’re bound to find at least for-pay wireless.
For me, on the 30 minutes to 1 hour it takes to get home on the train or bus, being able to get connected is great. The convenience of simply opening the Mac and getting online beats the guesswork of WiFi. I tried getting the Mac working with my Nokia N93 over Bluetooth, but it was just too unstable – one day it worked, the next simply refused to even connect. A more in-depth review of the device is coming, once I get a chance to roam about with it for a while.

So far, installation on the Mac was pretty straightforward, download the setup package from Vodafone’s site (they don’t tell you this in the manual), which then enables the modem as a networking device. If you don’t follow this step, it can get recognized as a storage device, which is not particularly useful for a modem. The one thing I don’t understand is why it comes with a miniUSB cable that ends in two USB connectors, my guess is it’s power-related (some USB ports don’t provide the full 500mA they are supposed to provide).

Yesterday, I posted a few pictures of the opened Fonera, with a few initial views on the device. When I tried to plug it in, it failed to work, only the power LED lighting up. Neither the WiFi signal was coming up, nor the ethernet port was tickling the switch.

The only course of action? To open it up even more. So, the aluminium chassis came off, and that’s when I realized I had seen this before. The WiFi section, which includes the Atheros AR2315, crystal, filters, power amplifiers and ancilliary circuitry are housed inside this casing, and correspond to a reference design provided most likely by Atheros themselves. Check out the Meraki Mini router. For reference, I provide a side-by-side picture below (click for large image).

This is further confirmed by looking closely at the Atheros website section on the AR2315, where we find the following picture:

There is nothing wrong with using reference designs per se, as it is the fastest and easiest way to bring a product to market. If you don’t need to customize your design much, simply use what the manufacturer suggests, and you will be playing on the safe side. A perfect example is Bluetooth headsets, where CSR dominates the market. Virtually all headsets in the market use their reference design, with very little changes between them, other than physical placement of LEDs and buttons.

Block-by-block, here is an overview of the Fonera.

Power

Power is supplied to the Fonera via jack SK1, and is fed through a rapid fuse (Polychem type) to a simple drop-down regulator, which drops voltage from around 5V (4.85V as measured on the wall power supply, using a Fluke 179 multimeter) to 3.3V. The regulator appears to be an AME1117 (though the package markings read AME117), in its CCCT configuration, TO-252 form factor. The regulator is stabilized using three electrolyic capacitors. In these types of regulators, ESR (equivalent series resistance) of the input decoupling capacitors is very important, and this can usually be controlled nicely with tantalum capacitors. These are very expensive compared to electrolytic, however.

There is a second stage of regulation, this time done by an Anpec APL1117, which further drops the voltage to 2.5V. This supply appears to be used by the wireless subsection. Two ceramic capacitors stabilize the regulator.

Without the Atheros chip in place, the PCB drew 90mA at 5V, or 450mW. Since the device was not functioning, the total supply current with WiFi active could not be determined.

Memory

Two memory ICs are available on the Fonera, the first is an ST M25P64 serial flash, with a 50MHz SPI bus and 64Mbit capacity (8MB), in 300mil SO16 format. The fact that SPI has been chosen has the advantage that extra memory devices could be attached to the bus, but it has the caveat that it is slower than a parallel bus. Thus, flashing a new firmware could take a rather long time. Interestingly, there are two footprints on the PCB, presumably to fit a different size and format memory IC, one SO16 and one SO8.
The second memory IC is a Hynix HY57V281620E synchronous DRAM, with a capacity of 128Mbit organized in 16bit blocks. In practice, this results in 16MB of RAM available to the processor.

Ethernet

At the heart of the wired ethernet subsystem is an Altima AC101 ethernet transceiver, capable of 10/100 full duplex operation. The IC is placed on the bottom layer of the PCB, and runs off a 25MHz crystal, strangely placed next to the main power regulator, where it could absorb electrical noise. Usually, crystals are placed well away from sources of interference. Nothing else too exciting here, the transceiver is connected to a standard RJ45 socket, TP1.

Wireless

The wireless section is the most interesting. This is where the Atheros AR2315 single-chip WiFi processor lives. Little public information is available about this or any other Atheros chipset, so it is hard to figure out exactly how it is put in place, but a few details are clear.

First, the chip gets hot. This is why a double heat-conductive adhesive tape bonds the surface to the metal cover, and in turn to the heatsink placed on top. The processor runs from a 40MHz clock source. After the Atheros core, come a couple of filters, and a power amplifier stage. This then runs off to the two antenna tracks. The first antenna exits the aluminium cage and runs up to a test connector. This connector breaks the antenna track when the right mating plug is inserted, which is then fed into a dedicated RF analyzer, which validates that the device is within constraints.

After the antenna test point, there is a split, which can be configured using a zero-ohm resistor, to run to an internal solder pad, or to a PCB-mounted right-angle SMA connector. It is unclear why they chose to use the solder pad, as an in-place soldered connector needs less handling than soldering a pigtail by hand. Besides, my intuition tells me the losses would be lower – I will test this when I get a working Fonera. Both tracks run through an impedance matching network, consisting of two capacitors to ground from the RF track, and an inductor between the capacitors . The purpose if this small circuit is to get the impedance of the PCB track as close to 50 ohms as possible. If the track impedance is mismatched to the antenna, losses take place.

The second antenna runs straight to a PCB pad, where a pigtail may be soldered, also passing a matching network. Below is a picture showing the details of this subsection.

Interfaces

There are two IDC-style connectors on the PCB, one 2×5, and one 2×7 but unpopulated. The 2×5 looks like a serial connector, as only power, ground and two tracks lead out from it. The layout has to be studied in more detail to confirm this assumption.
It can be speculated that this is in fact a serial port, but without the AR2315 pinout, this cannot be determined for sure. The 2×7 header seems to be a JTAG interface, possibly compliant with MIPS EJTAG 2.6. The mapping of the header pins to the AR2315 BGA balls is shown below (thanks for adding a row/column silkscreen for the Atheros chip, and thanks to the OpenWRT project wiki for the JTAG information!):

Between the Ethernet jack and the empty SMA footprint, there is a footprint of 6-way header, which needs a bit more study to determine where it leads internally [I will update the post when I find out –Mike].

Conclusion

This is a very compact and simple WiFi router, designed not for being easy to hack, but for lowest cost. The cheap power regulator, use of large SMDs and choice of pigtail rather than board-mounted SMA connector point in this direction. There is only one port which could be used for something useful, if it is indeed a serial port, the only two GPIOs available being the WLAN and Ethernet LEDs – as long as the Ethernet LED is not controlled by the Altima but by the Atheros. The power LED is on as long as there is power applied to the device, so there is no control over this by the Atheros processor. Power consumption is a bit high, considering the wireless device was not present. The PCB layout is very professional, except in a few particular cases such as the large crystal, but overall, quite nice.

In all, a very small device which could have a lot of potential, had it not been for its lack of I/O. It is unclear whether the router will accept custom firmware, as there are rumors that an encryption & signature system is used. The Fonera is probably OK for regular use by Foneros, but it does not have the hackable edge of the Linksys WRT54Gx. The only suprise could come from the edge connector, as of yet of unknown usefulness.

References

Atheros AR2315 chipset website section and product brief.

After a few days of silence, digesting the hubbub created by my analysis of Fon’s status, I’ve put my head back into more useful things than answering hate mail and out-of-line comments (thanks to those who provided balanced views, either for or against!). So, I decided to open a Fonera and see what lives inside.

A full review is coming, but first impressions:

• The plastic casing looks and feels very nice, the molds must have been expensive, as the different parts mate very well.
• Inside lives a single PCB, with components on both sides. The top holds the bulkier components, such as power regulator, RAM and WiFi section, inside an aluminium RF shield.
• The PCB looks professional and well laid out on first inspection.
• Components used (I haven’t opened the aluminium chassis yet) are older SOIC and TSSOP, thus cheaper to handle and solder. Balled components require from special handling, such as baking in hydrogen for 24 hours to dry them before soldering, etc.

Here are some pics (click each photo for bigger views on Flickr) I have taken with a Nokia N93 (really nice phone btw, mini-review coming):

The underside of the case, with screws off.

Perspective view of the top PCB.

Bottom side of the PCB.

Sticker on the flash IC showing the firmware version.

Yesterday I read some news about Chumby, a new WiFi device being released soon, costing $150, and which looks like an alarm clock on steroids. It features a color screen, the ability to run widgets, hackable hardware, and a squishterface (just made that up, to try to describe the squeeze sensor that the soft case uses to provide user input).

The company behind the Chumby actively promotes hacking the product in any way you want, so this could become another Roomba, albeit cooler (yes, I know, the Roomba moves, so what!). I have signed up to try and get an early sample, let’s see if they consider my arguments.

A few words of constructive criticism – when creating an account, the country drop-down list is not in alphabetical order, so you spend quite a bit of time trying to find yours (US users will have it easy, as it is the default). Additionally, once the steps are completed, you are asked to enter the device ID and give it a name, after which you end up staring at a white page with the big black words: “Application error (Rails”. Whatever that means.

People use USB WiFi adapters for a number of reasons, maybe their laptop doesn’t have built-in WiFi, or like me, there are no cards yet available that fit the tiny pseudo-PCMCIA slot of the MacBook Pro. Yes, I know the MBP has built-in WiFi, but my personal interest and professional activity involve using WiFi in alternative ways, so I need to test antennas, adapters, software and so on.

A few weeks ago, I bought a D-Link DWL-G122, the thought being that since it could be connected to a long USB extension cable, there wouldn’t be any of the RF losses associated to coaxial cables – and so I could go wardriving with a potentially better setup than the usual PCMCIA card with a pigtail and coax running to a roof-mount antenna. And I was wrong. The results were appaling – even the Vaio’s internal IPW2200 card was much better, detecting over twice as many access points as with the D-Link.

How could this be? Logically, having the antenna attached directly to the RF port of the WiFi adapter should reduce loss considerably – but it wasn’t the case. To be sure, I went shopping again, and this time bought a Conceptronic C54RU. One would think that the D-Link, costing around 39$, would have better performance, since the Conceptronic only cost me 25$ – there just had to be something there to justify the price difference. To my surprise, performance was almost identical. This prompted me to pry open the two adapters, and this is what I found:

No, I didn’t just photoshop a clone of the first PCB. It is the same PCB for both adapters – which means that some OEM/ODM company is manufacturing these devices, and selling them in customized plastics to whoever wants them. Paying attention to quality? Probably not their very first priority.

The next two photographs show a little explanation on the structure of the RF section of these adapters. Do not confuse the PCB antenna as a diversity arrangement, it is basically a center-fed dipole. The designer paid no attention to the large mass of grounding material right next to the large pads of the antenna, and the matching circuit could probably not do much to alleviate the poor design. Here is the actual stripline [click the image for a larger version]:

And the test connector:

Bottom line: if you are close to your access point, and don’t really care about the range and quality of the link, this may be the adapter for you. But, if your intention is to take these devices for a wardrive, well, don’t.

Last night I was watching a DVD on my MacBook Pro, and remembered that I still kept a Motorola Bluetooth stereo headset from the time I was working at SouthWing and we designed such devices.

Bluetooth stereo headsets use a profile called Advanced Audio Distribution Profile (A2DP), which allows them to receive medium-quality audio at 16kHz from compatible devices. Most USB Bluetooth dongles sold recently have the profile in their drivers, and there are some mobile phones from Nokia, Samsung and Motorola that also feature this profile. The advantage is that you can listen to music wirelessly, and also control the player from the headset, as they feature the usual forward, back, play and pause controls.

Once I found the headset, I switched on Bluetooth on the Mac, and started the pairing process. The headset was recognised just fine, and pairing completed, but I noticed that it had been connected as a Handsfree device, with A2DP nowhere to be found. Since there doesn’t seem to be a method of connecting the headset permanently, so the audio is always routed from the Mac to it, the attempt was frustrated – I couldn’t even listen to the DVD in low-quality audio.

Why has Apple left out this profile, is it a blunder, or a calculated approach? As to this date, Apple doesn’t manufacture or resell any Bluetooth wireless headsets (only one can be found at their store, and it comes with a dongle for the iPod, so it doesn’t count). So, why would they have an interest in adding the A2DP profile, so that we could use any other headset? If they are in the process of designing their own, they might want to keep the profile away from Macs until they launch it.

Then again, if we give Apple a vote of confidence that they are not that insidious, it could be a blunder. And a big one. Windows has been able to work with A2DP headsets since late 2005, so they have had plenty of time to add the profile to their Bluetooth stack.

A few myths and facts about Bluetooth, versions and profiles for the curious:

1. Profiles are mostly independant of the Bluetooth version. It is perfectly possible to have A2DP in a V1.2 Bluetooth device, just the same as a V2.0 + EDR can have just two profiles and miss many of the usual ones – the mix is up to the manufacturer and driver supplier.

2. EDR stands for Enhanced Data Rate – this does not increase the range, just increases data throughput from around 700kbps to around 2.1kbps, by using a different modulation scheme. The Bluetooth protocol and profiles stay just the same – the advantage is that since data takes almost 1/3rd of the time to send compared to non-EDR devices, there is a considerable power consumption reduction.

3. “Device Y doesn’t support profile Z”. Again, this is up to the manufacturer, and it’s hard to add new profiles, specially in embedded devices. Some chipsets use masked ROM, which means that the Bluetooth stack, profiles and other settings are burned at the time the silicon is printed – so, no software updating on these. Masked ROM is considerably cheaper, although has an initial setup cost of $100.000, so it’s only good for high-volume production runs. The chips can drop $1 to $2 compared to the flash EEPROM counterparts.

As an example of a very poorly implemented Bluetooth solution we can find the Logitech MX5000 keyboard and mouse combo – it sucks. A lot. I am preparing a review that will try to investigate why it does the stupid things it does, such as repeating the first letter you type when it wakes up a dozen times, or why the mouse starts wondering around the screen as if it was possessed by a poltergeist.