Today we’ll be looking an Alcatel Lucent 9361 Home Cell V2 which is used as a small base station to provide your mobile phone with better reception.
A few notches later and we’re in, no screws needed to be removed but it was a bit of a pain to get in.
When you pick up the board it’s a bit heavy compared to other PCBs and straight up we can see 2 metal covers which is what you’d see in mobile phones. There is also a plastic cover as well which is a little strange. On the back of the board we can see that we have some metal blocks and an unpopulated section at the top left, maybe for a micro SD card slot?
At first I thought that the 5. and 6. metal blocks was more shielding but upon closer inspection 6. doesn’t go all the way down to the board, so they must be using them as heatsinks.
We can also see the two antennas, one is mounted on the board which looks like an S, while the other is just on the side of the case with some foam holding it.
1. Passives
Not much here just a lot of passive components.
2. Analog Devices ADC/DAC + 3G Transceiver
The AD9963 has two 10/12bit ADC channels that can run at 100 MSPS and two 10/12bit DAC channels that can run at 170 MSPS with 5 channels of analog auxiliary input/output, AD9961_9963.
The ADF4602 is a Multiband 3G Femtocell Transceiver which is WCDMA/HSPA compatible, ADF4602.
3. Crystal Oscillator
Under the plastic cover there is a crystal oscillator which I’m unsure of the actual frequency of the crystal and on the underside there are some resistors, the copper on the PCB layers under the crystal oscillator have been removed.
4. MXIC 16Mbit Flash
MX25L1606EZN
To remove both heatsinks I increased my soldering iron to 420C.
5. Headpad
Nothing under this one but a heat pad and some thermal paste which would be used to remove heat from the ADC/DAC and 3G transceiver. A bit strange that they didn’t put the heatsink the on IC’s themselves.
6. Mindspeed Picochip ARM Processor
The main processor is a Picochip PC302 and is a 3GPP 3G Home NodeB (HNB) modem, it has a 400MHz clock using the ARM11 architecture and supports up to 4 users on the 3G connection, PC302.
7. Realtek 10/100Mbit Fast Ethernet
The usual Realtek Ethernet adapter chip that almost in every device, RTL8306G.
8. Hynix 2Gbit Nand Flash
HY27UF082G2B
9. Hynix 512Mbit DDR2 SDRAM x 2
H5PS5162FFR
And that’s all there is for this teardown.
Hi,
Where would the firmware be?
MXIC 16Mbit Flash or Hynix 2Gbit Nand Flash ?!!?
I would say the 2Gbit Nand Flash as it seems that more higher consumer devices are increasing their flash size – 256Mbit and higher. Perhaps the 16Mbit Flash is used booting or maybe for user save data?
Hi,
I’m looking for a JTAG on this board, bug it seems that they is not, or I don’t see it.
Did you found sort of JTAG interface?
Al
Hi Al,
Your best bet could be the 14 exposed pins with a “Z” label in the middle (just above the “2” red number which I’ve placed on the bottom of the board. It looks like each second pin in it is ground?
Hi, did you try to connect to these pins? Was it successful try?
I would like to check that does 9631 home cell work with a extended powerline.I had tried plug in but the 2 light is blinking.As for my understanding, it is still not stable. I have another connected to router and it worked well.
Thanks.
Great ! I will look at this Femtocell very soon ;P
Prepare the solder iron 😛
Has anyone had any luck finding a serial port yet?
I looked at TP21- TP25, see the bottom right corner of https://www.insidegadgets.com/wp-content/uploads/2013/01/IMG_2729_1.jpg.
I’m following the tips here; http://www.devttys0.com/2012/11/reverse-engineering-serial-ports/#more-414
I don’t have a scope so I’m just using a multimeter. I found that when booting the device, TP 24 and 25 stay at a constant 0V, TP21 stays at a constant 3.35V, TP22 stays at a constant 2.49V but TP23 fluctuates from 1.32-1.36V.
I was kind of hoping that TP23 would turn out to be a serial TX, but when I connected it up via minicom and an FTDI cable, I got nothing.
Anyone that finds a serial port, please post here. I’m hoping there will be one, there is a very similar product here: https://wiki.thc.org/vodafone where they successfully found a serial port
How do i connect my Virgin phone to a Alcatel 9361 Home Cell, Please?
Hi
I purchased a device (AL 9361 HOME CELL V2GC) from the UK and I live in Israel, apparently Israel (Orange network) is working on another band, is there a way to change the band?
Thanks
Hi,
Did you find a solution? I need the same thing Thanks
manny.kaiser@gmail.com
Hello,
Can anyone measure the size of resistivity R202 in the power supply section? Resistance is 3.6864 MHz crystal neighbor.
Anyone know how to 10x increase the power output to the antenna?
– Use in the cellar and the old house a peripheral wall 1.5 meters thick built of stone material, clasical BTS in my inside house no have signal.
Mobil transmitters typically 23dBm (200mW)
BTS mostly 43-46dBm (20W ~ 40W)
Femtocell transmitter 13dBm (20mW)
I also thought of replacing the original 2 db antenna for the new omni antenna 12 db.
Thank you very much!
Dahlia Cestr – electrical engineer from CeNET.cz
Anybody found firmware for this stuff ?
I’d say that the 16Mbit flash is probably storing calibration data or something of that sort, it’s got epoxy globbed around it to prevent access to the pins (it’s a WSON-8 package so the epoxy isn’t there for infill like it would be if it were a BGA chip)
The reason for the crystal having the resistors on the back is that you need a highly accurate reference in this type of device, basically the resistors are being used as heating elements to keep the crystal at a constant temperature, the slots are there for thermal and mechanical isolation from the rest of the board, U908 is likely a temperature sensor of some description.
Ah makes sense, DIY TXCO module :), thanks for posting!
Almost, it’s an OCXO (Oven Controlled Crystal Oscillator) not a TCXO (Temperature Compensated Crystal Oscillator), similar principle different implementation.
An OCXO is maintained at a very stable temperature above ambient to ensure that the characteristics of the crystal are consistent, whereas in a TCXO you’re actually manipulating the signal out of it to stabilise for temperature (generally by introducing additional devices with the opposite temperature coefficient to that of the crystal into the signal path).
Anyone found out how to activate it on a different provider?